@awesomate/hosting-mcp 0.6.2 → 0.7.1

package/skill/awesomate-hosting/scripts/deploy.sh

@@ -52,18 +52,17 @@ done
   echo "--from wp-content looks empty (no themes/ or plugins/). Refusing to --delete against live."; exit 1; }
 case "$DOMAIN" in *[!a-z0-9.-]*|"") echo "Invalid --domain."; exit 1;; esac
 
-# Read connection details + PAT (node is present wherever the MCP runs).
-# Capture first, THEN eval — so a no-shell plan (node exits 2) aborts here with
-# its own message instead of leaving $U/$P/… unset for `set -u` to trip on later.
-if ! CREDS_EVAL="$(node -e '
-const c = require(process.env.HOME + "/.awesomate/credentials.json");
-if (!c.ssh) { console.error("Your plan does not include shell access (Support Plus+ required)."); process.exit(2); }
-const q = (s) => "'"'"'" + String(s == null ? "" : s).replace(/'"'"'/g, "") + "'"'"'";
-console.log(`H=${q(c.ssh.host)}; U=${q(c.ssh.user)}; P=${q(c.ssh.port||22)}; K=${q(c.ssh.keyPath)}; API=${q(c.apiBase)}; PAT=${q(c.pat)}`);
-')"; then
+# Resolve the account (folder pin / AWESOMATE_ACCOUNT / sole profile) and its
+# connection details + PAT via the shared resolver (node is present wherever
+# the MCP runs). Capture first, THEN eval — so a resolver failure (no-shell
+# plan exits 2, unpinned multi-account exits 1) aborts here with its own
+# message instead of leaving $U/$P/… unset for `set -u` to trip on later.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if ! CREDS_EVAL="$(node "$SCRIPT_DIR/resolve-account.mjs" --ssh --api)"; then
   exit 1
 fi
 eval "$CREDS_EVAL"
+echo "→ account: $ACCT"
 
 # Harden every credentials-derived field BEFORE it reaches ssh/rsync/scp. rsync
 # re-tokenizes its -e remote-shell string on whitespace (ignoring shell quotes),

package/skill/awesomate-hosting/scripts/pull-live.sh

@@ -25,15 +25,13 @@ done
 [ -n "$DOMAIN" ] && [ -n "$TO" ] || { echo "Usage: pull-live.sh --domain <live-domain> --to <local-dir> [--docroot PATH]"; exit 1; }
 case "$DOMAIN" in *[!a-z0-9.-]*|"") echo "Invalid --domain."; exit 1;; esac
 
-if ! CREDS_EVAL="$(node -e '
-const c = require(process.env.HOME + "/.awesomate/credentials.json");
-if (!c.ssh) { console.error("Your plan does not include shell access (Support Plus+ required)."); process.exit(2); }
-const q = (s) => "'"'"'" + String(s == null ? "" : s).replace(/'"'"'/g, "") + "'"'"'";
-console.log(`H=${q(c.ssh.host)}; U=${q(c.ssh.user)}; P=${q(c.ssh.port||22)}; K=${q(c.ssh.keyPath)}`);
-')"; then
+# Shared resolver: folder pin / AWESOMATE_ACCOUNT / sole profile → ssh block.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if ! CREDS_EVAL="$(node "$SCRIPT_DIR/resolve-account.mjs" --ssh)"; then
   exit 1
 fi
 eval "$CREDS_EVAL"
+echo "→ account: $ACCT"
 
 # Harden credentials-derived fields before they reach rsync/scp/ssh — rsync
 # word-splits its -e remote-shell string, so whitespace here could inject ssh

package/skill/awesomate-hosting/scripts/resolve-account.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+/**
+ * Shared account resolver for the awesomate-hosting skill scripts.
+ *
+ * Mirrors the MCP server's precedence exactly (mcp/src/config.ts):
+ *   AWESOMATE_ACCOUNT env → .awesomate.json pin (walked up from cwd, stopping
+ *   at $HOME) → sole profile → defaultProfile → legacy v1 top-level fields.
+ * A pin naming a missing profile is a hard error — never a silent fallback.
+ *
+ * Prints shell-eval assignments (single-quoted, quote-stripped values — same
+ * hardening contract the callers' charclass gates assume):
+ *   node resolve-account.mjs --ssh   # ACCT + H/U/P/K
+ *   node resolve-account.mjs --api   # ACCT + API/PAT
+ * Flags combine. Exit 1 = no resolvable account, exit 2 = no shell access.
+ */
+
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+
+function readJson(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch { return null; }
+}
+
+function fail(msg, code = 1) { console.error(msg); process.exit(code); }
+
+const credPath = join(homedir(), '.awesomate', 'credentials.json');
+const file = readJson(credPath) ?? {};
+
+const profiles = {};
+if (file.profiles && typeof file.profiles === 'object') {
+  for (const [key, profile] of Object.entries(file.profiles)) {
+    if (profile && typeof profile.pat === 'string') profiles[key] = profile;
+  }
+} else if (typeof file.pat === 'string' && file.pat) {
+  profiles[file.slug || 'default'] = file; // legacy v1 single-account file
+}
+const names = Object.keys(profiles);
+
+function findPin() {
+  const explicit = process.env.AWESOMATE_PIN_FILE;
+  if (explicit) return existsSync(explicit) ? explicit : null;
+  const home = resolve(homedir());
+  let dir = resolve(process.cwd());
+  for (;;) {
+    const candidate = join(dir, '.awesomate.json');
+    if (existsSync(candidate)) return candidate;
+    if (dir === home) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+let key = null;
+if (process.env.AWESOMATE_ACCOUNT) {
+  key = process.env.AWESOMATE_ACCOUNT;
+  if (!profiles[key]) {
+    fail(`AWESOMATE_ACCOUNT="${key}" has no matching profile in ${credPath}. Available: ${names.join(', ') || '(none)'}.`);
+  }
+} else {
+  const pinPath = findPin();
+  if (pinPath) {
+    const pin = readJson(pinPath);
+    key = pin && typeof pin.account === 'string' ? pin.account : null;
+    if (!key) fail(`${pinPath} exists but has no "account" field. Expected: {"account": "<slug>"}.`);
+    if (!profiles[key]) {
+      fail(
+        `This folder is pinned to account "${key}" (${pinPath}) but no matching profile exists in ${credPath}. ` +
+          `Available: ${names.join(', ') || '(none)'}. Connect "${key}" from hub.awesomate.ai/sites (logged in as it) or fix the pin.`,
+      );
+    }
+  } else if (names.length === 1) {
+    key = names[0];
+  } else if (file.defaultProfile && profiles[file.defaultProfile]) {
+    key = file.defaultProfile;
+  } else if (names.length === 0) {
+    fail('Not connected. Run the Connect Claude Code setup from hub.awesomate.ai/sites.');
+  } else {
+    fail(
+      `Multiple accounts are connected (${names.join(', ')}) and this folder isn't pinned to one. ` +
+        'Create .awesomate.json {"account": "<slug>"} in the project root or set AWESOMATE_ACCOUNT.',
+    );
+  }
+}
+
+const profile = profiles[key];
+const q = (s) => "'" + String(s == null ? '' : s).replace(/'/g, '') + "'";
+const out = [`ACCT=${q(profile.slug ?? key)}`];
+if (process.argv.includes('--ssh')) {
+  if (!profile.ssh) fail('Your plan does not include shell access (Support Plus+ required).', 2);
+  out.push(`H=${q(profile.ssh.host)}`, `U=${q(profile.ssh.user)}`, `P=${q(profile.ssh.port || 22)}`, `K=${q(profile.ssh.keyPath)}`);
+}
+if (process.argv.includes('--api')) {
+  out.push(`API=${q(profile.apiBase || 'https://hub.awesomate.ai')}`, `PAT=${q(profile.pat)}`);
+}
+console.log(out.join('; '));

package/skill/awesomate-hosting/scripts/ssh-connect.sh

@@ -8,12 +8,12 @@ set -euo pipefail
 CRED="$HOME/.awesomate/credentials.json"
 [ -f "$CRED" ] || { echo "Not connected. Run bootstrap first (Connect Claude Code on hub.awesomate.ai/sites)."; exit 1; }
 
-# Parse the ssh block with node (present wherever the MCP runs via npx).
-eval "$(node -e '
-const c = require(process.env.HOME + "/.awesomate/credentials.json");
-if (!c.ssh) { console.error("Your plan does not include shell access (Support Plus+ required)."); process.exit(2); }
-const q = (s) => "'"'"'" + String(s).replace(/'"'"'/g, "") + "'"'"'";
-console.log(`H=${q(c.ssh.host)}; U=${q(c.ssh.user)}; P=${q(c.ssh.port||22)}; K=${q(c.ssh.keyPath)}`);
-')"
+# Resolve WHICH account (folder pin / AWESOMATE_ACCOUNT / sole profile) and its
+# ssh block via the shared resolver. Capture then eval so a resolver failure
+# aborts with its own message instead of tripping set -u later.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if ! CREDS_EVAL="$(node "$SCRIPT_DIR/resolve-account.mjs" --ssh)"; then exit 1; fi
+eval "$CREDS_EVAL"
+echo "→ account: $ACCT" >&2
 
 exec ssh -i "$K" -p "$P" -o StrictHostKeyChecking=accept-new "$U@$H" "$@"

package/skill/awesomate-n8n/SKILL.md

@@ -20,7 +20,13 @@ promote back, and delete drafts — via the `awesomate_n8n_deploy` and
 
 ## 0. First run (every session)
 
-Call `awesomate_n8n_context` once before any n8n work and cache the result:
+Run `awesomate_whoami` first — n8n tools act on whichever ACCOUNT this folder
+resolves to (folder `.awesomate.json` pin / `AWESOMATE_ACCOUNT` / sole
+profile; see the awesomate-hosting skill's multi-account section). If the slug
+isn't the instance the user means, stop and fix the pin/connection before any
+n8n work. Every tool response is stamped `account: <slug>` — watch it.
+
+Then call `awesomate_n8n_context` once before any n8n work and cache the result:
 
 - `consented: false` → give the user the `settingsUrl` link (Settings →
   Privacy → "Allow Claude Code to Build n8n Workflows"), wait for them to
@@ -40,8 +46,11 @@ $env, `$json.body`, task-runner limits, activation semantics).
 
 ## 1. Reads
 
-PAT as `Authorization: Bearer <pat>` (from `~/.awesomate/credentials.json`)
-against `apiBase`. Never echo the PAT into the conversation.
+PAT as `Authorization: Bearer <pat>` against `apiBase`. Resolve the ACTIVE
+profile's pat — `node ~/.claude/skills/awesomate-hosting/scripts/resolve-account.mjs --api`
+— never read `credentials.json`'s top-level `pat` directly when a `profiles`
+map exists (it mirrors the default profile, not necessarily this folder's
+account). Never echo the PAT into the conversation.
 
 | What | Endpoint |
 |---|---|