@awesomate/hosting-mcp 0.67.0 → 0.68.0

package/dist/index.js

@@ -40110,6 +40110,227 @@ function hubPatch(config3, path, jsonBody = {}) {
 function hubDelete(config3, path, jsonBody) {
   return hubRequest(config3, "DELETE", path, jsonBody);
 }
+function serverMessage(body, status, fallback) {
+  const msg = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : body && typeof body === "object" && "error" in body && typeof body.error === "string" ? body.error : `${fallback} (${status})`;
+  return /[.!?]$/.test(msg) ? msg : `${msg}.`;
+}
+async function readBody(res) {
+  const text = await res.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return text;
+  }
+}
+async function hubUploadRaw(config3, path, file) {
+  const { openAsBlob } = await import("node:fs");
+  const blob = typeof openAsBlob === "function" ? await openAsBlob(file.localPath, { type: file.contentType ?? "application/octet-stream" }) : new Blob([await (await import("node:fs/promises")).readFile(file.localPath)], {
+    type: file.contentType ?? "application/octet-stream"
+  });
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 6e5);
+  let res;
+  try {
+    res = await (0, import_undici.fetch)(`${config3.apiBase}${path}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${config3.pat}`,
+        "Content-Type": blob.type || "application/octet-stream",
+        "Content-Length": String(blob.size)
+      },
+      body: blob,
+      signal: controller.signal,
+      dispatcher: proxyDispatcher
+    });
+  } catch (err) {
+    const aborted2 = err instanceof Error && err.name === "AbortError";
+    throw new HubApiError(
+      aborted2 ? "The upload timed out after 10 minutes. Try a smaller file, or upload it in the hub at Knowledge, Files." : `Could not reach the Awesomate hub at ${config3.apiBase} to upload. This is a connectivity issue, not an auth problem.`,
+      0,
+      null
+    );
+  } finally {
+    clearTimeout(timer);
+  }
+  const body = await readBody(res);
+  if (!res.ok) throw new HubApiError(serverMessage(body, res.status, "Upload failed"), res.status, body);
+  return body;
+}
+async function hubDownloadToFile(config3, path, localPath) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 6e5);
+  try {
+    let res;
+    try {
+      res = await (0, import_undici.fetch)(`${config3.apiBase}${path}`, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${config3.pat}` },
+        signal: controller.signal,
+        dispatcher: proxyDispatcher
+      });
+    } catch (err) {
+      const aborted2 = err instanceof Error && err.name === "AbortError";
+      throw new HubApiError(
+        aborted2 ? "The download timed out after 10 minutes." : `Could not reach the Awesomate hub at ${config3.apiBase} to download. This is a connectivity issue, not an auth problem.`,
+        0,
+        null
+      );
+    }
+    if (!res.ok || !res.body) {
+      const body = await readBody(res);
+      throw new HubApiError(serverMessage(body, res.status, "Download failed"), res.status, body);
+    }
+    const { createWriteStream } = await import("node:fs");
+    const { rename, rm } = await import("node:fs/promises");
+    const { Readable } = await import("node:stream");
+    const { pipeline } = await import("node:stream/promises");
+    const tmp = `${localPath}.part-${process.pid}-${Date.now()}`;
+    let bytes = 0;
+    const counted = Readable.fromWeb(res.body);
+    counted.on("data", (chunk) => {
+      bytes += chunk.length;
+    });
+    try {
+      await pipeline(counted, createWriteStream(tmp, { flags: "wx" }));
+      await rename(tmp, localPath);
+    } catch (err) {
+      await rm(tmp, { force: true });
+      throw err;
+    }
+    return bytes;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/files.ts
+var FILES_ACTIONS = [
+  "status",
+  "list",
+  "search",
+  "download",
+  "upload",
+  "mkdir",
+  "move",
+  "make_public",
+  "make_private",
+  "delete"
+];
+var FILES_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+var TOP = ["public", "private", "temp"];
+function filesPath(raw, what = "path") {
+  const p = String(raw ?? "").trim().replace(/^\/+/, "").replace(/^files\//, "");
+  const top = p.split("/")[0];
+  if (!p || !TOP.includes(top)) {
+    throw new Error(`${what} must start with public/, private/ or temp/ (got "${raw ?? ""}"). Paths are relative to the account's files folder.`);
+  }
+  return p;
+}
+function swapTopFolder(path, to) {
+  const rest = path.split("/").slice(1).join("/");
+  if (!rest) throw new Error(`"${path}" is a top folder. Name the file or folder inside it.`);
+  return `${to}/${rest}`;
+}
+function uploadTarget(dest, localName) {
+  const d = filesPath(dest, "path");
+  if (d.endsWith("/") || TOP.includes(d)) return `${d.replace(/\/$/, "")}/${localName}`;
+  return d;
+}
+var q = (params) => Object.entries(params).filter(([, v]) => v !== void 0 && v !== "").map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+var PUBLIC_NOTE = "A file in public/ can be read by anyone who has its public_url, with no login. Files in private/ and temp/ are never served publicly.";
+async function filesAction(config3, args) {
+  switch (args.action) {
+    case "status": {
+      const caps = await hubGet(config3, "/api/files/capabilities");
+      if (!caps.enabled) {
+        const why = !caps.planEligible ? "Files comes with Support Plus, Pro and Embedded. Relay that honestly (hub.awesomate.ai/billing) and let the user decide." : !caps.variantEligible ? "Files needs a one-time switch of their automation account, which the owner starts in the hub at Knowledge, Files (a short restart). Never start it for them." : `The owner has not switched on "Open your automation account's file folders" in Settings, Privacy. Only they can switch it on; never do it for them.`;
+        return { ...caps, note: why };
+      }
+      const usage = await hubGet(config3, "/api/files/usage");
+      return { ...caps, usage, note: PUBLIC_NOTE };
+    }
+    case "list": {
+      const path = args.path ? filesPath(args.path) : "";
+      return { ...await hubGet(config3, `/api/files?${q({ path })}`), note: PUBLIC_NOTE };
+    }
+    case "search": {
+      const out = await hubGet(
+        config3,
+        `/api/files/search?${q({ q: args.q ?? "", top: args.top, exts: args.exts?.join(",") })}`
+      );
+      return out.truncated ? { ...out, note: "Only the first 200 matches came back. Narrow the search (a longer name, a top folder or file types) before saying something is not there." } : out;
+    }
+    case "download": {
+      const path = filesPath(args.path);
+      const { resolve: resolve3, basename, join: join4 } = await import("node:path");
+      const { existsSync: existsSync3, statSync } = await import("node:fs");
+      const { homedir: homedir4 } = await import("node:os");
+      const name = basename(path);
+      const raw = args.to ? args.to.startsWith("~") ? join4(homedir4(), args.to.slice(1)) : args.to : name;
+      let target = resolve3(raw);
+      if (existsSync3(target) && statSync(target).isDirectory()) target = join4(target, name);
+      if (existsSync3(target) && !args.overwrite) {
+        throw new Error(`${target} already exists on this computer. Ask the user, then pass overwrite: true or a different "to".`);
+      }
+      const bytes = await hubDownloadToFile(config3, `/api/files/stream?${q({ path, disposition: "attachment" })}`, target);
+      return { downloaded: path, savedTo: target, bytes };
+    }
+    case "upload": {
+      if (!args.localPath) throw new Error('upload needs localPath (the file on this computer) and path (where it goes, e.g. "public/images/").');
+      const { resolve: resolve3, basename, join: join4 } = await import("node:path");
+      const { existsSync: existsSync3, statSync } = await import("node:fs");
+      const { homedir: homedir4 } = await import("node:os");
+      const abs = resolve3(args.localPath.startsWith("~") ? join4(homedir4(), args.localPath.slice(1)) : args.localPath);
+      if (!existsSync3(abs)) throw new Error(`No file at ${abs}. Prefer an absolute path: this server's working directory may differ from the user's shell.`);
+      const st = statSync(abs);
+      if (!st.isFile()) throw new Error(`${abs} is not a file. Upload one file per call.`);
+      if (st.size > FILES_MAX_UPLOAD_BYTES) {
+        throw new Error(`${basename(abs)} is ${(st.size / 1024 / 1024).toFixed(1)} MB, over the 50 MB limit for one upload. Compress or split it.`);
+      }
+      const target = uploadTarget(args.path ?? "", basename(abs));
+      const out = await hubUploadRaw(
+        config3,
+        `/api/files?${q({ path: target, overwrite: args.overwrite ? "1" : void 0 })}`,
+        { localPath: abs }
+      );
+      return target.startsWith("public/") ? { ...out, note: PUBLIC_NOTE } : out;
+    }
+    case "mkdir":
+      return hubPost(config3, "/api/files/mkdir", { path: filesPath(args.path) });
+    case "move": {
+      const from = filesPath(args.path, "path");
+      const to = filesPath(args.to, "to");
+      if (to.startsWith("public/") && !from.startsWith("public/") && !args.confirm) {
+        throw new Error(`Moving into public/ makes the file readable by anyone with its address. Ask the user first, then call again with confirm: true.`);
+      }
+      return hubPost(config3, "/api/files/move", { from, to });
+    }
+    case "make_public": {
+      const from = filesPath(args.path);
+      if (from.startsWith("public/")) throw new Error(`${from} is already public.`);
+      if (!args.confirm) {
+        throw new Error("Making a file public means anyone with its address can read it, with no login. Ask the user first, then call again with confirm: true.");
+      }
+      const out = await hubPost(config3, "/api/files/move", { from, to: swapTopFolder(from, "public") });
+      return { ...out, note: `Moved from ${from}. Any workflow or page that used the old path needs the new one.` };
+    }
+    case "make_private": {
+      const from = filesPath(args.path);
+      if (!from.startsWith("public/")) throw new Error(`${from} is not in public/, so it is already private.`);
+      const out = await hubPost(config3, "/api/files/move", { from, to: swapTopFolder(from, "private") });
+      return {
+        ...out,
+        note: `Moved from ${from}. Its public address no longer serves it, but Cloudflare can keep showing the last copy for up to 4 hours, and a copy someone already downloaded is not recalled. Any workflow, page or app that used it needs changing.`
+      };
+    }
+    case "delete": {
+      const path = filesPath(args.path);
+      if (!args.confirm) throw new Error(`Delete moves ${path} to the trash. Ask the user first, then call again with confirm: true.`);
+      const out = await hubDelete(config3, `/api/files?${q({ path })}`);
+      return { ...out, note: "Moved to the trash folder (trashPath), not erased, and no longer counted toward the Files allowance." };
+    }
+  }
+}
 
 // src/skills.ts
 import { cpSync, existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
@@ -40346,10 +40567,10 @@ function describeSourcePage(page) {
 async function knowledgeSources(config3, args) {
   try {
     if (args.action === "list") {
-      const q = new URLSearchParams();
-      if (args.cursor) q.set("cursor", args.cursor);
-      if (args.limit !== void 0) q.set("limit", String(args.limit));
-      const qs = q.toString();
+      const q2 = new URLSearchParams();
+      if (args.cursor) q2.set("cursor", args.cursor);
+      if (args.limit !== void 0) q2.set("limit", String(args.limit));
+      const qs = q2.toString();
       const page = await hubGet(config3, `/api/knowledge/sources${qs ? `?${qs}` : ""}`);
       return describeSourcePage(page);
     }
@@ -40358,11 +40579,11 @@ async function knowledgeSources(config3, args) {
       return { ...r, note: "Each rule keeps a File Manager folder synced into the knowledge base: files under path_prefix (matching include_globs, if any) are ingested with the rule visibility/tags/collection, re-ingested when they change, and handled per on_file_removed when they disappear. A worker sweeps every 15 min; uploads under an auto rule sync immediately; sync_run sweeps now." };
     }
     if (args.action === "sync_state") {
-      const q = new URLSearchParams();
-      if (args.ruleId !== void 0) q.set("rule_id", String(args.ruleId));
-      if (args.status) q.set("status", args.status);
-      if (args.limit !== void 0) q.set("limit", String(args.limit));
-      const qs = q.toString();
+      const q2 = new URLSearchParams();
+      if (args.ruleId !== void 0) q2.set("rule_id", String(args.ruleId));
+      if (args.status) q2.set("status", args.status);
+      if (args.limit !== void 0) q2.set("limit", String(args.limit));
+      const qs = q2.toString();
       return await hubGet(config3, `/api/knowledge/files-sync/state${qs ? `?${qs}` : ""}`);
     }
     if (args.action === "sync_rule_create") {
@@ -40389,15 +40610,15 @@ async function knowledgeSources(config3, args) {
       return { ...r, note: 'Files ingested this run are queued on the platform; verify with awesomate_knowledge_sources {action:"jobs"} and a search for a phrase from the file, never with the run summary alone.' };
     }
     if (args.action === "search") {
-      const q = new URLSearchParams();
-      if (args.q) q.set("q", args.q);
-      if (args.kind) q.set("kind", args.kind);
-      if (args.visibility) q.set("visibility", args.visibility);
-      for (const t of args.tags ?? []) q.append("tag", t);
-      for (const c of args.collectionIds ?? []) q.append("collection", c);
-      if (args.cursor) q.set("cursor", args.cursor);
-      if (args.limit !== void 0) q.set("limit", String(args.limit));
-      const qs = q.toString();
+      const q2 = new URLSearchParams();
+      if (args.q) q2.set("q", args.q);
+      if (args.kind) q2.set("kind", args.kind);
+      if (args.visibility) q2.set("visibility", args.visibility);
+      for (const t of args.tags ?? []) q2.append("tag", t);
+      for (const c of args.collectionIds ?? []) q2.append("collection", c);
+      if (args.cursor) q2.set("cursor", args.cursor);
+      if (args.limit !== void 0) q2.set("limit", String(args.limit));
+      const qs = q2.toString();
       const page = await hubGet(config3, `/api/knowledge/library${qs ? `?${qs}` : ""}`);
       return { ...describeSourcePage(page), note_visibility: "Each source carries visibility (private|internal|public \u2014 who may retrieve it; enforced) and collections. Nothing marked public = a public chatbot answers nothing." };
     }
@@ -40457,8 +40678,8 @@ async function knowledgeSources(config3, args) {
       }
     }
     if (args.action === "jobs") {
-      const q = args.status ? `?status=${encodeURIComponent(args.status)}` : "";
-      return await hubGet(config3, `/api/knowledge/jobs${q}`);
+      const q2 = args.status ? `?status=${encodeURIComponent(args.status)}` : "";
+      return await hubGet(config3, `/api/knowledge/jobs${q2}`);
     }
     if (args.action === "remove") {
       if (!args.sourceId) throw new Error("sourceId is required for remove");
@@ -40622,10 +40843,10 @@ async function knowledgePeople(config3, args) {
       const probe = await hubGet(config3, "/api/knowledge/entities");
       if (!probe.available) return entityLayerUnavailablePayload();
       if (args.action === "list") {
-        const q = new URLSearchParams();
-        if (args.status) q.set("status", args.status);
-        if (args.cursor) q.set("cursor", args.cursor);
-        const qs = q.toString();
+        const q2 = new URLSearchParams();
+        if (args.status) q2.set("status", args.status);
+        if (args.cursor) q2.set("cursor", args.cursor);
+        const qs = q2.toString();
         const page = await hubGet(config3, `/api/knowledge/people${qs ? `?${qs}` : ""}`);
         return {
           ...page,
@@ -40636,10 +40857,10 @@ async function knowledgePeople(config3, args) {
         };
       }
       if (args.action === "aliases") {
-        const q = new URLSearchParams({ status: "pending" });
-        if (args.kind) q.set("kind", args.kind);
-        if (args.cursor) q.set("cursor", args.cursor);
-        const page = await hubGet(config3, `/api/knowledge/entities/aliases?${q.toString()}`);
+        const q2 = new URLSearchParams({ status: "pending" });
+        if (args.kind) q2.set("kind", args.kind);
+        if (args.cursor) q2.set("cursor", args.cursor);
+        const page = await hubGet(config3, `/api/knowledge/entities/aliases?${q2.toString()}`);
         return {
           ...page,
           note: "Each suggestion is a text name the content uses that probably refers to a known entity. Show the user the alias, the suggested match and the confidence, then use decide with the (kind, alias_norm) pair: only after they explicitly say accept, reject, or create."
@@ -40763,9 +40984,9 @@ function plainSnippet(text) {
 }
 async function knowledgeSearch(config3, args) {
   try {
-    const q = new URLSearchParams();
-    if (args.q) q.set("q", args.q);
-    if (args.kind) q.set("kind", args.kind);
+    const q2 = new URLSearchParams();
+    if (args.q) q2.set("q", args.q);
+    if (args.kind) q2.set("kind", args.kind);
     for (const [name, values] of [
       ["topic", args.topic],
       ["person", args.person],
@@ -40775,12 +40996,12 @@ async function knowledgeSearch(config3, args) {
       ["year", args.year],
       ["doc", args.doc]
     ]) {
-      for (const v of values ?? []) q.append(name, v);
+      for (const v of values ?? []) q2.append(name, v);
     }
-    if (args.limit !== void 0) q.set("limit", String(args.limit));
-    if (args.offset !== void 0) q.set("offset", String(args.offset));
-    if (args.include_media) q.set("include", "media");
-    const qs = q.toString();
+    if (args.limit !== void 0) q2.set("limit", String(args.limit));
+    if (args.offset !== void 0) q2.set("offset", String(args.offset));
+    if (args.include_media) q2.set("include", "media");
+    const qs = q2.toString();
     const result = await hubGet(config3, `/api/knowledge/explore${qs ? `?${qs}` : ""}`);
     const hits = Array.isArray(result.hits) ? result.hits.map((h) => ({
       ...h,
@@ -41336,6 +41557,7 @@ var TITLES = {
   awesomate_knowledge_ask: "Ask the Knowledge Base",
   awesomate_knowledge_sources: "Manage knowledge sources",
   awesomate_knowledge_upload: "Upload file to Knowledge Base",
+  awesomate_files: "Manage Files (public and private file folders)",
   awesomate_knowledge_agent: "Configure knowledge agent",
   awesomate_knowledge_agents: "Manage knowledge agents",
   awesomate_knowledge_collections: "Manage knowledge collections",
@@ -41534,8 +41756,8 @@ server.registerTool(
         return textResult(await hubGet(cfg, "/api/my-n8n/machine/agents/status"));
       }
       if (action === "describe") {
-        const q = tool ? `?name=${encodeURIComponent(tool)}` : "";
-        return textResult(await hubGet(cfg, `/api/my-n8n/machine/agents/tools${q}`));
+        const q2 = tool ? `?name=${encodeURIComponent(tool)}` : "";
+        return textResult(await hubGet(cfg, `/api/my-n8n/machine/agents/tools${q2}`));
       }
       if (action === "result") {
         if (!call_id) return errorResult(new Error('call_id is required for action "result"'));
@@ -41610,10 +41832,10 @@ server.registerTool(
       if (action === "mine") return textResult(await hubGet(cfg, "/api/bookings"));
       if (!session_type) return errorResult(new Error(`session_type is required for ${action}`));
       if (action === "slots") {
-        const q = new URLSearchParams({ session_type });
-        if (from) q.set("from", String(Date.parse(from)));
-        if (to) q.set("to", String(Date.parse(to)));
-        return textResult(await hubGet(cfg, `/api/bookings/slots?${q.toString()}`));
+        const q2 = new URLSearchParams({ session_type });
+        if (from) q2.set("from", String(Date.parse(from)));
+        if (to) q2.set("to", String(Date.parse(to)));
+        return textResult(await hubGet(cfg, `/api/bookings/slots?${q2.toString()}`));
       }
       if (!starts_at || !host_team_member_id) return errorResult(new Error("starts_at and host_team_member_id are required for book"));
       return textResult(
@@ -41664,8 +41886,8 @@ server.registerTool(
         if (active) qs.set("active", active);
         if (limit) qs.set("limit", String(limit));
         if (offset) qs.set("offset", String(offset));
-        const q = qs.toString();
-        return textResult(await hubGet(requireConfig(), `/api/my-n8n/machine/workflows${q ? `?${q}` : ""}`));
+        const q2 = qs.toString();
+        return textResult(await hubGet(requireConfig(), `/api/my-n8n/machine/workflows${q2 ? `?${q2}` : ""}`));
       }
       const full = await hubGet(requireConfig(), `/api/my-n8n/workflows/${encodeURIComponent(id)}`);
       if (detail === "structure" && full?.workflow?.nodes) {
@@ -41696,8 +41918,8 @@ server.registerTool(
       const cfg = requireConfig();
       if (what === "datatable_rows") {
         if (!datatableId) return errorResult(new Error("datatableId is required for datatable_rows"));
-        const q = limit ? `?limit=${limit}` : "";
-        return textResult(await hubGet(cfg, `/api/my-n8n/machine/datatables/${encodeURIComponent(datatableId)}/rows${q}`));
+        const q2 = limit ? `?limit=${limit}` : "";
+        return textResult(await hubGet(cfg, `/api/my-n8n/machine/datatables/${encodeURIComponent(datatableId)}/rows${q2}`));
       }
       const path = {
         nodes: "/api/my-n8n/machine/nodes",
@@ -41850,19 +42072,19 @@ server.registerTool(
       )
     }
   },
-  async ({ action, q, subject, message, category }) => {
+  async ({ action, q: q2, subject, message, category }) => {
     try {
       const cfg = requireConfig();
       if (action === "ask") {
-        if (!q) return errorResult(new Error("ask needs q"));
-        return textResult(await hubGet(cfg, `/api/help/ask?q=${encodeURIComponent(q)}`));
+        if (!q2) return errorResult(new Error("ask needs q"));
+        return textResult(await hubGet(cfg, `/api/help/ask?q=${encodeURIComponent(q2)}`));
       }
       if (action === "faq") {
-        return textResult(await hubGet(cfg, `/api/help/faq${q ? `?q=${encodeURIComponent(q)}` : ""}`));
+        return textResult(await hubGet(cfg, `/api/help/faq${q2 ? `?q=${encodeURIComponent(q2)}` : ""}`));
       }
       if (action === "help_docs") {
-        if (!q) return errorResult(new Error("help_docs needs q"));
-        return textResult(await hubGet(cfg, `/api/help/docs?q=${encodeURIComponent(q)}`));
+        if (!q2) return errorResult(new Error("help_docs needs q"));
+        return textResult(await hubGet(cfg, `/api/help/docs?q=${encodeURIComponent(q2)}`));
       }
       if (action === "list_tickets") {
         return textResult(await hubGet(cfg, "/api/support/tickets"));
@@ -42564,10 +42786,10 @@ server.registerTool(
       limit: external_exports.number().int().min(1).max(200).optional().describe("list only: page size (default 50, max 200)")
     }
   },
-  async ({ action, url, sitemap, since, sourceId, status, cursor, limit, q, kind, visibility, tags, collectionIds, removeCollectionIds, sourceIds, confirm, pathPrefix, includeGlobs, onFileRemoved, ruleId }) => {
+  async ({ action, url, sitemap, since, sourceId, status, cursor, limit, q: q2, kind, visibility, tags, collectionIds, removeCollectionIds, sourceIds, confirm, pathPrefix, includeGlobs, onFileRemoved, ruleId }) => {
     try {
       return knowledgeResult(
-        await knowledgeSources(requireConfig(), { action, url, sitemap, since, sourceId, status, cursor, limit, q, kind, visibility, tags, collectionIds, removeCollectionIds, sourceIds, confirm, pathPrefix, includeGlobs, onFileRemoved, ruleId })
+        await knowledgeSources(requireConfig(), { action, url, sitemap, since, sourceId, status, cursor, limit, q: q2, kind, visibility, tags, collectionIds, removeCollectionIds, sourceIds, confirm, pathPrefix, includeGlobs, onFileRemoved, ruleId })
       );
     } catch (err) {
       return knowledgeError(err);
@@ -42762,6 +42984,31 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_files",
+  {
+    annotations: annotate("awesomate_files", DESTRUCTIVE),
+    description: `The account's Files: the folders on their automation account (n8n) that workflows read and write, and that the hub shows at Knowledge, Files. Three top folders: public/ (every file has a public_url anyone can open with no login: images for a site or email, downloads, media a workflow made), private/ (only the account, its workflows and the hub) and temp/ (scratch space). Support Plus, Pro and Embedded; the owner must also have switched on "Open your automation account's file folders" in Settings, Privacy. Paths are relative to the files folder and start with the top folder, e.g. public/images/logo.png. action 'status': whether Files is on, why not, and storage used against the plan's limit: call this first. 'list' {path?}: one folder (no path = the top folders); files in public/ carry public_url. 'search' {q?, top?, exts?}: find files by name across the folders (first 200 matches; truncated:true means narrow it). 'download' {path, to?, overwrite?}: save a file to THIS computer (to = a local file or folder, default the working directory); never overwrites without overwrite:true. 'upload' {localPath, path, overwrite?}: send a file from this computer (max 50 MB each); path is the target file, or a folder ending in / to keep the name. Upload into public/ only when the user wants it publicly reachable. 'mkdir' {path}. 'move' {path, to}: rename or move; moving into public/ needs confirm:true. 'make_public' {path, confirm:true}: moves private/ or temp/ to the same place under public/ and returns its public_url: ASK the user first, anyone with the address can read it. 'make_private' {path}: moves it out of public/, so its public address stops serving it; Cloudflare can keep showing the last copy for up to 4 hours (also after a delete or a replace of a public file), so never promise it is gone at once. 'delete' {path, confirm:true}: moves to the trash (not erased); ask first. Moving or renaming changes the path, so tell the user any workflow, page or app using the old path or address needs the new one. Contents stream between this computer and the hub: never paste a file's contents into the conversation to move it. A 507 files_storage_full means the plan's Files allowance is used: say how much, offer to find large or old files to remove, and leave any plan change to the user.`,
+    inputSchema: {
+      action: external_exports.enum(FILES_ACTIONS),
+      path: external_exports.string().max(1024).optional().describe("A path in Files, starting public/, private/ or temp/. For upload, the target (a folder ending in / keeps the local name)."),
+      to: external_exports.string().max(4096).optional().describe("move: the new Files path. download: where to save on this computer (file or folder; ~ expands)."),
+      localPath: external_exports.string().max(4096).optional().describe("upload: the file on this computer (~ expands; prefer an absolute path)."),
+      q: external_exports.string().max(200).optional().describe("search: part of a file name (* and ? work as wildcards)."),
+      top: external_exports.enum(["public", "private", "temp"]).optional().describe("search: only this top folder."),
+      exts: external_exports.array(external_exports.string().regex(/^\.[a-z0-9]+$/i)).max(20).optional().describe('search: only these extensions, e.g. [".png", ".jpg"].'),
+      overwrite: external_exports.boolean().optional().describe("upload: replace a file already at path. download: replace a local file."),
+      confirm: external_exports.boolean().optional().describe("true only after the user agreed: make_public, delete, and a move into public/.")
+    }
+  },
+  async (args) => {
+    try {
+      return textResult(await filesAction(requireConfig(), args));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
 server.registerTool(
   "awesomate_knowledge_people",
   {
@@ -43035,7 +43282,7 @@ server.registerTool(
   "awesomate_crm_apps",
   {
     annotations: annotate("awesomate_crm_apps", MUTATING),
-    description: "The account's own apps (a client portal, a members' app) whose users sign in by email link and then read and change only what each kind's access rules allow them (awesomate_crm_kinds set_access). Pro and above to create or change; reading is every plan. action 'list': each app with its publishable key, allowed origins, sign-up mode and default role. action 'create' {name, allowed_origins, sign_up?, default_role?}: name appears in the sign-in email; allowed_origins are the exact origins the app runs on (https://portal.example.com; http://localhost:5173 for development; capacitor://localhost for the mobile shell), with no path and no wildcard; sign_up 'invite' (default: only people added with awesomate_crm_app_users) or 'open' (anyone who uses the email link gets the default role). action 'update' {app_id, ...any of those, status?}: status 'disabled' signs everyone out of that app and stops its server keys; voice_agent_id names the account's agent that signed-in people talk to by voice (Talk to the agent: @awesomate/sdk voiceAgent() and voiceSession() with the hub's AwesomateAgent widget; the agent greets them by name and, when the app's assistant is set up, knows the 10 most recent conversations they can see, read as them; the app's origin must also be listed under the agent's 'Where your app runs'), null takes it away. The publishable key (pk_...) is not a secret: it goes in the app's browser code, with @awesomate/sdk. Never put the account's own token (amt_pat_...) in browser code. SDK docs, with a tutorial that builds a customer portal: https://hub.awesomate.ai/docs/sdk/ (as one text file for you: https://hub.awesomate.ai/docs/sdk/llms-full.txt). Confirm origins and sign-up mode with the user: open sign-up lets strangers in under the default role. action 'customer_lookup' {app_id, roles?}: which roles in that app may look customers up (name, email and phone, by search or id, with @awesomate/sdk lookupCustomers) and so put a record under any customer, not only themselves. Without roles it reads the setting; roles ['staff'] switches it on for staff; [] switches it off. Never the app's default role (the one customers sign in with): that would show every customer to every other customer, and the hub refuses it. Off until the owner asks for it. SERVER KEYS (ak_...), for the app's own server or an n8n workflow, used with @awesomate/sdk createClient({ token: <key> }) or as a Bearer token on https://hub.awesomate.ai/api/sdk/v1/server: action 'keys' {app_id} lists them (never the secrets); 'create_key' {app_id, name, access: 'read'|'write', kinds?} makes one (kinds leaves it to those kinds, 'contact' to read contacts; leave it out for every kind) and returns the key ONCE: put it straight into the app server's environment (awesomate_app_set_env for an app hosted with us) and never into browser code, a repository or a reply to the user. For an n8n workflow pass n8n_credential: true instead (prefer it): the hub puts the key into a Header Auth credential 'Awesomate app key: <name>' on their n8n (Authorization: Bearer, usable only towards the hub) and returns only its id and name, so the key never passes through you. 'revoke_key' {app_id, key_id} stops it at once, and removes a credential the hub made. A key reads every attribute of an app kind, contacts only as you read them, and writes need Support Plus and above. Prefer the narrowest key: read unless the server writes, and only the kinds it uses.",
+    description: "The account's own apps (a client portal, a members' app) whose users sign in by email link and then read and change only what each kind's access rules allow them (awesomate_crm_kinds set_access). Pro and above to create or change; reading is every plan. action 'list': each app with its publishable key, allowed origins, sign-up mode and default role. action 'create' {name, allowed_origins, sign_up?, default_role?}: name appears in the sign-in email; allowed_origins are the exact origins the app runs on (https://portal.example.com; http://localhost:5173 for development; capacitor://localhost for the mobile shell), with no path and no wildcard; sign_up 'invite' (default: only people added with awesomate_crm_app_users) or 'open' (anyone who uses the email link gets the default role). action 'update' {app_id, ...any of those, status?}: status 'disabled' signs everyone out of that app and stops its server keys; voice_agent_id names the account's agent that signed-in people talk to by voice (Talk to the agent: @awesomate/sdk voiceAgent() and voiceSession() with the hub's AwesomateAgent widget; the agent greets them by name and, when the app's assistant is set up, knows the 10 most recent conversations they can see, read as them; the app's origin must also be listed under the agent's 'Where your app runs'), null takes it away; file_uploads 'off' (default) | 'private' | 'public' lets signed-in people upload files from the app (@awesomate/sdk files.upload, up to 10 MB each) into the account's Files under private/apps/<app_id>/ or public/apps/<app_id>/ (public gives each a public address; page and script types are refused there), counted toward the plan's Files space: with open sign-up that means anyone, so confirm with the user. The publishable key (pk_...) is not a secret: it goes in the app's browser code, with @awesomate/sdk. Never put the account's own token (amt_pat_...) in browser code. SDK docs, with a tutorial that builds a customer portal: https://hub.awesomate.ai/docs/sdk/ (as one text file for you: https://hub.awesomate.ai/docs/sdk/llms-full.txt). Confirm origins and sign-up mode with the user: open sign-up lets strangers in under the default role. action 'customer_lookup' {app_id, roles?}: which roles in that app may look customers up (name, email and phone, by search or id, with @awesomate/sdk lookupCustomers) and so put a record under any customer, not only themselves. Without roles it reads the setting; roles ['staff'] switches it on for staff; [] switches it off. Never the app's default role (the one customers sign in with): that would show every customer to every other customer, and the hub refuses it. Off until the owner asks for it. SERVER KEYS (ak_...), for the app's own server or an n8n workflow, used with @awesomate/sdk createClient({ token: <key> }) or as a Bearer token on https://hub.awesomate.ai/api/sdk/v1/server: action 'keys' {app_id} lists them (never the secrets); 'create_key' {app_id, name, access: 'read'|'write', kinds?} makes one (kinds leaves it to those kinds, 'contact' to read contacts; leave it out for every kind) and returns the key ONCE: put it straight into the app server's environment (awesomate_app_set_env for an app hosted with us) and never into browser code, a repository or a reply to the user. For an n8n workflow pass n8n_credential: true instead (prefer it): the hub puts the key into a Header Auth credential 'Awesomate app key: <name>' on their n8n (Authorization: Bearer, usable only towards the hub) and returns only its id and name, so the key never passes through you. 'revoke_key' {app_id, key_id} stops it at once, and removes a credential the hub made. A key reads every attribute of an app kind, contacts only as you read them, and writes need Support Plus and above. Prefer the narrowest key: read unless the server writes, and only the kinds it uses.",
     inputSchema: {
       action: external_exports.enum(["list", "create", "update", "keys", "create_key", "revoke_key", "customer_lookup"]),
       app_id: external_exports.string().max(48).optional().describe("update, keys, create_key, revoke_key, customer_lookup: the app"),
@@ -43049,10 +43296,11 @@ server.registerTool(
       sign_up: external_exports.enum(["invite", "open"]).optional(),
       default_role: external_exports.string().max(31).optional().describe("lower case; the role open sign-up gives"),
       status: external_exports.enum(["active", "disabled"]).optional().describe("update only"),
-      voice_agent_id: external_exports.string().uuid().nullable().optional().describe("update only: the account's own agent (awesomate_knowledge_agents list) that signed-in people talk to by voice in this app; null takes voice away")
+      voice_agent_id: external_exports.string().uuid().nullable().optional().describe("update only: the account's own agent (awesomate_knowledge_agents list) that signed-in people talk to by voice in this app; null takes voice away"),
+      file_uploads: external_exports.enum(["off", "private", "public"]).optional().describe("update only: whether signed-in people may upload files from the app, and whether each gets a public address")
     }
   },
-  async ({ action, app_id, name, allowed_origins, sign_up, default_role, status, voice_agent_id, access, kinds, key_id, roles, n8n_credential }) => {
+  async ({ action, app_id, name, allowed_origins, sign_up, default_role, status, voice_agent_id, file_uploads, access, kinds, key_id, roles, n8n_credential }) => {
     try {
       const cfg = requireConfig();
       if (action === "list") return textResult(await hubGet(cfg, "/api/my-crm/v1/apps"));
@@ -43078,7 +43326,8 @@ server.registerTool(
       return textResult(await hubPatch(cfg, `/api/my-crm/v1/apps/${encodeURIComponent(app_id)}`, {
         ...fields,
         ...status ? { status } : {},
-        ...voice_agent_id === void 0 ? {} : { voice_agent_id }
+        ...voice_agent_id === void 0 ? {} : { voice_agent_id },
+        ...file_uploads ? { file_uploads } : {}
       }));
     } catch (err) {
       return errorResult(err);
@@ -43658,8 +43907,8 @@ server.registerTool(
   async ({ domain, path }) => {
     try {
       const dom = encodeURIComponent(domain.toLowerCase());
-      const q = path && path !== "/" ? `?path=${encodeURIComponent(path)}` : "";
-      return textResult(await hubGet(requireConfig(), `/api/client-hosting/sites/${dom}/audit${q}`));
+      const q2 = path && path !== "/" ? `?path=${encodeURIComponent(path)}` : "";
+      return textResult(await hubGet(requireConfig(), `/api/client-hosting/sites/${dom}/audit${q2}`));
     } catch (err) {
       return errorResult(err);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",
@@ -19,7 +19,7 @@
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --target=node18 --format=esm --outfile=dist/index.js --banner:js='#!/usr/bin/env node\nimport { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:*",
     "typecheck": "tsc --noEmit",
-    "test": "npm run build && esbuild src/config.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/config.mjs --external:node:* && esbuild src/knowledge.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/knowledge.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && esbuild src/skills.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/skills.mjs --external:node:* && esbuild src/features.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/features.mjs --external:node:* && esbuild src/http.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/http.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && node --test test/*.test.mjs",
+    "test": "npm run build && esbuild src/config.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/config.mjs --external:node:* && esbuild src/knowledge.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/knowledge.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && esbuild src/skills.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/skills.mjs --external:node:* && esbuild src/features.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/features.mjs --external:node:* && esbuild src/http.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/http.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && esbuild src/files.ts --bundle --platform=node --target=node18 --format=esm --outfile=test/.build/files.mjs --banner:js='import { createRequire as __awmCreateRequire } from \"node:module\"; const require = __awmCreateRequire(import.meta.url);' --external:node:* && node --test test/*.test.mjs",
     "prepublishOnly": "npm run typecheck && npm run test"
   },
   "dependencies": {

package/skill/CHANGELOG.json

@@ -1,5 +1,12 @@
 {
   "versions": [
+    {
+      "version": "0.68.0",
+      "highlights": [
+        "Claude can work with your Files: the folders your workflows use on your automation account. Put an image up and get its public address, fetch a report a workflow saved, make a file public or private, and tidy up, with storage counted against your plan's Files space",
+        "Apps you build can let signed-in people attach files, such as a photo of a job, when you switch uploads on for the app"
+      ]
+    },
     {
       "version": "0.67.0",
       "highlights": [

package/skill/awesomate-hosting/SKILL.md

@@ -224,6 +224,7 @@ MCP, so say that rather than stopping.
 | `awesomate_dns_check` | Live answer to "where does this domain actually point" — before and after any DNS change |
 | `awesomate_site_uptime` | 30-day availability, incidents, downtime per domain (cached, free) |
 | `awesomate_site_audit` | SEO + AEO build gates for one page, fetched as GPTBot — content present without JS, retrieval bots reachable, canonical, schema, structure, speed. Not plan-gated. Run it after any public-page change, and see the awesomate-seo skill for the fixes |
+| `awesomate_files` | Files on their automation account (public/, private/, temp/): put an image or download up and hand back its `public_url`, fetch what a workflow wrote, tidy a folder. Ask before make_public, a move into public/, or delete. Support Plus+, owner's file-folders switch on (`status` says what's missing). Guide: https://hub.awesomate.ai/docs/mcp/guides/files/ |
 | `awesomate_snapshot_site` | Before ANY change to a live site — files + DB restore point |
 | `awesomate_list_snapshots` | What restore points a site has |
 | `awesomate_rollback_site` | Restore a snapshot after something went wrong (confirm first) |

package/skill/awesomate-portals/SKILL.md

@@ -178,6 +178,17 @@ https://hub.awesomate.ai/docs/sdk/guides/customer-actions/
   `agentId: await app.voiceAgent()` and `session: () => app.voiceSession()`. Guide:
   https://hub.awesomate.ai/docs/sdk/guides/voice/
 
+## 6b2. Optional: file uploads
+
+People signed in to the app can attach files (a photo of a job, a signed form) when the owner
+switches it on: `awesomate_crm_apps {action:'update', app_id, file_uploads:'private'}` ('public'
+also gives each file a public address; web pages and scripts are refused there). Off by default;
+with open sign-up anyone could upload, so ask the owner. Give the kind a `file` attribute
+(`awesomate_crm_kinds {action:'add_attribute'}`), then the page does
+`const f = await app.files.upload(file)` (10 MB each) and stores `f.handle` in that attribute;
+`app.files.download(handle)` gives the file back to anyone in the app who can read the record.
+Uploads count toward the account's Files space. Guide: https://hub.awesomate.ai/docs/sdk/guides/files/
+
 ## 6c. Optional: reply emails
 
 `awesomate_crm_notifications {action:'set', app_id, notifications: {enabled: true, thread_link: 'job'}}`