@awesomate/hosting-mcp 0.7.0 → 0.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, and n8n automations",
   "license": "UNLICENSED",
   "type": "module",
@@ -24,6 +24,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "undici": "^6.21.0",
     "zod": "^3.24.1"
   },
   "devDependencies": {

package/skill/awesomate-hosting/SKILL.md

@@ -68,8 +68,34 @@ fallback** — that's deliberate.
 - Connecting a second account never disconnects the first; re-pairing an
   account just refreshes its profile.
 - The bootstrap prints a final `AWESOMATE CONNECT: SUCCESS account=<slug>` (or
-  `FAILED reason=…`) sentinel — when a connect ran as a `!` bang command, check
-  for that line instead of assuming success from silence.
+  `PARTIAL … issues=…` / `FAILED reason=…`) sentinel — when a connect ran as a
+  `!` bang command, check for that line instead of assuming success from
+  silence. `PARTIAL` means the token/pin are stored but a step (listed in
+  `issues=`) needs the printed manual fix.
+
+### Sandboxed / ephemeral environments (cloud agent containers)
+
+- **Egress proxy**: if `HTTPS_PROXY`/`HTTP_PROXY` is set, the environment
+  forces traffic through a proxy that Node's built-in fetch ignores — requests
+  bypass it and the gateway answers 403, which looks like a bad code/token but
+  is a transport failure. The bootstrap and MCP server handle this themselves
+  (undici env-proxy agent); if an older version is in play, prefix commands
+  with `NODE_USE_ENV_PROXY=1`. Diagnostic: `curl` works but `node -e "fetch(…)"`
+  403s → proxy bypass, not credentials.
+- **Interrupted connect?** Setup codes are re-runnable for their whole
+  10-minute life (each run mints a fresh token), and `--pat amt_pat_…` resumes
+  with an already-redeemed token — never tell the user their code is spent
+  unless the API literally said so.
+- **Nothing persists**: `~/.awesomate`, the skill copy, and the MCP
+  registration all vanish with the container. Treat a container connect as a
+  diagnosis/test, and tell the user a real workstation is needed for a lasting
+  install.
+- **No ssh client**: containers usually lack `ssh-keygen`/`ssh`, so deploy and
+  shell are unavailable — reads and management calls still work. The bootstrap
+  skips SSH with a note rather than failing.
+- Never probe connectivity with a POST to `/redeem` — it's state-changing. Use
+  `GET {apiBase}/api/hosting-access/context` (401 without a token still proves
+  reachability).
 
 If this skill is loaded but **no `awesomate_*` tools exist in the session at
 all**, the MCP server was registered after Claude Code started (the bootstrap

package/skill/awesomate-hosting/scripts/bootstrap.mjs

@@ -2,27 +2,33 @@
 /**
  * Awesomate Hosting — one-time bootstrap.
  *
- * Redeems the single-use setup code from the hub's "Connect Claude Code" prompt
- * for a durable, scoped access token; stores it as a PROFILE (multi-account
- * safe); pins the current folder to that account; and (on Support Plus+)
- * generates an SSH keypair and authorizes the PUBLIC key on the client's own
- * cPanel account. The private key never leaves this machine; the setup code is
- * the only secret that ever crossed the clipboard, and it's single-use + short-
- * lived. The access token itself is never printed.
+ * Redeems the setup code from the hub's "Connect Claude Code" prompt for a
+ * durable, scoped access token; stores it as a PROFILE (multi-account safe);
+ * pins the current folder to that account; and (on Support Plus+) generates an
+ * SSH keypair and authorizes the PUBLIC key on the client's own cPanel
+ * account. The private key never leaves this machine; the setup code is the
+ * only secret that ever crossed the clipboard, and it's short-lived. The
+ * access token itself is never printed.
  *
  * Usage (Claude runs this — the user doesn't touch a terminal):
- *   node bootstrap.mjs --code amt_bs_XXXX [--account <slug>] [--api https://hub.awesomate.ai]
+ *   node bootstrap.mjs --code amt_bs_XXXX [--account <slug>] [--pin-dir <dir>]
+ *   node bootstrap.mjs --pat amt_pat_XXXX [--account <slug>]   # resume: skip redeem
  *
- * --account asserts WHICH account the code is expected to connect. If the
- * redeemed identity doesn't match, the bootstrap aborts before writing
- * anything — connecting the wrong account loudly beats connecting it silently.
+ * --account asserts WHICH account this connect is for — mismatch aborts before
+ * anything is written. --pat resumes a half-finished bootstrap with an
+ * already-redeemed token (no fresh code needed). Setup codes are replayable
+ * for their whole 10-minute life, so re-running the same command is also safe.
  *
- * Dependency-free: Node 18+ built-ins only (global fetch, node:fs/os/path,
- * child_process for ssh-keygen + the claude CLI).
+ * Proxied environments (cloud agent sandboxes): Node's built-in fetch ignores
+ * HTTP(S)_PROXY, so this script routes through undici's EnvHttpProxyAgent when
+ * a proxy is configured (falling back to a one-shot re-exec with
+ * NODE_USE_ENV_PROXY=1 when undici isn't resolvable).
+ *
+ * Node 18+ built-ins only, plus undici when running from the npm package.
  */
 
-import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, writeFileSync, chmodSync, readFileSync, cpSync, readdirSync } from 'node:fs';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, writeFileSync, chmodSync, readFileSync, cpSync, readdirSync, renameSync, statSync } from 'node:fs';
 import { homedir, hostname } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -33,13 +39,21 @@ function arg(name, fallback) {
 }
 
 const code = arg('code');
+const resumePat = arg('pat');
 const expectedAccount = arg('account', null);
+const pinDirArg = arg('pin-dir', null);
 const apiBase = (arg('api', 'https://hub.awesomate.ai')).replace(/\/$/, '');
-if (!code || !code.startsWith('amt_bs_')) {
-  console.error('Missing/invalid --code. Copy a fresh setup prompt from hub.awesomate.ai/sites.');
+
+if (!resumePat && (!code || !code.startsWith('amt_bs_'))) {
+  console.error('Missing/invalid --code. Copy a fresh setup prompt from hub.awesomate.ai/sites (or resume with --pat if you already hold a token).');
   console.error('AWESOMATE CONNECT: FAILED reason=bad-code');
   process.exit(1);
 }
+if (resumePat && !resumePat.startsWith('amt_pat_')) {
+  console.error('--pat does not look like an Awesomate access token (expected amt_pat_ prefix).');
+  console.error('AWESOMATE CONNECT: FAILED reason=bad-pat');
+  process.exit(1);
+}
 
 const dir = join(homedir(), '.awesomate');
 const keysDir = join(dir, 'keys');
@@ -47,20 +61,81 @@ const credPath = join(dir, 'credentials.json');
 const keyPath = join(keysDir, 'id_ed25519');
 const PIN_FILENAME = '.awesomate.json';
 
+// ---------------------------------------------------------------------------
+// Proxy-aware fetch. Node's built-in fetch does NOT honor HTTP(S)_PROXY —
+// in sandboxes that force egress through a proxy, requests bypass it and the
+// gateway answers 403, which looks exactly like a credential failure. Route
+// through undici's EnvHttpProxyAgent when a proxy env var is set.
+// ---------------------------------------------------------------------------
+const PROXY_URL =
+  process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || '';
+let doFetch = fetch;
+
+async function initProxySupport() {
+  if (!PROXY_URL) return;
+  // undici tags EnvHttpProxyAgent experimental and warns on construction —
+  // noise in the middle of connect output. Keep every other warning.
+  process.removeAllListeners('warning');
+  process.on('warning', (w) => {
+    if (!/EnvHttpProxyAgent/.test(String(w.message))) console.error(w.stack ?? String(w.message));
+  });
+  try {
+    // Resolves when running from the npm package (undici is a dependency).
+    const undici = await import('undici');
+    const dispatcher = new undici.EnvHttpProxyAgent();
+    doFetch = (url, opts = {}) => undici.fetch(url, { ...opts, dispatcher });
+    console.log(`• Egress proxy detected — routing hub requests through ${PROXY_URL}.`);
+  } catch {
+    // Running from an installed skill copy with no node_modules. Re-exec once
+    // with NODE_USE_ENV_PROXY=1 (built-in fetch honors proxies on newer Node;
+    // the env var is ignored where unsupported, so this is at worst a no-op).
+    if (process.env.AWESOMATE_PROXY_REEXEC !== '1') {
+      const r = spawnSync(process.execPath, process.argv.slice(1), {
+        stdio: 'inherit',
+        env: { ...process.env, NODE_USE_ENV_PROXY: '1', AWESOMATE_PROXY_REEXEC: '1' },
+      });
+      process.exit(r.status ?? 1);
+    }
+    console.log(`• Egress proxy detected (${PROXY_URL}) but proxy support is unavailable in this runtime — requests may be blocked by the gateway.`);
+  }
+}
+
+const proxyAdvice = () =>
+  PROXY_URL
+    ? ` An egress proxy is configured (${PROXY_URL}); if this persists, re-run the command prefixed with NODE_USE_ENV_PROXY=1.`
+    : '';
+
 async function request(method, path, { body, token } = {}) {
   const headers = { 'Content-Type': 'application/json' };
   if (token) headers.Authorization = `Bearer ${token}`;
-  const res = await fetch(`${apiBase}${path}`, {
-    method,
-    headers,
-    body: method === 'GET' ? undefined : JSON.stringify(body ?? {}),
-  });
+  let res;
+  try {
+    res = await doFetch(`${apiBase}${path}`, {
+      method,
+      headers,
+      body: method === 'GET' ? undefined : JSON.stringify(body ?? {}),
+    });
+  } catch (err) {
+    const detail = err?.cause?.code ?? err?.code ?? err?.message ?? 'network error';
+    throw new Error(`Could not reach ${apiBase} (${detail}). This is a NETWORK problem, not a code/token problem.${proxyAdvice()}`);
+  }
   const text = await res.text();
   let json;
   try { json = text ? JSON.parse(text) : null; } catch { json = text; }
+  const apiError = json && typeof json === 'object' && typeof json.error === 'string' ? json.error : null;
   if (!res.ok) {
-    const msg = json && typeof json === 'object' && json.error ? json.error : `HTTP ${res.status}`;
-    throw new Error(`${path} failed: ${msg}`);
+    if (apiError) {
+      const e = new Error(`${path} failed: ${apiError}`);
+      e.isApiError = true;
+      e.status = res.status;
+      throw e;
+    }
+    // No structured error body → the response almost certainly came from an
+    // egress gateway / firewall, not from the hub. Say so instead of blaming
+    // the code — that misdirection is expensive.
+    throw new Error(
+      `${path} returned HTTP ${res.status} without an API error body — the request likely never reached hub.awesomate.ai (egress proxy or firewall in the way).${proxyAdvice()}`,
+    );
   }
   return json;
 }
@@ -74,6 +149,13 @@ function readJsonFile(path) {
   } catch { return null; }
 }
 
+/** Atomic JSON write (tmp + rename) so a crash can't leave a torn file. */
+function writeJsonFile(path, value) {
+  const tmp = `${path}.tmp-${process.pid}`;
+  writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`);
+  renameSync(tmp, path);
+}
+
 /**
  * Merge one account profile into credentials.json (v2 multi-profile shape).
  * Existing profiles for OTHER accounts are preserved — connecting a second
@@ -122,25 +204,33 @@ function mergeProfile(profile) {
 
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   chmodSync(dir, 0o700);
-  writeFileSync(credPath, JSON.stringify(creds, null, 2));
+  writeJsonFile(credPath, creds);
   chmodSync(credPath, 0o600);
   return creds;
 }
 
-/** Pin the folder bootstrap ran in to this account. Never pins $HOME. */
+/**
+ * Pin a folder to this account. --pin-dir overrides the implicit cwd (useful
+ * when the bootstrap is run from somewhere other than the project root).
+ * Never pins $HOME.
+ */
 function writePin(slug) {
-  const cwd = resolve(process.cwd());
-  if (cwd === resolve(homedir())) {
-    console.log(`• Running from the home directory — not writing a ${PIN_FILENAME} pin. Re-run Connect from the project folder to pin it.`);
+  const target = resolve(pinDirArg || process.cwd());
+  if (pinDirArg && !(existsSync(target) && statSync(target).isDirectory())) {
+    console.log(`• --pin-dir ${pinDirArg} is not an existing directory — skipping the pin. Create it and add ${PIN_FILENAME} with {"account": "${slug}"}.`);
+    return null;
+  }
+  if (target === resolve(homedir())) {
+    console.log(`• Target is the home directory — not writing a ${PIN_FILENAME} pin. Re-run from the project folder (or pass --pin-dir) to pin it.`);
     return null;
   }
-  const pinPath = join(cwd, PIN_FILENAME);
+  const pinPath = join(target, PIN_FILENAME);
   const existing = readJsonFile(pinPath);
   if (existing?.account && existing.account !== slug) {
-    console.log(`• Re-pinning this folder: ${existing.account} → ${slug}.`);
+    console.log(`• Re-pinning ${target}: ${existing.account} → ${slug}.`);
   }
-  writeFileSync(pinPath, `${JSON.stringify({ version: 1, account: slug }, null, 2)}\n`);
-  console.log(`✓ Pinned ${cwd} to account "${slug}" (${PIN_FILENAME}).`);
+  writeJsonFile(pinPath, { version: 1, account: slug });
+  console.log(`✓ Pinned ${target} to account "${slug}" (${PIN_FILENAME}).`);
   return pinPath;
 }
 
@@ -152,12 +242,6 @@ function writePin(slug) {
  * failure here never aborts the rest of setup.
  */
 function installSkill() {
-  // bootstrap.mjs lives at <skill>/scripts/bootstrap.mjs → the skill dir is
-  // `..` and every sibling of it under the package's skill/ dir is another
-  // bundled skill (e.g. awesomate-n8n). Install them all. When bootstrap is
-  // re-run from an already-installed copy (~/.claude/skills/...), the parent
-  // is the user's whole skills folder — in that case only reinstall this one
-  // skill, never its unrelated siblings.
   const hostingSkill = dirname(dirname(fileURLToPath(import.meta.url)));
   const skillRoot = dirname(hostingSkill);
   // Only the package layout (skill/<name>/) has bundled siblings; from an
@@ -203,100 +287,138 @@ function installSkill() {
   return true;
 }
 
-function claudeCli(args) {
-  return execFileSync('claude', args, { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' });
-}
-
-const MANUAL_ADD =
-  'claude mcp add --scope user awesomate-hosting -- npx -y -p @awesomate/hosting-mcp awesomate-hosting-mcp';
+const CLEAN_ENTRY = {
+  command: 'npx',
+  args: ['-y', '-p', '@awesomate/hosting-mcp', 'awesomate-hosting-mcp'],
+};
+const MANUAL_ADD_JSON = JSON.stringify({ mcpServers: { 'awesomate-hosting': CLEAN_ENTRY } }, null, 2);
 
 /**
- * Converge on exactly one env-free, user-scope MCP registration.
+ * Converge on exactly one env-free, user-scope MCP registration by editing the
+ * config files DIRECTLY — `claude mcp add` flag syntax has drifted between CLI
+ * versions (--scope/-s rejected on some), and a registration is too important
+ * to hang off a moving target.
  *
  * Legacy bootstraps baked AWESOMATE_PAT into the registration env — env beats
  * credentials.json inside the server, so those registrations keep serving a
- * STALE account forever after a re-pair. Remove every registration that
- * carries the env var (user scope, plus this project's .mcp.json / local
- * scope), then add the clean one. Registrations in OTHER projects' local
- * scopes can't be removed from here — those are reported for manual cleanup.
- *
- * Throws on failure: a wrong registration is exactly the silent-wrong-account
- * bug this bootstrap exists to prevent.
+ * STALE account forever after a re-pair. Remove every entry that carries the
+ * env var (user scope, this project's local scope + .mcp.json); entries in
+ * OTHER projects are reported for manual cleanup, not touched.
  */
 function ensureMcpRegistration() {
   const cwd = resolve(process.cwd());
-  const claudeConfig = readJsonFile(join(homedir(), '.claude.json')) ?? {};
-  const warnings = [];
-
-  const scopesToClean = [];
-  if (claudeConfig.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) scopesToClean.push('user');
-  if (readJsonFile(join(cwd, '.mcp.json'))?.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) scopesToClean.push('project');
-  for (const [projectDir, project] of Object.entries(claudeConfig.projects ?? {})) {
-    if (!project?.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) continue;
-    if (resolve(projectDir) === cwd) scopesToClean.push('local');
-    else warnings.push(`cd ${projectDir} && claude mcp remove awesomate-hosting -s local`);
-  }
+  const claudeJsonPath = join(homedir(), '.claude.json');
 
-  for (const scope of scopesToClean) {
-    claudeCli(['mcp', 'remove', 'awesomate-hosting', '-s', scope]);
-    console.log(`✓ Removed legacy ${scope}-scope registration (had a token baked into its env).`);
+  let cfg = {};
+  if (existsSync(claudeJsonPath)) {
+    cfg = readJsonFile(claudeJsonPath);
+    if (!cfg) {
+      throw new Error(`${claudeJsonPath} exists but is not valid JSON — refusing to rewrite it. Fix the file, then add:\n${MANUAL_ADD_JSON}`);
+    }
   }
 
-  const userEntry = claudeConfig.mcpServers?.['awesomate-hosting'];
-  const userEntryIsClean =
-    userEntry && !userEntry.env?.AWESOMATE_PAT && !scopesToClean.includes('user') &&
-    JSON.stringify(userEntry.args ?? []).includes('awesomate-hosting-mcp');
-  if (userEntryIsClean) {
-    console.log('✓ MCP server already registered (user scope, env-free) — account selection comes from the folder pin.');
+  const entry = cfg.mcpServers?.['awesomate-hosting'];
+  const entryIsClean =
+    entry && !entry.env?.AWESOMATE_PAT && JSON.stringify(entry.args ?? []).includes('awesomate-hosting-mcp');
+
+  let changed = false;
+  if (!entryIsClean) {
+    cfg.mcpServers = { ...(cfg.mcpServers ?? {}), 'awesomate-hosting': CLEAN_ENTRY };
+    changed = true;
+    console.log(
+      entry?.env?.AWESOMATE_PAT
+        ? '✓ Replaced the legacy user-scope registration (had a token baked into its env) with an env-free one.'
+        : '✓ Registered the Awesomate Hosting MCP server (user scope, env-free — the folder pin picks the account).',
+    );
   } else {
-    if (userEntry && !scopesToClean.includes('user')) {
-      // Exists but is odd (wrong command, partial env) — replace it.
-      try { claudeCli(['mcp', 'remove', 'awesomate-hosting', '-s', 'user']); } catch { /* may not exist at this scope */ }
+    console.log('✓ MCP server already registered (user scope, env-free) — account selection comes from the folder pin.');
+  }
+
+  // This project's local-scope entry (lives under projects[cwd] in ~/.claude.json).
+  const localEntry = cfg.projects?.[cwd]?.mcpServers?.['awesomate-hosting'];
+  if (localEntry?.env?.AWESOMATE_PAT) {
+    delete cfg.projects[cwd].mcpServers['awesomate-hosting'];
+    changed = true;
+    console.log("✓ Removed this project's legacy local-scope registration (token baked into env).");
+  }
+  // Other projects: report, don't touch.
+  for (const [projectDir, project] of Object.entries(cfg.projects ?? {})) {
+    if (resolve(projectDir) === cwd) continue;
+    if (project?.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) {
+      console.log(`• ${projectDir} still has a legacy registration with a baked-in token — from that folder run the Connect command again, or remove the awesomate-hosting entry from its local MCP config.`);
     }
-    claudeCli(['mcp', 'add', '--scope', 'user', 'awesomate-hosting', '--',
-      'npx', '-y', '-p', '@awesomate/hosting-mcp', 'awesomate-hosting-mcp']);
-    console.log('✓ Registered the Awesomate Hosting MCP server (user scope, env-free — the folder pin picks the account).');
   }
 
-  for (const w of warnings) {
-    console.log(`• Another project still has a legacy registration with a baked-in token. From that project run:\n    ${w}`);
+  if (changed) writeJsonFile(claudeJsonPath, cfg);
+
+  // Project-scope .mcp.json in cwd.
+  const mcpJsonPath = join(cwd, '.mcp.json');
+  const mcpJson = readJsonFile(mcpJsonPath);
+  if (mcpJson?.mcpServers?.['awesomate-hosting']?.env?.AWESOMATE_PAT) {
+    delete mcpJson.mcpServers['awesomate-hosting'];
+    writeJsonFile(mcpJsonPath, mcpJson);
+    console.log('✓ Removed the legacy project-scope (.mcp.json) registration (token baked into env).');
   }
 }
 
 async function main() {
-  console.log(`Redeeming setup code against ${apiBase} …`);
-  const redeemed = await post('/api/hosting-access/redeem', {
-    body: { code, machineLabel: `Claude Code on ${hostname()}` },
-  });
+  await initProxySupport();
+  const issues = [];
+
+  // ── Identity: redeem a code, or verify a resumed PAT ─────────────────────
+  let redeemed;
+  if (resumePat) {
+    console.log(`Resuming with an existing access token — verifying against ${apiBase} …`);
+    const ctx = await get('/api/hosting-access/context', { token: resumePat });
+    redeemed = {
+      pat: resumePat,
+      contactId: ctx.contactId,
+      slug: ctx.slug ?? null,
+      email: ctx.email ?? null,
+      plan: ctx.plan,
+      shellAccess: Boolean(ctx.capabilities?.shell),
+      cpanel: ctx.cpanel ?? null,
+      expiresAt: ctx.patExpiresAt ?? null,
+    };
+  } else {
+    console.log(`Redeeming setup code against ${apiBase} …`);
+    redeemed = await post('/api/hosting-access/redeem', {
+      body: { code, machineLabel: `Claude Code on ${hostname()}` },
+    });
+  }
 
   const slug = redeemed.slug ?? null;
   if (!slug) {
-    console.error('The hub did not return an account slug for this code — cannot safely store a profile. Contact Awesomate support.');
+    console.error('The hub did not return an account slug — cannot safely store a profile. Contact Awesomate support.');
     console.error('AWESOMATE CONNECT: FAILED reason=no-slug');
     process.exit(1);
   }
   // Wrong-account guard: abort BEFORE writing anything.
   if (expectedAccount && expectedAccount !== slug) {
-    console.error(`This setup code belongs to account "${slug}" but this connect was for "${expectedAccount}".`);
+    console.error(`This ${resumePat ? 'token' : 'setup code'} belongs to account "${slug}" but this connect was for "${expectedAccount}".`);
     console.error(`You are probably logged into the wrong hub account — log into ${expectedAccount}'s hub account and copy a fresh Connect prompt.`);
     console.error(`AWESOMATE CONNECT: FAILED reason=account-mismatch expected=${expectedAccount} got=${slug}`);
     process.exit(1);
   }
 
-  // Server-side identity check with the NEW token before trusting it.
-  let context = null;
-  try {
-    context = await get('/api/hosting-access/context', { token: redeemed.pat });
-  } catch (err) {
-    console.error(`Token verification failed (${err.message}) — not storing it. Re-run with a fresh code from hub.awesomate.ai/sites.`);
-    console.error('AWESOMATE CONNECT: FAILED reason=verify-failed');
-    process.exit(1);
-  }
-  const ctxSlug = context?.slug ?? context?.account?.slug ?? null;
-  if (ctxSlug && ctxSlug !== slug) {
-    console.error(`Identity mismatch: redeem said "${slug}" but the token resolves to "${ctxSlug}". Not storing it — contact Awesomate support.`);
-    console.error('AWESOMATE CONNECT: FAILED reason=identity-mismatch');
-    process.exit(1);
+  // Server-side identity check with the NEW token before trusting it (the
+  // resume path already did exactly this to build `redeemed`).
+  if (!resumePat) {
+    let context = null;
+    try {
+      context = await get('/api/hosting-access/context', { token: redeemed.pat });
+    } catch (err) {
+      console.error(`Token verification failed (${err.message}) — not storing it. Re-run the same command (setup codes stay valid for 10 minutes).`);
+      console.error('AWESOMATE CONNECT: FAILED reason=verify-failed');
+      process.exit(1);
+    }
+    const ctxSlug = context?.slug ?? null;
+    if (ctxSlug && ctxSlug !== slug) {
+      console.error(`Identity mismatch: redeem said "${slug}" but the token resolves to "${ctxSlug}". Not storing it — contact Awesomate support.`);
+      console.error('AWESOMATE CONNECT: FAILED reason=identity-mismatch');
+      process.exit(1);
+    }
+    redeemed.email = redeemed.email ?? context?.email ?? null;
   }
 
   const profile = {
@@ -304,7 +426,7 @@ async function main() {
     pat: redeemed.pat,
     contactId: redeemed.contactId,
     slug,
-    email: redeemed.email ?? context?.email ?? context?.account?.email ?? null,
+    email: redeemed.email ?? null,
     plan: redeemed.plan,
     cpanel: redeemed.cpanel ?? null,
     expiresAt: redeemed.expiresAt ?? null,
@@ -315,8 +437,8 @@ async function main() {
   const pinPath = writePin(slug);
 
   // Install the skill + register the MCP server FIRST — these always work and
-  // don't depend on hosting being fully provisioned. SSH comes last so that a
-  // shell/provisioning hiccup can't strand the skill or MCP.
+  // don't depend on hosting being fully provisioned. Neither is allowed to
+  // strand the other or SSH: every step from here is collected, not fatal.
   try { installSkill(); } catch (err) {
     console.log(`• Could not auto-install the skill (${err.message}) — continuing; you can copy skill/ manually.`);
   }
@@ -324,15 +446,15 @@ async function main() {
   try {
     ensureMcpRegistration();
   } catch (err) {
-    console.error(`MCP registration failed: ${err.message}`);
-    console.error(`Register it manually (no token goes in the command — the folder pin picks the account):\n  ${MANUAL_ADD}`);
-    console.error(`AWESOMATE CONNECT: FAILED reason=mcp-registration account=${slug}`);
-    process.exit(1);
+    issues.push('mcp-registration');
+    console.error(`• MCP registration failed: ${err.message}`);
+    console.error(`  Add it manually (no token goes in the config — the folder pin picks the account):\n${MANUAL_ADD_JSON}`);
   }
 
   // SSH key (Support Plus+): best-effort. If it fails (e.g. hosting not fully
-  // provisioned yet), keep the token + skill + MCP — deploy/shell just aren't
-  // ready until it's registered, which the skill can retry later.
+  // provisioned yet, or no ssh tooling in this environment), keep the token +
+  // skill + MCP — deploy/shell just aren't ready until it's registered, which
+  // the skill can retry later.
   if (redeemed.shellAccess) {
     try {
       if (!existsSync(keyPath)) {
@@ -349,8 +471,12 @@ async function main() {
       mergeProfile(profile);
       console.log(`✓ SSH key authorized on ${reg.sshUser}@${reg.sshHost} (jailed to your account).`);
     } catch (err) {
-      console.log(`• SSH key not registered yet: ${err.message}`);
-      console.log('  Everything else is set up. This usually means hosting isn\'t fully provisioned — contact Awesomate support, then ask me to "retry SSH setup".');
+      if (err?.code === 'ENOENT') {
+        console.log('• No ssh-keygen in this environment — skipping SSH setup. Deploy and shell need a real workstation; reads and management calls work fine here.');
+      } else {
+        console.log(`• SSH key not registered yet: ${err.message}`);
+        console.log('  Everything else is set up. This usually means hosting isn\'t fully provisioned — contact Awesomate support, then ask me to "retry SSH setup".');
+      }
     }
   } else {
     console.log('• Plan has no shell access — read/status mode. Upgrade to Support Plus for SSH + deploy.');
@@ -360,12 +486,18 @@ async function main() {
   console.log(`\n✓ Connected: ${who}${pinPath ? ` — pinned ${dirname(pinPath)}` : ''}`);
   console.log('Setup complete. Next: run awesomate_whoami to confirm the account, then ask me to read your plan and list your sites.');
   console.log('(The skill works in your current Claude session right away via its REST fallback — restart Claude Code when convenient to load the MCP tools.)');
+  if (issues.length) {
+    console.log(`AWESOMATE CONNECT: PARTIAL account=${slug} pin=${pinPath ?? 'none'} issues=${issues.join(',')}`);
+    process.exit(1);
+  }
   console.log(`AWESOMATE CONNECT: SUCCESS account=${slug} pin=${pinPath ?? 'none'}`);
 }
 
 main().catch((err) => {
   console.error('Bootstrap failed:', err.message);
-  console.error('If the code expired or was already used, grab a fresh one from hub.awesomate.ai/sites.');
+  if (err.isApiError && err.status === 401) {
+    console.error('Grab a fresh code from hub.awesomate.ai/sites — codes last 10 minutes (and stay re-runnable within that window).');
+  }
   console.error('AWESOMATE CONNECT: FAILED reason=error');
   process.exit(1);
 });