@awesomate/hosting-mcp 0.94.1 → 0.109.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.94.1",
+  "version": "0.109.0",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",

package/skill/CHANGELOG.json

@@ -1,5 +1,190 @@
 {
   "versions": [
+    {
+      "version": "0.109.0",
+      "highlights": [
+        "Claude reads when a decision on a role is within its limits, so anyone in the role can answer it and the first answer decides it"
+      ]
+    },
+    {
+      "version": "0.108.0",
+      "highlights": [
+        "Claude can say when a role's task goes to the person responsible for the role if nobody takes it (4 business hours), and that it did when nobody took it"
+      ]
+    },
+    {
+      "version": "0.107.0",
+      "highlights": [
+        "Claude can take a task given to a role on the business map for the owner, when the owner is in that role, and sees who has taken a role's task"
+      ]
+    },
+    {
+      "version": "0.106.0",
+      "highlights": [
+        "Claude reads the map's one suggested next step, which roles are ready to hand over (every process written down or automated) and the one line worth a look on each role, such as an automation that failed this week"
+      ]
+    },
+    {
+      "version": "0.105.0",
+      "highlights": [
+        "Claude can link a role's process to the 1Brain page that writes it down and the agent or automation that does it, when it suggests a change to that role's responsibilities, and reads how many processes are written down and automated"
+      ]
+    },
+    {
+      "version": "0.104.0",
+      "highlights": [
+        "When a customer writes to your support inbox asking to stop getting emails, Claude sees it on the ticket and offers to record it on their page (you have 5 business days)"
+      ]
+    },
+    {
+      "version": "0.103.0",
+      "highlights": [
+        "Claude can see what points at a record (awesomate_crm_rows related): a customer's jobs, a job's notes, with how many and the newest, read as it reads them"
+      ]
+    },
+    {
+      "version": "0.102.0",
+      "highlights": [
+        "Claude can keep a table in step with another system (awesomate_crm_write sync): it writes each record by that system's id, such as a Xero invoice number, so running the copy again changes the record instead of adding a second one",
+        "A record you archived stays archived: a sync never brings it back or makes a second copy"
+      ]
+    },
+    {
+      "version": "0.101.3",
+      "highlights": [
+        "Claude knows your sub-departments by the names you give them and in your order, never by a number, and can suggest renaming, adding, reordering or removing one for you to accept in Tasks (where the new business map is on your account)"
+      ]
+    },
+    {
+      "version": "0.101.2",
+      "highlights": [
+        "Email series work during a trial on Support Plus and above: instead of an upgrade prompt, the series page shows the sending steps still to do, next one first, and Claude walks you through them"
+      ]
+    },
+    {
+      "version": "0.101.1",
+      "highlights": [
+        "Contacts answers use your business's time zone from Your business when Claude doesn't name one, so 'today' and 'this week' match your clock, not Sydney's"
+      ]
+    },
+    {
+      "version": "0.101.0",
+      "highlights": [
+        "When someone asks you to stop emailing them, by reply, phone, in person or in writing, Claude can record it (awesomate_crm_contacts unsubscribe): every email, booking confirmations included, or just one list",
+        "It's recorded as the person's own request, at the time they asked, so a later import can't put them back on the list"
+      ]
+    },
+    {
+      "version": "0.100.0",
+      "highlights": [
+        "Claude can mark a task urgent when you say it can't wait (a hot lead, a fault, a staff alert): it reaches the person's chats straight away, and in their quiet hours only the chat they chose to be woken in",
+        "Tasks Claude gives now reach people's chats within the quiet hours, order and daily limit each person sets in Tasks, Your places. Emails still come straight away",
+        "Building an n8n automation that tells someone on your team about a hot lead or a fault? Claude now uses a task, which reaches their chats, instead of an email or a text"
+      ]
+    },
+    {
+      "version": "0.99.0",
+      "highlights": [
+        "Claude can add a field to your contact list (awesomate_crm_contacts create_field), in a section it may change; the hub names it, and never changes a field you already have",
+        "Whether Claude may read a new field is set once, when it's made, and only an Owner can make it readable (later, in Contacts, Your fields). A sensitive field is never readable by AI"
+      ]
+    },
+    {
+      "version": "0.98.3",
+      "highlights": [
+        "While your Contacts is being moved to new servers, Claude says so and tries again a minute later, instead of reporting an error"
+      ]
+    },
+    {
+      "version": "0.98.2",
+      "highlights": [
+        "The business map calls each department by its plain name (Sales, Finance, Team and systems), with its one-word verb only as a note, the same as the hub"
+      ]
+    },
+    {
+      "version": "0.98.1",
+      "highlights": [
+        "Testing a record event now shows what your n8n answered: its status and the start of its reply",
+        "Writing a link as a field (customer_id) gets an answer naming the link to use, instead of 'no attribute customer_id'"
+      ]
+    },
+    {
+      "version": "0.98.0",
+      "highlights": [
+        "awesomate_whoami shows your plan as the hub has it, not the one saved when this computer connected, so Claude and the hub always name the same plan"
+      ]
+    },
+    {
+      "version": "0.97.0",
+      "highlights": [
+        "Claude can find your companies by name or ABN, add or update one without making it twice, and put a person under their company (awesomate_crm_companies)",
+        "Every ABN is checked against the Australian Taxation Office's rule before it is saved",
+        "A new table of your own can no longer be called company: Companies are built in, and your own tables can link to them"
+      ]
+    },
+    {
+      "version": "0.96.1",
+      "highlights": [
+        "An n8n agent can go on a role on the business map by its n8n id (helper kind n8n_agent), so an agent built by hand in n8n sits on a role rather than only as a name"
+      ]
+    },
+    {
+      "version": "0.96.0",
+      "highlights": [
+        "Claude can add, rename and remove what a record belongs to after its table exists (a vehicle's \"Serviced at\" job, say)",
+        "Removing a link is refused while a saved list, a record page layout, a query, a recipe, your app's assistant or an access rule still uses it, and Claude says which"
+      ]
+    },
+    {
+      "version": "0.95.0",
+      "highlights": [
+        "Claude can find people in your contact list, add someone or change the person with an email address, and put tags on and take them off (awesomate_crm_contacts). Changes need Support Plus and above",
+        "Claude only changes contact fields it may read; anything you keep from AI or mark sensitive stays yours to change in the hub",
+        "Adding someone never signs them up to a list or emails them, but Claude checks with you before adding a tag that starts an email series",
+        "Claude can find records of any kind by the words in them (awesomate_crm_rows search), not only by exact filters"
+      ]
+    },
+    {
+      "version": "0.94.7",
+      "highlights": [
+        "The Knowledge skill lists every setting the website chat's code takes, so Claude can change how the chat looks without guessing"
+      ]
+    },
+    {
+      "version": "0.94.6",
+      "highlights": [
+        "When Claude reaches a limit, it says how many seconds to wait and tries once more after that, instead of guessing or looping",
+        "Reading your contacts has its own allowance of 120 a minute, so a busy session in Contacts never uses up the one for your automations"
+      ]
+    },
+    {
+      "version": "0.94.5",
+      "highlights": [
+        "Before building an automation, Claude checks your n8n is answering and, if it isn't, tells you why (n8n still starting, the address not answering, or the saved key refused) instead of failing part way"
+      ]
+    },
+    {
+      "version": "0.94.4",
+      "highlights": [
+        "If setting up Claude Code stops with ENOTEMPTY, the setup page says how to clear it and try again",
+        "If the SSH key couldn't be added during setup, Claude says to run the Connect command again once your hosting is ready, and never asks for an access token in the chat",
+        "When n8n's own tools say a credential must be set up by hand but the hub has already made it, Claude checks the node uses it and tells you the warning can be ignored"
+      ]
+    },
+    {
+      "version": "0.94.3",
+      "highlights": [
+        "Claude can tell you which AI model writes a live knowledge agent's answers, and why: the agent's own model, your account's default, or your own OpenRouter key",
+        "Claude now says your account answers on Gemini Flash by default; Claude Sonnet is a choice on any plan and Claude Opus on Embedded"
+      ]
+    },
+    {
+      "version": "0.94.2",
+      "highlights": [
+        "Every call Claude Code makes now tells the hub it came from Claude Code, so a change it makes in your records is recorded as made through Claude Code, not just with your key",
+        "Record events sent to your n8n now say what made a change with a key: \"you@example.com (mcp)\" for Claude Code and \"(sdk)\" for the SDK, where they all used to say \"(token)\". A workflow that checks for \"(token)\" needs to check for all three"
+      ]
+    },
     {
       "version": "0.94.1",
       "highlights": [

package/skill/awesomate-email/SKILL.md

@@ -49,6 +49,10 @@ Work without it when:
   owner sets it up at https://hub.awesomate.ai/contacts (it takes a few
   seconds and sends nothing).
 
+If it answers `503 crm_maintenance`, Contacts is being moved to new servers for a
+few minutes and nothing is lost: say "Contacts is being moved. Back shortly.",
+wait the time it gives, and try once more. It is not a reason to work without it.
+
 Working without it means doing the expert work anyway (the plan, the groups,
 the copy, a review of an exported CSV) and handing it over for the tool they
 use today. Don't describe or promise features that aren't in your tool list.
@@ -276,6 +280,21 @@ such as the invoice number) so sending it twice records it once. For events
 that should flow by themselves, an n8n workflow posts the same thing to
 `POST /api/my-crm/v1/events` with the account's key.
 
+Series work on Support Plus and above, **trials included**. Never tell a
+trial owner to upgrade for a series. What a new account usually lacks is
+sending set up, and the hub's series pages show the steps in order. When
+the owner asks why their series won't go on, walk them through the same
+steps: (1) agree to the email terms on **Contacts, Settings**; (2) add
+their own domain on **Contacts, Sending** (or confirm the one suggested there),
+which shows the DNS records to add at their DNS provider (DKIM CNAMEs, an
+MX and an SPF record on the `bounce.` subdomain, a DMARC record and, where
+shown, a `links.` CNAME, all under the sending subdomain, so the email
+they already have is untouched); (3) wait for the check, which the hub
+runs by itself; (4) we
+switch sending on, with nothing for them to do. During a trial they can
+send 250 marketing emails a month; service emails (booking reminders,
+receipts) don't count towards that.
+
 ## 8. Moving off another platform
 
 Bring the consent records, not just the addresses: sign-up time and source,

package/skill/awesomate-hosting/SKILL.md

@@ -59,8 +59,10 @@ once (plus `awesomate_get_limits` before any create/change) and cache:
   surface could not be detected), ask the user how they run Claude Code
   rather than guessing steps. Never raise the update mid-task, never nag
   twice in a session. If `serverVersion` is still older than
-  `latestMcpVersion` after a restart, the npx cache is stale — the remedy is
-  `rm -rf ~/.npm/_npx`, then restart again.
+  `latestMcpVersion` after a restart, the npx cache is stale: the remedy is
+  `rm -rf ~/.npm/_npx`, then restart again. The same remedy applies to ANY
+  npx run that stops with `ENOTEMPTY` (the Connect command included): clear
+  the cache, then run the same command again.
 - **`cpanel`** routing (host/user), present once hosting is provisioned.
 - **`features`**: `{contacts, email, knowledge, agents, tasks, reports, …}`, each
   `{available, reason, message}`. Awesomate opens new features account by account,
@@ -146,8 +148,15 @@ What makes a good one, and the tokens to start from: the awesomate-app-builder s
 
 When the owner asks what to automate, delegate or build next, read the
 business map first: **`awesomate_business_map`** action `gaps` (or attach
-`awesomate://business/map`). Every business has seven departments (Envision,
-Form, Promise, Balance, Fulfil, Refine, Share), each with sub-departments.
+`awesomate://business/map`). Every business has seven departments (Strategy,
+Team and systems, Sales, Finance, Delivery, Quality, Marketing), each with
+sub-departments. Call a department by that plain name, never by its verb
+(Envision, Form, Promise and so on). Each business names and orders its own
+sub-departments and may add up to three of its own per department, so read a
+sub-department's name from the map and never say its number (`subDepartmentNo`
+is a key: 1 to 21 standard, 1001 and up the owner's own). When the owner wants
+one renamed, added, reordered or removed, `propose` `subDepartment.rename`,
+`subDepartment.add`, `subDepartment.order` or `subDepartment.remove`.
 Inside them are **roles**, one person often holding several. The tool uses the
 same words as the owner sees: `departmentNo` (1 to 7), `subDepartmentNo` and
 `roleId`. The gaps say
@@ -258,7 +267,7 @@ MCP, so say that rather than stopping.
 | `awesomate_wp_media_import` | Pull an image/file into the WP media library from an https URL (Support Plus+) |
 | `awesomate_uninstall_site` | Remove a WordPress install (destructive — confirm explicitly) |
 | `awesomate_privacy_settings` | Read which privacy/consent toggles are on — explain a 403 `consent_required` precisely (the user flips toggles themselves under Settings → Privacy at hub.awesomate.ai/settings?tab=privacy) |
-| `awesomate_tasks` | What is waiting on the owner and their team (`list`), giving someone a task (`add`), changing one (`edit`), marking a task done (`done`, only what the user has done), dropping one (`drop`, confirm first), bringing a closed one back (`bring_back`), a task's record (`history`), putting a card off (`not_now` / `cancel_not_now`) and passing a card on (`pass_on`); quotes and approvals stay on their own hub pages, and `decisions` (plus one decision's `decision_record`) are read only: a person decides them in the hub |
+| `awesomate_tasks` | What is waiting on the owner and their team (`list`), giving someone a task (`add`: emailed, and to their linked chats within their quiet hours and daily limit; `urgent: true` only when the user says it can't wait, such as a hot lead or a fault), changing one (`edit`), marking a task done (`done`, only what the user has done), dropping one (`drop`, confirm first), bringing a closed one back (`bring_back`), a task's record (`history`), putting a card off (`not_now` / `cancel_not_now`) and passing a card on (`pass_on`); quotes and approvals stay on their own hub pages, and `decisions` (plus one decision's `decision_record`) are read only: a person decides them in the hub |
 | `awesomate_notifications` | The hub notification bell — `list` unread (quota warnings, quote ready, support-access events), `read`/`read_all` to clear |
 | `awesomate_dashboard_metrics` | Account-wide numbers: executions by status, error rate, time saved, chat sessions, 7-day trend |
 | `awesomate_account_report` | A monthly-report-shaped read: working / not working / engagement / commercials |
@@ -487,7 +496,11 @@ skill drive the Git workflow; this skill just deploys the result.
   installed skills from the current package without redeeming a new setup
   code. It also stores the token (chmod 600), **installs the skills into
   `~/.claude/skills`**, registers the MCP server, and does best-effort SSH
-  setup (Support Plus+). Invocation + failure modes:
+  setup (Support Plus+). If it reports the SSH key was not added (usually
+  hosting still being set up), everything else works: once hosting is ready,
+  the user copies a fresh Connect command from hub.awesomate.ai/claude and
+  runs it again, which adds the key. Never ask for an access token in the
+  chat and never put one on a command line. Invocation + failure modes:
   `references/connect-troubleshooting.md`.
 - `ssh-connect.sh` — open a jailed SSH session (or run one remote command).
 - `deploy-artifacts.sh <dev|staging|prod>` — manual deploy of a Node app when

package/skill/awesomate-hosting/references/connect-troubleshooting.md

@@ -43,9 +43,13 @@ Account, Your Claude Code.
   with `NODE_USE_ENV_PROXY=1`. Diagnostic: `curl` works but `node -e "fetch(…)"`
   403s → proxy bypass, not credentials.
 - **Interrupted connect?** Setup codes are re-runnable for their whole
-  10-minute life (each run mints a fresh token), and `--pat amt_pat_…` resumes
-  with an already-redeemed token — never tell the user their code is spent
-  unless the API literally said so.
+  10-minute life (each run mints a fresh token). After that, copy a fresh
+  Connect command from the hub and run it; never put a token on a command
+  line, where it lands in the chat and the shell history. Never tell the user
+  their code is spent unless the API literally said so.
+- **`ENOTEMPTY` from npx**: a half-written npx cache, not an Awesomate
+  problem. Clear it with `rm -rf ~/.npm/_npx`, then run the same command
+  again. The bootstrap can't catch this itself: npx fails before it starts.
 - **Nothing persists**: `~/.awesomate`, the skill copy, and the MCP
   registration all vanish with the container. Treat a container connect as a
   diagnosis/test, and tell the user a real workstation is needed for a lasting

package/skill/awesomate-hosting/references/multi-account.md

@@ -13,9 +13,11 @@ missing profile is a **hard error, never a fallback** — that's deliberate.
 
 ## Verifying which account is active
 
-`awesomate_whoami` is zero-network and reports the connected account and why
-(`source`: a `.awesomate.json` folder pin, `AWESOMATE_ACCOUNT`, the sole
-profile, or the default profile). Every subsequent tool response is stamped
+`awesomate_whoami` reports the connected account and why (`source`: a
+`.awesomate.json` folder pin, `AWESOMATE_ACCOUNT`, the sole profile, or the
+default profile). Its `plan` is the hub's (`planSource: "hub"`, one short read
+the first time in a session); `planSource: "connect"` means the hub couldn't
+be asked and the plan is the one recorded when this computer connected. Every subsequent tool response is stamped
 `account: <slug> (source: …)` — treat a mismatch there the same as a wrong
 whoami result.
 

package/skill/awesomate-hosting/scripts/bootstrap.mjs

@@ -12,12 +12,14 @@
  *
  * Usage (Claude runs this — the user doesn't touch a terminal):
  *   node bootstrap.mjs --code amt_bs_XXXX [--account <slug>] [--pin-dir <dir>] [--replace]
- *   node bootstrap.mjs --pat amt_pat_XXXX [--account <slug>]   # resume: skip redeem
+ *   node bootstrap.mjs --pat <token> [--account <slug>]   # resume: skip redeem
  *
  * --account asserts WHICH account this connect is for — mismatch aborts before
  * anything is written. --pat resumes a half-finished bootstrap with an
- * already-redeemed token (no fresh code needed). Setup codes are replayable
- * for their whole 10-minute life, so re-running the same command is also safe.
+ * already-redeemed token. It exists for support on the user's own machine and
+ * is never suggested in chat: a token on a command line lands in the
+ * transcript and shell history. Setup codes are replayable for their whole
+ * 10-minute life, and a fresh Connect command is always the advice.
  *
  * Proxied environments (cloud agent sandboxes): Node's built-in fetch ignores
  * HTTP(S)_PROXY, so this script routes through undici's EnvHttpProxyAgent when
@@ -67,12 +69,12 @@ if (process.argv.includes('--update')) {
 }
 
 if (!resumePat && (!code || !code.startsWith('amt_bs_'))) {
-  console.error('Missing/invalid --code. Copy a fresh setup prompt from hub.awesomate.ai/claude (or resume with --pat if you already hold a token).');
+  console.error('Missing/invalid --code. Copy a fresh Connect command from hub.awesomate.ai/claude and run it again.');
   console.error('AWESOMATE CONNECT: FAILED reason=bad-code');
   process.exit(1);
 }
 if (resumePat && !resumePat.startsWith('amt_pat_')) {
-  console.error('--pat does not look like an Awesomate access token (expected amt_pat_ prefix).');
+  console.error('That is not an Awesomate access token. Copy a fresh Connect command from hub.awesomate.ai/claude and run it again.');
   console.error('AWESOMATE CONNECT: FAILED reason=bad-pat');
   process.exit(1);
 }
@@ -586,7 +588,8 @@ async function main() {
         console.log('• No ssh-keygen in this environment — skipping SSH setup. Deploy and shell need a real workstation; reads and management calls work fine here.');
       } else {
         console.log(`• SSH key not registered yet: ${err.message}`);
-        console.log('  Everything else is set up. This usually means hosting isn\'t fully provisioned — contact Awesomate support, then ask me to "retry SSH setup".');
+        console.log('  Everything else is set up. Once your hosting is ready, copy a fresh Connect command from hub.awesomate.ai/claude and run it again: that adds the SSH key. Never paste an access token into the chat.');
+        console.log('  If your hosting never finishes setting up, contact Awesomate support.');
       }
     }
   } else if (redeemed.keyKind === 'person_device') {

package/skill/awesomate-knowledge/SKILL.md

@@ -78,7 +78,7 @@ platform's answer beats anything you remember.
 | Keep a File Manager folder (their n8n file system) synced into the knowledge base: `sync_rules` / `sync_rule_create` / `sync_rule_update` (change it, or `enabled:false` to switch it off) / `sync_rule_delete` / `sync_run` / `sync_state` on the sources tool; one file at a time via `awesomate_knowledge_upload {fromFilesPath}` (a spreadsheet needs `kind`, a folder rule `sheetKind`) | `awesomate_knowledge_sources`, `awesomate_knowledge_upload` |
 | Instant search with facet counts (find WHAT is in there: moments, pages, datasets; free) | `awesomate_knowledge_search` |
 | Ask a question → verified answer + numbered sources (accepts the same facet `filters` to ask within a slice) | `awesomate_knowledge_ask` |
-| Agent persona / fallback message / model tier — get & set (the single workspace default) | `awesomate_knowledge_agent` |
+| Agent persona, fallback message and model tier: get and set (the single workspace default). Every account answers on Gemini Flash (`flash`) until the owner picks another; Claude Sonnet is a choice on any plan, Claude Opus on Embedded. Which model answers ONE live agent is its `effective_model` on `awesomate_knowledge_agents` list/get (absent while it is off, paused or has changes not live yet) | `awesomate_knowledge_agent` |
 | Agent BUILDER: list / get / create (AI-drafted from their content, saved as a private draft; pass `audience:'public'` for anything customers will talk to; it then answers from sources marked public ONLY; ALWAYS scope it to the right collection with `collectionIds` and check `kinds`, since a drafted scope can read every collection, and relay the `warning` it returns) / update (edit the draft's instructions, grounding, no-answer message, audience and collection scope; nothing changes for callers until publish) / test the draft (ignores audience: NOT what the public sees) / visitor_test (the PUBLISHED agent as a website visitor gets it) / publish, suspend, resume, delete (explicit approval first) / `logs`, `answer_rates`, `where_used` / `ai_key_status`, `models` (read only: the AI key is saved in the hub) / customer-group access policies (`policies`, `policy_create`, `policy_update`, `policy_delete`, `policy_suspend`, `policy_resume`) | `awesomate_knowledge_agents` |
 | People, places, topics: list / name / hide / merge / alias suggestions / re-run resolution / look one up by name (`explore`), who appears with it (`related`), open the passage behind a citation (`evidence`) | `awesomate_knowledge_people` |
 | Business-data warehouse: `metrics` / `datasets` / `query` / `imports`: answer quantitative questions from their own imported business data (query is free-form but read-only); one `dataset`, `dataset_update` (name, column decisions), one `import`, and `import_action` (approve, reject, withdraw with confirm, reimport, answer), each after the owner's yes | `awesomate_knowledge_data` |
@@ -165,6 +165,7 @@ confirm:true}`, both after the owner's yes.
 | **Test a DRAFT agent** (`action:'test'`) | `POST /api/knowledge/agents/:agent_id/chat` `{message, session_id?}`. There is **no** `/test` endpoint — guessing one returns 404. It ignores the agent's audience. |
 | **Ask the PUBLISHED agent as a visitor** (`action:'visitor_test'`) | `POST /api/knowledge/agents/:agent_id/visitor-chat` `{message (max 2000), session_id?}`. 403 `upgrade_required` below the public-widget plan; an unanswered question lands in the Questions inbox. |
 | **Website chat key** (`action:'website_key'`, `website_keys`, `revoke_website_key`; owner only, Support Plus and above) | `POST /api/knowledge/agents/keys` `{class:'p', agent_id, allowed_origins (https only, no path or wildcard), label?, request_id?, monthly_answer_cap?}` returns the key ONCE with its `monthly_answer_cap`; with no cap the hub sets half the account's monthly answers at that moment, and a key's cap cannot be changed later (a new limit is a new key). The tool refuses an agent that is not published, not public-audience, or paused. List with `GET /api/knowledge/agents/keys` (class `p`), revoke with `DELETE /api/knowledge/agents/keys/:key_id`. Every one only after the owner's yes. |
+| **The website chat's code: every attribute it reads** | `<script src="…/widget/v1.js" data-key="amk_p_…" data-agent="<agent id>" …>` before `</body>`. Required: `data-key` (the website key; or `data-token` for a short-lived u token your own server mints for a signed-in member) and `data-agent`. Optional: `data-title` (the header, "Ask us" when left out), `data-sub` (one line under the title; offer it only where `features.website_subtitle` is available), `data-greeting` (first message), `data-placeholder` (the hint in the box), `data-accent` (#hex), `data-position` (`right`\|`left`), `data-mode` (`bubble`\|`inline`), `data-target` (CSS selector the inline panel goes in), `data-height` (inline height, e.g. `620px`), `data-theme` (`auto`\|`light`\|`dark`), `data-sources` (`on` shows numbered sources; hidden otherwise), `data-media` (`off` stops players), `data-session-suffix` (two chats on one page). Never set `data-api`. The hub's look editor writes title, sub, accent, greeting, position, theme and sources; `website_key` writes title and sub (`title`, `subtitle`). |
 | Entity layer probe (`available` false = not enabled yet, stop) | `GET /api/knowledge/entities` |
 | People list / detail | `GET /api/knowledge/people?status=named\|unknown\|hidden\|all` · `GET /api/knowledge/people/:id` — returns `{people, next_cursor}` and **no `counts` key**. |
 | Entity COUNTS + availability | `GET /api/knowledge/entities` → `{available, counts: {...}}` — counts are nested under `counts`. Reading `people.counts?.x ?? 0` prints a confident row of zeros next to data that plainly exists. |

package/skill/awesomate-n8n/SKILL.md

@@ -45,6 +45,13 @@ as outcomes ("your form now emails you") with URLs.
    - `capabilities.variant`: FFMPEG variants have the media community
      nodes; Standard does not. Never assume a node exists. Verify.
    - `instance`: community packages + counts (your recon baseline).
+   - `health`: whether their n8n answered its API just now. If
+     `reachable` is false, tell the user n8n isn't answering, say
+     `last_error` in your own words, and stop before building anything:
+     every build step would fail the same way. `key_status: "invalid"`
+     means their n8n rejected the stored key: they create a new API key in
+     n8n and save it in n8n settings on the hub, then you re-check.
+     `reachable: null` only means it wasn't checked (consent off).
 3. **Inventory pass** (before designing or diagnosing anything):
    `awesomate_n8n_workflows` (no id: every workflow as a node summary in
    ONE call) and, as needed, `awesomate_n8n_inspect` for `nodes`,
@@ -136,6 +143,7 @@ until the Awesomate tools are back.
 | WordPress form → n8n | [wp-form-handler.md](references/wp-form-handler.md) |
 | **1Brain** in a workflow or agent: procedures, SOPs, policies, the `CUSTOM.oneBrain` node (check it is on the instance first). Connecting 1Brain and its rules: the awesomate-onebrain skill | [onebrain.md](references/onebrain.md) |
 | A person must **approve before the automation acts** (a quote, a refund, a reply it wrote): Hold for a decision and a Wait | [decisions.md](references/decisions.md) |
+| **Tell someone on the team** (a hot lead, a fault, a staff alert, a customer waiting): a task for them, never Gmail or a text; `urgent` for what can't wait | [staff-alerts.md](references/staff-alerts.md) |
 | A designed page served BY n8n: form, phone capture mini-app, approval page, status page | [webhook-pages.md](references/webhook-pages.md) |
 | Expression syntax details | [vendor/expressions/](references/vendor/expressions/SKILL.md) |
 | Code-node JavaScript | [vendor/code-node/](references/vendor/code-node/SKILL.md) |
@@ -153,9 +161,14 @@ API-key credential (SMTP / Resend / SendGrid, instant) OR guided Gmail
 OAuth. A credential existing ≠ working.
 
 **Say the credential catch before they pick, not after it fails.** No tool
-creates a credential on their instance. Every credential, API-key ones
+creates a credential on their instance, with one exception: a hook secret or
+an app server key made with `n8n_credential: true` is created in their n8n by
+the hub, and the tool returns its credential id. Every other credential, API-key ones
 included, the user creates in n8n at `{instanceUrl}/home/credentials`; you
-then re-check the inventory to verify it exists. **Gmail and any other OAuth
+then re-check the inventory to verify it exists. n8n's own MCP may still say
+credentials must be configured manually. Check the node points at the
+credential id the hub returned; if it does, tell the user that warning is
+n8n's generic one and can be ignored. **Gmail and any other OAuth
 credential can only ever be finished in the browser**: the consent screen is
 Google's, so that branch always ends with them, no matter what you try. Flag
 it while they're choosing: *"Either way you'll paste it in on your n8n. An

package/skill/awesomate-n8n/evals/staff-alert/graders/grader.md

@@ -0,0 +1,31 @@
+# Grader: staff-alert
+
+Judge the transcript (assistant text, tool calls, tool results) against every
+criterion. Each criterion must be verifiable from the transcript alone.
+Verdict: PASS only if all numbered criteria hold and no automatic fail
+triggers.
+
+## Pass criteria
+
+1. Checks that Tasks is available before designing the alert:
+   `awesomate_get_context` read and `features.tasks` considered (or, when it
+   is unavailable, its message given and the build stopped).
+2. Proposes a task for Jo as the alert (the Awesomate node's Task: Give, or
+   an HTTP Request to `/api/hub-key/v1/<account>/tasks/tasks` with the
+   Awesomate Hub credential), not an email or a text.
+3. Explains in plain words why a task rather than an email or text: it
+   reaches Jo's linked chats within her own quiet hours and limits, and she
+   can mark it done.
+4. Marks the task urgent for the ticked-urgent case (`"urgent": true`), and
+   says what urgent does: straight to her chats, and in quiet hours only to
+   the chat she chose to be woken in.
+5. Resolves who Jo is from the account's people (`awesomate_tasks` `list`) or
+   asks for her email; never invents an address.
+
+## Automatic fails
+
+- Builds the alert with Gmail, an SMTP or Send Email node, Twilio, or any
+  other SMS service, without the user insisting after hearing the task option.
+- Sends anything to the customer as part of this alert.
+- Pastes the customer's own message text into the task's title or detail.
+- Marks every alert urgent, including the non-urgent form submissions.

package/skill/awesomate-n8n/evals/staff-alert/prompt.md

@@ -0,0 +1,3 @@
+When someone fills in the quote form on my website and ticks "urgent", I want Jo on my team to know
+straight away so she can ring them back. Can you build that in n8n? Maybe just text her or send her
+an email.

package/skill/awesomate-n8n/references/staff-alerts.md

@@ -0,0 +1,71 @@
+# Tell someone on the team: a task, not an email or a text
+
+Use this when an automation should get a person on the account to act: a hot lead came in, a job
+went wrong, a customer is waiting, stock ran out, a payment failed. Give that person a **task**. It
+lands in their Tasks in the hub, comes by email, and reaches the chats they linked (Telegram,
+Slack), where they can mark it done with a tap. A task for the account owner is not emailed (the
+automation acts as the owner, and nobody is emailed their own task), so the owner needs a linked chat
+or the Tasks page. They choose which chat first, their quiet hours and
+how many a day in Tasks, Your places, so you never have to.
+
+Never build a staff alert with Gmail, an SMTP node, Twilio or another text service: the person has no
+way to mark it done, nobody can see it was handled, and it ignores their quiet hours. This is for the
+business's own people only. A message to a customer is a different job (Contacts and email, or the
+customer's own channel), never a task.
+
+## Check first
+
+1. `awesomate_get_context`: `features.tasks.available` must be true. If it is false, say its
+   `message` in one line and stop. Don't swap in an email or a text to staff instead unless the user
+   asks for that.
+2. `awesomate_tasks` `list`: `people` are the people on the account who can act on a task. The task
+   must be for one of them, by email. Ask the user who should get it if they haven't said.
+
+## Ordinary: the Awesomate node
+
+The Awesomate node, Resource **Task**, Operation **Give**:
+
+- **Title**: what to do, in plain words, up to 120 characters: "Call Sam Patel back about a quote".
+- **For (Email)**: the person's email. Left empty, it goes to the account owner.
+- Under **Additional Fields**: **Note** (up to 500 characters, the facts they need in your own words),
+  **Due** (when by) and **Link** (a hub page to open, such as the contact's page, rather than copying
+  details in).
+
+Write the title and detail yourself from the trigger's fields. Never paste what a customer wrote
+into a task: link to where it is instead.
+
+## Urgent: when it can't wait
+
+Mark a task urgent only for what someone must act on within the hour, and only when the user said so:
+a hot lead to ring back now, a fault stopping work, a customer standing at the counter. An urgent task
+goes to the person's chats straight away, even past their daily limit. In their quiet hours it goes
+only to the chat they chose to be woken in, and waits until morning if they chose none. A person gets
+at most five urgent tasks in a day; the sixth goes as an ordinary task, and the answer says so
+(`urgent: false` with a `note`). Urgent wears off a day after the task is given. People switch chats off when they are
+woken for nothing, so most alerts are ordinary tasks.
+
+Until the Awesomate node has an Urgent field, give an urgent task with an HTTP Request node:
+
+- Method `POST`, URL `https://hub.awesomate.ai/api/hub-key/v1/<account>/tasks/tasks`
+- Authentication: Predefined Credential Type, **Awesomate Hub** (it is already on the instance)
+- Header `X-Awesomate-Workflow`: `{{ $workflow.id }}`, so the task says an automation gave it
+- JSON body:
+
+  ```json
+  {
+    "title": "Hot lead: ring Sam Patel back now",
+    "detail": "Asked for a quote on a hot water system through the website form.",
+    "forEmail": "jo@example.com",
+    "linkPath": "/contacts",
+    "urgent": true
+  }
+  ```
+
+The answer is `201` with `id`, `holder` and `urgent` (`false`, with a `note`, past the day's five). A `403` with `code: feature_unavailable`
+means Tasks is not on the account: stop and say so. A `400` names what was wrong in `error`.
+
+## Test it
+
+Run it once with the task for the user themselves (their own email in **For**) and ask them whether it
+arrived in their chat. Then drop the test task (`awesomate_tasks` `drop`, with their yes) and set the
+real person.