@hoststack.dev/mcp 0.16.1 → 0.18.0

package/dist/hoststack-mcp.js

@@ -8,7 +8,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { HostStack } from "@hoststack.dev/sdk";
 
 // src/version.ts
-var MCP_VERSION = true ? "0.16.1" : "0.0.0-dev";
+var MCP_VERSION = true ? "0.18.0" : "0.0.0-dev";
 var USER_AGENT = `hoststack-mcp/${MCP_VERSION}`;
 
 // src/api-client.ts
@@ -228,7 +228,7 @@ definePrompt({
     const text = `Goal: diagnose the most recent failed deploy on service ${service_id} and propose a fix.
 
 Plan (use these tools in order):
-1. \`list_deploys({ service_id: "${service_id}" })\` \u2014 pull recent deploys, newest first. Identify the most recent deploy with status \`failed\` (or \`cancelled\` if the user wants to investigate that too). Capture its publicId, branch, and commitSha.
+1. \`list_deploys({ service_id: "${service_id}" })\` \u2014 pull recent deploys, newest first. Identify the most recent deploy with status \`failed\` (or \`cancelled\` if the user wants to investigate that too). Capture its publicId, branch, and commitHash.
 2. \`get_deploy_logs({ service_id: "${service_id}", deploy_id: "<dpl_\u2026>" })\` \u2014 read the full build output. Scan for: stack traces, "ERROR" / "error:" lines, exit codes, missing env vars, OOM-killed signals, network failures pulling dependencies.
 3. \`get_service({ service_id: "${service_id}" })\` \u2014 confirm the service's runtime, plan, and whether autoDeploy is on. Plan tier matters because OOMs at small tiers point at \`maxMemoryMb\`.
 4. (Optional) \`list_env_vars({ service_id: "${service_id}" })\` \u2014 only if the build error mentions a missing variable. Don't fetch otherwise; values are masked anyway.
@@ -510,9 +510,9 @@ defineTool({
   name: "list_alerts",
   category: "alerts",
   description: [
-    "List recent alert-shaped events for the team: deploy failures, git auth losses, service health failures, auto-restarts, ACME cert failures, resource alerts (high CPU), database backup/restore failures, registrant verification lapses.",
+    "List recent alert-shaped events for the team: deploy failures, git auth losses, service health failures, uptime failures (a service stopped answering its public URL), new and regressed error issues (an exception the app reported), auto-restarts, ACME cert failures, resource alerts (high CPU), database backup/restore failures, registrant verification lapses.",
     "",
-    "When to use: triage 'what's currently broken or recently broke for this team'. Pairs with list_activity_log for the full audit feed; this tool is the alert-shaped subset.",
+    "When to use: triage 'what's currently broken or recently broke for this team'. Pairs with list_activity_log for the full audit feed; this tool is the alert-shaped subset. For an `error.issue_new` / `error.issue_regressed` entry, `list_error_issues` and `get_error_issue` carry the stack behind it.",
     "",
     'By default events are AGGREGATED by (action, resourceId) so flapping events collapse to one row with a fire count + first/last timestamps \u2014 e.g. "service.auto_restarted on service 31, 8 times in the last hour, last at 14:22". Pass aggregate=false to see every raw row.',
     "",
@@ -620,7 +620,105 @@ defineTool({
 });
 
 // src/tools/databases.ts
+import { z as z6 } from "zod";
+
+// src/tools/machines.ts
 import { z as z5 } from "zod";
+var machineInput = z5.union([z5.number().int().positive(), z5.string()]).optional().describe(
+  `Run this on one of the team's OWN enrolled machines instead of HostStack compute \u2014 the machine's name (e.g. "desktop") or its numeric id. List them with list_machines. Omit for HostStack compute, which is the default and the right answer unless the user asked for their own hardware.`
+);
+async function resolveMachineId(ctx, teamId, machine) {
+  const { machines } = await ctx.hoststack.machines.list(teamId);
+  if (machines.length === 0) {
+    throw new Error(
+      "This team has no enrolled machines. Enrol one from the dashboard (Machines \u2192 Add machine) or with `hoststack machines add`, then run the install command it prints on that machine."
+    );
+  }
+  const known = machines.map((m) => `"${m.name}" (id ${m.id})`).join(", ");
+  if (typeof machine === "number") {
+    const byId = machines.find((m) => m.id === machine);
+    if (!byId) throw new Error(`No machine with id ${machine}. This team has: ${known}.`);
+    return byId.id;
+  }
+  const needle = machine.trim().toLowerCase();
+  const matches = machines.filter(
+    (m) => m.name.toLowerCase() === needle || m.hostname.toLowerCase() === needle
+  );
+  if (matches.length === 0) {
+    throw new Error(`No machine named "${machine}". This team has: ${known}.`);
+  }
+  if (matches.length > 1) {
+    throw new Error(
+      `More than one machine is named "${machine}" (ids ${matches.map((m) => m.id).join(", ")}). Pass the numeric id.`
+    );
+  }
+  return matches[0].id;
+}
+function describeMachine(m) {
+  if (!m.enrolled) return `${m.name}: registered but never paired`;
+  if (m.status !== "active") return `${m.name}: offline`;
+  if (m.agentBuild === "from-source") return `${m.name}: online, agent running from source`;
+  if (m.agentBuild === "unknown") return `${m.name}: online, agent too old to report its build`;
+  return `${m.name}: online`;
+}
+defineTool({
+  name: "list_machines",
+  category: "machines",
+  description: [
+    "List the team's OWN enrolled machines \u2014 hardware they supply (a spare desktop, a home server, a VPS they already pay for) that HostStack runs work on. These are NOT HostStack's servers; you cannot enrol, resize or reboot them from here.",
+    "",
+    "When to use: before creating a service, database or dev box that the user wants on their own hardware (pass the machine name to create_service / create_database / create_standalone_dev_environment), or to explain why something pinned to a machine is down \u2014 a machine that is switched off takes everything on it with it.",
+    "",
+    "Inputs: none.",
+    "",
+    "Returns: { items: Machine[] } \u2014 each entry has id (pass this as `machine`), name, status (active|offline|provisioning), enrolled, agentBuild (current|behind|from-source|unknown), agentVersion, lastHeartbeatAt, totalMemoryMb, totalCpuCores, and workloads { devBoxes, services, databases }.",
+    "",
+    "Notes: a machine is only reachable while its owner has it switched on, and a database pinned to one is reachable ONLY from that same machine \u2014 put the app that queries it there too. Enrolment needs a person at the machine to run an installer, so there is no tool for it: point the user at the dashboard (Machines \u2192 Add machine) or `hoststack machines add`.",
+    "",
+    'Example: list_machines() \u2192 { items: [{ id: 12452, name: "desktop", status: "active", workloads: { devBoxes: 8, services: 0, databases: 2 } }] }'
+  ].join("\n"),
+  input: {},
+  handler: async (_args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.machines.list(teamId);
+    const data = shapeList(response, "machines", shape);
+    const summary = response.machines.length === 0 ? "This team has no enrolled machines. Everything runs on HostStack compute." : `${response.machines.length} machine${response.machines.length === 1 ? "" : "s"} \u2014 ${response.machines.map(describeMachine).join("; ")}.`;
+    return respond({ summary, data });
+  }
+});
+defineTool({
+  name: "get_machine",
+  category: "machines",
+  description: [
+    "One of the team's own enrolled machines, with what is actually running on it \u2014 rather than the counts list_machines carries.",
+    "",
+    'When to use: before advising the user to switch a machine off, move work off it, or remove it \u2014 `running` is the list of things that go away with the machine. Also the fastest answer to "what is on my desktop?".',
+    "",
+    "Inputs:",
+    '  - machine: the machine name (e.g. "desktop") or its numeric id.',
+    "",
+    'Returns: { machine: Machine, running: Workload[] } \u2014 each workload has kind ("dev_box" | "service" | "database"), name, status and projectId. The kinds differ in consequence: a dev box waits for its machine to come back, a service is down while it is off, and a database takes down everything reading from it.',
+    "",
+    'Example: get_machine({ machine: "desktop" }) \u2192 { machine: { name: "desktop", status: "active" }, running: [{ kind: "database", name: "postgres-58" }] }'
+  ].join("\n"),
+  input: {
+    machine: z5.union([z5.number().int().positive(), z5.string()]).describe('Machine name (e.g. "desktop") or numeric id. List them with list_machines.')
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const machineId = await resolveMachineId(ctx, teamId, args2.machine);
+    const response = await ctx.hoststack.machines.get(teamId, machineId);
+    const data = {
+      machine: shape(response.machine),
+      running: shapeList({ running: response.running }, "running", shape).items
+    };
+    const running = response.running ?? [];
+    const summary = running.length === 0 ? `${describeMachine(response.machine)}. Nothing is running on it.` : `${describeMachine(response.machine)}. Running ${running.length} thing${running.length === 1 ? "" : "s"}: ${running.map((w) => `${w.name} (${w.kind})`).join(", ")}.`;
+    return respond({ summary, data });
+  }
+});
+
+// src/tools/databases.ts
 var DATABASE_VERSIONS = {
   postgres: { default: "18", supported: ["18", "17", "16", "15"] },
   redis: { default: "8", supported: ["8", "7", "6"] },
@@ -657,6 +755,7 @@ defineTool({
     "  - environment_id (optional): bind to a specific environment; defaults to the project Production env.",
     "  - postgis (optional): provision the PostGIS image variant so `CREATE EXTENSION postgis` works. Postgres only.",
     "  - pgvector (optional): provision the pgvector image variant so `CREATE EXTENSION vector` works. Postgres only, mutually exclusive with postgis.",
+    "  - machine (optional): put it on one of the team's OWN enrolled machines (name or id, see list_machines) instead of HostStack compute. It costs nothing there and is still backed up off-site, but it is reachable ONLY from that same machine \u2014 the service that queries it has to run there too, and linking it to a service anywhere else is refused. No HA and no external access on a machine you own.",
     "",
     'Returns: { database: Database } \u2014 note BOTH `id` (numeric \u2014 this is what link_resource_to_service wants) and `publicId` ("db_\u2026" \u2014 what the other database tools want).',
     "",
@@ -665,16 +764,17 @@ defineTool({
     'Example: create_database({ project_id: "prj_abc", name: "app-db", engine: "postgres" }) \u2192 { database: { id: 42, publicId: "db_\u2026", status: "creating" } }'
   ].join("\n"),
   input: {
-    project_id: z5.union([z5.number().int().positive(), z5.string()]).describe('Target project \u2014 numeric id or publicId ("prj_\u2026").'),
-    name: z5.string().min(1).max(100).describe("Database name (1\u2013100 chars)."),
-    engine: z5.enum(DB_ENGINES).describe("Database engine."),
-    version: z5.string().max(20).optional().describe(`Engine version. ${VERSION_HELP}. Omit for the engine default.`),
-    plan: z5.enum(["micro", "starter", "standard", "pro"]).optional().describe('Plan tier (memory/CPU). Default "starter".'),
-    environment_id: z5.union([z5.number().int().positive(), z5.string()]).optional().describe("Environment to bind to. Defaults to the project Production env."),
-    postgis: z5.boolean().optional().describe("Postgres only \u2014 enable the PostGIS extension image."),
-    pgvector: z5.boolean().optional().describe(
+    project_id: z6.union([z6.number().int().positive(), z6.string()]).describe('Target project \u2014 numeric id or publicId ("prj_\u2026").'),
+    name: z6.string().min(1).max(100).describe("Database name (1\u2013100 chars)."),
+    engine: z6.enum(DB_ENGINES).describe("Database engine."),
+    version: z6.string().max(20).optional().describe(`Engine version. ${VERSION_HELP}. Omit for the engine default.`),
+    plan: z6.enum(["micro", "starter", "standard", "pro"]).optional().describe('Plan tier (memory/CPU). Default "starter".'),
+    environment_id: z6.union([z6.number().int().positive(), z6.string()]).optional().describe("Environment to bind to. Defaults to the project Production env."),
+    postgis: z6.boolean().optional().describe("Postgres only \u2014 enable the PostGIS extension image."),
+    pgvector: z6.boolean().optional().describe(
       "Postgres only \u2014 enable the pgvector extension image. Exclusive with postgis."
-    )
+    ),
+    machine: machineInput
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -697,6 +797,9 @@ defineTool({
     }
     if (args2.postgis !== void 0) input.postgis = args2.postgis;
     if (args2.pgvector !== void 0) input.pgvector = args2.pgvector;
+    if (args2.machine !== void 0) {
+      input.machineId = await resolveMachineId(ctx, teamId, args2.machine);
+    }
     const response = await ctx.hoststack.databases.create(teamId, input);
     const data = { database: shapeDatabase(response.database) };
     const db = response.database;
@@ -724,7 +827,7 @@ defineTool({
     'Example: delete_database({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to permanently delete.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to permanently delete.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -750,7 +853,7 @@ defineTool({
     'Example: suspend_database({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to suspend.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to suspend.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -776,7 +879,7 @@ defineTool({
     'Example: resume_database({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to resume.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to resume.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -802,7 +905,7 @@ defineTool({
     'Example: list_databases({ project_id: 12 }) \u2192 { items: [{ publicId: "db_\u2026", type: "postgres", status: "running", \u2026 }] }'
   ].join("\n"),
   input: {
-    project_id: z5.number().int().positive().describe("Numeric project ID (from list_projects).")
+    project_id: z6.number().int().positive().describe("Numeric project ID (from list_projects).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -831,10 +934,10 @@ defineTool({
     'Example: update_database({ database_id: "db_xyz", disk_size_gb: 50 }) \u2192 { database: { diskSizeGb: 50, \u2026 } }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_xyz)."),
-    name: z5.string().min(1).max(100).optional().describe("New database name."),
-    plan: z5.enum(["free", "micro", "starter", "standard", "pro"]).optional().describe("Plan tier (memory/CPU)."),
-    disk_size_gb: z5.number().int().min(1).max(1024).optional().describe("New disk size in GB. Must be \u2265 current.")
+    database_id: z6.string().describe("Database publicId (e.g. db_xyz)."),
+    name: z6.string().min(1).max(100).optional().describe("New database name."),
+    plan: z6.enum(["free", "micro", "starter", "standard", "pro"]).optional().describe("Plan tier (memory/CPU)."),
+    disk_size_gb: z6.number().int().min(1).max(1024).optional().describe("New disk size in GB. Must be \u2265 current.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -867,7 +970,7 @@ defineTool({
     'Example: get_database({ database_id: "db_xyz" }) \u2192 { database: { type: "postgres", version: "16", status: "running", \u2026 } }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_xyz).")
+    database_id: z6.string().describe("Database publicId (e.g. db_xyz).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -905,8 +1008,8 @@ defineTool({
     `  - query_database({ database_id: "db_abc", sql: "SELECT id, email FROM users WHERE created_at > now() - interval '1 day' LIMIT 50" })`
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc)."),
-    sql: z5.string().min(1).max(16384).describe(
+    database_id: z6.string().describe("Database publicId (e.g. db_abc)."),
+    sql: z6.string().min(1).max(16384).describe(
       "A single READ-ONLY SQL statement. No trailing `;`, no embedded `;`, no psql meta-commands."
     )
   },
@@ -935,7 +1038,7 @@ defineTool({
     'Example: upgrade_database_to_ha({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to upgrade to HA.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to upgrade to HA.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -964,8 +1067,8 @@ defineTool({
     'Example: upgrade_database_version({ database_id: "db_abc", version: "18" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to upgrade."),
-    version: z5.string().describe('Target engine version, e.g. "18" for postgres or "8" for redis.')
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to upgrade."),
+    version: z6.string().describe('Target engine version, e.g. "18" for postgres or "8" for redis.')
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -993,7 +1096,7 @@ defineTool({
     'Example: restart_database({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to restart.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to restart.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1019,7 +1122,7 @@ defineTool({
     'Example: get_database_cluster({ database_id: "db_abc" }) \u2192 { members: [...5 live rows], failovers: [] }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId for the HA cluster.")
+    database_id: z6.string().describe("Database publicId for the HA cluster.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1031,7 +1134,7 @@ defineTool({
 });
 
 // src/tools/deploys.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 defineTool({
   name: "list_deploys",
   category: "deploys",
@@ -1043,12 +1146,12 @@ defineTool({
     "Inputs:",
     '  - service_id: publicId of the service (e.g. "svc_abc123"). Use list_services to find it.',
     "",
-    'Returns: { items: Deploy[] } \u2014 each deploy includes id, publicId, status (pending|building|deploying|live|failed|cancelled), commitSha, commitMessage, branch, triggeredBy, startedAt, finishedAt, imageBuildMs (docker build / image-pull only; null on skip-build redeploys \u2014 v89), containerBootMs (deploying \u2192 live wall-clock; null on builds that failed before container start \u2014 v89), buildDurationMs (legacy alias of imageBuildMs kept for back-compat), totalDurationMs (full deploy wall-clock = finishedAt \u2212 startedAt). Use imageBuildMs + containerBootMs together to tell "build is slow" apart from "boot is slow".',
+    'Returns: { items: Deploy[] } \u2014 each deploy includes id, publicId, status (pending|building|deploying|live|failed|cancelled), commitHash (the resolved commit SHA; the key is OMITTED entirely when the deploy recorded none, so a missing key means "no commit", not "wrong key"), commitMessage, branch, triggeredBy, startedAt, finishedAt, imageBuildMs (docker build / image-pull only; null on skip-build redeploys \u2014 v89), containerBootMs (deploying \u2192 live wall-clock; null on builds that failed before container start \u2014 v89), buildDurationMs (legacy alias of imageBuildMs kept for back-compat), totalDurationMs (full deploy wall-clock = finishedAt \u2212 startedAt). Use imageBuildMs + containerBootMs together to tell "build is slow" apart from "boot is slow".',
     "",
     'Example: list_deploys({ service_id: "svc_abc" }) \u2192 { items: [{ publicId: "dpl_\u2026", status: "live", commitMessage: "Fix login", \u2026 }, \u2026] }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z7.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1070,13 +1173,13 @@ defineTool({
     "  - service_id: publicId of the service.",
     '  - deploy_id: publicId of the deploy (e.g. "dpl_\u2026").',
     "",
-    "Returns: { deploy: Deploy } \u2014 full deploy record (status, commitSha, commitMessage, branch, imageBuildMs + containerBootMs (v89 split timings; legacy buildDurationMs preserved as alias), totalDurationMs, finishedAt, etc).",
+    "Returns: { deploy: Deploy } \u2014 full deploy record (status, commitHash (omitted when the deploy recorded no commit), commitMessage, branch, imageBuildMs + containerBootMs (v89 split timings; legacy buildDurationMs preserved as alias), totalDurationMs, finishedAt, etc).",
     "",
     'Example: get_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { deploy: { status: "live", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    deploy_id: z6.string().describe("Deploy publicId.")
+    service_id: z7.string().describe("Service publicId."),
+    deploy_id: z7.string().describe("Deploy publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1104,9 +1207,9 @@ defineTool({
     'Example: trigger_deploy({ service_id: "svc_abc" }) \u2192 { deploy: { publicId: "dpl_\u2026", status: "pending", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    commit_hash: z6.string().max(40).optional().describe("Specific commit to build (default: branch HEAD)."),
-    branch: z6.string().max(200).optional().describe("Branch to build (default: service configured branch).")
+    service_id: z7.string().describe("Service publicId."),
+    commit_hash: z7.string().max(40).optional().describe("Specific commit to build (default: branch HEAD)."),
+    branch: z7.string().max(200).optional().describe("Branch to build (default: service configured branch).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1139,8 +1242,8 @@ defineTool({
     'Example: cancel_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    deploy_id: z6.string().describe("Deploy publicId.")
+    service_id: z7.string().describe("Service publicId."),
+    deploy_id: z7.string().describe("Deploy publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1168,10 +1271,10 @@ defineTool({
     'Example: get_deploy_logs({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { logs: "Building\u2026\\nStep 1/8\u2026\\n\u2026", lineCount: 42, nextAfterId: 1234 }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    deploy_id: z6.string().describe("Deploy publicId."),
-    after_id: z6.number().int().optional().describe("Pagination cursor from a previous response\u2019s nextAfterId."),
-    limit: z6.number().int().min(1).max(5e3).optional().describe("Max log entries to fetch (default 500, hard cap 5000).")
+    service_id: z7.string().describe("Service publicId."),
+    deploy_id: z7.string().describe("Deploy publicId."),
+    after_id: z7.number().int().optional().describe("Pagination cursor from a previous response\u2019s nextAfterId."),
+    limit: z7.number().int().min(1).max(5e3).optional().describe("Max log entries to fetch (default 500, hard cap 5000).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1211,10 +1314,10 @@ defineTool({
     'Example: diagnose_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 all three sections in one call.'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    deploy_id: z6.string().describe("Deploy publicId."),
-    build_log_lines: z6.number().int().min(1).max(2e3).optional().describe("Trailing build log lines. Default 200, max 2000."),
-    runtime_log_lines: z6.number().int().min(0).max(1e3).optional().describe(
+    service_id: z7.string().describe("Service publicId."),
+    deploy_id: z7.string().describe("Deploy publicId."),
+    build_log_lines: z7.number().int().min(1).max(2e3).optional().describe("Trailing build log lines. Default 200, max 2000."),
+    runtime_log_lines: z7.number().int().min(0).max(1e3).optional().describe(
       "Trailing runtime log lines since deploy start. Default 100, max 1000. 0 = skip."
     )
   },
@@ -1275,7 +1378,7 @@ defineTool({
 });
 
 // src/tools/dns-records.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var DNS_RECORD_TYPES = [
   "A",
   "AAAA",
@@ -1290,7 +1393,7 @@ var DNS_RECORD_TYPES = [
 async function resolveZonePublicId(hoststack, teamId, input) {
   if (input.zone_id) {
     const { zones: zones2 } = await hoststack.dns.listZones(teamId);
-    const match = zones2.find((z16) => z16.publicId === input.zone_id);
+    const match = zones2.find((z20) => z20.publicId === input.zone_id);
     if (!match) {
       throw new Error(`Zone ${input.zone_id} not found on this team.`);
     }
@@ -1304,7 +1407,7 @@ async function resolveZonePublicId(hoststack, teamId, input) {
   const labels = fqdn.split(".");
   for (let i = 0; i < labels.length - 1; i++) {
     const candidate = labels.slice(i).join(".");
-    const match = zones.find((z16) => z16.domainName.toLowerCase() === candidate);
+    const match = zones.find((z20) => z20.domainName.toLowerCase() === candidate);
     if (match && match.status !== "deleting") {
       return { publicId: match.publicId, domainName: match.domainName };
     }
@@ -1349,8 +1452,8 @@ defineTool({
     'Example: list_dns_records({ domain: "micci.dk" }) \u2192 { zone: { domainName: "micci.dk", \u2026 }, items: [{ type: "TXT", name: "@", value: "google-site-verification=\u2026", ttl: 300, \u2026 }] }'
   ].join("\n"),
   input: {
-    zone_id: z7.string().optional().describe('Zone publicId (e.g. "dnz_abc").'),
-    domain: z7.string().optional().describe("Apex or subdomain \u2014 resolves to the longest-matching hosted zone.")
+    zone_id: z8.string().optional().describe('Zone publicId (e.g. "dnz_abc").'),
+    domain: z8.string().optional().describe("Apex or subdomain \u2014 resolves to the longest-matching hosted zone.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1383,7 +1486,7 @@ defineTool({
     'Example: get_dns_record({ record_id: "dnr_abc" }) \u2192 { record: { type: "TXT", name: "@", value: "\u2026", status: "active", \u2026 } }'
   ].join("\n"),
   input: {
-    record_id: z7.string().describe("Record publicId.")
+    record_id: z8.string().describe("Record publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1429,13 +1532,13 @@ defineTool({
     'Example: create_dns_record({ domain: "micci.dk", type: "TXT", name: "@", content: "google-site-verification=C0V0scK48g2\u2026", ttl: 300 })'
   ].join("\n"),
   input: {
-    zone_id: z7.string().optional().describe("Zone publicId."),
-    domain: z7.string().optional().describe("Apex or subdomain to resolve a hosted zone."),
-    type: z7.enum(DNS_RECORD_TYPES).describe("DNS record type."),
-    name: z7.string().min(1).max(253).describe('"@" for apex, or a bare label. Do NOT include the zone suffix.'),
-    content: z7.string().min(1).max(2e3).describe("Record value; TXT values are unquoted."),
-    ttl: z7.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
-    priority: z7.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
+    zone_id: z8.string().optional().describe("Zone publicId."),
+    domain: z8.string().optional().describe("Apex or subdomain to resolve a hosted zone."),
+    type: z8.enum(DNS_RECORD_TYPES).describe("DNS record type."),
+    name: z8.string().min(1).max(253).describe('"@" for apex, or a bare label. Do NOT include the zone suffix.'),
+    content: z8.string().min(1).max(2e3).describe("Record value; TXT values are unquoted."),
+    ttl: z8.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
+    priority: z8.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
   },
   handler: async (args2, ctx) => {
     if ((args2.type === "MX" || args2.type === "SRV") && args2.priority === void 0) {
@@ -1481,12 +1584,12 @@ defineTool({
     'Example: update_dns_record({ record_id: "dnr_abc", type: "A", name: "api", content: "203.0.113.42", ttl: 300 })'
   ].join("\n"),
   input: {
-    record_id: z7.string().describe("Record publicId."),
-    type: z7.enum(DNS_RECORD_TYPES).describe("DNS record type."),
-    name: z7.string().min(1).max(253).describe('"@" for apex, or a bare label. Do NOT include the zone suffix.'),
-    content: z7.string().min(1).max(2e3).describe("Record value; TXT unquoted."),
-    ttl: z7.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
-    priority: z7.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
+    record_id: z8.string().describe("Record publicId."),
+    type: z8.enum(DNS_RECORD_TYPES).describe("DNS record type."),
+    name: z8.string().min(1).max(253).describe('"@" for apex, or a bare label. Do NOT include the zone suffix.'),
+    content: z8.string().min(1).max(2e3).describe("Record value; TXT unquoted."),
+    ttl: z8.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
+    priority: z8.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
   },
   handler: async (args2, ctx) => {
     if ((args2.type === "MX" || args2.type === "SRV") && args2.priority === void 0) {
@@ -1540,7 +1643,7 @@ defineTool({
     'Example: delete_dns_record({ record_id: "dnr_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    record_id: z7.string().describe("Record publicId.")
+    record_id: z8.string().describe("Record publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1573,7 +1676,7 @@ defineTool({
     'Example: resync_dns_record({ record_id: "dnr_abc" }) \u2192 { record: { status: "active", ... } }'
   ].join("\n"),
   input: {
-    record_id: z7.string().describe("Record publicId.")
+    record_id: z8.string().describe("Record publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1611,7 +1714,7 @@ async function findRecordZone(hoststack, teamId, recordPublicId) {
 }
 
 // src/tools/domains.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 defineTool({
   name: "list_domains",
   category: "domains",
@@ -1651,9 +1754,9 @@ defineTool({
     'Example: add_domain({ hostname: "api.example.com", service_id: "svc_abc" }) \u2192 { domain: { hostname: "api.example.com", dnsTargets: [...], verified: false, \u2026 } }'
   ].join("\n"),
   input: {
-    hostname: z8.string().min(3).max(253).describe("Fully-qualified hostname (e.g. api.example.com)."),
-    service_id: z8.string().describe("Service publicId to bind to."),
-    path_prefix: z8.string().optional().describe('Optional URL prefix for path-based routing (e.g. "/api").')
+    hostname: z9.string().min(3).max(253).describe("Fully-qualified hostname (e.g. api.example.com)."),
+    service_id: z9.string().describe("Service publicId to bind to."),
+    path_prefix: z9.string().optional().describe('Optional URL prefix for path-based routing (e.g. "/api").')
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1687,7 +1790,7 @@ defineTool({
     'Example: verify_domain({ domain_id: "dom_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    domain_id: z8.string().describe("Domain publicId.")
+    domain_id: z9.string().describe("Domain publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1714,7 +1817,7 @@ defineTool({
     'Example: remove_domain({ domain_id: "dom_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    domain_id: z8.string().describe("Domain publicId.")
+    domain_id: z9.string().describe("Domain publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1724,7 +1827,7 @@ defineTool({
 });
 
 // src/tools/env-vars.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 defineTool({
   name: "list_env_vars",
   category: "env-vars",
@@ -1741,7 +1844,7 @@ defineTool({
     'Example: list_env_vars({ service_id: "svc_abc" }) \u2192 { items: [{ key: "DATABASE_URL", value: "\u2022\u2022\u2022\u2022\u2022\u2022", isSecret: true }, { key: "PORT", value: "3000", isSecret: false }] }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId.")
+    service_id: z10.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1771,11 +1874,11 @@ defineTool({
     'Example: set_env_var({ service_id: "svc_abc", key: "DATABASE_URL", value: "postgres://\u2026", is_secret: true }) \u2192 { envVar: { key: "DATABASE_URL", value: "\u2022\u2022\u2022\u2022\u2022\u2022", \u2026 }, action: "updated" }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId."),
-    key: z9.string().min(1).max(128).describe("Env-var key."),
-    value: z9.string().describe("New value."),
-    is_secret: z9.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true."),
-    target: z9.enum(["build", "runtime", "both"]).optional().describe("Injection target: build, runtime, or both. Default both.")
+    service_id: z10.string().describe("Service publicId."),
+    key: z10.string().min(1).max(128).describe("Env-var key."),
+    value: z10.string().describe("New value."),
+    is_secret: z10.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true."),
+    target: z10.enum(["build", "runtime", "both"]).optional().describe("Injection target: build, runtime, or both. Default both.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1827,8 +1930,8 @@ defineTool({
     'Example: delete_env_var({ service_id: "svc_abc", key: "OLD_FLAG" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId."),
-    key: z9.string().min(1).max(128).describe("Env-var key to delete.")
+    service_id: z10.string().describe("Service publicId."),
+    key: z10.string().min(1).max(128).describe("Env-var key to delete.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1864,13 +1967,13 @@ defineTool({
     'Example: bulk_set_env_vars({ service_id: "svc_abc", env_vars: [{ key: "PORT", value: "3000", is_secret: false }, { key: "DATABASE_URL", value: "\u2026", is_secret: true }] }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId."),
-    env_vars: z9.array(
-      z9.object({
-        key: z9.string().min(1).max(128),
-        value: z9.string(),
-        is_secret: z9.boolean().optional(),
-        target: z9.enum(["build", "runtime", "both"]).optional()
+    service_id: z10.string().describe("Service publicId."),
+    env_vars: z10.array(
+      z10.object({
+        key: z10.string().min(1).max(128),
+        value: z10.string(),
+        is_secret: z10.boolean().optional(),
+        target: z10.enum(["build", "runtime", "both"]).optional()
       })
     ).max(500).describe("Array of env-var rows. Hard cap 500.")
   },
@@ -1896,7 +1999,7 @@ defineTool({
 });
 
 // src/tools/environments.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 defineTool({
   name: "list_environments",
   category: "environments",
@@ -1917,7 +2020,7 @@ defineTool({
     'Example: list_environments({ project_id: "prj_abc" }) \u2192 { items: [{ name: "Production", type: "production", isDefault: true }, { name: "Staging", type: "staging" }] }'
   ].join("\n"),
   input: {
-    project_id: z10.string().describe("Project publicId.")
+    project_id: z11.string().describe("Project publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1951,13 +2054,13 @@ defineTool({
     'Example: create_environment({ project_id: "prj_abc", name: "Staging", type: "staging" }) \u2192 { environment: { id: 7, publicId: "env_\u2026", name: "Staging", type: "staging" } }'
   ].join("\n"),
   input: {
-    project_id: z10.string().describe("Project publicId."),
-    name: z10.string().min(1).max(64).describe("Environment name (1\u201364 chars)."),
-    type: z10.enum(["production", "staging", "development", "preview"]).describe(
+    project_id: z11.string().describe("Project publicId."),
+    name: z11.string().min(1).max(64).describe("Environment name (1\u201364 chars)."),
+    type: z11.enum(["production", "staging", "development", "preview"]).describe(
       // §2.1: "development" here is a project deployment env, NOT a cloud Dev Box.
       'Environment type \u2014 drives the hostname suffix. type="development" creates a PROJECT deployment environment (a -dev hostname suffix), NOT an agentic Dev Box \u2014 for a cloud dev box use create_dev_environment / create_standalone_dev_environment / spin_up_dev_environment.'
     ),
-    is_protected: z10.boolean().optional().describe("Require admin role for destructive actions. Default false.")
+    is_protected: z11.boolean().optional().describe("Require admin role for destructive actions. Default false.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1991,8 +2094,8 @@ defineTool({
     'Example: delete_environment({ project_id: "prj_abc", environment_id: "env_xyz" }) \u2192 { success: true }'
   ].join("\n"),
   input: {
-    project_id: z10.string().describe("Project publicId."),
-    environment_id: z10.union([z10.string(), z10.number()]).describe("Environment publicId or numeric id.")
+    project_id: z11.string().describe("Project publicId."),
+    environment_id: z11.union([z11.string(), z11.number()]).describe("Environment publicId or numeric id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2023,9 +2126,9 @@ defineTool({
     'Example: promote_deploy({ service_id: "svc_staging", deploy_id: "dpl_built", target_environment_id: "env_prod" }) \u2192 { deploy: { id: 99, status: "pending", trigger: "rollback", dockerImageId: "sha256:\u2026" } }'
   ].join("\n"),
   input: {
-    service_id: z10.string().describe("Source service publicId."),
-    deploy_id: z10.string().describe("Source deploy publicId (must have a built image)."),
-    target_environment_id: z10.union([z10.string(), z10.number()]).describe("Target environment publicId or numeric id.")
+    service_id: z11.string().describe("Source service publicId."),
+    deploy_id: z11.string().describe("Source deploy publicId (must have a built image)."),
+    target_environment_id: z11.union([z11.string(), z11.number()]).describe("Target environment publicId or numeric id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2047,6 +2150,437 @@ defineTool({
   }
 });
 
+// src/tools/analytics.ts
+import { z as z12 } from "zod";
+async function resolveSiteIds(domains, teamId, api) {
+  if (!domains || domains.length === 0) return void 0;
+  const { sites } = await api.get(`/api/analytics/${teamId}/sites`);
+  const ids = [];
+  const missing = [];
+  for (const domain of domains) {
+    const needle = domain.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+    const match = sites.find((s) => s.domain === needle);
+    if (match) ids.push(match.id);
+    else missing.push(domain);
+  }
+  if (missing.length > 0) {
+    throw new Error(
+      `Not tracking ${missing.join(", ")}. Known sites: ${sites.map((s) => s.domain).join(", ") || "none yet"}.`
+    );
+  }
+  return ids.join(",");
+}
+defineTool({
+  name: "list_analytics_sites",
+  category: "analytics",
+  description: [
+    "List the websites this team tracks \u2014 domains, their site keys, retention, and which service (if any) serves each one.",
+    "",
+    "When to use: before any other analytics call, to learn which domains exist; or to fetch the script tag a site needs.",
+    "",
+    "The site key is PUBLIC by design \u2014 it ships in a `data-site-key` attribute that anyone can view-source, like a Sentry DSN. It is write-only and scoped to one site. Do not treat it as a secret, and do not confuse it with the team API key.",
+    "",
+    "Returns: { sites: Array }. Each site has id, publicId, name, domain, ingestKey, allowedOrigins, serviceId, serviceName, retentionDays, droppedCount (events refused by the hourly quota and therefore MISSING from every count for that site), and keyGraceEndsAt when a rotation is still in its grace window.",
+    "",
+    'Each site also carries lastEventAt (null means NOTHING has ever reached ingest for that key) plus lastRefusalReason and refusedRecently, a 7-day tally by reason. An empty chart with lastEventAt set is a site with no traffic; an empty chart with lastEventAt null is a broken setup. Do not report "no visitors" without checking which one you are looking at \u2014 call check_analytics_site for the diagnosis.',
+    "",
+    "Example: list_analytics_sites({}) \u2192 { sites: [{ id: 3, domain: 'micci.dk', ingestKey: 'site_\u2026', retentionDays: 30, serviceName: 'micci-web' }] }."
+  ].join("\n"),
+  input: {},
+  handler: async (_args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.get(`/api/analytics/${teamId}/sites`);
+    const items = Array.isArray(response.sites) ? response.sites.map(shape) : [];
+    const summary = items.length === 0 ? "No analytics sites yet. Create one with create_analytics_site." : `Tracking ${items.length} site${items.length === 1 ? "" : "s"}.`;
+    return respond({ summary, data: { sites: items } });
+  }
+});
+defineTool({
+  name: "check_analytics_site",
+  category: "analytics",
+  description: [
+    "Why a site is reporting nothing \u2014 the diagnosis, without having to generate traffic and guess.",
+    "",
+    "When to use: any time a chart is empty, a site was just set up, a key was rotated, or someone asks whether the snippet is installed correctly. Call this BEFORE telling anyone their traffic dropped.",
+    "",
+    "The ingest endpoint answers HTTP 204 to a real site key and to a typo alike \u2014 deliberately, so it cannot be used to enumerate keys \u2014 which means five completely different situations produce the same empty chart: a stale or mistyped key in the deployed snippet, an origin the site does not allow, a blown hourly quota, events blocked in the browser before they leave (CORS, ad blocker, CSP), and simply no visitors yet. This tool tells them apart.",
+    "",
+    "Returns health ('receiving' | 'quiet' | 'refusing' | 'never'), a headline and detail sentence, lastEventAt, lastRefusalAt/Reason/Origin, refusedRecently (a 7-day tally by reason), the site key the snippet must carry, allowed origins, and quota usage this hour.",
+    "",
+    "health='never' means nothing has EVER reached ingest for this key, so the request is not leaving the browser \u2014 check the snippet is in the deployed HTML and tell the user to add `data-debug` to the script tag, which makes the tracker log its resolved endpoint and every accepted 204 to the console.",
+    "",
+    "Example: check_analytics_site({ domain: 'example.com' }) \u2192 { health: 'refusing', headline: 'Reaching us, and being refused.', detail: 'Something on example.com posted 214 event(s) with a site key we do not recognise\u2026', lastEventAt: null, refusedRecently: { unknown_key: 214, bad_origin: 0, bot: 3, over_quota: 0 } }."
+  ].join("\n"),
+  input: {
+    domain: z12.string().max(253).describe("Bare hostname of a site this team tracks.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const siteIds = await resolveSiteIds([args2.domain], teamId, ctx.api);
+    const status = await ctx.api.get(
+      `/api/analytics/${teamId}/sites/${siteIds}/status`
+    );
+    return respond({ summary: `${args2.domain}: ${status.headline}`, data: shape(status) });
+  }
+});
+defineTool({
+  name: "get_analytics_summary",
+  category: "analytics",
+  description: [
+    "One row per site: visitors, pageviews, bounce rate, average visit and live visitors, each with the previous period to compare against.",
+    "",
+    'When to use: "how are my sites doing", a weekly check, or spotting which of several domains moved. This is the cross-site view; use get_analytics_overview for the breakdowns behind one of them.',
+    "",
+    "READ THE VISITOR NUMBER CAREFULLY. Inside a site's raw-event window (35 days by default, so 24h through 30d are raw) `visitors` is a true distinct count over the range. Beyond it the answer comes from a daily rollup and `visitors` is each day's uniques ADDED TOGETHER \u2014 someone who visits daily counts once per day. `visitorsAreSummedDailies` says which you got; quote it when reporting a 90d or 12mo number.",
+    "",
+    "Visitors are never summed ACROSS sites. The same person on two domains is two session ids, and reconciling them would require the cross-domain identity a cookieless tracker exists not to build. Add pageviews if you need a total; do not add visitors.",
+    "",
+    "Inputs: range (24h|7d|30d|90d|12mo, default 7d), domains (optional list; omit for every site).",
+    "",
+    "Example: get_analytics_summary({ range: '30d' }) \u2192 { range: '30d', sites: [{ domain: 'hoststack.dev', current: { visitors: 4210, pageviews: 11890, bounceRate: 47.2 }, previous: {\u2026}, live: 3, visitorsAreSummedDailies: false }] }."
+  ].join("\n"),
+  input: {
+    range: z12.enum(["24h", "7d", "30d", "90d", "12mo"]).optional().describe("Default 7d."),
+    domains: z12.array(z12.string().max(253)).max(50).optional().describe("Bare hostnames. Omit for every site this team tracks.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const siteIds = await resolveSiteIds(args2.domains, teamId, ctx.api);
+    const response = await ctx.api.get(`/api/analytics/${teamId}/summary`, {
+      range: args2.range ?? "7d",
+      ...siteIds ? { siteIds } : {}
+    });
+    const sites = Array.isArray(response.sites) ? response.sites : [];
+    const summed = sites.some((s) => s.visitorsAreSummedDailies);
+    const summary = sites.length === 0 ? "No sites to report on." : `${sites.length} site${sites.length === 1 ? "" : "s"} over ${response.range}.${summed ? " Visitor counts are daily uniques summed, not distinct over the range \u2014 this range is past the raw-event window." : ""}`;
+    return respond({ summary, data: { range: response.range, sites: sites.map(shape) } });
+  }
+});
+defineTool({
+  name: "get_analytics_overview",
+  category: "analytics",
+  description: [
+    "The full breakdown for one site (or several): timeseries, top paths, referrers, custom events, browsers, operating systems, languages, screen sizes, campaigns, devices and countries.",
+    "",
+    "When to use: after get_analytics_summary has told you WHICH site moved, and you need to see what drove it \u2014 a referrer that appeared, a campaign that landed, a path that spiked.",
+    "",
+    "Two things change past the raw-event window (35 days by default, so 24h through 30d are raw): `visitors` becomes daily uniques summed rather than a distinct count (`visitorsAreSummedDailies`), and FILTERS ARE IGNORED because the rollup stores per-day aggregates with no events left to filter (`filtersSupported: false`). Check both fields before drawing a conclusion; do not silently present a filtered request that was not filtered.",
+    "",
+    "Inputs: range (24h|7d|30d|90d|12mo, default 7d), domains (optional list; omit for every site), filters (optional map \u2014 country, browser, os, device, language, path, referrer, utmSource, utmMedium, utmCampaign, utmTerm, utmContent).",
+    "",
+    "Example: get_analytics_overview({ domains: ['hoststack.dev'], range: '7d', filters: { country: 'DK' } }) \u2192 { source: 'raw', filtersSupported: true, summary: { current: { visitors: 310, \u2026 } }, topPaths: [{ path: '/pricing', pageviews: 214 }], topReferrers: [{ referrer: 'Direct', visits: 190 }], \u2026 }."
+  ].join("\n"),
+  input: {
+    range: z12.enum(["24h", "7d", "30d", "90d", "12mo"]).optional().describe("Default 7d."),
+    domains: z12.array(z12.string().max(253)).max(50).optional().describe("Bare hostnames. Omit for every site this team tracks."),
+    filters: z12.record(z12.string(), z12.string().max(200)).optional().describe("Dimension filters. Ignored for ranges past the raw-event window.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const siteIds = await resolveSiteIds(args2.domains, teamId, ctx.api);
+    const response = await ctx.api.get(`/api/analytics/${teamId}/overview`, {
+      range: args2.range ?? "7d",
+      ...siteIds ? { siteIds } : {},
+      ...args2.filters ?? {}
+    });
+    const { current } = response.summary;
+    const caveats = [];
+    if (response.visitorsAreSummedDailies) {
+      caveats.push(
+        "visitors are daily uniques summed (this range is past the raw-event window)"
+      );
+    }
+    if (args2.filters && Object.keys(args2.filters).length > 0 && !response.filtersSupported) {
+      caveats.push(
+        "the filters you passed were NOT applied \u2014 they only work on shorter ranges"
+      );
+    }
+    const summary = `${current.pageviews.toLocaleString()} pageviews from ${current.visitors.toLocaleString()} visitors over ${response.range}${caveats.length > 0 ? `. Note: ${caveats.join("; ")}.` : "."}`;
+    return respond({ summary, data: response });
+  }
+});
+defineTool({
+  name: "create_analytics_site",
+  category: "analytics",
+  description: [
+    "Start tracking a domain, and return the script tag to paste into its <head>.",
+    "",
+    "When to use: the user wants analytics for a site that is not in list_analytics_sites yet. Works for any domain, whether or not it is hosted on HostStack.",
+    "",
+    "If the domain is already attached to a service on this team, the new site links itself to that service and appears on its Analytics tab. Nothing is counted until the snippet is actually on the page \u2014 creating the site alone produces an empty dashboard, which is expected, not a fault.",
+    "",
+    'Inputs: domain (required, bare hostname \u2014 "example.com", not a URL), name (optional display name, defaults to the domain).',
+    "",
+    `Example: create_analytics_site({ domain: 'micci.dk' }) \u2192 { site: { id: 3, domain: 'micci.dk', ingestKey: 'site_\u2026' }, snippet: '<script defer src="https://hoststack.dev/t.js" data-site-key="site_\u2026"></script>' }.`
+  ].join("\n"),
+  input: {
+    domain: z12.string().min(1).max(253).describe("Bare hostname, e.g. example.com"),
+    name: z12.string().min(1).max(100).optional().describe("Display name. Defaults to the domain.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const site = await ctx.api.post(`/api/analytics/${teamId}/sites`, {
+      domain: args2.domain,
+      ...args2.name ? { name: args2.name } : {}
+    });
+    const snippet = `<script defer src="https://hoststack.dev/t.js" data-site-key="${site.ingestKey}"></script>`;
+    return respond({
+      summary: `Now tracking ${site.domain}. Paste the snippet into its <head> \u2014 nothing is counted until you do.`,
+      data: { site: shape(site), snippet }
+    });
+  }
+});
+
+// src/tools/errors.ts
+import { z as z13 } from "zod";
+defineTool({
+  name: "list_error_issues",
+  category: "errors",
+  description: [
+    "List error issues for the team \u2014 exceptions the team's own applications reported, grouped by cause rather than listed one per event.",
+    "",
+    'When to use: "what is throwing in production", triaging after a deploy, or finding the bug behind a user report. Pairs with list_alerts (which tells you an alert fired) and get_service_logs (which shows the raw output around it).',
+    "",
+    'Grouping: an issue is one distinct problem. Its fingerprint is the exception class, the message with variable parts removed (so "user 41 not found" and "user 9002 not found" are ONE issue), and the topmost stack frame in the team\'s own code \u2014 not the framework\'s. `culprit` is that frame, and it is the line to open first.',
+    "",
+    "Counts are exact; occurrence samples are not. `occurrenceCount` is the true number of times it happened. A bounded number of full occurrences is retained per issue (see get_error_issue), and `droppedCount` is how many were counted but not stored because the service exceeded its hourly ingest quota.",
+    "",
+    'Defaults to status=unresolved, because the list exists to answer "what is broken". Pass status=resolved or status=ignored for the others.',
+    "",
+    "Inputs (all optional): serviceId, status (unresolved|resolved|ignored), q (substring match on title/culprit), limit (default 50, max 200), offset, sort (last_seen|first_seen|count).",
+    "",
+    'Returns: { issues: Array, total: number }. Each issue has id, publicId, serviceId, serviceName, type, title, culprit, level, status, occurrenceCount, droppedCount, affectedUsers (capped at 500 \u2014 500 means "500 or more"), firstSeenAt, lastSeenAt, firstSeenRelease, lastSeenRelease, environment, sourceTaskPublicId (a dev-box task already open for it).',
+    "",
+    "Example: list_error_issues({ serviceId: 48, sort: 'count' }) \u2192 { issues: [{ id: 12, type: 'TypeError', title: 'TypeError: cart.total is not a function', culprit: 'src/checkout.ts:12 in checkout', occurrenceCount: 4187, affectedUsers: 96, lastSeenRelease: 'a91f3c2', \u2026 }], total: 3 }."
+  ].join("\n"),
+  input: {
+    serviceId: z13.number().int().positive().optional().describe("Only issues for this service."),
+    status: z13.enum(["unresolved", "resolved", "ignored"]).optional().describe("Default unresolved."),
+    q: z13.string().max(200).optional().describe("Substring match on title or culprit."),
+    limit: z13.number().int().positive().max(200).optional().describe("Default 50, cap 200."),
+    offset: z13.number().int().min(0).optional(),
+    sort: z13.enum(["last_seen", "first_seen", "count"]).optional().describe("Default last_seen.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const params = {};
+    for (const key of ["serviceId", "status", "q", "limit", "offset", "sort"]) {
+      const value = args2[key];
+      if (value !== void 0) params[key] = String(value);
+    }
+    const response = await ctx.api.get(`/api/errors/${teamId}/issues`, params);
+    const items = Array.isArray(response.issues) ? response.issues.map(shape) : [];
+    const summary = items.length === 0 ? `No ${args2.status ?? "unresolved"} error issues${args2.serviceId ? " for that service" : ""}.` : `Returned ${items.length} of ${response.total} ${args2.status ?? "unresolved"} issue${response.total === 1 ? "" : "s"}.`;
+    return respond({ summary, data: { issues: items, total: response.total } });
+  }
+});
+defineTool({
+  name: "get_error_issue",
+  category: "errors",
+  description: [
+    "Fetch one error issue plus its most recent stored occurrences \u2014 the stack traces, request context and releases behind the aggregate.",
+    "",
+    "When to use: after list_error_issues has told you WHICH problem to look at, and you need the actual stack to reason about the cause.",
+    "",
+    "Occurrences are SAMPLES, not the full history: a bounded number is kept per issue while the count stays exact, and they age out after 30 days while the issue itself remains. An issue whose samples have expired returns an empty occurrences array \u2014 that is normal, not an error.",
+    "",
+    "Each occurrence has stack (raw, as the runtime printed it), context (tenant-supplied JSON, with sensitive keys already redacted), requestId, release, environment and createdAt.",
+    "",
+    "Inputs: issueId (required), occurrences (how many samples, default 5, max 50).",
+    "",
+    "Returns: { issue: {...}, occurrences: Array }.",
+    "",
+    "Example: get_error_issue({ issueId: 12 }) \u2192 { issue: { title: 'TypeError: cart.total is not a function', occurrenceCount: 4187, \u2026 }, occurrences: [{ stack: '    at checkout (/app/src/checkout.ts:12:9)\u2026', requestId: 'req_9f3c', release: 'a91f3c2', createdAt: '\u2026' }] }."
+  ].join("\n"),
+  input: {
+    issueId: z13.number().int().positive().describe("Numeric issue id from list_error_issues."),
+    occurrences: z13.number().int().positive().max(50).optional().describe("How many samples to include. Default 5.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const [issueRes, occRes] = await Promise.all([
+      ctx.api.get(`/api/errors/${teamId}/issues/${args2.issueId}`),
+      ctx.api.get(
+        `/api/errors/${teamId}/issues/${args2.issueId}/occurrences`,
+        { limit: String(args2.occurrences ?? 5) }
+      )
+    ]);
+    const occurrences = Array.isArray(occRes.occurrences) ? occRes.occurrences.map(shape) : [];
+    const issue = shape(issueRes.issue);
+    return respond({
+      summary: `${String(issue["title"] ?? "Issue")} \u2014 ${String(issue["occurrenceCount"] ?? 0)} occurrence(s), ${occurrences.length} sample(s) available.`,
+      data: { issue, occurrences }
+    });
+  }
+});
+defineTool({
+  name: "update_error_issue",
+  category: "errors",
+  description: [
+    "Resolve, ignore or reopen an error issue.",
+    "",
+    "When to use: after fixing a bug (resolve, so a recurrence is reported as a regression), or to silence noise you have decided to live with (ignore).",
+    "",
+    "`resolved` records the release it was resolved in. If the issue occurs again afterwards it reopens itself and fires an `error.issue_regressed` alert \u2014 which is the point of resolving rather than ignoring, and the reason not to resolve something you have not actually fixed.",
+    "",
+    "`ignored` keeps counting occurrences and stops telling anyone. An ignored issue never reopens itself, so this is the right choice for noise you have decided to live with, and the wrong choice for something you intend to fix.",
+    "",
+    "`unresolved` reopens it.",
+    "",
+    "Inputs: issueId (required), status (required).",
+    "",
+    "Returns: { issue: {...} } with the updated row.",
+    "",
+    "Example: update_error_issue({ issueId: 12, status: 'resolved' }) \u2192 { issue: { status: 'resolved', resolvedInRelease: 'a91f3c2', \u2026 } }."
+  ].join("\n"),
+  input: {
+    issueId: z13.number().int().positive(),
+    status: z13.enum(["unresolved", "resolved", "ignored"])
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.patch(
+      `/api/errors/${teamId}/issues/${args2.issueId}`,
+      { status: args2.status }
+    );
+    return respond({
+      summary: `Issue ${args2.issueId} is now ${args2.status}.`,
+      data: { issue: shape(response.issue) }
+    });
+  }
+});
+defineTool({
+  name: "fix_error_in_dev_box",
+  category: "errors",
+  description: [
+    "Turn an error issue into a coding-agent task in the project's dev box, with the repository already checked out.",
+    "",
+    "When to use: the issue is real, it is in the team's own code, and somebody is going to have to open the repository anyway. This writes the whole briefing so nobody has to reconstruct it from the dashboard.",
+    "",
+    "This is the thing a third-party error tracker structurally cannot do. The task carries the exception, the stack with the team's OWN frames marked (`>>`), the release it happened on, how often and to how many users, and a real request context \u2014 plus hard boundaries: work on a branch, do not deploy, do not delete tests, and stop and say so if the cause turns out not to be in this repository.",
+    "",
+    "It CREATES the task; it does not start the agent. Running spends the team's own agent tokens and is a separate decision made in the dev box UI.",
+    "",
+    "Refused with 422 when the cause cannot be attributed to the repository \u2014 every stack frame inside a dependency, no usable stack at all, a browser extension, or a connection failure with no in-app frame. That gate is deliberate: an agent told to fix something it cannot reach does not refuse, it produces a confident and useless diff.",
+    "",
+    "Pressing this twice for one issue returns the existing task (alreadyExisted=true) rather than queueing a duplicate run.",
+    "",
+    "Inputs: issueId (required), serviceId (optional \u2014 pin to a specific dev box; omitted, the project's box is used).",
+    "",
+    "Returns: { task, alreadyExisted, box: { serviceId, name, asleep }, automodeEnabled }.",
+    "",
+    "Example: fix_error_in_dev_box({ issueId: 12 }) \u2192 { task: { title: 'Fix error: TypeError in src/checkout.ts:12' }, alreadyExisted: false, box: { name: 'shop-dev', asleep: true }, automodeEnabled: false }."
+  ].join("\n"),
+  input: {
+    issueId: z13.number().int().positive(),
+    serviceId: z13.number().int().positive().optional().describe("Dev box to pin the task to. Omitted, the project's box is used.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const body = { issueId: args2.issueId };
+    if (args2.serviceId !== void 0) body["serviceId"] = args2.serviceId;
+    const response = await ctx.api.post(
+      `/api/dev-env-tasks/${teamId}/from-issue`,
+      body
+    );
+    const verb = response.alreadyExisted ? "Already queued" : "Queued";
+    const note = response.box.asleep ? " That box is asleep \u2014 resume it before running the task." : "";
+    return respond({
+      summary: `${verb} in dev box "${response.box.name}": ${response.task.title ?? "task"}.${note}`,
+      data: shape(response)
+    });
+  }
+});
+defineTool({
+  name: "list_ingest_keys",
+  category: "errors",
+  description: [
+    "List a service's error-ingest keys. Only prefixes and last-used timestamps \u2014 the key itself is stored as a hash and is never readable again.",
+    "",
+    "When to use: checking whether a service is wired up for error reporting at all, or whether an old key is still in use before revoking it (`lastUsedAt` is stamped lazily, at most once a minute).",
+    "",
+    "Inputs: serviceId (required).",
+    "",
+    "Returns: { keys: Array } with id, publicId, name, prefix, lastUsedAt, createdAt.",
+    "",
+    "Example: list_ingest_keys({ serviceId: 48 }) \u2192 { keys: [{ id: 3, name: 'default', prefix: 'ing_9f3c1ab2', lastUsedAt: '2026-08-21T09:14:00Z' }] }."
+  ].join("\n"),
+  input: { serviceId: z13.number().int().positive() },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.get(
+      `/api/services/${teamId}/${args2.serviceId}/ingest-keys`
+    );
+    const keys = Array.isArray(response.keys) ? response.keys.map(shape) : [];
+    return respond({
+      summary: keys.length === 0 ? "No ingest keys on this service \u2014 it cannot report errors yet." : `${keys.length} ingest key${keys.length === 1 ? "" : "s"} on this service.`,
+      data: { keys }
+    });
+  }
+});
+defineTool({
+  name: "create_ingest_key",
+  category: "errors",
+  description: [
+    "Mint a write-only error-ingest key for a service, so its application can report exceptions.",
+    "",
+    "When to use: setting a service up for error tracking for the first time, or rotating a key that has leaked or is being retired.",
+    "",
+    "The response is the ONLY place the plaintext key ever exists \u2014 it is stored as a SHA-256 hash and cannot be shown again. Put it wherever the application reads it from (an env var, usually) before discarding the response.",
+    "",
+    "The key is deliberately low-privilege: it can create error events for this ONE service and can do nothing else \u2014 it cannot read the issues it created, list services, or touch anything on the team. That is why shipping it inside the application, including a browser bundle where it is world-readable, is expected rather than a mistake.",
+    "",
+    'Reporting is a plain HTTP POST, no SDK required: POST {baseUrl}/api/ingest/errors/{key} with {"events":[{"type","value","stack","level","context"}]}, up to 100 events per request.',
+    "",
+    'Inputs: serviceId (required), name (optional label, default "default"). Max 5 keys per service \u2014 the extras exist so a key can be rotated without downtime (create the second, ship it, delete the first).',
+    "",
+    "Returns: { key: { id, publicId, name, prefix, key } } where `key` is the plaintext.",
+    "",
+    "Example: create_ingest_key({ serviceId: 48 }) \u2192 { id: 4, name: 'default', prefix: 'ing_1b7d40ae', key: 'ing_1b7d40ae\u2026' }."
+  ].join("\n"),
+  input: {
+    serviceId: z13.number().int().positive(),
+    name: z13.string().min(1).max(100).optional().describe('Label. Default "default".')
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.post(
+      `/api/services/${teamId}/${args2.serviceId}/ingest-keys`,
+      { name: args2.name ?? "default" }
+    );
+    return respond({
+      summary: "Ingest key created. The plaintext key is in the payload and is not retrievable again \u2014 store it now.",
+      data: shape(response.key)
+    });
+  }
+});
+defineTool({
+  name: "delete_ingest_key",
+  category: "errors",
+  description: [
+    "Revoke an error-ingest key. It stops working immediately, including on API replicas that had it cached.",
+    "",
+    "When to use: finishing a key rotation, or containing a key that leaked somewhere it should not have.",
+    "",
+    "Anything still posting with it starts getting 401s, so revoke the OLD key after the new one is deployed, not before.",
+    "",
+    "Inputs: serviceId, keyId (both required).",
+    "",
+    "Returns: { success: true }.",
+    "",
+    "Example: delete_ingest_key({ serviceId: 48, keyId: 3 }) \u2192 { success: true }."
+  ].join("\n"),
+  input: {
+    serviceId: z13.number().int().positive(),
+    keyId: z13.number().int().positive()
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    await ctx.api.delete(`/api/services/${teamId}/${args2.serviceId}/ingest-keys/${args2.keyId}`);
+    return respond({ summary: `Ingest key ${args2.keyId} revoked.` });
+  }
+});
+
 // src/tools/github.ts
 defineTool({
   name: "sync_github_repos",
@@ -2154,7 +2688,7 @@ defineTool({
 });
 
 // src/tools/notifications.ts
-import { z as z11 } from "zod";
+import { z as z14 } from "zod";
 var NOTIFICATION_EVENTS = [
   "deploy.started",
   "deploy.succeeded",
@@ -2168,9 +2702,25 @@ var NOTIFICATION_EVENTS = [
   "service.auto_suspended",
   "service.acme_cert_failed",
   "service.resource_alert",
+  "service.uptime_down",
+  "service.uptime_recovered",
+  "error.issue_new",
+  "error.issue_regressed",
   "git.auth_failed",
   "cron.execution_failed",
-  "workflow.failed"
+  "workflow.failed",
+  "devenv.agent.needs_input",
+  "devenv.agent.finished",
+  "devenv.task.created",
+  "devenv.task.needs_input",
+  "devenv.task.finished",
+  "database.backup_failed",
+  "database.restore_failed",
+  "machine.offline",
+  "machine.online",
+  "billing.invoice",
+  "billing.payment_failed",
+  "billing.spend_limit"
 ];
 defineTool({
   name: "list_notification_channels",
@@ -2209,17 +2759,21 @@ defineTool({
     "  - webhook_url: Slack/Discord webhook URL OR email address.",
     "  - events: list of event names to subscribe to. Pass an empty list to create a channel that fires for nothing (manual subscribe later with update_notification_channel).",
     "",
-    "Valid events: deploy.started, deploy.succeeded, deploy.failed, deploy.failed_consecutive, service.created, service.deleted, service.suspended, service.resumed, service.restart_failed, service.auto_suspended, service.acme_cert_failed, service.resource_alert, git.auth_failed, cron.execution_failed, workflow.failed.",
+    // Rendered from the enum instead of retyped: the hand-written copy of
+    // this sentence went stale the same way the enum did, and a description
+    // that disagrees with the schema teaches the model to send values the
+    // tool then rejects.
+    `Valid events: ${NOTIFICATION_EVENTS.join(", ")}.`,
     "",
     "Returns: { channel: Channel }.",
     "",
     "Example: create_notification_channel({ type: 'slack', name: 'eng-alerts', webhook_url: 'https://hooks.slack.com/\u2026', events: ['deploy.failed', 'git.auth_failed', 'service.restart_failed'] })"
   ].join("\n"),
   input: {
-    type: z11.enum(["slack", "discord", "email"]).describe("Channel type."),
-    name: z11.string().min(1).max(128).describe("Human-readable label."),
-    webhook_url: z11.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
-    events: z11.array(z11.enum(NOTIFICATION_EVENTS)).describe(
+    type: z14.enum(["slack", "discord", "email"]).describe("Channel type."),
+    name: z14.string().min(1).max(128).describe("Human-readable label."),
+    webhook_url: z14.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
+    events: z14.array(z14.enum(NOTIFICATION_EVENTS)).describe(
       "List of events the channel subscribes to. Empty list = subscribe to nothing."
     )
   },
@@ -2257,10 +2811,10 @@ defineTool({
     "Example: update_notification_channel({ channel_id: 3, events: ['deploy.failed', 'service.restart_failed', 'git.auth_failed'] })"
   ].join("\n"),
   input: {
-    channel_id: z11.number().int().positive().describe("Numeric channel id from list_notification_channels."),
-    name: z11.string().min(1).max(128).optional().describe("New label."),
-    active: z11.boolean().optional().describe("false silences without deleting."),
-    events: z11.array(z11.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
+    channel_id: z14.number().int().positive().describe("Numeric channel id from list_notification_channels."),
+    name: z14.string().min(1).max(128).optional().describe("New label."),
+    active: z14.boolean().optional().describe("false silences without deleting."),
+    events: z14.array(z14.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2299,7 +2853,7 @@ defineTool({
     "Example: delete_notification_channel({ channel_id: 3 }) \u2192 { ok: true }"
   ].join("\n"),
   input: {
-    channel_id: z11.number().int().positive().describe("Numeric channel id.")
+    channel_id: z14.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2326,7 +2880,7 @@ defineTool({
     "Example: test_notification_channel({ channel_id: 3 }) \u2192 { success: true }"
   ].join("\n"),
   input: {
-    channel_id: z11.number().int().positive().describe("Numeric channel id.")
+    channel_id: z14.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2341,7 +2895,7 @@ defineTool({
 });
 
 // src/tools/projects.ts
-import { z as z12 } from "zod";
+import { z as z15 } from "zod";
 var AVAILABLE_REGION_IDS = ["eu-central-1"];
 defineTool({
   name: "list_projects",
@@ -2382,9 +2936,9 @@ defineTool({
     'Example: create_project({ name: "billing-api", description: "Stripe webhooks", region: "eu-central-1" }) \u2192 { project: { id: 12, publicId: "prj_\u2026", \u2026 } }'
   ].join("\n"),
   input: {
-    name: z12.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
-    description: z12.string().max(500).optional().describe("Short description (\u2264500 chars)."),
-    region: z12.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
+    name: z15.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
+    description: z15.string().max(500).optional().describe("Short description (\u2264500 chars)."),
+    region: z15.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2417,9 +2971,9 @@ defineTool({
     'Example: update_project({ project_id: "prj_abc", name: "billing-prod" }) \u2192 { project: { name: "billing-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z12.string().describe("Project publicId."),
-    name: z12.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
-    description: z12.string().max(500).optional().describe("New description (\u2264500 chars).")
+    project_id: z15.string().describe("Project publicId."),
+    name: z15.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
+    description: z15.string().max(500).optional().describe("New description (\u2264500 chars).")
   },
   handler: async (args2, ctx) => {
     if (args2.name === void 0 && args2.description === void 0) {
@@ -2453,7 +3007,7 @@ defineTool({
     'Example: get_project({ project_id: "prj_abc" }) \u2192 { project: { id: 12, name: "billing", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z12.string().describe("Project publicId (e.g. prj_abc123).")
+    project_id: z15.string().describe("Project publicId (e.g. prj_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2465,7 +3019,7 @@ defineTool({
 });
 
 // src/tools/resource-links.ts
-import { z as z13 } from "zod";
+import { z as z16 } from "zod";
 var RESOURCE_LINK_TYPES = [
   "database",
   "object_storage",
@@ -2526,7 +3080,7 @@ defineTool({
     'Example: list_service_resources({ service_id: "svc_abc" }) \u2192 { items: [{ id: 7, resourceType: "database", resourceId: 42, alias: "APP_DB" }] }'
   ].join("\n"),
   input: {
-    service_id: z13.union([z13.number().int().positive(), z13.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
+    service_id: z16.union([z16.number().int().positive(), z16.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2563,10 +3117,10 @@ defineTool({
     'Example: link_resource_to_service({ service_id: "svc_abc", resource_type: "database", resource_id: 42, alias: "APP_DB" }) \u2192 { link: { id: 7, alias: "APP_DB" } }'
   ].join("\n"),
   input: {
-    service_id: z13.union([z13.number().int().positive(), z13.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    resource_type: z13.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
-    resource_id: z13.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
-    alias: z13.string().min(1).max(48).regex(
+    service_id: z16.union([z16.number().int().positive(), z16.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    resource_type: z16.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
+    resource_id: z16.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
+    alias: z16.string().min(1).max(48).regex(
       /^[A-Z][A-Z0-9_]*$/,
       "Alias must be uppercase letters, digits and underscores, starting with a letter."
     ).describe('Uppercase env-var prefix, e.g. "APP_DB". Unique within the service.')
@@ -2602,8 +3156,8 @@ defineTool({
     'Example: unlink_resource_from_service({ service_id: "svc_abc", link_id: 7 }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z13.union([z13.number().int().positive(), z13.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    link_id: z13.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
+    service_id: z16.union([z16.number().int().positive(), z16.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    link_id: z16.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2615,9 +3169,217 @@ defineTool({
 });
 
 // src/tools/services.ts
-import { z as z14 } from "zod";
+import { z as z17 } from "zod";
+
+// src/lib/app-templates.ts
+var MCP_APP_TEMPLATES = [
+  {
+    id: "node-express",
+    name: "Node.js Express",
+    description: "HTTP server with Express.js",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    startCommand: "node index.js"
+  },
+  {
+    id: "python-fastapi",
+    name: "Python FastAPI",
+    description: "Modern Python API framework",
+    type: "web_service",
+    runtime: "python",
+    installCommand: "pip install -r requirements.txt",
+    startCommand: "uvicorn main:app --host 0.0.0.0 --port $PORT"
+  },
+  {
+    id: "go-api",
+    name: "Go HTTP Server",
+    description: "Lightweight Go web service",
+    type: "web_service",
+    runtime: "go",
+    installCommand: "go mod download",
+    buildCommand: "go build -o server .",
+    startCommand: "./server"
+  },
+  {
+    id: "bun-hono",
+    name: "Bun + Hono",
+    description: "Fast TypeScript API with Bun runtime",
+    type: "web_service",
+    runtime: "bun",
+    installCommand: "bun install",
+    startCommand: "bun run src/index.ts"
+  },
+  {
+    id: "nextjs-ssr",
+    name: "Next.js",
+    description: "Server-rendered Next.js started with next start",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    startCommand: "npm run start"
+  },
+  {
+    id: "react-router-ssr",
+    name: "React Router / Remix",
+    description: "Server build served by react-router-serve or remix-serve",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    startCommand: "npm run start"
+  },
+  {
+    id: "sveltekit-node",
+    name: "SvelteKit",
+    description: "SvelteKit server build produced by adapter-node",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    startCommand: "node build"
+  },
+  {
+    id: "nuxt",
+    name: "Nuxt",
+    description: "Nuxt server build running on the Nitro output",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    startCommand: "node .output/server/index.mjs"
+  },
+  {
+    id: "django",
+    name: "Django",
+    description: "Django project served by Gunicorn",
+    type: "web_service",
+    runtime: "python",
+    installCommand: "pip install -r requirements.txt",
+    buildCommand: "python manage.py collectstatic --noinput || true",
+    startCommand: "gunicorn --bind 0.0.0.0:$PORT --workers 2 $(ls */wsgi.py | head -n1 | cut -d/ -f1).wsgi:application"
+  },
+  {
+    id: "flask",
+    name: "Flask",
+    description: "Flask app served by Gunicorn",
+    type: "web_service",
+    runtime: "python",
+    installCommand: "pip install -r requirements.txt",
+    startCommand: "gunicorn --bind 0.0.0.0:$PORT --workers 2 app:app"
+  },
+  {
+    id: "spring-boot",
+    name: "Spring Boot",
+    description: "Spring Boot fat JAR built with Maven or Gradle",
+    type: "web_service",
+    runtime: "java",
+    // No install/build on purpose: the agent inspects the repo and picks
+    // Maven vs Gradle with the matching toolchain image. Sending either one
+    // here would break the other half of the split.
+    startCommand: "java -jar /app/app.jar --server.port=$PORT"
+  },
+  {
+    id: "static-react",
+    name: "React SPA",
+    description: "Single-page React application",
+    type: "static_site",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    publishPath: "./dist"
+  },
+  {
+    id: "static-nextjs",
+    name: "Next.js Static",
+    description: "Next.js with static export",
+    type: "static_site",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    publishPath: "./out"
+  },
+  {
+    id: "astro",
+    name: "Astro",
+    description: "Astro site built to Astro's default static output",
+    type: "static_site",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    publishPath: "./dist"
+  },
+  {
+    id: "worker-bullmq",
+    name: "BullMQ Worker",
+    description: "Background job processor",
+    type: "worker",
+    runtime: "node",
+    installCommand: "npm install",
+    startCommand: "node worker.js"
+  },
+  {
+    id: "uptime-kuma",
+    name: "Uptime Kuma",
+    description: "Self-hosted uptime monitoring and status pages, with its own SQLite store",
+    type: "web_service",
+    dockerImage: "louislam/uptime-kuma:1",
+    port: 3e3
+  },
+  {
+    id: "vaultwarden",
+    name: "Vaultwarden",
+    description: "Self-hosted Bitwarden-compatible password manager (unofficial server)",
+    type: "web_service",
+    dockerImage: "vaultwarden/server:1.32.7-alpine",
+    port: 3e3
+  },
+  {
+    id: "n8n",
+    name: "n8n",
+    description: "Self-hosted workflow automation \u2014 visual editor, 400+ integrations",
+    type: "web_service",
+    dockerImage: "n8nio/n8n:1",
+    port: 5678
+  },
+  {
+    id: "wordpress",
+    name: "WordPress",
+    description: "PHP 8.3 + Apache, with a managed MySQL database (billed separately)",
+    type: "web_service",
+    dockerImage: "wordpress:php8.3-apache",
+    port: 80
+  },
+  {
+    id: "ghost",
+    name: "Ghost",
+    description: "Blogs and newsletters, with a managed MySQL database (billed separately)",
+    type: "web_service",
+    dockerImage: "ghost:5-alpine",
+    port: 2368
+  },
+  {
+    id: "cron-cleanup",
+    name: "Cleanup Cron",
+    description: "Daily maintenance task",
+    type: "cron_job",
+    runtime: "node",
+    installCommand: "npm install",
+    startCommand: "node cleanup.js",
+    cronSchedule: "0 3 * * *"
+  }
+];
+
+// src/tools/services.ts
 var DEV_ENV_IMAGE = "registry.hoststack.dev/hoststack/dev-env:latest";
 var DEV_ENV_VOLUME = { name: "workspace", mountPath: "/workspace", sizeGb: 10 };
+var DEV_BOX_INSIDE = [
+  "INSIDE the box (no Docker daemon \u2014 do not try `docker run`, and runtime `apt-get` is blocked too; it is all preinstalled):",
+  '  - Databases/engines via `dev-services up`: Postgres 17 (:5432, user "dev", trust auth), Redis (:6379), Meilisearch (:7700). MariaDB/MySQL (:3306, user "dev", no password, client `mariadb`) and MongoDB (:27017, client `mongosh`) are OPT-IN \u2014 `dev-services up mysql` / `dev-services up mongodb` \u2014 so a box does not pay RAM for engines it never uses. `dev-services createdb <name>` makes a Postgres role + database in one step. Data lives on /workspace, so it survives restarts.',
+  "  - Language runtimes: node, bun, python and php 8.3 are built in. go, java, ruby, rust, elixir and dotnet install on demand with `dev-runtime add <name>` (persisted to /workspace). Together that covers every runtime the platform itself deploys \u2014 a WordPress/Laravel/Rails stack runs in the box. elixir needs `dev-runtime add erlang` first: it is a BEAM distribution with no OTP of its own, and Ubuntu ships one too old to use, so mise builds a current one (takes a few minutes).",
+  "  - `hoststack-status` prints what is running, the box dev URL and agent login state at any time."
+].join("\n");
 var SERVICE_TYPES = [
   "web_service",
   "private_service",
@@ -2664,11 +3426,11 @@ defineTool({
     'Example: list_services({ status: "failed" }) \u2192 only services that need attention.'
   ].join("\n"),
   input: {
-    project_id: z14.union([z14.number().int().positive(), z14.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
-    environment_id: z14.union([z14.number().int().positive(), z14.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
-    status: z14.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
-    type: z14.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
-    dev_environment: z14.boolean().optional().describe(
+    project_id: z17.union([z17.number().int().positive(), z17.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
+    environment_id: z17.union([z17.number().int().positive(), z17.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
+    status: z17.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
+    type: z17.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
+    dev_environment: z17.boolean().optional().describe(
       "Include agentic Dev Boxes in the results (excluded by default; see list_dev_environments)."
     )
   },
@@ -2713,6 +3475,8 @@ defineTool({
     "",
     "When to use: the user wants to deploy something new. For a one-command AI dev environment specifically, prefer create_dev_environment (it also attaches the /workspace volume and sets the MCP keys).",
     "",
+    "*** For a packaged app (WordPress, Ghost, n8n, Uptime Kuma, Vaultwarden), start at list_templates and pass template_id. *** Those templates are prebuilt images that only boot with the volume, scratch dirs, uid and companion database the platform attaches from the template id \u2014 the same image passed as a bare docker_image crash-loops on the read-only rootfs, and the fix is a redeploy away rather than an edit away.",
+    "",
     '*** NOT for databases. *** If the user wants Postgres, Redis, MySQL, MariaDB or MongoDB, call create_database \u2014 do NOT create a service with docker_image "postgres:16" / "redis:7" / "mongo" / "mysql". A database deployed as a service is unmanaged: no backups, no version upgrades, no HA, no credential rotation, no metrics, no persistent volume, and nothing injects its URL into your app. `docker_image` here is for YOUR application images (or sidecars), not for datastores the platform already manages.',
     "",
     "Inputs:",
@@ -2726,32 +3490,43 @@ defineTool({
     "  - cron_schedule (optional): cron expression \u2014 required for cron_job.",
     '  - publish_path (optional): static-site output dir (e.g. "dist").',
     '  - runtime (optional): "node" | "bun" | "python" | \u2026 (auto-detected from a repo when omitted).',
+    "  - port (optional): the port the container listens on (1\u201365535). A source-built service should omit it \u2014 the platform injects $PORT and expects the app to bind that. Set it for a docker_image whose listen port is fixed by the image (WordPress 80, Ghost 2368, n8n 5678): the platform publishes and health-checks this port and never re-reads what the process actually bound, so an image listening elsewhere fails its first deploy on a container that is perfectly healthy.",
+    "  - template_id (optional): create from a quickstart template \u2014 an id from list_templates and nothing else. Everything the template brings (volumes, scratch dirs, uid, generated secrets, companion managed database) is resolved server-side and attached before the first deploy fires; there is no way to send those in the body. For an image template, pass its docker_image and port alongside, exactly as list_templates returns them.",
     '  - plan (optional): service size (default "micro").',
     "  - environment_id (optional): bind to a specific environment; defaults to the project Production env.",
     "  - auto_deploy (optional, default true): trigger the first deploy immediately when a source is present.",
+    "  - machine (optional): run it on one of the team's OWN enrolled machines (name or id, see list_machines) instead of HostStack compute. Pinned at creation and never moved afterwards, and the service is up only while that machine is.",
     "",
     "Returns: { service: Service, deployId: number | null }.",
     "",
-    'Example: create_service({ project_id: "prj_abc", name: "api", type: "web_service", github_repo_id: 42 }) \u2192 { service: { publicId: "svc_\u2026" }, deployId: 1234 }'
+    'Example: create_service({ project_id: "prj_abc", name: "api", type: "web_service", github_repo_id: 42 }) \u2192 { service: { publicId: "svc_\u2026" }, deployId: 1234 }',
+    'Example (one-click app): create_service({ project_id: "prj_abc", name: "blog", type: "web_service", template_id: "wordpress", docker_image: "wordpress:php8.3-apache", port: 80 }) \u2014 the wp-content volume, the www-data uid, the Apache scratch dirs and the managed MySQL come from the template id.'
   ].join("\n"),
   input: {
-    project_id: z14.union([z14.number().int().positive(), z14.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z14.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
-    type: z14.enum(SERVICE_TYPES).describe("Service type."),
-    docker_image: z14.string().max(500).optional().describe(
+    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z17.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
+    type: z17.enum(SERVICE_TYPES).describe("Service type."),
+    docker_image: z17.string().max(500).optional().describe(
       "Pre-built APPLICATION image ref. Mutually exclusive with github_repo_id. Not for databases \u2014 use create_database for postgres/redis/mysql/mariadb/mongodb."
     ),
-    github_repo_id: z14.number().int().positive().optional().describe("Linked GitHub repo numeric id. Mutually exclusive with docker_image."),
-    branch: z14.string().max(200).optional().describe('Git branch (default "main").'),
-    install_command: z14.string().max(1e3).optional().describe("Install shell command."),
-    build_command: z14.string().max(1e3).optional().describe("Build shell command."),
-    start_command: z14.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
-    cron_schedule: z14.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
-    publish_path: z14.string().max(500).optional().describe("Static-site output dir."),
-    runtime: z14.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
-    plan: z14.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
-    environment_id: z14.union([z14.number().int().positive(), z14.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
-    auto_deploy: z14.boolean().optional().describe("Trigger the first deploy immediately (default true).")
+    github_repo_id: z17.number().int().positive().optional().describe("Linked GitHub repo numeric id. Mutually exclusive with docker_image."),
+    branch: z17.string().max(200).optional().describe('Git branch (default "main").'),
+    install_command: z17.string().max(1e3).optional().describe("Install shell command."),
+    build_command: z17.string().max(1e3).optional().describe("Build shell command."),
+    start_command: z17.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
+    cron_schedule: z17.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
+    publish_path: z17.string().max(500).optional().describe("Static-site output dir."),
+    runtime: z17.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
+    port: z17.number().int().min(1).max(65535).optional().describe(
+      "Listen port, for a prebuilt image whose port is fixed by the image. Omit for a source-built service \u2014 it binds the injected $PORT."
+    ),
+    template_id: z17.string().max(64).optional().describe(
+      "Quickstart template id from list_templates. Its volumes, scratch dirs, uid, secrets and companion database are resolved server-side; for an image template also pass its docker_image and port."
+    ),
+    plan: z17.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
+    environment_id: z17.union([z17.number().int().positive(), z17.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
+    auto_deploy: z17.boolean().optional().describe("Trigger the first deploy immediately (default true)."),
+    machine: machineInput
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2773,6 +3548,8 @@ defineTool({
     if (args2.cron_schedule !== void 0) input.cronSchedule = args2.cron_schedule;
     if (args2.publish_path !== void 0) input.publishPath = args2.publish_path;
     if (args2.runtime !== void 0) input.runtime = args2.runtime;
+    if (args2.port !== void 0) input.port = args2.port;
+    if (args2.template_id !== void 0) input.templateId = args2.template_id;
     if (args2.plan !== void 0) input.plan = args2.plan;
     if (args2.auto_deploy !== void 0) input.autoDeploy = args2.auto_deploy;
     if (args2.environment_id !== void 0) {
@@ -2781,6 +3558,9 @@ defineTool({
         teamId
       });
     }
+    if (args2.machine !== void 0) {
+      input.machineId = await resolveMachineId(ctx, teamId, args2.machine);
+    }
     const response = await ctx.hoststack.services.create(teamId, input);
     const data = {
       service: shapeService(response.service),
@@ -2804,28 +3584,31 @@ defineTool({
     '  - project_id: numeric id or publicId ("prj_\u2026") of the target project.',
     '  - name (optional): service name (default "dev-environment").',
     '  - plan (optional): box size. Defaults to "standard" (2 GB) \u2014 the OOM-safe floor (DEV_ENV_MIN_SIZE); a coding agent + build OOMs below it. A smaller plan is clamped up to "standard".',
-    "  - disk_gb (optional): /workspace volume size in GB (default 10, 1\u2013100).",
+    "  - disk_gb (optional): /workspace volume size in GB (default 10, min 10, max 10240).",
     "  - hoststack_api_key (optional): sets HOSTSTACK_API_KEY so the hoststack MCP works inside the container.",
     "  - poststack_api_key (optional): sets POSTSTACK_API_KEY so the poststack MCP works inside the container.",
     "  - repo_url (optional): clone this git URL into /workspace on first boot (with optional branch).",
     "",
+    DEV_BOX_INSIDE,
+    "",
     "Returns: { service: Service, volumeAttached: boolean, deployId: number | null }. Open the Terminal tab on the service (dashboard or phone) once it is running; log in once with `claude /login` inside the container.",
     "",
     'Example: create_dev_environment({ project_id: "prj_abc", name: "scratch", hoststack_api_key: "hs_live_\u2026" })'
   ].join("\n"),
   input: {
-    project_id: z14.union([z14.number().int().positive(), z14.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z14.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
-    plan: z14.enum(SERVICE_PLANS).optional().describe(
+    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z17.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
+    plan: z17.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB, the OOM-safe floor; a smaller plan is clamped up to "standard").'
     ),
-    disk_gb: z14.number().int().min(1).max(100).optional().describe("/workspace volume size in GB (default 10)."),
-    hoststack_api_key: z14.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
-    poststack_api_key: z14.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
-    repo_url: z14.string().max(500).optional().describe(
+    disk_gb: z17.number().int().min(10).max(10240).optional().describe("/workspace volume size in GB (default 10, min 10, max 10240)."),
+    hoststack_api_key: z17.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
+    poststack_api_key: z17.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
+    repo_url: z17.string().max(500).optional().describe(
       "Clone this git URL into /workspace on first boot (HTTPS, or SSH once a key is set)."
     ),
-    branch: z14.string().max(200).optional().describe("Branch to clone (with repo_url).")
+    branch: z17.string().max(200).optional().describe("Branch to clone (with repo_url)."),
+    machine: machineInput
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2844,6 +3627,9 @@ defineTool({
       autoDeploy: false,
       plan
     };
+    if (args2.machine !== void 0) {
+      createInput.machineId = await resolveMachineId(ctx, teamId, args2.machine);
+    }
     const created = await ctx.hoststack.services.create(teamId, createInput);
     const service = created.service;
     const rollback = async () => {
@@ -2931,14 +3717,16 @@ defineTool({
     "  - include_database_clone (optional): clone the linked database so the app runs on a copy of real data (default true).",
     '  - name (optional): dev box name (default "<source>-dev").',
     "",
+    DEV_BOX_INSIDE,
+    "",
     "Returns: { service, devUrl, deployId }. Once it is live: open the Terminal tab, run `claude`, start the dev server (it must bind $PORT), and view the app at https://<devUrl>. Tear it all down later with delete_dev_environment.",
     "",
     'Example: spin_up_dev_environment({ service_id: "svc_api" }) \u2192 a dev box running a clone of the api service (repo + env-vars + cloned DB) with a public dev URL.'
   ].join("\n"),
   input: {
-    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
-    include_database_clone: z14.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
-    name: z14.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
+    service_id: z17.union([z17.number().int().positive(), z17.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
+    include_database_clone: z17.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
+    name: z17.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2979,7 +3767,7 @@ defineTool({
     'Example: delete_dev_environment({ service_id: "svc_api_dev" }) \u2192 removes the dev box, its cloned database, and the /workspace volume.'
   ].join("\n"),
   input: {
-    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
+    service_id: z17.union([z17.number().int().positive(), z17.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3015,8 +3803,8 @@ defineTool({
     'Example: resize_dev_environment({ service_id: "svc_skyskraber_dev", size: "large" }) \u2192 bumps the box to the large tier, applied live.'
   ].join("\n"),
   input: {
-    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe("The box to resize \u2014 numeric id or publicId."),
-    size: z14.enum(SERVICE_PLANS).describe(
+    service_id: z17.union([z17.number().int().positive(), z17.string()]).describe("The box to resize \u2014 numeric id or publicId."),
+    size: z17.enum(SERVICE_PLANS).describe(
       'Target size tier (service catalog size, e.g. "standard", "large", "xlarge").'
     )
   },
@@ -3070,35 +3858,62 @@ defineTool({
   name: "list_templates",
   category: "services",
   description: [
-    "List the canonical Dev Box (AI dev environment) preset so an agent can see, without guessing, what a `create_standalone_dev_environment` / `create_dev_environment` actually provisions: the container image, the persistent /workspace volume (mount + default size), the OOM-safe size floor, and the companion database options.",
+    "List the app quickstart templates the dashboard New-Service wizard offers, plus the separate Dev Box preset. Two kinds live in one list: a stack template (Next.js, Django, SvelteKit, Spring Boot, \u2026) is a pre-filled install/build/start command set you pair with a Git repo, and a one-click app (WordPress, Ghost, n8n, Uptime Kuma, Vaultwarden) is a prebuilt image that needs no repo at all.",
     "",
-    "When to use: before creating a Dev Box, to confirm the image, the default /workspace size, the minimum plan, or which companion engines can be attached \u2014 instead of hand-duplicating those constants.",
+    'When to use: whenever asked to deploy a known stack ("deploy my Next.js app", "put this Django project on HostStack"), before hand-writing a start command; whenever asked for a packaged app ("deploy WordPress", "I want a Ghost blog"), before reaching for a bare docker_image; and before creating a Dev Box, to confirm the image, /workspace size, plan floor, and companion engines instead of duplicating those constants.',
     "",
-    'Returns: { templates: [{ id, name, image, volume: { name, mountPath, sizeGb }, minPlan, companions }] }. Today there is one preset ("dev-environment").',
+    "Returns: { templates: [{ id, name, description, type, runtime?, installCommand?, buildCommand?, startCommand?, publishPath?, cronSchedule?, dockerImage?, port?, requiresTemplateId? }], devBox: { id, name, image, volume: { name, mountPath, sizeGb }, minPlan, createWith, companions, inBox } }. A template WITHOUT `dockerImage` is source-built \u2014 pass its commands to create_service with a `github_repo_id`. A template WITH `dockerImage` is flagged `requiresTemplateId` and must be created as create_service({ template_id, docker_image, port, \u2026 }): the volume, scratch dirs, uid, generated secrets and companion managed database it needs are attached server-side from the id, and the same image sent without it crash-loops on the read-only rootfs. The Dev Box is NOT in `templates`: it is created with create_standalone_dev_environment / create_dev_environment, never create_service. `companions` are SEPARATE managed databases you can attach; `inBox` is what the box already runs on its own (engines via `dev-services`, language runtimes via `dev-runtime`) \u2014 check it before concluding a box cannot run something.",
     "",
-    'Example: list_templates() \u2192 { templates: [{ id: "dev-environment", image: "registry.hoststack.dev/hoststack/dev-env:latest", volume: { mountPath: "/workspace", sizeGb: 10 }, minPlan: "standard", companions: ["postgres","redis","meilisearch"] }] }'
+    'Example: list_templates() \u2192 { templates: [{ id: "nextjs-ssr", name: "Next.js", type: "web_service", runtime: "node", installCommand: "npm install", buildCommand: "npm run build", startCommand: "npm run start" }, { id: "wordpress", name: "WordPress", type: "web_service", dockerImage: "wordpress:php8.3-apache", port: 80, requiresTemplateId: true }, \u2026], devBox: { id: "dev-environment", image: "registry.hoststack.dev/hoststack/dev-env:latest", volume: { mountPath: "/workspace", sizeGb: 10 }, minPlan: "standard", companions: ["postgres","redis","meilisearch"] } }'
   ].join("\n"),
   input: {},
   handler: async () => {
-    const templates = [
-      {
-        id: "dev-environment",
-        name: "AI Dev Environment",
-        image: DEV_ENV_IMAGE,
-        volume: {
-          name: DEV_ENV_VOLUME.name,
-          mountPath: DEV_ENV_VOLUME.mountPath,
-          sizeGb: DEV_ENV_VOLUME.sizeGb
+    const devBox = {
+      id: "dev-environment",
+      name: "AI Dev Environment",
+      image: DEV_ENV_IMAGE,
+      volume: {
+        name: DEV_ENV_VOLUME.name,
+        mountPath: DEV_ENV_VOLUME.mountPath,
+        sizeGb: DEV_ENV_VOLUME.sizeGb
+      },
+      /** OOM-safe plan floor — a coding agent + build needs at least this. */
+      minPlan: DEV_ENV_MIN_SIZE,
+      /** Create it with these, never create_service. */
+      createWith: ["create_standalone_dev_environment", "create_dev_environment"],
+      /** Companion engines you can attach (fresh + empty), like local `make db-up`. */
+      companions: ["postgres", "redis", "meilisearch"],
+      /**
+       * What the box can already run without attaching anything. Reported
+       * so an agent picking a template can see that "it needs MySQL" or
+       * "it's a PHP app" is already satisfied, instead of concluding the
+       * box is unsuitable and reaching for Docker (there is no daemon).
+       */
+      inBox: {
+        engines: {
+          default: ["postgres", "redis", "meilisearch"],
+          optIn: ["mysql", "mongodb"],
+          start: "dev-services up [mysql|mongodb]"
         },
-        /** OOM-safe plan floor — a coding agent + build needs at least this. */
-        minPlan: DEV_ENV_MIN_SIZE,
-        /** Companion engines you can attach (fresh + empty), like local `make db-up`. */
-        companions: ["postgres", "redis", "meilisearch"]
+        runtimes: {
+          builtin: ["node", "bun", "python", "php"],
+          // erlang is listed because elixir cannot run without it —
+          // see DEV_BOX_INSIDE. Ordering matters for a caller acting
+          // on this: add erlang, then elixir.
+          onDemand: ["go", "java", "ruby", "rust", "erlang", "elixir", "dotnet"],
+          install: "dev-runtime add <name>"
+        }
       }
-    ];
+    };
+    const templates = MCP_APP_TEMPLATES.map(
+      (t) => t.dockerImage ? { ...t, requiresTemplateId: true } : t
+    );
+    const byType = /* @__PURE__ */ new Map();
+    for (const t of templates) byType.set(t.type, (byType.get(t.type) ?? 0) + 1);
+    const breakdown = [...byType].map(([type, n]) => `${n} ${type}`).join(", ");
     return respond({
-      summary: `${templates.length} Dev Box template${templates.length === 1 ? "" : "s"} available (image ${DEV_ENV_IMAGE}, /workspace ${DEV_ENV_VOLUME.sizeGb} GB, floor "${DEV_ENV_MIN_SIZE}").`,
-      data: { templates }
+      summary: `${templates.length} app templates (${breakdown}) \u2014 pick one by id, then either pass its commands to create_service with a github_repo_id, or, if it has a dockerImage, pass template_id + docker_image + port. Plus the Dev Box preset (image ${DEV_ENV_IMAGE}, /workspace ${DEV_ENV_VOLUME.sizeGb} GB, floor "${DEV_ENV_MIN_SIZE}"), which is created with create_standalone_dev_environment, not create_service.`,
+      data: { templates, devBox }
     });
   }
 });
@@ -3110,7 +3925,9 @@ defineTool({
     "",
     "This makes a cloud Dev Box, NOT a project deploy environment (create_environment \u2192 Production / Staging / Preview). It is a workspace you code in, not a deployment target.",
     "",
-    'Every Dev Box \u2014 with or without companions \u2014 also ships NATIVE Postgres 17, Redis and Meilisearch INSIDE the box, started with `dev-services up` (postgres :5432 as user "dev" with trust auth, redis :6379, meilisearch :7700). That is the no-Docker replacement for `make db-up` and is the right answer for local development inside the box; there is no Docker daemon available in there. The `companions` option is different \u2014 it attaches SEPARATE managed databases to the box\'s environment for when the box needs a real, persistent, backed-up datastore.',
+    DEV_BOX_INSIDE,
+    "",
+    "Those in-box engines are the no-Docker replacement for a local `make db-up`, and are the right answer for development inside the box. The `companions` option is a DIFFERENT thing: it attaches SEPARATE managed databases to the box's environment, for when the box needs a real, persistent, backed-up datastore rather than a scratch one.",
     "",
     'When to use: "create a dev environment for <repo>", "spin me up a cloud dev box with a Postgres". Distinct from spin_up_dev_environment (which clones an EXISTING service) and create_dev_environment (a bare box in a chosen project).',
     "",
@@ -3121,6 +3938,7 @@ defineTool({
     "  - clone_url (for url): an http(s) git clone URL.",
     "  - branch (optional): branch to clone.",
     '  - databases (optional): companion services to attach \u2014 any of "postgres", "redis", "meilisearch".',
+    "  - machine (optional): run the box on one of the team's OWN enrolled machines (name or id, see list_machines) instead of HostStack compute. /workspace then lives on that machine's disk, so the box is reachable only while it is switched on, and any companion databases are created there too.",
     '  - plan (optional): box size. Defaults to "standard" (2 GB) \u2014 the OOM-safe floor (DEV_ENV_MIN_SIZE); a smaller plan is floored up to "standard" server-side.',
     "  - agent_accounts (optional): bind specific saved agent logins by account id per provider. OMIT to auto-inherit the box owner's default logins (claude/codex/opencode), so `claude` is already authenticated on first boot \u2014 no manual login.",
     "",
@@ -3129,25 +3947,26 @@ defineTool({
     'Example: create_standalone_dev_environment({ name: "app-dev", source_kind: "github_repo", github_repo_id: 42, databases: ["postgres","redis"] })'
   ].join("\n"),
   input: {
-    name: z14.string().min(1).max(100).optional().describe(
+    name: z17.string().min(1).max(100).optional().describe(
       'Dev Box name. Omit to have it named after the source (the repo name, or "dev-box" for a blank one), de-duplicated against existing boxes.'
     ),
-    source_kind: z14.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
-    github_repo_id: z14.number().int().positive().optional().describe('Connected GitHub repo id (required when source_kind="github_repo").'),
-    clone_url: z14.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
-    branch: z14.string().min(1).max(255).optional().describe("Branch to clone."),
-    databases: z14.array(z14.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
-    plan: z14.enum(SERVICE_PLANS).optional().describe(
+    source_kind: z17.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
+    github_repo_id: z17.number().int().positive().optional().describe('Connected GitHub repo id (required when source_kind="github_repo").'),
+    clone_url: z17.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
+    branch: z17.string().min(1).max(255).optional().describe("Branch to clone."),
+    databases: z17.array(z17.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
+    plan: z17.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB; a smaller plan is floored to "standard").'
     ),
-    agent_accounts: z14.array(
-      z14.object({
-        provider: z14.enum(["claude", "codex", "opencode"]),
-        account_id: z14.number().int().positive()
+    agent_accounts: z17.array(
+      z17.object({
+        provider: z17.enum(["claude", "codex", "opencode"]),
+        account_id: z17.number().int().positive()
       })
     ).max(3).optional().describe(
       "Bind saved agent logins by account id per provider. Omit to inherit the box owner's default logins automatically."
-    )
+    ),
+    machine: machineInput
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3179,9 +3998,11 @@ defineTool({
     } else {
       source = { kind: "blank" };
     }
+    const machineId = args2.machine !== void 0 ? await resolveMachineId(ctx, teamId, args2.machine) : void 0;
     const input = {
       ...args2.name ? { name: args2.name } : {},
       source,
+      ...machineId !== void 0 ? { machineId } : {},
       ...args2.databases ? { databases: args2.databases } : {},
       ...args2.plan ? { plan: args2.plan } : {},
       ...args2.agent_accounts && args2.agent_accounts.length > 0 ? {
@@ -3218,7 +4039,7 @@ defineTool({
     'Example: get_service({ service_id: "svc_abc" }) \u2192 { service: { type: "web", status: "running", \u2026 }, config: { healthCheckGracePeriodSec: 120, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z17.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3250,7 +4071,7 @@ defineTool({
     'Example: get_service_metrics({ service_id: "svc_abc" }) \u2192 { metrics: { cpu: 0.42, memory: 0.71, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId.")
+    service_id: z17.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3279,9 +4100,9 @@ defineTool({
     'Example: get_service_metrics_history({ service_id: "svc_abc", from: "-1h" }) \u2192 60-ish points for the last hour.'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId."),
-    from: z14.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
-    to: z14.string().optional().describe("ISO-8601 upper bound; defaults to now.")
+    service_id: z17.string().describe("Service publicId."),
+    from: z17.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
+    to: z17.string().optional().describe("ISO-8601 upper bound; defaults to now.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3325,8 +4146,8 @@ defineTool({
     'Example: update_service({ service_id: "svc_abc", name: "api-prod" }) \u2192 { service: { name: "api-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId."),
-    name: z14.string().min(1).max(60).describe("New service name (1\u201360 chars).")
+    service_id: z17.string().describe("Service publicId."),
+    name: z17.string().min(1).max(60).describe("New service name (1\u201360 chars).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3375,40 +4196,40 @@ defineTool({
     'Example: update_service_config({ service_id: "svc_abc", health_check_grace_period_sec: 180 }) \u2192 { config: { healthCheckGracePeriodSec: 180, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId."),
-    install_command: z14.string().nullable().optional().describe("Install shell command. Null clears."),
-    build_command: z14.string().nullable().optional().describe("Build shell command. Null clears."),
-    start_command: z14.string().nullable().optional().describe("Start shell command. Null clears."),
-    branch: z14.string().optional().describe("Git branch to track."),
-    root_directory: z14.string().optional().describe("Build context root."),
-    dockerfile_path: z14.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
-    auto_deploy: z14.boolean().optional().describe("Auto-deploy on push."),
-    health_check_path: z14.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
-    health_check_enabled: z14.boolean().optional().describe("Toggle health checking on/off."),
-    health_check_interval: z14.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
-    health_check_timeout: z14.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
-    health_check_grace_period_sec: z14.number().int().min(1).max(1800).optional().describe(
+    service_id: z17.string().describe("Service publicId."),
+    install_command: z17.string().nullable().optional().describe("Install shell command. Null clears."),
+    build_command: z17.string().nullable().optional().describe("Build shell command. Null clears."),
+    start_command: z17.string().nullable().optional().describe("Start shell command. Null clears."),
+    branch: z17.string().optional().describe("Git branch to track."),
+    root_directory: z17.string().optional().describe("Build context root."),
+    dockerfile_path: z17.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
+    auto_deploy: z17.boolean().optional().describe("Auto-deploy on push."),
+    health_check_path: z17.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
+    health_check_enabled: z17.boolean().optional().describe("Toggle health checking on/off."),
+    health_check_interval: z17.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
+    health_check_timeout: z17.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
+    health_check_grace_period_sec: z17.number().int().min(1).max(1800).optional().describe(
       "Startup grace period in seconds (1\u20131800). Raise this if the app needs more time to boot before health checks start counting failures."
     ),
-    memory_mb: z14.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
-    cpu_shares: z14.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
-    disk_size_gb: z14.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
-    port: z14.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
-    protocol: z14.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
-    restart_policy: z14.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
-    deploy_strategy: z14.enum(["rolling", "recreate"]).optional().describe(
+    memory_mb: z17.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
+    cpu_shares: z17.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
+    disk_size_gb: z17.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
+    port: z17.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
+    protocol: z17.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
+    restart_policy: z17.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
+    deploy_strategy: z17.enum(["rolling", "recreate"]).optional().describe(
       'How a deploy replaces the container. "rolling" (default) = start new, wait for healthy, switch traffic, stop old (zero downtime). "recreate" = stop old first, then start new (brief outage) \u2014 required for a container holding an exclusive lock on a mounted volume, which cannot deploy at all under rolling.'
     ),
-    pre_deploy_command: z14.string().optional().describe("Shell command run before the new release accepts traffic."),
-    instance_count: z14.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
-    min_instances: z14.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
-    max_instances: z14.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
-    scale_cpu_threshold: z14.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
-    scale_memory_threshold: z14.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
-    log_filter_rules: z14.array(
-      z14.object({
-        pattern: z14.string().min(1).max(200),
-        action: z14.enum(["drop", "downgrade"])
+    pre_deploy_command: z17.string().optional().describe("Shell command run before the new release accepts traffic."),
+    instance_count: z17.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
+    min_instances: z17.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
+    max_instances: z17.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
+    scale_cpu_threshold: z17.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
+    scale_memory_threshold: z17.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
+    log_filter_rules: z17.array(
+      z17.object({
+        pattern: z17.string().min(1).max(200),
+        action: z17.enum(["drop", "downgrade"])
       })
     ).max(50).optional().describe(
       "Runtime-log filter rules. Empty array [] clears all rules. Each pattern is case-insensitive substring match against the message."
@@ -3505,7 +4326,7 @@ defineTool({
     'Example: suspend_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId.")
+    service_id: z17.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3529,7 +4350,7 @@ defineTool({
     'Example: resume_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId.")
+    service_id: z17.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3555,7 +4376,7 @@ defineTool({
     'Example: delete_service({ service_id: "svc_abandoned" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId.")
+    service_id: z17.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3592,16 +4413,16 @@ defineTool({
     '  - Just count error lines without fetching them: get_service_logs({ service_id: "svc_abc", level: "error", since: "-5m", count_only: true }) \u2192 { count: 47 }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId."),
-    lines: z14.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
-    since: z14.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z14.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z14.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z14.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
+    service_id: z17.string().describe("Service publicId."),
+    lines: z17.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
+    since: z17.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z17.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z17.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z17.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
       "Filter by structured JSON log level (pino/bunyan/severity). Falls back to a stream-alias hint for plain-text logs (info/debug\u2192stdout, warn/error/fatal\u2192stderr)."
     ),
-    search: z14.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z14.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
+    search: z17.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z17.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3650,14 +4471,14 @@ defineTool({
     'Example: get_service_logs_bulk({ service_ids: ["svc_api", "svc_worker"], level: "error", since: "-15m", count_only: true }) \u2192 { results: { svc_api: { count: 0 }, svc_worker: { count: 12 } } }.'
   ].join("\n"),
   input: {
-    service_ids: z14.array(z14.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
-    lines_per_service: z14.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
-    since: z14.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z14.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z14.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z14.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
-    search: z14.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z14.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
+    service_ids: z17.array(z17.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
+    lines_per_service: z17.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
+    since: z17.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z17.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z17.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z17.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
+    search: z17.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z17.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3702,8 +4523,117 @@ defineTool({
   }
 });
 
+// src/tools/uptime.ts
+import { z as z18 } from "zod";
+var STATUS_MEANING = [
+  "Status vocabulary: `up` answering as expected \xB7 `down` failed the threshold and an alert is open \xB7 `unknown` not probed yet \xB7 `unresolvable` the service has no active domain to request \xB7 `paused` the service is not meant to be answering (suspended, mid-deploy, never deployed) OR it sleeps when idle and probing it would keep it awake."
+].join("\n");
+defineTool({
+  name: "get_uptime_check",
+  category: "uptime",
+  description: [
+    "Read a service's uptime check \u2014 HostStack requesting the service's public URL on a schedule and alerting when it stops answering.",
+    "",
+    'When to use: "is this service actually reachable", or before changing a check to see what it currently does. This is NOT the deploy-time health check: that one watches the container from inside the host and stops mattering once a deploy is live. This one runs from the control plane against the public URL, so it also catches DNS, TLS, edge and routing failures \u2014 and a service that accepts the connection and then answers nothing.',
+    "",
+    STATUS_MEANING,
+    "",
+    "Inputs: serviceId (required).",
+    "",
+    'Returns: { check } or { check: null } when none is configured. The check carries path, method, expectedStatus, intervalSeconds, failureThreshold, status, consecutiveFailures, lastCheckedAt, lastStatusCode, lastLatencyMs, lastError, lastChangedAt (the "down since" timestamp).',
+    "",
+    "Example: get_uptime_check({ serviceId: 48 }) \u2192 { check: { path: '/healthz', status: 'down', consecutiveFailures: 5, lastError: 'No response within 10000ms', lastChangedAt: '2026-08-21T04:12:00Z' } }."
+  ].join("\n"),
+  input: { serviceId: z18.number().int().positive() },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.get(
+      `/api/services/${teamId}/${args2.serviceId}/uptime-check`
+    );
+    if (response.check === null) {
+      return respond({
+        summary: "No uptime check on this service \u2014 nothing is watching its public URL.",
+        data: { check: null }
+      });
+    }
+    const check = shape(response.check);
+    return respond({
+      summary: `Uptime check is ${String(check["status"])}${check["lastError"] ? ` \u2014 ${String(check["lastError"])}` : ""}.`,
+      data: { check }
+    });
+  }
+});
+defineTool({
+  name: "set_uptime_check",
+  category: "uptime",
+  description: [
+    "Create or update a service's uptime check.",
+    "",
+    "When to use: turning monitoring on for a service that has just gone live, or adjusting a check that is too noisy (raise failureThreshold) or too slow to notice (lower intervalSeconds).",
+    "",
+    'Only service types with a public URL can be checked (web services and static sites). A worker, cron job or private service is refused with 400 \u2014 a check on one could only ever report "no domain to check", which reads as a broken feature rather than an inapplicable one.',
+    "",
+    "IMPORTANT: changing the shape of a check RESETS its accumulated state (status, consecutive failures, open alert). A check whose path or expected status just changed has not observed the new check failing, so carrying failures forward would alert about a condition that was never measured. Pass the full shape you want, not a partial edit of an unknown current state \u2014 read it with get_uptime_check first if that matters.",
+    "",
+    "`path` is a path, not a URL: the host comes from the service's primary domain at probe time, so moving the service to a new domain moves the check with it.",
+    "",
+    "Method is GET or HEAD only. A probe fires unattended every interval forever, so it has to be safe to repeat \u2014 a check that could POST would be a scheduled writer against the team's own API.",
+    "",
+    "Redirects are NOT followed: a 301 is an answer, and following one can walk the probe onto a marketing site and report a dead service as healthy. If a redirect is expected, set expectedStatus to it.",
+    "",
+    'Inputs (all optional except serviceId): enabled, path (default "/"), method (GET|HEAD), expectedStatus (default 200), timeoutMs (1000\u201360000, default 10000 \u2014 this is what catches a hung server), intervalSeconds (30\u20133600, default 60), failureThreshold (1\u201310, default 3 \u2014 one failed request is usually a restart, not an outage).',
+    "",
+    "Returns: { check } with the saved check.",
+    "",
+    "Example: set_uptime_check({ serviceId: 48, path: '/healthz', intervalSeconds: 60, failureThreshold: 3 }) \u2192 { check: { status: 'unknown', \u2026 } }."
+  ].join("\n"),
+  input: {
+    serviceId: z18.number().int().positive(),
+    enabled: z18.boolean().optional(),
+    path: z18.string().max(500).optional().describe('Must start with /. Default "/".'),
+    method: z18.enum(["GET", "HEAD"]).optional(),
+    expectedStatus: z18.number().int().min(100).max(599).optional(),
+    timeoutMs: z18.number().int().min(1e3).max(6e4).optional(),
+    intervalSeconds: z18.number().int().min(30).max(3600).optional(),
+    failureThreshold: z18.number().int().min(1).max(10).optional()
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const { serviceId, ...body } = args2;
+    const response = await ctx.api.put(
+      `/api/services/${teamId}/${serviceId}/uptime-check`,
+      body
+    );
+    return respond({
+      summary: `Uptime check saved. It will start reporting within a minute or two.`,
+      data: { check: shape(response.check) }
+    });
+  }
+});
+defineTool({
+  name: "delete_uptime_check",
+  category: "uptime",
+  description: [
+    'Stop checking a service. Any open "not answering" alert is left as it stands rather than being silently resolved \u2014 removing the monitor is not evidence the service came back.',
+    "",
+    "When to use: the service is being retired, or monitoring has moved somewhere else. To pause a check without losing its configuration, call set_uptime_check with enabled=false instead.",
+    "",
+    "Inputs: serviceId (required).",
+    "",
+    "Returns: { success: true }.",
+    "",
+    "Example: delete_uptime_check({ serviceId: 48 }) \u2192 { success: true }."
+  ].join("\n"),
+  input: { serviceId: z18.number().int().positive() },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    await ctx.api.delete(`/api/services/${teamId}/${args2.serviceId}/uptime-check`);
+    return respond({ summary: "Uptime check removed. Nothing is watching this service now." });
+  }
+});
+
 // src/tools/volumes.ts
-import { z as z15 } from "zod";
+import { z as z19 } from "zod";
 var MIN_VOLUME_SIZE_GB = 10;
 defineTool({
   name: "list_volumes",
@@ -3721,7 +4651,7 @@ defineTool({
     'Example: list_volumes({ service_id: "svc_abc" }) \u2192 { items: [{ name: "data", mountPath: "/var/data", sizeGb: 10, status: "active" }] }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z19.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3750,15 +4680,15 @@ defineTool({
     'Example: create_volume({ service_id: "svc_abc", name: "data", mount_path: "/var/data", size_gb: 10 }) \u2192 { volume: { name: "data", mountPath: "/var/data", sizeGb: 10, status: "pending" } }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    name: z15.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
-    mount_path: z15.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
+    service_id: z19.string().describe("Service publicId."),
+    name: z19.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
+    mount_path: z19.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
     // 10 GB is the real floor: the block-storage backend rejects anything
     // smaller. Advertising 1 GB here (and defaulting to it) meant taking the
     // defaults produced a volume that provisioned with `Hetzner API error:
     // 422` on the NEXT deploy, with nothing tying the failure back to the
     // size. Reject it at the call instead.
-    size_gb: z15.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
+    size_gb: z19.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
       `Disk size in GB (minimum ${MIN_VOLUME_SIZE_GB}, default ${MIN_VOLUME_SIZE_GB}, max 100 via MCP).`
     )
   },
@@ -3796,10 +4726,10 @@ defineTool({
     'Example: update_volume({ service_id: "svc_abc", volume_id: "vol_xyz", size_gb: 20 }) \u2192 { volume: { sizeGb: 20, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    volume_id: z15.string().describe("Volume publicId (e.g. vol_\u2026)."),
-    mount_path: z15.string().startsWith("/").max(500).optional().describe("New mount path."),
-    size_gb: z15.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`)
+    service_id: z19.string().describe("Service publicId."),
+    volume_id: z19.string().describe("Volume publicId (e.g. vol_\u2026)."),
+    mount_path: z19.string().startsWith("/").max(500).optional().describe("New mount path."),
+    size_gb: z19.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`)
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3837,8 +4767,8 @@ defineTool({
     'Example: delete_volume({ service_id: "svc_abc", volume_id: "vol_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    volume_id: z15.string().describe("Volume publicId.")
+    service_id: z19.string().describe("Service publicId."),
+    volume_id: z19.string().describe("Volume publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();