@hoststack.dev/mcp 0.17.0 → 0.19.0

package/dist/hoststack-mcp.js

@@ -8,7 +8,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { HostStack } from "@hoststack.dev/sdk";
 
 // src/version.ts
-var MCP_VERSION = true ? "0.17.0" : "0.0.0-dev";
+var MCP_VERSION = true ? "0.19.0" : "0.0.0-dev";
 var USER_AGENT = `hoststack-mcp/${MCP_VERSION}`;
 
 // src/api-client.ts
@@ -228,7 +228,7 @@ definePrompt({
     const text = `Goal: diagnose the most recent failed deploy on service ${service_id} and propose a fix.
 
 Plan (use these tools in order):
-1. \`list_deploys({ service_id: "${service_id}" })\` \u2014 pull recent deploys, newest first. Identify the most recent deploy with status \`failed\` (or \`cancelled\` if the user wants to investigate that too). Capture its publicId, branch, and commitSha.
+1. \`list_deploys({ service_id: "${service_id}" })\` \u2014 pull recent deploys, newest first. Identify the most recent deploy with status \`failed\` (or \`cancelled\` if the user wants to investigate that too). Capture its publicId, branch, and commitHash.
 2. \`get_deploy_logs({ service_id: "${service_id}", deploy_id: "<dpl_\u2026>" })\` \u2014 read the full build output. Scan for: stack traces, "ERROR" / "error:" lines, exit codes, missing env vars, OOM-killed signals, network failures pulling dependencies.
 3. \`get_service({ service_id: "${service_id}" })\` \u2014 confirm the service's runtime, plan, and whether autoDeploy is on. Plan tier matters because OOMs at small tiers point at \`maxMemoryMb\`.
 4. (Optional) \`list_env_vars({ service_id: "${service_id}" })\` \u2014 only if the build error mentions a missing variable. Don't fetch otherwise; values are masked anyway.
@@ -510,9 +510,9 @@ defineTool({
   name: "list_alerts",
   category: "alerts",
   description: [
-    "List recent alert-shaped events for the team: deploy failures, git auth losses, service health failures, auto-restarts, ACME cert failures, resource alerts (high CPU), database backup/restore failures, registrant verification lapses.",
+    "List recent alert-shaped events for the team: deploy failures, git auth losses, service health failures, uptime failures (a service stopped answering its public URL), new and regressed error issues (an exception the app reported), auto-restarts, ACME cert failures, resource alerts (high CPU), database backup/restore failures, registrant verification lapses.",
     "",
-    "When to use: triage 'what's currently broken or recently broke for this team'. Pairs with list_activity_log for the full audit feed; this tool is the alert-shaped subset.",
+    "When to use: triage 'what's currently broken or recently broke for this team'. Pairs with list_activity_log for the full audit feed; this tool is the alert-shaped subset. For an `error.issue_new` / `error.issue_regressed` entry, `list_error_issues` and `get_error_issue` carry the stack behind it.",
     "",
     'By default events are AGGREGATED by (action, resourceId) so flapping events collapse to one row with a fire count + first/last timestamps \u2014 e.g. "service.auto_restarted on service 31, 8 times in the last hour, last at 14:22". Pass aggregate=false to see every raw row.',
     "",
@@ -1146,7 +1146,7 @@ defineTool({
     "Inputs:",
     '  - service_id: publicId of the service (e.g. "svc_abc123"). Use list_services to find it.',
     "",
-    'Returns: { items: Deploy[] } \u2014 each deploy includes id, publicId, status (pending|building|deploying|live|failed|cancelled), commitSha, commitMessage, branch, triggeredBy, startedAt, finishedAt, imageBuildMs (docker build / image-pull only; null on skip-build redeploys \u2014 v89), containerBootMs (deploying \u2192 live wall-clock; null on builds that failed before container start \u2014 v89), buildDurationMs (legacy alias of imageBuildMs kept for back-compat), totalDurationMs (full deploy wall-clock = finishedAt \u2212 startedAt). Use imageBuildMs + containerBootMs together to tell "build is slow" apart from "boot is slow".',
+    'Returns: { items: Deploy[] } \u2014 each deploy includes id, publicId, status (pending|building|deploying|live|failed|cancelled), commitHash (the resolved commit SHA; the key is OMITTED entirely when the deploy recorded none, so a missing key means "no commit", not "wrong key"), commitMessage, branch, triggeredBy, startedAt, finishedAt, imageBuildMs (docker build / image-pull only; null on skip-build redeploys \u2014 v89), containerBootMs (deploying \u2192 live wall-clock; null on builds that failed before container start \u2014 v89), buildDurationMs (legacy alias of imageBuildMs kept for back-compat), totalDurationMs (full deploy wall-clock = finishedAt \u2212 startedAt). Use imageBuildMs + containerBootMs together to tell "build is slow" apart from "boot is slow".',
     "",
     'Example: list_deploys({ service_id: "svc_abc" }) \u2192 { items: [{ publicId: "dpl_\u2026", status: "live", commitMessage: "Fix login", \u2026 }, \u2026] }'
   ].join("\n"),
@@ -1173,7 +1173,7 @@ defineTool({
     "  - service_id: publicId of the service.",
     '  - deploy_id: publicId of the deploy (e.g. "dpl_\u2026").',
     "",
-    "Returns: { deploy: Deploy } \u2014 full deploy record (status, commitSha, commitMessage, branch, imageBuildMs + containerBootMs (v89 split timings; legacy buildDurationMs preserved as alias), totalDurationMs, finishedAt, etc).",
+    "Returns: { deploy: Deploy } \u2014 full deploy record (status, commitHash (omitted when the deploy recorded no commit), commitMessage, branch, imageBuildMs + containerBootMs (v89 split timings; legacy buildDurationMs preserved as alias), totalDurationMs, finishedAt, etc).",
     "",
     'Example: get_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { deploy: { status: "live", \u2026 } }'
   ].join("\n"),
@@ -1393,7 +1393,7 @@ var DNS_RECORD_TYPES = [
 async function resolveZonePublicId(hoststack, teamId, input) {
   if (input.zone_id) {
     const { zones: zones2 } = await hoststack.dns.listZones(teamId);
-    const match = zones2.find((z17) => z17.publicId === input.zone_id);
+    const match = zones2.find((z22) => z22.publicId === input.zone_id);
     if (!match) {
       throw new Error(`Zone ${input.zone_id} not found on this team.`);
     }
@@ -1407,7 +1407,7 @@ async function resolveZonePublicId(hoststack, teamId, input) {
   const labels = fqdn.split(".");
   for (let i = 0; i < labels.length - 1; i++) {
     const candidate = labels.slice(i).join(".");
-    const match = zones.find((z17) => z17.domainName.toLowerCase() === candidate);
+    const match = zones.find((z22) => z22.domainName.toLowerCase() === candidate);
     if (match && match.status !== "deleting") {
       return { publicId: match.publicId, domainName: match.domainName };
     }
@@ -1868,6 +1868,7 @@ defineTool({
     "  - value: new value (will be encrypted at rest if is_secret=true).",
     "  - is_secret (optional): true marks the value as secret (masked on read). On create, defaults to true for safety. On update, omitting it leaves the existing flag untouched \u2014 pass it explicitly only when you want to change classification.",
     '  - target (optional): where the var is injected \u2014 "build", "runtime", or "both". On create, defaults to "both". On update, omitting it leaves the existing target untouched.',
+    '    IMPORTANT for build-time values (a frontend VITE_*/NEXT_PUBLIC_*, anything a bundler inlines): "both" and "build" reach the build, but a SECRET var never does on "both" \u2014 build args are baked into image history. Since is_secret defaults to TRUE here, set is_secret:false for a public build-time value or it will silently be missing from the built artifact. Use "build" to force a secret into the build anyway.',
     "",
     'Returns: { envVar: EnvVar, action: "created" | "updated" }.',
     "",
@@ -1878,7 +1879,9 @@ defineTool({
     key: z10.string().min(1).max(128).describe("Env-var key."),
     value: z10.string().describe("New value."),
     is_secret: z10.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true."),
-    target: z10.enum(["build", "runtime", "both"]).optional().describe("Injection target: build, runtime, or both. Default both.")
+    target: z10.enum(["build", "runtime", "both"]).optional().describe(
+      'Injection target: build, runtime, or both. Default both. A secret var on "both" is runtime-only (build args land in image history) \u2014 pass is_secret:false for a public build-time value, or use "build" to force it.'
+    )
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1961,6 +1964,7 @@ defineTool({
     "Inputs:",
     "  - service_id: publicId of the service.",
     '  - env_vars: array of { key, value, is_secret?, target? }. is_secret defaults to FALSE per row (a row is stored in the clear unless you set is_secret:true); target defaults to "both". Note this differs from set_env_var, which defaults a newly-created var to secret.',
+    '    A var reaches the image BUILD when target is "build", or when target is "both" and is_secret is false. A secret on "both" is runtime-only, because build args are visible in image history.',
     "",
     "Returns: { ok: true }. Re-list with list_env_vars to confirm the new state.",
     "",
@@ -2150,6 +2154,531 @@ defineTool({
   }
 });
 
+// src/tools/analytics.ts
+import { z as z12 } from "zod";
+async function resolveSiteIds(domains, teamId, api) {
+  if (!domains || domains.length === 0) return void 0;
+  const { sites } = await api.get(`/api/analytics/${teamId}/sites`);
+  const ids = [];
+  const missing = [];
+  for (const domain of domains) {
+    const needle = domain.toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+    const match = sites.find((s) => s.domain === needle);
+    if (match) ids.push(match.id);
+    else missing.push(domain);
+  }
+  if (missing.length > 0) {
+    throw new Error(
+      `Not tracking ${missing.join(", ")}. Known sites: ${sites.map((s) => s.domain).join(", ") || "none yet"}.`
+    );
+  }
+  return ids.join(",");
+}
+defineTool({
+  name: "list_analytics_sites",
+  category: "analytics",
+  description: [
+    "List the websites this team tracks \u2014 domains, their site keys, retention, and which service (if any) serves each one.",
+    "",
+    "When to use: before any other analytics call, to learn which domains exist; or to fetch the script tag a site needs.",
+    "",
+    "The site key is PUBLIC by design \u2014 it ships in a `data-site-key` attribute that anyone can view-source, like a Sentry DSN. It is write-only and scoped to one site. Do not treat it as a secret, and do not confuse it with the team API key.",
+    "",
+    "Returns: { sites: Array }. Each site has id, publicId, name, domain, ingestKey, allowedOrigins, serviceId, serviceName, retentionDays, droppedCount (events refused by the hourly quota and therefore MISSING from every count for that site), and keyGraceEndsAt when a rotation is still in its grace window.",
+    "",
+    'Each site also carries lastEventAt (null means NOTHING has ever reached ingest for that key) plus lastRefusalReason and refusedRecently, a 7-day tally by reason. An empty chart with lastEventAt set is a site with no traffic; an empty chart with lastEventAt null is a broken setup. Do not report "no visitors" without checking which one you are looking at \u2014 call check_analytics_site for the diagnosis.',
+    "",
+    "Example: list_analytics_sites({}) \u2192 { sites: [{ id: 3, domain: 'micci.dk', ingestKey: 'site_\u2026', retentionDays: 30, serviceName: 'micci-web' }] }."
+  ].join("\n"),
+  input: {},
+  handler: async (_args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.get(`/api/analytics/${teamId}/sites`);
+    const items = Array.isArray(response.sites) ? response.sites.map(shape) : [];
+    const summary = items.length === 0 ? "No analytics sites yet. Create one with create_analytics_site." : `Tracking ${items.length} site${items.length === 1 ? "" : "s"}.`;
+    return respond({ summary, data: { sites: items } });
+  }
+});
+defineTool({
+  name: "check_analytics_site",
+  category: "analytics",
+  description: [
+    "Why a site is reporting nothing \u2014 the diagnosis, without having to generate traffic and guess.",
+    "",
+    "When to use: any time a chart is empty, a site was just set up, a key was rotated, or someone asks whether the snippet is installed correctly. Call this BEFORE telling anyone their traffic dropped.",
+    "",
+    "The ingest endpoint answers HTTP 204 to a real site key and to a typo alike \u2014 deliberately, so it cannot be used to enumerate keys \u2014 which means five completely different situations produce the same empty chart: a stale or mistyped key in the deployed snippet, an origin the site does not allow, a blown hourly quota, events blocked in the browser before they leave (CORS, ad blocker, CSP), and simply no visitors yet. This tool tells them apart.",
+    "",
+    "Returns: health ('receiving' | 'quiet' | 'refusing' | 'never'), a headline and detail sentence, lastEventAt, lastRefusalAt/Reason/Origin, refusedRecently (a 7-day tally by reason), the site key the snippet must carry, allowed origins, and quota usage this hour.",
+    "",
+    "health='never' means nothing has EVER reached ingest for this key, so the request is not leaving the browser \u2014 check the snippet is in the deployed HTML and tell the user to add `data-debug` to the script tag, which makes the tracker log its resolved endpoint and every accepted 204 to the console.",
+    "",
+    "Example: check_analytics_site({ domain: 'example.com' }) \u2192 { health: 'refusing', headline: 'Reaching us, and being refused.', detail: 'Something on example.com posted 214 event(s) with a site key we do not recognise\u2026', lastEventAt: null, refusedRecently: { unknown_key: 214, bad_origin: 0, bot: 3, over_quota: 0 } }."
+  ].join("\n"),
+  input: {
+    domain: z12.string().max(253).describe("Bare hostname of a site this team tracks.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const siteIds = await resolveSiteIds([args2.domain], teamId, ctx.api);
+    const status = await ctx.api.get(
+      `/api/analytics/${teamId}/sites/${siteIds}/status`
+    );
+    return respond({ summary: `${args2.domain}: ${status.headline}`, data: shape(status) });
+  }
+});
+defineTool({
+  name: "get_analytics_summary",
+  category: "analytics",
+  description: [
+    "One row per site: visitors, pageviews, bounce rate, average visit and live visitors, each with the previous period to compare against.",
+    "",
+    'When to use: "how are my sites doing", a weekly check, or spotting which of several domains moved. This is the cross-site view; use get_analytics_overview for the breakdowns behind one of them.',
+    "",
+    "READ THE VISITOR NUMBER CAREFULLY. Inside a site's raw-event window (35 days by default, so 24h through 30d are raw) `visitors` is a true distinct count over the range. Beyond it the answer comes from a daily rollup and `visitors` is each day's uniques ADDED TOGETHER \u2014 someone who visits daily counts once per day. `visitorsAreSummedDailies` says which you got; quote it when reporting a 90d or 12mo number.",
+    "",
+    "Visitors are never summed ACROSS sites. The same person on two domains is two session ids, and reconciling them would require the cross-domain identity a cookieless tracker exists not to build. Add pageviews if you need a total; do not add visitors.",
+    "",
+    "Inputs: range (24h|7d|30d|90d|12mo, default 7d), domains (optional list; omit for every site).",
+    "",
+    "Returns: the range asked for, and one row per site \u2014 domain, `current` and `previous` blocks of visitors / pageviews / bounceRate / avgVisitSeconds, the live visitor count, and `visitorsAreSummedDailies`, which says whether that visitor number is a distinct count or a sum of daily uniques. Quote that flag with any 90d or 12mo figure.",
+    "",
+    "Example: get_analytics_summary({ range: '30d' }) \u2192 { range: '30d', sites: [{ domain: 'hoststack.dev', current: { visitors: 4210, pageviews: 11890, bounceRate: 47.2 }, previous: {\u2026}, live: 3, visitorsAreSummedDailies: false }] }."
+  ].join("\n"),
+  input: {
+    range: z12.enum(["24h", "7d", "30d", "90d", "12mo"]).optional().describe("Default 7d."),
+    domains: z12.array(z12.string().max(253)).max(50).optional().describe("Bare hostnames. Omit for every site this team tracks.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const siteIds = await resolveSiteIds(args2.domains, teamId, ctx.api);
+    const response = await ctx.api.get(`/api/analytics/${teamId}/summary`, {
+      range: args2.range ?? "7d",
+      ...siteIds ? { siteIds } : {}
+    });
+    const sites = Array.isArray(response.sites) ? response.sites : [];
+    const summed = sites.some((s) => s.visitorsAreSummedDailies);
+    const summary = sites.length === 0 ? "No sites to report on." : `${sites.length} site${sites.length === 1 ? "" : "s"} over ${response.range}.${summed ? " Visitor counts are daily uniques summed, not distinct over the range \u2014 this range is past the raw-event window." : ""}`;
+    return respond({ summary, data: { range: response.range, sites: sites.map(shape) } });
+  }
+});
+defineTool({
+  name: "get_analytics_overview",
+  category: "analytics",
+  description: [
+    "The full breakdown for one site (or several): timeseries, top paths, referrers, custom events, browsers, operating systems, languages, screen sizes, campaigns, devices and countries.",
+    "",
+    "When to use: after get_analytics_summary has told you WHICH site moved, and you need to see what drove it \u2014 a referrer that appeared, a campaign that landed, a path that spiked.",
+    "",
+    "Two things change past the raw-event window (35 days by default, so 24h through 30d are raw): `visitors` becomes daily uniques summed rather than a distinct count (`visitorsAreSummedDailies`), and FILTERS ARE IGNORED because the rollup stores per-day aggregates with no events left to filter (`filtersSupported: false`). Check both fields before drawing a conclusion; do not silently present a filtered request that was not filtered.",
+    "",
+    "Inputs: range (24h|7d|30d|90d|12mo, default 7d), domains (optional list; omit for every site), filters (optional map \u2014 country, browser, os, device, language, path, referrer, utmSource, utmMedium, utmCampaign, utmTerm, utmContent).",
+    "",
+    "Returns: `source` ('raw' | 'rollup') and `filtersSupported`, which together say how much of the request was actually honoured; a `summary` block of current-vs-previous totals; a timeseries; and the breakdowns \u2014 topPaths, topReferrers, topEvents, browsers, operatingSystems, languages, screenSizes, campaigns, devices and countries. Read `source` and `filtersSupported` before quoting any of it.",
+    "",
+    "Example: get_analytics_overview({ domains: ['hoststack.dev'], range: '7d', filters: { country: 'DK' } }) \u2192 { source: 'raw', filtersSupported: true, summary: { current: { visitors: 310, \u2026 } }, topPaths: [{ path: '/pricing', pageviews: 214 }], topReferrers: [{ referrer: 'Direct', visits: 190 }], \u2026 }."
+  ].join("\n"),
+  input: {
+    range: z12.enum(["24h", "7d", "30d", "90d", "12mo"]).optional().describe("Default 7d."),
+    domains: z12.array(z12.string().max(253)).max(50).optional().describe("Bare hostnames. Omit for every site this team tracks."),
+    filters: z12.record(z12.string(), z12.string().max(200)).optional().describe("Dimension filters. Ignored for ranges past the raw-event window.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const siteIds = await resolveSiteIds(args2.domains, teamId, ctx.api);
+    const response = await ctx.api.get(`/api/analytics/${teamId}/overview`, {
+      range: args2.range ?? "7d",
+      ...siteIds ? { siteIds } : {},
+      ...args2.filters ?? {}
+    });
+    const { current } = response.summary;
+    const caveats = [];
+    if (response.visitorsAreSummedDailies) {
+      caveats.push(
+        "visitors are daily uniques summed (this range is past the raw-event window)"
+      );
+    }
+    if (args2.filters && Object.keys(args2.filters).length > 0 && !response.filtersSupported) {
+      caveats.push(
+        "the filters you passed were NOT applied \u2014 they only work on shorter ranges"
+      );
+    }
+    const summary = `${current.pageviews.toLocaleString()} pageviews from ${current.visitors.toLocaleString()} visitors over ${response.range}${caveats.length > 0 ? `. Note: ${caveats.join("; ")}.` : "."}`;
+    return respond({ summary, data: response });
+  }
+});
+defineTool({
+  name: "create_analytics_site",
+  category: "analytics",
+  description: [
+    "Start tracking a domain, and return the script tag to paste into its <head>.",
+    "",
+    "When to use: the user wants analytics for a site that is not in list_analytics_sites yet. Works for any domain, whether or not it is hosted on HostStack.",
+    "",
+    "If the domain is already attached to a service on this team, the new site links itself to that service and appears on its Analytics tab. Nothing is counted until the snippet is actually on the page \u2014 creating the site alone produces an empty dashboard, which is expected, not a fault.",
+    "",
+    'Inputs: domain (required, bare hostname \u2014 "example.com", not a URL), name (optional display name, defaults to the domain).',
+    "",
+    "Returns: the created site (id, domain, name, ingestKey, retentionDays) and the ready-made `snippet` to paste into the page \u2014 the key is in that snippet, so hand it over rather than describing it.",
+    "",
+    `Example: create_analytics_site({ domain: 'micci.dk' }) \u2192 { site: { id: 3, domain: 'micci.dk', ingestKey: 'site_\u2026' }, snippet: '<script defer src="https://hoststack.dev/t.js" data-site-key="site_\u2026"></script>' }.`
+  ].join("\n"),
+  input: {
+    domain: z12.string().min(1).max(253).describe("Bare hostname, e.g. example.com"),
+    name: z12.string().min(1).max(100).optional().describe("Display name. Defaults to the domain.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const site = await ctx.api.post(`/api/analytics/${teamId}/sites`, {
+      domain: args2.domain,
+      ...args2.name ? { name: args2.name } : {}
+    });
+    const snippet = `<script defer src="https://hoststack.dev/t.js" data-site-key="${site.ingestKey}"></script>`;
+    return respond({
+      summary: `Now tracking ${site.domain}. Paste the snippet into its <head> \u2014 nothing is counted until you do.`,
+      data: { site: shape(site), snippet }
+    });
+  }
+});
+defineTool({
+  name: "verify_site_domain",
+  category: "analytics",
+  description: [
+    "Prove the team owns a site's domain, by publishing a TXT record.",
+    "",
+    "When to use: before turning on an uptime check for a site that HostStack does not host. Analytics itself needs no proof \u2014 the ingest key only labels events the site posts about itself \u2014 so do NOT send a user through this just to get a dashboard. It exists for the capabilities where the PLATFORM acts on the hostname.",
+    "",
+    "Call it once with no `check` to get the record to publish, then again with check=true once the record is live. The token is stable across calls, so it is safe to re-read the instructions while the user is mid-paste.",
+    "",
+    "A site whose domain is already verified on a service in this team is proven ALREADY and does not need this \u2014 `list_analytics_sites` reports that as domainProven. This is for the site with no service behind it, which can never have such a link.",
+    "",
+    `The record is read from the domain's own authoritative nameservers rather than through a cache, so "I just added it" works immediately instead of being masked by a negative-cache TTL.`,
+    "",
+    'Inputs: siteId (required), check (optional, default false \u2014 true means "look at DNS now and tell me the verdict").',
+    "",
+    "Returns: the record to publish plus `verified`. A `verified: false` is a successful check with a negative answer, not an error \u2014 most often the record simply has not propagated yet.",
+    "",
+    "Example: verify_site_domain({ siteId: 3 }) \u2192 { recordName: '_hoststack-verify.poststack.dev', recordType: 'TXT', recordValue: 'hoststack-verify=9f3c\u2026', verified: false }."
+  ].join("\n"),
+  input: {
+    siteId: z12.number().int().positive(),
+    check: z12.boolean().optional().describe(
+      "True to read DNS now and return the verdict. False just returns the record."
+    )
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const instructions = await ctx.api.get(`/api/analytics/${teamId}/sites/${args2.siteId}/verification`);
+    if (!args2.check) {
+      return respond({
+        summary: instructions.verified ? "Already verified." : `Publish a ${instructions.recordType} record at ${instructions.recordName} with the value shown, then call again with check=true.`,
+        data: shape(instructions)
+      });
+    }
+    const verdict = await ctx.api.post(
+      `/api/analytics/${teamId}/sites/${args2.siteId}/verify`,
+      {}
+    );
+    return respond({
+      summary: verdict.verified ? "Verified. This site can now be given an uptime check." : `Not verified yet \u2014 ${verdict.detail ?? "the record was not found"}.`,
+      data: { record: shape(instructions), result: shape(verdict) }
+    });
+  }
+});
+defineTool({
+  name: "set_site_uptime_check",
+  category: "analytics",
+  description: [
+    "Watch a site HostStack does not host \u2014 request its URL on a schedule and alert when it stops answering.",
+    "",
+    "When to use: the user has a site running somewhere else (their own box, another provider) and wants to know when it goes down. This is the one observability capability an off-platform site cannot provide for itself: analytics is a script tag and error reporting is an HTTP POST, but an outside-in probe has to come from outside.",
+    "",
+    "For a site that IS a HostStack service, use set_uptime_check with its serviceId instead \u2014 that one follows the service if its domain changes.",
+    "",
+    "REQUIRES a proven domain. Call verify_site_domain first if `domainProven` is false; an unverified target is refused with 400. This is not paperwork: an uptime check makes the control plane fetch the hostname every interval, forever, from our IP, so it must be a name the team has shown it owns.",
+    "",
+    "Always https, and the host is the site's domain \u2014 `path` is a path, not a URL. Redirects are NOT followed: a 301 is an answer, and following one can walk the probe onto a parked page and report a dead site as healthy. Set expectedStatus to the redirect if one is expected.",
+    "",
+    'Inputs (all optional except siteId): enabled, path (default "/"), method (GET|HEAD), expectedStatus (default 200), timeoutMs (1000\u201360000, default 10000 \u2014 this is what catches a hung server), intervalSeconds (30\u20133600, default 60), failureThreshold (1\u201310, default 3).',
+    "",
+    "Returns: the stored check \u2014 enabled, the resolved target URL, method, expectedStatus, timeoutMs, intervalSeconds, failureThreshold \u2014 plus its live state: status ('up' | 'down' | 'unknown'), lastCheckedAt, lastStatusCode and consecutiveFailures. A freshly created check is 'unknown' until the first probe runs.",
+    "",
+    "Example: set_site_uptime_check({ siteId: 3, path: '/health', intervalSeconds: 60 }) \u2192 { check: { status: 'unknown', \u2026 } }."
+  ].join("\n"),
+  input: {
+    siteId: z12.number().int().positive(),
+    enabled: z12.boolean().optional(),
+    path: z12.string().max(500).optional().describe('Must start with /. Default "/".'),
+    method: z12.enum(["GET", "HEAD"]).optional(),
+    expectedStatus: z12.number().int().min(100).max(599).optional(),
+    timeoutMs: z12.number().int().min(1e3).max(6e4).optional(),
+    intervalSeconds: z12.number().int().min(30).max(3600).optional(),
+    failureThreshold: z12.number().int().min(1).max(10).optional()
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const { siteId, ...body } = args2;
+    const response = await ctx.api.put(
+      `/api/analytics/${teamId}/sites/${siteId}/uptime-check`,
+      body
+    );
+    return respond({
+      summary: "Uptime check saved. It will start reporting within a minute or two.",
+      data: { check: shape(response.check) }
+    });
+  }
+});
+
+// src/tools/errors.ts
+import { z as z13 } from "zod";
+defineTool({
+  name: "list_error_issues",
+  category: "errors",
+  description: [
+    "List error issues for the team \u2014 exceptions the team's own applications reported, grouped by cause rather than listed one per event.",
+    "",
+    'When to use: "what is throwing in production", triaging after a deploy, or finding the bug behind a user report. Pairs with list_alerts (which tells you an alert fired) and get_service_logs (which shows the raw output around it).',
+    "",
+    'Grouping: an issue is one distinct problem. Its fingerprint is the exception class, the message with variable parts removed (so "user 41 not found" and "user 9002 not found" are ONE issue), and the topmost stack frame in the team\'s own code \u2014 not the framework\'s. `culprit` is that frame, and it is the line to open first.',
+    "",
+    "Counts are exact; occurrence samples are not. `occurrenceCount` is the true number of times it happened. A bounded number of full occurrences is retained per issue (see get_error_issue), and `droppedCount` is how many were counted but not stored because the service exceeded its hourly ingest quota.",
+    "",
+    'Defaults to status=unresolved, because the list exists to answer "what is broken". Pass status=resolved or status=ignored for the others.',
+    "",
+    "Inputs (all optional): serviceId, status (unresolved|resolved|ignored), q (substring match on title/culprit), limit (default 50, max 200), offset, sort (last_seen|first_seen|count).",
+    "",
+    'Returns: { issues: Array, total: number }. Each issue has id, publicId, serviceId, serviceName, type, title, culprit, level, status, occurrenceCount, droppedCount, affectedUsers (capped at 500 \u2014 500 means "500 or more"), firstSeenAt, lastSeenAt, firstSeenRelease, lastSeenRelease, environment, sourceTaskPublicId (a dev-box task already open for it).',
+    "",
+    "Example: list_error_issues({ serviceId: 48, sort: 'count' }) \u2192 { issues: [{ id: 12, type: 'TypeError', title: 'TypeError: cart.total is not a function', culprit: 'src/checkout.ts:12 in checkout', occurrenceCount: 4187, affectedUsers: 96, lastSeenRelease: 'a91f3c2', \u2026 }], total: 3 }."
+  ].join("\n"),
+  input: {
+    serviceId: z13.number().int().positive().optional().describe("Only issues for this service."),
+    status: z13.enum(["unresolved", "resolved", "ignored"]).optional().describe("Default unresolved."),
+    q: z13.string().max(200).optional().describe("Substring match on title or culprit."),
+    limit: z13.number().int().positive().max(200).optional().describe("Default 50, cap 200."),
+    offset: z13.number().int().min(0).optional(),
+    sort: z13.enum(["last_seen", "first_seen", "count"]).optional().describe("Default last_seen.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const params = {};
+    for (const key of ["serviceId", "status", "q", "limit", "offset", "sort"]) {
+      const value = args2[key];
+      if (value !== void 0) params[key] = String(value);
+    }
+    const response = await ctx.api.get(`/api/errors/${teamId}/issues`, params);
+    const items = Array.isArray(response.issues) ? response.issues.map(shape) : [];
+    const summary = items.length === 0 ? `No ${args2.status ?? "unresolved"} error issues${args2.serviceId ? " for that service" : ""}.` : `Returned ${items.length} of ${response.total} ${args2.status ?? "unresolved"} issue${response.total === 1 ? "" : "s"}.`;
+    return respond({ summary, data: { issues: items, total: response.total } });
+  }
+});
+defineTool({
+  name: "get_error_issue",
+  category: "errors",
+  description: [
+    "Fetch one error issue plus its most recent stored occurrences \u2014 the stack traces, request context and releases behind the aggregate.",
+    "",
+    "When to use: after list_error_issues has told you WHICH problem to look at, and you need the actual stack to reason about the cause.",
+    "",
+    "Occurrences are SAMPLES, not the full history: a bounded number is kept per issue while the count stays exact, and they age out after 30 days while the issue itself remains. An issue whose samples have expired returns an empty occurrences array \u2014 that is normal, not an error.",
+    "",
+    "Each occurrence has stack (raw, as the runtime printed it), context (tenant-supplied JSON, with sensitive keys already redacted), requestId, release, environment and createdAt.",
+    "",
+    "Inputs: issueId (required), occurrences (how many samples, default 5, max 50).",
+    "",
+    "Returns: { issue: {...}, occurrences: Array }.",
+    "",
+    "Example: get_error_issue({ issueId: 12 }) \u2192 { issue: { title: 'TypeError: cart.total is not a function', occurrenceCount: 4187, \u2026 }, occurrences: [{ stack: '    at checkout (/app/src/checkout.ts:12:9)\u2026', requestId: 'req_9f3c', release: 'a91f3c2', createdAt: '\u2026' }] }."
+  ].join("\n"),
+  input: {
+    issueId: z13.number().int().positive().describe("Numeric issue id from list_error_issues."),
+    occurrences: z13.number().int().positive().max(50).optional().describe("How many samples to include. Default 5.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const [issueRes, occRes] = await Promise.all([
+      ctx.api.get(`/api/errors/${teamId}/issues/${args2.issueId}`),
+      ctx.api.get(
+        `/api/errors/${teamId}/issues/${args2.issueId}/occurrences`,
+        { limit: String(args2.occurrences ?? 5) }
+      )
+    ]);
+    const occurrences = Array.isArray(occRes.occurrences) ? occRes.occurrences.map(shape) : [];
+    const issue = shape(issueRes.issue);
+    return respond({
+      summary: `${String(issue["title"] ?? "Issue")} \u2014 ${String(issue["occurrenceCount"] ?? 0)} occurrence(s), ${occurrences.length} sample(s) available.`,
+      data: { issue, occurrences }
+    });
+  }
+});
+defineTool({
+  name: "update_error_issue",
+  category: "errors",
+  description: [
+    "Resolve, ignore or reopen an error issue.",
+    "",
+    "When to use: after fixing a bug (resolve, so a recurrence is reported as a regression), or to silence noise you have decided to live with (ignore).",
+    "",
+    "`resolved` records the release it was resolved in. If the issue occurs again afterwards it reopens itself and fires an `error.issue_regressed` alert \u2014 which is the point of resolving rather than ignoring, and the reason not to resolve something you have not actually fixed.",
+    "",
+    "`ignored` keeps counting occurrences and stops telling anyone. An ignored issue never reopens itself, so this is the right choice for noise you have decided to live with, and the wrong choice for something you intend to fix.",
+    "",
+    "`unresolved` reopens it.",
+    "",
+    "Inputs: issueId (required), status (required).",
+    "",
+    "Returns: { issue: {...} } with the updated row.",
+    "",
+    "Example: update_error_issue({ issueId: 12, status: 'resolved' }) \u2192 { issue: { status: 'resolved', resolvedInRelease: 'a91f3c2', \u2026 } }."
+  ].join("\n"),
+  input: {
+    issueId: z13.number().int().positive(),
+    status: z13.enum(["unresolved", "resolved", "ignored"])
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.patch(
+      `/api/errors/${teamId}/issues/${args2.issueId}`,
+      { status: args2.status }
+    );
+    return respond({
+      summary: `Issue ${args2.issueId} is now ${args2.status}.`,
+      data: { issue: shape(response.issue) }
+    });
+  }
+});
+defineTool({
+  name: "fix_error_in_dev_box",
+  category: "errors",
+  description: [
+    "Turn an error issue into a coding-agent task in the project's dev box, with the repository already checked out.",
+    "",
+    "When to use: the issue is real, it is in the team's own code, and somebody is going to have to open the repository anyway. This writes the whole briefing so nobody has to reconstruct it from the dashboard.",
+    "",
+    "This is the thing a third-party error tracker structurally cannot do. The task carries the exception, the stack with the team's OWN frames marked (`>>`), the release it happened on, how often and to how many users, and a real request context \u2014 plus hard boundaries: work on a branch, do not deploy, do not delete tests, and stop and say so if the cause turns out not to be in this repository.",
+    "",
+    "It CREATES the task; it does not start the agent. Running spends the team's own agent tokens and is a separate decision made in the dev box UI.",
+    "",
+    "Refused with 422 when the cause cannot be attributed to the repository \u2014 every stack frame inside a dependency, no usable stack at all, a browser extension, or a connection failure with no in-app frame. That gate is deliberate: an agent told to fix something it cannot reach does not refuse, it produces a confident and useless diff.",
+    "",
+    "Pressing this twice for one issue returns the existing task (alreadyExisted=true) rather than queueing a duplicate run.",
+    "",
+    "Inputs: issueId (required), serviceId (optional \u2014 pin to a specific dev box; omitted, the project's box is used).",
+    "",
+    "Returns: { task, alreadyExisted, box: { serviceId, name, asleep }, automodeEnabled }.",
+    "",
+    "Example: fix_error_in_dev_box({ issueId: 12 }) \u2192 { task: { title: 'Fix error: TypeError in src/checkout.ts:12' }, alreadyExisted: false, box: { name: 'shop-dev', asleep: true }, automodeEnabled: false }."
+  ].join("\n"),
+  input: {
+    issueId: z13.number().int().positive(),
+    serviceId: z13.number().int().positive().optional().describe("Dev box to pin the task to. Omitted, the project's box is used.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const body = { issueId: args2.issueId };
+    if (args2.serviceId !== void 0) body["serviceId"] = args2.serviceId;
+    const response = await ctx.api.post(
+      `/api/dev-env-tasks/${teamId}/from-issue`,
+      body
+    );
+    const verb = response.alreadyExisted ? "Already queued" : "Queued";
+    const note = response.box.asleep ? " That box is asleep \u2014 resume it before running the task." : "";
+    return respond({
+      summary: `${verb} in dev box "${response.box.name}": ${response.task.title ?? "task"}.${note}`,
+      data: shape(response)
+    });
+  }
+});
+defineTool({
+  name: "list_ingest_keys",
+  category: "errors",
+  description: [
+    "List a service's error-ingest keys. Only prefixes and last-used timestamps \u2014 the key itself is stored as a hash and is never readable again.",
+    "",
+    "When to use: checking whether a service is wired up for error reporting at all, or whether an old key is still in use before revoking it (`lastUsedAt` is stamped lazily, at most once a minute).",
+    "",
+    "Inputs: serviceId (required).",
+    "",
+    "Returns: { keys: Array } with id, publicId, name, prefix, lastUsedAt, createdAt.",
+    "",
+    "Example: list_ingest_keys({ serviceId: 48 }) \u2192 { keys: [{ id: 3, name: 'default', prefix: 'ing_9f3c1ab2', lastUsedAt: '2026-08-21T09:14:00Z' }] }."
+  ].join("\n"),
+  input: { serviceId: z13.number().int().positive() },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.get(
+      `/api/services/${teamId}/${args2.serviceId}/ingest-keys`
+    );
+    const keys = Array.isArray(response.keys) ? response.keys.map(shape) : [];
+    return respond({
+      summary: keys.length === 0 ? "No ingest keys on this service \u2014 it cannot report errors yet." : `${keys.length} ingest key${keys.length === 1 ? "" : "s"} on this service.`,
+      data: { keys }
+    });
+  }
+});
+defineTool({
+  name: "create_ingest_key",
+  category: "errors",
+  description: [
+    "Mint a write-only error-ingest key for a service, so its application can report exceptions.",
+    "",
+    "When to use: setting a service up for error tracking for the first time, or rotating a key that has leaked or is being retired.",
+    "",
+    "The response is the ONLY place the plaintext key ever exists \u2014 it is stored as a SHA-256 hash and cannot be shown again. Put it wherever the application reads it from (an env var, usually) before discarding the response.",
+    "",
+    "The key is deliberately low-privilege: it can create error events for this ONE service and can do nothing else \u2014 it cannot read the issues it created, list services, or touch anything on the team. That is why shipping it inside the application, including a browser bundle where it is world-readable, is expected rather than a mistake.",
+    "",
+    'Reporting is a plain HTTP POST, no SDK required: POST {baseUrl}/api/ingest/errors/{key} with {"events":[{"type","value","stack","level","context"}]}, up to 100 events per request.',
+    "",
+    'Inputs: serviceId (required), name (optional label, default "default"). Max 5 keys per service \u2014 the extras exist so a key can be rotated without downtime (create the second, ship it, delete the first).',
+    "",
+    "Returns: { key: { id, publicId, name, prefix, key } } where `key` is the plaintext.",
+    "",
+    "Example: create_ingest_key({ serviceId: 48 }) \u2192 { id: 4, name: 'default', prefix: 'ing_1b7d40ae', key: 'ing_1b7d40ae\u2026' }."
+  ].join("\n"),
+  input: {
+    serviceId: z13.number().int().positive(),
+    name: z13.string().min(1).max(100).optional().describe('Label. Default "default".')
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.post(
+      `/api/services/${teamId}/${args2.serviceId}/ingest-keys`,
+      { name: args2.name ?? "default" }
+    );
+    return respond({
+      summary: "Ingest key created. The plaintext key is in the payload and is not retrievable again \u2014 store it now.",
+      data: shape(response.key)
+    });
+  }
+});
+defineTool({
+  name: "delete_ingest_key",
+  category: "errors",
+  description: [
+    "Revoke an error-ingest key. It stops working immediately, including on API replicas that had it cached.",
+    "",
+    "When to use: finishing a key rotation, or containing a key that leaked somewhere it should not have.",
+    "",
+    "Anything still posting with it starts getting 401s, so revoke the OLD key after the new one is deployed, not before.",
+    "",
+    "Inputs: serviceId, keyId (both required).",
+    "",
+    "Returns: { success: true }.",
+    "",
+    "Example: delete_ingest_key({ serviceId: 48, keyId: 3 }) \u2192 { success: true }."
+  ].join("\n"),
+  input: {
+    serviceId: z13.number().int().positive(),
+    keyId: z13.number().int().positive()
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    await ctx.api.delete(`/api/services/${teamId}/${args2.serviceId}/ingest-keys/${args2.keyId}`);
+    return respond({ summary: `Ingest key ${args2.keyId} revoked.` });
+  }
+});
+
 // src/tools/github.ts
 defineTool({
   name: "sync_github_repos",
@@ -2192,6 +2721,61 @@ defineTool({
   }
 });
 
+// src/tools/issue-reports.ts
+import { z as z14 } from "zod";
+defineTool({
+  name: "report_issue",
+  category: "support",
+  description: [
+    "File a bug or platform fault with the HostStack team. Use this when something on the PLATFORM is broken in a way you cannot fix from where you stand \u2014 a deploy that fails identically no matter what you change, a dev box that will not start, an API that returns the wrong thing, an error message that does not match what actually happened.",
+    "",
+    'When to use: you have already looked. This is not a substitute for reading logs (get_deploy_logs, get_service_logs) or for diagnose_deploy \u2014 it is what you do once you have a specific fault and no way to act on it. A report that says "the deploy failed" is worth less than no report; one that says "every deploy since 09:03 fails at container create with 404 No such image, but the image pulls fine by hand" is what gets fixed.',
+    "",
+    "When NOT to use: an application bug in the user's own code, a failing test, a misconfigured env var, or anything the user asked you to change. Those are your job, not a platform fault. Do not file the same issue twice \u2014 if you already reported it this session, say so instead.",
+    "",
+    "Diagnostic context is attached SERVER-SIDE, so you do not need to paste it: passing `serviceId` attaches the service and its most recent deploy, and the last 40 lines of that deploy log go with it. Pass `deployId` to pin a specific deploy instead of the newest. Describe what you observed and what you expected \u2014 the evidence is collected for you.",
+    "",
+    "Inputs: title (required, one line), description (required \u2014 what happened, what you expected, what you already ruled out), severity (low|normal|high|urgent, default normal), serviceId (optional), deployId (optional), databaseId (optional).",
+    "",
+    "Rate-limited to 5 reports per minute per team. Filing one notifies the HostStack team and opens a ticket the user can see and reply to.",
+    "",
+    "Returns: { ticket: { id, publicId } } \u2014 quote the publicId to the user so they can follow it up.",
+    "",
+    "Example: report_issue({ title: 'Dev box deploys fail with 404 No such image', description: 'Every deploy of svc 172 since 2026-08-22 09:03 fails at container create with `404 No such image: \u2026/dev-env:latest`. The deploy log reports \"Image ready in 1s\" for a 5.5 GB image, so the pull is not happening. The image pulls fine by hand from the same registry.', severity: 'high', serviceId: 172 }) \u2192 { ticket: { publicId: 'tkt_\u2026' } }"
+  ].join("\n"),
+  input: {
+    title: z14.string().min(1).max(300).describe("One-line summary of the fault."),
+    description: z14.string().min(1).max(1e4).describe("What happened, what you expected instead, and what you already ruled out."),
+    severity: z14.enum(["low", "normal", "high", "urgent"]).optional().describe(
+      'Default normal. Use high/urgent only when something is DOWN or losing data \u2014 not for "this is annoying".'
+    ),
+    serviceId: z14.number().int().positive().optional().describe(
+      "The affected service. Attaches the service, its latest deploy, and that deploy log tail automatically."
+    ),
+    deployId: z14.number().int().positive().optional().describe("Pin a specific deploy instead of the service\u2019s most recent one."),
+    databaseId: z14.number().int().positive().optional().describe("The affected database.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const body = {
+      title: args2.title,
+      description: args2.description,
+      severity: args2.severity ?? "normal"
+    };
+    if (args2.serviceId !== void 0) body["serviceId"] = args2.serviceId;
+    if (args2.deployId !== void 0) body["deployId"] = args2.deployId;
+    if (args2.databaseId !== void 0) body["databaseId"] = args2.databaseId;
+    const response = await ctx.api.post(
+      `/api/issue-reports/${teamId}`,
+      body
+    );
+    return respond({
+      summary: `Issue reported as ${response.ticket.publicId}. Tell the user the reference so they can follow it up \u2014 and do not file this one again.`,
+      data: shape(response.ticket)
+    });
+  }
+});
+
 // src/tools/meta.ts
 var DEV_ENV_TOOL_NAMES = [
   "create_dev_environment",
@@ -2257,7 +2841,7 @@ defineTool({
 });
 
 // src/tools/notifications.ts
-import { z as z12 } from "zod";
+import { z as z15 } from "zod";
 var NOTIFICATION_EVENTS = [
   "deploy.started",
   "deploy.succeeded",
@@ -2271,9 +2855,25 @@ var NOTIFICATION_EVENTS = [
   "service.auto_suspended",
   "service.acme_cert_failed",
   "service.resource_alert",
+  "service.uptime_down",
+  "service.uptime_recovered",
+  "error.issue_new",
+  "error.issue_regressed",
   "git.auth_failed",
   "cron.execution_failed",
-  "workflow.failed"
+  "workflow.failed",
+  "devenv.agent.needs_input",
+  "devenv.agent.finished",
+  "devenv.task.created",
+  "devenv.task.needs_input",
+  "devenv.task.finished",
+  "database.backup_failed",
+  "database.restore_failed",
+  "machine.offline",
+  "machine.online",
+  "billing.invoice",
+  "billing.payment_failed",
+  "billing.spend_limit"
 ];
 defineTool({
   name: "list_notification_channels",
@@ -2312,17 +2912,21 @@ defineTool({
     "  - webhook_url: Slack/Discord webhook URL OR email address.",
     "  - events: list of event names to subscribe to. Pass an empty list to create a channel that fires for nothing (manual subscribe later with update_notification_channel).",
     "",
-    "Valid events: deploy.started, deploy.succeeded, deploy.failed, deploy.failed_consecutive, service.created, service.deleted, service.suspended, service.resumed, service.restart_failed, service.auto_suspended, service.acme_cert_failed, service.resource_alert, git.auth_failed, cron.execution_failed, workflow.failed.",
+    // Rendered from the enum instead of retyped: the hand-written copy of
+    // this sentence went stale the same way the enum did, and a description
+    // that disagrees with the schema teaches the model to send values the
+    // tool then rejects.
+    `Valid events: ${NOTIFICATION_EVENTS.join(", ")}.`,
     "",
     "Returns: { channel: Channel }.",
     "",
     "Example: create_notification_channel({ type: 'slack', name: 'eng-alerts', webhook_url: 'https://hooks.slack.com/\u2026', events: ['deploy.failed', 'git.auth_failed', 'service.restart_failed'] })"
   ].join("\n"),
   input: {
-    type: z12.enum(["slack", "discord", "email"]).describe("Channel type."),
-    name: z12.string().min(1).max(128).describe("Human-readable label."),
-    webhook_url: z12.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
-    events: z12.array(z12.enum(NOTIFICATION_EVENTS)).describe(
+    type: z15.enum(["slack", "discord", "email"]).describe("Channel type."),
+    name: z15.string().min(1).max(128).describe("Human-readable label."),
+    webhook_url: z15.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
+    events: z15.array(z15.enum(NOTIFICATION_EVENTS)).describe(
       "List of events the channel subscribes to. Empty list = subscribe to nothing."
     )
   },
@@ -2360,10 +2964,10 @@ defineTool({
     "Example: update_notification_channel({ channel_id: 3, events: ['deploy.failed', 'service.restart_failed', 'git.auth_failed'] })"
   ].join("\n"),
   input: {
-    channel_id: z12.number().int().positive().describe("Numeric channel id from list_notification_channels."),
-    name: z12.string().min(1).max(128).optional().describe("New label."),
-    active: z12.boolean().optional().describe("false silences without deleting."),
-    events: z12.array(z12.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
+    channel_id: z15.number().int().positive().describe("Numeric channel id from list_notification_channels."),
+    name: z15.string().min(1).max(128).optional().describe("New label."),
+    active: z15.boolean().optional().describe("false silences without deleting."),
+    events: z15.array(z15.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2402,7 +3006,7 @@ defineTool({
     "Example: delete_notification_channel({ channel_id: 3 }) \u2192 { ok: true }"
   ].join("\n"),
   input: {
-    channel_id: z12.number().int().positive().describe("Numeric channel id.")
+    channel_id: z15.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2429,7 +3033,7 @@ defineTool({
     "Example: test_notification_channel({ channel_id: 3 }) \u2192 { success: true }"
   ].join("\n"),
   input: {
-    channel_id: z12.number().int().positive().describe("Numeric channel id.")
+    channel_id: z15.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2444,7 +3048,7 @@ defineTool({
 });
 
 // src/tools/projects.ts
-import { z as z13 } from "zod";
+import { z as z16 } from "zod";
 var AVAILABLE_REGION_IDS = ["eu-central-1"];
 defineTool({
   name: "list_projects",
@@ -2485,9 +3089,9 @@ defineTool({
     'Example: create_project({ name: "billing-api", description: "Stripe webhooks", region: "eu-central-1" }) \u2192 { project: { id: 12, publicId: "prj_\u2026", \u2026 } }'
   ].join("\n"),
   input: {
-    name: z13.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
-    description: z13.string().max(500).optional().describe("Short description (\u2264500 chars)."),
-    region: z13.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
+    name: z16.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
+    description: z16.string().max(500).optional().describe("Short description (\u2264500 chars)."),
+    region: z16.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2520,9 +3124,9 @@ defineTool({
     'Example: update_project({ project_id: "prj_abc", name: "billing-prod" }) \u2192 { project: { name: "billing-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z13.string().describe("Project publicId."),
-    name: z13.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
-    description: z13.string().max(500).optional().describe("New description (\u2264500 chars).")
+    project_id: z16.string().describe("Project publicId."),
+    name: z16.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
+    description: z16.string().max(500).optional().describe("New description (\u2264500 chars).")
   },
   handler: async (args2, ctx) => {
     if (args2.name === void 0 && args2.description === void 0) {
@@ -2556,7 +3160,7 @@ defineTool({
     'Example: get_project({ project_id: "prj_abc" }) \u2192 { project: { id: 12, name: "billing", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z13.string().describe("Project publicId (e.g. prj_abc123).")
+    project_id: z16.string().describe("Project publicId (e.g. prj_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2567,8 +3171,156 @@ defineTool({
   }
 });
 
+// src/tools/dev-tasks.ts
+import { z as z17 } from "zod";
+var NOT_A_RUN = "Filing a task does NOT start an agent. It writes a prompt into the box's backlog for someone to run; a suspended box keeps it until it wakes.";
+defineTool({
+  name: "list_dev_tasks",
+  category: "dev-tasks",
+  description: [
+    "List a project's agent task backlog - the same list the dashboard's Development \u2192 Tasks surface shows.",
+    "",
+    "When to use: to see what is already queued for a box before filing something (the backlog is how you avoid two agents being pointed at one job), or to find the task id for update_dev_task.",
+    "",
+    "Inputs:",
+    '  - project_id: numeric project id (from list_projects) or its "prj_\u2026" publicId.',
+    "",
+    "Returns: { summary, data: { items: DevTask[] } } - each task with publicId, title, status, serviceId (the box, or null for a loose idea), createdAt.",
+    "",
+    "`status` spans two worlds: `idea`/`done` are what a person sets, while `queued`/`running`/`needs_input`/`failed`/`cancelled` describe an agent run and belong to the runner.",
+    "",
+    'Example: list_dev_tasks({ project_id: 26 }) \u2192 { items: [{ publicId: "task_\u2026", status: "idea", title: "Fix the footprint join" }] }'
+  ].join("\n"),
+  input: {
+    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Project \u2014 publicId ("prj_\u2026") or numeric id.')
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.devTasks.list(teamId, args2.project_id);
+    const data = shapeList(response, "tasks", shape);
+    const open = data.items.filter(
+      (t) => t && typeof t === "object" && "status" in t && !["done", "cancelled"].includes(String(t.status))
+    ).length;
+    const summary = data.items.length === 0 ? "No tasks in this project." : `${data.items.length} task${data.items.length === 1 ? "" : "s"}, ${open} still open.${response.automodeEnabled ? "" : " Automode is off here, so a queued task waits for someone to start it."}`;
+    return respond({ summary, data });
+  }
+});
+defineTool({
+  name: "get_dev_task",
+  category: "dev-tasks",
+  description: [
+    "Get one task, including the full prompt body.",
+    "",
+    "When to use: to read what a task actually asks for before acting on it or marking it done - `list_dev_tasks` returns titles, not prompts.",
+    "",
+    "Inputs:",
+    '  - task_id: "task_\u2026" publicId or numeric id.',
+    "",
+    "Returns: { summary, data: DevTask }.",
+    "",
+    'Example: get_dev_task({ task_id: "task_hy1i2jdp\u2026" }) \u2192 { data: { title: "Footprint coverage", body: "The BBRUUID join returns 17 of 49 \u2026", status: "idea" } }'
+  ].join("\n"),
+  input: {
+    task_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Task \u2014 publicId ("task_\u2026") or numeric id.')
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.devTasks.get(teamId, args2.task_id);
+    const data = shape(response.task);
+    return respond({ summary: `Task ${response.task.publicId}: ${response.task.title}`, data });
+  }
+});
+defineTool({
+  name: "create_dev_task",
+  category: "dev-tasks",
+  description: [
+    "File a task in a project's backlog, optionally pinned to a specific dev box.",
+    "",
+    `When to use: to hand work to a dev box other than the one you are in - a fix that belongs in an upstream service, a follow-up in a different repo, anything the box you are in cannot do itself. ${NOT_A_RUN}`,
+    "",
+    "Inputs:",
+    '  - project_id: numeric project id or "prj_\u2026" publicId.',
+    "  - title: one line, \u2264200 chars. This is what the backlog shows.",
+    "  - body: the prompt, markdown, \u226420 000 chars. Write it for someone who was not in this conversation: what is broken, where, how it was measured, and what to watch out for.",
+    '  - service_id: the dev box to pin it to ("svc_\u2026" or numeric). Omit for a loose idea in the project backlog.',
+    "",
+    "Returns: { summary, data: DevTask } - `publicId` is the id to quote back to the user.",
+    "",
+    'Example: create_dev_task({ project_id: 26, service_id: 51, title: "Footprint coverage", body: "The BBRUUID join returns 17 of 49 \u2026" })'
+  ].join("\n"),
+  input: {
+    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Project \u2014 publicId ("prj_\u2026") or numeric id.'),
+    title: z17.string().min(1).max(200).describe("One-line title, \u2264200 chars."),
+    body: z17.string().max(2e4).optional().describe("The prompt handed to the agent. Markdown, \u226420 000 chars."),
+    service_id: z17.union([z17.number().int().positive(), z17.string()]).optional().describe(
+      'Dev box to pin it to \u2014 publicId ("svc_\u2026") or numeric id. Omit for a loose idea.'
+    )
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const serviceId = args2.service_id === void 0 ? void 0 : await ctx.hoststack.resolveId(args2.service_id, { kind: "service", teamId });
+    const projectId = await ctx.hoststack.resolveId(args2.project_id, {
+      kind: "project",
+      teamId
+    });
+    const response = await ctx.hoststack.devTasks.create(teamId, {
+      projectId,
+      title: args2.title,
+      ...args2.body ? { body: args2.body } : {},
+      ...serviceId ? { serviceId } : {}
+    });
+    const data = shape(response.task);
+    return respond({
+      summary: `Filed ${response.task.publicId}: ${response.task.title}. ${NOT_A_RUN}`,
+      data
+    });
+  }
+});
+defineTool({
+  name: "update_dev_task",
+  category: "dev-tasks",
+  description: [
+    "Edit a task, or move it between the two statuses a PERSON may set.",
+    "",
+    "When to use: to mark a task `done` once the work has landed (by hand, or in another branch - most work does not finish inside the task runner), to reopen it as an `idea`, to correct a title or prompt, or to pin a loose idea to a box.",
+    "",
+    "Inputs:",
+    '  - task_id: "task_\u2026" publicId or numeric id.',
+    '  - status: "done" or "idea". Only these two; `queued`/`running`/`failed`/`cancelled` belong to the runner and are rejected.',
+    "  - title / body / service_id: optional edits.",
+    "",
+    "Only mark a task done when it is actually resolved - the backlog is what someone reads to decide what still needs doing.",
+    "",
+    "Returns: { summary, data: DevTask }.",
+    "",
+    'Example: update_dev_task({ task_id: "task_hy1i2jdp\u2026", status: "done" }) \u2192 { data: { status: "done" } }'
+  ].join("\n"),
+  input: {
+    task_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Task \u2014 publicId ("task_\u2026") or numeric id.'),
+    status: z17.enum(["idea", "done"]).optional().describe("The only two a person may set. The runner owns the rest of the lifecycle."),
+    title: z17.string().min(1).max(200).optional().describe("New title."),
+    body: z17.string().max(2e4).optional().describe("New prompt body."),
+    service_id: z17.union([z17.number().int().positive(), z17.string()]).nullable().optional().describe("Pin to a dev box, or null to unpin it back to a loose idea.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const serviceId = args2.service_id === void 0 || args2.service_id === null ? args2.service_id : await ctx.hoststack.resolveId(args2.service_id, { kind: "service", teamId });
+    const response = await ctx.hoststack.devTasks.update(teamId, args2.task_id, {
+      ...args2.status ? { status: args2.status } : {},
+      ...args2.title ? { title: args2.title } : {},
+      ...args2.body !== void 0 ? { body: args2.body } : {},
+      ...serviceId !== void 0 ? { serviceId } : {}
+    });
+    const data = shape(response.task);
+    return respond({
+      summary: `${response.task.publicId} is now ${response.task.status}: ${response.task.title}`,
+      data
+    });
+  }
+});
+
 // src/tools/resource-links.ts
-import { z as z14 } from "zod";
+import { z as z18 } from "zod";
 var RESOURCE_LINK_TYPES = [
   "database",
   "object_storage",
@@ -2629,7 +3381,7 @@ defineTool({
     'Example: list_service_resources({ service_id: "svc_abc" }) \u2192 { items: [{ id: 7, resourceType: "database", resourceId: 42, alias: "APP_DB" }] }'
   ].join("\n"),
   input: {
-    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
+    service_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2666,10 +3418,10 @@ defineTool({
     'Example: link_resource_to_service({ service_id: "svc_abc", resource_type: "database", resource_id: 42, alias: "APP_DB" }) \u2192 { link: { id: 7, alias: "APP_DB" } }'
   ].join("\n"),
   input: {
-    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    resource_type: z14.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
-    resource_id: z14.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
-    alias: z14.string().min(1).max(48).regex(
+    service_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    resource_type: z18.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
+    resource_id: z18.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
+    alias: z18.string().min(1).max(48).regex(
       /^[A-Z][A-Z0-9_]*$/,
       "Alias must be uppercase letters, digits and underscores, starting with a letter."
     ).describe('Uppercase env-var prefix, e.g. "APP_DB". Unique within the service.')
@@ -2705,8 +3457,8 @@ defineTool({
     'Example: unlink_resource_from_service({ service_id: "svc_abc", link_id: 7 }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    link_id: z14.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
+    service_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    link_id: z18.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2718,7 +3470,7 @@ defineTool({
 });
 
 // src/tools/services.ts
-import { z as z15 } from "zod";
+import { z as z19 } from "zod";
 
 // src/lib/app-templates.ts
 var MCP_APP_TEMPLATES = [
@@ -2868,6 +3620,46 @@ var MCP_APP_TEMPLATES = [
     installCommand: "npm install",
     startCommand: "node worker.js"
   },
+  {
+    id: "uptime-kuma",
+    name: "Uptime Kuma",
+    description: "Self-hosted uptime monitoring and status pages, with its own SQLite store",
+    type: "web_service",
+    dockerImage: "louislam/uptime-kuma:1",
+    port: 3e3
+  },
+  {
+    id: "vaultwarden",
+    name: "Vaultwarden",
+    description: "Self-hosted Bitwarden-compatible password manager (unofficial server)",
+    type: "web_service",
+    dockerImage: "vaultwarden/server:1.32.7-alpine",
+    port: 3e3
+  },
+  {
+    id: "n8n",
+    name: "n8n",
+    description: "Self-hosted workflow automation \u2014 visual editor, 400+ integrations",
+    type: "web_service",
+    dockerImage: "n8nio/n8n:1",
+    port: 5678
+  },
+  {
+    id: "wordpress",
+    name: "WordPress",
+    description: "PHP 8.3 + Apache, with a managed MySQL database (billed separately)",
+    type: "web_service",
+    dockerImage: "wordpress:php8.3-apache",
+    port: 80
+  },
+  {
+    id: "ghost",
+    name: "Ghost",
+    description: "Blogs and newsletters, with a managed MySQL database (billed separately)",
+    type: "web_service",
+    dockerImage: "ghost:5-alpine",
+    port: 2368
+  },
   {
     id: "cron-cleanup",
     name: "Cleanup Cron",
@@ -2935,11 +3727,11 @@ defineTool({
     'Example: list_services({ status: "failed" }) \u2192 only services that need attention.'
   ].join("\n"),
   input: {
-    project_id: z15.union([z15.number().int().positive(), z15.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
-    environment_id: z15.union([z15.number().int().positive(), z15.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
-    status: z15.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
-    type: z15.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
-    dev_environment: z15.boolean().optional().describe(
+    project_id: z19.union([z19.number().int().positive(), z19.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
+    environment_id: z19.union([z19.number().int().positive(), z19.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
+    status: z19.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
+    type: z19.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
+    dev_environment: z19.boolean().optional().describe(
       "Include agentic Dev Boxes in the results (excluded by default; see list_dev_environments)."
     )
   },
@@ -2984,6 +3776,8 @@ defineTool({
     "",
     "When to use: the user wants to deploy something new. For a one-command AI dev environment specifically, prefer create_dev_environment (it also attaches the /workspace volume and sets the MCP keys).",
     "",
+    "*** For a packaged app (WordPress, Ghost, n8n, Uptime Kuma, Vaultwarden), start at list_templates and pass template_id. *** Those templates are prebuilt images that only boot with the volume, scratch dirs, uid and companion database the platform attaches from the template id \u2014 the same image passed as a bare docker_image crash-loops on the read-only rootfs, and the fix is a redeploy away rather than an edit away.",
+    "",
     '*** NOT for databases. *** If the user wants Postgres, Redis, MySQL, MariaDB or MongoDB, call create_database \u2014 do NOT create a service with docker_image "postgres:16" / "redis:7" / "mongo" / "mysql". A database deployed as a service is unmanaged: no backups, no version upgrades, no HA, no credential rotation, no metrics, no persistent volume, and nothing injects its URL into your app. `docker_image` here is for YOUR application images (or sidecars), not for datastores the platform already manages.',
     "",
     "Inputs:",
@@ -2997,6 +3791,8 @@ defineTool({
     "  - cron_schedule (optional): cron expression \u2014 required for cron_job.",
     '  - publish_path (optional): static-site output dir (e.g. "dist").',
     '  - runtime (optional): "node" | "bun" | "python" | \u2026 (auto-detected from a repo when omitted).',
+    "  - port (optional): the port the container listens on (1\u201365535). A source-built service should omit it \u2014 the platform injects $PORT and expects the app to bind that. Set it for a docker_image whose listen port is fixed by the image (WordPress 80, Ghost 2368, n8n 5678): the platform publishes and health-checks this port and never re-reads what the process actually bound, so an image listening elsewhere fails its first deploy on a container that is perfectly healthy.",
+    "  - template_id (optional): create from a quickstart template \u2014 an id from list_templates and nothing else. Everything the template brings (volumes, scratch dirs, uid, generated secrets, companion managed database) is resolved server-side and attached before the first deploy fires; there is no way to send those in the body. For an image template, pass its docker_image and port alongside, exactly as list_templates returns them.",
     '  - plan (optional): service size (default "micro").',
     "  - environment_id (optional): bind to a specific environment; defaults to the project Production env.",
     "  - auto_deploy (optional, default true): trigger the first deploy immediately when a source is present.",
@@ -3004,26 +3800,33 @@ defineTool({
     "",
     "Returns: { service: Service, deployId: number | null }.",
     "",
-    'Example: create_service({ project_id: "prj_abc", name: "api", type: "web_service", github_repo_id: 42 }) \u2192 { service: { publicId: "svc_\u2026" }, deployId: 1234 }'
+    'Example: create_service({ project_id: "prj_abc", name: "api", type: "web_service", github_repo_id: 42 }) \u2192 { service: { publicId: "svc_\u2026" }, deployId: 1234 }',
+    'Example (one-click app): create_service({ project_id: "prj_abc", name: "blog", type: "web_service", template_id: "wordpress", docker_image: "wordpress:php8.3-apache", port: 80 }) \u2014 the wp-content volume, the www-data uid, the Apache scratch dirs and the managed MySQL come from the template id.'
   ].join("\n"),
   input: {
-    project_id: z15.union([z15.number().int().positive(), z15.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z15.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
-    type: z15.enum(SERVICE_TYPES).describe("Service type."),
-    docker_image: z15.string().max(500).optional().describe(
+    project_id: z19.union([z19.number().int().positive(), z19.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z19.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
+    type: z19.enum(SERVICE_TYPES).describe("Service type."),
+    docker_image: z19.string().max(500).optional().describe(
       "Pre-built APPLICATION image ref. Mutually exclusive with github_repo_id. Not for databases \u2014 use create_database for postgres/redis/mysql/mariadb/mongodb."
     ),
-    github_repo_id: z15.number().int().positive().optional().describe("Linked GitHub repo numeric id. Mutually exclusive with docker_image."),
-    branch: z15.string().max(200).optional().describe('Git branch (default "main").'),
-    install_command: z15.string().max(1e3).optional().describe("Install shell command."),
-    build_command: z15.string().max(1e3).optional().describe("Build shell command."),
-    start_command: z15.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
-    cron_schedule: z15.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
-    publish_path: z15.string().max(500).optional().describe("Static-site output dir."),
-    runtime: z15.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
-    plan: z15.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
-    environment_id: z15.union([z15.number().int().positive(), z15.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
-    auto_deploy: z15.boolean().optional().describe("Trigger the first deploy immediately (default true)."),
+    github_repo_id: z19.number().int().positive().optional().describe("Linked GitHub repo numeric id. Mutually exclusive with docker_image."),
+    branch: z19.string().max(200).optional().describe('Git branch (default "main").'),
+    install_command: z19.string().max(1e3).optional().describe("Install shell command."),
+    build_command: z19.string().max(1e3).optional().describe("Build shell command."),
+    start_command: z19.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
+    cron_schedule: z19.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
+    publish_path: z19.string().max(500).optional().describe("Static-site output dir."),
+    runtime: z19.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
+    port: z19.number().int().min(1).max(65535).optional().describe(
+      "Listen port, for a prebuilt image whose port is fixed by the image. Omit for a source-built service \u2014 it binds the injected $PORT."
+    ),
+    template_id: z19.string().max(64).optional().describe(
+      "Quickstart template id from list_templates. Its volumes, scratch dirs, uid, secrets and companion database are resolved server-side; for an image template also pass its docker_image and port."
+    ),
+    plan: z19.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
+    environment_id: z19.union([z19.number().int().positive(), z19.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
+    auto_deploy: z19.boolean().optional().describe("Trigger the first deploy immediately (default true)."),
     machine: machineInput
   },
   handler: async (args2, ctx) => {
@@ -3046,6 +3849,8 @@ defineTool({
     if (args2.cron_schedule !== void 0) input.cronSchedule = args2.cron_schedule;
     if (args2.publish_path !== void 0) input.publishPath = args2.publish_path;
     if (args2.runtime !== void 0) input.runtime = args2.runtime;
+    if (args2.port !== void 0) input.port = args2.port;
+    if (args2.template_id !== void 0) input.templateId = args2.template_id;
     if (args2.plan !== void 0) input.plan = args2.plan;
     if (args2.auto_deploy !== void 0) input.autoDeploy = args2.auto_deploy;
     if (args2.environment_id !== void 0) {
@@ -3092,18 +3897,18 @@ defineTool({
     'Example: create_dev_environment({ project_id: "prj_abc", name: "scratch", hoststack_api_key: "hs_live_\u2026" })'
   ].join("\n"),
   input: {
-    project_id: z15.union([z15.number().int().positive(), z15.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z15.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
-    plan: z15.enum(SERVICE_PLANS).optional().describe(
+    project_id: z19.union([z19.number().int().positive(), z19.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z19.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
+    plan: z19.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB, the OOM-safe floor; a smaller plan is clamped up to "standard").'
     ),
-    disk_gb: z15.number().int().min(10).max(10240).optional().describe("/workspace volume size in GB (default 10, min 10, max 10240)."),
-    hoststack_api_key: z15.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
-    poststack_api_key: z15.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
-    repo_url: z15.string().max(500).optional().describe(
+    disk_gb: z19.number().int().min(10).max(10240).optional().describe("/workspace volume size in GB (default 10, min 10, max 10240)."),
+    hoststack_api_key: z19.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
+    poststack_api_key: z19.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
+    repo_url: z19.string().max(500).optional().describe(
       "Clone this git URL into /workspace on first boot (HTTPS, or SSH once a key is set)."
     ),
-    branch: z15.string().max(200).optional().describe("Branch to clone (with repo_url)."),
+    branch: z19.string().max(200).optional().describe("Branch to clone (with repo_url)."),
     machine: machineInput
   },
   handler: async (args2, ctx) => {
@@ -3220,9 +4025,9 @@ defineTool({
     'Example: spin_up_dev_environment({ service_id: "svc_api" }) \u2192 a dev box running a clone of the api service (repo + env-vars + cloned DB) with a public dev URL.'
   ].join("\n"),
   input: {
-    service_id: z15.union([z15.number().int().positive(), z15.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
-    include_database_clone: z15.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
-    name: z15.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
+    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
+    include_database_clone: z19.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
+    name: z19.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3263,7 +4068,7 @@ defineTool({
     'Example: delete_dev_environment({ service_id: "svc_api_dev" }) \u2192 removes the dev box, its cloned database, and the /workspace volume.'
   ].join("\n"),
   input: {
-    service_id: z15.union([z15.number().int().positive(), z15.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
+    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3299,8 +4104,8 @@ defineTool({
     'Example: resize_dev_environment({ service_id: "svc_skyskraber_dev", size: "large" }) \u2192 bumps the box to the large tier, applied live.'
   ].join("\n"),
   input: {
-    service_id: z15.union([z15.number().int().positive(), z15.string()]).describe("The box to resize \u2014 numeric id or publicId."),
-    size: z15.enum(SERVICE_PLANS).describe(
+    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe("The box to resize \u2014 numeric id or publicId."),
+    size: z19.enum(SERVICE_PLANS).describe(
       'Target size tier (service catalog size, e.g. "standard", "large", "xlarge").'
     )
   },
@@ -3354,13 +4159,13 @@ defineTool({
   name: "list_templates",
   category: "services",
   description: [
-    "List the app quickstart templates the dashboard New-Service wizard offers, plus the separate Dev Box preset. A template is a pre-filled install/build/start command set for a stack (Next.js, Django, SvelteKit, Spring Boot, \u2026) \u2014 pass its fields straight to `create_service` to get a service configured exactly like a hand-created one.",
+    "List the app quickstart templates the dashboard New-Service wizard offers, plus the separate Dev Box preset. Two kinds live in one list: a stack template (Next.js, Django, SvelteKit, Spring Boot, \u2026) is a pre-filled install/build/start command set you pair with a Git repo, and a one-click app (WordPress, Ghost, n8n, Uptime Kuma, Vaultwarden) is a prebuilt image that needs no repo at all.",
     "",
-    'When to use: whenever asked to deploy a known stack ("deploy my Next.js app", "put this Django project on HostStack"), before hand-writing a start command; and before creating a Dev Box, to confirm the image, /workspace size, plan floor, and companion engines instead of duplicating those constants.',
+    'When to use: whenever asked to deploy a known stack ("deploy my Next.js app", "put this Django project on HostStack"), before hand-writing a start command; whenever asked for a packaged app ("deploy WordPress", "I want a Ghost blog"), before reaching for a bare docker_image; and before creating a Dev Box, to confirm the image, /workspace size, plan floor, and companion engines instead of duplicating those constants.',
     "",
-    "Returns: { templates: [{ id, name, description, type, runtime, installCommand?, buildCommand?, startCommand?, publishPath?, cronSchedule? }], devBox: { id, name, image, volume: { name, mountPath, sizeGb }, minPlan, createWith, companions, inBox } }. Every template is source-built from a Git repo \u2014 pair one with `github_repo_id`, not `docker_image`. The Dev Box is NOT in `templates`: it is created with create_standalone_dev_environment / create_dev_environment, never create_service. `companions` are SEPARATE managed databases you can attach; `inBox` is what the box already runs on its own (engines via `dev-services`, language runtimes via `dev-runtime`) \u2014 check it before concluding a box cannot run something.",
+    "Returns: { templates: [{ id, name, description, type, runtime?, installCommand?, buildCommand?, startCommand?, publishPath?, cronSchedule?, dockerImage?, port?, requiresTemplateId? }], devBox: { id, name, image, volume: { name, mountPath, sizeGb }, minPlan, createWith, companions, inBox } }. A template WITHOUT `dockerImage` is source-built \u2014 pass its commands to create_service with a `github_repo_id`. A template WITH `dockerImage` is flagged `requiresTemplateId` and must be created as create_service({ template_id, docker_image, port, \u2026 }): the volume, scratch dirs, uid, generated secrets and companion managed database it needs are attached server-side from the id, and the same image sent without it crash-loops on the read-only rootfs. The Dev Box is NOT in `templates`: it is created with create_standalone_dev_environment / create_dev_environment, never create_service. `companions` are SEPARATE managed databases you can attach; `inBox` is what the box already runs on its own (engines via `dev-services`, language runtimes via `dev-runtime`) \u2014 check it before concluding a box cannot run something.",
     "",
-    'Example: list_templates() \u2192 { templates: [{ id: "nextjs-ssr", name: "Next.js", type: "web_service", runtime: "node", installCommand: "npm install", buildCommand: "npm run build", startCommand: "npm run start" }, \u2026], devBox: { id: "dev-environment", image: "registry.hoststack.dev/hoststack/dev-env:latest", volume: { mountPath: "/workspace", sizeGb: 10 }, minPlan: "standard", companions: ["postgres","redis","meilisearch"] } }'
+    'Example: list_templates() \u2192 { templates: [{ id: "nextjs-ssr", name: "Next.js", type: "web_service", runtime: "node", installCommand: "npm install", buildCommand: "npm run build", startCommand: "npm run start" }, { id: "wordpress", name: "WordPress", type: "web_service", dockerImage: "wordpress:php8.3-apache", port: 80, requiresTemplateId: true }, \u2026], devBox: { id: "dev-environment", image: "registry.hoststack.dev/hoststack/dev-env:latest", volume: { mountPath: "/workspace", sizeGb: 10 }, minPlan: "standard", companions: ["postgres","redis","meilisearch"] } }'
   ].join("\n"),
   input: {},
   handler: async () => {
@@ -3401,12 +4206,14 @@ defineTool({
         }
       }
     };
-    const templates = MCP_APP_TEMPLATES;
+    const templates = MCP_APP_TEMPLATES.map(
+      (t) => t.dockerImage ? { ...t, requiresTemplateId: true } : t
+    );
     const byType = /* @__PURE__ */ new Map();
     for (const t of templates) byType.set(t.type, (byType.get(t.type) ?? 0) + 1);
     const breakdown = [...byType].map(([type, n]) => `${n} ${type}`).join(", ");
     return respond({
-      summary: `${templates.length} app templates (${breakdown}) \u2014 pick one by id and pass its commands to create_service with a github_repo_id. Plus the Dev Box preset (image ${DEV_ENV_IMAGE}, /workspace ${DEV_ENV_VOLUME.sizeGb} GB, floor "${DEV_ENV_MIN_SIZE}"), which is created with create_standalone_dev_environment, not create_service.`,
+      summary: `${templates.length} app templates (${breakdown}) \u2014 pick one by id, then either pass its commands to create_service with a github_repo_id, or, if it has a dockerImage, pass template_id + docker_image + port. Plus the Dev Box preset (image ${DEV_ENV_IMAGE}, /workspace ${DEV_ENV_VOLUME.sizeGb} GB, floor "${DEV_ENV_MIN_SIZE}"), which is created with create_standalone_dev_environment, not create_service.`,
       data: { templates, devBox }
     });
   }
@@ -3441,21 +4248,21 @@ defineTool({
     'Example: create_standalone_dev_environment({ name: "app-dev", source_kind: "github_repo", github_repo_id: 42, databases: ["postgres","redis"] })'
   ].join("\n"),
   input: {
-    name: z15.string().min(1).max(100).optional().describe(
+    name: z19.string().min(1).max(100).optional().describe(
       'Dev Box name. Omit to have it named after the source (the repo name, or "dev-box" for a blank one), de-duplicated against existing boxes.'
     ),
-    source_kind: z15.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
-    github_repo_id: z15.number().int().positive().optional().describe('Connected GitHub repo id (required when source_kind="github_repo").'),
-    clone_url: z15.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
-    branch: z15.string().min(1).max(255).optional().describe("Branch to clone."),
-    databases: z15.array(z15.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
-    plan: z15.enum(SERVICE_PLANS).optional().describe(
+    source_kind: z19.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
+    github_repo_id: z19.number().int().positive().optional().describe('Connected GitHub repo id (required when source_kind="github_repo").'),
+    clone_url: z19.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
+    branch: z19.string().min(1).max(255).optional().describe("Branch to clone."),
+    databases: z19.array(z19.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
+    plan: z19.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB; a smaller plan is floored to "standard").'
     ),
-    agent_accounts: z15.array(
-      z15.object({
-        provider: z15.enum(["claude", "codex", "opencode"]),
-        account_id: z15.number().int().positive()
+    agent_accounts: z19.array(
+      z19.object({
+        provider: z19.enum(["claude", "codex", "opencode"]),
+        account_id: z19.number().int().positive()
       })
     ).max(3).optional().describe(
       "Bind saved agent logins by account id per provider. Omit to inherit the box owner's default logins automatically."
@@ -3533,7 +4340,7 @@ defineTool({
     'Example: get_service({ service_id: "svc_abc" }) \u2192 { service: { type: "web", status: "running", \u2026 }, config: { healthCheckGracePeriodSec: 120, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z19.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3565,7 +4372,7 @@ defineTool({
     'Example: get_service_metrics({ service_id: "svc_abc" }) \u2192 { metrics: { cpu: 0.42, memory: 0.71, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId.")
+    service_id: z19.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3594,9 +4401,9 @@ defineTool({
     'Example: get_service_metrics_history({ service_id: "svc_abc", from: "-1h" }) \u2192 60-ish points for the last hour.'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    from: z15.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
-    to: z15.string().optional().describe("ISO-8601 upper bound; defaults to now.")
+    service_id: z19.string().describe("Service publicId."),
+    from: z19.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
+    to: z19.string().optional().describe("ISO-8601 upper bound; defaults to now.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3640,8 +4447,8 @@ defineTool({
     'Example: update_service({ service_id: "svc_abc", name: "api-prod" }) \u2192 { service: { name: "api-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    name: z15.string().min(1).max(60).describe("New service name (1\u201360 chars).")
+    service_id: z19.string().describe("Service publicId."),
+    name: z19.string().min(1).max(60).describe("New service name (1\u201360 chars).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3690,40 +4497,40 @@ defineTool({
     'Example: update_service_config({ service_id: "svc_abc", health_check_grace_period_sec: 180 }) \u2192 { config: { healthCheckGracePeriodSec: 180, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    install_command: z15.string().nullable().optional().describe("Install shell command. Null clears."),
-    build_command: z15.string().nullable().optional().describe("Build shell command. Null clears."),
-    start_command: z15.string().nullable().optional().describe("Start shell command. Null clears."),
-    branch: z15.string().optional().describe("Git branch to track."),
-    root_directory: z15.string().optional().describe("Build context root."),
-    dockerfile_path: z15.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
-    auto_deploy: z15.boolean().optional().describe("Auto-deploy on push."),
-    health_check_path: z15.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
-    health_check_enabled: z15.boolean().optional().describe("Toggle health checking on/off."),
-    health_check_interval: z15.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
-    health_check_timeout: z15.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
-    health_check_grace_period_sec: z15.number().int().min(1).max(1800).optional().describe(
+    service_id: z19.string().describe("Service publicId."),
+    install_command: z19.string().nullable().optional().describe("Install shell command. Null clears."),
+    build_command: z19.string().nullable().optional().describe("Build shell command. Null clears."),
+    start_command: z19.string().nullable().optional().describe("Start shell command. Null clears."),
+    branch: z19.string().optional().describe("Git branch to track."),
+    root_directory: z19.string().optional().describe("Build context root."),
+    dockerfile_path: z19.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
+    auto_deploy: z19.boolean().optional().describe("Auto-deploy on push."),
+    health_check_path: z19.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
+    health_check_enabled: z19.boolean().optional().describe("Toggle health checking on/off."),
+    health_check_interval: z19.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
+    health_check_timeout: z19.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
+    health_check_grace_period_sec: z19.number().int().min(1).max(1800).optional().describe(
       "Startup grace period in seconds (1\u20131800). Raise this if the app needs more time to boot before health checks start counting failures."
     ),
-    memory_mb: z15.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
-    cpu_shares: z15.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
-    disk_size_gb: z15.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
-    port: z15.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
-    protocol: z15.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
-    restart_policy: z15.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
-    deploy_strategy: z15.enum(["rolling", "recreate"]).optional().describe(
+    memory_mb: z19.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
+    cpu_shares: z19.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
+    disk_size_gb: z19.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
+    port: z19.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
+    protocol: z19.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
+    restart_policy: z19.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
+    deploy_strategy: z19.enum(["rolling", "recreate"]).optional().describe(
       'How a deploy replaces the container. "rolling" (default) = start new, wait for healthy, switch traffic, stop old (zero downtime). "recreate" = stop old first, then start new (brief outage) \u2014 required for a container holding an exclusive lock on a mounted volume, which cannot deploy at all under rolling.'
     ),
-    pre_deploy_command: z15.string().optional().describe("Shell command run before the new release accepts traffic."),
-    instance_count: z15.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
-    min_instances: z15.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
-    max_instances: z15.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
-    scale_cpu_threshold: z15.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
-    scale_memory_threshold: z15.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
-    log_filter_rules: z15.array(
-      z15.object({
-        pattern: z15.string().min(1).max(200),
-        action: z15.enum(["drop", "downgrade"])
+    pre_deploy_command: z19.string().optional().describe("Shell command run before the new release accepts traffic."),
+    instance_count: z19.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
+    min_instances: z19.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
+    max_instances: z19.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
+    scale_cpu_threshold: z19.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
+    scale_memory_threshold: z19.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
+    log_filter_rules: z19.array(
+      z19.object({
+        pattern: z19.string().min(1).max(200),
+        action: z19.enum(["drop", "downgrade"])
       })
     ).max(50).optional().describe(
       "Runtime-log filter rules. Empty array [] clears all rules. Each pattern is case-insensitive substring match against the message."
@@ -3820,7 +4627,7 @@ defineTool({
     'Example: suspend_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId.")
+    service_id: z19.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3844,7 +4651,7 @@ defineTool({
     'Example: resume_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId.")
+    service_id: z19.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3870,7 +4677,7 @@ defineTool({
     'Example: delete_service({ service_id: "svc_abandoned" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId.")
+    service_id: z19.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3907,16 +4714,16 @@ defineTool({
     '  - Just count error lines without fetching them: get_service_logs({ service_id: "svc_abc", level: "error", since: "-5m", count_only: true }) \u2192 { count: 47 }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    lines: z15.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
-    since: z15.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z15.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z15.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z15.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
+    service_id: z19.string().describe("Service publicId."),
+    lines: z19.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
+    since: z19.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z19.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z19.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z19.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
       "Filter by structured JSON log level (pino/bunyan/severity). Falls back to a stream-alias hint for plain-text logs (info/debug\u2192stdout, warn/error/fatal\u2192stderr)."
     ),
-    search: z15.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z15.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
+    search: z19.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z19.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3965,14 +4772,14 @@ defineTool({
     'Example: get_service_logs_bulk({ service_ids: ["svc_api", "svc_worker"], level: "error", since: "-15m", count_only: true }) \u2192 { results: { svc_api: { count: 0 }, svc_worker: { count: 12 } } }.'
   ].join("\n"),
   input: {
-    service_ids: z15.array(z15.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
-    lines_per_service: z15.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
-    since: z15.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z15.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z15.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z15.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
-    search: z15.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z15.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
+    service_ids: z19.array(z19.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
+    lines_per_service: z19.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
+    since: z19.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z19.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z19.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z19.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
+    search: z19.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z19.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4017,8 +4824,119 @@ defineTool({
   }
 });
 
+// src/tools/uptime.ts
+import { z as z20 } from "zod";
+var STATUS_MEANING = [
+  "Status vocabulary: `up` answering as expected \xB7 `down` failed the threshold and an alert is open \xB7 `unknown` not probed yet \xB7 `unresolvable` the service has no active domain to request \xB7 `paused` the service is not meant to be answering (suspended, mid-deploy, never deployed) OR it sleeps when idle and probing it would keep it awake."
+].join("\n");
+defineTool({
+  name: "get_uptime_check",
+  category: "uptime",
+  description: [
+    "Read a service's uptime check \u2014 HostStack requesting the service's public URL on a schedule and alerting when it stops answering.",
+    "",
+    'When to use: "is this service actually reachable", or before changing a check to see what it currently does. This is NOT the deploy-time health check: that one watches the container from inside the host and stops mattering once a deploy is live. This one runs from the control plane against the public URL, so it also catches DNS, TLS, edge and routing failures \u2014 and a service that accepts the connection and then answers nothing.',
+    "",
+    STATUS_MEANING,
+    "",
+    "Inputs: serviceId (required).",
+    "",
+    'Returns: { check } or { check: null } when none is configured. The check carries path, method, expectedStatus, intervalSeconds, failureThreshold, status, consecutiveFailures, lastCheckedAt, lastStatusCode, lastLatencyMs, lastError, lastChangedAt (the "down since" timestamp).',
+    "",
+    "Example: get_uptime_check({ serviceId: 48 }) \u2192 { check: { path: '/healthz', status: 'down', consecutiveFailures: 5, lastError: 'No response within 10000ms', lastChangedAt: '2026-08-21T04:12:00Z' } }."
+  ].join("\n"),
+  input: { serviceId: z20.number().int().positive() },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.get(
+      `/api/services/${teamId}/${args2.serviceId}/uptime-check`
+    );
+    if (response.check === null) {
+      return respond({
+        summary: "No uptime check on this service \u2014 nothing is watching its public URL.",
+        data: { check: null }
+      });
+    }
+    const check = shape(response.check);
+    return respond({
+      summary: `Uptime check is ${String(check["status"])}${check["lastError"] ? ` \u2014 ${String(check["lastError"])}` : ""}.`,
+      data: { check }
+    });
+  }
+});
+defineTool({
+  name: "set_uptime_check",
+  category: "uptime",
+  description: [
+    "Create or update a service's uptime check.",
+    "",
+    "When to use: turning monitoring on for a service that has just gone live, or adjusting a check that is too noisy (raise failureThreshold) or too slow to notice (lower intervalSeconds).",
+    "",
+    'Only service types with a public URL can be checked (web services and static sites). A worker, cron job or private service is refused with 400 \u2014 a check on one could only ever report "no domain to check", which reads as a broken feature rather than an inapplicable one.',
+    "",
+    "For a site HostStack does NOT host, there is no serviceId to pass: use set_site_uptime_check with its analytics siteId instead. That path needs the domain proven first (verify_site_domain), because the host it probes comes from the site row rather than from a domain the platform already vouches for.",
+    "",
+    "IMPORTANT: changing the shape of a check RESETS its accumulated state (status, consecutive failures, open alert). A check whose path or expected status just changed has not observed the new check failing, so carrying failures forward would alert about a condition that was never measured. Pass the full shape you want, not a partial edit of an unknown current state \u2014 read it with get_uptime_check first if that matters.",
+    "",
+    "`path` is a path, not a URL: the host comes from the service's primary domain at probe time, so moving the service to a new domain moves the check with it.",
+    "",
+    "Method is GET or HEAD only. A probe fires unattended every interval forever, so it has to be safe to repeat \u2014 a check that could POST would be a scheduled writer against the team's own API.",
+    "",
+    "Redirects are NOT followed: a 301 is an answer, and following one can walk the probe onto a marketing site and report a dead service as healthy. If a redirect is expected, set expectedStatus to it.",
+    "",
+    'Inputs (all optional except serviceId): enabled, path (default "/"), method (GET|HEAD), expectedStatus (default 200), timeoutMs (1000\u201360000, default 10000 \u2014 this is what catches a hung server), intervalSeconds (30\u20133600, default 60), failureThreshold (1\u201310, default 3 \u2014 one failed request is usually a restart, not an outage).',
+    "",
+    "Returns: { check } with the saved check.",
+    "",
+    "Example: set_uptime_check({ serviceId: 48, path: '/healthz', intervalSeconds: 60, failureThreshold: 3 }) \u2192 { check: { status: 'unknown', \u2026 } }."
+  ].join("\n"),
+  input: {
+    serviceId: z20.number().int().positive(),
+    enabled: z20.boolean().optional(),
+    path: z20.string().max(500).optional().describe('Must start with /. Default "/".'),
+    method: z20.enum(["GET", "HEAD"]).optional(),
+    expectedStatus: z20.number().int().min(100).max(599).optional(),
+    timeoutMs: z20.number().int().min(1e3).max(6e4).optional(),
+    intervalSeconds: z20.number().int().min(30).max(3600).optional(),
+    failureThreshold: z20.number().int().min(1).max(10).optional()
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const { serviceId, ...body } = args2;
+    const response = await ctx.api.put(
+      `/api/services/${teamId}/${serviceId}/uptime-check`,
+      body
+    );
+    return respond({
+      summary: `Uptime check saved. It will start reporting within a minute or two.`,
+      data: { check: shape(response.check) }
+    });
+  }
+});
+defineTool({
+  name: "delete_uptime_check",
+  category: "uptime",
+  description: [
+    'Stop checking a service. Any open "not answering" alert is left as it stands rather than being silently resolved \u2014 removing the monitor is not evidence the service came back.',
+    "",
+    "When to use: the service is being retired, or monitoring has moved somewhere else. To pause a check without losing its configuration, call set_uptime_check with enabled=false instead.",
+    "",
+    "Inputs: serviceId (required).",
+    "",
+    "Returns: { success: true }.",
+    "",
+    "Example: delete_uptime_check({ serviceId: 48 }) \u2192 { success: true }."
+  ].join("\n"),
+  input: { serviceId: z20.number().int().positive() },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    await ctx.api.delete(`/api/services/${teamId}/${args2.serviceId}/uptime-check`);
+    return respond({ summary: "Uptime check removed. Nothing is watching this service now." });
+  }
+});
+
 // src/tools/volumes.ts
-import { z as z16 } from "zod";
+import { z as z21 } from "zod";
 var MIN_VOLUME_SIZE_GB = 10;
 defineTool({
   name: "list_volumes",
@@ -4036,7 +4954,7 @@ defineTool({
     'Example: list_volumes({ service_id: "svc_abc" }) \u2192 { items: [{ name: "data", mountPath: "/var/data", sizeGb: 10, status: "active" }] }'
   ].join("\n"),
   input: {
-    service_id: z16.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z21.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4065,15 +4983,15 @@ defineTool({
     'Example: create_volume({ service_id: "svc_abc", name: "data", mount_path: "/var/data", size_gb: 10 }) \u2192 { volume: { name: "data", mountPath: "/var/data", sizeGb: 10, status: "pending" } }'
   ].join("\n"),
   input: {
-    service_id: z16.string().describe("Service publicId."),
-    name: z16.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
-    mount_path: z16.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
+    service_id: z21.string().describe("Service publicId."),
+    name: z21.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
+    mount_path: z21.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
     // 10 GB is the real floor: the block-storage backend rejects anything
     // smaller. Advertising 1 GB here (and defaulting to it) meant taking the
     // defaults produced a volume that provisioned with `Hetzner API error:
     // 422` on the NEXT deploy, with nothing tying the failure back to the
     // size. Reject it at the call instead.
-    size_gb: z16.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
+    size_gb: z21.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
       `Disk size in GB (minimum ${MIN_VOLUME_SIZE_GB}, default ${MIN_VOLUME_SIZE_GB}, max 100 via MCP).`
     )
   },
@@ -4111,10 +5029,10 @@ defineTool({
     'Example: update_volume({ service_id: "svc_abc", volume_id: "vol_xyz", size_gb: 20 }) \u2192 { volume: { sizeGb: 20, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z16.string().describe("Service publicId."),
-    volume_id: z16.string().describe("Volume publicId (e.g. vol_\u2026)."),
-    mount_path: z16.string().startsWith("/").max(500).optional().describe("New mount path."),
-    size_gb: z16.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`)
+    service_id: z21.string().describe("Service publicId."),
+    volume_id: z21.string().describe("Volume publicId (e.g. vol_\u2026)."),
+    mount_path: z21.string().startsWith("/").max(500).optional().describe("New mount path."),
+    size_gb: z21.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`)
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4152,8 +5070,8 @@ defineTool({
     'Example: delete_volume({ service_id: "svc_abc", volume_id: "vol_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z16.string().describe("Service publicId."),
-    volume_id: z16.string().describe("Volume publicId.")
+    service_id: z21.string().describe("Service publicId."),
+    volume_id: z21.string().describe("Volume publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();