@hoststack.dev/mcp 0.18.0 → 0.19.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { HostStack } from "@hoststack.dev/sdk";
 
 // src/version.ts
-var MCP_VERSION = true ? "0.18.0" : "0.0.0-dev";
+var MCP_VERSION = true ? "0.19.0" : "0.0.0-dev";
 var USER_AGENT = `hoststack-mcp/${MCP_VERSION}`;
 
 // src/api-client.ts
@@ -1394,7 +1394,7 @@ var DNS_RECORD_TYPES = [
 async function resolveZonePublicId(hoststack, teamId, input) {
   if (input.zone_id) {
     const { zones: zones2 } = await hoststack.dns.listZones(teamId);
-    const match = zones2.find((z20) => z20.publicId === input.zone_id);
+    const match = zones2.find((z22) => z22.publicId === input.zone_id);
     if (!match) {
       throw new Error(`Zone ${input.zone_id} not found on this team.`);
     }
@@ -1408,7 +1408,7 @@ async function resolveZonePublicId(hoststack, teamId, input) {
   const labels = fqdn.split(".");
   for (let i = 0; i < labels.length - 1; i++) {
     const candidate = labels.slice(i).join(".");
-    const match = zones.find((z20) => z20.domainName.toLowerCase() === candidate);
+    const match = zones.find((z22) => z22.domainName.toLowerCase() === candidate);
     if (match && match.status !== "deleting") {
       return { publicId: match.publicId, domainName: match.domainName };
     }
@@ -1869,6 +1869,7 @@ defineTool({
     "  - value: new value (will be encrypted at rest if is_secret=true).",
     "  - is_secret (optional): true marks the value as secret (masked on read). On create, defaults to true for safety. On update, omitting it leaves the existing flag untouched \u2014 pass it explicitly only when you want to change classification.",
     '  - target (optional): where the var is injected \u2014 "build", "runtime", or "both". On create, defaults to "both". On update, omitting it leaves the existing target untouched.',
+    '    IMPORTANT for build-time values (a frontend VITE_*/NEXT_PUBLIC_*, anything a bundler inlines): "both" and "build" reach the build, but a SECRET var never does on "both" \u2014 build args are baked into image history. Since is_secret defaults to TRUE here, set is_secret:false for a public build-time value or it will silently be missing from the built artifact. Use "build" to force a secret into the build anyway.',
     "",
     'Returns: { envVar: EnvVar, action: "created" | "updated" }.',
     "",
@@ -1879,7 +1880,9 @@ defineTool({
     key: z10.string().min(1).max(128).describe("Env-var key."),
     value: z10.string().describe("New value."),
     is_secret: z10.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true."),
-    target: z10.enum(["build", "runtime", "both"]).optional().describe("Injection target: build, runtime, or both. Default both.")
+    target: z10.enum(["build", "runtime", "both"]).optional().describe(
+      'Injection target: build, runtime, or both. Default both. A secret var on "both" is runtime-only (build args land in image history) \u2014 pass is_secret:false for a public build-time value, or use "build" to force it.'
+    )
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1962,6 +1965,7 @@ defineTool({
     "Inputs:",
     "  - service_id: publicId of the service.",
     '  - env_vars: array of { key, value, is_secret?, target? }. is_secret defaults to FALSE per row (a row is stored in the clear unless you set is_secret:true); target defaults to "both". Note this differs from set_env_var, which defaults a newly-created var to secret.',
+    '    A var reaches the image BUILD when target is "build", or when target is "both" and is_secret is false. A secret on "both" is runtime-only, because build args are visible in image history.',
     "",
     "Returns: { ok: true }. Re-list with list_env_vars to confirm the new state.",
     "",
@@ -2206,7 +2210,7 @@ defineTool({
     "",
     "The ingest endpoint answers HTTP 204 to a real site key and to a typo alike \u2014 deliberately, so it cannot be used to enumerate keys \u2014 which means five completely different situations produce the same empty chart: a stale or mistyped key in the deployed snippet, an origin the site does not allow, a blown hourly quota, events blocked in the browser before they leave (CORS, ad blocker, CSP), and simply no visitors yet. This tool tells them apart.",
     "",
-    "Returns health ('receiving' | 'quiet' | 'refusing' | 'never'), a headline and detail sentence, lastEventAt, lastRefusalAt/Reason/Origin, refusedRecently (a 7-day tally by reason), the site key the snippet must carry, allowed origins, and quota usage this hour.",
+    "Returns: health ('receiving' | 'quiet' | 'refusing' | 'never'), a headline and detail sentence, lastEventAt, lastRefusalAt/Reason/Origin, refusedRecently (a 7-day tally by reason), the site key the snippet must carry, allowed origins, and quota usage this hour.",
     "",
     "health='never' means nothing has EVER reached ingest for this key, so the request is not leaving the browser \u2014 check the snippet is in the deployed HTML and tell the user to add `data-debug` to the script tag, which makes the tracker log its resolved endpoint and every accepted 204 to the console.",
     "",
@@ -2238,6 +2242,8 @@ defineTool({
     "",
     "Inputs: range (24h|7d|30d|90d|12mo, default 7d), domains (optional list; omit for every site).",
     "",
+    "Returns: the range asked for, and one row per site \u2014 domain, `current` and `previous` blocks of visitors / pageviews / bounceRate / avgVisitSeconds, the live visitor count, and `visitorsAreSummedDailies`, which says whether that visitor number is a distinct count or a sum of daily uniques. Quote that flag with any 90d or 12mo figure.",
+    "",
     "Example: get_analytics_summary({ range: '30d' }) \u2192 { range: '30d', sites: [{ domain: 'hoststack.dev', current: { visitors: 4210, pageviews: 11890, bounceRate: 47.2 }, previous: {\u2026}, live: 3, visitorsAreSummedDailies: false }] }."
   ].join("\n"),
   input: {
@@ -2269,6 +2275,8 @@ defineTool({
     "",
     "Inputs: range (24h|7d|30d|90d|12mo, default 7d), domains (optional list; omit for every site), filters (optional map \u2014 country, browser, os, device, language, path, referrer, utmSource, utmMedium, utmCampaign, utmTerm, utmContent).",
     "",
+    "Returns: `source` ('raw' | 'rollup') and `filtersSupported`, which together say how much of the request was actually honoured; a `summary` block of current-vs-previous totals; a timeseries; and the breakdowns \u2014 topPaths, topReferrers, topEvents, browsers, operatingSystems, languages, screenSizes, campaigns, devices and countries. Read `source` and `filtersSupported` before quoting any of it.",
+    "",
     "Example: get_analytics_overview({ domains: ['hoststack.dev'], range: '7d', filters: { country: 'DK' } }) \u2192 { source: 'raw', filtersSupported: true, summary: { current: { visitors: 310, \u2026 } }, topPaths: [{ path: '/pricing', pageviews: 214 }], topReferrers: [{ referrer: 'Direct', visits: 190 }], \u2026 }."
   ].join("\n"),
   input: {
@@ -2312,6 +2320,8 @@ defineTool({
     "",
     'Inputs: domain (required, bare hostname \u2014 "example.com", not a URL), name (optional display name, defaults to the domain).',
     "",
+    "Returns: the created site (id, domain, name, ingestKey, retentionDays) and the ready-made `snippet` to paste into the page \u2014 the key is in that snippet, so hand it over rather than describing it.",
+    "",
     `Example: create_analytics_site({ domain: 'micci.dk' }) \u2192 { site: { id: 3, domain: 'micci.dk', ingestKey: 'site_\u2026' }, snippet: '<script defer src="https://hoststack.dev/t.js" data-site-key="site_\u2026"></script>' }.`
   ].join("\n"),
   input: {
@@ -2331,6 +2341,94 @@ defineTool({
     });
   }
 });
+defineTool({
+  name: "verify_site_domain",
+  category: "analytics",
+  description: [
+    "Prove the team owns a site's domain, by publishing a TXT record.",
+    "",
+    "When to use: before turning on an uptime check for a site that HostStack does not host. Analytics itself needs no proof \u2014 the ingest key only labels events the site posts about itself \u2014 so do NOT send a user through this just to get a dashboard. It exists for the capabilities where the PLATFORM acts on the hostname.",
+    "",
+    "Call it once with no `check` to get the record to publish, then again with check=true once the record is live. The token is stable across calls, so it is safe to re-read the instructions while the user is mid-paste.",
+    "",
+    "A site whose domain is already verified on a service in this team is proven ALREADY and does not need this \u2014 `list_analytics_sites` reports that as domainProven. This is for the site with no service behind it, which can never have such a link.",
+    "",
+    `The record is read from the domain's own authoritative nameservers rather than through a cache, so "I just added it" works immediately instead of being masked by a negative-cache TTL.`,
+    "",
+    'Inputs: siteId (required), check (optional, default false \u2014 true means "look at DNS now and tell me the verdict").',
+    "",
+    "Returns: the record to publish plus `verified`. A `verified: false` is a successful check with a negative answer, not an error \u2014 most often the record simply has not propagated yet.",
+    "",
+    "Example: verify_site_domain({ siteId: 3 }) \u2192 { recordName: '_hoststack-verify.poststack.dev', recordType: 'TXT', recordValue: 'hoststack-verify=9f3c\u2026', verified: false }."
+  ].join("\n"),
+  input: {
+    siteId: z12.number().int().positive(),
+    check: z12.boolean().optional().describe(
+      "True to read DNS now and return the verdict. False just returns the record."
+    )
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const instructions = await ctx.api.get(`/api/analytics/${teamId}/sites/${args.siteId}/verification`);
+    if (!args.check) {
+      return respond({
+        summary: instructions.verified ? "Already verified." : `Publish a ${instructions.recordType} record at ${instructions.recordName} with the value shown, then call again with check=true.`,
+        data: shape(instructions)
+      });
+    }
+    const verdict = await ctx.api.post(
+      `/api/analytics/${teamId}/sites/${args.siteId}/verify`,
+      {}
+    );
+    return respond({
+      summary: verdict.verified ? "Verified. This site can now be given an uptime check." : `Not verified yet \u2014 ${verdict.detail ?? "the record was not found"}.`,
+      data: { record: shape(instructions), result: shape(verdict) }
+    });
+  }
+});
+defineTool({
+  name: "set_site_uptime_check",
+  category: "analytics",
+  description: [
+    "Watch a site HostStack does not host \u2014 request its URL on a schedule and alert when it stops answering.",
+    "",
+    "When to use: the user has a site running somewhere else (their own box, another provider) and wants to know when it goes down. This is the one observability capability an off-platform site cannot provide for itself: analytics is a script tag and error reporting is an HTTP POST, but an outside-in probe has to come from outside.",
+    "",
+    "For a site that IS a HostStack service, use set_uptime_check with its serviceId instead \u2014 that one follows the service if its domain changes.",
+    "",
+    "REQUIRES a proven domain. Call verify_site_domain first if `domainProven` is false; an unverified target is refused with 400. This is not paperwork: an uptime check makes the control plane fetch the hostname every interval, forever, from our IP, so it must be a name the team has shown it owns.",
+    "",
+    "Always https, and the host is the site's domain \u2014 `path` is a path, not a URL. Redirects are NOT followed: a 301 is an answer, and following one can walk the probe onto a parked page and report a dead site as healthy. Set expectedStatus to the redirect if one is expected.",
+    "",
+    'Inputs (all optional except siteId): enabled, path (default "/"), method (GET|HEAD), expectedStatus (default 200), timeoutMs (1000\u201360000, default 10000 \u2014 this is what catches a hung server), intervalSeconds (30\u20133600, default 60), failureThreshold (1\u201310, default 3).',
+    "",
+    "Returns: the stored check \u2014 enabled, the resolved target URL, method, expectedStatus, timeoutMs, intervalSeconds, failureThreshold \u2014 plus its live state: status ('up' | 'down' | 'unknown'), lastCheckedAt, lastStatusCode and consecutiveFailures. A freshly created check is 'unknown' until the first probe runs.",
+    "",
+    "Example: set_site_uptime_check({ siteId: 3, path: '/health', intervalSeconds: 60 }) \u2192 { check: { status: 'unknown', \u2026 } }."
+  ].join("\n"),
+  input: {
+    siteId: z12.number().int().positive(),
+    enabled: z12.boolean().optional(),
+    path: z12.string().max(500).optional().describe('Must start with /. Default "/".'),
+    method: z12.enum(["GET", "HEAD"]).optional(),
+    expectedStatus: z12.number().int().min(100).max(599).optional(),
+    timeoutMs: z12.number().int().min(1e3).max(6e4).optional(),
+    intervalSeconds: z12.number().int().min(30).max(3600).optional(),
+    failureThreshold: z12.number().int().min(1).max(10).optional()
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const { siteId, ...body } = args;
+    const response = await ctx.api.put(
+      `/api/analytics/${teamId}/sites/${siteId}/uptime-check`,
+      body
+    );
+    return respond({
+      summary: "Uptime check saved. It will start reporting within a minute or two.",
+      data: { check: shape(response.check) }
+    });
+  }
+});
 
 // src/tools/errors.ts
 import { z as z13 } from "zod";
@@ -2624,6 +2722,61 @@ defineTool({
   }
 });
 
+// src/tools/issue-reports.ts
+import { z as z14 } from "zod";
+defineTool({
+  name: "report_issue",
+  category: "support",
+  description: [
+    "File a bug or platform fault with the HostStack team. Use this when something on the PLATFORM is broken in a way you cannot fix from where you stand \u2014 a deploy that fails identically no matter what you change, a dev box that will not start, an API that returns the wrong thing, an error message that does not match what actually happened.",
+    "",
+    'When to use: you have already looked. This is not a substitute for reading logs (get_deploy_logs, get_service_logs) or for diagnose_deploy \u2014 it is what you do once you have a specific fault and no way to act on it. A report that says "the deploy failed" is worth less than no report; one that says "every deploy since 09:03 fails at container create with 404 No such image, but the image pulls fine by hand" is what gets fixed.',
+    "",
+    "When NOT to use: an application bug in the user's own code, a failing test, a misconfigured env var, or anything the user asked you to change. Those are your job, not a platform fault. Do not file the same issue twice \u2014 if you already reported it this session, say so instead.",
+    "",
+    "Diagnostic context is attached SERVER-SIDE, so you do not need to paste it: passing `serviceId` attaches the service and its most recent deploy, and the last 40 lines of that deploy log go with it. Pass `deployId` to pin a specific deploy instead of the newest. Describe what you observed and what you expected \u2014 the evidence is collected for you.",
+    "",
+    "Inputs: title (required, one line), description (required \u2014 what happened, what you expected, what you already ruled out), severity (low|normal|high|urgent, default normal), serviceId (optional), deployId (optional), databaseId (optional).",
+    "",
+    "Rate-limited to 5 reports per minute per team. Filing one notifies the HostStack team and opens a ticket the user can see and reply to.",
+    "",
+    "Returns: { ticket: { id, publicId } } \u2014 quote the publicId to the user so they can follow it up.",
+    "",
+    "Example: report_issue({ title: 'Dev box deploys fail with 404 No such image', description: 'Every deploy of svc 172 since 2026-08-22 09:03 fails at container create with `404 No such image: \u2026/dev-env:latest`. The deploy log reports \"Image ready in 1s\" for a 5.5 GB image, so the pull is not happening. The image pulls fine by hand from the same registry.', severity: 'high', serviceId: 172 }) \u2192 { ticket: { publicId: 'tkt_\u2026' } }"
+  ].join("\n"),
+  input: {
+    title: z14.string().min(1).max(300).describe("One-line summary of the fault."),
+    description: z14.string().min(1).max(1e4).describe("What happened, what you expected instead, and what you already ruled out."),
+    severity: z14.enum(["low", "normal", "high", "urgent"]).optional().describe(
+      'Default normal. Use high/urgent only when something is DOWN or losing data \u2014 not for "this is annoying".'
+    ),
+    serviceId: z14.number().int().positive().optional().describe(
+      "The affected service. Attaches the service, its latest deploy, and that deploy log tail automatically."
+    ),
+    deployId: z14.number().int().positive().optional().describe("Pin a specific deploy instead of the service\u2019s most recent one."),
+    databaseId: z14.number().int().positive().optional().describe("The affected database.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const body = {
+      title: args.title,
+      description: args.description,
+      severity: args.severity ?? "normal"
+    };
+    if (args.serviceId !== void 0) body["serviceId"] = args.serviceId;
+    if (args.deployId !== void 0) body["deployId"] = args.deployId;
+    if (args.databaseId !== void 0) body["databaseId"] = args.databaseId;
+    const response = await ctx.api.post(
+      `/api/issue-reports/${teamId}`,
+      body
+    );
+    return respond({
+      summary: `Issue reported as ${response.ticket.publicId}. Tell the user the reference so they can follow it up \u2014 and do not file this one again.`,
+      data: shape(response.ticket)
+    });
+  }
+});
+
 // src/tools/meta.ts
 var DEV_ENV_TOOL_NAMES = [
   "create_dev_environment",
@@ -2689,7 +2842,7 @@ defineTool({
 });
 
 // src/tools/notifications.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var NOTIFICATION_EVENTS = [
   "deploy.started",
   "deploy.succeeded",
@@ -2771,10 +2924,10 @@ defineTool({
     "Example: create_notification_channel({ type: 'slack', name: 'eng-alerts', webhook_url: 'https://hooks.slack.com/\u2026', events: ['deploy.failed', 'git.auth_failed', 'service.restart_failed'] })"
   ].join("\n"),
   input: {
-    type: z14.enum(["slack", "discord", "email"]).describe("Channel type."),
-    name: z14.string().min(1).max(128).describe("Human-readable label."),
-    webhook_url: z14.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
-    events: z14.array(z14.enum(NOTIFICATION_EVENTS)).describe(
+    type: z15.enum(["slack", "discord", "email"]).describe("Channel type."),
+    name: z15.string().min(1).max(128).describe("Human-readable label."),
+    webhook_url: z15.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
+    events: z15.array(z15.enum(NOTIFICATION_EVENTS)).describe(
       "List of events the channel subscribes to. Empty list = subscribe to nothing."
     )
   },
@@ -2812,10 +2965,10 @@ defineTool({
     "Example: update_notification_channel({ channel_id: 3, events: ['deploy.failed', 'service.restart_failed', 'git.auth_failed'] })"
   ].join("\n"),
   input: {
-    channel_id: z14.number().int().positive().describe("Numeric channel id from list_notification_channels."),
-    name: z14.string().min(1).max(128).optional().describe("New label."),
-    active: z14.boolean().optional().describe("false silences without deleting."),
-    events: z14.array(z14.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
+    channel_id: z15.number().int().positive().describe("Numeric channel id from list_notification_channels."),
+    name: z15.string().min(1).max(128).optional().describe("New label."),
+    active: z15.boolean().optional().describe("false silences without deleting."),
+    events: z15.array(z15.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2854,7 +3007,7 @@ defineTool({
     "Example: delete_notification_channel({ channel_id: 3 }) \u2192 { ok: true }"
   ].join("\n"),
   input: {
-    channel_id: z14.number().int().positive().describe("Numeric channel id.")
+    channel_id: z15.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2881,7 +3034,7 @@ defineTool({
     "Example: test_notification_channel({ channel_id: 3 }) \u2192 { success: true }"
   ].join("\n"),
   input: {
-    channel_id: z14.number().int().positive().describe("Numeric channel id.")
+    channel_id: z15.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2896,7 +3049,7 @@ defineTool({
 });
 
 // src/tools/projects.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var AVAILABLE_REGION_IDS = ["eu-central-1"];
 defineTool({
   name: "list_projects",
@@ -2937,9 +3090,9 @@ defineTool({
     'Example: create_project({ name: "billing-api", description: "Stripe webhooks", region: "eu-central-1" }) \u2192 { project: { id: 12, publicId: "prj_\u2026", \u2026 } }'
   ].join("\n"),
   input: {
-    name: z15.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
-    description: z15.string().max(500).optional().describe("Short description (\u2264500 chars)."),
-    region: z15.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
+    name: z16.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
+    description: z16.string().max(500).optional().describe("Short description (\u2264500 chars)."),
+    region: z16.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2972,9 +3125,9 @@ defineTool({
     'Example: update_project({ project_id: "prj_abc", name: "billing-prod" }) \u2192 { project: { name: "billing-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z15.string().describe("Project publicId."),
-    name: z15.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
-    description: z15.string().max(500).optional().describe("New description (\u2264500 chars).")
+    project_id: z16.string().describe("Project publicId."),
+    name: z16.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
+    description: z16.string().max(500).optional().describe("New description (\u2264500 chars).")
   },
   handler: async (args, ctx) => {
     if (args.name === void 0 && args.description === void 0) {
@@ -3008,7 +3161,7 @@ defineTool({
     'Example: get_project({ project_id: "prj_abc" }) \u2192 { project: { id: 12, name: "billing", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z15.string().describe("Project publicId (e.g. prj_abc123).")
+    project_id: z16.string().describe("Project publicId (e.g. prj_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3019,8 +3172,156 @@ defineTool({
   }
 });
 
+// src/tools/dev-tasks.ts
+import { z as z17 } from "zod";
+var NOT_A_RUN = "Filing a task does NOT start an agent. It writes a prompt into the box's backlog for someone to run; a suspended box keeps it until it wakes.";
+defineTool({
+  name: "list_dev_tasks",
+  category: "dev-tasks",
+  description: [
+    "List a project's agent task backlog - the same list the dashboard's Development \u2192 Tasks surface shows.",
+    "",
+    "When to use: to see what is already queued for a box before filing something (the backlog is how you avoid two agents being pointed at one job), or to find the task id for update_dev_task.",
+    "",
+    "Inputs:",
+    '  - project_id: numeric project id (from list_projects) or its "prj_\u2026" publicId.',
+    "",
+    "Returns: { summary, data: { items: DevTask[] } } - each task with publicId, title, status, serviceId (the box, or null for a loose idea), createdAt.",
+    "",
+    "`status` spans two worlds: `idea`/`done` are what a person sets, while `queued`/`running`/`needs_input`/`failed`/`cancelled` describe an agent run and belong to the runner.",
+    "",
+    'Example: list_dev_tasks({ project_id: 26 }) \u2192 { items: [{ publicId: "task_\u2026", status: "idea", title: "Fix the footprint join" }] }'
+  ].join("\n"),
+  input: {
+    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Project \u2014 publicId ("prj_\u2026") or numeric id.')
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.devTasks.list(teamId, args.project_id);
+    const data = shapeList(response, "tasks", shape);
+    const open = data.items.filter(
+      (t) => t && typeof t === "object" && "status" in t && !["done", "cancelled"].includes(String(t.status))
+    ).length;
+    const summary = data.items.length === 0 ? "No tasks in this project." : `${data.items.length} task${data.items.length === 1 ? "" : "s"}, ${open} still open.${response.automodeEnabled ? "" : " Automode is off here, so a queued task waits for someone to start it."}`;
+    return respond({ summary, data });
+  }
+});
+defineTool({
+  name: "get_dev_task",
+  category: "dev-tasks",
+  description: [
+    "Get one task, including the full prompt body.",
+    "",
+    "When to use: to read what a task actually asks for before acting on it or marking it done - `list_dev_tasks` returns titles, not prompts.",
+    "",
+    "Inputs:",
+    '  - task_id: "task_\u2026" publicId or numeric id.',
+    "",
+    "Returns: { summary, data: DevTask }.",
+    "",
+    'Example: get_dev_task({ task_id: "task_hy1i2jdp\u2026" }) \u2192 { data: { title: "Footprint coverage", body: "The BBRUUID join returns 17 of 49 \u2026", status: "idea" } }'
+  ].join("\n"),
+  input: {
+    task_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Task \u2014 publicId ("task_\u2026") or numeric id.')
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.devTasks.get(teamId, args.task_id);
+    const data = shape(response.task);
+    return respond({ summary: `Task ${response.task.publicId}: ${response.task.title}`, data });
+  }
+});
+defineTool({
+  name: "create_dev_task",
+  category: "dev-tasks",
+  description: [
+    "File a task in a project's backlog, optionally pinned to a specific dev box.",
+    "",
+    `When to use: to hand work to a dev box other than the one you are in - a fix that belongs in an upstream service, a follow-up in a different repo, anything the box you are in cannot do itself. ${NOT_A_RUN}`,
+    "",
+    "Inputs:",
+    '  - project_id: numeric project id or "prj_\u2026" publicId.',
+    "  - title: one line, \u2264200 chars. This is what the backlog shows.",
+    "  - body: the prompt, markdown, \u226420 000 chars. Write it for someone who was not in this conversation: what is broken, where, how it was measured, and what to watch out for.",
+    '  - service_id: the dev box to pin it to ("svc_\u2026" or numeric). Omit for a loose idea in the project backlog.',
+    "",
+    "Returns: { summary, data: DevTask } - `publicId` is the id to quote back to the user.",
+    "",
+    'Example: create_dev_task({ project_id: 26, service_id: 51, title: "Footprint coverage", body: "The BBRUUID join returns 17 of 49 \u2026" })'
+  ].join("\n"),
+  input: {
+    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Project \u2014 publicId ("prj_\u2026") or numeric id.'),
+    title: z17.string().min(1).max(200).describe("One-line title, \u2264200 chars."),
+    body: z17.string().max(2e4).optional().describe("The prompt handed to the agent. Markdown, \u226420 000 chars."),
+    service_id: z17.union([z17.number().int().positive(), z17.string()]).optional().describe(
+      'Dev box to pin it to \u2014 publicId ("svc_\u2026") or numeric id. Omit for a loose idea.'
+    )
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const serviceId = args.service_id === void 0 ? void 0 : await ctx.hoststack.resolveId(args.service_id, { kind: "service", teamId });
+    const projectId = await ctx.hoststack.resolveId(args.project_id, {
+      kind: "project",
+      teamId
+    });
+    const response = await ctx.hoststack.devTasks.create(teamId, {
+      projectId,
+      title: args.title,
+      ...args.body ? { body: args.body } : {},
+      ...serviceId ? { serviceId } : {}
+    });
+    const data = shape(response.task);
+    return respond({
+      summary: `Filed ${response.task.publicId}: ${response.task.title}. ${NOT_A_RUN}`,
+      data
+    });
+  }
+});
+defineTool({
+  name: "update_dev_task",
+  category: "dev-tasks",
+  description: [
+    "Edit a task, or move it between the two statuses a PERSON may set.",
+    "",
+    "When to use: to mark a task `done` once the work has landed (by hand, or in another branch - most work does not finish inside the task runner), to reopen it as an `idea`, to correct a title or prompt, or to pin a loose idea to a box.",
+    "",
+    "Inputs:",
+    '  - task_id: "task_\u2026" publicId or numeric id.',
+    '  - status: "done" or "idea". Only these two; `queued`/`running`/`failed`/`cancelled` belong to the runner and are rejected.',
+    "  - title / body / service_id: optional edits.",
+    "",
+    "Only mark a task done when it is actually resolved - the backlog is what someone reads to decide what still needs doing.",
+    "",
+    "Returns: { summary, data: DevTask }.",
+    "",
+    'Example: update_dev_task({ task_id: "task_hy1i2jdp\u2026", status: "done" }) \u2192 { data: { status: "done" } }'
+  ].join("\n"),
+  input: {
+    task_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Task \u2014 publicId ("task_\u2026") or numeric id.'),
+    status: z17.enum(["idea", "done"]).optional().describe("The only two a person may set. The runner owns the rest of the lifecycle."),
+    title: z17.string().min(1).max(200).optional().describe("New title."),
+    body: z17.string().max(2e4).optional().describe("New prompt body."),
+    service_id: z17.union([z17.number().int().positive(), z17.string()]).nullable().optional().describe("Pin to a dev box, or null to unpin it back to a loose idea.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const serviceId = args.service_id === void 0 || args.service_id === null ? args.service_id : await ctx.hoststack.resolveId(args.service_id, { kind: "service", teamId });
+    const response = await ctx.hoststack.devTasks.update(teamId, args.task_id, {
+      ...args.status ? { status: args.status } : {},
+      ...args.title ? { title: args.title } : {},
+      ...args.body !== void 0 ? { body: args.body } : {},
+      ...serviceId !== void 0 ? { serviceId } : {}
+    });
+    const data = shape(response.task);
+    return respond({
+      summary: `${response.task.publicId} is now ${response.task.status}: ${response.task.title}`,
+      data
+    });
+  }
+});
+
 // src/tools/resource-links.ts
-import { z as z16 } from "zod";
+import { z as z18 } from "zod";
 var RESOURCE_LINK_TYPES = [
   "database",
   "object_storage",
@@ -3081,7 +3382,7 @@ defineTool({
     'Example: list_service_resources({ service_id: "svc_abc" }) \u2192 { items: [{ id: 7, resourceType: "database", resourceId: 42, alias: "APP_DB" }] }'
   ].join("\n"),
   input: {
-    service_id: z16.union([z16.number().int().positive(), z16.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
+    service_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3118,10 +3419,10 @@ defineTool({
     'Example: link_resource_to_service({ service_id: "svc_abc", resource_type: "database", resource_id: 42, alias: "APP_DB" }) \u2192 { link: { id: 7, alias: "APP_DB" } }'
   ].join("\n"),
   input: {
-    service_id: z16.union([z16.number().int().positive(), z16.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    resource_type: z16.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
-    resource_id: z16.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
-    alias: z16.string().min(1).max(48).regex(
+    service_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    resource_type: z18.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
+    resource_id: z18.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
+    alias: z18.string().min(1).max(48).regex(
       /^[A-Z][A-Z0-9_]*$/,
       "Alias must be uppercase letters, digits and underscores, starting with a letter."
     ).describe('Uppercase env-var prefix, e.g. "APP_DB". Unique within the service.')
@@ -3157,8 +3458,8 @@ defineTool({
     'Example: unlink_resource_from_service({ service_id: "svc_abc", link_id: 7 }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z16.union([z16.number().int().positive(), z16.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    link_id: z16.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
+    service_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    link_id: z18.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3170,7 +3471,7 @@ defineTool({
 });
 
 // src/tools/services.ts
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 
 // src/lib/app-templates.ts
 var MCP_APP_TEMPLATES = [
@@ -3427,11 +3728,11 @@ defineTool({
     'Example: list_services({ status: "failed" }) \u2192 only services that need attention.'
   ].join("\n"),
   input: {
-    project_id: z17.union([z17.number().int().positive(), z17.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
-    environment_id: z17.union([z17.number().int().positive(), z17.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
-    status: z17.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
-    type: z17.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
-    dev_environment: z17.boolean().optional().describe(
+    project_id: z19.union([z19.number().int().positive(), z19.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
+    environment_id: z19.union([z19.number().int().positive(), z19.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
+    status: z19.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
+    type: z19.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
+    dev_environment: z19.boolean().optional().describe(
       "Include agentic Dev Boxes in the results (excluded by default; see list_dev_environments)."
     )
   },
@@ -3504,29 +3805,29 @@ defineTool({
     'Example (one-click app): create_service({ project_id: "prj_abc", name: "blog", type: "web_service", template_id: "wordpress", docker_image: "wordpress:php8.3-apache", port: 80 }) \u2014 the wp-content volume, the www-data uid, the Apache scratch dirs and the managed MySQL come from the template id.'
   ].join("\n"),
   input: {
-    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z17.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
-    type: z17.enum(SERVICE_TYPES).describe("Service type."),
-    docker_image: z17.string().max(500).optional().describe(
+    project_id: z19.union([z19.number().int().positive(), z19.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z19.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
+    type: z19.enum(SERVICE_TYPES).describe("Service type."),
+    docker_image: z19.string().max(500).optional().describe(
       "Pre-built APPLICATION image ref. Mutually exclusive with github_repo_id. Not for databases \u2014 use create_database for postgres/redis/mysql/mariadb/mongodb."
     ),
-    github_repo_id: z17.number().int().positive().optional().describe("Linked GitHub repo numeric id. Mutually exclusive with docker_image."),
-    branch: z17.string().max(200).optional().describe('Git branch (default "main").'),
-    install_command: z17.string().max(1e3).optional().describe("Install shell command."),
-    build_command: z17.string().max(1e3).optional().describe("Build shell command."),
-    start_command: z17.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
-    cron_schedule: z17.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
-    publish_path: z17.string().max(500).optional().describe("Static-site output dir."),
-    runtime: z17.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
-    port: z17.number().int().min(1).max(65535).optional().describe(
+    github_repo_id: z19.number().int().positive().optional().describe("Linked GitHub repo numeric id. Mutually exclusive with docker_image."),
+    branch: z19.string().max(200).optional().describe('Git branch (default "main").'),
+    install_command: z19.string().max(1e3).optional().describe("Install shell command."),
+    build_command: z19.string().max(1e3).optional().describe("Build shell command."),
+    start_command: z19.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
+    cron_schedule: z19.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
+    publish_path: z19.string().max(500).optional().describe("Static-site output dir."),
+    runtime: z19.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
+    port: z19.number().int().min(1).max(65535).optional().describe(
       "Listen port, for a prebuilt image whose port is fixed by the image. Omit for a source-built service \u2014 it binds the injected $PORT."
     ),
-    template_id: z17.string().max(64).optional().describe(
+    template_id: z19.string().max(64).optional().describe(
       "Quickstart template id from list_templates. Its volumes, scratch dirs, uid, secrets and companion database are resolved server-side; for an image template also pass its docker_image and port."
     ),
-    plan: z17.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
-    environment_id: z17.union([z17.number().int().positive(), z17.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
-    auto_deploy: z17.boolean().optional().describe("Trigger the first deploy immediately (default true)."),
+    plan: z19.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
+    environment_id: z19.union([z19.number().int().positive(), z19.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
+    auto_deploy: z19.boolean().optional().describe("Trigger the first deploy immediately (default true)."),
     machine: machineInput
   },
   handler: async (args, ctx) => {
@@ -3597,18 +3898,18 @@ defineTool({
     'Example: create_dev_environment({ project_id: "prj_abc", name: "scratch", hoststack_api_key: "hs_live_\u2026" })'
   ].join("\n"),
   input: {
-    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z17.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
-    plan: z17.enum(SERVICE_PLANS).optional().describe(
+    project_id: z19.union([z19.number().int().positive(), z19.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z19.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
+    plan: z19.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB, the OOM-safe floor; a smaller plan is clamped up to "standard").'
     ),
-    disk_gb: z17.number().int().min(10).max(10240).optional().describe("/workspace volume size in GB (default 10, min 10, max 10240)."),
-    hoststack_api_key: z17.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
-    poststack_api_key: z17.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
-    repo_url: z17.string().max(500).optional().describe(
+    disk_gb: z19.number().int().min(10).max(10240).optional().describe("/workspace volume size in GB (default 10, min 10, max 10240)."),
+    hoststack_api_key: z19.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
+    poststack_api_key: z19.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
+    repo_url: z19.string().max(500).optional().describe(
       "Clone this git URL into /workspace on first boot (HTTPS, or SSH once a key is set)."
     ),
-    branch: z17.string().max(200).optional().describe("Branch to clone (with repo_url)."),
+    branch: z19.string().max(200).optional().describe("Branch to clone (with repo_url)."),
     machine: machineInput
   },
   handler: async (args, ctx) => {
@@ -3725,9 +4026,9 @@ defineTool({
     'Example: spin_up_dev_environment({ service_id: "svc_api" }) \u2192 a dev box running a clone of the api service (repo + env-vars + cloned DB) with a public dev URL.'
   ].join("\n"),
   input: {
-    service_id: z17.union([z17.number().int().positive(), z17.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
-    include_database_clone: z17.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
-    name: z17.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
+    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
+    include_database_clone: z19.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
+    name: z19.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3768,7 +4069,7 @@ defineTool({
     'Example: delete_dev_environment({ service_id: "svc_api_dev" }) \u2192 removes the dev box, its cloned database, and the /workspace volume.'
   ].join("\n"),
   input: {
-    service_id: z17.union([z17.number().int().positive(), z17.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
+    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3804,8 +4105,8 @@ defineTool({
     'Example: resize_dev_environment({ service_id: "svc_skyskraber_dev", size: "large" }) \u2192 bumps the box to the large tier, applied live.'
   ].join("\n"),
   input: {
-    service_id: z17.union([z17.number().int().positive(), z17.string()]).describe("The box to resize \u2014 numeric id or publicId."),
-    size: z17.enum(SERVICE_PLANS).describe(
+    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe("The box to resize \u2014 numeric id or publicId."),
+    size: z19.enum(SERVICE_PLANS).describe(
       'Target size tier (service catalog size, e.g. "standard", "large", "xlarge").'
     )
   },
@@ -3948,21 +4249,21 @@ defineTool({
     'Example: create_standalone_dev_environment({ name: "app-dev", source_kind: "github_repo", github_repo_id: 42, databases: ["postgres","redis"] })'
   ].join("\n"),
   input: {
-    name: z17.string().min(1).max(100).optional().describe(
+    name: z19.string().min(1).max(100).optional().describe(
       'Dev Box name. Omit to have it named after the source (the repo name, or "dev-box" for a blank one), de-duplicated against existing boxes.'
     ),
-    source_kind: z17.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
-    github_repo_id: z17.number().int().positive().optional().describe('Connected GitHub repo id (required when source_kind="github_repo").'),
-    clone_url: z17.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
-    branch: z17.string().min(1).max(255).optional().describe("Branch to clone."),
-    databases: z17.array(z17.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
-    plan: z17.enum(SERVICE_PLANS).optional().describe(
+    source_kind: z19.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
+    github_repo_id: z19.number().int().positive().optional().describe('Connected GitHub repo id (required when source_kind="github_repo").'),
+    clone_url: z19.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
+    branch: z19.string().min(1).max(255).optional().describe("Branch to clone."),
+    databases: z19.array(z19.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
+    plan: z19.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB; a smaller plan is floored to "standard").'
     ),
-    agent_accounts: z17.array(
-      z17.object({
-        provider: z17.enum(["claude", "codex", "opencode"]),
-        account_id: z17.number().int().positive()
+    agent_accounts: z19.array(
+      z19.object({
+        provider: z19.enum(["claude", "codex", "opencode"]),
+        account_id: z19.number().int().positive()
       })
     ).max(3).optional().describe(
       "Bind saved agent logins by account id per provider. Omit to inherit the box owner's default logins automatically."
@@ -4040,7 +4341,7 @@ defineTool({
     'Example: get_service({ service_id: "svc_abc" }) \u2192 { service: { type: "web", status: "running", \u2026 }, config: { healthCheckGracePeriodSec: 120, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z17.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z19.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4072,7 +4373,7 @@ defineTool({
     'Example: get_service_metrics({ service_id: "svc_abc" }) \u2192 { metrics: { cpu: 0.42, memory: 0.71, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z17.string().describe("Service publicId.")
+    service_id: z19.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4101,9 +4402,9 @@ defineTool({
     'Example: get_service_metrics_history({ service_id: "svc_abc", from: "-1h" }) \u2192 60-ish points for the last hour.'
   ].join("\n"),
   input: {
-    service_id: z17.string().describe("Service publicId."),
-    from: z17.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
-    to: z17.string().optional().describe("ISO-8601 upper bound; defaults to now.")
+    service_id: z19.string().describe("Service publicId."),
+    from: z19.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
+    to: z19.string().optional().describe("ISO-8601 upper bound; defaults to now.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4147,8 +4448,8 @@ defineTool({
     'Example: update_service({ service_id: "svc_abc", name: "api-prod" }) \u2192 { service: { name: "api-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z17.string().describe("Service publicId."),
-    name: z17.string().min(1).max(60).describe("New service name (1\u201360 chars).")
+    service_id: z19.string().describe("Service publicId."),
+    name: z19.string().min(1).max(60).describe("New service name (1\u201360 chars).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4197,40 +4498,40 @@ defineTool({
     'Example: update_service_config({ service_id: "svc_abc", health_check_grace_period_sec: 180 }) \u2192 { config: { healthCheckGracePeriodSec: 180, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z17.string().describe("Service publicId."),
-    install_command: z17.string().nullable().optional().describe("Install shell command. Null clears."),
-    build_command: z17.string().nullable().optional().describe("Build shell command. Null clears."),
-    start_command: z17.string().nullable().optional().describe("Start shell command. Null clears."),
-    branch: z17.string().optional().describe("Git branch to track."),
-    root_directory: z17.string().optional().describe("Build context root."),
-    dockerfile_path: z17.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
-    auto_deploy: z17.boolean().optional().describe("Auto-deploy on push."),
-    health_check_path: z17.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
-    health_check_enabled: z17.boolean().optional().describe("Toggle health checking on/off."),
-    health_check_interval: z17.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
-    health_check_timeout: z17.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
-    health_check_grace_period_sec: z17.number().int().min(1).max(1800).optional().describe(
+    service_id: z19.string().describe("Service publicId."),
+    install_command: z19.string().nullable().optional().describe("Install shell command. Null clears."),
+    build_command: z19.string().nullable().optional().describe("Build shell command. Null clears."),
+    start_command: z19.string().nullable().optional().describe("Start shell command. Null clears."),
+    branch: z19.string().optional().describe("Git branch to track."),
+    root_directory: z19.string().optional().describe("Build context root."),
+    dockerfile_path: z19.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
+    auto_deploy: z19.boolean().optional().describe("Auto-deploy on push."),
+    health_check_path: z19.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
+    health_check_enabled: z19.boolean().optional().describe("Toggle health checking on/off."),
+    health_check_interval: z19.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
+    health_check_timeout: z19.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
+    health_check_grace_period_sec: z19.number().int().min(1).max(1800).optional().describe(
       "Startup grace period in seconds (1\u20131800). Raise this if the app needs more time to boot before health checks start counting failures."
     ),
-    memory_mb: z17.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
-    cpu_shares: z17.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
-    disk_size_gb: z17.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
-    port: z17.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
-    protocol: z17.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
-    restart_policy: z17.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
-    deploy_strategy: z17.enum(["rolling", "recreate"]).optional().describe(
+    memory_mb: z19.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
+    cpu_shares: z19.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
+    disk_size_gb: z19.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
+    port: z19.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
+    protocol: z19.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
+    restart_policy: z19.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
+    deploy_strategy: z19.enum(["rolling", "recreate"]).optional().describe(
       'How a deploy replaces the container. "rolling" (default) = start new, wait for healthy, switch traffic, stop old (zero downtime). "recreate" = stop old first, then start new (brief outage) \u2014 required for a container holding an exclusive lock on a mounted volume, which cannot deploy at all under rolling.'
     ),
-    pre_deploy_command: z17.string().optional().describe("Shell command run before the new release accepts traffic."),
-    instance_count: z17.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
-    min_instances: z17.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
-    max_instances: z17.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
-    scale_cpu_threshold: z17.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
-    scale_memory_threshold: z17.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
-    log_filter_rules: z17.array(
-      z17.object({
-        pattern: z17.string().min(1).max(200),
-        action: z17.enum(["drop", "downgrade"])
+    pre_deploy_command: z19.string().optional().describe("Shell command run before the new release accepts traffic."),
+    instance_count: z19.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
+    min_instances: z19.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
+    max_instances: z19.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
+    scale_cpu_threshold: z19.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
+    scale_memory_threshold: z19.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
+    log_filter_rules: z19.array(
+      z19.object({
+        pattern: z19.string().min(1).max(200),
+        action: z19.enum(["drop", "downgrade"])
       })
     ).max(50).optional().describe(
       "Runtime-log filter rules. Empty array [] clears all rules. Each pattern is case-insensitive substring match against the message."
@@ -4327,7 +4628,7 @@ defineTool({
     'Example: suspend_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z17.string().describe("Service publicId.")
+    service_id: z19.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4351,7 +4652,7 @@ defineTool({
     'Example: resume_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z17.string().describe("Service publicId.")
+    service_id: z19.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4377,7 +4678,7 @@ defineTool({
     'Example: delete_service({ service_id: "svc_abandoned" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z17.string().describe("Service publicId.")
+    service_id: z19.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4414,16 +4715,16 @@ defineTool({
     '  - Just count error lines without fetching them: get_service_logs({ service_id: "svc_abc", level: "error", since: "-5m", count_only: true }) \u2192 { count: 47 }'
   ].join("\n"),
   input: {
-    service_id: z17.string().describe("Service publicId."),
-    lines: z17.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
-    since: z17.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z17.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z17.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z17.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
+    service_id: z19.string().describe("Service publicId."),
+    lines: z19.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
+    since: z19.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z19.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z19.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z19.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
       "Filter by structured JSON log level (pino/bunyan/severity). Falls back to a stream-alias hint for plain-text logs (info/debug\u2192stdout, warn/error/fatal\u2192stderr)."
     ),
-    search: z17.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z17.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
+    search: z19.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z19.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4472,14 +4773,14 @@ defineTool({
     'Example: get_service_logs_bulk({ service_ids: ["svc_api", "svc_worker"], level: "error", since: "-15m", count_only: true }) \u2192 { results: { svc_api: { count: 0 }, svc_worker: { count: 12 } } }.'
   ].join("\n"),
   input: {
-    service_ids: z17.array(z17.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
-    lines_per_service: z17.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
-    since: z17.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z17.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z17.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z17.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
-    search: z17.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z17.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
+    service_ids: z19.array(z19.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
+    lines_per_service: z19.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
+    since: z19.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z19.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z19.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z19.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
+    search: z19.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z19.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4525,7 +4826,7 @@ defineTool({
 });
 
 // src/tools/uptime.ts
-import { z as z18 } from "zod";
+import { z as z20 } from "zod";
 var STATUS_MEANING = [
   "Status vocabulary: `up` answering as expected \xB7 `down` failed the threshold and an alert is open \xB7 `unknown` not probed yet \xB7 `unresolvable` the service has no active domain to request \xB7 `paused` the service is not meant to be answering (suspended, mid-deploy, never deployed) OR it sleeps when idle and probing it would keep it awake."
 ].join("\n");
@@ -4545,7 +4846,7 @@ defineTool({
     "",
     "Example: get_uptime_check({ serviceId: 48 }) \u2192 { check: { path: '/healthz', status: 'down', consecutiveFailures: 5, lastError: 'No response within 10000ms', lastChangedAt: '2026-08-21T04:12:00Z' } }."
   ].join("\n"),
-  input: { serviceId: z18.number().int().positive() },
+  input: { serviceId: z20.number().int().positive() },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
     const response = await ctx.api.get(
@@ -4574,6 +4875,8 @@ defineTool({
     "",
     'Only service types with a public URL can be checked (web services and static sites). A worker, cron job or private service is refused with 400 \u2014 a check on one could only ever report "no domain to check", which reads as a broken feature rather than an inapplicable one.',
     "",
+    "For a site HostStack does NOT host, there is no serviceId to pass: use set_site_uptime_check with its analytics siteId instead. That path needs the domain proven first (verify_site_domain), because the host it probes comes from the site row rather than from a domain the platform already vouches for.",
+    "",
     "IMPORTANT: changing the shape of a check RESETS its accumulated state (status, consecutive failures, open alert). A check whose path or expected status just changed has not observed the new check failing, so carrying failures forward would alert about a condition that was never measured. Pass the full shape you want, not a partial edit of an unknown current state \u2014 read it with get_uptime_check first if that matters.",
     "",
     "`path` is a path, not a URL: the host comes from the service's primary domain at probe time, so moving the service to a new domain moves the check with it.",
@@ -4589,14 +4892,14 @@ defineTool({
     "Example: set_uptime_check({ serviceId: 48, path: '/healthz', intervalSeconds: 60, failureThreshold: 3 }) \u2192 { check: { status: 'unknown', \u2026 } }."
   ].join("\n"),
   input: {
-    serviceId: z18.number().int().positive(),
-    enabled: z18.boolean().optional(),
-    path: z18.string().max(500).optional().describe('Must start with /. Default "/".'),
-    method: z18.enum(["GET", "HEAD"]).optional(),
-    expectedStatus: z18.number().int().min(100).max(599).optional(),
-    timeoutMs: z18.number().int().min(1e3).max(6e4).optional(),
-    intervalSeconds: z18.number().int().min(30).max(3600).optional(),
-    failureThreshold: z18.number().int().min(1).max(10).optional()
+    serviceId: z20.number().int().positive(),
+    enabled: z20.boolean().optional(),
+    path: z20.string().max(500).optional().describe('Must start with /. Default "/".'),
+    method: z20.enum(["GET", "HEAD"]).optional(),
+    expectedStatus: z20.number().int().min(100).max(599).optional(),
+    timeoutMs: z20.number().int().min(1e3).max(6e4).optional(),
+    intervalSeconds: z20.number().int().min(30).max(3600).optional(),
+    failureThreshold: z20.number().int().min(1).max(10).optional()
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4625,7 +4928,7 @@ defineTool({
     "",
     "Example: delete_uptime_check({ serviceId: 48 }) \u2192 { success: true }."
   ].join("\n"),
-  input: { serviceId: z18.number().int().positive() },
+  input: { serviceId: z20.number().int().positive() },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
     await ctx.api.delete(`/api/services/${teamId}/${args.serviceId}/uptime-check`);
@@ -4634,7 +4937,7 @@ defineTool({
 });
 
 // src/tools/volumes.ts
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 var MIN_VOLUME_SIZE_GB = 10;
 defineTool({
   name: "list_volumes",
@@ -4652,7 +4955,7 @@ defineTool({
     'Example: list_volumes({ service_id: "svc_abc" }) \u2192 { items: [{ name: "data", mountPath: "/var/data", sizeGb: 10, status: "active" }] }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z21.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4681,15 +4984,15 @@ defineTool({
     'Example: create_volume({ service_id: "svc_abc", name: "data", mount_path: "/var/data", size_gb: 10 }) \u2192 { volume: { name: "data", mountPath: "/var/data", sizeGb: 10, status: "pending" } }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId."),
-    name: z19.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
-    mount_path: z19.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
+    service_id: z21.string().describe("Service publicId."),
+    name: z21.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
+    mount_path: z21.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
     // 10 GB is the real floor: the block-storage backend rejects anything
     // smaller. Advertising 1 GB here (and defaulting to it) meant taking the
     // defaults produced a volume that provisioned with `Hetzner API error:
     // 422` on the NEXT deploy, with nothing tying the failure back to the
     // size. Reject it at the call instead.
-    size_gb: z19.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
+    size_gb: z21.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
       `Disk size in GB (minimum ${MIN_VOLUME_SIZE_GB}, default ${MIN_VOLUME_SIZE_GB}, max 100 via MCP).`
     )
   },
@@ -4727,10 +5030,10 @@ defineTool({
     'Example: update_volume({ service_id: "svc_abc", volume_id: "vol_xyz", size_gb: 20 }) \u2192 { volume: { sizeGb: 20, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId."),
-    volume_id: z19.string().describe("Volume publicId (e.g. vol_\u2026)."),
-    mount_path: z19.string().startsWith("/").max(500).optional().describe("New mount path."),
-    size_gb: z19.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`)
+    service_id: z21.string().describe("Service publicId."),
+    volume_id: z21.string().describe("Volume publicId (e.g. vol_\u2026)."),
+    mount_path: z21.string().startsWith("/").max(500).optional().describe("New mount path."),
+    size_gb: z21.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`)
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4768,8 +5071,8 @@ defineTool({
     'Example: delete_volume({ service_id: "svc_abc", volume_id: "vol_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId."),
-    volume_id: z19.string().describe("Volume publicId.")
+    service_id: z21.string().describe("Service publicId."),
+    volume_id: z21.string().describe("Volume publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();