@hoststack.dev/mcp 0.19.0 → 0.20.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { HostStack } from "@hoststack.dev/sdk";
 
 // src/version.ts
-var MCP_VERSION = true ? "0.19.0" : "0.0.0-dev";
+var MCP_VERSION = true ? "0.20.0" : "0.0.0-dev";
 var USER_AGENT = `hoststack-mcp/${MCP_VERSION}`;
 
 // src/api-client.ts
@@ -1724,9 +1724,11 @@ defineTool({
     "",
     "When to use: enumerate live domains, audit DNS verification status, or find which service a hostname resolves to before troubleshooting routing.",
     "",
-    "Returns: { items: Domain[] } \u2014 id, publicId, hostname, serviceId, verified, dnsTargets, sslStatus, createdAt.",
+    "Returns: { items: Domain[] } \u2014 id, publicId, hostname, serviceId, verified, dnsTargets, sslStatus, isPrimary, createdAt.",
     "",
-    'Example: list_domains() \u2192 { items: [{ hostname: "api.example.com", verified: true, sslStatus: "active", \u2026 }] }'
+    "`isPrimary` is the one the platform treats as the service's address: what `${service.url}` resolves to, what its uptime check probes, and what the monitoring page shows. When NO domain on a service is primary \u2014 the default, since nothing sets it automatically \u2014 that choice falls to the OLDEST domain on the service, which on a renamed host is usually the retired alias rather than the canonical name. Nominate one with update_domain.",
+    "",
+    'Example: list_domains() \u2192 { items: [{ hostname: "api.example.com", verified: true, sslStatus: "active", isPrimary: false, \u2026 }] }'
   ].join("\n"),
   input: {},
   handler: async (_args, ctx) => {
@@ -1802,6 +1804,54 @@ defineTool({
     });
   }
 });
+defineTool({
+  name: "update_domain",
+  category: "domains",
+  description: [
+    "Change a domain's settings \u2014 most usefully, nominate it as the service's PRIMARY hostname.",
+    "",
+    "When to use: a service answers on more than one hostname and you need to say which one is canonical \u2014 before setting an uptime check on it, after renaming a storefront, or when `${service.url}` is resolving to the wrong name. Also for toggling https on a domain or turning one into a redirect.",
+    "",
+    "WHY PRIMARY MATTERS. A service can answer on several hostnames that behave differently \u2014 the canonical one serves the page, a retired alias 301s to it \u2014 and three parts of the platform have to pick ONE of them: the address a service advertises to itself in `${service.url}`, the host its uptime check probes, and the hostname shown on the monitoring page. All three pick the primary, and fall back to the OLDEST domain when no primary is nominated. So a service with two hostnames and no primary has its uptime check pointed at whichever domain was added first, which may well be the alias that redirects \u2014 and `set_uptime_check` takes a path, never a host, so nominating the primary here is the only way to say which name is checked.",
+    "",
+    "One primary per service: promoting a domain demotes its sibling in the same write, so there is never a pair to choose between.",
+    "",
+    "Inputs:",
+    "  - domain_id: publicId of the domain (from list_domains).",
+    "  - isPrimary: make this the service's primary hostname.",
+    "  - sslEnabled: serve it over https. Applies on the next deploy, which this triggers.",
+    "  - redirectTo: send every request to an absolute http(s) URL instead of the service. Pass null to clear.",
+    "",
+    "Returns: { domain } \u2014 the updated row, including isPrimary.",
+    "",
+    'Example: update_domain({ domain_id: "dom_xyz", isPrimary: true }) \u2192 { domain: { hostname: "shop.example.com", isPrimary: true } }'
+  ].join("\n"),
+  input: {
+    domain_id: z9.string().describe("Domain publicId."),
+    isPrimary: z9.boolean().optional(),
+    sslEnabled: z9.boolean().optional(),
+    redirectTo: z9.string().max(2e3).nullable().optional().describe("Absolute http(s) URL, or null to clear.")
+  },
+  handler: async (args, ctx) => {
+    const { domain_id: domainId, ...patch } = args;
+    const body = Object.fromEntries(
+      Object.entries(patch).filter(([, v]) => v !== void 0)
+    );
+    if (Object.keys(body).length === 0) {
+      return respond({
+        summary: "Nothing to change \u2014 pass isPrimary, sslEnabled or redirectTo.",
+        data: { ok: false }
+      });
+    }
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.domains.update(teamId, domainId, body);
+    const domain = shapeDomain(response.domain);
+    return respond({
+      summary: body.isPrimary === true ? `${String(domain.hostname ?? domainId)} is now the primary hostname for its service \u2014 it is what \`\${service.url}\` resolves to and what the uptime check probes.` : `Updated ${String(domain.hostname ?? domainId)}.`,
+      data: { domain }
+    });
+  }
+});
 defineTool({
   name: "remove_domain",
   category: "domains",
@@ -2157,6 +2207,15 @@ defineTool({
 
 // src/tools/analytics.ts
 import { z as z12 } from "zod";
+
+// src/lib/format.ts
+var MCP_LOCALE = "en-IE";
+var COUNT_FORMAT = new Intl.NumberFormat(MCP_LOCALE);
+function formatCount(value) {
+  return COUNT_FORMAT.format(value);
+}
+
+// src/tools/analytics.ts
 async function resolveSiteIds(domains, teamId, api) {
   if (!domains || domains.length === 0) return void 0;
   const { sites } = await api.get(`/api/analytics/${teamId}/sites`);
@@ -2175,6 +2234,10 @@ async function resolveSiteIds(domains, teamId, api) {
   }
   return ids.join(",");
 }
+var ALLOWED_ORIGINS_INPUT = z12.array(z12.string().trim().min(1).max(253)).max(20).describe(
+  'Extra origins allowed to post events, beyond the site domain and its subdomains (both are always allowed). Bare hostnames, e.g. ["staging.example.com", "localhost:5173"]. Replaces the whole list; pass [] to clear it.'
+);
+var RETENTION_DAYS_INPUT = z12.number().int().positive().describe("How many days of raw events to keep. Rollups outlive this.");
 defineTool({
   name: "list_analytics_sites",
   category: "analytics",
@@ -2210,7 +2273,9 @@ defineTool({
     "",
     "The ingest endpoint answers HTTP 204 to a real site key and to a typo alike \u2014 deliberately, so it cannot be used to enumerate keys \u2014 which means five completely different situations produce the same empty chart: a stale or mistyped key in the deployed snippet, an origin the site does not allow, a blown hourly quota, events blocked in the browser before they leave (CORS, ad blocker, CSP), and simply no visitors yet. This tool tells them apart.",
     "",
-    "Returns: health ('receiving' | 'quiet' | 'refusing' | 'never'), a headline and detail sentence, lastEventAt, lastRefusalAt/Reason/Origin, refusedRecently (a 7-day tally by reason), the site key the snippet must carry, allowed origins, and quota usage this hour.",
+    "Returns: health ('receiving' | 'quiet' | 'refusing' | 'never'), a headline and detail sentence, lastEventAt, lastRefusalAt/Reason/Origin, refusedRecently (a 7-day tally by reason), refusedOrigins (which origins were turned away for bad_origin and how often, over the same window), the site key the snippet must carry, allowed origins, and quota usage this hour.",
+    "",
+    "Use refusedOrigins, not lastRefusalOrigin, to decide what to allow: lastRefusalOrigin is the newest refusal of ANY reason, and bots outnumber everything, so one crawler hit overwrites the origin behind a real outage. Feed what you find to update_analytics_site \u2014 and if the origin is NOT the user's, the site key is public by design and somebody has pasted it into their own page, so the answer is to rotate the key rather than allow them.",
     "",
     "health='never' means nothing has EVER reached ingest for this key, so the request is not leaving the browser \u2014 check the snippet is in the deployed HTML and tell the user to add `data-debug` to the script tag, which makes the tracker log its resolved endpoint and every accepted 204 to the console.",
     "",
@@ -2304,7 +2369,7 @@ defineTool({
         "the filters you passed were NOT applied \u2014 they only work on shorter ranges"
       );
     }
-    const summary = `${current.pageviews.toLocaleString()} pageviews from ${current.visitors.toLocaleString()} visitors over ${response.range}${caveats.length > 0 ? `. Note: ${caveats.join("; ")}.` : "."}`;
+    const summary = `${formatCount(current.pageviews)} pageviews from ${formatCount(current.visitors)} visitors over ${response.range}${caveats.length > 0 ? `. Note: ${caveats.join("; ")}.` : "."}`;
     return respond({ summary, data: response });
   }
 });
@@ -2318,7 +2383,9 @@ defineTool({
     "",
     "If the domain is already attached to a service on this team, the new site links itself to that service and appears on its Analytics tab. Nothing is counted until the snippet is actually on the page \u2014 creating the site alone produces an empty dashboard, which is expected, not a fault.",
     "",
-    'Inputs: domain (required, bare hostname \u2014 "example.com", not a URL), name (optional display name, defaults to the domain).',
+    'Inputs: domain (required, bare hostname \u2014 "example.com", not a URL), name (optional display name, defaults to the domain), allowed_origins (optional extra origins beyond the domain and its subdomains), retention_days (optional raw-event retention).',
+    "",
+    "To change any of these later \u2014 or to attach the site to a service \u2014 use update_analytics_site. Creating is not the only chance to set them.",
     "",
     "Returns: the created site (id, domain, name, ingestKey, retentionDays) and the ready-made `snippet` to paste into the page \u2014 the key is in that snippet, so hand it over rather than describing it.",
     "",
@@ -2326,13 +2393,17 @@ defineTool({
   ].join("\n"),
   input: {
     domain: z12.string().min(1).max(253).describe("Bare hostname, e.g. example.com"),
-    name: z12.string().min(1).max(100).optional().describe("Display name. Defaults to the domain.")
+    name: z12.string().min(1).max(100).optional().describe("Display name. Defaults to the domain."),
+    allowed_origins: ALLOWED_ORIGINS_INPUT.optional(),
+    retention_days: RETENTION_DAYS_INPUT.optional()
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
     const site = await ctx.api.post(`/api/analytics/${teamId}/sites`, {
       domain: args.domain,
-      ...args.name ? { name: args.name } : {}
+      ...args.name ? { name: args.name } : {},
+      ...args.allowed_origins ? { allowedOrigins: args.allowed_origins } : {},
+      ...args.retention_days ? { retentionDays: args.retention_days } : {}
     });
     const snippet = `<script defer src="https://hoststack.dev/t.js" data-site-key="${site.ingestKey}"></script>`;
     return respond({
@@ -2341,6 +2412,53 @@ defineTool({
     });
   }
 });
+defineTool({
+  name: "update_analytics_site",
+  category: "analytics",
+  description: [
+    "Change an existing analytics site: its allowed origins, display name, retention, or which service it belongs to.",
+    "",
+    "When to use: events are being refused with `bad_origin` because they come from an origin the site does not list (check_analytics_site names it), a site needs a clearer name, retention should change, or the site should appear on a service's Analytics tab.",
+    "",
+    "Inputs: domain (required \u2014 the site to change, by its bare hostname), then any of allowed_origins, name, retention_days, service_id. Everything is optional except domain; only the fields you pass are touched.",
+    "",
+    "allowed_origins REPLACES the list rather than appending, so read the current one from list_analytics_sites first and send it back with your addition. The site domain and its subdomains are always allowed and never need listing.",
+    "",
+    "Returns: { site } \u2014 the site as it now stands.",
+    "",
+    "Example: update_analytics_site({ domain: 'example.com', allowed_origins: ['staging.example.com'] }) \u2192 { site: { domain: 'example.com', allowedOrigins: ['staging.example.com'], \u2026 } }."
+  ].join("\n"),
+  input: {
+    domain: z12.string().min(1).max(253).describe("Bare hostname of a site this team tracks."),
+    allowed_origins: ALLOWED_ORIGINS_INPUT.optional(),
+    name: z12.string().trim().min(1).max(100).optional().describe("New display name."),
+    retention_days: RETENTION_DAYS_INPUT.optional(),
+    service_id: z12.number().int().positive().nullable().optional().describe("Numeric service id to attach this site to, or null to detach it.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const siteId = await resolveSiteIds([args.domain], teamId, ctx.api);
+    const patch = {};
+    if (args.allowed_origins !== void 0) patch["allowedOrigins"] = args.allowed_origins;
+    if (args.name !== void 0) patch["name"] = args.name;
+    if (args.retention_days !== void 0) patch["retentionDays"] = args.retention_days;
+    if (args.service_id !== void 0) patch["serviceId"] = args.service_id;
+    if (Object.keys(patch).length === 0) {
+      throw new Error(
+        "Nothing to update. Pass at least one of allowed_origins, name, retention_days or service_id."
+      );
+    }
+    const site = await ctx.api.patch(
+      `/api/analytics/${teamId}/sites/${siteId}`,
+      patch
+    );
+    const changed = Object.keys(patch).join(", ");
+    return respond({
+      summary: `Updated ${site.domain} (${changed}).`,
+      data: { site: shape(site) }
+    });
+  }
+});
 defineTool({
   name: "verify_site_domain",
   category: "analytics",
@@ -2386,6 +2504,42 @@ defineTool({
     });
   }
 });
+defineTool({
+  name: "get_site_uptime_check",
+  category: "analytics",
+  description: [
+    "Read a site's uptime check without touching it.",
+    "",
+    'When to use: answer "has it probed yet?", "is it up?", "how many failures in a row?" \u2014 the site counterpart of get_uptime_check.',
+    "",
+    'READ THIS BEFORE REACHING FOR set_site_uptime_check TO INSPECT ONE. The setter RESETS the accumulated state it returns (status back to "unknown", consecutiveFailures to 0, lastCheckedAt to null), because a check whose shape just changed has not observed the new shape failing. So using it to look at a check is what stops the check ever showing a probe: every read restarts the measurement, and a working check reads as one that never runs. This tool exists because that trap cost a real investigation an afternoon.',
+    "",
+    "Returns: { check } \u2014 enabled, path, method, expectedStatus, timeoutMs, intervalSeconds, failureThreshold, plus live state: status ('up' | 'down' | 'unknown'), consecutiveFailures, lastCheckedAt, lastStatusCode, lastLatencyMs, lastError, lastChangedAt. `null` when the site has no check.",
+    "",
+    "Example: get_site_uptime_check({ siteId: 12 }) \u2192 { check: { status: 'up', lastStatusCode: 200, lastCheckedAt: '2026-09-09T05:27:34Z' } }."
+  ].join("\n"),
+  input: {
+    siteId: z12.number().int().positive()
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.get(
+      `/api/analytics/${teamId}/sites/${args.siteId}/uptime-check`
+    );
+    if (!response.check) {
+      return respond({
+        summary: "No uptime check on this site \u2014 nothing is watching it.",
+        data: { check: null }
+      });
+    }
+    const check = shape(response.check);
+    const lastCheckedAt = check.lastCheckedAt;
+    return respond({
+      summary: `Uptime check is ${String(check.status ?? "unknown")}${lastCheckedAt ? `, last probed ${String(lastCheckedAt)}` : ", not probed yet"}.`,
+      data: { check }
+    });
+  }
+});
 defineTool({
   name: "set_site_uptime_check",
   category: "analytics",
@@ -2394,7 +2548,9 @@ defineTool({
     "",
     "When to use: the user has a site running somewhere else (their own box, another provider) and wants to know when it goes down. This is the one observability capability an off-platform site cannot provide for itself: analytics is a script tag and error reporting is an HTTP POST, but an outside-in probe has to come from outside.",
     "",
-    "For a site that IS a HostStack service, use set_uptime_check with its serviceId instead \u2014 that one follows the service if its domain changes.",
+    "Works on a site HostStack DOES host too, and that is not a worse option: this check names ONE hostname \u2014 the site's own proven domain \u2014 where set_uptime_check follows whichever of the service's domains is primary at probe time. A service answering on a canonical host plus a 301 alias has no single correct expectedStatus, so a site check per hostname is how each one gets asserted, and nothing in the prober treats a service-backed site differently. Use set_uptime_check when the check should follow the service's domain; use this one when a named host is the point.",
+    "",
+    'To READ a check, call get_site_uptime_check. Changing the shape of a check RESETS its accumulated state (status to "unknown", consecutiveFailures to 0, lastCheckedAt to null) \u2014 the new shape has not been measured yet, so carrying failures forward would alert about a condition nobody observed. A write that resolves to the shape ALREADY STORED changes nothing and leaves that state alone. The inputs are defaults rather than a partial edit, though: omitting intervalSeconds on a check currently set to 30 resolves to 60, which IS a change.',
     "",
     "REQUIRES a proven domain. Call verify_site_domain first if `domainProven` is false; an unverified target is refused with 400. This is not paperwork: an uptime check makes the control plane fetch the hostname every interval, forever, from our IP, so it must be a name the team has shown it owns.",
     "",
@@ -2423,9 +2579,11 @@ defineTool({
       `/api/analytics/${teamId}/sites/${siteId}/uptime-check`,
       body
     );
+    const check = shape(response.check);
+    const probed = check["lastCheckedAt"] !== null && check["lastCheckedAt"] !== void 0;
     return respond({
-      summary: "Uptime check saved. It will start reporting within a minute or two.",
-      data: { check: shape(response.check) }
+      summary: probed ? `Uptime check saved \u2014 the shape was already stored, so nothing was reset: still ${String(check["status"])}, last probed ${String(check["lastCheckedAt"])}.` : 'Uptime check saved, and not probed yet \u2014 "unknown" with no lastCheckedAt is the state of a check that has not run once, not a broken one. It reports within a minute or two: read it with get_site_uptime_check, never by saving it again.',
+      data: { check }
     });
   }
 });
@@ -2853,11 +3011,17 @@ var NOTIFICATION_EVENTS = [
   "service.suspended",
   "service.resumed",
   "service.restart_failed",
-  "service.auto_suspended",
+  "service.no_running_container",
+  "service.health_check_failed",
   "service.acme_cert_failed",
   "service.resource_alert",
+  "service.pressure_sustained",
+  "service.pressure_recovered",
   "service.uptime_down",
   "service.uptime_recovered",
+  "watchdog.reported_down",
+  "watchdog.reported_recovered",
+  "watchdog.silent",
   "error.issue_new",
   "error.issue_regressed",
   "git.auth_failed",
@@ -2869,7 +3033,13 @@ var NOTIFICATION_EVENTS = [
   "devenv.task.needs_input",
   "devenv.task.finished",
   "database.backup_failed",
+  "database.backup_overdue",
+  "database.failed",
   "database.restore_failed",
+  "volume.backup_failed",
+  "volume.backup_overdue",
+  "domain.registrant_verification_lapsed",
+  "service.auto_restarted",
   "machine.offline",
   "machine.online",
   "billing.invoice",
@@ -4092,10 +4262,12 @@ defineTool({
     "",
     "This resizes a cloud Dev Box, NOT a project deploy environment.",
     "",
-    "When to use: a Dev Box OOM-killed (see exitReason/recommendedSize from list_dev_environments), or you just want more headroom. This changes the SIZE TIER \u2014 unlike per-config memory/CPU overrides, which are clamped to the current tier and so cannot grow a box past it.",
+    "When to use: a Dev Box OOM-killed (see exitReason/recommendedSize from list_dev_environments), or you just want more headroom. This changes the SIZE TIER.",
     "",
     "How it applies: the new tier's memory + CPU take effect LIVE on the running container (no recreate, no dropped shell sessions); a larger disk takes effect on the next recreate (suspend\u2192resume). Dev boxes are floored to the OOM-safe minimum size server-side.",
     "",
+    "The tier is not always the container's limit, so check `effectiveMemoryMb` from list_dev_environments rather than assuming: a dedicated (Pro) tier resolves ~1.5 GB below nominal for agent headroom, and a per-service memory override REPLACES the tier figure rather than merely clamping to it. An UPSIZE now retires an override that would hold the box below its new tier; a re-assert of the SAME tier does not, so on a box already at the top tier a resize cannot lift an override \u2014 clear it with a config PATCH of memoryMb to 512 (the legacy floor, which means \"no override\"), or use the Remove-cap button on the box's Settings \u2192 General tab. `memoryPinnedBelowTier: true` is how you tell that case apart from a box that is genuinely maxed out.",
+    "",
     "Inputs:",
     "  - service_id: the box to resize \u2014 numeric id or publicId.",
     '  - size: target tier \u2014 one of the service catalog sizes (e.g. "standard", "large", "xlarge").',
@@ -4133,7 +4305,9 @@ defineTool({
     "",
     `When to use: "show my dev environments", before opening/tearing one down, to find a box's id.`,
     "",
-    'Returns: { items: [{ ...service, devUrl, databases, exitReason, recommendedSize }] } where `databases` lists the companion engines wired into the box (e.g. ["postgres","redis"]). `exitReason` is "oom_killed" / "crashed" / null for the box\'s last container exit; when it is "oom_killed", `recommendedSize` is the next tier up to rescale to (use resize_dev_environment).',
+    'Returns: { items: [{ ...service, devUrl, databases, exitReason, recommendedSize, effectiveMemoryMb, memoryPinnedBelowTier }] } where `databases` lists the companion engines wired into the box (e.g. ["postgres","redis"]). `exitReason` is "oom_killed" / "crashed" / null for the box\'s last container exit; when it is "oom_killed", `recommendedSize` is the next tier up to rescale to (use resize_dev_environment).',
+    "",
+    '`effectiveMemoryMb` is the container\'s REAL ceiling \u2014 what `/sys/fs/cgroup/memory.max` reads inside the box \u2014 and is the number to size any in-box work against. Do NOT derive it from `plan`: a dedicated (Pro) tier sits ~1.5 GB below nominal, and a per-service override replaces the tier figure outright. When `memoryPinnedBelowTier` is true an override, not the tier, is the cap, so `recommendedSize: null` means "nothing bigger to sell you" rather than "nothing you can do" \u2014 see resize_dev_environment for how to lift it.',
     "",
     "Example: list_dev_environments() \u2192 every dev box for the active team."
   ].join("\n"),
@@ -4150,7 +4324,12 @@ defineTool({
           devUrl: env.devUrl ?? null,
           databases: env.databases ?? [],
           exitReason: env.exitReason ?? null,
-          recommendedSize: env.recommendedSize ?? null
+          recommendedSize: env.recommendedSize ?? null,
+          // The number an agent should size its work against. Absent it,
+          // the only honest way to learn a box's ceiling was to shell in
+          // and read the cgroup — so every box rediscovered its own.
+          effectiveMemoryMb: env.effectiveMemoryMb ?? null,
+          memoryPinnedBelowTier: env.memoryPinnedBelowTier ?? false
         }))
       }
     });
@@ -4336,7 +4515,7 @@ defineTool({
     "Inputs:",
     '  - service_id: publicId of the service (e.g. "svc_abc123").',
     "",
-    'Returns: { service: Service, config: ServiceConfig } \u2014 service has type/status/runtime/repoUrl/branch/autoDeploy/region/plan/timestamps; config has memoryMb, cpuShares, diskSizeGb, port, protocol, healthCheckEnabled, healthCheckInterval, healthCheckTimeout, healthCheckGracePeriodSec, restartPolicy, deployStrategy ("rolling" | "recreate"), preDeployCommand, min/maxInstances, scale thresholds.',
+    'Returns: { service: Service, config: ServiceConfig } \u2014 service has type/status/runtime/repoUrl/branch/autoDeploy/region/plan/timestamps; config has memoryMb, cpuShares, diskSizeGb, port, protocol, healthCheckEnabled, healthCheckInterval, healthCheckTimeout, healthCheckGracePeriodSec, allowSearchIndexing, restartPolicy, deployStrategy ("rolling" | "recreate"), preDeployCommand, min/maxInstances, scale thresholds.',
     "",
     'Example: get_service({ service_id: "svc_abc" }) \u2192 { service: { type: "web", status: "running", \u2026 }, config: { healthCheckGracePeriodSec: 120, \u2026 } }'
   ].join("\n"),
@@ -4395,11 +4574,15 @@ defineTool({
     '  - from: ISO-8601 lower bound OR relative offset like "-15m" / "-2h" / "-7d".',
     "  - to: ISO-8601 upper bound (or relative offset). Defaults to now.",
     "",
-    "Resolution: \u22647d \u2192 raw samples (~minute granularity), \u226430d \u2192 hourly pre-aggregates, >30d \u2192 daily. Up to ~500 points returned.",
+    "Resolution: \u22647d \u2192 raw samples (one per ~30s), >7d \u2192 hourly pre-aggregates, >30d \u2192 daily. At most 300 points are returned, so a window wider than ~2.5h is thinned to fit.",
+    "",
+    "`cpuPercent` is the PEAK of whatever the point covers, and 100 means one host CORE \u2014 not 100% of the service. A `micro` (500 millicores) is capped by its cgroup at ~50, so ~50 IS that plan pegged. To compare against a `service.pressure_sustained` alert, which reports a share of the plan allowance, multiply by 1000/cpuMillicores (the alert ships that denominator in its metadata).",
+    "",
+    "Memory is the reading at that point, NOT a peak \u2014 so a memory number here can sit below an alert that averaged the hour.",
     "",
     "Returns: { history: Array<{ timestamp, cpuPercent, memoryUsedMb, memoryLimitMb, networkRxBytes, networkTxBytes, diskUsedMb }> }.",
     "",
-    'Example: get_service_metrics_history({ service_id: "svc_abc", from: "-1h" }) \u2192 60-ish points for the last hour.'
+    'Example: get_service_metrics_history({ service_id: "svc_abc", from: "-1h" }) \u2192 ~120 points for the last hour.'
   ].join("\n"),
   input: {
     service_id: z19.string().describe("Service publicId."),
@@ -4477,6 +4660,7 @@ defineTool({
     "  - auto_deploy (optional): boolean \u2014 auto-deploy on git push.",
     '  - health_check_path (optional): HTTP path the platform GETs to verify liveness (e.g. "/health"). Pass null for TCP-only check.',
     "  - health_check_enabled (optional): boolean \u2014 toggle health checking on/off.",
+    "  - allow_search_indexing (optional): boolean \u2014 let search engines index the free *.hoststack.dev platform URL. Off by default; the platform URL is served with X-Robots-Tag: noindex so a site does not rank on a hostname it does not own. Custom domains are always indexable and unaffected. Applies on the next deploy.",
     "  - health_check_interval (optional): integer 5\u2013300 seconds \u2014 how often the check runs.",
     "  - health_check_timeout (optional): integer 1\u201360 seconds \u2014 single-attempt timeout.",
     '  - health_check_grace_period_sec (optional): integer 1\u20131800 seconds \u2014 startup tolerance before failures count. RAISE THIS (e.g. 180) when the agent reports "Health check timed out" on a cold-boot app (Bun + Vite SSR typically need 90\u2013180s).',
@@ -4491,7 +4675,7 @@ defineTool({
     "  - instance_count (optional): integer 1\u201350 \u2014 pin both min and max instances to this value.",
     "  - min_instances, max_instances (optional): integers \u2014 autoscale bounds. Use instead of instance_count when you want a range.",
     "  - scale_cpu_threshold, scale_memory_threshold (optional): integer 10\u2013100 \u2014 autoscale trigger percentage.",
-    '  - log_filter_rules (optional): list of { pattern, action } rules applied to runtime logs at query time. Pattern matches the message by case-insensitive substring; action is "drop" (filter out) or "downgrade" (flip stderr \u2192 stdout so it stops looking like an error). Pass [] to clear all rules. Capped at 50 rules.',
+    `  - log_filter_rules (optional): list of { pattern, action } rules applied at read time \u2014 to get_service_logs (tail AND count) and to the dashboard's live stream alike. Pattern matches the message by case-insensitive substring, literally (a % or _ is not a wildcard); action is "drop" (filter out) or "downgrade" (flip stderr \u2192 stdout so it stops looking like an error). Stored lines are never altered, so removing a rule re-exposes everything it was hiding. Pass [] to clear all rules. Capped at 50 rules.`,
     "",
     "Returns: { service?: Service, config?: ServiceConfig } \u2014 whichever rows were touched.",
     "",
@@ -4508,6 +4692,9 @@ defineTool({
     auto_deploy: z19.boolean().optional().describe("Auto-deploy on push."),
     health_check_path: z19.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
     health_check_enabled: z19.boolean().optional().describe("Toggle health checking on/off."),
+    allow_search_indexing: z19.boolean().optional().describe(
+      "Let search engines index the free *.hoststack.dev platform URL (off by default). Custom domains are always indexable. Applies on the next deploy."
+    ),
     health_check_interval: z19.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
     health_check_timeout: z19.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
     health_check_grace_period_sec: z19.number().int().min(1).max(1800).optional().describe(
@@ -4554,6 +4741,8 @@ defineTool({
     const configUpdate = {};
     if (args.health_check_enabled !== void 0)
       configUpdate["healthCheckEnabled"] = args.health_check_enabled;
+    if (args.allow_search_indexing !== void 0)
+      configUpdate["allowSearchIndexing"] = args.allow_search_indexing;
     if (args.health_check_interval !== void 0)
       configUpdate["healthCheckInterval"] = args.health_check_interval;
     if (args.health_check_timeout !== void 0)
@@ -4704,7 +4893,9 @@ defineTool({
     '  - stream (optional): "stdout" | "stderr". Omit to combine.',
     "  - level (optional): real log level \u2014 trace/debug/info/warn/error/fatal. For structured JSON logs (pino, bunyan, OpenTelemetry severity) this filters on the parsed inner level field. For plain text logs it falls back to a stream-alias hint (info/debug \u2192 stdout, warn/error/fatal \u2192 stderr).",
     "  - search (optional): case-insensitive substring grep, \u2264100 chars.",
-    '  - count_only (optional): when true, returns { count } only \u2014 much cheaper for "how many error lines in last 5m" polling.',
+    '  - count_only (optional): when true, returns { count } only \u2014 much cheaper for "how many error lines in last 5m" polling. It counts exactly what the same call would return, so `count` and the entry count agree whenever count <= lines.',
+    "",
+    "If the service has log_filter_rules with action='drop' (see update_service_config), the lines they match are excluded from BOTH the tail and the count \u2014 so a count lower than the raw log volume is the rules working, not lines going missing. `stream` selects on the stream shown in the response, which a 'downgrade' rule may have flipped from stderr to stdout.",
     "",
     "Returns: { logs: LogEntry[] | string } when count_only is false. Each entry has { timestamp, level?, stream, message }. `level` is the parsed inner level when the message is a structured JSON envelope (pino numeric or string), and undefined for plain-text logs. `stream` is always one of stdout/stderr. Or { count: number } when count_only is true.",
     "",
@@ -4842,9 +5033,11 @@ defineTool({
     "",
     "Inputs: serviceId (required).",
     "",
-    'Returns: { check } or { check: null } when none is configured. The check carries path, method, expectedStatus, intervalSeconds, failureThreshold, status, consecutiveFailures, lastCheckedAt, lastStatusCode, lastLatencyMs, lastError, lastChangedAt (the "down since" timestamp).',
+    'Returns: { check } or { check: null } when none is configured. The check carries path, method, expectedStatus, intervalSeconds, failureThreshold, status, consecutiveFailures, lastCheckedAt, lastStatusCode, lastLatencyMs, lastError, lastChangedAt (the "down since" timestamp), and lastTargetUrl.',
+    "",
+    "WHICH HOSTNAME IS PROBED: `lastTargetUrl` is the URL the last probe actually dialled \u2014 read it here rather than inferring it. A check names a PATH and the platform picks the host: the service's primary domain, or the OLDEST domain when no primary is nominated, which on a renamed host is usually the retired alias. So a service answering on two names that behave differently (canonical serves, alias 301s) can have a check that asserts the wrong status code without anything being wrong with the service. If lastTargetUrl is not the name you meant to watch, nominate the right one with update_domain({ domain_id, isPrimary: true }) \u2014 set_uptime_check takes a path and never a host.",
     "",
-    "Example: get_uptime_check({ serviceId: 48 }) \u2192 { check: { path: '/healthz', status: 'down', consecutiveFailures: 5, lastError: 'No response within 10000ms', lastChangedAt: '2026-08-21T04:12:00Z' } }."
+    "Example: get_uptime_check({ serviceId: 48 }) \u2192 { check: { path: '/healthz', status: 'down', consecutiveFailures: 5, lastError: 'No response within 10000ms', lastChangedAt: '2026-08-21T04:12:00Z', lastTargetUrl: 'https://grundfast.dk/healthz' } }."
   ].join("\n"),
   input: { serviceId: z20.number().int().positive() },
   handler: async (args, ctx) => {
@@ -4877,9 +5070,9 @@ defineTool({
     "",
     "For a site HostStack does NOT host, there is no serviceId to pass: use set_site_uptime_check with its analytics siteId instead. That path needs the domain proven first (verify_site_domain), because the host it probes comes from the site row rather than from a domain the platform already vouches for.",
     "",
-    "IMPORTANT: changing the shape of a check RESETS its accumulated state (status, consecutive failures, open alert). A check whose path or expected status just changed has not observed the new check failing, so carrying failures forward would alert about a condition that was never measured. Pass the full shape you want, not a partial edit of an unknown current state \u2014 read it with get_uptime_check first if that matters.",
+    "IMPORTANT: changing the shape of a check RESETS its accumulated state (status, consecutive failures, open alert). A check whose path or expected status just changed has not observed the new check failing, so carrying failures forward would alert about a condition that was never measured. A write that resolves to the shape already stored changes nothing and leaves that state alone \u2014 but the inputs are defaults, not a partial edit, so omitting intervalSeconds on a check set to 30 resolves to 60 and IS a change. Read a check with get_uptime_check; never re-save one in order to look at it.",
     "",
-    "`path` is a path, not a URL: the host comes from the service's primary domain at probe time, so moving the service to a new domain moves the check with it.",
+    "`path` is a path, not a URL: the host comes from the service's primary domain at probe time, so moving the service to a new domain moves the check with it. On a service with SEVERAL domains that is a choice, and this tool does not make it \u2014 nominate the hostname to watch with update_domain({ domain_id, isPrimary: true }), or the platform falls back to the OLDEST domain, which after a rename is usually the alias that redirects. Check which one is live with get_uptime_check's lastTargetUrl before trusting an expectedStatus. When ONE named hostname has to be asserted whatever the platform picks \u2014 a canonical host and a 301 alias cannot share an expectedStatus \u2014 give that hostname its own analytics site and check it with set_site_uptime_check.",
     "",
     "Method is GET or HEAD only. A probe fires unattended every interval forever, so it has to be safe to repeat \u2014 a check that could POST would be a scheduled writer against the team's own API.",
     "",
@@ -4908,9 +5101,11 @@ defineTool({
       `/api/services/${teamId}/${serviceId}/uptime-check`,
       body
     );
+    const check = shape(response.check);
+    const probed = check["lastCheckedAt"] !== null && check["lastCheckedAt"] !== void 0;
     return respond({
-      summary: `Uptime check saved. It will start reporting within a minute or two.`,
-      data: { check: shape(response.check) }
+      summary: probed ? `Uptime check saved \u2014 the shape was already stored, so nothing was reset: still ${String(check["status"])}, last probed ${String(check["lastCheckedAt"])}.` : 'Uptime check saved, and not probed yet \u2014 "unknown" with no lastCheckedAt is the state of a check that has not run once, not a broken one. It reports within a minute or two: read it with get_uptime_check, never by saving it again.',
+      data: { check }
     });
   }
 });