@hoststack.dev/mcp 0.23.0 → 0.25.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { HostStack } from "@hoststack.dev/sdk";
 
 // src/version.ts
-var MCP_VERSION = true ? "0.23.0" : "0.0.0-dev";
+var MCP_VERSION = true ? "0.25.0" : "0.0.0-dev";
 var USER_AGENT = `hoststack-mcp/${MCP_VERSION}`;
 
 // src/api-client.ts
@@ -1394,7 +1394,7 @@ var DNS_RECORD_TYPES = [
 async function resolveZonePublicId(hoststack, teamId, input) {
   if (input.zone_id) {
     const { zones: zones2 } = await hoststack.dns.listZones(teamId);
-    const match = zones2.find((z22) => z22.publicId === input.zone_id);
+    const match = zones2.find((z23) => z23.publicId === input.zone_id);
     if (!match) {
       throw new Error(`Zone ${input.zone_id} not found on this team.`);
     }
@@ -1408,7 +1408,7 @@ async function resolveZonePublicId(hoststack, teamId, input) {
   const labels = fqdn.split(".");
   for (let i = 0; i < labels.length - 1; i++) {
     const candidate = labels.slice(i).join(".");
-    const match = zones.find((z22) => z22.domainName.toLowerCase() === candidate);
+    const match = zones.find((z23) => z23.domainName.toLowerCase() === candidate);
     if (match && match.status !== "deleting") {
       return { publicId: match.publicId, domainName: match.domainName };
     }
@@ -2894,19 +2894,69 @@ defineTool({
 });
 
 // src/tools/github.ts
+import { z as z14 } from "zod";
+function shapeRepo(repo) {
+  return {
+    id: repo.id,
+    fullName: repo.fullName,
+    defaultBranch: repo.defaultBranch,
+    private: repo.isPrivate,
+    url: repo.htmlUrl,
+    ...repo.language ? { language: repo.language } : {}
+  };
+}
+defineTool({
+  name: "list_github_repos",
+  category: "github",
+  description: [
+    "Every GitHub repository this team can deploy, with the `id` create_service takes \u2014 and the `owner/name` you can pass instead of it.",
+    "",
+    "When to use: before create_service or create_standalone_dev_environment with a repo source. `github_repo_id` is a HostStack row id, NOT the id GitHub shows \u2014 it appears in no clone URL and no GitHub API response, so it cannot be derived and must not be guessed. (Guessing used to be survivable-looking: the create returned 200 and the mistake surfaced one step later as `Invalid git clone URL` from the deploy. It is now refused at create time.)",
+    "",
+    "Inputs:",
+    '  - q (optional): case-insensitive substring of the full name ("owner/name"). Omit for everything.',
+    "",
+    "Returns: { items: [{ id, fullName, defaultBranch, private, url, language? }], total } \u2014 `total` is the count before `q` filtered it.",
+    "",
+    "If the repo you just pushed is missing, call sync_github_repos first: HostStack cannot see a brand-new repository until an installation re-sync runs.",
+    "",
+    'Example: list_github_repos({ q: "stenshoppen" }) \u2192 { items: [{ id: 143, fullName: "acme/stenshoppen", defaultBranch: "master", private: true }], total: 45 }',
+    'Then either: create_service({ \u2026, github_repo: "acme/stenshoppen" }) \u2014 or the id, if you prefer.'
+  ].join("\n"),
+  input: {
+    q: z14.string().min(1).max(200).optional().describe('Case-insensitive substring of "owner/name". Omit to list everything.')
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const { repos } = await ctx.api.get(
+      `/api/github/${teamId}/repos`
+    );
+    const needle = args.q?.trim().toLowerCase();
+    const matched = needle ? repos.filter((r) => r.fullName.toLowerCase().includes(needle)) : repos;
+    const items = matched.map(shapeRepo).sort((a, b) => a.fullName.localeCompare(b.fullName));
+    if (repos.length === 0) {
+      return respond({
+        summary: "No GitHub repositories are connected to this team. Install the HostStack GitHub App from the dashboard (Settings \u2192 GitHub), then call sync_github_repos.",
+        data: { items, total: 0 }
+      });
+    }
+    const summary = needle ? items.length === 0 ? `No connected repository matches "${args.q}" (${repos.length} connected). Push it, then call sync_github_repos.` : `${items.length} of ${repos.length} connected repositories match "${args.q}".` : `${items.length} connected repositor${items.length === 1 ? "y" : "ies"}.`;
+    return respond({ summary, data: { items, total: repos.length } });
+  }
+});
 defineTool({
   name: "sync_github_repos",
   category: "github",
   description: [
-    "Re-sync the repository list from GitHub for every connected GitHub App installation.",
+    "Re-sync the repository list from GitHub for every connected GitHub App installation, and return what that now exposes.",
     "",
-    "When to use: right after pushing a brand-new repository, HostStack cannot see it until an installation re-sync runs \u2014 so create_service with a github_repo_id would fail. Call this first. (Same operation as the dashboard's refresh icon on the repo picker.)",
+    "When to use: right after pushing a brand-new repository, HostStack cannot see it until an installation re-sync runs \u2014 so create_service with a github_repo_id or github_repo would fail. Call this first. (Same operation as the dashboard's refresh icon on the repo picker.) To read the list WITHOUT re-syncing, call list_github_repos.",
     "",
     "No inputs.",
     "",
-    "Returns: { installations: number, repos: [{ account, count }], totalRepos } \u2014 the accounts synced and how many repos each now exposes.",
+    "Returns: { installations: number, accounts: [{ account, count }], totalRepos, repos: [{ id, fullName }] } \u2014 `repos` carries the ids create_service takes, so a sync is enough to act on; it does not have to be followed by a list.",
     "",
-    'Example: sync_github_repos({}) \u2192 { installations: 1, repos: [{ account: "acme", count: 12 }], totalRepos: 12 }'
+    'Example: sync_github_repos({}) \u2192 { installations: 1, accounts: [{ account: "acme", count: 12 }], totalRepos: 12, repos: [{ id: 143, fullName: "acme/stenshoppen" }, \u2026] }'
   ].join("\n"),
   input: {},
   handler: async (_args, ctx) => {
@@ -2920,23 +2970,29 @@ defineTool({
       );
     }
     const perAccount = [];
-    let totalRepos = 0;
+    const synced = [];
     for (const inst of installations) {
       const { repos } = await ctx.api.post(
         `/api/github/${teamId}/installations/${inst.id}/sync`
       );
       perAccount.push({ account: inst.accountLogin, count: repos.length });
-      totalRepos += repos.length;
+      for (const repo of repos) synced.push({ id: repo.id, fullName: repo.fullName });
     }
+    synced.sort((a, b) => a.fullName.localeCompare(b.fullName));
     return respond({
-      summary: `Synced ${totalRepos} repositories across ${installations.length} installation(s).`,
-      data: { installations: installations.length, repos: perAccount, totalRepos }
+      summary: `Synced ${synced.length} repositories across ${installations.length} installation(s).`,
+      data: {
+        installations: installations.length,
+        accounts: perAccount,
+        totalRepos: synced.length,
+        repos: synced
+      }
     });
   }
 });
 
 // src/tools/issue-reports.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 defineTool({
   name: "report_issue",
   category: "support",
@@ -2958,16 +3014,16 @@ defineTool({
     "Example: report_issue({ title: 'Dev box deploys fail with 404 No such image', description: 'Every deploy of svc 172 since 2026-08-22 09:03 fails at container create with `404 No such image: \u2026/dev-env:latest`. The deploy log reports \"Image ready in 1s\" for a 5.5 GB image, so the pull is not happening. The image pulls fine by hand from the same registry.', severity: 'high', serviceId: 172 }) \u2192 { ticket: { publicId: 'tkt_\u2026' } }"
   ].join("\n"),
   input: {
-    title: z14.string().min(1).max(300).describe("One-line summary of the fault."),
-    description: z14.string().min(1).max(1e4).describe("What happened, what you expected instead, and what you already ruled out."),
-    severity: z14.enum(["low", "normal", "high", "urgent"]).optional().describe(
+    title: z15.string().min(1).max(300).describe("One-line summary of the fault."),
+    description: z15.string().min(1).max(1e4).describe("What happened, what you expected instead, and what you already ruled out."),
+    severity: z15.enum(["low", "normal", "high", "urgent"]).optional().describe(
       'Default normal. Use high/urgent only when something is DOWN or losing data \u2014 not for "this is annoying".'
     ),
-    serviceId: z14.number().int().positive().optional().describe(
+    serviceId: z15.number().int().positive().optional().describe(
       "The affected service. Attaches the service, its latest deploy, and that deploy log tail automatically."
     ),
-    deployId: z14.number().int().positive().optional().describe("Pin a specific deploy instead of the service\u2019s most recent one."),
-    databaseId: z14.number().int().positive().optional().describe("The affected database.")
+    deployId: z15.number().int().positive().optional().describe("Pin a specific deploy instead of the service\u2019s most recent one."),
+    databaseId: z15.number().int().positive().optional().describe("The affected database.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3055,7 +3111,7 @@ defineTool({
 });
 
 // src/tools/notifications.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var NOTIFICATION_EVENTS = [
   "deploy.started",
   "deploy.succeeded",
@@ -3081,6 +3137,7 @@ var NOTIFICATION_EVENTS = [
   "error.issue_regressed",
   "git.auth_failed",
   "cron.execution_failed",
+  "cron.schedule_missed",
   "workflow.failed",
   "devenv.agent.needs_input",
   "devenv.agent.finished",
@@ -3149,10 +3206,10 @@ defineTool({
     "Example: create_notification_channel({ type: 'slack', name: 'eng-alerts', webhook_url: 'https://hooks.slack.com/\u2026', events: ['deploy.failed', 'git.auth_failed', 'service.restart_failed'] })"
   ].join("\n"),
   input: {
-    type: z15.enum(["slack", "discord", "email"]).describe("Channel type."),
-    name: z15.string().min(1).max(128).describe("Human-readable label."),
-    webhook_url: z15.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
-    events: z15.array(z15.enum(NOTIFICATION_EVENTS)).describe(
+    type: z16.enum(["slack", "discord", "email"]).describe("Channel type."),
+    name: z16.string().min(1).max(128).describe("Human-readable label."),
+    webhook_url: z16.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
+    events: z16.array(z16.enum(NOTIFICATION_EVENTS)).describe(
       "List of events the channel subscribes to. Empty list = subscribe to nothing."
     )
   },
@@ -3190,10 +3247,10 @@ defineTool({
     "Example: update_notification_channel({ channel_id: 3, events: ['deploy.failed', 'service.restart_failed', 'git.auth_failed'] })"
   ].join("\n"),
   input: {
-    channel_id: z15.number().int().positive().describe("Numeric channel id from list_notification_channels."),
-    name: z15.string().min(1).max(128).optional().describe("New label."),
-    active: z15.boolean().optional().describe("false silences without deleting."),
-    events: z15.array(z15.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
+    channel_id: z16.number().int().positive().describe("Numeric channel id from list_notification_channels."),
+    name: z16.string().min(1).max(128).optional().describe("New label."),
+    active: z16.boolean().optional().describe("false silences without deleting."),
+    events: z16.array(z16.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3232,7 +3289,7 @@ defineTool({
     "Example: delete_notification_channel({ channel_id: 3 }) \u2192 { ok: true }"
   ].join("\n"),
   input: {
-    channel_id: z15.number().int().positive().describe("Numeric channel id.")
+    channel_id: z16.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3259,7 +3316,7 @@ defineTool({
     "Example: test_notification_channel({ channel_id: 3 }) \u2192 { success: true }"
   ].join("\n"),
   input: {
-    channel_id: z15.number().int().positive().describe("Numeric channel id.")
+    channel_id: z16.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3274,7 +3331,7 @@ defineTool({
 });
 
 // src/tools/projects.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var AVAILABLE_REGION_IDS = ["eu-central-1"];
 defineTool({
   name: "list_projects",
@@ -3315,9 +3372,9 @@ defineTool({
     'Example: create_project({ name: "billing-api", description: "Stripe webhooks", region: "eu-central-1" }) \u2192 { project: { id: 12, publicId: "prj_\u2026", \u2026 } }'
   ].join("\n"),
   input: {
-    name: z16.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
-    description: z16.string().max(500).optional().describe("Short description (\u2264500 chars)."),
-    region: z16.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
+    name: z17.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
+    description: z17.string().max(500).optional().describe("Short description (\u2264500 chars)."),
+    region: z17.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3350,9 +3407,9 @@ defineTool({
     'Example: update_project({ project_id: "prj_abc", name: "billing-prod" }) \u2192 { project: { name: "billing-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z16.string().describe("Project publicId."),
-    name: z16.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
-    description: z16.string().max(500).optional().describe("New description (\u2264500 chars).")
+    project_id: z17.string().describe("Project publicId."),
+    name: z17.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
+    description: z17.string().max(500).optional().describe("New description (\u2264500 chars).")
   },
   handler: async (args, ctx) => {
     if (args.name === void 0 && args.description === void 0) {
@@ -3386,7 +3443,7 @@ defineTool({
     'Example: get_project({ project_id: "prj_abc" }) \u2192 { project: { id: 12, name: "billing", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z16.string().describe("Project publicId (e.g. prj_abc123).")
+    project_id: z17.string().describe("Project publicId (e.g. prj_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3398,7 +3455,7 @@ defineTool({
 });
 
 // src/tools/dev-tasks.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var NOT_A_RUN = "Filing a task does NOT start an agent. It writes a prompt into the box's backlog for someone to run; a suspended box keeps it until it wakes.";
 defineTool({
   name: "list_dev_tasks",
@@ -3418,7 +3475,7 @@ defineTool({
     'Example: list_dev_tasks({ project_id: 26 }) \u2192 { items: [{ publicId: "task_\u2026", status: "idea", title: "Fix the footprint join" }] }'
   ].join("\n"),
   input: {
-    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Project \u2014 publicId ("prj_\u2026") or numeric id.')
+    project_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Project \u2014 publicId ("prj_\u2026") or numeric id.')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3447,7 +3504,7 @@ defineTool({
     'Example: get_dev_task({ task_id: "task_hy1i2jdp\u2026" }) \u2192 { data: { title: "Footprint coverage", body: "The BBRUUID join returns 17 of 49 \u2026", status: "idea" } }'
   ].join("\n"),
   input: {
-    task_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Task \u2014 publicId ("task_\u2026") or numeric id.')
+    task_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Task \u2014 publicId ("task_\u2026") or numeric id.')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3475,10 +3532,10 @@ defineTool({
     'Example: create_dev_task({ project_id: 26, service_id: 51, title: "Footprint coverage", body: "The BBRUUID join returns 17 of 49 \u2026" })'
   ].join("\n"),
   input: {
-    project_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Project \u2014 publicId ("prj_\u2026") or numeric id.'),
-    title: z17.string().min(1).max(200).describe("One-line title, \u2264200 chars."),
-    body: z17.string().max(2e4).optional().describe("The prompt handed to the agent. Markdown, \u226420 000 chars."),
-    service_id: z17.union([z17.number().int().positive(), z17.string()]).optional().describe(
+    project_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Project \u2014 publicId ("prj_\u2026") or numeric id.'),
+    title: z18.string().min(1).max(200).describe("One-line title, \u2264200 chars."),
+    body: z18.string().max(2e4).optional().describe("The prompt handed to the agent. Markdown, \u226420 000 chars."),
+    service_id: z18.union([z18.number().int().positive(), z18.string()]).optional().describe(
       'Dev box to pin it to \u2014 publicId ("svc_\u2026") or numeric id. Omit for a loose idea.'
     )
   },
@@ -3524,13 +3581,13 @@ defineTool({
     'Example: update_dev_task({ task_id: "task_hy1i2jdp\u2026", status: "done" }) \u2192 { data: { status: "done" } }'
   ].join("\n"),
   input: {
-    task_id: z17.union([z17.number().int().positive(), z17.string()]).describe('Task \u2014 publicId ("task_\u2026") or numeric id.'),
-    status: z17.enum(["idea", "done"]).optional().describe("The only two a person may set. The runner owns the rest of the lifecycle."),
-    title: z17.string().min(1).max(200).optional().describe("New title."),
-    body: z17.string().max(2e4).optional().describe("New prompt body."),
-    service_id: z17.union([z17.number().int().positive(), z17.string()]).nullable().optional().describe("Pin to a dev box, or null to unpin it back to a loose idea."),
-    provider: z17.enum(["claude", "codex", "opencode"]).nullable().optional().describe("Which agent runs this task, or null to leave it to the box."),
-    permission_mode: z17.enum(["acceptEdits", "bypassPermissions", "default"]).optional().describe(
+    task_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Task \u2014 publicId ("task_\u2026") or numeric id.'),
+    status: z18.enum(["idea", "done"]).optional().describe("The only two a person may set. The runner owns the rest of the lifecycle."),
+    title: z18.string().min(1).max(200).optional().describe("New title."),
+    body: z18.string().max(2e4).optional().describe("New prompt body."),
+    service_id: z18.union([z18.number().int().positive(), z18.string()]).nullable().optional().describe("Pin to a dev box, or null to unpin it back to a loose idea."),
+    provider: z18.enum(["claude", "codex", "opencode"]).nullable().optional().describe("Which agent runs this task, or null to leave it to the box."),
+    permission_mode: z18.enum(["acceptEdits", "bypassPermissions", "default"]).optional().describe(
       "How the agent may act. bypassPermissions asks for nothing \u2014 set it only on request."
     )
   },
@@ -3555,7 +3612,7 @@ defineTool({
 });
 
 // src/tools/resource-links.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var RESOURCE_LINK_TYPES = [
   "database",
   "object_storage",
@@ -3616,7 +3673,7 @@ defineTool({
     'Example: list_service_resources({ service_id: "svc_abc" }) \u2192 { items: [{ id: 7, resourceType: "database", resourceId: 42, alias: "APP_DB" }] }'
   ].join("\n"),
   input: {
-    service_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
+    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3653,10 +3710,10 @@ defineTool({
     'Example: link_resource_to_service({ service_id: "svc_abc", resource_type: "database", resource_id: 42, alias: "APP_DB" }) \u2192 { link: { id: 7, alias: "APP_DB" } }'
   ].join("\n"),
   input: {
-    service_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    resource_type: z18.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
-    resource_id: z18.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
-    alias: z18.string().min(1).max(48).regex(
+    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    resource_type: z19.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
+    resource_id: z19.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
+    alias: z19.string().min(1).max(48).regex(
       /^[A-Z][A-Z0-9_]*$/,
       "Alias must be uppercase letters, digits and underscores, starting with a letter."
     ).describe('Uppercase env-var prefix, e.g. "APP_DB". Unique within the service.')
@@ -3692,8 +3749,8 @@ defineTool({
     'Example: unlink_resource_from_service({ service_id: "svc_abc", link_id: 7 }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z18.union([z18.number().int().positive(), z18.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    link_id: z18.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
+    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    link_id: z19.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3705,7 +3762,7 @@ defineTool({
 });
 
 // src/tools/services.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // src/lib/app-templates.ts
 var MCP_APP_TEMPLATES = [
@@ -3957,16 +4014,16 @@ defineTool({
     '  - type: "web_service" | "private_service" | "worker" | "cron_job" | "static_site".',
     "  - dev_environment: include Dev Boxes in the results (excluded by default).",
     "",
-    "Returns: { items: Service[] } \u2014 each service includes id, publicId, name, type, status, projectId, repoUrl, branch, runtime, createdAt.",
+    "Returns: { items: Service[] } \u2014 each service includes id, publicId, name, type, status, projectId, branch, runtime, createdAt, and, for a source-built service, repoProvider/repoFullName/repoUrl (what it actually builds \u2014 the stored id alone names no repository).",
     "",
     'Example: list_services({ status: "failed" }) \u2192 only services that need attention.'
   ].join("\n"),
   input: {
-    project_id: z19.union([z19.number().int().positive(), z19.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
-    environment_id: z19.union([z19.number().int().positive(), z19.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
-    status: z19.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
-    type: z19.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
-    dev_environment: z19.boolean().optional().describe(
+    project_id: z20.union([z20.number().int().positive(), z20.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
+    environment_id: z20.union([z20.number().int().positive(), z20.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
+    status: z20.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
+    type: z20.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
+    dev_environment: z20.boolean().optional().describe(
       "Include agentic Dev Boxes in the results (excluded by default; see list_dev_environments)."
     )
   },
@@ -4007,7 +4064,7 @@ defineTool({
   name: "create_service",
   category: "services",
   description: [
-    "Create a new service in a project. Source is either a connected git repo (github_repo_id) OR a pre-built docker_image \u2014 never both.",
+    'Create a new service in a project. Source is either a connected git repo (github_repo "owner/name", or github_repo_id) OR a pre-built docker_image \u2014 never both.',
     "",
     "When to use: the user wants to deploy something new. For a one-command AI dev environment specifically, prefer create_dev_environment (it also attaches the /workspace volume and sets the MCP keys).",
     "",
@@ -4020,7 +4077,9 @@ defineTool({
     "  - name: service name (1\u2013100 chars).",
     '  - type: "web_service" | "private_service" | "worker" | "cron_job" | "static_site".',
     "  - docker_image (optional): pre-built image ref to deploy instead of building from source.",
-    "  - github_repo_id (optional): connect a previously-linked GitHub repo by numeric id.",
+    '  - github_repo (optional): connect a connected GitHub repo by name \u2014 "owner/name". Preferred over github_repo_id: it is what you actually know, and a wrong name is refused here instead of failing the deploy.',
+    "  - github_repo_id (optional): the same repo by its HostStack numeric id (from list_github_repos). NOT GitHub's id. Mutually exclusive with github_repo.",
+    "  - git_repo_url (optional): a PUBLIC https git URL, for a repo that is not connected through GitHub. Private repos do not work here \u2014 they need a provider connection, because this field carries no credentials and embedding them in the URL is rejected. Mutually exclusive with github_repo_id and docker_image.",
     '  - branch (optional): git branch (default "main").',
     "  - install_command / build_command / start_command (optional): build/run shell commands. start_command is required for web/private services without a docker_image.",
     "  - cron_schedule (optional): cron expression \u2014 required for cron_job.",
@@ -4035,33 +4094,42 @@ defineTool({
     "",
     "Returns: { service: Service, deployId: number | null }.",
     "",
-    'Example: create_service({ project_id: "prj_abc", name: "api", type: "web_service", github_repo_id: 42 }) \u2192 { service: { publicId: "svc_\u2026" }, deployId: 1234 }',
+    'Example: create_service({ project_id: "prj_abc", name: "api", type: "web_service", github_repo: "acme/api" }) \u2192 { service: { publicId: "svc_\u2026", repoUrl: "https://github.com/acme/api" }, deployId: 1234 }',
+    "Repo not listed by list_github_repos? Call sync_github_repos \u2014 a repository pushed since the last sync is invisible until then.",
     'Example (one-click app): create_service({ project_id: "prj_abc", name: "blog", type: "web_service", template_id: "wordpress", docker_image: "wordpress:php8.3-apache", port: 80 }) \u2014 the wp-content volume, the www-data uid, the Apache scratch dirs and the managed MySQL come from the template id.'
   ].join("\n"),
   input: {
-    project_id: z19.union([z19.number().int().positive(), z19.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z19.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
-    type: z19.enum(SERVICE_TYPES).describe("Service type."),
-    docker_image: z19.string().max(500).optional().describe(
+    project_id: z20.union([z20.number().int().positive(), z20.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z20.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
+    type: z20.enum(SERVICE_TYPES).describe("Service type."),
+    docker_image: z20.string().max(500).optional().describe(
       "Pre-built APPLICATION image ref. Mutually exclusive with github_repo_id. Not for databases \u2014 use create_database for postgres/redis/mysql/mariadb/mongodb."
     ),
-    github_repo_id: z19.number().int().positive().optional().describe("Linked GitHub repo numeric id. Mutually exclusive with docker_image."),
-    branch: z19.string().max(200).optional().describe('Git branch (default "main").'),
-    install_command: z19.string().max(1e3).optional().describe("Install shell command."),
-    build_command: z19.string().max(1e3).optional().describe("Build shell command."),
-    start_command: z19.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
-    cron_schedule: z19.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
-    publish_path: z19.string().max(500).optional().describe("Static-site output dir."),
-    runtime: z19.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
-    port: z19.number().int().min(1).max(65535).optional().describe(
+    github_repo: z20.string().min(1).max(255).optional().describe(
+      'Connected GitHub repo as "owner/name" (see list_github_repos). Resolved server-side. Mutually exclusive with github_repo_id and docker_image.'
+    ),
+    github_repo_id: z20.number().int().positive().optional().describe(
+      "HostStack row id of a connected GitHub repo (list_github_repos) \u2014 not GitHub's own id. Prefer github_repo. Mutually exclusive with docker_image."
+    ),
+    git_repo_url: z20.string().max(2048).optional().describe(
+      "Public https git URL. No embedded credentials \u2014 private repos need a provider connection. Mutually exclusive with github_repo_id and docker_image."
+    ),
+    branch: z20.string().max(200).optional().describe('Git branch (default "main").'),
+    install_command: z20.string().max(1e3).optional().describe("Install shell command."),
+    build_command: z20.string().max(1e3).optional().describe("Build shell command."),
+    start_command: z20.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
+    cron_schedule: z20.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
+    publish_path: z20.string().max(500).optional().describe("Static-site output dir."),
+    runtime: z20.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
+    port: z20.number().int().min(1).max(65535).optional().describe(
       "Listen port, for a prebuilt image whose port is fixed by the image. Omit for a source-built service \u2014 it binds the injected $PORT."
     ),
-    template_id: z19.string().max(64).optional().describe(
+    template_id: z20.string().max(64).optional().describe(
       "Quickstart template id from list_templates. Its volumes, scratch dirs, uid, secrets and companion database are resolved server-side; for an image template also pass its docker_image and port."
     ),
-    plan: z19.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
-    environment_id: z19.union([z19.number().int().positive(), z19.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
-    auto_deploy: z19.boolean().optional().describe("Trigger the first deploy immediately (default true)."),
+    plan: z20.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
+    environment_id: z20.union([z20.number().int().positive(), z20.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
+    auto_deploy: z20.boolean().optional().describe("Trigger the first deploy immediately (default true)."),
     machine: machineInput
   },
   handler: async (args, ctx) => {
@@ -4076,7 +4144,9 @@ defineTool({
       projectId
     };
     if (args.docker_image !== void 0) input.dockerImage = args.docker_image;
+    if (args.github_repo !== void 0) input.githubRepo = args.github_repo;
     if (args.github_repo_id !== void 0) input.githubRepoId = args.github_repo_id;
+    if (args.git_repo_url !== void 0) input.gitRepoUrl = args.git_repo_url;
     if (args.branch !== void 0) input.branch = args.branch;
     if (args.install_command !== void 0) input.installCommand = args.install_command;
     if (args.build_command !== void 0) input.buildCommand = args.build_command;
@@ -4132,18 +4202,18 @@ defineTool({
     'Example: create_dev_environment({ project_id: "prj_abc", name: "scratch", hoststack_api_key: "hs_live_\u2026" })'
   ].join("\n"),
   input: {
-    project_id: z19.union([z19.number().int().positive(), z19.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z19.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
-    plan: z19.enum(SERVICE_PLANS).optional().describe(
+    project_id: z20.union([z20.number().int().positive(), z20.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z20.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
+    plan: z20.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB, the OOM-safe floor; a smaller plan is clamped up to "standard").'
     ),
-    disk_gb: z19.number().int().min(10).max(10240).optional().describe("/workspace volume size in GB (default 10, min 10, max 10240)."),
-    hoststack_api_key: z19.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
-    poststack_api_key: z19.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
-    repo_url: z19.string().max(500).optional().describe(
+    disk_gb: z20.number().int().min(10).max(10240).optional().describe("/workspace volume size in GB (default 10, min 10, max 10240)."),
+    hoststack_api_key: z20.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
+    poststack_api_key: z20.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
+    repo_url: z20.string().max(500).optional().describe(
       "Clone this git URL into /workspace on first boot (HTTPS, or SSH once a key is set)."
     ),
-    branch: z19.string().max(200).optional().describe("Branch to clone (with repo_url)."),
+    branch: z20.string().max(200).optional().describe("Branch to clone (with repo_url)."),
     machine: machineInput
   },
   handler: async (args, ctx) => {
@@ -4260,9 +4330,9 @@ defineTool({
     'Example: spin_up_dev_environment({ service_id: "svc_api" }) \u2192 a dev box running a clone of the api service (repo + env-vars + cloned DB) with a public dev URL.'
   ].join("\n"),
   input: {
-    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
-    include_database_clone: z19.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
-    name: z19.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
+    service_id: z20.union([z20.number().int().positive(), z20.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
+    include_database_clone: z20.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
+    name: z20.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4303,7 +4373,7 @@ defineTool({
     'Example: delete_dev_environment({ service_id: "svc_api_dev" }) \u2192 removes the dev box, its cloned database, and the /workspace volume.'
   ].join("\n"),
   input: {
-    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
+    service_id: z20.union([z20.number().int().positive(), z20.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4341,8 +4411,8 @@ defineTool({
     'Example: resize_dev_environment({ service_id: "svc_skyskraber_dev", size: "large" }) \u2192 bumps the box to the large tier, applied live.'
   ].join("\n"),
   input: {
-    service_id: z19.union([z19.number().int().positive(), z19.string()]).describe("The box to resize \u2014 numeric id or publicId."),
-    size: z19.enum(SERVICE_PLANS).describe(
+    service_id: z20.union([z20.number().int().positive(), z20.string()]).describe("The box to resize \u2014 numeric id or publicId."),
+    size: z20.enum(SERVICE_PLANS).describe(
       'Target size tier (service catalog size, e.g. "standard", "large", "xlarge").'
     )
   },
@@ -4479,7 +4549,7 @@ defineTool({
     "Inputs:",
     '  - name (optional): the Dev Box name. Omit it and the box is named after its source (the repo name, or "dev-box" when blank), with a numeric suffix if that name is taken \u2014 so "give me a dev box" needs no invented name.',
     '  - source_kind: "github_repo" (clone a connected repo \u2014 needs github_repo_id), "url" (clone any http(s) git URL \u2014 needs clone_url), or "blank" (empty box).',
-    "  - github_repo_id (for github_repo): numeric id of a connected GitHub repo.",
+    "  - github_repo_id (for github_repo): HostStack row id of a connected GitHub repo \u2014 call list_github_repos for it. It is NOT the id GitHub shows, and it cannot be guessed.",
     "  - clone_url (for url): an http(s) git clone URL.",
     "  - branch (optional): branch to clone.",
     '  - databases (optional): companion services to attach \u2014 any of "postgres", "redis", "meilisearch".',
@@ -4489,24 +4559,26 @@ defineTool({
     "",
     "Returns: { service, devUrl, deployId } \u2014 deploying. Once live: open the Terminal tab, run `claude`, start the dev server on $PORT, view at https://<devUrl>. Tear down with delete_dev_environment.",
     "",
-    'Example: create_standalone_dev_environment({ name: "app-dev", source_kind: "github_repo", github_repo_id: 42, databases: ["postgres","redis"] })'
+    'Example: list_github_repos({ q: "app" }) \u2192 id 42, then create_standalone_dev_environment({ name: "app-dev", source_kind: "github_repo", github_repo_id: 42, databases: ["postgres","redis"] })'
   ].join("\n"),
   input: {
-    name: z19.string().min(1).max(100).optional().describe(
+    name: z20.string().min(1).max(100).optional().describe(
       'Dev Box name. Omit to have it named after the source (the repo name, or "dev-box" for a blank one), de-duplicated against existing boxes.'
     ),
-    source_kind: z19.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
-    github_repo_id: z19.number().int().positive().optional().describe('Connected GitHub repo id (required when source_kind="github_repo").'),
-    clone_url: z19.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
-    branch: z19.string().min(1).max(255).optional().describe("Branch to clone."),
-    databases: z19.array(z19.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
-    plan: z19.enum(SERVICE_PLANS).optional().describe(
+    source_kind: z20.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
+    github_repo_id: z20.number().int().positive().optional().describe(
+      'Connected GitHub repo id from list_github_repos (required when source_kind="github_repo").'
+    ),
+    clone_url: z20.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
+    branch: z20.string().min(1).max(255).optional().describe("Branch to clone."),
+    databases: z20.array(z20.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
+    plan: z20.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB; a smaller plan is floored to "standard").'
     ),
-    agent_accounts: z19.array(
-      z19.object({
-        provider: z19.enum(["claude", "codex", "opencode"]),
-        account_id: z19.number().int().positive()
+    agent_accounts: z20.array(
+      z20.object({
+        provider: z20.enum(["claude", "codex", "opencode"]),
+        account_id: z20.number().int().positive()
       })
     ).max(3).optional().describe(
       "Bind saved agent logins by account id per provider. Omit to inherit the box owner's default logins automatically."
@@ -4579,12 +4651,12 @@ defineTool({
     "Inputs:",
     '  - service_id: publicId of the service (e.g. "svc_abc123").',
     "",
-    'Returns: { service: Service, config: ServiceConfig } \u2014 service has type/status/runtime/repoUrl/branch/autoDeploy/region/plan/timestamps; config has memoryMb, cpuShares, diskSizeGb, port, protocol, healthCheckEnabled, healthCheckInterval, healthCheckTimeout, healthCheckGracePeriodSec, allowSearchIndexing, restartPolicy, deployStrategy ("rolling" | "recreate"), preDeployCommand, min/maxInstances, scale thresholds.',
+    'Returns: { service: Service, config: ServiceConfig } \u2014 service has type/status/runtime/branch/autoDeploy/region/plan/timestamps plus repoProvider/repoFullName/repoUrl for a source-built service (absent when it deploys a prebuilt image); config has memoryMb, cpuShares, diskSizeGb, port, protocol, healthCheckEnabled, healthCheckInterval, healthCheckTimeout, healthCheckGracePeriodSec, allowSearchIndexing, restartPolicy, deployStrategy ("rolling" | "recreate"), preDeployCommand, min/maxInstances, scale thresholds.',
     "",
     'Example: get_service({ service_id: "svc_abc" }) \u2192 { service: { type: "web", status: "running", \u2026 }, config: { healthCheckGracePeriodSec: 120, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z20.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4616,7 +4688,7 @@ defineTool({
     'Example: get_service_metrics({ service_id: "svc_abc" }) \u2192 { metrics: { cpu: 0.42, memory: 0.71, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId.")
+    service_id: z20.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4649,9 +4721,9 @@ defineTool({
     'Example: get_service_metrics_history({ service_id: "svc_abc", from: "-1h" }) \u2192 ~120 points for the last hour.'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId."),
-    from: z19.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
-    to: z19.string().optional().describe("ISO-8601 upper bound; defaults to now.")
+    service_id: z20.string().describe("Service publicId."),
+    from: z20.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
+    to: z20.string().optional().describe("ISO-8601 upper bound; defaults to now.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4695,8 +4767,8 @@ defineTool({
     'Example: update_service({ service_id: "svc_abc", name: "api-prod" }) \u2192 { service: { name: "api-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId."),
-    name: z19.string().min(1).max(60).describe("New service name (1\u201360 chars).")
+    service_id: z20.string().describe("Service publicId."),
+    name: z20.string().min(1).max(60).describe("New service name (1\u201360 chars).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4741,6 +4813,11 @@ defineTool({
     "  - scale_cpu_threshold, scale_memory_threshold (optional): integer 10\u2013100 \u2014 autoscale trigger percentage.",
     "  - scale_requests_per_sec_threshold (optional): integer 1\u201310000 \u2014 autoscale on request rate instead of (or alongside) CPU and memory. Pass null to stop scaling on request rate.",
     "  - build_timeout_seconds (optional): integer 60\u20131800 \u2014 how long a build may run before it is killed. Raise it for a service whose build legitimately takes longer than the default; pass null to go back to the default.",
+    "  - plan (optional): move the service to a different size tier. This is the supported way to grow past the current tier's ceiling \u2014 memory_mb and cpu_shares are CLAMPED to the tier, so raising them alone does nothing once you are at the top of it. Memory and CPU apply to the running container where possible; disk grows on the next recreate. Changing tier changes what the service costs.",
+    "  - docker_image (optional): repoint an image-backed service at a different image. Takes effect on the next deploy \u2014 this writes the reference, it does not pull. Pass null to clear it.",
+    "  - cron_schedule (optional): the schedule for a cron_job service. Pass null to clear it.",
+    '  - publish_path (optional): the directory a static_site publishes (e.g. "dist"). Pass null to clear it.',
+    '  - runtime (optional): runtime hint ("node" | "bun" | "python" | \u2026), normally auto-detected from the repo. Set it when the detection is wrong.',
     `  - log_filter_rules (optional): list of { pattern, action } rules applied at read time \u2014 to get_service_logs (tail AND count) and to the dashboard's live stream alike. Pattern matches the message by case-insensitive substring, literally (a % or _ is not a wildcard); action is "drop" (filter out) or "downgrade" (flip stderr \u2192 stdout so it stops looking like an error). Stored lines are never altered, so removing a rule re-exposes everything it was hiding. Pass [] to clear all rules. Capped at 50 rules.`,
     "",
     "Returns: { service?: Service, config?: ServiceConfig } \u2014 whichever rows were touched.",
@@ -4748,45 +4825,54 @@ defineTool({
     'Example: update_service_config({ service_id: "svc_abc", health_check_grace_period_sec: 180 }) \u2192 { config: { healthCheckGracePeriodSec: 180, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId."),
-    install_command: z19.string().nullable().optional().describe("Install shell command. Null clears."),
-    build_command: z19.string().nullable().optional().describe("Build shell command. Null clears."),
-    start_command: z19.string().nullable().optional().describe("Start shell command. Null clears."),
-    branch: z19.string().optional().describe("Git branch to track."),
-    root_directory: z19.string().optional().describe("Build context root."),
-    dockerfile_path: z19.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
-    auto_deploy: z19.boolean().optional().describe("Auto-deploy on push."),
-    health_check_path: z19.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
-    health_check_enabled: z19.boolean().optional().describe("Toggle health checking on/off."),
-    allow_search_indexing: z19.boolean().optional().describe(
+    service_id: z20.string().describe("Service publicId."),
+    install_command: z20.string().nullable().optional().describe("Install shell command. Null clears."),
+    build_command: z20.string().nullable().optional().describe("Build shell command. Null clears."),
+    start_command: z20.string().nullable().optional().describe("Start shell command. Null clears."),
+    branch: z20.string().optional().describe("Git branch to track."),
+    root_directory: z20.string().optional().describe("Build context root."),
+    dockerfile_path: z20.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
+    auto_deploy: z20.boolean().optional().describe("Auto-deploy on push."),
+    health_check_path: z20.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
+    health_check_enabled: z20.boolean().optional().describe("Toggle health checking on/off."),
+    allow_search_indexing: z20.boolean().optional().describe(
       "Let search engines index the free *.hoststack.dev platform URL (off by default). Custom domains are always indexable. Applies on the next deploy."
     ),
-    health_check_interval: z19.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
-    health_check_timeout: z19.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
-    health_check_grace_period_sec: z19.number().int().min(1).max(1800).optional().describe(
+    health_check_interval: z20.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
+    health_check_timeout: z20.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
+    health_check_grace_period_sec: z20.number().int().min(1).max(1800).optional().describe(
       "Startup grace period in seconds (1\u20131800). Raise this if the app needs more time to boot before health checks start counting failures."
     ),
-    memory_mb: z19.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
-    cpu_shares: z19.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
-    disk_size_gb: z19.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
-    port: z19.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
-    protocol: z19.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
-    restart_policy: z19.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
-    deploy_strategy: z19.enum(["rolling", "recreate"]).optional().describe(
+    memory_mb: z20.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
+    cpu_shares: z20.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
+    disk_size_gb: z20.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
+    port: z20.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
+    protocol: z20.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
+    restart_policy: z20.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
+    deploy_strategy: z20.enum(["rolling", "recreate"]).optional().describe(
       'How a deploy replaces the container. "rolling" (default) = start new, wait for healthy, switch traffic, stop old (zero downtime). "recreate" = stop old first, then start new (brief outage) \u2014 required for a container holding an exclusive lock on a mounted volume, which cannot deploy at all under rolling.'
     ),
-    pre_deploy_command: z19.string().optional().describe("Shell command run before the new release accepts traffic."),
-    instance_count: z19.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
-    min_instances: z19.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
-    max_instances: z19.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
-    scale_cpu_threshold: z19.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
-    scale_memory_threshold: z19.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
-    scale_requests_per_sec_threshold: z19.number().int().min(1).max(1e4).nullable().optional().describe("Autoscale request-rate trigger (1\u201310000 req/s). null stops using it."),
-    build_timeout_seconds: z19.number().int().min(60).max(1800).nullable().optional().describe("Kill a build that runs longer than this (60\u20131800s). null = default."),
-    log_filter_rules: z19.array(
-      z19.object({
-        pattern: z19.string().min(1).max(200),
-        action: z19.enum(["drop", "downgrade"])
+    pre_deploy_command: z20.string().optional().describe("Shell command run before the new release accepts traffic."),
+    instance_count: z20.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
+    min_instances: z20.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
+    max_instances: z20.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
+    scale_cpu_threshold: z20.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
+    scale_memory_threshold: z20.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
+    scale_requests_per_sec_threshold: z20.number().int().min(1).max(1e4).nullable().optional().describe("Autoscale request-rate trigger (1\u201310000 req/s). null stops using it."),
+    build_timeout_seconds: z20.number().int().min(60).max(1800).nullable().optional().describe("Kill a build that runs longer than this (60\u20131800s). null = default."),
+    plan: z20.enum(SERVICE_PLANS).optional().describe(
+      "Move to a different size tier. memory_mb and cpu_shares are clamped to the tier, so this is what raises the ceiling. Changes cost."
+    ),
+    docker_image: z20.string().max(500).nullable().optional().describe(
+      "Repoint an image-backed service. Applies on the next deploy. null clears it."
+    ),
+    cron_schedule: z20.string().max(100).nullable().optional().describe("Cron expression for a cron_job service. null clears it."),
+    publish_path: z20.string().max(500).nullable().optional().describe('Static-site output directory, e.g. "dist". null clears it.'),
+    runtime: z20.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026). Normally auto-detected."),
+    log_filter_rules: z20.array(
+      z20.object({
+        pattern: z20.string().min(1).max(200),
+        action: z20.enum(["drop", "downgrade"])
       })
     ).max(50).optional().describe(
       "Runtime-log filter rules. Empty array [] clears all rules. Each pattern is case-insensitive substring match against the message."
@@ -4806,6 +4892,10 @@ defineTool({
     if (args.auto_deploy !== void 0) serviceUpdate["autoDeploy"] = args.auto_deploy;
     if (args.health_check_path !== void 0)
       serviceUpdate["healthCheckPath"] = args.health_check_path;
+    if (args.plan !== void 0) serviceUpdate["plan"] = args.plan;
+    if (args.cron_schedule !== void 0) serviceUpdate["cronSchedule"] = args.cron_schedule;
+    if (args.publish_path !== void 0) serviceUpdate["publishPath"] = args.publish_path;
+    if (args.runtime !== void 0) serviceUpdate["runtime"] = args.runtime;
     const configUpdate = {};
     if (args.health_check_enabled !== void 0)
       configUpdate["healthCheckEnabled"] = args.health_check_enabled;
@@ -4841,6 +4931,7 @@ defineTool({
       configUpdate["scaleRequestsPerSecThreshold"] = args.scale_requests_per_sec_threshold;
     if (args.build_timeout_seconds !== void 0)
       configUpdate["buildTimeoutSeconds"] = args.build_timeout_seconds;
+    if (args.docker_image !== void 0) configUpdate["dockerImage"] = args.docker_image;
     if (args.log_filter_rules !== void 0) {
       configUpdate["logFilterRules"] = args.log_filter_rules;
     }
@@ -4889,7 +4980,7 @@ defineTool({
     'Example: suspend_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId.")
+    service_id: z20.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4913,7 +5004,7 @@ defineTool({
     'Example: resume_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId.")
+    service_id: z20.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4939,7 +5030,7 @@ defineTool({
     'Example: delete_service({ service_id: "svc_abandoned" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId.")
+    service_id: z20.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -4978,16 +5069,16 @@ defineTool({
     '  - Just count error lines without fetching them: get_service_logs({ service_id: "svc_abc", level: "error", since: "-5m", count_only: true }) \u2192 { count: 47 }'
   ].join("\n"),
   input: {
-    service_id: z19.string().describe("Service publicId."),
-    lines: z19.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
-    since: z19.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z19.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z19.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z19.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
+    service_id: z20.string().describe("Service publicId."),
+    lines: z20.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
+    since: z20.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z20.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z20.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z20.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
       "Filter by structured JSON log level (pino/bunyan/severity). Falls back to a stream-alias hint for plain-text logs (info/debug\u2192stdout, warn/error/fatal\u2192stderr)."
     ),
-    search: z19.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z19.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
+    search: z20.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z20.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -5036,14 +5127,14 @@ defineTool({
     'Example: get_service_logs_bulk({ service_ids: ["svc_api", "svc_worker"], level: "error", since: "-15m", count_only: true }) \u2192 { results: { svc_api: { count: 0 }, svc_worker: { count: 12 } } }.'
   ].join("\n"),
   input: {
-    service_ids: z19.array(z19.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
-    lines_per_service: z19.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
-    since: z19.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z19.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z19.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z19.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
-    search: z19.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z19.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
+    service_ids: z20.array(z20.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
+    lines_per_service: z20.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
+    since: z20.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z20.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z20.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z20.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
+    search: z20.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z20.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -5089,7 +5180,7 @@ defineTool({
 });
 
 // src/tools/uptime.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var STATUS_MEANING = [
   "Status vocabulary: `up` answering as expected \xB7 `down` failed the threshold and an alert is open \xB7 `unknown` not probed yet \xB7 `unresolvable` the service has no active domain to request \xB7 `paused` the service is not meant to be answering (suspended, mid-deploy, never deployed) OR it sleeps when idle and probing it would keep it awake."
 ].join("\n");
@@ -5111,7 +5202,7 @@ defineTool({
     "",
     "Example: get_uptime_check({ serviceId: 48 }) \u2192 { check: { path: '/healthz', status: 'down', consecutiveFailures: 5, lastError: 'No response within 10000ms', lastChangedAt: '2026-08-21T04:12:00Z', lastTargetUrl: 'https://grundfast.dk/healthz' } }."
   ].join("\n"),
-  input: { serviceId: z20.number().int().positive() },
+  input: { serviceId: z21.number().int().positive() },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
     const response = await ctx.api.get(
@@ -5157,14 +5248,14 @@ defineTool({
     "Example: set_uptime_check({ serviceId: 48, path: '/healthz', intervalSeconds: 60, failureThreshold: 3 }) \u2192 { check: { status: 'unknown', \u2026 } }."
   ].join("\n"),
   input: {
-    serviceId: z20.number().int().positive(),
-    enabled: z20.boolean().optional(),
-    path: z20.string().max(500).optional().describe('Must start with /. Default "/".'),
-    method: z20.enum(["GET", "HEAD"]).optional(),
-    expectedStatus: z20.number().int().min(100).max(599).optional(),
-    timeoutMs: z20.number().int().min(1e3).max(6e4).optional(),
-    intervalSeconds: z20.number().int().min(30).max(3600).optional(),
-    failureThreshold: z20.number().int().min(1).max(10).optional()
+    serviceId: z21.number().int().positive(),
+    enabled: z21.boolean().optional(),
+    path: z21.string().max(500).optional().describe('Must start with /. Default "/".'),
+    method: z21.enum(["GET", "HEAD"]).optional(),
+    expectedStatus: z21.number().int().min(100).max(599).optional(),
+    timeoutMs: z21.number().int().min(1e3).max(6e4).optional(),
+    intervalSeconds: z21.number().int().min(30).max(3600).optional(),
+    failureThreshold: z21.number().int().min(1).max(10).optional()
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -5195,7 +5286,7 @@ defineTool({
     "",
     "Example: delete_uptime_check({ serviceId: 48 }) \u2192 { success: true }."
   ].join("\n"),
-  input: { serviceId: z20.number().int().positive() },
+  input: { serviceId: z21.number().int().positive() },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
     await ctx.api.delete(`/api/services/${teamId}/${args.serviceId}/uptime-check`);
@@ -5204,7 +5295,7 @@ defineTool({
 });
 
 // src/tools/volumes.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var MIN_VOLUME_SIZE_GB = 10;
 defineTool({
   name: "list_volumes",
@@ -5222,7 +5313,7 @@ defineTool({
     'Example: list_volumes({ service_id: "svc_abc" }) \u2192 { items: [{ name: "data", mountPath: "/var/data", sizeGb: 10, status: "active" }] }'
   ].join("\n"),
   input: {
-    service_id: z21.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z22.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -5251,15 +5342,15 @@ defineTool({
     'Example: create_volume({ service_id: "svc_abc", name: "data", mount_path: "/var/data", size_gb: 10 }) \u2192 { volume: { name: "data", mountPath: "/var/data", sizeGb: 10, status: "pending" } }'
   ].join("\n"),
   input: {
-    service_id: z21.string().describe("Service publicId."),
-    name: z21.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
-    mount_path: z21.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
+    service_id: z22.string().describe("Service publicId."),
+    name: z22.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
+    mount_path: z22.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
     // 10 GB is the real floor: the block-storage backend rejects anything
     // smaller. Advertising 1 GB here (and defaulting to it) meant taking the
     // defaults produced a volume that provisioned with `Hetzner API error:
     // 422` on the NEXT deploy, with nothing tying the failure back to the
     // size. Reject it at the call instead.
-    size_gb: z21.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
+    size_gb: z22.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
       `Disk size in GB (minimum ${MIN_VOLUME_SIZE_GB}, default ${MIN_VOLUME_SIZE_GB}, max 100 via MCP).`
     )
   },
@@ -5298,11 +5389,11 @@ defineTool({
     'Example: update_volume({ service_id: "svc_abc", volume_id: "vol_xyz", size_gb: 20 }) \u2192 { volume: { sizeGb: 20, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z21.string().describe("Service publicId."),
-    volume_id: z21.string().describe("Volume publicId (e.g. vol_\u2026)."),
-    mount_path: z21.string().startsWith("/").max(500).optional().describe("New mount path."),
-    size_gb: z21.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`),
-    backup_enabled: z21.boolean().optional().describe("Whether to keep backing this volume up. Past backups are kept either way.")
+    service_id: z22.string().describe("Service publicId."),
+    volume_id: z22.string().describe("Volume publicId (e.g. vol_\u2026)."),
+    mount_path: z22.string().startsWith("/").max(500).optional().describe("New mount path."),
+    size_gb: z22.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`),
+    backup_enabled: z22.boolean().optional().describe("Whether to keep backing this volume up. Past backups are kept either way.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -5341,8 +5432,8 @@ defineTool({
     'Example: delete_volume({ service_id: "svc_abc", volume_id: "vol_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z21.string().describe("Service publicId."),
-    volume_id: z21.string().describe("Volume publicId.")
+    service_id: z22.string().describe("Service publicId."),
+    volume_id: z22.string().describe("Volume publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();