@hoststack.dev/mcp 0.3.0 → 0.5.0

package/dist/index.js

@@ -419,8 +419,9 @@ defineTool({
     '  - action: filter to a specific action (e.g. "service.created", "deploy.triggered").',
     '  - resource_type: filter by resource type (e.g. "service", "deploy", "domain").',
     "  - user_id: filter by acting user numeric ID.",
+    '  - since/until: ISO-8601 timestamp OR a relative offset like "-15m" / "-2h" / "-7d" \u2014 narrow to a time window (handy for correlating a deploy with a log spike).',
     "",
-    "Returns: { items: ActivityLogEntry[], meta? } \u2014 each entry has id, action, resourceType, resourceId, actorEmail, ipAddress, createdAt, and a context payload.",
+    "Returns: { items: ActivityLogEntry[], meta: { page, perPage, total, totalPages } } \u2014 each entry has id, action, resourceType, resourceId, actorEmail, ipAddress, createdAt, and a context payload. Use meta.totalPages to tell whether you have more.",
     "",
     'Example: list_activity_log({ resource_type: "deploy", per_page: 10 }) \u2192 { items: [{ action: "deploy.triggered", actorEmail: "ada@\u2026", \u2026 }], meta: { total: 47, page: 1 } }'
   ].join("\n"),
@@ -429,7 +430,9 @@ defineTool({
     per_page: z2.number().int().positive().max(100).optional().describe("Items per page, hard cap 100."),
     action: z2.string().optional().describe('Action filter, e.g. "service.created".'),
     resource_type: z2.string().optional().describe("Resource type filter."),
-    user_id: z2.number().int().positive().optional().describe("Numeric acting-user filter.")
+    user_id: z2.number().int().positive().optional().describe("Numeric acting-user filter."),
+    since: z2.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-15m", "-2h", "-7d").'),
+    until: z2.string().optional().describe("ISO-8601 timestamp or relative offset upper bound.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -439,13 +442,24 @@ defineTool({
     if (args.action !== void 0) params["action"] = args.action;
     if (args.resource_type !== void 0) params["resourceType"] = args.resource_type;
     if (args.user_id !== void 0) params["userId"] = String(args.user_id);
+    if (args.since !== void 0) params["since"] = args.since;
+    if (args.until !== void 0) params["until"] = args.until;
     const response = await ctx.api.get(
       `/api/activity-log/${teamId}`,
       params
     );
     const items = Array.isArray(response.data) ? response.data.map(shapeActivity) : [];
     const data = { items };
-    if (response.meta !== void 0) data.meta = shape(response.meta);
+    if (response.meta !== void 0) {
+      data.meta = shape(response.meta);
+    } else if (response.page !== void 0 || response.perPage !== void 0 || response.total !== void 0 || response.totalPages !== void 0) {
+      data.meta = shape({
+        page: response.page,
+        perPage: response.perPage,
+        total: response.total,
+        totalPages: response.totalPages
+      });
+    }
     return respond({
       summary: items.length === 0 ? "No activity log entries match the given filters." : `Returned ${items.length} activity log entr${items.length === 1 ? "y" : "ies"}.`,
       data
@@ -453,8 +467,51 @@ defineTool({
   }
 });
 
-// src/tools/cron.ts
+// src/tools/alerts.ts
 import { z as z3 } from "zod";
+defineTool({
+  name: "list_alerts",
+  category: "alerts",
+  description: [
+    "List recent alert-shaped events for the team: deploy failures, git auth losses, service health failures, auto-restarts, ACME cert failures, resource alerts (high CPU), database backup/restore failures, registrant verification lapses.",
+    "",
+    "When to use: triage 'what's currently broken or recently broke for this team'. Pairs with list_activity_log for the full audit feed; this tool is the alert-shaped subset.",
+    "",
+    'By default events are AGGREGATED by (action, resourceId) so flapping events collapse to one row with a fire count + first/last timestamps \u2014 e.g. "service.auto_restarted on service 31, 8 times in the last hour, last at 14:22". Pass aggregate=false to see every raw row.',
+    "",
+    "Inputs (all optional):",
+    '  - since: ISO-8601 timestamp OR relative offset like "-1h" / "-2d". Default: -24h.',
+    "  - until: ISO-8601 upper bound (ignored when aggregating \u2014 aggregated view always extends to now).",
+    "  - limit: max rows (default 100, hard cap 500).",
+    "  - aggregate: true (default) collapses by (action, resourceId); false returns raw rows.",
+    "",
+    "Returns: { alerts: Array, aggregated: boolean }. Each aggregated entry includes action, resourceType, resourceId, severity, count, firstFiredAt, lastFiredAt, lastMetadata. Each raw entry includes id, action, resourceType, resourceId, severity, metadata, createdAt.",
+    "",
+    "Example: list_alerts({ since: '-1h' }) \u2192 { alerts: [{ action: 'deploy.failed', resourceId: 31, severity: 'error', count: 3, lastFiredAt: '\u2026', \u2026 }] }."
+  ].join("\n"),
+  input: {
+    since: z3.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-1h", "-2d"). Default: -24h.'),
+    until: z3.string().optional().describe("ISO-8601 upper bound. Only honored when aggregate=false."),
+    limit: z3.number().int().positive().max(500).optional().describe("Max rows (default 100, hard cap 500)."),
+    aggregate: z3.boolean().optional().describe("Collapse by (action, resourceId). Default true.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const params = {};
+    if (args.since !== void 0) params["since"] = args.since;
+    if (args.until !== void 0) params["until"] = args.until;
+    if (args.limit !== void 0) params["limit"] = String(args.limit);
+    if (args.aggregate === false) params["aggregate"] = "0";
+    const response = await ctx.api.get(`/api/alerts/${teamId}`, params);
+    const items = Array.isArray(response.alerts) ? response.alerts.map(shape) : [];
+    const aggregated = Boolean(response.aggregated);
+    const summary = items.length === 0 ? "No alerts in the requested window \u2014 everything is operating normally." : aggregated ? `Returned ${items.length} alert group${items.length === 1 ? "" : "s"} (flapping events collapsed).` : `Returned ${items.length} raw alert event${items.length === 1 ? "" : "s"}.`;
+    return respond({ summary, data: { alerts: items, aggregated } });
+  }
+});
+
+// src/tools/cron.ts
+import { z as z4 } from "zod";
 defineTool({
   name: "list_cron_executions",
   category: "cron",
@@ -472,8 +529,8 @@ defineTool({
     'Example: list_cron_executions({ service_id: "svc_cron" }) \u2192 { items: [{ status: "succeeded", exitCode: 0, \u2026 }, \u2026] }'
   ].join("\n"),
   input: {
-    service_id: z3.string().describe("Cron service publicId."),
-    limit: z3.number().int().positive().max(200).optional().describe("Max executions to return (default 50).")
+    service_id: z4.string().describe("Cron service publicId."),
+    limit: z4.number().int().positive().max(200).optional().describe("Max executions to return (default 50).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -501,8 +558,8 @@ defineTool({
     'Example: get_cron_execution({ service_id: "svc_cron", execution_id: "exe_xyz" }) \u2192 { execution: { status: "failed", exitCode: 1, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z3.string().describe("Cron service publicId."),
-    execution_id: z3.string().describe("Execution publicId.")
+    service_id: z4.string().describe("Cron service publicId."),
+    execution_id: z4.string().describe("Execution publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -514,7 +571,7 @@ defineTool({
 });
 
 // src/tools/databases.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 defineTool({
   name: "list_databases",
   category: "databases",
@@ -531,7 +588,7 @@ defineTool({
     'Example: list_databases({ project_id: 12 }) \u2192 { items: [{ publicId: "db_\u2026", type: "postgres", status: "running", \u2026 }] }'
   ].join("\n"),
   input: {
-    project_id: z4.number().int().positive().describe("Numeric project ID (from list_projects).")
+    project_id: z5.number().int().positive().describe("Numeric project ID (from list_projects).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -541,6 +598,45 @@ defineTool({
     return respond({ summary, data });
   }
 });
+defineTool({
+  name: "update_database",
+  category: "databases",
+  description: [
+    "Update a managed database \u2014 rename, change plan tier (memory/CPU), or grow disk size.",
+    "",
+    "When to use: the user wants to resize a database (disk or plan), or rename it. Disk can only grow \u2014 shrinking is rejected because the underlying filesystem would orphan data.",
+    "",
+    "Inputs:",
+    '  - database_id: publicId of the database (e.g. "db_\u2026").',
+    "  - name (optional): new database name.",
+    '  - plan (optional): "free" | "starter" | "standard" | "pro" \u2014 changes memory tier.',
+    "  - disk_size_gb (optional): new disk size in GB (must be \u2265 current).",
+    "",
+    "Returns: { database: Database } \u2014 the updated record.",
+    "",
+    'Example: update_database({ database_id: "db_xyz", disk_size_gb: 50 }) \u2192 { database: { diskSizeGb: 50, \u2026 } }'
+  ].join("\n"),
+  input: {
+    database_id: z5.string().describe("Database publicId (e.g. db_xyz)."),
+    name: z5.string().min(1).max(100).optional().describe("New database name."),
+    plan: z5.enum(["free", "starter", "standard", "pro"]).optional().describe("Plan tier (memory/CPU)."),
+    disk_size_gb: z5.number().int().min(1).max(1024).optional().describe("New disk size in GB. Must be \u2265 current.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const input = {};
+    if (args.name !== void 0) input.name = args.name;
+    if (args.plan !== void 0) input.plan = args.plan;
+    if (args.disk_size_gb !== void 0) input.diskSizeGb = args.disk_size_gb;
+    if (Object.keys(input).length === 0) {
+      return respond({ summary: "No fields to update.", data: {} });
+    }
+    const response = await ctx.hoststack.databases.update(teamId, args.database_id, input);
+    const data = { database: shapeDatabase(response.database) };
+    const fields = Object.keys(input).join(", ");
+    return respond({ summary: `Updated ${fields} on database ${args.database_id}.`, data });
+  }
+});
 defineTool({
   name: "get_database",
   category: "databases",
@@ -557,7 +653,7 @@ defineTool({
     'Example: get_database({ database_id: "db_xyz" }) \u2192 { database: { type: "postgres", version: "16", status: "running", \u2026 } }'
   ].join("\n"),
   input: {
-    database_id: z4.string().describe("Database publicId (e.g. db_xyz).")
+    database_id: z5.string().describe("Database publicId (e.g. db_xyz).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -570,7 +666,7 @@ defineTool({
 });
 
 // src/tools/deploys.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 defineTool({
   name: "list_deploys",
   category: "deploys",
@@ -582,12 +678,12 @@ defineTool({
     "Inputs:",
     '  - service_id: publicId of the service (e.g. "svc_abc123"). Use list_services to find it.',
     "",
-    "Returns: { items: Deploy[] } \u2014 each deploy includes id, publicId, status (pending|building|deploying|live|failed|cancelled), commitSha, commitMessage, branch, triggeredBy, startedAt, finishedAt, durationMs.",
+    "Returns: { items: Deploy[] } \u2014 each deploy includes id, publicId, status (pending|building|deploying|live|failed|cancelled), commitSha, commitMessage, branch, triggeredBy, startedAt, finishedAt, buildDurationMs (just the docker build / image-pull step), totalDurationMs (full deploy wall-clock = finishedAt \u2212 startedAt).",
     "",
     'Example: list_deploys({ service_id: "svc_abc" }) \u2192 { items: [{ publicId: "dpl_\u2026", status: "live", commitMessage: "Fix login", \u2026 }, \u2026] }'
   ].join("\n"),
   input: {
-    service_id: z5.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z6.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -609,13 +705,13 @@ defineTool({
     "  - service_id: publicId of the service.",
     '  - deploy_id: publicId of the deploy (e.g. "dpl_\u2026").',
     "",
-    "Returns: { deploy: Deploy } \u2014 full deploy record (status, commitSha, commitMessage, branch, durationMs, finishedAt, etc).",
+    "Returns: { deploy: Deploy } \u2014 full deploy record (status, commitSha, commitMessage, branch, buildDurationMs, totalDurationMs, finishedAt, etc).",
     "",
     'Example: get_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { deploy: { status: "live", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z5.string().describe("Service publicId."),
-    deploy_id: z5.string().describe("Deploy publicId.")
+    service_id: z6.string().describe("Service publicId."),
+    deploy_id: z6.string().describe("Deploy publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -642,8 +738,8 @@ defineTool({
     'Example: trigger_deploy({ service_id: "svc_abc" }) \u2192 { deploy: { publicId: "dpl_\u2026", status: "pending", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z5.string().describe("Service publicId."),
-    clear_cache: z5.boolean().optional().describe("Clear the build cache (default false).")
+    service_id: z6.string().describe("Service publicId."),
+    clear_cache: z6.boolean().optional().describe("Clear the build cache (default false).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -675,8 +771,8 @@ defineTool({
     'Example: cancel_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z5.string().describe("Service publicId."),
-    deploy_id: z5.string().describe("Deploy publicId.")
+    service_id: z6.string().describe("Service publicId."),
+    deploy_id: z6.string().describe("Deploy publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -704,10 +800,10 @@ defineTool({
     'Example: get_deploy_logs({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { logs: "Building\u2026\\nStep 1/8\u2026\\n\u2026", lineCount: 42, nextAfterId: 1234 }'
   ].join("\n"),
   input: {
-    service_id: z5.string().describe("Service publicId."),
-    deploy_id: z5.string().describe("Deploy publicId."),
-    after_id: z5.number().int().optional().describe("Pagination cursor from a previous response\u2019s nextAfterId."),
-    limit: z5.number().int().min(1).max(5e3).optional().describe("Max log entries to fetch (default 500, hard cap 5000).")
+    service_id: z6.string().describe("Service publicId."),
+    deploy_id: z6.string().describe("Deploy publicId."),
+    after_id: z6.number().int().optional().describe("Pagination cursor from a previous response\u2019s nextAfterId."),
+    limit: z6.number().int().min(1).max(5e3).optional().describe("Max log entries to fetch (default 500, hard cap 5000).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -728,9 +824,90 @@ defineTool({
     });
   }
 });
+defineTool({
+  name: "diagnose_deploy",
+  category: "deploys",
+  description: [
+    "One-shot diagnostic bundle for a deploy: full deploy record + tail of build logs + tail of runtime logs starting at the deploy's start time. Lets you investigate any deploy failure mode (build-time failure, health-check timeout, post-deploy runtime crash) without juggling two log endpoints and two IDs.",
+    "",
+    "When to use: a deploy is failed/superseded/stuck and you want the whole story in one call. For just the build output, use get_deploy_logs. For just runtime logs of the running service, use get_service_logs.",
+    "",
+    "Inputs:",
+    "  - service_id: publicId of the service.",
+    "  - deploy_id: publicId of the deploy to diagnose.",
+    "  - build_log_lines (optional): how many trailing build log lines to include. Default 200, max 2000.",
+    "  - runtime_log_lines (optional): how many trailing runtime log lines (since the deploy started) to include. Default 100, max 1000. Set to 0 to skip runtime logs (saves a round-trip when investigating a pure build-time failure).",
+    "",
+    "Returns: { deploy, build: { logs, lineCount }, runtime: { logs, lineCount } } \u2014 runtime is omitted when runtime_log_lines is 0 or the deploy never started a container.",
+    "",
+    'Example: diagnose_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 all three sections in one call.'
+  ].join("\n"),
+  input: {
+    service_id: z6.string().describe("Service publicId."),
+    deploy_id: z6.string().describe("Deploy publicId."),
+    build_log_lines: z6.number().int().min(1).max(2e3).optional().describe("Trailing build log lines. Default 200, max 2000."),
+    runtime_log_lines: z6.number().int().min(0).max(1e3).optional().describe(
+      "Trailing runtime log lines since deploy start. Default 100, max 1000. 0 = skip."
+    )
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const buildLimit = args.build_log_lines ?? 200;
+    const runtimeLimit = args.runtime_log_lines ?? 100;
+    const [deployResp, buildResp] = await Promise.all([
+      ctx.hoststack.deploys.get(teamId, args.service_id, args.deploy_id),
+      ctx.hoststack.deploys.getLogs(teamId, args.service_id, args.deploy_id, {
+        limit: buildLimit
+      })
+    ]);
+    const buildEntries = buildResp.logs;
+    const buildLogs = buildEntries.map((e) => e.message).join("\n");
+    const deployShape = shapeDeploy(deployResp.deploy);
+    const deployStatus = deployShape && "status" in deployShape ? deployShape.status : "unknown";
+    const startedAtRaw = deployShape && "startedAt" in deployShape ? deployShape.startedAt : void 0;
+    const startedAt = typeof startedAtRaw === "string" ? startedAtRaw : void 0;
+    const data = {
+      deploy: deployShape,
+      build: { logs: buildLogs, lineCount: buildEntries.length }
+    };
+    const hadContainer = deployStatus !== "pending" && deployStatus !== "building";
+    if (runtimeLimit > 0 && hadContainer) {
+      const runtimeResp = await ctx.hoststack.services.getRuntimeLogs(
+        teamId,
+        args.service_id,
+        {
+          lines: runtimeLimit,
+          ...startedAt ? { since: startedAt } : {}
+        }
+      );
+      if ("count" in runtimeResp) {
+        data["runtime"] = { logs: "", lineCount: runtimeResp.count };
+      } else {
+        const runtimeEntries = Array.isArray(runtimeResp.logs) ? runtimeResp.logs : typeof runtimeResp.logs === "string" ? runtimeResp.logs.split("\n").map((line) => ({ message: line })) : [];
+        const runtimeText = runtimeEntries.map(
+          (e) => typeof e === "object" && "message" in e ? String(e.message) : String(e)
+        ).join("\n");
+        data["runtime"] = {
+          logs: runtimeText,
+          lineCount: runtimeEntries.length,
+          sinceWindow: startedAt ?? null
+        };
+      }
+    }
+    const failureSummary = shape({
+      status: deployStatus,
+      errorMessage: deployShape && "errorMessage" in deployShape ? deployShape.errorMessage : void 0
+    });
+    data["summary"] = failureSummary;
+    return respond({
+      summary: `Diagnostic bundle for deploy ${args.deploy_id} (${deployStatus}): ${buildEntries.length} build log line${buildEntries.length === 1 ? "" : "s"}${runtimeLimit > 0 && hadContainer ? ", runtime log tail included" : ""}.`,
+      data
+    });
+  }
+});
 
 // src/tools/domains.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 defineTool({
   name: "list_domains",
   category: "domains",
@@ -769,8 +946,8 @@ defineTool({
     'Example: add_domain({ hostname: "api.example.com", service_id: "svc_abc" }) \u2192 { domain: { hostname: "api.example.com", dnsTargets: [...], verified: false, \u2026 } }'
   ].join("\n"),
   input: {
-    hostname: z6.string().min(3).max(253).describe("Fully-qualified hostname (e.g. api.example.com)."),
-    service_id: z6.string().optional().describe("Optional service publicId to bind to.")
+    hostname: z7.string().min(3).max(253).describe("Fully-qualified hostname (e.g. api.example.com)."),
+    service_id: z7.string().optional().describe("Optional service publicId to bind to.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -800,12 +977,15 @@ defineTool({
     'Example: verify_domain({ domain_id: "dom_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    domain_id: z6.string().describe("Domain publicId.")
+    domain_id: z7.string().describe("Domain publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
     await ctx.hoststack.domains.verify(teamId, args.domain_id);
-    return respond({ summary: `Triggered DNS verification for ${args.domain_id}.`, data: { ok: true } });
+    return respond({
+      summary: `Triggered DNS verification for ${args.domain_id}.`,
+      data: { ok: true }
+    });
   }
 });
 defineTool({
@@ -824,7 +1004,7 @@ defineTool({
     'Example: remove_domain({ domain_id: "dom_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    domain_id: z6.string().describe("Domain publicId.")
+    domain_id: z7.string().describe("Domain publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -834,7 +1014,7 @@ defineTool({
 });
 
 // src/tools/env-vars.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 defineTool({
   name: "list_env_vars",
   category: "env-vars",
@@ -851,7 +1031,7 @@ defineTool({
     'Example: list_env_vars({ service_id: "svc_abc" }) \u2192 { items: [{ key: "DATABASE_URL", value: "\u2022\u2022\u2022\u2022\u2022\u2022", isSecret: true }, { key: "PORT", value: "3000", isSecret: false }] }'
   ].join("\n"),
   input: {
-    service_id: z7.string().describe("Service publicId.")
+    service_id: z8.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -880,10 +1060,10 @@ defineTool({
     'Example: set_env_var({ service_id: "svc_abc", key: "DATABASE_URL", value: "postgres://\u2026", is_secret: true }) \u2192 { envVar: { key: "DATABASE_URL", value: "\u2022\u2022\u2022\u2022\u2022\u2022", \u2026 }, action: "updated" }'
   ].join("\n"),
   input: {
-    service_id: z7.string().describe("Service publicId."),
-    key: z7.string().min(1).max(128).describe("Env-var key."),
-    value: z7.string().describe("New value."),
-    is_secret: z7.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true.")
+    service_id: z8.string().describe("Service publicId."),
+    key: z8.string().min(1).max(128).describe("Env-var key."),
+    value: z8.string().describe("New value."),
+    is_secret: z8.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -891,10 +1071,15 @@ defineTool({
     const existing = await ctx.hoststack.envVars.list(teamId, args.service_id);
     const match = existing.envVars.find((v) => v.key === args.key);
     if (match) {
-      const response2 = await ctx.hoststack.envVars.update(teamId, args.service_id, String(match.id), {
-        value: args.value,
-        isSecret
-      });
+      const response2 = await ctx.hoststack.envVars.update(
+        teamId,
+        args.service_id,
+        String(match.id),
+        {
+          value: args.value,
+          isSecret
+        }
+      );
       const data2 = {
         envVar: shapeEnvVar(response2.envVar),
         action: "updated"
@@ -930,18 +1115,18 @@ defineTool({
     'Example: delete_env_var({ service_id: "svc_abc", key: "OLD_FLAG" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z7.string().describe("Service publicId."),
-    key: z7.string().min(1).max(128).describe("Env-var key to delete.")
+    service_id: z8.string().describe("Service publicId."),
+    key: z8.string().min(1).max(128).describe("Env-var key to delete.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
     const existing = await ctx.hoststack.envVars.list(teamId, args.service_id);
     const match = existing.envVars.find((v) => v.key === args.key);
     if (!match) {
-      return respondError(
-        `Env var "${args.key}" not found on service ${args.service_id}.`,
-        { key: args.key, service_id: args.service_id }
-      );
+      return respondError(`Env var "${args.key}" not found on service ${args.service_id}.`, {
+        key: args.key,
+        service_id: args.service_id
+      });
     }
     await ctx.hoststack.envVars.delete(teamId, args.service_id, String(match.id));
     return respond({
@@ -967,19 +1152,19 @@ defineTool({
     'Example: bulk_set_env_vars({ service_id: "svc_abc", env_vars: [{ key: "PORT", value: "3000", is_secret: false }, { key: "DATABASE_URL", value: "\u2026", is_secret: true }] }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z7.string().describe("Service publicId."),
-    env_vars: z7.array(
-      z7.object({
-        key: z7.string().min(1).max(128),
-        value: z7.string(),
-        is_secret: z7.boolean().optional()
+    service_id: z8.string().describe("Service publicId."),
+    env_vars: z8.array(
+      z8.object({
+        key: z8.string().min(1).max(128),
+        value: z8.string(),
+        is_secret: z8.boolean().optional()
       })
     ).max(500).describe("Array of env-var rows. Hard cap 500.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
     const payload = {
-      envVars: args.env_vars.map((v) => {
+      vars: args.env_vars.map((v) => {
         const row = {
           key: v.key,
           value: v.value
@@ -996,6 +1181,146 @@ defineTool({
   }
 });
 
+// src/tools/environments.ts
+import { z as z9 } from "zod";
+defineTool({
+  name: "list_environments",
+  category: "environments",
+  description: [
+    "List every environment for a project (production / staging / development / preview).",
+    "",
+    "When to use: the user wants to see what envs exist before creating a service in one or promoting a deploy. Every project has at least Production.",
+    "",
+    "Inputs:",
+    '  - project_id: project publicId (e.g. "prj_abc123").',
+    "",
+    "Returns: { items: Environment[] } \u2014 id, publicId, name, type, isDefault, isProtected.",
+    "",
+    'Example: list_environments({ project_id: "prj_abc" }) \u2192 { items: [{ name: "Production", type: "production", isDefault: true }, { name: "Staging", type: "staging" }] }'
+  ].join("\n"),
+  input: {
+    project_id: z9.string().describe("Project publicId.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.environments.list(teamId, args.project_id);
+    const data = shapeList(response, "environments", shape);
+    const summary = data.items.length === 0 ? "No environments yet \u2014 every project should have Production by default." : `Found ${data.items.length} environment${data.items.length === 1 ? "" : "s"}.`;
+    return respond({ summary, data });
+  }
+});
+defineTool({
+  name: "create_environment",
+  category: "environments",
+  description: [
+    "Create a new environment in a project (e.g. Staging, QA, Preview).",
+    "",
+    "When to use: the user wants to add an env so they can run a sibling service alongside production for testing or staging before release.",
+    "",
+    "Inputs:",
+    "  - project_id: project publicId.",
+    "  - name: human-readable name (1\u201364 chars). Shown in the env switcher.",
+    '  - type: "production" | "staging" | "development" | "preview". Determines the hostname suffix on services in this env (production stays clean; others get -staging / -dev / -preview).',
+    "  - is_protected (optional): require admin role for destructive actions in this env. Default false.",
+    "",
+    "Returns: { environment: Environment }.",
+    "",
+    'Example: create_environment({ project_id: "prj_abc", name: "Staging", type: "staging" }) \u2192 { environment: { id: 7, publicId: "environment_\u2026", name: "Staging", type: "staging" } }'
+  ].join("\n"),
+  input: {
+    project_id: z9.string().describe("Project publicId."),
+    name: z9.string().min(1).max(64).describe("Environment name (1\u201364 chars)."),
+    type: z9.enum(["production", "staging", "development", "preview"]).describe("Environment type \u2014 drives the hostname suffix."),
+    is_protected: z9.boolean().optional().describe("Require admin role for destructive actions. Default false.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const input = {
+      name: args.name,
+      type: args.type
+    };
+    if (args.is_protected !== void 0) input.isProtected = args.is_protected;
+    const response = await ctx.hoststack.environments.create(teamId, args.project_id, input);
+    const data = { environment: shape(response.environment) };
+    return respond({
+      summary: `Created environment "${args.name}" (${args.type}) in project ${args.project_id}.`,
+      data
+    });
+  }
+});
+defineTool({
+  name: "delete_environment",
+  category: "environments",
+  description: [
+    "Delete an environment from a project.",
+    "",
+    "When to use: an env is no longer used (e.g. tearing down a feature branch staging). Blocked when the env still has live services or databases attached \u2014 destroy or move them first. The default env (usually Production) cannot be deleted.",
+    "",
+    "Inputs:",
+    "  - project_id: project publicId.",
+    "  - environment_id: environment publicId or numeric id.",
+    "",
+    "Returns: { success: true } on success.",
+    "",
+    'Example: delete_environment({ project_id: "prj_abc", environment_id: "environment_xyz" }) \u2192 { success: true }'
+  ].join("\n"),
+  input: {
+    project_id: z9.string().describe("Project publicId."),
+    environment_id: z9.union([z9.string(), z9.number()]).describe("Environment publicId or numeric id.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    await ctx.hoststack.environments.delete(teamId, args.project_id, args.environment_id);
+    return respond({
+      summary: `Deleted environment ${String(args.environment_id)} from project ${args.project_id}.`,
+      data: { success: true }
+    });
+  }
+});
+defineTool({
+  name: "promote_deploy",
+  category: "environments",
+  description: [
+    "Promote a built deploy from one environment to another (build-once, run-many).",
+    "",
+    "When to use: the user has tested a deploy in staging and wants to ship that exact image to production without rebuilding. Atomic and image-based \u2014 same docker image runs on the sibling service in the target env.",
+    "",
+    "Inputs:",
+    "  - service_id: source service publicId (the one that owns the deploy).",
+    "  - deploy_id: source deploy publicId. Must have `dockerImageId` set (i.e. a successful build).",
+    "  - target_environment_id: env publicId or numeric id to promote into. Must be in the same project. Cannot be the source service's own env.",
+    "",
+    "Behaviour: if a sibling service with the same name already exists in the target env, the new deploy lands on it. Otherwise the API auto-clones the source service's build/runtime config into the target env first. Env-specific config (env vars, secret files, volumes, IP allowlists, custom domains) is NOT copied \u2014 those are per-env by design.",
+    "",
+    "Returns: { deploy: Deploy } \u2014 the new deploy on the target service.",
+    "",
+    'Example: promote_deploy({ service_id: "svc_staging", deploy_id: "dpl_built", target_environment_id: "environment_prod" }) \u2192 { deploy: { id: 99, status: "pending", trigger: "rollback", dockerImageId: "sha256:\u2026" } }'
+  ].join("\n"),
+  input: {
+    service_id: z9.string().describe("Source service publicId."),
+    deploy_id: z9.string().describe("Source deploy publicId (must have a built image)."),
+    target_environment_id: z9.union([z9.string(), z9.number()]).describe("Target environment publicId or numeric id.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const targetEnvId = await ctx.hoststack.resolveId(args.target_environment_id, {
+      kind: "environment",
+      teamId: await ctx.hoststack.resolveId(teamId, { kind: "team" })
+    });
+    const response = await ctx.hoststack.deploys.promote(
+      teamId,
+      args.service_id,
+      args.deploy_id,
+      targetEnvId
+    );
+    const data = { deploy: shape(response.deploy) };
+    return respond({
+      summary: `Promoted deploy ${args.deploy_id} from service ${args.service_id} to env ${String(args.target_environment_id)}.`,
+      data
+    });
+  }
+});
+
 // src/tools/meta.ts
 defineTool({
   name: "get_me",
@@ -1022,8 +1347,190 @@ defineTool({
   }
 });
 
+// src/tools/notifications.ts
+import { z as z10 } from "zod";
+var NOTIFICATION_EVENTS = [
+  "deploy.started",
+  "deploy.succeeded",
+  "deploy.failed",
+  "deploy.failed_consecutive",
+  "service.created",
+  "service.deleted",
+  "service.suspended",
+  "service.resumed",
+  "service.restart_failed",
+  "service.auto_suspended",
+  "service.acme_cert_failed",
+  "git.auth_failed"
+];
+defineTool({
+  name: "list_notification_channels",
+  category: "alerts",
+  description: [
+    "List configured notification channels for the team (Slack/Discord webhooks + email recipients). Each channel has a list of events it subscribes to \u2014 fire only happens when an event in that list occurs.",
+    "",
+    "When to use: setting up alerts ('which channels are notifying us on deploy failures?'), auditing why someone got/didn't get paged, or before subscribing a new event.",
+    "",
+    "Returns: { items: Channel[] } \u2014 each channel includes id, type, name, webhookUrl (masked), active, events, createdAt.",
+    "",
+    "Example: list_notification_channels() \u2192 { items: [{ id: 3, type: 'slack', name: 'eng-alerts', events: ['deploy.failed', 'git.auth_failed'], \u2026 }] }"
+  ].join("\n"),
+  input: {},
+  handler: async (_args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.notifications.listChannels(teamId);
+    const data = shapeList(response, "channels", shape);
+    const summary = data.items.length === 0 ? "No notification channels yet \u2014 create one with create_notification_channel." : `Found ${data.items.length} notification channel${data.items.length === 1 ? "" : "s"}.`;
+    return respond({ summary, data });
+  }
+});
+defineTool({
+  name: "create_notification_channel",
+  category: "alerts",
+  description: [
+    "Create a Slack, Discord, or email notification channel and subscribe it to a list of events.",
+    "",
+    "When to use: setting up alert delivery for a team \u2014 paging the on-call when a deploy fails, posting to #incidents when git auth breaks, emailing the owner on ACME renewal failure.",
+    "",
+    "For type=email, `webhook_url` is the recipient email address. For type=slack or type=discord, it is the incoming webhook URL. The URL is stored encrypted server-side and masked in list responses.",
+    "",
+    "Inputs:",
+    '  - type: "slack" | "discord" | "email".',
+    "  - name: human-readable label (1\u2013128 chars).",
+    "  - webhook_url: Slack/Discord webhook URL OR email address.",
+    "  - events: list of event names to subscribe to. Pass an empty list to create a channel that fires for nothing (manual subscribe later with update_notification_channel).",
+    "",
+    "Valid events: deploy.started, deploy.succeeded, deploy.failed, deploy.failed_consecutive, service.created, service.deleted, service.suspended, service.resumed, service.restart_failed, service.auto_suspended, service.acme_cert_failed, git.auth_failed.",
+    "",
+    "Returns: { channel: Channel }.",
+    "",
+    "Example: create_notification_channel({ type: 'slack', name: 'eng-alerts', webhook_url: 'https://hooks.slack.com/\u2026', events: ['deploy.failed', 'git.auth_failed', 'service.restart_failed'] })"
+  ].join("\n"),
+  input: {
+    type: z10.enum(["slack", "discord", "email"]).describe("Channel type."),
+    name: z10.string().min(1).max(128).describe("Human-readable label."),
+    webhook_url: z10.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
+    events: z10.array(z10.enum(NOTIFICATION_EVENTS)).describe("List of events the channel subscribes to. Empty list = subscribe to nothing.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.notifications.createChannel(teamId, {
+      type: args.type,
+      name: args.name,
+      webhookUrl: args.webhook_url,
+      events: args.events
+    });
+    const data = { channel: shape(response.channel) };
+    return respond({
+      summary: `Created ${args.type} channel "${args.name}" subscribed to ${args.events.length} event${args.events.length === 1 ? "" : "s"}.`,
+      data
+    });
+  }
+});
+defineTool({
+  name: "update_notification_channel",
+  category: "alerts",
+  description: [
+    "Update a notification channel: rename, enable/disable, or change its event subscription list. The webhook URL and type are immutable \u2014 create a new channel if those need to change.",
+    "",
+    "When to use: silencing a noisy channel (active=false), adding a new event to an existing list, or relabeling.",
+    "",
+    "Inputs:",
+    "  - channel_id: numeric id of the channel.",
+    "  - name (optional): new label.",
+    "  - active (optional): false to silence, true to re-enable.",
+    "  - events (optional): replace the full subscription list. Passing [] silences all events without disabling the channel.",
+    "",
+    "Returns: { channel: Channel }.",
+    "",
+    "Example: update_notification_channel({ channel_id: 3, events: ['deploy.failed', 'service.restart_failed', 'git.auth_failed'] })"
+  ].join("\n"),
+  input: {
+    channel_id: z10.number().int().positive().describe("Numeric channel id from list_notification_channels."),
+    name: z10.string().min(1).max(128).optional().describe("New label."),
+    active: z10.boolean().optional().describe("false silences without deleting."),
+    events: z10.array(z10.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const update = {};
+    if (args.name !== void 0) update.name = args.name;
+    if (args.active !== void 0) update.active = args.active;
+    if (args.events !== void 0) update.events = args.events;
+    if (Object.keys(update).length === 0) {
+      return respond({ summary: "No fields to update.", data: {} });
+    }
+    const response = await ctx.hoststack.notifications.updateChannel(
+      teamId,
+      args.channel_id,
+      update
+    );
+    const data = { channel: shape(response.channel) };
+    return respond({
+      summary: `Updated notification channel #${args.channel_id}.`,
+      data
+    });
+  }
+});
+defineTool({
+  name: "delete_notification_channel",
+  category: "alerts",
+  description: [
+    "Permanently delete a notification channel. Use update_notification_channel({ active: false }) to silence without deleting if you might want it back later.",
+    "",
+    "When to use: a channel is no longer needed (decommissioned Slack workspace, team member left, webhook leaked) and you want it gone from the team config entirely.",
+    "",
+    "Inputs:",
+    "  - channel_id: numeric id of the channel.",
+    "",
+    "Returns: { ok: true }.",
+    "",
+    "Example: delete_notification_channel({ channel_id: 3 }) \u2192 { ok: true }"
+  ].join("\n"),
+  input: {
+    channel_id: z10.number().int().positive().describe("Numeric channel id.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    await ctx.hoststack.notifications.deleteChannel(teamId, args.channel_id);
+    return respond({
+      summary: `Deleted notification channel #${args.channel_id}.`,
+      data: { ok: true }
+    });
+  }
+});
+defineTool({
+  name: "test_notification_channel",
+  category: "alerts",
+  description: [
+    'Fire a synthetic test event to the channel so the user can confirm the webhook is wired up correctly. The webhook receives an unmistakeable "test message" payload.',
+    "",
+    "When to use: after creating a channel, or when alerts stop arriving \u2014 quickest way to tell whether the issue is on HostStack's side or the channel's.",
+    "",
+    "Inputs:",
+    "  - channel_id: numeric id of the channel.",
+    "",
+    "Returns: { success: boolean, error?: string } \u2014 false + error string when the webhook returned non-2xx.",
+    "",
+    "Example: test_notification_channel({ channel_id: 3 }) \u2192 { success: true }"
+  ].join("\n"),
+  input: {
+    channel_id: z10.number().int().positive().describe("Numeric channel id.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.notifications.testChannel(teamId, args.channel_id);
+    const data = shape(response);
+    const okFlag = data && typeof data === "object" && "success" in data ? data.success : false;
+    return respond({
+      summary: okFlag ? `Test event delivered to channel #${args.channel_id}.` : `Test event FAILED for channel #${args.channel_id}: ${data.error ?? "unknown error"}.`,
+      data
+    });
+  }
+});
+
 // src/tools/projects.ts
-import { z as z8 } from "zod";
+import { z as z11 } from "zod";
 defineTool({
   name: "list_projects",
   category: "projects",
@@ -1063,9 +1570,9 @@ defineTool({
     'Example: create_project({ name: "billing-api", description: "Stripe webhooks", region: "fsn1" }) \u2192 { project: { id: 12, publicId: "prj_\u2026", \u2026 } }'
   ].join("\n"),
   input: {
-    name: z8.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
-    description: z8.string().max(500).optional().describe("Short description (\u2264500 chars)."),
-    region: z8.enum(["fsn1", "nbg1", "hel1"]).optional().describe("Hetzner region: fsn1 | nbg1 | hel1.")
+    name: z11.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
+    description: z11.string().max(500).optional().describe("Short description (\u2264500 chars)."),
+    region: z11.enum(["fsn1", "nbg1", "hel1"]).optional().describe("Hetzner region: fsn1 | nbg1 | hel1.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1096,9 +1603,9 @@ defineTool({
     'Example: update_project({ project_id: "prj_abc", name: "billing-prod" }) \u2192 { project: { name: "billing-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z8.string().describe("Project publicId."),
-    name: z8.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
-    description: z8.string().max(500).optional().describe("New description (\u2264500 chars).")
+    project_id: z11.string().describe("Project publicId."),
+    name: z11.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
+    description: z11.string().max(500).optional().describe("New description (\u2264500 chars).")
   },
   handler: async (args, ctx) => {
     if (args.name === void 0 && args.description === void 0) {
@@ -1132,7 +1639,7 @@ defineTool({
     'Example: get_project({ project_id: "prj_abc" }) \u2192 { project: { id: 12, name: "billing", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z8.string().describe("Project publicId (e.g. prj_abc123).")
+    project_id: z11.string().describe("Project publicId (e.g. prj_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1144,25 +1651,59 @@ defineTool({
 });
 
 // src/tools/services.ts
-import { z as z9 } from "zod";
+import { z as z12 } from "zod";
 defineTool({
   name: "list_services",
   category: "services",
   description: [
-    "List every service (web, worker, cron, private) in the active HostStack team.",
+    "List services (web, worker, cron, private, static) in the active HostStack team.",
     "",
     "When to use: the agent needs to find a service by name, check what is deployed, or pick a target for a follow-up tool (logs, deploys, env vars). This is the canonical way to resolve a publicId from a human-friendly name.",
     "",
+    "Inputs (all optional):",
+    '  - project_id: narrow to one project (numeric id or publicId "prj_\u2026").',
+    '  - environment_id: narrow to one environment (numeric id or publicId "env_\u2026").',
+    '  - status: "active" | "deploying" | "suspended" | "failed" | "not_deployed".',
+    '  - type: "web_service" | "private_service" | "worker" | "cron_job" | "static_site".',
+    "",
     "Returns: { items: Service[] } \u2014 each service includes id, publicId, name, type, status, projectId, repoUrl, branch, runtime, createdAt.",
     "",
-    'Example: list_services() \u2192 { items: [{ id: 31, publicId: "svc_\u2026", name: "api", type: "web", status: "running", \u2026 }] }'
+    'Example: list_services({ status: "failed" }) \u2192 only services that need attention.'
   ].join("\n"),
-  input: {},
-  handler: async (_args, ctx) => {
+  input: {
+    project_id: z12.union([z12.number().int().positive(), z12.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
+    environment_id: z12.union([z12.number().int().positive(), z12.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
+    status: z12.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
+    type: z12.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type.")
+  },
+  handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
-    const response = await ctx.hoststack.services.list(teamId);
+    const filters = {};
+    if (args.project_id !== void 0) {
+      const resolved = await ctx.hoststack.resolveId(args.project_id, {
+        kind: "project",
+        teamId
+      });
+      filters.projectId = resolved;
+    }
+    if (args.environment_id !== void 0) {
+      const resolved = await ctx.hoststack.resolveId(args.environment_id, {
+        kind: "environment",
+        teamId
+      });
+      filters.environmentId = resolved;
+    }
+    if (args.status) filters.status = args.status;
+    if (args.type) filters.type = args.type;
+    const response = await ctx.hoststack.services.list(teamId, filters);
     const data = shapeList(response, "services", shapeService);
-    const summary = data.items.length === 0 ? "No services yet \u2014 create one with create_service or via the dashboard." : `Found ${data.items.length} service${data.items.length === 1 ? "" : "s"}.`;
+    const filterDesc = [
+      args.project_id !== void 0 ? `project=${args.project_id}` : null,
+      args.environment_id !== void 0 ? `env=${args.environment_id}` : null,
+      args.status ? `status=${args.status}` : null,
+      args.type ? `type=${args.type}` : null
+    ].filter(Boolean).join(", ");
+    const summary = data.items.length === 0 ? filterDesc ? `No services match the given filters (${filterDesc}).` : "No services yet \u2014 create one with create_service or via the dashboard." : `Found ${data.items.length} service${data.items.length === 1 ? "" : "s"}${filterDesc ? ` matching ${filterDesc}` : ""}.`;
     return respond({ summary, data });
   }
 });
@@ -1182,7 +1723,7 @@ defineTool({
     'Example: get_service({ service_id: "svc_abc" }) \u2192 { service: { type: "web", status: "running", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z12.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1198,7 +1739,7 @@ defineTool({
   description: [
     "Fetch the latest CPU, memory, network, and request-rate metrics for a service.",
     "",
-    "When to use: a service is reportedly slow, you suspect resource pressure, or you want a quick health snapshot before scaling. Returns a single point-in-time sample, not a time series.",
+    'When to use: a service is reportedly slow, you suspect resource pressure, or you want a quick health snapshot before scaling. Returns a single point-in-time sample. For a time series \u2014 "is memory growing?", "did CPU spike during that deploy?" \u2014 use get_service_metrics_history instead.',
     "",
     "Inputs:",
     "  - service_id: publicId of the service.",
@@ -1208,7 +1749,7 @@ defineTool({
     'Example: get_service_metrics({ service_id: "svc_abc" }) \u2192 { metrics: { cpu: 0.42, memory: 0.71, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId.")
+    service_id: z12.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1217,6 +1758,55 @@ defineTool({
     return respond({ summary: `Metrics snapshot for service ${args.service_id}.`, data });
   }
 });
+defineTool({
+  name: "get_service_metrics_history",
+  category: "services",
+  description: [
+    "Fetch a metrics time series (CPU, memory, network, disk) for a service.",
+    "",
+    'When to use: answering "is memory growing over the last hour?", "did CPU spike during deploy X?", or "what does normal look like for this service?". Pairs well with get_deploy to align spikes against deploy times.',
+    "",
+    "Inputs (all optional \u2014 omit both for the trailing hour):",
+    "  - service_id: publicId of the service.",
+    '  - from: ISO-8601 lower bound OR relative offset like "-15m" / "-2h" / "-7d".',
+    "  - to: ISO-8601 upper bound (or relative offset). Defaults to now.",
+    "",
+    "Resolution: \u22647d \u2192 raw samples (~minute granularity), \u226430d \u2192 hourly pre-aggregates, >30d \u2192 daily. Up to ~500 points returned.",
+    "",
+    "Returns: { history: Array<{ timestamp, cpuPercent, memoryUsedMb, memoryLimitMb, networkRxBytes, networkTxBytes, diskUsedMb }> }.",
+    "",
+    'Example: get_service_metrics_history({ service_id: "svc_abc", from: "-1h" }) \u2192 60-ish points for the last hour.'
+  ].join("\n"),
+  input: {
+    service_id: z12.string().describe("Service publicId."),
+    from: z12.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
+    to: z12.string().optional().describe("ISO-8601 upper bound; defaults to now.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const opts = {};
+    const resolveRel = (raw) => {
+      const rel = /^-(\d+)(s|m|h|d)$/.exec(raw.trim());
+      if (!rel) return raw;
+      const amount = Number.parseInt(rel[1], 10);
+      const unit = rel[2];
+      const ms = unit === "s" ? amount * 1e3 : unit === "m" ? amount * 6e4 : unit === "h" ? amount * 36e5 : amount * 864e5;
+      return new Date(Date.now() - ms).toISOString();
+    };
+    if (args.from) opts.from = resolveRel(args.from);
+    if (args.to) opts.to = resolveRel(args.to);
+    const response = await ctx.hoststack.services.getMetricsHistory(
+      teamId,
+      args.service_id,
+      opts
+    );
+    const points = Array.isArray(response.history) ? response.history.length : 0;
+    return respond({
+      summary: `Returned ${points} metric point${points === 1 ? "" : "s"} for service ${args.service_id}.`,
+      data: { history: response.history }
+    });
+  }
+});
 defineTool({
   name: "update_service",
   category: "services",
@@ -1234,8 +1824,8 @@ defineTool({
     'Example: update_service({ service_id: "svc_abc", name: "api-prod" }) \u2192 { service: { name: "api-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId."),
-    name: z9.string().min(1).max(60).describe("New service name (1\u201360 chars).")
+    service_id: z12.string().describe("Service publicId."),
+    name: z12.string().min(1).max(60).describe("New service name (1\u201360 chars).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1262,21 +1852,30 @@ defineTool({
     "  - dockerfile_path (optional): path to Dockerfile relative to root_directory. Pass null to clear.",
     "  - auto_deploy (optional): boolean \u2014 auto-deploy on git push.",
     "  - instance_count (optional): integer \u22651 \u2014 pin both min and max instances to this value.",
+    '  - log_filter_rules (optional): list of { pattern, action } rules applied to runtime logs at query time. Pattern matches the message by case-insensitive substring; action is "drop" (filter out) or "downgrade" (flip stderr \u2192 stdout so it stops looking like an error). Pass [] to clear all rules. Capped at 50 rules.',
     "",
     "Returns: { service?: Service, config?: ServiceConfig } \u2014 whichever rows were touched.",
     "",
     'Example: update_service_config({ service_id: "svc_abc", start_command: "bun apps/api/src/index.ts" }) \u2192 { service: { startCommand: "bun apps/api/src/index.ts", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId."),
-    install_command: z9.string().nullable().optional().describe("Install shell command. Null clears."),
-    build_command: z9.string().nullable().optional().describe("Build shell command. Null clears."),
-    start_command: z9.string().nullable().optional().describe("Start shell command. Null clears."),
-    branch: z9.string().optional().describe("Git branch to track."),
-    root_directory: z9.string().optional().describe("Build context root."),
-    dockerfile_path: z9.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
-    auto_deploy: z9.boolean().optional().describe("Auto-deploy on push."),
-    instance_count: z9.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350).")
+    service_id: z12.string().describe("Service publicId."),
+    install_command: z12.string().nullable().optional().describe("Install shell command. Null clears."),
+    build_command: z12.string().nullable().optional().describe("Build shell command. Null clears."),
+    start_command: z12.string().nullable().optional().describe("Start shell command. Null clears."),
+    branch: z12.string().optional().describe("Git branch to track."),
+    root_directory: z12.string().optional().describe("Build context root."),
+    dockerfile_path: z12.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
+    auto_deploy: z12.boolean().optional().describe("Auto-deploy on push."),
+    instance_count: z12.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
+    log_filter_rules: z12.array(
+      z12.object({
+        pattern: z12.string().min(1).max(200),
+        action: z12.enum(["drop", "downgrade"])
+      })
+    ).max(50).optional().describe(
+      "Runtime-log filter rules. Empty array [] clears all rules. Each pattern is case-insensitive substring match against the message."
+    )
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1288,14 +1887,16 @@ defineTool({
     if (args.dockerfile_path !== void 0)
       serviceUpdate["dockerfilePath"] = args.dockerfile_path;
     if (args.branch !== void 0) serviceUpdate["branch"] = args.branch;
-    if (args.root_directory !== void 0)
-      serviceUpdate["rootDirectory"] = args.root_directory;
+    if (args.root_directory !== void 0) serviceUpdate["rootDirectory"] = args.root_directory;
     if (args.auto_deploy !== void 0) serviceUpdate["autoDeploy"] = args.auto_deploy;
     const configUpdate = {};
     if (args.instance_count !== void 0) {
       configUpdate["minInstances"] = args.instance_count;
       configUpdate["maxInstances"] = args.instance_count;
     }
+    if (args.log_filter_rules !== void 0) {
+      configUpdate["logFilterRules"] = args.log_filter_rules;
+    }
     if (Object.keys(serviceUpdate).length === 0 && Object.keys(configUpdate).length === 0) {
       return respond({ summary: "No fields to update.", data: {} });
     }
@@ -1341,7 +1942,7 @@ defineTool({
     'Example: suspend_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId.")
+    service_id: z12.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1365,7 +1966,7 @@ defineTool({
     'Example: resume_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId.")
+    service_id: z12.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1384,18 +1985,31 @@ defineTool({
     "Inputs:",
     "  - service_id: publicId of the service.",
     "  - lines (optional): tail size (default 200, max 1000).",
-    "  - since (optional): ISO-8601 timestamp; only return entries newer than this.",
+    '  - since/until (optional): ISO-8601 timestamp OR a relative offset like "-5m", "-1h", "-2d".',
     '  - stream (optional): "stdout" | "stderr". Omit to combine.',
+    "  - level (optional): real log level \u2014 trace/debug/info/warn/error/fatal. For structured JSON logs (pino, bunyan, OpenTelemetry severity) this filters on the parsed inner level field. For plain text logs it falls back to a stream-alias hint (info/debug \u2192 stdout, warn/error/fatal \u2192 stderr).",
+    "  - search (optional): case-insensitive substring grep, \u2264100 chars.",
+    '  - count_only (optional): when true, returns { count } only \u2014 much cheaper for "how many error lines in last 5m" polling.',
+    "",
+    "Returns: { logs: LogEntry[] | string } when count_only is false. Each entry has { timestamp, level?, stream, message }. `level` is the parsed inner level when the message is a structured JSON envelope (pino numeric or string), and undefined for plain-text logs. `stream` is always one of stdout/stderr. Or { count: number } when count_only is true.",
     "",
-    "Returns: { logs: LogEntry[] | string } \u2014 each entry has { timestamp, level?, stream?, message }. Older HostStack agents return a single string blob.",
+    'Example: get_service_logs({ service_id: "svc_abc", search: "OOM", since: "-15m" }) \u2192 { logs: [...] }.',
     "",
-    'Example: get_service_logs({ service_id: "svc_abc", lines: 100 }) \u2192 { logs: [{ timestamp: "2026-04-25T\u2026", message: "GET /health 200" }, \u2026] }'
+    "More examples:",
+    '  - Last 50 stderr lines from the past hour: get_service_logs({ service_id: "svc_abc", lines: 50, stream: "stderr", since: "-1h" })',
+    '  - Just count error lines without fetching them: get_service_logs({ service_id: "svc_abc", level: "error", since: "-5m", count_only: true }) \u2192 { count: 47 }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId."),
-    lines: z9.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
-    since: z9.string().datetime().optional().describe("ISO-8601 timestamp lower bound."),
-    stream: z9.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream.")
+    service_id: z12.string().describe("Service publicId."),
+    lines: z12.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
+    since: z12.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z12.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z12.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z12.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
+      "Filter by structured JSON log level (pino/bunyan/severity). Falls back to a stream-alias hint for plain-text logs (info/debug\u2192stdout, warn/error/fatal\u2192stderr)."
+    ),
+    search: z12.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z12.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1403,8 +2017,18 @@ defineTool({
       lines: args.lines ?? 200
     };
     if (args.since) opts.since = args.since;
+    if (args.until) opts.until = args.until;
     if (args.stream) opts.stream = args.stream;
+    if (args.level) opts.level = args.level;
+    if (args.search) opts.search = args.search;
+    if (args.count_only) opts.countOnly = args.count_only;
     const response = await ctx.hoststack.services.getRuntimeLogs(teamId, args.service_id, opts);
+    if ("count" in response) {
+      return respond({
+        summary: `${response.count} matching log line${response.count === 1 ? "" : "s"} for service ${args.service_id}.`,
+        data: { count: response.count }
+      });
+    }
     const count = Array.isArray(response.logs) ? response.logs.length : typeof response.logs === "string" ? response.logs.split("\n").length : 0;
     return respond({
       summary: `Fetched ${count} log line${count === 1 ? "" : "s"} for service ${args.service_id}.`,
@@ -1412,9 +2036,82 @@ defineTool({
     });
   }
 });
+defineTool({
+  name: "get_service_logs_bulk",
+  category: "logs",
+  description: [
+    "Fetch runtime logs for multiple services in parallel and return one response keyed by service_id. Single round-trip from the MCP client perspective.",
+    "",
+    'When to use: investigating something that spans a project \u2014 "what does every service in the auth-fleet say about the OOM at 14:00?", "did anything log an error in the last 5 minutes across these 4 services?". Pair with list_services (filter by project/status) to get the service_ids list first.',
+    "",
+    "Inputs:",
+    "  - service_ids: list of service publicIds (svc_\u2026). Hard cap 10 to bound work \u2014 for larger fleets, partition the call.",
+    "  - lines_per_service (optional): tail size per service (default 100, max 500). Smaller default than get_service_logs since you are fanning out.",
+    '  - since/until (optional): same shape as get_service_logs (ISO-8601 or "-5m", "-1h").',
+    '  - stream (optional): "stdout" | "stderr".',
+    "  - level (optional): structured-log level filter (trace/debug/info/warn/error/fatal).",
+    "  - search (optional): case-insensitive substring filter applied to every service.",
+    '  - count_only (optional): when true, return { results: { [service_id]: { count } } } \u2014 much cheaper for "how many error lines per service in the last 5m" surveys.',
+    "",
+    "Returns: { results: { [service_id]: { logs?, count?, error? } } } \u2014 per-service result, with `error` populated when one service failed (the rest still succeed).",
+    "",
+    'Example: get_service_logs_bulk({ service_ids: ["svc_api", "svc_worker"], level: "error", since: "-15m", count_only: true }) \u2192 { results: { svc_api: { count: 0 }, svc_worker: { count: 12 } } }.'
+  ].join("\n"),
+  input: {
+    service_ids: z12.array(z12.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
+    lines_per_service: z12.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
+    since: z12.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z12.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z12.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z12.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
+    search: z12.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z12.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const linesPerService = args.lines_per_service ?? 100;
+    const baseOpts = { lines: linesPerService };
+    if (args.since) baseOpts.since = args.since;
+    if (args.until) baseOpts.until = args.until;
+    if (args.stream) baseOpts.stream = args.stream;
+    if (args.level) baseOpts.level = args.level;
+    if (args.search) baseOpts.search = args.search;
+    if (args.count_only) baseOpts.countOnly = args.count_only;
+    const settled = await Promise.allSettled(
+      args.service_ids.map(async (sid) => {
+        const response = await ctx.hoststack.services.getRuntimeLogs(teamId, sid, baseOpts);
+        return { sid, response };
+      })
+    );
+    const results = {};
+    let okCount = 0;
+    let errorCount = 0;
+    for (let i = 0; i < settled.length; i += 1) {
+      const outcome = settled[i];
+      const sid = args.service_ids[i];
+      if (outcome.status === "fulfilled") {
+        const { response } = outcome.value;
+        if ("count" in response) {
+          results[sid] = { count: response.count };
+        } else {
+          results[sid] = { logs: response.logs };
+        }
+        okCount += 1;
+      } else {
+        const reason = outcome.reason;
+        results[sid] = {
+          error: typeof reason === "string" ? reason : reason?.message ?? "Unknown error"
+        };
+        errorCount += 1;
+      }
+    }
+    const summary = errorCount === 0 ? `Fetched logs from ${okCount} service${okCount === 1 ? "" : "s"}.` : `Fetched logs from ${okCount} of ${args.service_ids.length} service${args.service_ids.length === 1 ? "" : "s"} (${errorCount} failed \u2014 see per-service .error field).`;
+    return respond({ summary, data: { results } });
+  }
+});
 
 // src/tools/volumes.ts
-import { z as z10 } from "zod";
+import { z as z13 } from "zod";
 defineTool({
   name: "list_volumes",
   category: "volumes",
@@ -1431,7 +2128,7 @@ defineTool({
     'Example: list_volumes({ service_id: "svc_abc" }) \u2192 { items: [{ name: "data", mountPath: "/var/data", sizeGb: 10, status: "active" }] }'
   ].join("\n"),
   input: {
-    service_id: z10.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z13.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1460,10 +2157,10 @@ defineTool({
     'Example: create_volume({ service_id: "svc_abc", name: "data", mount_path: "/var/data", size_gb: 10 }) \u2192 { volume: { name: "data", mountPath: "/var/data", sizeGb: 10, status: "active" } }'
   ].join("\n"),
   input: {
-    service_id: z10.string().describe("Service publicId."),
-    name: z10.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
-    mount_path: z10.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
-    size_gb: z10.number().int().min(1).max(100).optional().describe("Disk size in GB (default 1, max 100).")
+    service_id: z13.string().describe("Service publicId."),
+    name: z13.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
+    mount_path: z13.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
+    size_gb: z13.number().int().min(1).max(100).optional().describe("Disk size in GB (default 1, max 100).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1499,10 +2196,10 @@ defineTool({
     'Example: update_volume({ service_id: "svc_abc", volume_id: "vol_xyz", size_gb: 20 }) \u2192 { volume: { sizeGb: 20, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z10.string().describe("Service publicId."),
-    volume_id: z10.string().describe("Volume publicId (e.g. vol_\u2026)."),
-    mount_path: z10.string().startsWith("/").max(500).optional().describe("New mount path."),
-    size_gb: z10.number().int().min(1).max(100).optional().describe("New size in GB.")
+    service_id: z13.string().describe("Service publicId."),
+    volume_id: z13.string().describe("Volume publicId (e.g. vol_\u2026)."),
+    mount_path: z13.string().startsWith("/").max(500).optional().describe("New mount path."),
+    size_gb: z13.number().int().min(1).max(100).optional().describe("New size in GB.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1540,8 +2237,8 @@ defineTool({
     'Example: delete_volume({ service_id: "svc_abc", volume_id: "vol_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z10.string().describe("Service publicId."),
-    volume_id: z10.string().describe("Volume publicId.")
+    service_id: z13.string().describe("Service publicId."),
+    volume_id: z13.string().describe("Volume publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();