@koda-sl/baker-cli 0.170.0 → 0.173.0

package/README.md

@@ -2673,7 +2673,7 @@ Permissions enforced server-side:
 
 ### `baker mcp connected | list | add | remove`
 
-See every third-party tool a chat can reach (managed integrations + custom servers) and manage **custom MCP servers** — point the agent at any remote HTTPS MCP endpoint. Registered tools appear as `mcp__<name>__*` on the next chat message.
+See everything a chat can reach — managed integrations, custom servers, and connected platforms — and manage **custom MCP servers** by pointing the agent at any remote HTTPS MCP endpoint. Registered tools appear as `mcp__<name>__*` on the next chat message.
 
 ```bash
 baker mcp connected
@@ -2684,6 +2684,7 @@ baker mcp add --name mine --url https://my.dev/mcp --scope user
 baker mcp remove --name weather
 ```
 
+- `connected` returns three lists. `managed` and `custom` are MCP tools the agent calls directly; `platforms` are the accounts the company signed in to (HubSpot, Google Ads, GA4, Search Console, Tag Manager, LinkedIn Ads), each with its login and the resources it may read. A platform has **no** `mcp__*` tools — it is read through its own command family — so it is listed here to keep the agent from concluding a working connection is missing.
 - `--url` must be the **full MCP endpoint** (commonly ending in `/mcp`), HTTPS and public; loopback / private / cloud-metadata hosts are rejected. A bare domain frequently accepts the OAuth sign-in and then serves no tools, so every address is handshake-checked after it changes: `connected` and `list` report `usable: false` plus a `problem` (and a `suggestedAddress` when the server advertises a better endpoint) for a server that isn't serving tools, or `lastCheck: failed` when the last check only hit an outage — that one may work anyway, and a later turn re-checks it automatically. Repointing a server at a different host clears its saved sign-in: a token belongs to the host that issued it, so the server has to be connected again.
 - Scope is two independent choices — audience (just you / everyone) × level (this company / whole org):
   - `--scope company` (default) — everyone in this company.
@@ -2730,9 +2731,9 @@ baker history list --category ads --full    # ad writes with raw metadata
 
 ---
 
-### `baker hubspot forms list | view` · `baker hubspot meetings list | view`
+### `baker hubspot forms list | view | submissions` · `baker hubspot workflows list` · `baker hubspot pipelines list` · `baker hubspot contacts summary | lookup` · `baker hubspot meetings list | view`
 
-Read-only view of the company's **connected HubSpot account** — the forms and meeting links (calendars) that live there, plus the settings inside HubSpot that decide how each behaves once placed in a Form. Fetched from HubSpot live on every call; nothing is cached.
+Read-only view of the company's **connected HubSpot account** — the forms and meeting links (calendars) that live there, the leads those forms received, and the workflows, deal pipelines, and contact records a lead runs through afterwards. Fetched from HubSpot live on every call; nothing is cached and nothing is ever written back.
 
 The reason this exists: a form's **post-submit action** (inline thank-you vs redirect to a URL), its embed version, its consent mode, and a calendar's booking fields are *not* persisted onto the flow node when a form is picked. They cannot be read from `_data.json` or `baker flows show` — only from here.
 
@@ -2743,6 +2744,12 @@ baker hubspot forms list --embed-type legacy    # only legacy-embed forms
 baker hubspot forms view <formId>               # fields, consent mode, full configuration
 baker hubspot forms view <formId> --full        # + the raw HubSpot payload
 baker hubspot forms view <formId> --as-node     # the form.external blob for a flow node
+baker hubspot forms submissions <formId>        # how many leads it received, and when
+baker hubspot forms submissions <formId> --days 90 --full
+baker hubspot workflows list --enabled-only     # what runs after a lead is captured
+baker hubspot pipelines list                    # where a lead lands, and the stages after it
+baker hubspot contacts summary --days 30        # are recent leads being worked? (counts only)
+baker hubspot contacts lookup lead@example.com  # was this one lead picked up?
 baker hubspot meetings list                     # every calendar + whether booking redirects
 baker hubspot meetings view <slug>              # booking-form fields for one calendar
 baker hubspot meetings view <slug> --as-node    # the form.external blob for a flow node
@@ -2750,9 +2757,16 @@ baker hubspot meetings view <slug> --as-node    # the form.external blob for a f
 
 **`forms list` flags:** `--search <text>` (name substring), `--redirecting-only`, `--embed-type legacy|v4|unknown`. Rows carry only what it takes to choose; `portalId` is returned once on `data`, not per row.
 **`forms view`:** positional `<formId>`; `--full` adds the untouched HubSpot payload; `--as-node` returns the resource blob instead of the readable view.
+**`forms submissions`:** positional `<formId>`; `--days <1-365>` (default 30) sets the window; `--full` adds each submission's field values. The default response is counts and dates only — `total`, `inWindow`, `lastSubmittedAt`, and per-day counts — because submissions carry the lead's own contact details. `truncated: true` means the page budget ran out before the window was covered, so `inWindow` is a floor rather than an exact count.
+**`workflows list` flags:** `--search <text>`, `--enabled-only`. Disabled workflows are listed too — a form wired to one that is off looks connected and does nothing.
+**`pipelines list`:** no flags; stages come back in the order they run in HubSpot.
+**`contacts summary` flags:** `--days <1-365>` (default 30) over contact creation date. Returns counts only — total contacts, how many have an owner, and the lifecycle-stage split — never a name or an email. `truncated: true` means the page budget ran out, so the counts are floors.
+**`contacts lookup`:** positional `<email>`; returns that contact's lifecycle stage, owner, the account (company) it was filed under, and associated deals with their stage. `dealsReadable: false` / `companyReadable: false` mean the connection does not cover deals or accounts, so an empty `deals` or a null `company` is unknown rather than absent. `found: false` means no contact with that email — the lead never reached the CRM, which is a finding rather than an error.
 **`meetings list` flags:** `--search <text>`, `--redirecting-only`.
 **`meetings view`:** positional `<slug>` — the only reliable source for a calendar's booking fields (HubSpot omits `customParams` from the list endpoint, so `fieldCount: null` there means unknown, not zero); `--as-node` as above.
 
+**`HUBSPOT_RECONNECT_REQUIRED`** is returned when HubSpot is connected but that account never granted access to what the command needs — a HubSpot grant is fixed at the moment the user approves it, so an account connected before a capability shipped cannot serve it. It is not the same as `NO_HUBSPOT_CONNECTION`: the connection works, and only the user can widen it by reconnecting from Brain → Integrations → Tools. The error carries a `fix` describing exactly that.
+
 **`--as-node`** returns exactly the object a flow node's `form.external` expects, so an agent can wire a HubSpot step by editing the flow's `_data.json` instead of interrupting the user with the `request_flow_input` approval form. It includes two fields the dashboard picker omits and the renderer needs: `configuration.postSubmitAction` (drives post-submit redirect suppression) and `region` (selects the v4 embed host — without it a v4 form on a eu1/ap1 portal loads the wrong script host).
 
 **Response:**

package/dist/cli.js

@@ -2983,6 +2983,124 @@ var hubspotFormsViewResponseSchema = z10.object({
     external: hubspotFormNodeExternalSchema.optional()
   })
 });
+var HUBSPOT_MISSING_GRANT_MARKER = "has not granted access to";
+var hubspotFormSubmissionsRequestSchema = z10.object({
+  formId: z10.string().min(1),
+  /** Window in days, counted back from now. */
+  days: z10.number().int().min(1).max(365).default(30),
+  /** Include each submission's field values — personal data, so opt-in. */
+  full: z10.boolean().optional()
+});
+var hubspotSubmissionValueSchema = z10.object({ name: z10.string(), value: z10.string() });
+var hubspotFormSubmissionsResponseSchema = z10.object({
+  ok: z10.literal(true),
+  data: z10.object({
+    /** Submissions read from HubSpot, across every page fetched. */
+    total: z10.number().int(),
+    /** Submissions inside the requested window. */
+    inWindow: z10.number().int(),
+    lastSubmittedAt: z10.number().nullable(),
+    byDay: z10.array(z10.object({ day: z10.string(), count: z10.number().int() })),
+    /**
+     * True when the page budget ran out before the window was fully covered, so
+     * `inWindow` is a floor rather than a count. Reported rather than hidden:
+     * a truncated read must not be mistaken for a complete one.
+     */
+    truncated: z10.boolean(),
+    /** Present only when `full` was requested; null otherwise. */
+    submissions: z10.array(
+      z10.object({
+        submittedAt: z10.number(),
+        pageUrl: z10.string().nullable(),
+        values: z10.array(hubspotSubmissionValueSchema)
+      })
+    ).nullable()
+  })
+});
+var hubspotWorkflowsListRequestSchema = z10.object({
+  search: z10.string().min(1).max(200).optional(),
+  /** Only workflows that are currently on. */
+  enabledOnly: z10.boolean().optional()
+});
+var hubspotWorkflowSummarySchema = z10.object({
+  id: z10.string(),
+  name: z10.string(),
+  enabled: z10.boolean(),
+  type: z10.string().nullable(),
+  updatedAt: z10.number().nullable()
+});
+var hubspotWorkflowsListResponseSchema = z10.object({
+  ok: z10.literal(true),
+  data: z10.object({ workflows: z10.array(hubspotWorkflowSummarySchema) })
+});
+var hubspotContactsSummaryRequestSchema = z10.object({
+  /** Window in days, counted back from now, over contact creation date. */
+  days: z10.number().int().min(1).max(365).default(30)
+});
+var hubspotContactsSummaryResponseSchema = z10.object({
+  ok: z10.literal(true),
+  data: z10.object({
+    total: z10.number().int(),
+    withOwner: z10.number().int(),
+    withoutOwner: z10.number().int(),
+    byStage: z10.array(z10.object({ stage: z10.string(), count: z10.number().int() })),
+    /** True when the page budget ran out, so the counts are floors. */
+    truncated: z10.boolean()
+  })
+});
+var hubspotContactLookupRequestSchema = z10.object({
+  email: z10.string().min(1).max(320)
+});
+var hubspotContactLookupResponseSchema = z10.object({
+  ok: z10.literal(true),
+  data: z10.object({
+    /** False means the lead never reached the CRM — a finding, not an error. */
+    found: z10.boolean(),
+    contact: z10.object({
+      id: z10.string(),
+      lifecycleStage: z10.string().nullable(),
+      ownerId: z10.string().nullable(),
+      createdAt: z10.string().nullable()
+    }).nullable(),
+    deals: z10.array(z10.object({ id: z10.string(), stage: z10.string().nullable(), pipeline: z10.string().nullable() })),
+    /**
+     * False when the connection never granted deal access, which makes an empty
+     * `deals` unknown rather than absent. Deal access is granted separately from
+     * contact access, so one can be present without the other — and "no deals"
+     * is the headline finding of this command, so it must not be guessed.
+     */
+    dealsReadable: z10.boolean(),
+    /**
+     * The account the contact was filed under. In B2B a workflow usually
+     * creates it on contact creation, so its absence is a finding — but only
+     * when `companyReadable` is true.
+     */
+    company: z10.object({ id: z10.string(), name: z10.string().nullable(), domain: z10.string().nullable() }).nullable(),
+    /**
+     * False when the connection never granted company access, which makes
+     * `company: null` unknown rather than absent. Company access is granted
+     * separately from contact access, so one can be present without the other.
+     */
+    companyReadable: z10.boolean()
+  })
+});
+var hubspotPipelinesListRequestSchema = z10.object({});
+var hubspotPipelineStageSchema = z10.object({
+  id: z10.string(),
+  label: z10.string(),
+  /** HubSpot's win probability for the stage, as it returns it (a decimal string). */
+  probability: z10.string().nullable()
+});
+var hubspotPipelineSchema = z10.object({
+  id: z10.string(),
+  label: z10.string(),
+  /** Ordered as they appear in HubSpot, so the sequence is the real one. */
+  stages: z10.array(hubspotPipelineStageSchema)
+});
+var hubspotPipelinesListResponseSchema = z10.object({
+  ok: z10.literal(true),
+  data: z10.object({ pipelines: z10.array(hubspotPipelineSchema) })
+});
 var hubspotMeetingFieldSchema = z10.object({
   name: z10.string(),
   label: z10.string(),
@@ -26571,6 +26689,20 @@ Full guide: __tooling__/docs/tools/baker/history.md`
 import { defineCommand as defineCommand114 } from "citty";
 var EMBED_TYPES = ["legacy", "v4", "unknown"];
 function failNotConnected(err) {
+  if (err instanceof ApiError && err.code === "UNAUTHORIZED" && err.message.includes(HUBSPOT_MISSING_GRANT_MARKER)) {
+    writeJson({
+      ok: false,
+      error: {
+        code: "HUBSPOT_RECONNECT_REQUIRED",
+        message: err.message,
+        fix: {
+          action: "reconnect",
+          explanation: "AGENT INSTRUCTION: HubSpot IS connected \u2014 do not tell the user it is missing, and do not retry. This account was connected before this capability existed, so its access does not cover it. Only the user can widen it: tell them to open the dashboard, go to Brain -> Integrations -> Tools and reconnect HubSpot; it works from their next message. Do not abort the wider task: say which part you could not read, skip it, and finish everything else."
+        }
+      }
+    });
+    process.exit(1);
+  }
   if (err instanceof ApiError && err.code === "NOT_FOUND" && err.message.includes("No HubSpot account is connected")) {
     writeJson({
       ok: false,
@@ -26624,6 +26756,47 @@ registerSchema({
     }
   }
 });
+registerSchema({
+  command: "hubspot.forms.submissions",
+  description: "How many leads a form actually received over a window, and on which days \u2014 the difference between 'this form is live' and 'this form is working'. Start here when asked whether a form or a campaign is producing leads. Returns counts and dates only; the leads' own answers need --full and are personal data, so do not put them in a report. Pair with `hubspot pipelines list` to see whether those leads were then worked.",
+  args: {
+    formId: { type: "positional", description: "HubSpot form id (from `baker hubspot forms list`)", required: true },
+    days: { type: "string", description: "Window in days, 1-365 (default 30)", required: false },
+    full: {
+      type: "boolean",
+      description: "Include each submission's field values \u2014 personal data, request only when actually needed",
+      required: false,
+      default: false
+    }
+  }
+});
+registerSchema({
+  command: "hubspot.contacts.summary",
+  description: "Whether the leads that arrived recently are actually being worked, as counts: how many contacts were created in the window, how many have someone assigned, and how they split across lifecycle stages. This is the 'have these leads been treated?' answer. Returns no names or emails \u2014 use `hubspot contacts lookup` for one specific person.",
+  args: {
+    days: { type: "string", description: "Window in days, 1-365 (default 30)", required: false }
+  }
+});
+registerSchema({
+  command: "hubspot.contacts.lookup",
+  description: "One contact by email: its lifecycle stage, whether anyone is assigned, the account (company) it was filed under, and any deals it is attached to with their stage. Use it to settle whether a specific lead was picked up. `found: false` means the lead never reached the CRM at all \u2014 that is a finding, not an error. `dealsReadable: false` / `companyReadable: false` mean deals or account details were not readable on this connection, so an empty deals list or a null company is unknown rather than absent.",
+  args: {
+    email: { type: "positional", description: "The contact's email address", required: true }
+  }
+});
+registerSchema({
+  command: "hubspot.workflows.list",
+  description: "Every workflow on the connected account, with whether it is switched on. Read it when auditing what happens to a lead after it is captured \u2014 a form wired to a workflow that is off looks connected and does nothing.",
+  args: {
+    search: { type: "string", description: "Case-insensitive substring match on the workflow name", required: false },
+    "enabled-only": { type: "boolean", description: "Only workflows that are on", required: false, default: false }
+  }
+});
+registerSchema({
+  command: "hubspot.pipelines.list",
+  description: "The account's deal pipelines and their stages, in the order they run. Use it to answer where a lead lands once captured and whether it moved \u2014 the 'have these leads been worked?' half of a form audit.",
+  args: {}
+});
 registerSchema({
   command: "hubspot.meetings.list",
   description: "Every HubSpot meeting link (calendar) on the connected account, with just enough to choose one: name, slug, link type (personal / group / round-robin), whether booking redirects somewhere, and how many booking fields it asks for (null = unknown, read it with `meetings view`). Next step is usually `hubspot meetings view <slug> --as-node`, which gives you the blob to write straight into a hubspotMeeting step.",
@@ -26833,9 +27006,217 @@ var meetingsViewCommand = defineCommand114({
     }
   }
 });
+var formsSubmissionsCommand = defineCommand114({
+  meta: {
+    name: "submissions",
+    description: "How many leads a form received, and when. Example: baker hubspot forms submissions <formId> --days 30"
+  },
+  args: {
+    formId: { type: "positional", description: "HubSpot form id", required: true },
+    days: { type: "string", description: "Window in days (default 30)", required: false },
+    full: { type: "boolean", description: "Include each lead's answers", required: false }
+  },
+  run: async ({ args }) => {
+    try {
+      const days = args.days === void 0 ? 30 : Number(args.days);
+      if (!Number.isInteger(days) || days < 1 || days > 365) {
+        throw new ApiError("VALIDATION_ERROR", "--days must be a whole number between 1 and 365.");
+      }
+      const response = await apiPost("/api/hubspot/forms/submissions", {
+        formId: args.formId,
+        days,
+        ...args.full ? { full: true } : {}
+      });
+      const { inWindow, total, truncated, lastSubmittedAt } = response.data;
+      const hints = [];
+      if (inWindow === 0) {
+        hints.push(
+          total === 0 ? "This form has received nothing at all \u2014 check it is the form actually embedded on the page before concluding the campaign is at fault." : `No leads in the last ${days} days, though the form has ${total} older submission(s). It worked once and has gone quiet.`
+        );
+      }
+      if (truncated) {
+        hints.push(
+          "Stopped before reaching the end of the window, so `inWindow` is a floor, not a count. Say so rather than reporting it as exact."
+        );
+      }
+      if (!args.full && inWindow > 0) {
+        hints.push(
+          "Counts only \u2014 the leads' own answers are not included. Add --full if you genuinely need the field values; it returns personal data, so do not paste it into a report or a chat message."
+        );
+      }
+      if (lastSubmittedAt !== null) {
+        hints.push(
+          "To find out whether these leads were worked, cross-check the deal pipeline: `baker hubspot pipelines list`."
+        );
+      }
+      writeJson({ ...response, meta: { count: inWindow }, ...hints.length > 0 ? { hints } : {} });
+    } catch (err) {
+      failNotConnected(err);
+    }
+  }
+});
+var workflowsListCommand = defineCommand114({
+  meta: {
+    name: "list",
+    description: "List HubSpot workflows. Example: baker hubspot workflows list --enabled-only"
+  },
+  args: {
+    search: { type: "string", description: "Match on workflow name", required: false },
+    "enabled-only": { type: "boolean", description: "Only workflows that are on", required: false }
+  },
+  run: async ({ args }) => {
+    try {
+      const body = {};
+      if (args.search) {
+        body.search = args.search;
+      }
+      if (args["enabled-only"]) {
+        body.enabledOnly = true;
+      }
+      const response = await apiPost("/api/hubspot/workflows/list", body);
+      const { workflows } = response.data;
+      const off = workflows.filter((workflow) => !workflow.enabled);
+      const hints = [];
+      if (workflows.length === 0) {
+        hints.push("No workflows matched. Drop --search/--enabled-only, or the account genuinely has none.");
+      }
+      if (off.length > 0) {
+        hints.push(
+          `${off.length} of these are switched off. A form wired to a workflow that is off looks connected and does nothing \u2014 worth flagging to the user.`
+        );
+      }
+      writeJson({ ...response, meta: { count: workflows.length }, ...hints.length > 0 ? { hints } : {} });
+    } catch (err) {
+      failNotConnected(err);
+    }
+  }
+});
+var pipelinesListCommand = defineCommand114({
+  meta: {
+    name: "list",
+    description: "List HubSpot deal pipelines and their stages. Example: baker hubspot pipelines list"
+  },
+  args: {},
+  run: async () => {
+    try {
+      const response = await apiPost("/api/hubspot/pipelines/list", {});
+      const { pipelines } = response.data;
+      const hints = pipelines.length === 0 ? ["This account has no deal pipelines, so there is nowhere for a lead to be worked."] : ["Stages are listed in the order they run in HubSpot, so the first stage is where a new lead lands."];
+      writeJson({ ...response, meta: { count: pipelines.length }, hints });
+    } catch (err) {
+      failNotConnected(err);
+    }
+  }
+});
+var contactsSummaryCommand = defineCommand114({
+  meta: {
+    name: "summary",
+    description: "Whether recent leads are being worked, as counts. Example: baker hubspot contacts summary --days 30"
+  },
+  args: {
+    days: { type: "string", description: "Window in days (default 30)", required: false }
+  },
+  run: async ({ args }) => {
+    try {
+      const days = args.days === void 0 ? 30 : Number(args.days);
+      if (!Number.isInteger(days) || days < 1 || days > 365) {
+        throw new ApiError("VALIDATION_ERROR", "--days must be a whole number between 1 and 365.");
+      }
+      const response = await apiPost("/api/hubspot/contacts/summary", { days });
+      const { total, withOwner, withoutOwner, byStage, truncated } = response.data;
+      const hints = [];
+      if (total === 0) {
+        hints.push(`No contacts were created in the last ${days} days \u2014 nothing reached the CRM in that window.`);
+      } else if (withOwner === 0) {
+        hints.push(
+          `None of these ${total} contacts has anyone assigned. That is the strongest available signal that the leads are arriving and nobody is picking them up \u2014 worth raising with the user.`
+        );
+      } else if (withoutOwner > withOwner) {
+        hints.push(`${withoutOwner} of ${total} contacts have nobody assigned \u2014 more unworked than worked.`);
+      }
+      const unset = byStage.find((entry) => entry.stage === "unset");
+      if (unset && unset.count > 0) {
+        hints.push(
+          `${unset.count} contact(s) have no lifecycle stage set at all, so they were created and never staged.`
+        );
+      }
+      if (truncated) {
+        hints.push("Stopped before reading every contact in the window, so these counts are floors, not totals.");
+      }
+      writeJson({ ...response, meta: { count: total }, ...hints.length > 0 ? { hints } : {} });
+    } catch (err) {
+      failNotConnected(err);
+    }
+  }
+});
+function contactLookupHints(data) {
+  const { found, contact, deals, dealsReadable, company, companyReadable } = data;
+  if (!found) {
+    return [
+      "No contact with that email. The lead never reached the CRM \u2014 check the form's submissions before assuming the CRM lost it."
+    ];
+  }
+  const hints = [];
+  if (contact?.ownerId === null) {
+    hints.push("Nobody is assigned to this contact.");
+  }
+  if (!dealsReadable) {
+    hints.push(
+      "Deals were not read: this HubSpot connection does not cover them. Do not report the lead as having no deal \u2014 you cannot tell. The user can enable it by reconnecting HubSpot."
+    );
+  } else if (deals.length === 0) {
+    hints.push("No deal is associated, so this contact was never taken into the pipeline.");
+  }
+  if (!companyReadable) {
+    hints.push(
+      "Account details were not read: this HubSpot connection does not cover them. Do not report the lead as having no account \u2014 you cannot tell. The user can enable it by reconnecting HubSpot."
+    );
+  } else if (company === null) {
+    hints.push(
+      "No account is associated either. Most B2B setups create one automatically when a contact arrives, so this usually means the lead was never processed at all \u2014 not that the account is missing."
+    );
+  }
+  return hints;
+}
+var contactsLookupCommand = defineCommand114({
+  meta: {
+    name: "lookup",
+    description: "Find one contact by email and see whether it was worked. Example: baker hubspot contacts lookup a@b.com"
+  },
+  args: {
+    email: { type: "positional", description: "The contact's email address", required: true }
+  },
+  run: async ({ args }) => {
+    try {
+      const response = await apiPost("/api/hubspot/contacts/lookup", {
+        email: args.email
+      });
+      const hints = contactLookupHints(response.data);
+      writeJson({
+        ...response,
+        meta: { count: response.data.found ? 1 : 0 },
+        ...hints.length > 0 ? { hints } : {}
+      });
+    } catch (err) {
+      failNotConnected(err);
+    }
+  }
+});
+var contactsCommand = defineCommand114({
+  meta: { name: "contacts", description: "Contacts on the connected HubSpot account." },
+  subCommands: { summary: contactsSummaryCommand, lookup: contactsLookupCommand }
+});
 var formsCommand = defineCommand114({
   meta: { name: "forms", description: "HubSpot forms on the connected account." },
-  subCommands: { list: formsListCommand, view: formsViewCommand }
+  subCommands: { list: formsListCommand, view: formsViewCommand, submissions: formsSubmissionsCommand }
+});
+var workflowsCommand = defineCommand114({
+  meta: { name: "workflows", description: "HubSpot workflows on the connected account." },
+  subCommands: { list: workflowsListCommand }
+});
+var pipelinesCommand = defineCommand114({
+  meta: { name: "pipelines", description: "HubSpot deal pipelines on the connected account." },
+  subCommands: { list: pipelinesListCommand }
 });
 var meetingsCommand = defineCommand114({
   meta: { name: "meetings", description: "HubSpot meeting links (calendars) on the connected account." },
@@ -26844,21 +27225,37 @@ var meetingsCommand = defineCommand114({
 var hubspotCommand = defineCommand114({
   meta: {
     name: "hubspot",
-    description: `Read the connected HubSpot account \u2014 forms and meeting links (calendars) \u2014 and get the blob to wire one into a Form step yourself.
+    description: `Read the connected HubSpot account \u2014 forms, the leads they received, workflows, deal pipelines and
+meeting links (calendars) \u2014 and get the blob to wire a form into a Form step yourself.
 
 Examples:
   baker hubspot forms list                        # every form: embed type + post-submit action
   baker hubspot forms list --redirecting-only     # which forms redirect away on submit
   baker hubspot forms view <formId>               # fields, consent mode, full configuration
   baker hubspot forms view <formId> --as-node     # the form.external blob -> write into the step
+  baker hubspot forms submissions <formId>        # how many leads it got, and when
+  baker hubspot workflows list --enabled-only     # what runs after a lead is captured
+  baker hubspot pipelines list                    # where a lead lands, and the stages after it
+  baker hubspot contacts summary --days 30        # are recent leads being worked? (counts only)
+  baker hubspot contacts lookup a@b.com           # was this one lead picked up?
   baker hubspot meetings list                     # every calendar + whether booking redirects
   baker hubspot meetings view <slug> --as-node    # same, for a hubspotMeeting step
 
+An account connected before one of these existed cannot serve it \u2014 you get HUBSPOT_RECONNECT_REQUIRED, which
+means HubSpot IS connected and the user has to reconnect it to widen what Baker may read. Report that and
+carry on with the rest; never call it broken and never retry.
+
 Nothing here is secret, so HubSpot steps do not need request_flow_input: take --as-node and edit the
 flow's _data.json. Use the approval form only when no account is connected or the right form is unclear.
 Full guide: __tooling__/docs/tools/baker/hubspot.md`
   },
-  subCommands: { forms: formsCommand, meetings: meetingsCommand }
+  subCommands: {
+    forms: formsCommand,
+    workflows: workflowsCommand,
+    pipelines: pipelinesCommand,
+    contacts: contactsCommand,
+    meetings: meetingsCommand
+  }
 });
 
 // src/commands/images/index.ts
@@ -30946,6 +31343,21 @@ Subcommands:
 
 // src/commands/mcp/index.ts
 import { defineCommand as defineCommand141 } from "citty";
+
+// src/commands/mcp/platforms.ts
+function readsKey(label) {
+  const [first = "", ...rest] = label.split(" ");
+  return [first.toLowerCase(), ...rest].join("");
+}
+function platformEntry(platform) {
+  return {
+    platform: platform.label,
+    ...platform.account ? { account: platform.account } : {},
+    ...platform.readsLabel && platform.reads.length > 0 ? { [readsKey(platform.readsLabel)]: platform.reads } : {}
+  };
+}
+
+// src/commands/mcp/index.ts
 var SCOPES = ["user", "user_org", "company", "org"];
 function parseScope(raw) {
   const scope = raw === void 0 ? "company" : String(raw);
@@ -30993,18 +31405,21 @@ function fail6(err) {
   writeJson({ ok: false, error: { code: "NETWORK_ERROR", message: "Unexpected error" } });
   process.exit(1);
 }
+var PLATFORMS_HINT = "`platforms` are connected accounts you reach through `baker` commands (HubSpot, Google Ads, GA4, Search Console, Tag Manager, \u2026), NOT mcp__* tools \u2014 there is no tool to call for them. A platform listed here IS connected: never tell the user to connect it, and never conclude it is missing because it has no mcp__* entry. Read what it holds with its own command family (`baker hubspot \u2026`, `baker ads google \u2026`, `baker ga4 \u2026`, and so on).";
 registerSchema({
   command: "mcp.connected",
-  description: "List every third-party tool this chat can reach: managed integrations (Attio, Slack, Gmail, Google Sheets, \u2026) plus custom MCP servers. Start here when the user mentions an external tool.",
+  description: "List everything this chat can reach: managed integrations (Attio, Slack, Gmail, Google Sheets, \u2026), custom MCP servers, and the platforms the company signed in to (HubSpot, Google Ads, GA4, Search Console, Tag Manager) which you read through their own `baker` commands. Start here when the user mentions an external tool or platform.",
   args: {}
 });
 var connectedCommand = defineCommand141({
   meta: {
     name: "connected",
-    description: `List all connected third-party tools \u2014 managed integrations plus custom MCP servers.
+    description: `Everything this chat can reach \u2014 managed integrations, custom MCP servers, and connected platforms.
 
 Managed tools ride the composio servers (mcp__composio_<scope>__*); custom servers expose mcp__<name>__*.
-A tool the user names that is NOT listed here is simply not connected yet.`
+Platforms (HubSpot, Google Ads, GA4, \u2026) have no mcp__* tools at all \u2014 you read them with their own
+\`baker\` command family, and one listed here is connected and ready to use.
+A tool or platform the user names that is NOT listed anywhere here is simply not connected yet.`
   },
   run: async () => {
     try {
@@ -31018,7 +31433,11 @@ A tool the user names that is NOT listed here is simply not connected yet.`
         ...c.readOnly ? { readOnly: true } : {}
       }));
       const custom = data.custom.map(customEntry);
+      const platforms = (data.platforms ?? []).map(platformEntry);
       const hints = [];
+      if (platforms.length > 0) {
+        hints.push(PLATFORMS_HINT);
+      }
       if (data.custom.some((s) => s.health && !s.health.ok && !s.health.transient)) {
         hints.push(BROKEN_SERVER_HINT);
       }
@@ -31034,11 +31453,11 @@ A tool the user names that is NOT listed here is simply not connected yet.`
         );
       }
       hints.push(
-        "Not listed = not connected. Managed app (Slack, HubSpot, Attio, \u2026) \u2192 the user connects it in the dashboard: Brain \u2192 Integrations \u2192 Tools. Custom HTTPS MCP endpoint \u2192 `baker mcp add`."
+        "Not listed anywhere = not connected. Managed app (Slack, Attio, \u2026) or platform (HubSpot, Google Ads, GA4, \u2026) \u2192 the user connects it in the dashboard: Brain \u2192 Integrations \u2192 Tools. Custom HTTPS MCP endpoint \u2192 `baker mcp add`."
       );
       writeJson({
         ok: true,
-        data: { ...data.managedDisabled ? { managedDisabled: true } : {}, managed, custom },
+        data: { ...data.managedDisabled ? { managedDisabled: true } : {}, managed, custom, platforms },
         hints
       });
     } catch (err) {
@@ -31171,7 +31590,7 @@ Tools from a registered server appear as mcp__<name>__* on the next message.
 Managed here are **company-scoped** servers; user- and org-scoped servers are managed in the dashboard.
 
 Start here:
-  baker mcp connected   # everything this chat can reach: managed integrations + custom servers
+  baker mcp connected   # everything this chat can reach: managed integrations, custom servers, connected platforms
 
 Examples:
   baker mcp add --name weather --url https://mcp.example.com/mcp