@selfhost.dev/mcp-server 0.9.0 → 0.10.0

package/dist/tools/project-services.js

@@ -2,15 +2,20 @@ import { z } from "zod";
 import { apiRequest } from "../client.js";
 import { session } from "../session.js";
 /**
- * Project services (CoolifyService) - one-click application templates deployed
- * into a project. FOUR templates are live, not one: the backend resolves them
- * from `ServiceProvisioning::Strategy.all`.
+ * Project services (CoolifyService) - one-click application templates deployed into a project.
+ * TWENTY-SIX templates are live, resolved backend-side from `ServiceProvisioning::Strategy.all`
+ * (one strategy file per template, auto-discovered). This module shipped knowing four of them
+ * until the 2026-09 sync, which meant an agent could only reach a sixth of the catalogue.
  *
  * Endpoints:
  * - GET    /api/v1/platform/projects/:pid/services
  * - GET    /api/v1/platform/projects/:pid/services/:service_pid   (the ONLY source of credentials)
  * - POST   /api/v1/platform/projects/:pid/services/:template_type (202 - async provisioning)
  * - DELETE /api/v1/platform/projects/:pid/services/:service_pid   (202; body {name} must match)
+ * - POST   /api/v1/platform/projects/:pid/services/:pid/custom_domain
+ * - DELETE /api/v1/platform/projects/:pid/services/:pid/custom_domain
+ * - POST/GET /api/v1/platform/projects/:pid/services/:pid/logs    (async request-then-read)
+ * - POST/GET /api/v1/platform/projects/:pid/services/:pid/stats   (async request-then-read)
  *
  * The project must be `active` before creating a service (409 otherwise).
  *
@@ -20,50 +25,353 @@ import { session } from "../session.js";
  *
  * The backend ships templates ahead of its clients, so `list_project_services` can
  * return a `template_type` this module does not know. Report it by its wire string
- * rather than guessing - list and delete work on any type.
+ * rather than guessing - list, delete, logs, stats and custom domains work on any type.
+ *
+ * THREE CREDENTIAL SHAPES, and getting this wrong is the main failure mode here:
+ * - `dashboardLogin`  - the create takes `dashboard_username` + `dashboard_password`, and they
+ *                       become the app's admin login. The username's accepted FORM varies:
+ *                       any string, a slug (`[a-zA-Z0-9_-]+`), or an email address (Krayin
+ *                       signs in by email, so a bare `admin` creates an unusable account).
+ * - `fixedRootPassword` - password only; the app owns the username (GitLab is always `root`,
+ *                       Elasticsearch always `elastic`). Sending a username is refused here.
+ * - `none`            - no admin env at all. THE FIRST VISITOR TO THE PUBLIC URL CLAIMS THE
+ *                       OWNER ACCOUNT. This is a real security consequence and every create
+ *                       of one of these says so unprompted.
+ *
+ * CAPACITY IS A DECLARE-TIME REFUSAL, NOT A RUNTIME DEGRADATION. A project is ONE VM.
+ * `heavy` templates (many containers, large pulls, first-boot migrations) are held to
+ * stricter free-memory limits than light ones, some carry a hard minimum on the host's TOTAL
+ * RAM, at most 5 children can exist per project, and Stalwart is a singleton because its mail
+ * ports are fixed on the host. A project server cannot be resized, so "out of RAM" means a
+ * NEW project - which is why the numbers are surfaced before the call rather than after.
  */
 const PROJECTS_BASE = "/api/v1/platform/projects";
 /** Wire values accepted at `POST .../services/:template_type`. */
-const TEMPLATE_TYPES = ["supabase", "n8n", "n8n-with-postgresql", "twenty"];
-/**
- * Per-template truth. `dashboardCreds` is the one that changes the call shape:
- * Supabase takes its Studio credentials as env at deploy, while n8n and Twenty
- * have no admin env at all - their first admin is whoever opens the URL first.
- */
+const TEMPLATE_TYPES = [
+    "supabase", "n8n", "n8n-with-postgresql", "twenty",
+    "wordpress", "gitlab", "elasticsearch", "elasticsearch-with-kibana",
+    "immich", "nextcloud", "jenkins", "grafana",
+    "grafana-with-postgresql", "strapi", "metabase", "anythingllm",
+    "stalwart", "chatwoot", "mautic", "minio",
+    "open-webui-with-ollama", "litellm", "odoo", "paperless",
+    "espocrm", "krayin",
+];
 const TEMPLATES = {
-    supabase: {
+    "supabase": {
         label: "Supabase",
-        dashboardCreds: true,
-        boot: "about 5 minutes",
-        firstAdmin: "the dashboard username/password you pass here",
-        credentials: "dashboard username + password, `public_url`, and the anon key when present",
-    },
-    n8n: {
-        label: "n8n (workflow automation)",
-        dashboardCreds: false,
-        boot: "up to 10 minutes",
-        firstAdmin: "THE FIRST PERSON TO OPEN THE URL - n8n shows an owner-setup screen to whoever gets there first",
-        credentials: "`public_url` only",
+        tagline: "Postgres, Auth, storage and auto-generated APIs.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "any",
+        minPasswordLength: 8,
+        bootMinutes: 7,
+    },
+    "n8n": {
+        label: "n8n",
+        tagline: "Workflow automation with hundreds of integrations.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "none",
+        bootMinutes: 4,
     },
     "n8n-with-postgresql": {
-        label: "n8n backed by PostgreSQL",
-        dashboardCreds: false,
-        boot: "up to 10 minutes",
-        firstAdmin: "THE FIRST PERSON TO OPEN THE URL - n8n shows an owner-setup screen to whoever gets there first",
-        credentials: "`public_url` only",
+        label: "n8n (Postgres)",
+        tagline: "The same n8n, backed by its own Postgres instead of SQLite.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "none",
+        bootMinutes: 5,
     },
-    twenty: {
+    "twenty": {
         label: "Twenty (CRM)",
-        dashboardCreds: false,
-        boot: "up to 15 minutes - it pulls images and runs migrations, so do not call it stuck early",
-        firstAdmin: "THE FIRST PERSON TO OPEN THE URL - Twenty shows a sign-up screen to whoever gets there first",
-        credentials: "`public_url` only",
+        tagline: "Open-source CRM for contacts, deals and pipelines.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 14,
+    },
+    "wordpress": {
+        label: "WordPress",
+        tagline: "MariaDB-backed WordPress for publishing and sites.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "none",
+        bootMinutes: 6,
+    },
+    "gitlab": {
+        label: "GitLab CE",
+        tagline: "Repositories, reviews and CI.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        fixedUsername: "root",
+        minPasswordLength: 12,
+        hostFloorGb: 8,
+        bootMinutes: 25,
+        loginNote: "GitLab ships with public sign-up disabled.",
+    },
+    "elasticsearch": {
+        label: "Elasticsearch",
+        tagline: "Search and analytics over your own documents.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        fixedUsername: "elastic",
+        minPasswordLength: 8,
+        bootMinutes: 10,
+        loginNote: "This password is the only lock on the endpoint, so keep it somewhere safe.",
+    },
+    "elasticsearch-with-kibana": {
+        label: "Elasticsearch + Kibana",
+        tagline: "Search and analytics with a UI in front of it.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        fixedUsername: "elastic",
+        minPasswordLength: 8,
+        hostFloorGb: 4,
+        bootMinutes: 8,
+        loginNote: "The URL is KIBANA, not the raw Elasticsearch API. Query the API from Kibana's Dev Tools, or deploy plain `elasticsearch` when an app needs to reach it directly.",
+    },
+    "immich": {
+        label: "Immich",
+        tagline: "Photo and video backup for your phone.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 20,
+    },
+    "nextcloud": {
+        label: "Nextcloud",
+        tagline: "Files, calendar and contacts you host yourself.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "any",
+        minPasswordLength: 8,
+        bootMinutes: 15,
+    },
+    "jenkins": {
+        label: "Jenkins",
+        tagline: "The CI server for your builds.",
+        recommendedRamGb: 4,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "slug",
+        minPasswordLength: 8,
+        hostFloorGb: 2,
+        bootMinutes: 15,
+        loginNote: "No setup wizard and no unlock key to find: the admin is seeded before the first boot.",
+    },
+    "grafana": {
+        label: "Grafana",
+        tagline: "Dashboards and alerts over your metrics.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "dashboardLogin",
+        usernameShape: "slug",
+        minPasswordLength: 8,
+        bootMinutes: 5,
+        loginNote: "It never boots on the well-known admin/admin default.",
+    },
+    "grafana-with-postgresql": {
+        label: "Grafana (Postgres)",
+        tagline: "The same Grafana, with its dashboards and alerts in a bundled Postgres.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "dashboardLogin",
+        usernameShape: "slug",
+        minPasswordLength: 8,
+        bootMinutes: 5,
+        loginNote: "It never boots on the well-known admin/admin default.",
+    },
+    "strapi": {
+        label: "Strapi",
+        tagline: "A headless CMS with an admin panel and a content API.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "none",
+        bootMinutes: 6,
+    },
+    "metabase": {
+        label: "Metabase",
+        tagline: "Dashboards and questions over your data.",
+        recommendedRamGb: 4,
+        heavy: true,
+        creds: "none",
+        hostFloorGb: 2,
+        bootMinutes: 7,
+    },
+    "anythingllm": {
+        label: "AnythingLLM",
+        tagline: "Chat over your own documents.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "fixedRootPassword",
+        minPasswordLength: 8,
+        bootMinutes: 6,
+        loginNote: "The unlock screen asks for this password ALONE, with no username. Without it AnythingLLM would boot open to anyone with the link.",
+    },
+    "stalwart": {
+        label: "Stalwart (mail server)",
+        tagline: "A full mail server, SMTP through JMAP.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "fixedRootPassword",
+        fixedUsername: "admin",
+        minPasswordLength: 8,
+        singleton: true,
+        bootMinutes: 4,
+        loginNote: "Hetzner blocks outbound port 25 on new accounts, so RECEIVING mail works at once but SENDING needs an unblock request or a relay. ONE STALWART PER PROJECT - the mail ports are fixed on the host, so a second one is refused at declare time.",
+    },
+    "chatwoot": {
+        label: "Chatwoot",
+        tagline: "Live chat and a shared support inbox.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 12,
     },
+    "mautic": {
+        label: "Mautic",
+        tagline: "Marketing automation and campaigns.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 8,
+    },
+    "minio": {
+        label: "MinIO",
+        tagline: "S3-compatible object storage.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "dashboardLogin",
+        usernameShape: "any",
+        minPasswordLength: 8,
+        bootMinutes: 3,
+        loginNote: "The username is the S3 ACCESS KEY and the password is the SECRET. There is no web console: manage buckets with the `mc` CLI or any S3 SDK.",
+    },
+    "open-webui-with-ollama": {
+        label: "Open WebUI + Ollama",
+        tagline: "Chat with local models on your own box.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 11,
+        loginNote: "Project servers are CPU ONLY, so stay with small models (1B-3B). Nothing ships with a model - you pull the first one yourself.",
+    },
+    "litellm": {
+        label: "LiteLLM",
+        tagline: "One OpenAI-compatible endpoint in front of every model provider.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "fixedRootPassword",
+        fixedUsername: "admin",
+        minPasswordLength: 8,
+        bootMinutes: 6,
+        loginNote: "This password is ALSO the API master key, as `sk-<password>`. Mint scoped virtual keys in the UI rather than handing that one out.",
+    },
+    "odoo": {
+        label: "Odoo",
+        tagline: "The open-source ERP and business suite.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        minPasswordLength: 8,
+        bootMinutes: 8,
+        loginNote: "This is the DATABASE-MANAGER MASTER PASSWORD, not a login. You use it once to create the database and pick your own admin email and password.",
+    },
+    "paperless": {
+        label: "Paperless-ngx",
+        tagline: "A searchable, OCR-indexed archive of your documents.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "any",
+        minPasswordLength: 8,
+        bootMinutes: 8,
+    },
+    "espocrm": {
+        label: "EspoCRM",
+        tagline: "Contacts, accounts and deals in a CRM you own.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "slug",
+        minPasswordLength: 8,
+        bootMinutes: 12,
+        loginNote: "No install wizard: the admin is seeded before the first boot, so it never comes up on the documented admin/password default.",
+    },
+    "krayin": {
+        label: "Krayin (CRM)",
+        tagline: "Leads, quotes and deals in an open-source CRM you own.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        fixedUsername: "",
+        usernameShape: "email",
+        minPasswordLength: 8,
+        unsupportedArchitectures: ["arm"],
+        bootMinutes: 15,
+        loginNote: "Krayin signs in with an EMAIL ADDRESS, so dashboard_username must be one - a bare `admin` creates an account nobody can sign in as. The admin is seeded before the first boot.",
+    },
+};
+/** Username validation per shape, mirroring the backend validators. */
+const USERNAME_SHAPE_RULES = {
+    any: { test: (v) => v.length > 0, hint: "any non-empty string" },
+    slug: { test: (v) => /^[a-zA-Z0-9_-]+$/.test(v), hint: "letters, digits, hyphen and underscore only" },
+    email: { test: (v) => /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v), hint: "an email address - this app signs in by email" },
 };
+/** Rendered into the create description so the catalogue cannot drift from the code. */
+const TEMPLATE_CATALOGUE_TEXT = TEMPLATE_TYPES.map((t) => {
+    const f = TEMPLATES[t];
+    const creds = f.creds === "dashboardLogin"
+        ? `username + password (${USERNAME_SHAPE_RULES[f.usernameShape ?? "any"].hint})`
+        : f.creds === "fixedRootPassword"
+            ? `password only${f.fixedUsername ? `, user is always \`${f.fixedUsername}\`` : ""}`
+            : "NO admin creds - first visitor owns it";
+    const flags = [
+        f.heavy ? "heavy" : null,
+        f.hostFloorGb ? `needs a ${f.hostFloorGb} GB+ host` : null,
+        f.singleton ? "one per project" : null,
+        f.unsupportedArchitectures?.length ? `no ${f.unsupportedArchitectures.join("/")} hosts` : null,
+    ].filter(Boolean).join(", ");
+    return `- \`${t}\` (${f.label}) - ${f.tagline} ${creds}. ~${f.bootMinutes} min, ${f.recommendedRamGb} GB recommended${flags ? ` [${flags}]` : ""}`;
+}).join("\n");
 const NO_ORG = "No active organization. Call `list_organizations` then `select_organization` first.";
 function hasOrg() {
     return session.getActiveOrgId() !== null;
 }
+/**
+ * Container inspection covers project SERVICES and project DATABASES with one contract - both
+ * are Docker containers on the project's single box, and the backend shares one
+ * `ContainerInspectable` concern for them. `resource_type` picks the collection rather than
+ * this module carrying two near-identical copies of four tools.
+ *
+ * REQUEST-THEN-READ, like the AWS instance-logs surface: POST dispatches a fetch to the host
+ * agent and returns a `pending` record; GET settles pending fetches against their tasks and
+ * returns the recent ones (newest first, up to 20).
+ *
+ * READ-ONLY BY CONSTRUCTION. The backend emits only allow-listed `docker ps / logs / stats /
+ * inspect` commands through the agent - no shell, no Docker socket, and the docker filter is
+ * scoped to this resource's containers. There is deliberately NO start / stop / restart /
+ * remove / exec surface anywhere on the platform, so do not go looking for one or promise it.
+ */
+const INSPECT_LINES_DEFAULT = 200;
+const INSPECT_LINES_MAX = 1000;
+const INSPECT_RESOURCE_TYPES = ["service", "database"];
+const FETCH_POLL_NOTE = "The response is a `fetches` array, newest first (up to 20). Each carries `status` (`pending` | `completed` | `failed`), `output` once completed, `error` when it failed, and `lines_requested`. A fetch still `pending` after 3 minutes settles as `failed` - the agent's reply was lost, so request a fresh one rather than polling on. An empty array means nothing has been requested for this resource yet.";
+function inspectPath(projectPid, resourceType, resourcePid, operation) {
+    const collection = resourceType === "service" ? "services" : "databases";
+    return `${PROJECTS_BASE}/${projectPid}/${collection}/${resourcePid}/${operation}`;
+}
+const inspectArgs = {
+    project_pid: z.string().min(1),
+    resource_type: z.enum(INSPECT_RESOURCE_TYPES)
+        .describe("`service` for a one-click template, `database` for a project Postgres/Redis/MySQL/MongoDB. Picks which collection the pid is looked up in."),
+    resource_pid: z.string().min(1).describe("The service or database pid, as returned by list_project_services / list_project_databases"),
+};
 export function registerProjectServiceTools(server) {
     server.tool("list_project_services", `List the one-click application templates deployed in a project. Returns pid, name, template_type, status (\`creating\` | \`active\` | \`inactive\` | \`failed\` | \`unknown\`), is_public, public_port, external_url, \`error_message\` when it failed, and a \`provisioning\` block with the per-stage progress.
 
@@ -104,40 +412,73 @@ Call this after \`create_project_service\` reports \`active\`, and give the user
         }
         return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
     });
-    server.tool("create_project_service", `Deploy a one-click application template into a project. FOUR are available:
+    server.tool("create_project_service", `Deploy a one-click application template into a project. TWENTY-SIX are available:
+
+${TEMPLATE_CATALOGUE_TEXT}
 
-- \`supabase\` - Postgres + Studio + auth/storage/realtime. The ONLY one that takes admin credentials up front: \`dashboard_username\` and \`dashboard_password\` (8+ chars) are REQUIRED and become the Studio login. Boots in about 5 minutes.
-- \`n8n\` - workflow automation, data in a bundled SQLite volume. Name only.
-- \`n8n-with-postgresql\` - the same n8n, backed by a per-service PostgreSQL sidecar instead of SQLite. Pick this for anything beyond light use; the difference is durability and concurrency, and it cannot be switched afterwards. Name only.
-- \`twenty\` - open-source CRM. Name only. Boots in up to 15 minutes (images + migrations) - do not declare it stuck early.
+CREDENTIALS DIFFER PER TEMPLATE AND THE WRONG SHAPE IS REFUSED HERE rather than sent and silently dropped:
+- Templates taking a username + password: pass \`dashboard_username\` and \`dashboard_password\`. The accepted username FORM varies - a slug for Jenkins/Grafana/EspoCRM, an EMAIL for Krayin, anything for the rest. The catalogue above says which.
+- Templates taking a password only: pass \`dashboard_password\` alone. The app owns the username (GitLab is \`root\`, Elasticsearch is \`elastic\`). Passing a username is refused.
+- Templates taking nothing: pass neither.
 
-FIRST-ADMIN WARNING for n8n, n8n-with-postgresql and Twenty: these have no admin credentials at all. The first person to open the public URL gets the owner account. Tell the user to complete setup immediately, and do not post the URL anywhere until they have. Passing \`dashboard_username\`/\`dashboard_password\` to them does nothing - they are rejected here rather than sent and silently ignored.
+FIRST-ADMIN SECURITY WARNING, for every template marked "first visitor owns it": these ship with no admin credentials whatsoever. Whoever opens the public URL first gets the owner account. Say this UNPROMPTED, tell the user to finish setup the moment it is up, and tell them not to share the URL before then.
 
 \`is_public\` is REQUIRED with no default: ASK THE USER. These are web apps whose first-run setup happens at the public URL, so \`true\` is usually what they want, but do not assume it.
 
+CAPACITY: a project is ONE server, and these limits are refusals at declare time, not slow degradation. \`heavy\` templates must leave more headroom (65% memory / 75% disk vs 80% / 85%); some need a minimum TOTAL host RAM whatever is free; at most 5 children per project; Stalwart is one-per-project. A project server CANNOT be resized, so exhausting it means creating a new project - check the recommended RAM against the project's server BEFORE promising a deploy.
+
 The project must be \`active\` (409 otherwise). Returns 202 with status \`creating\`; poll \`list_project_services\`, then call \`get_project_service\` for the credentials once it is \`active\`.
 
-EXPECT THESE 422s: a duplicate service name inside the same project; \`public_port\` already claimed by another database or service in the project; and the host being out of RAM (a capacity guard refuses new services rather than thrashing the box - the fix is a bigger project server, and there is no in-place resize for projects, so it means a new project).`, {
+EXPECT THESE 422s: a duplicate service name inside the same project; \`public_port\` already claimed by another database or service; the capacity guard refusing the template; a second Stalwart; and Krayin on an ARM (\`cax*\`) host, whose image has no ARM manifest at any tag.`, {
         project_pid: z.string().min(1),
-        template_type: z.enum(TEMPLATE_TYPES).describe("supabase | n8n | n8n-with-postgresql | twenty"),
+        template_type: z.enum(TEMPLATE_TYPES).describe("One of the 26 template slugs - see the catalogue in the description"),
         name: z.string().min(1).max(255).describe("Unique within the project"),
         is_public: z.boolean().describe("Required choice (ask the user, do not assume): true = internet-reachable; false = private to the project. First-run setup for these apps happens at the public URL."),
-        dashboard_username: z.string().min(1).max(255).optional().describe("Supabase ONLY - the Studio dashboard username. Required for supabase, rejected for every other template."),
-        dashboard_password: z.string().min(8).max(255).optional().describe("Supabase ONLY - the Studio dashboard password, 8+ chars. Required for supabase, rejected for every other template."),
+        dashboard_username: z.string().min(1).max(255).optional().describe("For templates that take a username + password only. The accepted form varies per template (slug / email / any) - see the catalogue. Refused for password-only and no-credential templates."),
+        dashboard_password: z.string().min(8).max(255).optional().describe("For templates that take any password. 8+ chars (GitLab requires 12+). Refused for no-credential templates."),
         public_port: z.number().int().min(1024).max(65535).optional().describe("Optional. Must not collide with another database or service in this project."),
     }, async ({ project_pid, template_type, name, is_public, dashboard_username, dashboard_password, public_port }) => {
         if (!hasOrg())
             return { content: [{ type: "text", text: NO_ORG }] };
         const template = TEMPLATES[template_type];
-        // Fail loudly on a credential/template mismatch instead of sending fields the
-        // backend drops. Silently ignoring them is how "I set a Twenty admin password"
-        // becomes a false belief the user acts on.
-        if (template.dashboardCreds) {
+        const minPw = template.minPasswordLength ?? 8;
+        // Validate the credential SHAPE before sending. The backend drops fields a template
+        // does not accept, so a silently-ignored password leaves the user believing they set
+        // one - which for a "first visitor owns it" template is a security problem, not a
+        // cosmetic one.
+        if (template.creds === "dashboardLogin") {
             if (!dashboard_username || !dashboard_password) {
                 return {
                     content: [{
                             type: "text",
-                            text: `\`${template_type}\` requires both dashboard_username and dashboard_password (8+ chars) - they become the Supabase Studio login. Ask the user for them.`,
+                            text: `\`${template_type}\` (${template.label}) requires BOTH dashboard_username and dashboard_password - they become its admin login. Username must be ${USERNAME_SHAPE_RULES[template.usernameShape ?? "any"].hint}; password ${minPw}+ chars. Ask the user for them.`,
+                        }],
+                };
+            }
+            const rule = USERNAME_SHAPE_RULES[template.usernameShape ?? "any"];
+            if (!rule.test(dashboard_username)) {
+                return {
+                    content: [{
+                            type: "text",
+                            text: `dashboard_username \`${dashboard_username}\` is not valid for ${template.label}: it must be ${rule.hint}.${template.usernameShape === "email" ? " Krayin signs in by email address, so a non-email username creates an admin account nobody can log in as." : ""}`,
+                        }],
+                };
+            }
+        }
+        else if (template.creds === "fixedRootPassword") {
+            if (!dashboard_password) {
+                return {
+                    content: [{
+                            type: "text",
+                            text: `\`${template_type}\` (${template.label}) requires dashboard_password (${minPw}+ chars).${template.fixedUsername ? ` The username is fixed by the app: \`${template.fixedUsername}\`.` : " The app does not use a username here."}${template.loginNote ? `\n\n${template.loginNote}` : ""}`,
+                        }],
+                };
+            }
+            if (dashboard_username) {
+                return {
+                    content: [{
+                            type: "text",
+                            text: `\`${template_type}\` does not accept a username - ${template.fixedUsername ? `the app's account is always \`${template.fixedUsername}\`` : "it has no username"}, so dashboard_username was not sent. Re-run with the password alone.`,
                         }],
                 };
             }
@@ -146,15 +487,26 @@ EXPECT THESE 422s: a duplicate service name inside the same project; \`public_po
             return {
                 content: [{
                         type: "text",
-                        text: `\`${template_type}\` has no admin credentials to set, so dashboard_username / dashboard_password do not apply and were not sent. Its first admin is ${template.firstAdmin}. Re-run without them.`,
+                        text: `\`${template_type}\` (${template.label}) has no admin credentials to set, so dashboard_username / dashboard_password do not apply and were NOT sent. Its owner account goes to the first person who opens the public URL. Re-run without them.`,
+                    }],
+            };
+        }
+        if (dashboard_password && dashboard_password.length < minPw) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `${template.label} requires a password of at least ${minPw} characters (got ${dashboard_password.length}).`,
                     }],
             };
         }
         const body = { name, is_public, instant_deploy: true };
-        if (template.dashboardCreds) {
+        if (template.creds === "dashboardLogin") {
             body.dashboard_username = dashboard_username;
             body.dashboard_password = dashboard_password;
         }
+        else if (template.creds === "fixedRootPassword") {
+            body.dashboard_password = dashboard_password;
+        }
         if (public_port !== undefined)
             body.public_port = public_port;
         const result = await apiRequest(`${PROJECTS_BASE}/${project_pid}/services/${template_type}`, {
@@ -166,11 +518,14 @@ EXPECT THESE 422s: a duplicate service name inside the same project; \`public_po
             return { content: [{ type: "text", text: `Failed to create service (${result.statusCode}): ${result.message}` }] };
         }
         const lines = [
-            `${template.label} service \`${name}\` is provisioning (status: creating). Expect ${template.boot}.`,
-            `Poll \`list_project_services\`, then call \`get_project_service\` for ${template.credentials}.`,
+            `${template.label} service \`${name}\` is provisioning (status: creating). Expect around ${template.bootMinutes} minute${template.bootMinutes === 1 ? "" : "s"} - do not call it stuck before then.`,
+            "Poll `list_project_services`, then call `get_project_service` (with include_credentials) once it is `active`. Credentials live on that endpoint only.",
         ];
-        if (!template.dashboardCreds) {
-            lines.push(`SECURITY: the first admin is ${template.firstAdmin}. Tell the user to open the URL and finish setup as soon as it is up, and not to share it before then.`);
+        if (template.creds === "none") {
+            lines.push(`SECURITY - ACT ON THIS NOW: ${template.label} has no admin account. THE FIRST PERSON TO OPEN THE PUBLIC URL BECOMES THE OWNER. Tell the user to open it and finish setup as soon as it is up, and not to share the URL until they have.`);
+        }
+        if (template.loginNote) {
+            lines.push(template.loginNote);
         }
         return {
             content: [
@@ -200,5 +555,141 @@ EXPECT THESE 422s: a duplicate service name inside the same project; \`public_po
         }
         return { content: [{ type: "text", text: "Service deletion queued." }] };
     });
+    server.tool("request_project_container_logs", `Ask the project's host to capture container logs for one service or database, then read them with \`get_project_container_logs\`. THIS DOES NOT RETURN LOGS: it dispatches a fetch to the host agent and returns a \`pending\` record, because the round-trip is too slow to block a request on.
+
+Reach for this when a service or database is \`active\` but misbehaving. This is the container's own stdout/stderr, which is where a crash loop, a failed migration or a bad env var actually shows up - the platform's own status fields will only tell you it is unhealthy, not why.
+
+Read-only: the backend runs an allow-listed \`docker logs\` scoped to this resource's containers. There is no start/stop/restart/exec anywhere on this surface.`, {
+        ...inspectArgs,
+        lines: z.number().int().min(1).max(INSPECT_LINES_MAX).optional()
+            .describe(`Tail length (default ${INSPECT_LINES_DEFAULT}, max ${INSPECT_LINES_MAX}; clamped server-side)`),
+    }, async ({ project_pid, resource_type, resource_pid, lines }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const body = {};
+        if (lines !== undefined)
+            body.lines = lines;
+        const result = await apiRequest(inspectPath(project_pid, resource_type, resource_pid, "logs"), {
+            method: "POST",
+            body,
+            toolName: "request_project_container_logs",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to request container logs (${result.statusCode}): ${result.message}` }] };
+        }
+        return {
+            content: [
+                { type: "text", text: "Log fetch dispatched (`pending`). Call `get_project_container_logs` with the same ids to read it - give the agent a second or two first." },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("get_project_container_logs", `Read container logs previously requested with \`request_project_container_logs\`. ${FETCH_POLL_NOTE}`, inspectArgs, async ({ project_pid, resource_type, resource_pid }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const result = await apiRequest(inspectPath(project_pid, resource_type, resource_pid, "logs"), {
+            toolName: "get_project_container_logs",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to read container logs (${result.statusCode}): ${result.message}` }] };
+        }
+        return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
+    });
+    server.tool("request_project_container_stats", `Ask the project's host for a live resource snapshot of one service's or database's containers - \`docker stats\`: CPU, memory, network and block IO. Dispatches a fetch and returns a \`pending\` record; read it with \`get_project_container_stats\`.
+
+THIS IS THE TOOL FOR "why is my project server full?". A project is ONE VM shared by every service and database in it, it cannot be resized, and the capacity guard refuses new children once it fills up. Identifying which container is eating the memory is the only actionable answer - the alternative is telling the user to build a new project.`, inspectArgs, async ({ project_pid, resource_type, resource_pid }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const result = await apiRequest(inspectPath(project_pid, resource_type, resource_pid, "stats"), {
+            method: "POST",
+            toolName: "request_project_container_stats",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to request container stats (${result.statusCode}): ${result.message}` }] };
+        }
+        return {
+            content: [
+                { type: "text", text: "Stats fetch dispatched (`pending`). Call `get_project_container_stats` with the same ids to read it." },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("get_project_container_stats", `Read the resource snapshot previously requested with \`request_project_container_stats\`. ${FETCH_POLL_NOTE}`, inspectArgs, async ({ project_pid, resource_type, resource_pid }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const result = await apiRequest(inspectPath(project_pid, resource_type, resource_pid, "stats"), {
+            toolName: "get_project_container_stats",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to read container stats (${result.statusCode}): ${result.message}` }] };
+        }
+        return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
+    });
+    server.tool("set_project_service_custom_domain", `Point a custom domain at a project service's web UI, replacing its platform-generated hostname. Every one of the 26 templates exposes a web component, so this works for all of them.
+
+DNS MUST ALREADY BE POINTING HERE BEFORE YOU CALL THIS. The backend resolves the domain and refuses if it does not already answer with the project's public IP - deliberately, because applying a domain before DNS lands burns Let's Encrypt rate limits on certificate requests that are guaranteed to fail. The correct order is:
+1. \`get_project\` for the project's \`public_ip\`.
+2. Have the user create a DNS **A record** for the domain pointing at that IP (a CNAME chain resolving to it also passes).
+3. Wait for propagation.
+4. Call this. A 422 naming the IP means step 2 or 3 is not done - relay it and retry later, do not loop.
+
+Pass a BARE HOSTNAME you own: no scheme, no path, and not a platform-generated suffix. The service must already be provisioned (\`uuid\` present) - a 422 says it is not ready yet.
+
+Templates whose containers bake their own public URL from the domain (Twenty's SERVER_URL, n8n's WEBHOOK_URL) re-derive it on the redeploy this triggers, so there is no env var for you to fix afterwards. Routing and TLS are verified after the call returns - re-read \`get_project_service\` to see the domain's status settle.`, {
+        project_pid: z.string().min(1),
+        service_pid: z.string().min(1),
+        domain: z.string().min(1).describe("Bare hostname, e.g. crm.example.com - no https://, no trailing path"),
+    }, async ({ project_pid, service_pid, domain }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const result = await apiRequest(`${PROJECTS_BASE}/${project_pid}/services/${service_pid}/custom_domain`, {
+            method: "POST",
+            body: { domain },
+            toolName: "set_project_service_custom_domain",
+        });
+        if (!result.success) {
+            const dnsHint = result.statusCode === 422
+                ? " If the message names an IP, the domain is not resolving to the project server yet: create the A record, wait for propagation, then retry."
+                : "";
+            return { content: [{ type: "text", text: `Failed to set custom domain (${result.statusCode}): ${result.message}.${dnsHint}` }] };
+        }
+        return {
+            content: [
+                { type: "text", text: `\`${domain}\` applied. The platform is now verifying routing and issuing TLS, which is not instant - re-read \`get_project_service\` to watch the domain status settle rather than assuming it is live.` },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("remove_project_service_custom_domain", `Remove a project service's custom domain and re-pin its platform-generated hostname. A 422 means no custom domain is set on that service.
+
+The service redeploys so its containers pick the platform URL back up, which means a brief interruption. Anything referencing the custom domain - bookmarks, webhooks registered with third parties, OAuth callback URLs - stops working, so say so before doing it.`, {
+        project_pid: z.string().min(1),
+        service_pid: z.string().min(1),
+        confirm: z.boolean().describe("Must be true. The service redeploys and anything pointing at the custom domain - webhooks, OAuth callbacks - breaks."),
+    }, async ({ project_pid, service_pid, confirm }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        if (!confirm) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `About to remove the custom domain from service ${service_pid}. It goes back to its platform hostname and redeploys (brief interruption), and any webhook or OAuth callback registered against the custom domain will break.\n\nCall again with confirm=true.`,
+                    }],
+            };
+        }
+        const result = await apiRequest(`${PROJECTS_BASE}/${project_pid}/services/${service_pid}/custom_domain`, {
+            method: "DELETE",
+            toolName: "remove_project_service_custom_domain",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to remove custom domain (${result.statusCode}): ${result.message}` }] };
+        }
+        return {
+            content: [
+                { type: "text", text: "Custom domain removed and the platform hostname restored. Re-read `get_project_service` for the current `public_url`." },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
 }
 //# sourceMappingURL=project-services.js.map