hookit-mcp 0.7.0 → 0.7.1

package/README.md

@@ -33,9 +33,9 @@ Coin names, tickers and descriptions are written by whoever launched the coin. T
 | `deploy_hook` | Deploys a hook written with hookit's Plugin SDK from this wallet on Ink, with the live ModuleRegistry as its constructor argument. Takes the Foundry artifact. `dryRun` is on unless `false`: it checks the code and prices the deployment. Workshop, below. |
 | `submit_hook` | Submits that hook to the Workshop for Hookit's review (manifest, public repo, name, tagline, description), signed by this wallet: a message, no transaction, no fee. `dryRun` is on unless `false`. |
 | `hook_status` | Where a submitted hook stands in the review, Hookit's note and checks, its module id once live, and what to do next. Needs no key. |
-| `wallet_status` | The wallet's ETH and USDG, the hookit.fun coins it holds with their value, its open floor loans, and whether it can launch. |
+| `wallet_status` | The wallet's ETH and USDG, the hookit.fun coins it holds with their value (tickers filtered like every launcher's text: anyone can send the wallet a coin), its open floor loans, and whether it can launch. |
 | `launch_token` | Launches in one call, with an optional `devBuyPct`, `payout`, `evolve` (`{ feePct?, maxFeePct?, potPct? }`: this wallet becomes the coin's Evolve decider, below) `velocity` (`{ preset?, malusPct }`: Velocity Fee, below) and `builderHooks` (`[{ hook, pct?, initData? }]`: builder hooks, below). `dryRun: true` checks and simulates without signing. |
-| `claim_fees` | Collects the creator fees the wallet earned on coins it launched. |
+| `claim_fees` | Collects what the wallet earned: the creator fees of coins it launched and the builder cut a Workshop hook it built paid it (ERC-6909 claims on Uniswap's PoolManager, redeemed through Hookit's V4ClaimsRedeemer for exactly what is owed). `dryRun: true` shows what is owed. |
 | `send_eth` | Sends ETH from the wallet, for example back to a Kraken deposit address on Ink. Refuses less than 0.001 ETH, Kraken's minimum deposit (`belowKrakenMinimum: true` for an address that is not Kraken). `dryRun: true` checks only. With `HOOKIT_SEND_ETH_TO` set, it refuses any other address. |
 | `agent_pass_challenge` | Step 1 for AI-agents-only coins: five short tasks for the Hookit Agent Pass check (or "already a holder"). `{ agentId? }` for an ERC-8004 validation (below). |
 | `claim_agent_pass` | Step 2: `{ id, answers, agentId?, requestHash? }` within 30 seconds; signs the answers with the wallet and claims the pass on chain. With `agentId`, gets Hookit's ERC-8004 validation instead (below). |
@@ -67,7 +67,7 @@ Paying or receiving a token approves exactly that amount to the contract that tr
 
 `coin_info` lists what a coin trades in (`tradeIn`). When `payWith` or `receive` is not one of them, the server swaps through [Relay](https://relay.link) on Ink, the same route hookit.fun's own swap box uses: it asks `https://www.hookit.fun/api/relay/quote` for the swap (Relay's API key stays on that server), then signs Relay's transactions itself. A buy swaps first and buys with what Relay returned; a sale sells for the coin's pair first, then swaps the proceeds. `dryRun` shows both legs.
 
-Before signing, Relay's transactions are checked twice. First their shape: Ink only, calls only to Relay's Ink contracts (router, approval proxy, receiver, multicaller, depository), an approval only of Relay's approval proxy (replaced by an exact approval of the amount), and no more ETH than the amount. Then their effect: the approval and every call run together in one `eth_simulateV1` from the wallet, and the swap is refused unless the wallet would give at most the amount, get at least Relay's own minimum, and lose nothing else. Anything else is refused and nothing is sent. No allowance to Relay is left behind, even when a swap fails. One Relay swap converts at most the per-buy cap (`HOOKIT_MAX_BUY_ETH` / `HOOKIT_MAX_BUY_USD`), with at most 3% slippage. Relay swaps ETH or USDG with each other, kBTC and the tokenized stocks. The RPC in `HOOKIT_RPC_URL` must support `eth_simulateV1` (Ink's public RPC does).
+Before signing, Relay's transactions are checked twice. First their shape: Ink only, calls only to Relay's Ink contracts (router, approval proxy, receiver, multicaller, depository), an approval only of Relay's approval proxy (replaced by an exact approval of the amount), and no more ETH than the amount. Then their effect: the approval and every call run together in one `eth_simulateV1` from the wallet, and the swap is refused unless the wallet would give at most the amount, get at least the minimum, and lose nothing else. That minimum is never the quote's word alone: it is at least the market price (Chainlink's ETH/USD as Factory C reads it, a stock's USDG pool on Ink, else hookit.fun's price) less the slippage and 5% for Relay's fees and price impact, and a quote under that floor is refused. Anything else is refused and nothing is sent. No allowance to Relay is left behind, even when a swap fails. One Relay swap converts at most the per-buy cap (`HOOKIT_MAX_BUY_ETH` / `HOOKIT_MAX_BUY_USD`), with at most 3% slippage. Relay swaps ETH or USDG with each other, kBTC and the tokenized stocks. The RPC in `HOOKIT_RPC_URL` must support `eth_simulateV1` (Ink's public RPC does).
 
 When the first leg went through and the second did not, the reply is `partial: true` with what the wallet now holds: do not retry the call, or the first leg runs twice.
 
@@ -184,10 +184,11 @@ Builder hooks are hooks written by outside builders in hookit.fun's Workshop. Ho
 
 ```
 list_builder_hooks()
-launch_token({ "name": "Burny", "symbol": "BRN", "hookTaxPct": 3, "builderHooks": [{ "hook": 21, "pct": 20 }], "dryRun": true })
+launch_token({ "name": "Burny", "symbol": "BRN", "hookTaxPct": 3, "modules": { "autoBurn": true },
+               "builderHooks": [{ "hook": 21, "pct": 20 }], "dryRun": true })
 ```
 
-- `hook` is the moduleId from `list_builder_hooks`, its plugin address or its exact name. `pct` is the whole percent of the hook pot it takes, up to its `maxPct` (hooks that take a share only); left out, hookit.fun picks the launch wizard's default. The coin's built-in pot destinations are rebalanced to leave it.
+- `hook` is the moduleId from `list_builder_hooks`, its plugin address or its exact name. `pct` is the whole percent of the hook pot it takes, up to its `maxPct` (hooks that take a share only); left out, hookit.fun picks the launch wizard's default (the whole pot when the coin has no other pot destination). The pot's shares total 100%: with a `pct` below that, the rest goes to the coin's built-in pot destinations (Auto-Burn above), which are rebalanced to leave it.
 - A hook with a share needs something to fill the hook pot: a hook tax, Creator → Hook, or a builder hook that adds its own fee (`fillsHookPot`). `maxFeePct` is the most a hook adds on a trade, and it counts in the 10% cap with the 1% base and the hook tax.
 - Names, taglines and descriptions are the builders' own words: the server filters them like a launcher's text and the agent treats them as data. The module, its plugin, its pot and fee caps and whether it is halted are read from ModuleRegistry, and a hook whose module holds another plugin or is deprecated is not listed.
 - Up to 8 per launch. Refused with Evolve and with Velocity Fee for now.
@@ -200,17 +201,17 @@ launch_token({ "name": "Burny", "symbol": "BRN", "hookTaxPct": 3, "builderHooks"
 An agent writes a hook with [hookit's Plugin SDK](https://github.com/SDKHookit/SDKHookit) (its AGENTS.md holds every rule Hookit's review checks), runs the SDK's tests, then deploys and submits it from this wallet. The wallet that deploys is the one that submits.
 
 ```
-deploy_hook({ "artifact": "out/MyHook.sol/MyHook.json" })                    // checks it, gas and cost
-deploy_hook({ "artifact": "out/MyHook.sol/MyHook.json", "dryRun": false })   // deploys it
+deploy_hook({ "artifact": "/abs/path/to/sdk/out/MyHook.sol/MyHook.json" })                    // checks it, gas and cost
+deploy_hook({ "artifact": "/abs/path/to/sdk/out/MyHook.sol/MyHook.json", "dryRun": false })   // deploys it
 // then, in the SDK folder: forge verify-contract … and forge script script/Manifest.s.sol … (the answer gives both)
-submit_hook({ "manifest": "manifests/my-hook.json", "repo": "https://github.com/you/my-hook/tree/<commit>",
+submit_hook({ "manifest": "/abs/path/to/sdk/manifests/my-hook.json", "repo": "https://github.com/you/my-hook/tree/<commit>",
               "name": "My Hook", "tagline": "…", "description": "…", "dryRun": false })
 hook_status({ "plugin": "0x…" })                                            // the review, then the module id
-launch_token({ "name": "…", "symbol": "…", "builderHooks": [{ "hook": 21, "initData": "0x…" }], "dryRun": true })
+launch_token({ "name": "…", "symbol": "…", "hookTaxPct": 3, "builderHooks": [{ "hook": 21, "initData": "0x…" }], "dryRun": true })
 ```
 
-- `deploy_hook` takes the Foundry artifact (`out/<File>.sol/<Contract>.json` after `forge build`) and refuses anything that is not a deployable plugin: one `address` constructor, no linked libraries, code within Ink's limits. The constructor argument is always the ModuleRegistry pinned here, never one the agent or a website names.
-- `submit_hook` sends the manifest as the SDK wrote it and cleans the card exactly as the Workshop's form does, then signs the Workshop's submit message. It says when the plugin already has a submission and warns when the explorer names another deployer.
+- `deploy_hook` takes the Foundry artifact (`out/<File>.sol/<Contract>.json` after `forge build`, as an absolute path: the server runs in its own folder) and refuses anything that is not a deployable plugin: built on the SDK's `HookPluginBase`, one `address` constructor, no linked libraries, code within Ink's limits. It reads regular files only, up to 16 MiB, and never quotes a file it cannot use. The constructor argument is always the ModuleRegistry pinned here, never one the agent or a website names.
+- `submit_hook` sends the manifest as the SDK wrote it and cleans the card exactly as the Workshop's form does, then signs the Workshop's submit message. Before signing, it checks that the manifest's codehash is the code deployed at its address and refuses a submission hookit.fun would refuse (a live plugin, or one that already has a submission in review or approved); it warns when the explorer names another deployer.
 - Nothing here is an audit: Hookit's review may ask for changes (a change is a new deployment and a new submission), and it can halt a plugin at any time.
 - Both signing tools are dry runs unless `dryRun` is `false`: deploy or submit only once the user said to.
 

package/index.js

@@ -4,7 +4,8 @@
 // AI-agents-only coins too, with a Hookit Agent Pass), redeem them at their Backed Floor or borrow against it, and
 // collect its creator fees.
 // The key in HOOKIT_PRIVATE_KEY signs on this machine and is never sent anywhere.
-import { readFileSync } from "node:fs";
+import { closeSync, constants as fsConstants, fstatSync, openSync, readSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -26,6 +27,7 @@ import {
   isAddress,
   keccak256,
   maxUint256,
+  MethodNotSupportedRpcError,
   parseAbi,
   parseAbiParameters,
   parseEther,
@@ -38,9 +40,11 @@ import { privateKeyToAccount } from "viem/accounts";
 import { z } from "zod";
 
 const API = (process.env.HOOKIT_API_URL || "https://www.hookit.fun").replace(/\/$/, "");
-const RPC = process.env.HOOKIT_RPC_URL || "https://rpc-gel.inkonchain.com";
+/** Ink's public RPC: what the commands this server hands out use, since HOOKIT_RPC_URL may carry an API key. */
+const INK_PUBLIC_RPC = "https://rpc-gel.inkonchain.com";
+const RPC = process.env.HOOKIT_RPC_URL || INK_PUBLIC_RPC;
 const KEY = process.env.HOOKIT_PRIVATE_KEY?.trim();
-const VERSION = "0.7.0";
+const VERSION = "0.7.1";
 const EXPLORER = "https://explorer.inkonchain.com";
 /**
  * The Ink deployments this server signs against. Pinned here, never taken from hookit.fun's catalog: a compromised
@@ -84,6 +88,8 @@ const PINNED = {
   // off unless code is there and the contracts point at each other (the plugin at this ModuleRegistry, Velocity at
   // Evolve's EvolveExtensions, each companion at Velocity).
   moduleRegistry: "0x91f1622D49a09Ce2904E8f98650393eB3dAA2470", // ModuleRegistry (v2 modules; Velocity's tier ids are found by scanning it, never hard-coded)
+  poolManager: "0x360E68faCcca8cA495c1B759Fd9EEe466db9FB32", // Uniswap v4 PoolManager on Ink (holds builder cuts as ERC-6909 claims)
+  claimsRedeemer: "0xB88be89e04B6bCB864B2AdA4F3294c69BAaA1A44", // V4ClaimsRedeemer: turns the caller's own ERC-6909 claims into ETH / tokens
   velocityFeePlugin: "0x99772E2199da48e0d1388A3776F96b4257A49E8E", // VelocityFeePlugin (stand-alone, Factory C launches)
   velocityEvolve: "0xA76B2081A521AD03d773B7A4EB38088DAcaDA628", // VelocityEvolve (Evolve extension; catalog id found by scanning EvolveExtensions)
   velocityEvolveFee1: "0xebA39A6E554580f8F4c0aEB9B58Ead323D34eC95", // VelocityEvolveFee rank 1 (asks the 2nd percent of the malus)
@@ -153,10 +159,36 @@ const ink = defineChain({
   blockExplorers: { default: { name: "Blockscout", url: "https://explorer.inkonchain.com" } },
 });
 
-const account = KEY ? privateKeyToAccount(KEY.startsWith("0x") ? KEY : `0x${KEY}`) : null;
+/**
+ * HOOKIT_RPC_URL without eth_fillTransaction: viem takes the chain id, nonce and fees an RPC's fill answers over its
+ * own, so a wrong or hostile RPC could have the wallet sign for another chain. Refused, viem fills from the pinned Ink
+ * chain and the usual one-value calls.
+ */
+const rpc = (config) => {
+  const transport = http(RPC)(config);
+  return {
+    ...transport,
+    request: (args, options) =>
+      args?.method === "eth_fillTransaction"
+        ? Promise.reject(new MethodNotSupportedRpcError(new Error("not used by hookit-mcp"), { method: "eth_fillTransaction" }))
+        : transport.request(args, options),
+  };
+};
+/** The wallet. It signs transactions for Ink only, whatever an RPC answered. */
+const account = (() => {
+  if (!KEY) return null;
+  const key = privateKeyToAccount(KEY.startsWith("0x") ? KEY : `0x${KEY}`);
+  return {
+    ...key,
+    signTransaction: (tx, options) =>
+      tx?.chainId === ink.id
+        ? key.signTransaction(tx, options)
+        : Promise.reject(new Error(`Refused to sign a transaction for chain ${tx?.chainId}: this server signs on Ink (${ink.id}) only. Check HOOKIT_RPC_URL.`)),
+  };
+})();
 // Ink makes a block a second: poll receipts at that pace rather than viem's 4 s default.
-const publicClient = createPublicClient({ chain: ink, transport: http(RPC), pollingInterval: 1_000 });
-const walletClient = account ? createWalletClient({ account, chain: ink, transport: http(RPC) }) : null;
+const publicClient = createPublicClient({ chain: ink, transport: rpc, pollingInterval: 1_000 });
+const walletClient = account ? createWalletClient({ account, chain: ink, transport: rpc }) : null;
 
 const factoryAbi = parseAbi([
   "event TokenLaunched(uint256 indexed launchId, address indexed token, address indexed creator, bytes32 poolId, address hooks, bool customHook, int24 tickLower, int24 tickUpper, uint128 liquidity)",
@@ -171,6 +203,12 @@ const escrowAbi = parseAbi([
   "function balanceOf(address account, address currency) view returns (uint256)",
   "function claimAll(address[] currencies)",
 ]);
+/** The PoolManager's ERC-6909 side: a plugin's PAY intents (a Workshop builder's cut) land there as claims. */
+const erc6909Abi = parseAbi([
+  "function balanceOf(address owner, uint256 id) view returns (uint256)",
+  "function approve(address spender, uint256 id, uint256 amount) returns (bool)",
+]);
+const claimsRedeemerAbi = parseAbi(["function claim(address currency, uint256 amount) returns (uint256)"]);
 const erc20Abi = parseAbi([
   "function symbol() view returns (string)",
   "function decimals() view returns (uint8)",
@@ -364,6 +402,15 @@ function errorName(err) {
   return null;
 }
 
+/** hookit.fun's simulation error, with hook C's PluginLaunchFailed(slot) put in words: that plugin's onLaunch reverted. */
+function launchSimulationError(text) {
+  const t = String(text ?? "");
+  const m = /0x73bafd90([0-9a-f]{64})?/i.exec(t);
+  if (!m) return t;
+  const slot = m[1] ? ` of plugin slot ${Number.parseInt(m[1].slice(-4), 16)}` : "";
+  return `${t} (PluginLaunchFailed: the onLaunch${slot} reverted, for a builder hook usually on its initData: check the launch settings its description documents)`;
+}
+
 /** The `reason` of a PluginBlocked(slot, reason) found in the revert text, else null. */
 function pluginBlockedReason(text) {
   const m = new RegExp(`${PLUGIN_BLOCKED}([0-9a-f]{64})([0-9a-f]{64})`).exec(text);
@@ -405,7 +452,11 @@ async function nextBlockRetry(fn) {
 
 function shortError(err) {
   const name = errorName(err);
-  const text = String(err?.shortMessage || err?.message || err).slice(0, 300);
+  // viem's messages quote the RPC's URL, and HOOKIT_RPC_URL may carry an API key.
+  const text = String(err?.shortMessage || err?.message || err)
+    .split(RPC)
+    .join("HOOKIT_RPC_URL")
+    .slice(0, 300);
   return name && !text.includes(name) ? `${name}: ${text}` : text;
 }
 
@@ -1071,6 +1122,41 @@ const RELAY_INK = new Set(
 const RELAY_APPROVAL_PROXY = getAddress("0xccc88a9d1b4ed6b0eaba998850414b24f1c315be");
 /** Slippage allowed on a Relay leg (ETH, USDG, stocks: liquid pairs), whatever the coin's own slippage is. */
 const RELAY_MAX_SLIPPAGE_BPS = 300;
+/** How far under the market price (on top of the slippage) a Relay quote may be: Relay's fees and price impact. */
+const RELAY_PRICE_MARGIN_BPS = 500;
+/** Chainlink's ETH/USD feed on Ink, as Factory C names it. */
+const ethUsdFeedAbi = parseAbi([
+  "function ethUsdFeed() view returns (address)",
+  "function decimals() view returns (uint8)",
+  "function latestRoundData() view returns (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound)",
+]);
+let chainEthUsdCache = null;
+/** ETH in US dollars from the Chainlink feed the pinned Factory C reads, cached for 60 s; null when stale or unread. */
+async function chainEthUsd() {
+  if (chainEthUsdCache && Date.now() - chainEthUsdCache.at < 60_000) return chainEthUsdCache.price;
+  const feed = await read(PINNED.factory, ethUsdFeedAbi, "ethUsdFeed");
+  const [[, answer, , updatedAt], decimals] = await Promise.all([read(feed, ethUsdFeedAbi, "latestRoundData"), read(feed, ethUsdFeedAbi, "decimals")]);
+  const fresh = Number(updatedAt) > Date.now() / 1000 - 25 * 3600;
+  const price = answer > 0n && fresh ? Number(answer) / 10 ** Number(decimals) : null;
+  chainEthUsdCache = { at: Date.now(), price };
+  return price;
+}
+
+/** One unit of `asset` in US dollars from Ink itself, hookit.fun not asked: USDG 1, ETH from Chainlink, a stock from its USDG pool; else null. */
+async function chainUsdPrice(asset) {
+  if (same(asset, PINNED.usdg)) return 1;
+  if (asset === zeroAddress) return chainEthUsd();
+  return usdgPoolPrice(null, asset);
+}
+
+/** What `amount` of `inMeta` is worth in `outMeta` at Ink's own prices, else hookit.fun's (kBTC has no USDG pool); null if unknown. */
+async function relayFairOut(inMeta, outMeta, amount) {
+  const price = async (asset) => (await chainUsdPrice(asset).catch(() => null)) ?? (await usdPrice(null, asset).catch(() => null));
+  const [pf, pt] = await Promise.all([price(inMeta.address), price(outMeta.address)]);
+  if (!(pf > 0) || !(pt > 0)) return null;
+  const v = (Number(formatUnits(amount, inMeta.decimals)) * pf) / pt;
+  return Number.isFinite(v) && v > 0 ? parseUnits(v.toFixed(outMeta.decimals), outMeta.decimals) : null;
+}
 
 /**
  * A Relay quote to swap `amount` of `from` into `to` on Ink for this wallet, through hookit.fun's /api/relay/quote
@@ -1109,11 +1195,24 @@ async function relayQuote(from, to, amount, slippageBps) {
   if (out <= 0n) return { error: `Relay would return no ${outMeta.symbol}.` };
   const checked = relayPlan(body.calls, from, amount, inMeta.symbol);
   if (checked.error) return { error: checked.error };
+  // The minimum the swap is simulated and checked against is never the quote's word alone: it is at least the market
+  // price less the slippage and a margin, so a forged quote (a minimum of 0, calls that pay someone else) is refused.
+  const fair = await relayFairOut(inMeta, outMeta, amount);
+  if (fair === null) {
+    return { error: `Could not price ${inMeta.symbol} against ${outMeta.symbol}, so Relay's quote cannot be checked against the market. Nothing was sent.` };
+  }
+  const floor = (fair * BigInt(10_000 - slippageBps - RELAY_PRICE_MARGIN_BPS)) / 10_000n;
+  if (out < floor) {
+    return {
+      error: `Relay's quote returns ${amountText(out, outMeta)} for ${amountText(amount, inMeta)}, more than ${(slippageBps + RELAY_PRICE_MARGIN_BPS) / 100}% under the market price (about ${amountText(fair, outMeta)}). Nothing was sent.`,
+    };
+  }
+  const quotedMin = BigInt(body.minimumAmount);
   return {
     quote: {
       requestId: body.requestId,
       out,
-      min: BigInt(body.minimumAmount),
+      min: quotedMin > floor ? quotedMin : floor,
       impact: body.impactPercent ?? null,
       calls: body.calls,
       inMeta,
@@ -1209,7 +1308,7 @@ async function relaySimulate(from, to, amount, min, plan) {
   const spent = -(net.get(getAddress(from)) ?? 0n);
   if (spent > amount) return `Relay's transactions would take more than ${amountText(amount, await assetMeta(from))}`;
   const got = net.get(getAddress(to)) ?? 0n;
-  if (got < min) return `Relay's transactions would return ${amountText(got, await assetMeta(to))}, below Relay's own minimum of ${amountText(min, await assetMeta(to))}`;
+  if (got < min) return `Relay's transactions would return ${amountText(got, await assetMeta(to))}, below the minimum of ${amountText(min, await assetMeta(to))}`;
   return null;
 }
 
@@ -1645,8 +1744,9 @@ server.registerTool(
     if (live.error) return fail(live.error);
     return reply({
       note: BUILDER_TEXT_NOTE,
+      cut: "builderCutMaxPct is the most the builder's wallet may get of what a hook spends (Hookit's review cap, at most 20%), and spends shows that cap: what a hook really pays its builder is in its source.",
       hooks: live.hooks,
-      howToLaunch: 'launch_token with builderHooks: [{ "hook": <moduleId>, "pct": <whole % of the hook pot, up to maxPct> }]. dryRun first.',
+      howToLaunch: 'launch_token with builderHooks: [{ "hook": <moduleId>, "pct": <whole % of the hook pot, up to maxPct>, "initData": <0x launch settings, optional> }]. dryRun first.',
     });
   },
 );
@@ -1656,29 +1756,39 @@ server.registerTool(
   {
     annotations: SIGNS,
     description:
-      "Deploys a hook you wrote with hookit's Plugin SDK from this wallet on Ink, with the live ModuleRegistry as its constructor argument, as the SDK requires. Give it the Foundry artifact (out/<File>.sol/<Contract>.json after forge build, with the SDK's tests green). Checks it first: one address constructor (HookPluginBase), code within Ink's limits, the gas and what it costs. dryRun is the default and deploys nothing: deploy only once the user said to. The answer gives the source-verify and manifest commands to run next, then submit_hook.",
+      "Deploys a hook you wrote with hookit's Plugin SDK from this wallet on Ink, with the live ModuleRegistry as its constructor argument, as the SDK requires. Give it the absolute path of the Foundry artifact (<SDK folder>/out/<File>.sol/<Contract>.json after forge build, with the SDK's tests green): this server does not run in the SDK folder. Checks it first: built on HookPluginBase (hookitPluginApi, one address constructor), code within Ink's limits, the gas and what it costs. dryRun is the default and deploys nothing: deploy only once the user said to. The answer gives the source-verify and manifest commands to run next, then submit_hook.",
     inputSchema: {
-      artifact: z.string().describe("Path to the plugin's Foundry artifact, e.g. ./out/MyPlugin.sol/MyPlugin.json in the SDK folder."),
+      artifact: z.string().describe("Absolute path to the plugin's Foundry artifact, e.g. /home/you/my-hook/out/MyPlugin.sol/MyPlugin.json."),
       dryRun: z.boolean().optional().describe("Default true: check and price the deployment only. false deploys it from this wallet."),
     },
   },
   serialized(async ({ artifact, dryRun }) => {
     if (!account) return needKey();
+    const file = readLocalFile(artifact, MAX_ARTIFACT_BYTES);
+    if (file.error) return fail(`Could not read the artifact: ${file.error}. Run forge build in the SDK folder and give the absolute path of out/<File>.sol/<Contract>.json.`);
     let raw;
     try {
-      raw = JSON.parse(readFileSync(artifact, "utf8"));
-    } catch (err) {
-      return fail(`Could not read the artifact ${plainText(artifact).slice(0, 200)}: ${plainText(err?.message).slice(0, 200)}. Run forge build in the SDK folder and give out/<File>.sol/<Contract>.json.`);
+      raw = JSON.parse(file.text);
+    } catch {
+      // Never quote the parser's message: it carries the file's first characters, whatever file the path named.
+      return fail(`${plainText(file.path).slice(0, 300)} is not JSON. Give the Foundry artifact: out/<File>.sol/<Contract>.json in the SDK folder.`);
     }
     const a = pluginArtifact(raw);
     if (a.error) return fail(a.error);
     const args = encodeAbiParameters([{ type: "address" }], [PINNED.moduleRegistry]);
     const data = `${a.bytecode}${args.slice(2)}`;
-    const [nonce, balance, gasPrice] = await Promise.all([
-      publicClient.getTransactionCount({ address: account.address, blockTag: "pending" }),
-      publicClient.getBalance({ address: account.address }),
-      publicClient.getGasPrice(),
-    ]);
+    let chainId, nonce, balance, fees;
+    try {
+      [chainId, nonce, balance, fees] = await Promise.all([
+        publicClient.getChainId(),
+        publicClient.getTransactionCount({ address: account.address, blockTag: "pending" }),
+        publicClient.getBalance({ address: account.address }),
+        publicClient.estimateFeesPerGas(),
+      ]);
+    } catch (err) {
+      return fail(`Ink's RPC did not answer: ${shortError(err)}. Nothing was sent; retry later.`);
+    }
+    if (chainId !== ink.id) return fail(`HOOKIT_RPC_URL answers for chain ${chainId}, not Ink (${ink.id}): nothing was signed. Point it at an Ink RPC.`);
     const unfunded = `Not enough ETH on Ink to deploy ${a.name}: send some to ${account.address} for the gas, then call deploy_hook again.`;
     if (balance === 0n) return fail(unfunded);
     let gas;
@@ -1690,7 +1800,8 @@ server.registerTool(
       return fail(`Deploying ${a.name} would fail: ${shortError(err)}`);
     }
     gas += gas / 5n;
-    const cost = gas * gasPrice;
+    // What the transaction may cost at the fee it is sent with, plus room for Ink's L1 data fee.
+    const cost = gas * fees.maxFeePerGas;
     const view = {
       contract: a.name,
       source: a.target,
@@ -1701,32 +1812,47 @@ server.registerTool(
       gas: String(gas),
       costEth: formatEther(cost),
     };
-    if (balance < cost + parseEther("0.00002")) {
-      return fail(`Not enough ETH on Ink to deploy: about ${formatEther(cost)} ETH of gas. Send some to ${account.address}.`);
+    if (balance < cost + parseEther("0.00005")) {
+      return fail(`Not enough ETH on Ink to deploy: up to ${formatEther(cost)} ETH of gas. Send some to ${account.address}.`);
     }
     if (dryRun !== false) {
       return reply({ dryRun: true, ...view, verdict: `Ready to deploy ${a.name}. Ask the user, then call deploy_hook again with dryRun false.` });
     }
-    const hash = await walletClient.sendTransaction({ data, gas });
-    const receipt = await publicClient.waitForTransactionReceipt({ hash });
+    let hash;
+    try {
+      hash = await walletClient.sendTransaction({ data, gas, nonce, maxFeePerGas: fees.maxFeePerGas, maxPriorityFeePerGas: fees.maxPriorityFeePerGas });
+    } catch (err) {
+      const details = err?.details ? ` (${plainText(err.details).split(RPC).join("HOOKIT_RPC_URL").slice(0, 200)})` : "";
+      return fail(`The deployment was not sent: ${shortError(err)}${details}`);
+    }
+    const receipt = await publicClient.waitForTransactionReceipt({ hash }).catch(() => null);
+    if (!receipt) return fail(`Sent, but no receipt yet: check ${EXPLORER}/tx/${hash} before deploying again.`);
     if (receipt.status !== "success" || !receipt.contractAddress) return fail(`The deployment reverted: ${EXPLORER}/tx/${hash}`);
     const plugin = getAddress(receipt.contractAddress);
-    const api = await read(plugin, pluginApiAbi, "hookitPluginApi").catch(() => null);
-    const target = a.target ?? `src/${a.name}.sol:${a.name}`;
+    const [api, code] = await Promise.all([
+      read(plugin, pluginApiAbi, "hookitPluginApi").catch(() => null),
+      publicClient.getCode({ address: plugin }).catch(() => null),
+    ]);
+    const name = manifestName(file.path, a.name);
+    const sdk = resolve(dirname(file.path), "..", "..");
+    const manifestFile = name ? join(sdk, "manifests", `${name}.json`) : null;
     return reply({
       deployed: true,
       ...view,
       address: plugin,
+      ...(code && code !== "0x" ? { runtimeBytes: (code.length - 2) / 2 } : {}),
       tx: `${EXPLORER}/tx/${hash}`,
       explorer: `${EXPLORER}/address/${plugin}`,
       pluginApi: api === null ? null : Number(api),
-      ...(api !== null && Number(api) !== PLUGIN_API
-        ? { warning: `hookitPluginApi() answers ${api}, not ${PLUGIN_API}: Hookit cannot register it. Build on HookPluginBase.` }
+      ...(api === null || Number(api) !== PLUGIN_API
+        ? { warning: `hookitPluginApi() ${api === null ? "does not answer" : `answers ${api}, not ${PLUGIN_API}`}: Hookit cannot register it. Build on HookPluginBase.` }
         : {}),
       next: [
-        `Verify the source (no key needed): forge verify-contract ${plugin} ${target} --chain 57073 --constructor-args ${args} --verifier blockscout --verifier-url ${EXPLORER}/api/`,
-        `Print the manifest (it never broadcasts), under the name the contract has in script/Manifest.s.sol (my-plugin for the starter): forge script script/Manifest.s.sol --sig "run(string,address)" ${manifestSlug(a.name)} ${plugin} --rpc-url ${RPC}`,
-        "Push the code to a public repo and note the commit, then submit_hook with the manifest file, that repo link, a name, a tagline and a description.",
+        `In the SDK folder (${plainText(sdk).slice(0, 200)}), verify the source (no key needed): forge verify-contract ${plugin} ${a.target} --chain 57073 --constructor-args ${args} --verifier blockscout --verifier-url ${EXPLORER}/api/`,
+        name
+          ? `Then print the manifest (it never broadcasts): forge script script/Manifest.s.sol --sig "run(string,address)" ${name} ${plugin} --rpc-url ${INK_PUBLIC_RPC}`
+          : `Then add ${a.name} to script/Manifest.s.sol (_deployLocal and _declaration) under a name of yours, and print the manifest (it never broadcasts): forge script script/Manifest.s.sol --sig "run(string,address)" <that name> ${plugin} --rpc-url ${INK_PUBLIC_RPC}`,
+        `Push the code to a public repo and note the commit, then submit_hook with the manifest file (${manifestFile ? plainText(manifestFile).slice(0, 300) : "the absolute path of manifests/<that name>.json"}), that repo link, a name, a tagline and a description.`,
       ],
     });
   }),
@@ -1754,29 +1880,45 @@ server.registerTool(
   },
   serialized(async ({ manifest, repo, name, tagline, description, tags, logo, dryRun }) => {
     if (!account) return needKey();
-    const m = workshopManifest(manifest, (path) => readFileSync(path, "utf8"));
+    const m = workshopManifest(manifest, (path) => {
+      const file = readLocalFile(path, MAX_MANIFEST_BYTES);
+      if (file.error) throw new Error(file.error);
+      return file.text;
+    });
     if (m.error) return fail(m.error);
     const parsed = workshopFields({ plugin: m.plugin, name, tagline, description, repo, manifest: m.text, logo, tags });
     if (parsed.error) return fail(`Not submitted: ${parsed.error}.`);
     const f = parsed.fields;
-    const code = await publicClient.getCode({ address: f.plugin }).catch(() => null);
+    let code;
+    try {
+      code = await publicClient.getCode({ address: f.plugin });
+    } catch (err) {
+      return fail(`Ink's RPC did not answer: ${shortError(err)}. Nothing was sent; retry later.`);
+    }
     if (!code || code === "0x") return fail(`No contract at ${f.plugin} on Ink: deploy it first (deploy_hook), then print its manifest.`);
+    if (m.codehash && m.codehash !== keccak256(code)) {
+      return fail(`The manifest's codehash is not the code at ${f.plugin}: it was edited or printed for another build. Print it again with the SDK's Manifest script for this address.`);
+    }
     const api = await read(f.plugin, pluginApiAbi, "hookitPluginApi").catch(() => null);
     if (api === null || Number(api) !== PLUGIN_API) return fail(`${f.plugin} is not a plugin of API ${PLUGIN_API} (hookitPluginApi()): build it on the SDK's HookPluginBase.`);
-    const [existing, deployer] = await Promise.all([
+    const [existing, explorer] = await Promise.all([
       fetch(`${API}/api/workshop/submissions?plugin=${f.plugin}`, { signal: AbortSignal.timeout(15_000) })
         .then((r) => (r.ok ? r.json() : null))
         .then((b) => b?.submission ?? null)
         .catch(() => null),
       fetch(`${EXPLORER}/api/v2/addresses/${f.plugin}`, { signal: AbortSignal.timeout(10_000) })
         .then((r) => (r.ok ? r.json() : null))
-        .then((b) => (isAddress(b?.creator_address_hash ?? "") ? getAddress(b.creator_address_hash) : null))
         .catch(() => null),
     ]);
+    const deployer = isAddress(explorer?.creator_address_hash ?? "") ? getAddress(explorer.creator_address_hash) : null;
     const warnings = [];
     if (deployer && !same(deployer, account.address)) {
       warnings.push(`This wallet did not deploy ${f.plugin} (${deployer} did): Hookit's review expects the deployer's signature, and the deployer can take the submission over.`);
     }
+    if (explorer?.is_verified === false) {
+      warnings.push(`The explorer has no verified source for ${f.plugin}: run the forge verify-contract command deploy_hook gave before submitting, Hookit's review reads that source.`);
+    }
+    const refusal = workshopConflict(existing, account.address, deployer);
     const view = {
       plugin: f.plugin,
       submitter: account.address,
@@ -1784,6 +1926,7 @@ server.registerTool(
       ...(existing ? { existing: workshopView(existing) } : {}),
       ...(warnings.length ? { warnings } : {}),
     };
+    if (refusal) return fail(`hookit.fun would refuse it: ${refusal}. Nothing was signed.`);
     if (dryRun !== false) {
       return reply({ dryRun: true, ...view, verdict: "Ready to submit. Show the user the card, then call submit_hook again with dryRun false." });
     }
@@ -1872,9 +2015,10 @@ server.registerTool(
             .sort((a, b) => (b.valueUsd ?? 0) - (a.valueUsd ?? 0))
             .slice(0, 25)
             .map((p) => ({
-              token: p.token,
-              symbol: p.symbol,
-              balance: p.balance,
+              token: isAddress(p.token ?? "") ? getAddress(p.token) : "?",
+              // A coin's ticker is its launcher's text (anyone can launch and send this wallet dust of it).
+              symbol: launcherLabel(p.symbol, 16, "(ticker withheld)"),
+              balance: Number.isFinite(p.balance) ? p.balance : 0,
               valueUsd: usd(p.valueUsd),
               ...(p.unrealizedPct !== null && p.unrealizedPct !== undefined ? { unrealizedPct: usd(p.unrealizedPct) } : {}),
             }));
@@ -1884,6 +2028,7 @@ server.registerTool(
       balanceEth: formatEther(balance),
       ...(usdgBalance !== null ? { balanceUsdg: short(usdgBalance, usdg.decimals) } : {}),
       holdings,
+      ...(Array.isArray(holdings) && holdings.length ? { launcherText: LAUNCHER_TEXT_NOTE } : {}),
       ...(loans.length ? { loans: await Promise.all(loans.map((l) => loanView(c, l))) } : {}),
       launchFeeEth: fee === null ? "unknown" : formatEther(fee),
       roughCostEth: formatEther(needed),
@@ -1908,8 +2053,8 @@ server.registerTool(
   {
     annotations: SIGNS,
     description:
-      "Launches a coin on hookit.fun with the chosen preset or hook modules, in one call. With builderHooks, it adds Workshop hooks from list_builder_hooks; the server checks each slot of the transaction against the hook's registry entry before signing. With evolve, this wallet becomes the coin's Evolve decider and moves its fee and split after launch (evolve_status, evolve_decide, evolve_plug). With velocity, sells pay a malus when the price is below its moving average (and dip buys get hook tax back when buys pay one); the server checks the malus tier, its settings and the 10% fee rule in the transaction itself before signing. With dryRun it only checks the launch and returns the unsigned transaction: use it first and show the user the settings.",
-    inputSchema: { ...launchShape, dryRun: z.boolean().optional().describe("Check and simulate only. Signs nothing.") },
+      "Launches a coin on hookit.fun with the chosen preset or hook modules, in one call. With builderHooks, it adds Workshop hooks from list_builder_hooks; the server checks each slot of the transaction against the hook's registry entry before signing. With evolve, this wallet becomes the coin's Evolve decider and moves its fee and split after launch (evolve_status, evolve_decide, evolve_plug). With velocity, sells pay a malus when the price is below its moving average (and dip buys get hook tax back when buys pay one); the server checks the malus tier, its settings and the 10% fee rule in the transaction itself before signing. With dryRun it only checks the launch and returns the unsigned transaction: use it first and show the user the settings. Without dryRun it signs and sends at once.",
+    inputSchema: { ...launchShape, dryRun: z.boolean().optional().describe("Check and simulate only. Signs nothing. Left out, the launch is signed and sent.") },
   },
   serialized(async ({ dryRun, ...args }) => {
     if (!dryRun && !account) return needKey();
@@ -1968,7 +2113,7 @@ server.registerTool(
         verdict: prepared.simulation?.needsApproval
           ? "Valid. A real launch will first approve the dev buy token, then launch."
           : prepared.simulation?.ok === false
-            ? `The launch would fail: ${prepared.simulation.error}`
+            ? `The launch would fail: ${launchSimulationError(prepared.simulation.error)}`
             : "The launch is valid.",
         plan: prepared.plan,
         ...(args.evolve ? { evolve: evolveLaunchView(prepared) } : {}),
@@ -1980,7 +2125,7 @@ server.registerTool(
       });
     }
     if (prepared.simulation && !prepared.simulation.ok) {
-      return fail(`The launch would fail: ${prepared.simulation.error}\nSettings: ${prepared.plan.settings.join("; ")}`);
+      return fail(`The launch would fail: ${launchSimulationError(prepared.simulation.error)}\nSettings: ${prepared.plan.settings.join("; ")}`);
     }
 
     const hash = await walletClient.sendTransaction({
@@ -2032,39 +2177,65 @@ server.registerTool(
   "claim_fees",
   {
     annotations: SIGNS,
-    description: "Collects the creator fees this wallet has earned on coins it launched itself (paid in ETH and the pair tokens).",
+    description:
+      "Collects what this wallet earned: the creator fees of coins it launched itself (paid in ETH and the pair tokens) and the builder cut a Workshop hook it built paid it (ERC-6909 claims on Uniswap's PoolManager, redeemed through Hookit's V4ClaimsRedeemer for exactly what is owed). With dryRun it only shows what is owed.",
     inputSchema: {
       currencies: z.array(z.string()).optional().describe("Token addresses to collect. Default: ETH plus every pair token."),
+      dryRun: z.boolean().optional().describe("Show what is owed only. Signs nothing."),
     },
   },
-  serialized(async ({ currencies }) => {
+  serialized(async ({ currencies, dryRun }) => {
     if (!account) return needKey();
+    const bad = (currencies ?? []).find((x) => !isAddress(x));
+    if (bad !== undefined) return fail(`Not a token address: ${plainText(bad).slice(0, 64)}`);
     const c = await catalog();
     if (!c.factory) return fail("Launches are not configured on this hookit.");
     const hook = await publicClient.readContract({ address: c.factory, abi: factoryAbi, functionName: "masterHook" });
     const escrow = await publicClient.readContract({ address: hook, abi: hookAbi, functionName: "feeEscrow" });
-    const candidates = currencies?.length ? currencies : [zeroAddress, ...(c.pairAddresses ?? [])];
+    const candidates = [...new Set((currencies?.length ? currencies : [zeroAddress, ...(c.pairAddresses ?? [])]).map((x) => getAddress(x)))];
     const owed = [];
+    const cuts = [];
     for (const currency of candidates) {
-      const amount = await publicClient.readContract({ address: escrow, abi: escrowAbi, functionName: "balanceOf", args: [account.address, currency] });
-      if (amount > 0n) owed.push({ currency, amount });
+      const [fees, cut] = await Promise.all([
+        publicClient.readContract({ address: escrow, abi: escrowAbi, functionName: "balanceOf", args: [account.address, currency] }),
+        // A currency's ERC-6909 id is its address as a number.
+        publicClient.readContract({ address: PINNED.poolManager, abi: erc6909Abi, functionName: "balanceOf", args: [account.address, BigInt(currency)] }),
+      ]);
+      if (fees > 0n) owed.push({ currency, amount: fees });
+      if (cut > 0n) cuts.push({ currency, amount: cut });
     }
-    if (owed.length === 0) return reply("Nothing to collect yet.");
-    const hash = await walletClient.writeContract({ address: escrow, abi: escrowAbi, functionName: "claimAll", args: [owed.map((o) => o.currency)] });
-    await publicClient.waitForTransactionReceipt({ hash });
-    const lines = [];
-    for (const { currency, amount } of owed) {
-      if (currency === zeroAddress) {
-        lines.push(`${formatEther(amount)} ETH`);
-        continue;
+    if (owed.length === 0 && cuts.length === 0) return reply("Nothing to collect yet.");
+    const owedText = async ({ currency, amount }) => amountText(amount, await assetMeta(currency));
+    const view = {
+      ...(owed.length ? { creatorFees: await Promise.all(owed.map(owedText)) } : {}),
+      ...(cuts.length ? { builderCut: await Promise.all(cuts.map(owedText)) } : {}),
+    };
+    if (dryRun) return reply({ dryRun: true, ...view, verdict: "Call claim_fees again without dryRun to collect it." });
+    const txs = [];
+    try {
+      if (owed.length) {
+        const hash = await walletClient.writeContract({ address: escrow, abi: escrowAbi, functionName: "claimAll", args: [owed.map((o) => o.currency)] });
+        const receipt = await publicClient.waitForTransactionReceipt({ hash });
+        if (receipt.status !== "success") return fail(`Collecting the creator fees reverted: ${EXPLORER}/tx/${hash}`);
+        txs.push(`${EXPLORER}/tx/${hash}`);
       }
-      const [symbol, decimals] = await Promise.all([
-        publicClient.readContract({ address: currency, abi: erc20Abi, functionName: "symbol" }).catch(() => currency),
-        publicClient.readContract({ address: currency, abi: erc20Abi, functionName: "decimals" }).catch(() => 18),
-      ]);
-      lines.push(`${Number(amount) / 10 ** Number(decimals)} ${symbol}`);
+      for (const { currency, amount } of cuts) {
+        // The redeemer may move exactly what is owed in this currency, and none of the wallet's other claims.
+        const approve = await walletClient.writeContract({ address: PINNED.poolManager, abi: erc6909Abi, functionName: "approve", args: [PINNED.claimsRedeemer, BigInt(currency), amount] });
+        if ((await publicClient.waitForTransactionReceipt({ hash: approve })).status !== "success") {
+          return fail(`Approving the redeemer reverted: ${EXPLORER}/tx/${approve}${txs.length ? `. Already sent: ${txs.join(", ")}` : ""}`);
+        }
+        const hash = await walletClient.writeContract({ address: PINNED.claimsRedeemer, abi: claimsRedeemerAbi, functionName: "claim", args: [currency, amount] });
+        const receipt = await publicClient.waitForTransactionReceipt({ hash });
+        if (receipt.status !== "success") {
+          return fail(`Redeeming the builder cut reverted: ${EXPLORER}/tx/${hash}${txs.length ? `. Already sent: ${txs.join(", ")}` : ""}`);
+        }
+        txs.push(`${EXPLORER}/tx/${hash}`);
+      }
+    } catch (err) {
+      return fail(`Collection stopped: ${shortError(err)}${txs.length ? `. Already sent: ${txs.join(", ")}` : ""}`);
     }
-    return reply({ collected: lines, tx: `https://explorer.inkonchain.com/tx/${hash}` });
+    return reply({ collected: view, txs });
   }),
 );
 
@@ -2926,6 +3097,23 @@ function launcherDescription(raw) {
   return { untrusted: true, text: [...t].slice(0, 500).join("") };
 }
 
+/**
+ * A Workshop hook's description for an agent, under launcherDescription's rules, except that Solidity's abi.encode(...)
+ * (and bytes. / string. calls) is not read as a link: builders are asked to document their launch settings that way.
+ */
+function builderDescription(raw) {
+  // Those calls' dots are masked with a private-use character (any the builder wrote is dropped first) while the
+  // link rules run, then put back.
+  const masked = String(raw ?? "")
+    .replace(/\uE000/g, "")
+    .replace(/\b(?:abi|bytes|string)\.[A-Za-z_]\w*(?=\s*\()/g, (call) => call.replace(/\./g, "\uE000"));
+  const t = evolveReason(masked);
+  if (t === null || INSTRUCTION_BAIT.test(t)) {
+    return { withheld: "The builder's description contains a link, a handle, an address or a tool name, so it is not shown. Read it on the hook's Workshop page." };
+  }
+  return { untrusted: true, text: [...t.replace(/\uE000/g, ".")].slice(0, 500).join("") };
+}
+
 /** One coin of /api/launches for an agent. */
 function coinRow(p, now) {
   const priceUsd = p.priceEth > 0 && p.quoteUsd > 0 ? p.priceEth * p.quoteUsd : null;
@@ -6245,7 +6433,7 @@ function builderHookView(h, entry) {
     moduleId: entry.id,
     name,
     tagline: launcherLabel(h.tagline, 140, ""),
-    description: launcherDescription(h.description),
+    description: builderDescription(h.description),
     categories: Array.isArray(h.categories) ? h.categories.filter((c) => ["protection", "fees", "tokenomics"].includes(c)) : [],
     plugin: entry.plugin,
     builder: isAddress(h.builder ?? "") ? getAddress(h.builder) : null,
@@ -6256,7 +6444,8 @@ function builderHookView(h, entry) {
     spends: Array.isArray(h.spends)
       ? h.spends.slice(0, 8).map((x) => ({ to: launcherLabel(x?.to, 24, "?"), pct: Number(x?.pct) || 0 }))
       : [],
-    builderCutPct: Math.min(20, Math.max(0, Number(h.builderCutPct) || 0)),
+    // The review's cap on what the builder's wallet gets of what the hook spends, not what this hook pays (B7).
+    builderCutMaxPct: Math.min(20, Math.max(0, Number(h.builderCutPct) || 0)),
     ...(source ? { source } : {}),
     launchWith: { hook: entry.id, ...(entry.maxPotBps > 0 ? { pct: Math.min(Math.floor(entry.maxPotBps / 100), 20) } : {}) },
   };
@@ -6293,6 +6482,45 @@ async function builderHooksLive() {
   return { hooks, entries };
 }
 
+/**
+ * A local file the agent named (an artifact, a manifest), read only when it is a regular file of at most maxBytes: a
+ * FIFO, a device or a huge file would hang or kill this server. { path, text } or { error }; the error names the
+ * resolved path and why, never what the file holds.
+ */
+function readLocalFile(path, maxBytes) {
+  const full = resolve(String(path ?? ""));
+  const shown = plainText(full).slice(0, 300);
+  let fd;
+  try {
+    // O_NONBLOCK: opening a FIFO nobody writes to must not block; regular files read as usual.
+    fd = openSync(full, fsConstants.O_RDONLY | (fsConstants.O_NONBLOCK ?? 0));
+    const st = fstatSync(fd);
+    if (!st.isFile()) return { error: `${shown} is not a regular file` };
+    if (st.size > maxBytes) return { error: `${shown} is ${st.size} bytes, above the ${maxBytes} this server reads` };
+    const buf = Buffer.alloc(st.size);
+    let read = 0;
+    while (read < st.size) {
+      const n = readSync(fd, buf, read, st.size - read, read);
+      if (n === 0) break;
+      read += n;
+    }
+    return { path: full, text: buf.subarray(0, read).toString("utf8") };
+  } catch (err) {
+    const why = { ENOENT: "no such file", EACCES: "permission denied", EISDIR: "a directory", ENOTDIR: "not a path to a file" }[err?.code] ?? "unreadable";
+    return { error: `${shown}: ${why}. This server runs in ${plainText(process.cwd()).slice(0, 200)}: give an absolute path` };
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+/** The name the SDK's script/Manifest.s.sol gives `contract`, read next to its artifact (<sdk>/out/<File>.sol/<Contract>.json), or null. */
+function manifestName(artifactPath, contract) {
+  const script = readLocalFile(join(dirname(artifactPath), "..", "..", "script", "Manifest.s.sol"), MAX_MANIFEST_BYTES);
+  if (script.error) return null;
+  const m = script.text.match(new RegExp(`keccak256\\("([a-z0-9][a-z0-9-]{0,63})"\\)\\)\\s*return\\s+address\\(new\\s+${contract}\\(`));
+  return m ? m[1] : null;
+}
+
 /** The listed hook an agent names: by module id, plugin address or exact name (case ignored). { hook } or { error }. */
 function builderHookFind(hooks, ref) {
   const key = String(ref ?? "").trim();
@@ -6395,6 +6623,9 @@ const PLUGIN_API = 3;
 /** EIP-170 and EIP-3860: the most runtime code a contract may have and the most init code a creation may carry. */
 const MAX_RUNTIME_BYTES = 24_576;
 const MAX_INITCODE_BYTES = 49_152;
+/** The most a Foundry artifact, a manifest and the SDK's Manifest script may weigh before this server reads them. */
+const MAX_ARTIFACT_BYTES = 16 * 1024 * 1024;
+const MAX_MANIFEST_BYTES = 256 * 1024;
 const WORKSHOP_TAGS = ["agents", "special"];
 /** CIDv0 or CIDv1: a logo is an image pinned on IPFS, never an arbitrary URL (the site's rule). */
 const WORKSHOP_LOGO = /^ipfs:\/\/(Qm[1-9A-HJ-NP-Za-km-z]{44}|b[a-z2-7]{50,100})$/;
@@ -6480,7 +6711,7 @@ function workshopSubmitMessage(f, issuedAt) {
 
 /**
  * The manifest submit_hook sends: the text of the SDK's manifest (a file path, or the JSON itself), sent as written so
- * its big integers keep every digit. { text, plugin } or { error }.
+ * its big integers keep every digit. { text, plugin, codehash } or { error } (codehash null when the manifest has none).
  */
 function workshopManifest(input, readText) {
   const raw = String(input ?? "").trim();
@@ -6489,7 +6720,7 @@ function workshopManifest(input, readText) {
     try {
       text = readText(raw);
     } catch (err) {
-      return { error: `Could not read the manifest file ${plainText(raw).slice(0, 200)}: ${plainText(err?.message).slice(0, 200)}. Give the path the SDK's Manifest script printed (manifests/<name>.json) or the JSON itself.` };
+      return { error: `Could not read the manifest file: ${plainText(err?.message).slice(0, 400)}. Give the absolute path of the file the SDK's Manifest script wrote (manifests/<name>.json) or the JSON itself.` };
     }
   }
   let parsed;
@@ -6501,7 +6732,8 @@ function workshopManifest(input, readText) {
   if (!parsed || typeof parsed !== "object" || typeof parsed.plugin !== "string" || !isAddress(parsed.plugin)) {
     return { error: "The manifest has no plugin address. Print it with the SDK's Manifest script for the deployed address." };
   }
-  return { text, plugin: getAddress(parsed.plugin) };
+  const codehash = typeof parsed.codehash === "string" && /^0x[0-9a-fA-F]{64}$/.test(parsed.codehash) ? parsed.codehash.toLowerCase() : null;
+  return { text, plugin: getAddress(parsed.plugin), codehash };
 }
 
 /**
@@ -6521,39 +6753,43 @@ function pluginArtifact(a) {
   if (!/^0x(?:[0-9a-fA-F]{2})+$/.test(bytecode) || !/^0x(?:[0-9a-fA-F]{2})+$/.test(runtime)) {
     return { error: "This artifact has no deployable code (an interface, an abstract contract or a library?). Give the plugin contract's artifact." };
   }
+  // The source path and the name go into the shell commands this server tells the agent to run: plain ones only.
   const target = Object.entries(a?.metadata?.settings?.compilationTarget ?? {})[0];
-  const name = target ? String(target[1]) : "the contract";
-  const ctor = Array.isArray(a.abi) ? a.abi.find((x) => x?.type === "constructor") : undefined;
+  if (!target) return { error: "This artifact has no compilationTarget metadata: build it with the SDK's forge build (default settings) and give out/<File>.sol/<Contract>.json." };
+  const [source, name] = target.map(String);
+  if (!/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(name)) return { error: "The artifact's contract name is not a plain Solidity identifier." };
+  if (!/^[A-Za-z0-9_][A-Za-z0-9_.\/-]{0,199}\.sol$/.test(source) || source.split("/").includes("..")) {
+    return { error: `${name}'s source path in the artifact is not a plain relative .sol path (letters, digits, _ . / - only).` };
+  }
+  const abi = Array.isArray(a.abi) ? a.abi : [];
+  const ctor = abi.find((x) => x?.type === "constructor");
   if (!ctor || ctor.inputs?.length !== 1 || ctor.inputs[0]?.type !== "address") {
     return { error: `${name} must have one constructor argument, the ModuleRegistry's address (constructor(address moduleRegistry_) HookPluginBase(address(0), moduleRegistry_)), like the SDK's starter. Is this the plugin's artifact and not its Declaration library?` };
   }
   if (ctor.stateMutability === "payable") return { error: `${name}'s constructor is payable: a plugin holds no ETH of its own.` };
+  if (!abi.some((x) => x?.type === "function" && x.name === "hookitPluginApi" && (x.inputs?.length ?? 0) === 0)) {
+    return { error: `${name} has no hookitPluginApi(): a Hookit plugin is built on the SDK's HookPluginBase. Is this the plugin's artifact?` };
+  }
   const runtimeBytes = (runtime.length - 2) / 2;
   if (runtimeBytes > MAX_RUNTIME_BYTES) return { error: `${name} is ${runtimeBytes} bytes of code, above Ink's ${MAX_RUNTIME_BYTES}.` };
   if ((bytecode.length - 2) / 2 + 32 > MAX_INITCODE_BYTES) return { error: `${name}'s creation code is above Ink's ${MAX_INITCODE_BYTES} bytes.` };
-  return { name, target: target ? `${target[0]}:${target[1]}` : null, bytecode, runtimeBytes };
+  return { name, target: `${source}:${name}`, bytecode, runtimeBytes };
 }
 
-/** The Manifest script's name for a contract: MyPlugin -> my-plugin. */
-const manifestSlug = (name) =>
-  String(name)
-    .replace(/([a-z0-9])([A-Z])/g, "$1-$2")
-    .replace(/[^A-Za-z0-9]+/g, "-")
-    .replace(/^-|-$/g, "")
-    .toLowerCase() || "my-plugin";
-
 /** What the agent does next, by the submission's status. */
 function workshopNext(s) {
   switch (s.status) {
     case "pending":
     case "in_review":
-      return "Hookit is reviewing it: nothing to do but wait. Check again with hook_status later (reviews take a human).";
+      return s.checks?.sourceVerified === false
+        ? "Hookit is reviewing it, but the explorer had no verified source when it was submitted: run the forge verify-contract command deploy_hook gave (no key needed), the review reads that source. Then check again with hook_status later (reviews take a human)."
+        : "Hookit is reviewing it: nothing to do but wait. Check again with hook_status later (reviews take a human).";
     case "changes_requested":
       return "Hookit asked for changes (reviewNote). Card text only: submit_hook again with the same manifest. Code: a plugin is immutable, so fix it and its tests, deploy_hook again, print a new manifest for the new address and submit_hook that one.";
     case "approved":
       return "Approved. Hookit is registering it on chain; once hook_status says live, launch with it.";
     case "live":
-      return `Live as module ${s.moduleId}. Launch a coin with it: launch_token with builderHooks: [{ "hook": ${s.moduleId} }] and dryRun first. list_builder_hooks shows it to every agent.`;
+      return `Live as module ${s.moduleId}. Launch a coin with it: launch_token with builderHooks: [{ "hook": ${s.moduleId} }] and dryRun first. A hook that takes a share of the hook pot needs something to fill it (hookTaxPct, e.g. 3), and the pot's shares total 100%: without a pct it takes the whole pot; with one, send the rest to a built-in destination (modules: { autoBurn: true }). list_builder_hooks shows it to every agent.`;
     case "rejected":
       return "Rejected (reviewNote). Start over with a new plugin only if the note leaves a way.";
     case "halted":
@@ -6576,7 +6812,8 @@ function workshopView(s) {
     checks: {
       sourceVerified: c.sourceVerified ?? null,
       codehashMatches: c.codehashMatches ?? null,
-      registryPrecheck: c.registryPrecheck ? plainText(c.registryPrecheck).slice(0, 300) : "accepted",
+      // The site stores null once the registry's dry run accepted it, its revert reason otherwise; absent is unknown.
+      registryPrecheck: c.registryPrecheck === null ? "accepted" : c.registryPrecheck ? plainText(c.registryPrecheck).slice(0, 300) : null,
       ...(c.proxy ? { proxy: plainText(c.proxy).slice(0, 200) } : {}),
       ...(c.hasDelegatecall ? { hasDelegatecall: true } : {}),
     },
@@ -6585,10 +6822,36 @@ function workshopView(s) {
   };
 }
 
+/**
+ * Why hookit.fun would refuse `me` submitting a plugin that already has a submission, or null: the site's 409 rules
+ * (live; the same wallet's approved or in-review one; another wallet's, unless `me` deployed the plugin and they did
+ * not, and it is not under review). Unknown when the site does not show the earlier submitter.
+ */
+function workshopConflict(existing, me, deployer) {
+  if (!existing) return null;
+  const status = String(existing.status ?? "");
+  if (status === "live") return "this plugin is already live";
+  if (!isAddress(existing.submitter ?? "")) return null;
+  if (same(existing.submitter, me)) {
+    return status === "approved" || status === "in_review" ? `your submission of it is already ${status.replace("_", " ")}` : null;
+  }
+  // A rejected one frees the plugin for anyone (the site's reclaimVerdict); otherwise only its deployer takes it back.
+  if (status === "rejected") return null;
+  if (!deployer || !same(deployer, me) || same(deployer, existing.submitter)) {
+    return "another wallet already submitted this plugin: if this wallet deployed it, ask the Workshop reviewers to reject that submission, then submit again";
+  }
+  if (status === "approved" || status === "in_review") {
+    return `another wallet's submission of it is ${status.replace("_", " ")}: ask the Workshop reviewers to reject it, then submit again`;
+  }
+  return null;
+}
+
 /** Why a launch asked without any plugin must not be signed, or null: hookit.fun added a plugin slot nobody asked for. */
 function unaskedSlotsRefusal(prepared) {
   const d = launchConfigDecoded(prepared);
-  return d && d.plugins.length > 0
+  // Fails closed: a call it cannot read (Factory C's launchWithNftStrategy, say) could carry any plugin slot.
+  if (!d) return "hookit answered with a launch call this version cannot read (not Factory C's launch or launchMulti). Nothing was sent; update hookit-mcp.";
+  return d.plugins.length > 0
     ? `hookit answered with ${d.plugins.length === 1 ? "a plugin slot" : `${d.plugins.length} plugin slots`} (module ${d.plugins.map((p) => p.moduleId).join(", ")}) that this launch did not ask for. Nothing was sent; update hookit-mcp.`
     : null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hookit-mcp",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Let an AI agent launch a coin on hookit.fun (Ink) with its own hook modules and builders' Workshop hooks, find, buy and sell coins with ETH, USDG or tokenized stocks (AI-agents-only ones too, with a Hookit Agent Pass), redeem or borrow at their Backed Floor, collect its creator fees, steer the fee split, the fee and the hooks of the Evolve coins it launched, and deploy and submit its own hook to the Workshop.",
   "type": "module",
   "bin": { "hookit-mcp": "index.js" },