hostinger-api-mcp 3.28.1 → 3.28.3

package/CHANGELOG.md

@@ -4,6 +4,20 @@ Generated at release time from the diff between the previous and current
 build. Tool changes are listed individually; everything else is summarised
 by area.
 
+## v3.28.3 — 2026-11-04
+
+### Also in this release
+
+- Bundled agent skills: 10 files
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+
+## v3.28.2 — 2026-11-04
+
+### Also in this release
+
+- Bundled agent skills: `skills/headless/VERSION`, `skills/headless/steps/08-deploy/SKILL.md`
+- Other files: `src/core/skills.js`, `src/core/skills.ts`
+
 ## v3.28.1 — 2026-11-04
 
 ### Also in this release

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.28.1",
+  "version": "3.28.3",
   "description": "Hostinger API — manage domains, DNS, hosting, VPS, billing and more from Gemini CLI.",
   "mcpServers": {
     "hostinger": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hostinger-api-mcp",
-  "version": "3.28.1",
+  "version": "3.28.3",
   "mcpName": "io.github.hostinger/hostinger-api-mcp",
   "description": "MCP server for Hostinger API",
   "repository": {

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/hostinger/api-mcp-server",
     "source": "github"
   },
-  "version": "3.28.1",
+  "version": "3.28.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@hostinger/mcp",
-      "version": "3.28.1",
+      "version": "3.28.3",
       "transport": {
         "type": "stdio"
       },

package/skills/headless/SKILL.md

@@ -154,7 +154,7 @@ keep the language you were using.
 > The deleted legacy flow that put WordPress on a separate `cms.<domain>` subdomain with a
 > `type:"static"` frontend on the main domain (two instances, recorded as `cms_domain` + `type:"static"`
 > in `site.json`) is **gone and forbidden**. If you ever see `cms_domain` or `type:"static"` in a
-> workspace's `site.json`, you are running a stale/legacy skill copy — stop and re-pull the latest skills
+> workspace's `site.json`, you are running a stale/legacy skill copy — stop and update the skill (`npx skills update` or the plugin update for an installed skill, or connect's Phase 1 npm install for a web-installed `headless/` folder)
 > (see `connect/SKILL.md`) before continuing.
 
 ### Background provision & the instance barrier

package/skills/headless/VERSION

@@ -1,3 +1,3 @@
-version=3.28.1
-commit=4609383f23a0
+version=3.28.3
+commit=c6396dc3106c
 built=2026-11-04

package/skills/headless/connect/SKILL.md

@@ -28,20 +28,51 @@ If that errors (Node not installed) or prints a version below 20, install or upg
 - Linux: `nvm install 22 && nvm use 22` (or your distro's Node 20+ package)
 - Windows: `winget install OpenJS.NodeJS.LTS` (or download from nodejs.org)
 
-## Phase 1 — Run the bootstrap (deterministic)
+## Phase 1 — Get the skill folder, then run its bootstrap (deterministic)
 
-Download the bootstrap script, then run it. It verifies the MCP server and handles sign-in, emitting one JSON event per line on stdout. Run it as a background/streaming process. Show the user only the sign-in URL (`awaiting_user`) or a
-failure's `detail`, and handle the other events silently (table below).
+### Find or install the skill folder
+
+The bootstrap script and every step after connect ship in the `headless/` skill folder. Use the copy
+you already have; never fetch single files from GitHub.
 
-The script is safe and inspectable: it only checks the MCP server via `npx` and drives the OAuth sign-in (a browser flow with a localhost callback) — no other network calls, no filesystem writes. Read it first if your sandbox flags externally-downloaded code.
+- **An installer put the skill here** (you read this file from disk, from a folder that `npx skills
+  add` or a Claude Code or Cursor plugin installed): that folder is `<skill>`. Use it as it is and
+  download nothing. Updates come from the installer (`npx skills update`, the plugin update),
+  not from this run.
+- **You read this file from the web, or from a `headless/` folder an earlier web run installed:**
+  install the skill from the published `@hostinger/mcp` npm release (for an earlier web install, only
+  when it is out of date; see below). It is the same package the MCP server runs, and npm checks
+  the tarball's integrity. Resolve the version first so the run uses one pinned release:
 
 ```bash
-# macOS/Linux:
-curl -fsSL -O https://raw.githubusercontent.com/hostinger/api-mcp-server/main/skills/headless/connect/bootstrap.mjs
-# Windows PowerShell:
-iwr https://raw.githubusercontent.com/hostinger/api-mcp-server/main/skills/headless/connect/bootstrap.mjs -OutFile bootstrap.mjs
+# macOS/Linux
+V=$(npm view @hostinger/mcp version) && npm pack "@hostinger/mcp@$V" --silent \
+  && tar -xzf "hostinger-mcp-$V.tgz" --strip-components=2 package/skills/headless && rm "hostinger-mcp-$V.tgz"
+```
+
+```powershell
+# Windows PowerShell
+$V = npm view @hostinger/mcp version; npm pack "@hostinger/mcp@$V" --silent
+tar -xzf "hostinger-mcp-$V.tgz" --strip-components=2 package/skills/headless; Remove-Item "hostinger-mcp-$V.tgz"
+```
+
+This leaves a local `headless/` folder, which is `<skill>`. A `headless/` folder already here from an
+earlier web install counts as installed, with one check: when line 1 of its `headless/VERSION` is older
+than `npm view @hostinger/mcp version`, install again the same way, so a run never uses a deleted,
+legacy flow.
 
-node bootstrap.mjs
+Read `<skill>/VERSION`: its line 1 is the skills version this run uses, which goes into
+`connect.json` (Phase 3).
+
+### Run the bootstrap
+
+Run the bundled script. It verifies the MCP server and handles sign-in, emitting one JSON event per line on stdout. Run it as a background/streaming process. Show the user only the sign-in URL (`awaiting_user`) or a
+failure's `detail`, and handle the other events silently (table below).
+
+The script is safe and inspectable: it only checks the MCP server via `npx` and drives the OAuth sign-in (a browser flow with a localhost callback) — no other network calls, no filesystem writes.
+
+```bash
+node <skill>/connect/bootstrap.mjs
 ```
 
 ### Relay these events
@@ -113,8 +144,8 @@ until the tool restarts. When either tool group above is missing:
    (`npx --package=@hostinger/mcp@latest hostinger-ecommerce-mcp`) if the ecommerce group is missing.
    Skip a server that is already registered under its name. When neither group is there, register
    both: the backend isn't chosen until refine, and one restart then covers every backend.
-2. **Pull the skills and write `connect.json`** (the route's skills step and Phase 3) before you stop,
-   so the next run starts from them.
+2. **Write `connect.json`** (Phase 3) before you stop. The skill folder from Phase 1 stays in place,
+   so the next run starts from it.
 3. **Send the first message and end your turn.** It follows *The first message* in
    `headless/SKILL.md`: the sign-in link if one was needed, then one line saying Hostinger is set up
    and asking the user to restart the tool (the route says how) and paste the same prompt again so the
@@ -136,16 +167,11 @@ If a tool loads new servers without a restart (VS Code), use them right away and
 If the user's tool isn't listed yet, connect it the generic way: register both Hostinger MCP servers
 in that tool's MCP config (command `npx`, args as above), then follow *register, restart, resume*.
 
-### Always pull the latest skills (never run a stale copy)
+### The skills come from Phase 1 only
 
-The tool route above downloads the `headless/` skill bundle. **Do this at the start of every run and let
-it overwrite any existing local `headless/` folder** — a build must never run on a stale copy, because an
-outdated local bundle is how a deleted, legacy flow (e.g. a separate CMS domain + a `type:"static"`
-frontend — two instances) ends up executing. The bundle ships a `headless/VERSION` stamp
-(`version=<semver>` on line 1, then `commit` and `built`). After pulling, read it; if you want to confirm
-it is current, compare line 1 against the published marker at
-`https://raw.githubusercontent.com/hostinger/api-mcp-server/main/skills/headless/VERSION` and re-pull if
-they differ. Carry the version into `connect.json` (Phase 3) so the build report records which skills ran.
+The tool routes don't download the skills: Phase 1 already found or installed `<skill>`. The bundle
+ships a `headless/VERSION` stamp (`version=<semver>` on line 1, then `commit` and `built`); carry the
+version into `connect.json` (Phase 3) so the build report records which skills ran.
 
 ## Phase 3 - Write `connect.json`
 

package/skills/headless/connect/tools/antigravity.md

@@ -37,22 +37,13 @@ no tokens to handle:
 ```
 
 Antigravity loads MCP servers only when the editor starts, so follow *register, restart, resume* in
-`connect/SKILL.md`: finish Step 2 and `connect.json`, then ask the user to fully quit and reopen
+`connect/SKILL.md`: write `connect.json`, then ask the user to fully quit and reopen
 Antigravity and paste the same prompt. Never spawn the server yourself or write a JSON-RPC client to
 reach it.
 
-## Step 2 — Install the skills and hand off
+## Step 2 — Hand off
 
-Download the Hostinger skills locally **at the start of every run** so your agent then reads the files
-directly with no further network calls during the run. **Always pull the latest and overwrite any
-existing local `headless/` copy** so a run never uses a stale skill version. The repo is **public**, so
-fetch just the skill folder over HTTPS — no git, no credentials (see `connect/tools/claude-code.md` for
-the full tarball command):
-
-```bash
-# macOS/Linux — downloads only skills/headless from the public repo
-curl -fsSL https://codeload.github.com/hostinger/api-mcp-server/tar.gz/refs/heads/main \
-  | tar -xz --strip-components=2 'api-mcp-server-main/skills/headless'
-```
-
-Then read the `headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its steps. That skill owns the rest of the run.
+The skills are already in place: Phase 1 of `connect/SKILL.md` found the installed `headless/`
+folder or installed it from the `@hostinger/mcp` release. Don't download them again here. Read the
+`headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its
+steps. That skill owns the rest of the run.

package/skills/headless/connect/tools/claude-code.md

@@ -30,27 +30,13 @@ claude mcp add hostinger-ecommerce --scope user -- npx --package=@hostinger/mcp@
 ```
 
 Claude Code loads MCP servers only at startup, so follow *register, restart, resume* in
-`connect/SKILL.md`: finish Step 2 and `connect.json`, then ask the user to exit Claude Code, start it
+`connect/SKILL.md`: write `connect.json`, then ask the user to exit Claude Code, start it
 again in the same folder (`claude`, or `claude --continue` to keep this conversation) and paste the
 same prompt. Never spawn the server yourself or write a JSON-RPC client to reach it.
 
-## Step 2 — Install the skills and hand off
-
-Download the Hostinger skills locally **at the start of every run** so your agent then reads the files directly with no further network calls during the run. **Always pull the latest and let it overwrite any existing local `headless/` folder** — a build must never run on a stale skill copy (an outdated local copy is how a deleted, legacy flow ends up executing). The repo is **public**, so fetch just the skill folder over HTTPS — no git, no credentials:
-
-```bash
-# macOS/Linux — downloads only skills/headless from the public repo
-curl -fsSL https://codeload.github.com/hostinger/api-mcp-server/tar.gz/refs/heads/main \
-  | tar -xz --strip-components=2 'api-mcp-server-main/skills/headless'
-```
-
-```powershell
-# Windows PowerShell
-curl.exe -fsSL https://codeload.github.com/hostinger/api-mcp-server/tar.gz/refs/heads/main -o headless-skill.tar.gz
-tar -xf headless-skill.tar.gz --strip-components=2 'api-mcp-server-main/skills/headless'
-```
-
-This leaves a local `headless/` folder with the full skill set. The bundle carries a `headless/VERSION` stamp (`version=<semver>`, commit, build date) — after pulling, read it and tell the user which skills version this run uses; it is the value to record in `connect.json`. If the tarball is ever blocked, browse the public folder at `https://github.com/hostinger/api-mcp-server/tree/main/skills/headless` and save each file under a local `headless/` directory, preserving the paths.
-
-Then open `headless/SKILL.md` and follow the steps on it. That skill owns the rest of the run — it resolves the operations sequence.
+## Step 2 — Hand off
 
+The skills are already in place: Phase 1 of `connect/SKILL.md` found the installed `headless/`
+folder or installed it from the `@hostinger/mcp` release. Don't download them again here. Read the
+`headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its
+steps. That skill owns the rest of the run.

package/skills/headless/connect/tools/codex.md

@@ -36,21 +36,12 @@ args = ["--package=@hostinger/mcp@latest", "hostinger-ecommerce-mcp"]
 ```
 
 Codex loads MCP servers only when it starts, so follow *register, restart, resume* in
-`connect/SKILL.md`: finish Step 2 and `connect.json`, then ask the user to restart Codex and paste the
+`connect/SKILL.md`: write `connect.json`, then ask the user to restart Codex and paste the
 same prompt. Never spawn the server yourself or write a JSON-RPC client to reach it.
 
-## Step 2 — Install the skills and hand off
+## Step 2 — Hand off
 
-Download the Hostinger skills locally **at the start of every run** so your agent then reads the files
-directly with no further network calls during the run. **Always pull the latest and overwrite any
-existing local `headless/` copy** so a run never uses a stale skill version. The repo is **public**, so
-fetch just the skill folder over HTTPS — no git, no credentials (see `connect/tools/claude-code.md` for
-the full tarball command):
-
-```bash
-# macOS/Linux — downloads only skills/headless from the public repo
-curl -fsSL https://codeload.github.com/hostinger/api-mcp-server/tar.gz/refs/heads/main \
-  | tar -xz --strip-components=2 'api-mcp-server-main/skills/headless'
-```
-
-Then read the `headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its steps. That skill owns the rest of the run.
+The skills are already in place: Phase 1 of `connect/SKILL.md` found the installed `headless/`
+folder or installed it from the `@hostinger/mcp` release. Don't download them again here. Read the
+`headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its
+steps. That skill owns the rest of the run.

package/skills/headless/connect/tools/cursor.md

@@ -59,7 +59,7 @@ OAuth can run:
 }
 ```
 
-Cursor loads MCP servers only when the editor starts, so after Step 2 and Step 3 follow
+Cursor loads MCP servers only when the editor starts, so after Step 2 write `connect.json` and follow
 *register, restart, resume* in `connect/SKILL.md`: ask the user to fully quit and reopen Cursor
 (and, if Cursor asks, enable the two Hostinger servers under Settings → MCP), then paste the same
 prompt. Never spawn the server yourself or write a JSON-RPC client to reach it: every connector call
@@ -100,18 +100,9 @@ npx --yes --package=@hostinger/mcp@latest hostinger-api-mcp --logout
 
 **API token (optional, CI / scripts):** set `HOSTINGER_API_TOKEN` in the environment before launching Cursor. When present it always wins and no OAuth code runs. Do not commit the token.
 
-## Step 3 — Install the skills and hand off
+## Step 3 — Hand off
 
-Download the Hostinger skills locally **at the start of every run** so your agent then reads the files
-directly with no further network calls during the run. **Always pull the latest and overwrite any
-existing local `headless/` copy** so a run never uses a stale skill version. The repo is **public**, so
-fetch just the skill folder over HTTPS — no git, no credentials (see `connect/tools/claude-code.md` for
-the full tarball command):
-
-```bash
-# macOS/Linux — downloads only skills/headless from the public repo
-curl -fsSL https://codeload.github.com/hostinger/api-mcp-server/tar.gz/refs/heads/main \
-  | tar -xz --strip-components=2 'api-mcp-server-main/skills/headless'
-```
-
-Then read the `headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its steps. That skill owns the rest of the run.
+The skills are already in place: Phase 1 of `connect/SKILL.md` found the installed `headless/`
+folder or installed it from the `@hostinger/mcp` release. Don't download them again here. Read the
+`headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its
+steps. That skill owns the rest of the run.

package/skills/headless/connect/tools/devin.md

@@ -36,22 +36,13 @@ tokens to handle.
   ```
 
 If the tools still aren't in this session, follow *register, restart, resume* in `connect/SKILL.md`:
-finish Step 2 and `connect.json`, then ask the user to restart the Devin session (on Devin Desktop,
+write `connect.json`, then ask the user to restart the Devin session (on Devin Desktop,
 fully quit and reopen the app) and paste the same prompt. Never spawn the server yourself or write a
 JSON-RPC client to reach it.
 
-## Step 2 — Install the skills and hand off
+## Step 2 — Hand off
 
-Download the Hostinger skills locally **at the start of every run** so your agent then reads the files
-directly with no further network calls during the run. **Always pull the latest and overwrite any
-existing local `headless/` copy** so a run never uses a stale skill version. The repo is **public**, so
-fetch just the skill folder over HTTPS — no git, no credentials (see `connect/tools/claude-code.md` for
-the full tarball command):
-
-```bash
-# macOS/Linux — downloads only skills/headless from the public repo
-curl -fsSL https://codeload.github.com/hostinger/api-mcp-server/tar.gz/refs/heads/main \
-  | tar -xz --strip-components=2 'api-mcp-server-main/skills/headless'
-```
-
-Then read the `headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its steps. That skill owns the rest of the run.
+The skills are already in place: Phase 1 of `connect/SKILL.md` found the installed `headless/`
+folder or installed it from the `@hostinger/mcp` release. Don't download them again here. Read the
+`headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its
+steps. That skill owns the rest of the run.

package/skills/headless/connect/tools/vscode.md

@@ -48,22 +48,13 @@ VS Code picks up new servers and their tools become available right away, with n
 (Alternatively, the official Hostinger Connector extension installs the same server:
 `code --install-extension hostinger-official.hostinger-connector`.)
 
-If the tools still don't show up, follow *register, restart, resume* in `connect/SKILL.md`: finish
-Step 2 and `connect.json`, then ask the user to run **Developer: Reload Window** and paste the same
+If the tools still don't show up, follow *register, restart, resume* in `connect/SKILL.md`: write
+`connect.json`, then ask the user to run **Developer: Reload Window** and paste the same
 prompt. Never spawn the server yourself or write a JSON-RPC client to reach it.
 
-## Step 2 — Install the skills and hand off
+## Step 2 — Hand off
 
-Download the Hostinger skills locally **at the start of every run** so your agent then reads the files
-directly with no further network calls during the run. **Always pull the latest and overwrite any
-existing local `headless/` copy** so a run never uses a stale skill version. The repo is **public**, so
-fetch just the skill folder over HTTPS — no git, no credentials (see `connect/tools/claude-code.md` for
-the full tarball command):
-
-```bash
-# macOS/Linux — downloads only skills/headless from the public repo
-curl -fsSL https://codeload.github.com/hostinger/api-mcp-server/tar.gz/refs/heads/main \
-  | tar -xz --strip-components=2 'api-mcp-server-main/skills/headless'
-```
-
-Then read the `headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its steps. That skill owns the rest of the run.
+The skills are already in place: Phase 1 of `connect/SKILL.md` found the installed `headless/`
+folder or installed it from the `@hostinger/mcp` release. Don't download them again here. Read the
+`headless/VERSION` stamp (record it in `connect.json`), open `headless/SKILL.md` and follow its
+steps. That skill owns the rest of the run.

package/skills/headless/steps/08-deploy/SKILL.md

@@ -115,9 +115,10 @@ echo "$DEPLOY_DIR/app.zip"   # the absolute path to pass as `path` in Step 3
 ```
 
 ```powershell
-# Windows PowerShell — %TEMP% sits under AppData, which the deploy also refuses; use a folder on the system drive
+# Windows PowerShell — %TEMP% sits under AppData, which the deploy also refuses; use a plain folder in your
+# profile, which only you can write to (never a folder under C:\, which every local account can write into)
 cd $HOME\.hostinger\<domain>\src
-$DeployDir = Join-Path $env:SystemDrive "hostinger-deploy\<domain>"; New-Item -ItemType Directory -Force $DeployDir | Out-Null
+$DeployDir = Join-Path $HOME "hostinger-deploy\<domain>"; New-Item -ItemType Directory -Force $DeployDir | Out-Null
 tar -a -cf "$DeployDir\app.zip" --exclude=node_modules --exclude=.next --exclude=dist --exclude=out --exclude=.git --exclude=.htaccess .
 "$DeployDir\app.zip"        # the absolute path to pass as `path` in Step 3
 ```
@@ -243,7 +244,7 @@ serves the build as plain files over the document root and **overwrites `/cms`**
 WordPress backend (this is the "accidentally cleared cms" failure). A static-built SPA (Vite/React/Vue)
 still deploys as `type: "nodejs"` with its `appType` — the framework's static output is served correctly
 that way, and `/cms` is preserved. If a flow ever tells you to deploy a headless site as `type:
-"static"`, you are on a stale/legacy skill copy — stop and re-pull the latest skills.
+"static"`, you are on a stale/legacy skill copy — stop and update the skill (`npx skills update` or the plugin update for an installed skill, or connect's Phase 1 npm install for a web-installed `headless/` folder).
 
 `hosting_deploy` on the local server is the only path: give its `path` a local **archive** (`zip`, `tar`,
 `tar.gz`, `tgz`, `7z`) written outside `~/.hostinger/` as in Step 2. There is no separate upload or