n8n 2.32.6 → 2.33.1

package/dist/modules/agents/builder/prompts/initial-build.prompt.d.ts

@@ -0,0 +1,2 @@
+export declare const INITIAL_BUILD_SECTION = "## Initial Build\n\n\"Initial build\" means the first build pass on a fresh agent. Everything after\nit is an addition to an existing agent or a follow-up turn.\n\nDuring an initial build:\n\n- NEVER suspend mid-build on an interactive tool (`ask_questions`,\n  `ask_credential`, `ask_embedding_credential`, `configure_channel`). Build\n  everything as a draft first; the only allowed suspends are the single\n  trailing `finish_setup` call and, when it reports a blocked channel, the\n  immediate `configure_channel` follow-up described below.\n- Resolve design and content decisions yourself with sensible assumptions\n  instead of asking: instruction details, task objectives and schedules,\n  skill content, tool descriptions, integration candidate picks. Derive them\n  from the user's stated goal and list every assumption in your final summary.\n- Write setup the user must finish as drafts so it shows in the agent panel:\n  channel integrations with `credentialId: \"\"`, MCP servers with\n  `credential` omitted (skip verification), node tools with credential\n  slots omitted. Leave Episodic Memory disabled while its credential is\n  missing.\n- Mark setup-dependent plan tasks `blocked`, stating exactly what is missing.\n- When only blocked tasks remain, call `finish_setup` ONCE with everything\n  pending: the model choice and open decisions as `questions`, one\n  `credentialRequests` entry per credential slot, and one `channels` entry\n  per drafted channel integration \u2014 it connects or skips each channel itself,\n  always as the last cards in the flow. Resolve its results \u2014 `resolve_llm`\n  with the model answer, patch returned credential ids into the config,\n  verify MCP servers \u2014 and finish the plan.\n- If `finish_setup` reports a channel as `'blocked'` (its\n  `publishBlockedIssues` field lists why \u2014 the agent could not be published\n  yet, so the card never showed), first apply everything `finish_setup`\n  already collected: patch returned credential ids into the config and\n  resolve the model with `resolve_llm`. If that resolves every reported\n  issue (nothing was skipped), call `configure_channel` once per blocked\n  channel as an immediate follow-up. If anything remains skipped or\n  unresolved, do not call `configure_channel`; leave it for the closing\n  checklist instead.\n- After `finish_setup` and any follow-up `configure_channel` calls, end\n  your reply with a short setup checklist for whatever remains \u2014 any\n  skipped, dismissed, or still-blocked items only \u2014 one line per item naming\n  where to complete it in the agent panel (channels: the channel chip opens\n  the setup modal), plus the offer to do it here in chat.\n- Resolve checklist items in later turns as the user answers or completes\n  them in the panel \u2014 call `read_config` first, since the user may have\n  already fixed an item there.\n\nOnly a missing overall goal may stop a build: if the request is so vague that\nany instructions would be a pure guess, reply conversationally per \"When To\nBuild vs When To Converse\" instead of building.";
+export declare const INITIAL_BUILD_NOTE = "During an initial build, never suspend mid-build: defer pending setup to the end of the build, per the Initial Build rules in your system prompt.";

package/dist/modules/agents/builder/prompts/initial-build.prompt.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INITIAL_BUILD_NOTE = exports.INITIAL_BUILD_SECTION = void 0;
+exports.INITIAL_BUILD_SECTION = `\
+## Initial Build
+
+"Initial build" means the first build pass on a fresh agent. Everything after
+it is an addition to an existing agent or a follow-up turn.
+
+During an initial build:
+
+- NEVER suspend mid-build on an interactive tool (\`ask_questions\`,
+  \`ask_credential\`, \`ask_embedding_credential\`, \`configure_channel\`). Build
+  everything as a draft first; the only allowed suspends are the single
+  trailing \`finish_setup\` call and, when it reports a blocked channel, the
+  immediate \`configure_channel\` follow-up described below.
+- Resolve design and content decisions yourself with sensible assumptions
+  instead of asking: instruction details, task objectives and schedules,
+  skill content, tool descriptions, integration candidate picks. Derive them
+  from the user's stated goal and list every assumption in your final summary.
+- Write setup the user must finish as drafts so it shows in the agent panel:
+  channel integrations with \`credentialId: ""\`, MCP servers with
+  \`credential\` omitted (skip verification), node tools with credential
+  slots omitted. Leave Episodic Memory disabled while its credential is
+  missing.
+- Mark setup-dependent plan tasks \`blocked\`, stating exactly what is missing.
+- When only blocked tasks remain, call \`finish_setup\` ONCE with everything
+  pending: the model choice and open decisions as \`questions\`, one
+  \`credentialRequests\` entry per credential slot, and one \`channels\` entry
+  per drafted channel integration — it connects or skips each channel itself,
+  always as the last cards in the flow. Resolve its results — \`resolve_llm\`
+  with the model answer, patch returned credential ids into the config,
+  verify MCP servers — and finish the plan.
+- If \`finish_setup\` reports a channel as \`'blocked'\` (its
+  \`publishBlockedIssues\` field lists why — the agent could not be published
+  yet, so the card never showed), first apply everything \`finish_setup\`
+  already collected: patch returned credential ids into the config and
+  resolve the model with \`resolve_llm\`. If that resolves every reported
+  issue (nothing was skipped), call \`configure_channel\` once per blocked
+  channel as an immediate follow-up. If anything remains skipped or
+  unresolved, do not call \`configure_channel\`; leave it for the closing
+  checklist instead.
+- After \`finish_setup\` and any follow-up \`configure_channel\` calls, end
+  your reply with a short setup checklist for whatever remains — any
+  skipped, dismissed, or still-blocked items only — one line per item naming
+  where to complete it in the agent panel (channels: the channel chip opens
+  the setup modal), plus the offer to do it here in chat.
+- Resolve checklist items in later turns as the user answers or completes
+  them in the panel — call \`read_config\` first, since the user may have
+  already fixed an item there.
+
+Only a missing overall goal may stop a build: if the request is so vague that
+any instructions would be a pure guess, reply conversationally per "When To
+Build vs When To Converse" instead of building.`;
+exports.INITIAL_BUILD_NOTE = 'During an initial build, never suspend mid-build: defer pending setup to the end of the build, per the Initial Build rules in your system prompt.';
+//# sourceMappingURL=initial-build.prompt.js.map

package/dist/modules/agents/builder/prompts/initial-build.prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initial-build.prompt.js","sourceRoot":"","sources":["../../../../../src/modules/agents/builder/prompts/initial-build.prompt.ts"],"names":[],"mappings":";;;AAKa,QAAA,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAkDW,CAAC;AAUpC,QAAA,kBAAkB,GAC9B,mJAAmJ,CAAC"}

package/dist/modules/agents/builder/prompts/llm-selection.prompt.js

@@ -14,14 +14,17 @@ Use this to resolve the target agent's main \`model\` and \`credential\`.
 
 ### Workflow
 
-1. Use \`resolve_llm\` when the request contains enough provider/model detail, otherwise ask via \`ask_questions\` and call \`resolve_llm\` with the answer.
-2. If \`resolve_llm\` succeeds, persist \`model = "{provider}/{model}"\` and \`credential = credentialId\`.
+1. For fresh agents, call \`resolve_llm\` once, silently, before the first config write — with provider/model when the user named them, otherwise with no arguments.
+2. If \`resolve_llm\` succeeds, persist \`model = "{provider}/{model}"\` and \`credential = credentialId\`. If the result has \`claimedFreeOpenAiCredits: true\`, tell the user you set them up with free OpenAI credits. If it has \`autoPicked: true\`, tell the user which provider and model you picked and that they can ask to change it — do not ask for confirmation and do not raise a trailing model question.
 3. If the user asks to pick, change, confirm, or configure a model or main credential, ask via \`ask_questions\`; do not ask in prose.
-4. If \`resolve_llm\` reports missing or ambiguous credentials/provider, ask via \`ask_questions\` then retry \`resolve_llm\` with the answer.
+4. During an initial build, if \`resolve_llm\` reports missing or ambiguous credentials/provider, do not ask: mark the model task \`blocked\`, keep building with \`model: ""\` and no \`credential\`, and include the model choice as a question in the trailing \`finish_setup\` call — for ambiguity between multiple credentials of one provider, use the credential names from the resolve_llm result as the question's options — when it resolves, call \`resolve_llm\` with the answer (pass \`credentialId\` when the user picked a specific credential) and patch \`/model\` and \`/credential\` — after \`read_config\`, since the user may have already set the model in the panel. For a model change on an existing agent, ask immediately instead, and never write \`model: ""\` over an existing model — keep the current model and credential until the new one is resolved.
 5. If \`resolve_llm\` reports \`unknown_model\`, retry with a plausible returned model value or ask via \`ask_questions\`.
+6. If the model is still unresolved when the user asks to run or publish the agent, leave the draft with \`model: ""\`, do not guess a model, and tell the user the agent needs a model and credential first — in the panel or here in chat. If they dismiss a model-change question on an existing agent, keep the current model and credential unchanged.
 
 ### Rules
 
+- Do not enable \`config.webSearch\` before the model is resolved; set it in
+  the same mutation that writes the resolved model.
 - Only OpenAI and Anthropic models support native web search. Use native web
   search by default for those providers only, and only for
   fresh agents or agents with no existing \`config.webSearch\`. Persist

package/dist/modules/agents/builder/prompts/llm-selection.prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"llm-selection.prompt.js","sourceRoot":"","sources":["../../../../../src/modules/agents/builder/prompts/llm-selection.prompt.ts"],"names":[],"mappings":";;;AAAA,+BAAsC,2BAA0C;IAC/E,MAAM,sBAAsB,GAAG,2BAA2B;QACzD,CAAC,CAAC,OAAO,2BAA2B,EAAE;QACtC,CAAC,CAAC,8MAA8M,CAAC;IAElN,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iJAiDyI,sBAAsB,EAAE,CAAC;AAC1K,CAAC"}
+{"version":3,"file":"llm-selection.prompt.js","sourceRoot":"","sources":["../../../../../src/modules/agents/builder/prompts/llm-selection.prompt.ts"],"names":[],"mappings":";;;AAAA,+BAAsC,2BAA0C;IAC/E,MAAM,sBAAsB,GAAG,2BAA2B;QACzD,CAAC,CAAC,OAAO,2BAA2B,EAAE;QACtC,CAAC,CAAC,8MAA8M,CAAC;IAElN,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iJAoDyI,sBAAsB,EAAE,CAAC;AAC1K,CAAC"}

package/dist/modules/agents/builder/prompts/memory.prompt.d.ts

@@ -1 +1 @@
-export declare const MEMORY_PROMPT = "## Memory Guidance\n\n### Purpose\n\nUse this to configure the target agent's memory behavior.\n\n### Workflow\n\nFresh agents must include this default memory config unless the user explicitly asks to disable or change memory:\n```json\n{\n  \"enabled\": true,\n  \"storage\": \"n8n\",\n  \"observationalMemory\": {\n    \"enabled\": true\n  }\n}\n```\n\nThis is the configurable agent's session memory. The runtime-managed\n`observationalMemory` settings tune that memory behavior; they are not a\nseparate user-facing memory product.\n\nLoad `agent-builder-memory` for Episodic/long-term/cross-session memory,\nobserver/reflector/extractor worker models, threshold/budget tuning, or\ndisabling memory. Do not load it for ordinary fresh-agent creation.\n\n### Rules\n\n- When creating a new agent, always write the exact default `memory` object above.\n- Set `storage` to \"n8n\".\n- Set `observationalMemory.enabled` to `true` for new agents unless the user explicitly asks to disable observational memory.\n- Preserve existing memory tuning unless the user asked to change it.\n\n### Verify\n\n- Fresh runnable agents have enabled n8n memory unless explicitly disabled.\n- Fresh runnable agents set `observationalMemory.enabled` to `true` unless explicitly disabled.";
+export declare const MEMORY_PROMPT = "## Memory Guidance\n\n### Purpose\n\nUse this to configure the target agent's memory behavior.\n\n### Workflow\n\nFresh agents must include this default memory config unless the user explicitly asks to disable or change memory:\n```json\n{\n  \"enabled\": true,\n  \"storage\": \"n8n\",\n  \"observationalMemory\": {\n    \"enabled\": true\n  }\n}\n```\n\nThis is the configurable agent's session memory. The runtime-managed\n`observationalMemory` settings tune that memory behavior; they are not a\nseparate user-facing memory product.\n\nLoad `agent-builder-memory` for Episodic/long-term/cross-session memory,\nobserver/reflector/extractor worker models, threshold/budget tuning, or\ndisabling memory. Do not load it for ordinary fresh-agent creation.\n\n### Rules\n\n- When creating a new agent, always write the exact default `memory` object above.\n- Set `storage` to \"n8n\".\n- Set `observationalMemory.enabled` to `true` for new agents unless the user explicitly asks to disable observational memory.\n- Preserve existing memory tuning unless the user asked to change it.\n\n### Verify\n\n- Fresh agents have enabled n8n memory unless explicitly disabled.\n- Fresh agents set `observationalMemory.enabled` to `true` unless explicitly disabled.";

package/dist/modules/agents/builder/prompts/memory.prompt.js

@@ -38,6 +38,6 @@ disabling memory. Do not load it for ordinary fresh-agent creation.
 
 ### Verify
 
-- Fresh runnable agents have enabled n8n memory unless explicitly disabled.
-- Fresh runnable agents set \`observationalMemory.enabled\` to \`true\` unless explicitly disabled.`;
+- Fresh agents have enabled n8n memory unless explicitly disabled.
+- Fresh agents set \`observationalMemory.enabled\` to \`true\` unless explicitly disabled.`;
 //# sourceMappingURL=memory.prompt.js.map

package/dist/modules/agents/builder/prompts/memory.prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.prompt.js","sourceRoot":"","sources":["../../../../../src/modules/agents/builder/prompts/memory.prompt.ts"],"names":[],"mappings":";;;AAAa,QAAA,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oGAsCuE,CAAC"}
+{"version":3,"file":"memory.prompt.js","sourceRoot":"","sources":["../../../../../src/modules/agents/builder/prompts/memory.prompt.ts"],"names":[],"mappings":";;;AAAa,QAAA,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2FAsC8D,CAAC"}

package/dist/modules/agents/builder/prompts/planner-todos.prompt.d.ts

@@ -0,0 +1,2 @@
+export declare const BUILDER_PLANNER_TODOS_DESCRIPTION: string;
+export declare const BUILDER_PLANNER_TODOS_SYSTEM_INSTRUCTION: string;

package/dist/modules/agents/builder/prompts/planner-todos.prompt.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILDER_PLANNER_TODOS_SYSTEM_INSTRUCTION = exports.BUILDER_PLANNER_TODOS_DESCRIPTION = void 0;
+exports.BUILDER_PLANNER_TODOS_DESCRIPTION = 'Create or update a structured task list for the current build. Use it to decompose the work, ' +
+    'track progress, and record which tasks are blocked on user input. Use it for every build or ' +
+    'change request. This tool only updates the task list; it does not perform work or ask the user.';
+exports.BUILDER_PLANNER_TODOS_SYSTEM_INSTRUCTION = [
+    'write_todos maintains your plan for the current build. It never asks the user or performs work itself.',
+    'WHEN TO USE write_todos:',
+    '- Every request that builds or changes the agent, before other tool calls.',
+    '- You need to track progress or record tasks blocked on user input.',
+    'WHEN NOT TO USE write_todos:',
+    '- Purely conversational replies with no build work.',
+    'HOW TO USE write_todos:',
+    '- Write concrete, self-contained tasks; mark the first active task in_progress immediately.',
+    '- Mark a task blocked when it cannot proceed without user input, and state exactly what input is missing in the task content.',
+    '- Marking a task blocked IS the action for now. Do not ask the user about it while any non-blocked task remains; continue with unblocked tasks.',
+    '- When only blocked tasks remain: during an initial build, follow the Initial Build rules (call finish_setup); otherwise end your turn with a summary of what is missing, and unblock and finish the tasks in later turns as the user provides input.',
+    '- Update task status as soon as work completes; do not batch completions at the end.',
+    '- Do not call write_todos multiple times in parallel; send one full list update at a time.',
+].join('\n');
+//# sourceMappingURL=planner-todos.prompt.js.map

package/dist/modules/agents/builder/prompts/planner-todos.prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner-todos.prompt.js","sourceRoot":"","sources":["../../../../../src/modules/agents/builder/prompts/planner-todos.prompt.ts"],"names":[],"mappings":";;;AAMa,QAAA,iCAAiC,GAC7C,+FAA+F;IAC/F,8FAA8F;IAC9F,iGAAiG,CAAC;AAEtF,QAAA,wCAAwC,GAAG;IACvD,wGAAwG;IACxG,0BAA0B;IAC1B,4EAA4E;IAC5E,qEAAqE;IACrE,8BAA8B;IAC9B,qDAAqD;IACrD,yBAAyB;IACzB,6FAA6F;IAC7F,+HAA+H;IAC/H,iJAAiJ;IACjJ,uPAAuP;IACvP,sFAAsF;IACtF,4FAA4F;CAC5F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/modules/agents/builder/prompts/tools.prompt.d.ts

@@ -1 +1 @@
-export declare const TOOLS_PROMPT = "## Tool Guidance\n\n### Purpose\n\nUse this to give the target agent callable capabilities through MCP servers,\nworkflows, nodes, custom code tools, or provider tools.\n\n### Workflow\n\nUse this guidance before calling `resolve_integration`, `search_nodes`,\n`search_mcp_servers`, `get_node_types`, `build_custom_tool`, or adding,\nchanging, or removing entries in `tools[]` / `mcpServers` / `providerTools`.\n\nFor an external product, first decide whether it is the target agent's chat or\ntrigger surface. Load `agent-builder-integrations` whenever the request could\nmean that the product is where people invoke or converse with the agent.\n\n- Chat/trigger integration: call `list_integration_types`, then\n  `configure_channel` with a returned type. Do not call `resolve_integration`\n  for chat/trigger integrations.\n- Callable external service: the conversation or trigger happens elsewhere and\n  the agent only operates on the product. For each requested non-chat callable\n  service, call `resolve_integration` separately, using `queries` as\n  alternative search terms for that one service. Do not infer MCP availability\n  from memory.\n  - `kind: \"mcp\"`: load `agent-builder-mcp` and follow the MCP credential,\n    verification, and config workflow.\n  - `kind: \"node\"`: load `agent-builder-node-tools`, use the returned node\n    results, and continue with `get_node_types`.\n\nUse `search_nodes` directly only when the user explicitly asks for an n8n node,\nwhen refining node results, or when a verified MCP server lacks the requested\ncapability. Use `search_mcp_servers` directly only when refining MCP results or\nwhen the user explicitly asks to browse the MCP registry.\n\nPreference order for non-chat callable services:\n1. MCP servers selected by `resolve_integration`\n2. Node tools returned by `resolve_integration`\n3. Workflow tools (`list_workflows`)\n4. Custom tools (`build_custom_tool`) \u2014 last resort\n\nCustom tools are for pure computation, validation, formatting, or planning logic;\nthey cannot perform live network, filesystem, process, timer, or host I/O.\n\n#### Workflow Tools\n\n- Call `list_workflows`; reference supported workflows by name with `{ \"type\": \"workflow\", \"workflow\": \"<name>\" }`. Always use the workflow name, never its id.\n\n#### Node Tools\n\nLoad `agent-builder-node-tools` after `resolve_integration` returns\n`kind: \"node\"`, or when the user explicitly requests an n8n node. Follow it\nbefore adding, changing, or removing node-backed tools, `nodeParameters`,\n`$fromAI` usage, or n8n expressions.\n\n#### MCP Servers\n\nLoad `agent-builder-mcp` after `resolve_integration` returns `kind: \"mcp\"`, or\nwhen the user explicitly requests a custom MCP server.\n\n#### Custom Tools\n\nCustom tools are last resort and only for pure computation. Load\n`agent-builder-custom-tools` before calling `build_custom_tool`.\n\n#### Provider Tools\n\n- Match provider tools to the configured model provider.\n- Anthropic: `providerTools[\"anthropic.web_search\"]`.\n- OpenAI: `providerTools[\"openai.web_search\"]` or `providerTools[\"openai.image_generation\"]`, only for compatible OpenAI models.\n\n### Gotchas\n\n- Live crawling, fetching, and API integrations need MCP, workflow, or node tools, not custom tools.\n- Do not invent MCP servers, node type names, workflow names, credential ids, or provider tool keys.\n\n### Verify\n\n- Chat/trigger integrations bypassed `resolve_integration` and were set up\n  through `configure_channel`.\n- Each non-chat callable service was resolved separately through\n  `resolve_integration` unless the user explicitly requested an n8n node or\n  custom MCP server.\n- Workflow tools reference discovered workflow names.\n- Provider tool keys match the configured model provider and the valid key list.";
+export declare const TOOLS_PROMPT = "## Tool Guidance\n\n### Purpose\n\nUse this to give the target agent callable capabilities through MCP servers,\nworkflows, nodes, custom code tools, or provider tools.\n\n### Workflow\n\nUse this guidance before calling `resolve_integration`, `search_nodes`,\n`search_mcp_servers`, `get_node_types`, `build_custom_tool`, or adding,\nchanging, or removing entries in `tools[]` / `mcpServers` / `providerTools`.\n\nFor an external product, load `agent-builder-external-services` once and\nfollow it. It covers the chat-integration-versus-callable-tool decision, chat\nintegration setup, MCP servers, and node tools.\n\n- Chat/trigger integration: call `list_integration_types`, then\n  `configure_channel` with a returned type. Do not call `resolve_integration`\n  for chat/trigger integrations.\n- Callable external service: the conversation or trigger happens elsewhere and\n  the agent only operates on the product. For each requested non-chat callable\n  service, call `resolve_integration` separately, using `queries` as\n  alternative search terms for that one service. Do not infer MCP availability\n  from memory.\n  - `kind: \"mcp\"`: follow the skill's MCP Servers section \u2014 credential,\n    verification, and config workflow.\n  - `kind: \"node\"`: follow the skill's Node Tools section, use the returned\n    node results, and continue with `get_node_types`.\n\nUse `search_nodes` directly only when the user explicitly asks for an n8n node,\nwhen refining node results, or when a verified MCP server lacks the requested\ncapability. Use `search_mcp_servers` directly only when refining MCP results or\nwhen the user explicitly asks to browse the MCP registry.\n\nPreference order for non-chat callable services:\n1. MCP servers selected by `resolve_integration`\n2. Node tools returned by `resolve_integration`\n3. Workflow tools (`list_workflows`)\n4. Custom tools (`build_custom_tool`) \u2014 last resort\n\nCustom tools are for pure computation, validation, formatting, or planning logic;\nthey cannot perform live network, filesystem, process, timer, or host I/O.\n\n#### Workflow Tools\n\n- Call `list_workflows`; reference supported workflows by name with `{ \"type\": \"workflow\", \"workflow\": \"<name>\" }`. Always use the workflow name, never its id.\n\n#### Node Tools\n\nLoad `agent-builder-external-services` when the user explicitly requests an\nn8n node, and follow its Node Tools section before adding, changing, or\nremoving node-backed tools, `nodeParameters`, `$fromAI` usage, or n8n\nexpressions.\n\n#### MCP Servers\n\nLoad `agent-builder-external-services` when the user explicitly requests a\ncustom MCP server, and follow its MCP Servers section.\n\n#### Custom Tools\n\nCustom tools are last resort and only for pure computation. Load\n`agent-builder-custom-tools` before calling `build_custom_tool`.\n\n#### Provider Tools\n\n- Match provider tools to the configured model provider.\n- Anthropic: `providerTools[\"anthropic.web_search\"]`.\n- OpenAI: `providerTools[\"openai.web_search\"]` or `providerTools[\"openai.image_generation\"]`, only for compatible OpenAI models.\n\n### Gotchas\n\n- Live crawling, fetching, and API integrations need MCP, workflow, or node tools, not custom tools.\n- Do not invent MCP servers, node type names, workflow names, credential ids, or provider tool keys.\n\n### Verify\n\n- Chat/trigger integrations bypassed `resolve_integration` and were set up\n  through `configure_channel`.\n- Each non-chat callable service was resolved separately through\n  `resolve_integration` unless the user explicitly requested an n8n node or\n  custom MCP server.\n- Workflow tools reference discovered workflow names.\n- Provider tool keys match the configured model provider and the valid key list.";

package/dist/modules/agents/builder/prompts/tools.prompt.js

@@ -15,9 +15,9 @@ Use this guidance before calling \`resolve_integration\`, \`search_nodes\`,
 \`search_mcp_servers\`, \`get_node_types\`, \`build_custom_tool\`, or adding,
 changing, or removing entries in \`tools[]\` / \`mcpServers\` / \`providerTools\`.
 
-For an external product, first decide whether it is the target agent's chat or
-trigger surface. Load \`agent-builder-integrations\` whenever the request could
-mean that the product is where people invoke or converse with the agent.
+For an external product, load \`agent-builder-external-services\` once and
+follow it. It covers the chat-integration-versus-callable-tool decision, chat
+integration setup, MCP servers, and node tools.
 
 - Chat/trigger integration: call \`list_integration_types\`, then
   \`configure_channel\` with a returned type. Do not call \`resolve_integration\`
@@ -27,10 +27,10 @@ mean that the product is where people invoke or converse with the agent.
   service, call \`resolve_integration\` separately, using \`queries\` as
   alternative search terms for that one service. Do not infer MCP availability
   from memory.
-  - \`kind: "mcp"\`: load \`agent-builder-mcp\` and follow the MCP credential,
+  - \`kind: "mcp"\`: follow the skill's MCP Servers section — credential,
     verification, and config workflow.
-  - \`kind: "node"\`: load \`agent-builder-node-tools\`, use the returned node
-    results, and continue with \`get_node_types\`.
+  - \`kind: "node"\`: follow the skill's Node Tools section, use the returned
+    node results, and continue with \`get_node_types\`.
 
 Use \`search_nodes\` directly only when the user explicitly asks for an n8n node,
 when refining node results, or when a verified MCP server lacks the requested
@@ -52,15 +52,15 @@ they cannot perform live network, filesystem, process, timer, or host I/O.
 
 #### Node Tools
 
-Load \`agent-builder-node-tools\` after \`resolve_integration\` returns
-\`kind: "node"\`, or when the user explicitly requests an n8n node. Follow it
-before adding, changing, or removing node-backed tools, \`nodeParameters\`,
-\`$fromAI\` usage, or n8n expressions.
+Load \`agent-builder-external-services\` when the user explicitly requests an
+n8n node, and follow its Node Tools section before adding, changing, or
+removing node-backed tools, \`nodeParameters\`, \`$fromAI\` usage, or n8n
+expressions.
 
 #### MCP Servers
 
-Load \`agent-builder-mcp\` after \`resolve_integration\` returns \`kind: "mcp"\`, or
-when the user explicitly requests a custom MCP server.
+Load \`agent-builder-external-services\` when the user explicitly requests a
+custom MCP server, and follow its MCP Servers section.
 
 #### Custom Tools
 

package/dist/modules/agents/builder/resolve-integration.tool.js

@@ -12,7 +12,7 @@ const resolveIntegrationInputSchema = zod_1.z.object({
 });
 function buildResolveIntegrationTool(deps) {
     return new tool_1.Tool(builder_tool_names_1.BUILDER_TOOLS.RESOLVE_INTEGRATION)
-        .description('Resolve external services to MCP servers or n8n node tools. Searches the MCP registry first and returns kind: "mcp" when a match exists; only searches agent-eligible n8n node tools and returns kind: "node" when no MCP server matches. For kind: "mcp", load agent-builder-mcp. For kind: "node", load agent-builder-node-tools and use the returned node results.')
+        .description('Resolve external services to MCP servers or n8n node tools. Searches the MCP registry first and returns kind: "mcp" when a match exists; only searches agent-eligible n8n node tools and returns kind: "node" when no MCP server matches. For either kind, load agent-builder-external-services and follow its matching section, using the returned results.')
         .input(resolveIntegrationInputSchema)
         .handler(async ({ queries }) => {
         const mcpResults = await deps.mcpRegistryService.search(queries);

package/dist/modules/agents/builder/resolve-integration.tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-integration.tool.js","sourceRoot":"","sources":["../../../../src/modules/agents/builder/resolve-integration.tool.ts"],"names":[],"mappings":";;;AACA,2CAAwC;AACxC,6BAAwB;AAKxB,6DAAqD;AAOrD,MAAM,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,OAAC;SACR,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,2DAA2D,CAAC;CACvE,CAAC,CAAC;AAEH,qCAA4C,IAA4B;IACvE,OAAO,IAAI,WAAI,CAAC,kCAAa,CAAC,mBAAmB,CAAC;SAChD,WAAW,CACX,uWAAuW,CACvW;SACA,KAAK,CAAC,6BAA6B,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAyB,EAAE,EAAE;QACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,KAAc,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAChF,OAAO;YACN,IAAI,EAAE,MAAe;YACrB,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;SACtD,CAAC;IACH,CAAC,CAAC;SACD,KAAK,EAAE,CAAC;AACX,CAAC"}
+{"version":3,"file":"resolve-integration.tool.js","sourceRoot":"","sources":["../../../../src/modules/agents/builder/resolve-integration.tool.ts"],"names":[],"mappings":";;;AACA,2CAAwC;AACxC,6BAAwB;AAKxB,6DAAqD;AAOrD,MAAM,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,OAAC;SACR,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,2DAA2D,CAAC;CACvE,CAAC,CAAC;AAEH,qCAA4C,IAA4B;IACvE,OAAO,IAAI,WAAI,CAAC,kCAAa,CAAC,mBAAmB,CAAC;SAChD,WAAW,CACX,8VAA8V,CAC9V;SACA,KAAK,CAAC,6BAA6B,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAyB,EAAE,EAAE;QACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,KAAc,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAChF,OAAO;YACN,IAAI,EAAE,MAAe;YACrB,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;SACtD,CAAC;IACH,CAAC,CAAC;SACD,KAAK,EAAE,CAAC;AACX,CAAC"}

package/dist/modules/agents/builder/skills/external-services.skill.d.ts

@@ -0,0 +1,2 @@
+import type { RuntimeSkill } from '@n8n/agents';
+export declare function externalServicesSkill(): RuntimeSkill;

package/dist/modules/agents/builder/skills/external-services.skill.js

@@ -0,0 +1,361 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.externalServicesSkill = externalServicesSkill;
+const api_types_1 = require("@n8n/api-types");
+const zod_to_json_schema_1 = require("zod-to-json-schema");
+const schema_text_serializer_1 = require("../../json-config/schema-text-serializer");
+const initial_build_prompt_1 = require("../prompts/initial-build.prompt");
+const mcpServerSchemaText = (0, schema_text_serializer_1.jsonSchemaToCompactText)((0, zod_to_json_schema_1.zodToJsonSchema)(api_types_1.McpServerConfigSchema));
+function externalServicesSkill() {
+    return {
+        id: 'agent-builder-external-services',
+        name: 'Agent Builder External Services',
+        description: 'Use when connecting the target agent to any external product: deciding whether Slack, Linear, Telegram, or another platform is a chat integration/trigger versus an MCP, node, or workflow tool; adding, removing, or updating chat integrations or MCP servers; and wiring n8n node-backed tools (search_nodes/get_node_types discovery, nodeParameters, node credential slots, $fromAI usage, n8n expressions).',
+        recommendedTools: [
+            'resolve_integration',
+            'list_integration_types',
+            'configure_channel',
+            'search_nodes',
+            'get_node_types',
+            'ask_credential',
+            'verify_mcp_server',
+            'read_config',
+            'patch_config',
+        ],
+        allowedTools: [
+            'resolve_integration',
+            'list_integration_types',
+            'configure_channel',
+            'search_mcp_servers',
+            'search_nodes',
+            'get_node_types',
+            'ask_credential',
+            'verify_mcp_server',
+            'get_resource_locator_options',
+            'ask_questions',
+            'read_config',
+            'patch_config',
+            'write_config',
+            'load_skill',
+        ],
+        instructions: `\
+## Purpose
+
+Use this to connect the target agent to external products across all three
+surfaces: chat integrations (the \`integrations\` array), MCP servers
+(\`mcpServers\`), and n8n node tools (entries in \`tools[]\` with
+\`nodeParameters\`). Decide the right surface first, then follow that
+section.
+
+## Integration vs Callable Tool Decision
+
+Use an integration when the product is the agent's conversation or trigger
+surface: humans will mention, message, comment to, or resume the agent there,
+or the agent needs to respond in that same platform conversation context.
+
+Use an MCP, node, or workflow tool when the product is only something the agent
+operates on: searching records, creating tickets, updating objects, or sending a
+business-process notification while the conversation happens elsewhere.
+
+Examples:
+
+- Slack integration: the agent should be chatted with in Slack, respond in
+  Slack threads, DM users, message channels, add reactions, or render rich UI
+  to Slack users.
+- Linear integration: the agent should be triggered from Linear issues/comments,
+  understand the current Linear subject, or reply in the same Linear
+  conversation.
+- Linear callable tools: the agent is triggered from Slack, Preview, a task, or a
+  workflow and only needs to search/create/update Linear tickets via MCP or node
+  tools.
+
+For callable (non-chat) services, call \`resolve_integration\` separately per
+service and follow the returned \`kind\`: \`"mcp"\` -> MCP Servers section
+below, \`"node"\` -> Node Tools section below.
+
+## Chat Integrations
+
+The \`integrations\` array controls how the target agent is triggered.
+
+- These are connected external chat platforms, not built-in Preview chat.
+- Call \`list_integration_types\` first.
+- Read the returned \`capabilities\`, \`useIntegrationWhen\`, and
+  \`useNodeToolWhen\` fields before deciding to add an integration.
+- Pick one returned \`type\` and pass it to \`configure_channel\` as
+  \`integrationType\`. ALWAYS use \`configure_channel\` for chat-channel
+  credentials — never \`ask_credential\` or a raw config write. The setup UI it
+  shows creates and persists the credential/connection itself; do not follow up
+  with \`patch_config\`/\`write_config\` to write the credential.
+- ${initial_build_prompt_1.INITIAL_BUILD_NOTE} Instead of \`configure_channel\`: after
+  \`list_integration_types\` returns the matching type, \`read_config()\` then
+  \`patch_config\` adding \`{ "type": "<integrationType>", "credentialId": "" }\`
+  to \`/integrations/-\` (include a minimal valid draft \`settings\` object for
+  telegram) so the channel appears in the agent panel as needing setup. Pass
+  the same \`integrationType\` in the trailing \`finish_setup\` call's
+  \`channels\` array — its card connects or skips the channel itself; if
+  skipped, list it in the closing setup checklist pointing at the channel
+  chip in the agent panel. If \`finish_setup\` instead reports the channel as
+  \`'blocked'\` (the agent could not be published yet), patch in the
+  credentials/model it collected first; if that resolves every reported
+  issue, call \`configure_channel\` directly for that channel as a follow-up.
+  Otherwise leave it for the closing checklist.
+- Preserve existing chat integrations unless the user asked to remove them.
+- To remove an existing chat integration, call \`read_config\` and inspect
+  \`config.integrations\`.
+- If exactly one existing integration matches the requested platform, remove
+  that entry with \`patch_config\` by index (or replace \`/integrations\` with a
+  filtered array when clearer).
+- If multiple existing integrations match the requested platform, ask which one
+  to remove before editing \`integrations\`.
+- Removing a chat integration means deleting its entry from
+  \`integrations[]\`. Do not call \`configure_channel\` to remove a channel.
+
+### Gotchas
+
+- Chat integration types must come from \`list_integration_types\`.
+- Do not add a chat integration just because the agent needs CRUD or notifications
+  for that product. Resolve the callable capability through \`resolve_integration\`
+  unless the product itself is the chat/trigger context.
+- For recurring or scheduled runs, create a task (\`create_tasks\`), not an
+  integration.
+- Omitting \`integrations\` from a config write preserves the current channels.
+  To remove one, write an explicit filtered array or remove the exact array
+  entry.
+
+## MCP Servers
+
+MCP servers expose external tool catalogs to the target agent over HTTP. They
+live on the top-level \`mcpServers\` array, and each entry maps 1:1 to a
+connected MCP server. Use this section when \`resolve_integration\` returned
+\`kind: "mcp"\`, the user explicitly asks to add or edit an MCP server, or the
+user provides or asks to configure a custom MCP server.
+
+### Discovery and setup
+
+For a generic external-service request, \`resolve_integration\` must select the
+integration type before MCP setup. If no resolver result is available yet,
+call \`resolve_integration\` with queries matching the requested service.
+Resolve one requested service per call; use \`queries\` only for alternative
+search terms for that service.
+
+- If it returns \`kind: "node"\` for a generic service request, follow the Node
+  Tools section with the returned node results. Stop this MCP workflow.
+- If it returns \`kind: "node"\` but the user explicitly requested an MCP server,
+  do not silently substitute a node tool. Continue with manual MCP setup by
+  asking for the URL and transport/authentication decision through
+  \`${api_types_1.ASK_QUESTIONS_TOOL_NAME}\`.
+- \`resolve_integration\` returns \`{ kind: "mcp", results: [...] }\` for MCP
+  matches. Never read server fields from the wrapper; select a result first:
+  - If \`results[]\` contains one entry, use it as \`selectedResult\`.
+  - If the request uniquely identifies one entry by \`name\` or \`title\`, use
+    that entry as \`selectedResult\`.
+  - If multiple candidates remain, call \`ask_questions\` with the candidate
+    titles and descriptions; never choose by array order. During an initial
+    build, do not call \`ask_questions\` for this: pick the best candidate by
+    title/description relevance yourself, and list the pick as an assumption
+    in your summary. Use the chosen entry as \`selectedResult\`. If
+    \`ask_questions\` returns \`{ answered: false }\`, stop MCP setup without
+    selecting a server, asking for credentials, verifying a connection, or
+    mutating config. Do not re-present the question.
+- Use \`name\`, \`url\`, \`transport\`, \`authentication\`, \`credentialType\`,
+  \`tools\`, and optional \`metadata\` only from \`selectedResult\`.
+
+Follow these steps for the selected MCP result:
+
+1. Credential: call \`ask_credential\` with a short \`purpose\`, using
+   \`selectedResult.credentialType\` as \`credentialType\`. Never invent
+   credential IDs.
+2. Verify: call \`verify_mcp_server\` with the selected result's \`name\`, \`url\`,
+   \`transport\`, and \`authentication\`, plus the returned \`credentialId\` as
+   \`credential\` when authentication is required.
+3. Capability check: confirm the verified tool names and descriptions cover the
+   capability the user requested.
+4. Write config: call \`read_config\`, then \`patch_config\` to add the entry to
+   \`mcpServers[]\` using the patch pattern below. When the entry already
+   exists and verify returned \`credentialApplied: true\`, skip this step — the
+   credential is already persisted.
+
+${initial_build_prompt_1.INITIAL_BUILD_NOTE} For MCP that means: pick the best candidate as an
+assumption (above), then \`read_config()\` and \`patch_config\` a draft
+\`/mcpServers/-\` entry using \`name\`, \`url\`, \`transport\`,
+\`authentication\`, and \`metadata.nodeTypeName\` from \`selectedResult\` with
+\`credential\` omitted, and skip \`verify_mcp_server\` — there is nothing to
+authenticate yet. Include the credential in the trailing \`finish_setup\` call;
+verify with the returned credential id — on success the tool writes the
+credential into the matching entry itself (\`credentialApplied: true\`); no
+\`read_config\`/\`patch_config\` follow-up for the credential. Existing-agent
+additions keep the immediate ask + verify flow above unchanged.
+
+If verification succeeds but the tools do not cover the requested capability
+for a generic service request, switch to the Node Tools section, call
+\`search_nodes\` with the same service queries, and continue with node setup. Do
+not add the MCP server merely because its registry entry matched.
+
+Full schema reference:
+
+${mcpServerSchemaText}
+
+### Tool exposure and approval
+
+- Expose every available MCP tool by default: omit \`toolFilter\` unless the user
+  explicitly asks to restrict which tools are exposed. Do not infer an allowlist
+  from the requested capability.
+- For an explicit filter or selected approval list, use only exact, unprefixed
+  \`name\` values from \`selectedResult.tools\` or a successful
+  \`verify_mcp_server\` result.
+- Never prepend the server name. Never invent MCP tool names. \`toolFilter.tools\`
+  and \`approval.tools\` match original MCP names; the SDK adds the server prefix
+  only when exposing tools to the model.
+
+### Credential flow
+
+- For \`bearerAuth\`, call \`ask_credential\` with
+  \`credentialType: "httpBearerAuth"\`.
+- For \`headerAuth\`, call \`ask_credential\` with
+  \`credentialType: "httpHeaderAuth"\`.
+- For \`multipleHeadersAuth\`, call \`ask_credential\` with
+  \`credentialType: "httpMultipleHeadersAuth"\`.
+- For \`mcpOAuth2Api\`, call \`ask_credential\` with
+  \`credentialType: "mcpOAuth2Api"\`.
+
+### Testing the connection
+
+Before writing to config, call \`verify_mcp_server\` with server \`name\`,
+\`url\`, \`transport\`, and (if applicable) the credential id from
+\`ask_credential\`.
+
+- Success returns \`{ ok: true, tools: [{ name, description }] }\`, and when a
+  matching \`mcpServers\` entry exists, also \`credentialApplied: true,
+  configMutated: true, agentId\` — the credential is written automatically; do
+  not follow with \`read_config\`/\`patch_config\` for the credential.
+- When verify succeeds but \`credentialApplied: false\` and the entry already
+  exists, fall back to \`read_config\` then \`patch_config\` for the credential.
+- For an explicitly requested filter or selected approval list, copy exact names
+  from the returned tool list following Tool exposure and approval above.
+- Failure returns \`{ ok: false, error: "..." }\`.
+- If verification fails, explain the error and ask the user to check the URL
+  or credentials before proceeding.
+
+### Incomplete setup
+
+The user can skip the credential prompt, the URL question, or both. Never
+invent a credential ID or a placeholder URL to fill the gap, and never abort
+the server addition — always persist what is known and let the user finish
+setup later:
+
+- Credential skipped (\`ask_credential\` returned \`{ skipped: true }\`): omit
+  only the \`credential\` field.
+- URL skipped: persist \`url: ""\`.
+- Either case: skip \`verify_mcp_server\` (there is nothing to authenticate or
+  connect to), then \`read_config\` and \`patch_config\` the entry, preserving
+  every other known field — \`name\`, \`transport\`, \`authentication\`, an
+  already-selected credential, and registry \`metadata\`.
+
+### Selecting credentials
+
+When using a registry-backed server, always use the \`credentialType\` returned
+by \`selectedResult\`.
+
+For custom MCP servers, if credential type is unknown, ask the user which
+credential type to use (OAuth2, Bearer Token, Header Auth, Multiple Headers
+Auth, or None) via \`${api_types_1.ASK_QUESTIONS_TOOL_NAME}\`. Then map to:
+
+- \`bearerAuth\` -> \`ask_credential\` with \`credentialType: "httpBearerAuth"\`
+- \`headerAuth\` -> \`ask_credential\` with \`credentialType: "httpHeaderAuth"\`
+- \`multipleHeadersAuth\` -> \`ask_credential\` with
+  \`credentialType: "httpMultipleHeadersAuth"\`
+- \`mcpOAuth2Api\` -> \`ask_credential\` with \`credentialType: "mcpOAuth2Api"\`
+
+### Patch pattern
+
+1. Initialize the array if missing:
+   \`{ "op": "add", "path": "/mcpServers", "value": [] }\`
+2. Append each server:
+   \`{ "op": "add", "path": "/mcpServers/-", "value": { ... } }\`
+
+### Gotchas
+
+- Server \`name\` must be unique across \`mcpServers\` within an agent.
+- Never fabricate \`metadata.nodeTypeName\`.
+- When \`selectedResult\` includes \`metadata.nodeTypeName\`, include
+  \`metadata: { nodeTypeName: <selectedResult.metadata.nodeTypeName> }\` in the
+  entry so the UI can render the correct server form.
+- A registry match proves server availability, not support for the requested
+  capability; use the verified live tool list for that decision.
+
+## Node Tools
+
+Use this section to discover, configure, and wire node tools into the target
+agent's \`tools[]\`, including \`nodeParameters\` and n8n expressions.
+
+### Workflow
+
+- For a generic external-service request, call \`resolve_integration\` before
+  node discovery unless a resolver result is already available.
+- If it returns \`kind: "mcp"\`, follow the MCP Servers section instead and stop
+  this node-tool workflow.
+- If it returns \`kind: "node"\`, use its returned node results and call
+  \`get_node_types\`; do not repeat the same search with \`search_nodes\`.
+- Call \`search_nodes\` directly only when the user explicitly requests an n8n
+  node, when refining node results, or when a verified MCP server lacks the
+  requested capability.
+- Never guess node type names.
+- Use the tool node id from discovery, usually ending in \`Tool\`.
+- Put fixed values in \`nodeParameters\`; use complete n8n expressions for values the agent should decide at runtime:
+  \`={{ $fromAI('url', 'The URL to inspect', 'string') }}\`.
+- For stable dynamic selectors, load \`agent-builder-resource-locators\` and
+  follow it.
+- Never write literal \`"$fromAI"\` or bare \`$fromAI\`; the node will treat it as the actual value.
+- Do not pipe AI-chosen fields through \`$json\`.
+- Do not include \`inputSchema\` or \`toolDescription\` for node tools.
+- For each required credential slot, call \`ask_credential\` once before the config mutation for an addition to an existing agent. ${initial_build_prompt_1.INITIAL_BUILD_NOTE} Add the tool with that credential slot omitted; after the trailing \`finish_setup\` resolves the credential, copy the returned credentials into \`node.credentials\` via \`patch_config\`; for resource-locator resolution follow \`agent-builder-resource-locators\` then. Pass the node's credential key as \`credentialSlot\`. On success, copy the returned \`credentials\` object directly to \`node.credentials\`. If skipped, still add the tool and omit only that credential slot.
+- When the agent already has a chat channel configured and the tool needs the same
+  credential type, \`ask_credential\` reuses the channel's credential automatically —
+  do not ask the user to pick a different one.
+
+### n8n Expressions
+
+Node tool parameters inside \`nodeParameters\` can use n8n expressions.
+Prefer \`$fromAI\` whenever the target agent should decide a value at runtime.
+Do not use \`$fromAI\` for stable resource IDs that the target agent cannot know
+at runtime, such as Linear \`teamId\`, project IDs, channel IDs, calendar IDs,
+database IDs, table IDs, or other dynamic "Name or ID" selectors. Resolve those
+with the \`agent-builder-resource-locators\` skill, \`ask_credential\`, and
+\`get_resource_locator_options\`; write the returned \`parameterValue\` into
+\`nodeParameters\`.
+
+- \`={{ /*n8n-auto-generated-fromAI-override*/ $fromAI('fieldName', 'What value to provide', 'string') }}\`
+- \`={{ /*n8n-auto-generated-fromAI-override*/ $fromAI('count', 'How many items', 'number') }}\`
+- \`={{ /*n8n-auto-generated-fromAI-override*/ $fromAI('enabled', 'Whether to enable this option', 'boolean') }}\`
+- \`={{ $now.toISO() }}\` for current date/time.
+- \`={{ $today }}\` for the start of today.
+
+Always wrap expressions in \`={{ }}\`. Never pipe AI-chosen node-tool fields
+through \`$json\`; use \`$fromAI\` for those fields instead.
+
+### Gotchas
+
+- Do not include \`inputSchema\` or \`toolDescription\` for node tools.
+- \`$fromAI(...)\` placeholders define the node tool input schema; do not add it manually.
+- Follow \`agent-builder-resource-locators\` for dynamic selector lookup,
+  credentials, and \`parameterValue\` handling.
+- If a required node-tool credential is skipped, add the tool and omit only that credential slot.
+- Node tools execute inline, so never use waiting operations such as \`sendAndWait\`
+  or \`dispatchAndWait\`. When the user requests human approval, configure the
+  intended non-waiting operation and set \`requireApproval: true\` on the tool.
+
+## Verify
+
+- Connected chat integrations were set up through \`configure_channel\`, not
+  \`ask_credential\` or a manual config write.
+- The chosen integration matches \`useIntegrationWhen\`; otherwise resolve the
+  callable capability through \`resolve_integration\` and use MCP, node, or
+  workflow tools.
+- Generic non-chat external services were routed through \`resolve_integration\`
+  before MCP or node setup.
+- The final \`integrations\` array keeps unrelated integrations intact and
+  removes only the requested channel entries.
+- Node tools use discovered tool node ids and valid node parameters.`,
+    };
+}
+//# sourceMappingURL=external-services.skill.js.map

package/dist/modules/agents/builder/skills/external-services.skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-services.skill.js","sourceRoot":"","sources":["../../../../../src/modules/agents/builder/skills/external-services.skill.ts"],"names":[],"mappings":";;;AACA,8CAAgF;AAEhF,2DAAqD;AAErD,qFAAmF;AACnF,0EAAqE;AAErE,MAAM,mBAAmB,GAAG,IAAA,gDAAuB,EAClD,IAAA,oCAAe,EAAC,iCAAqB,CAAgB,CACrD,CAAC;AAEF;IACC,OAAO;QACN,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACV,mZAAmZ;QACpZ,gBAAgB,EAAE;YACjB,qBAAqB;YACrB,wBAAwB;YACxB,mBAAmB;YACnB,cAAc;YACd,gBAAgB;YAChB,gBAAgB;YAChB,mBAAmB;YACnB,aAAa;YACb,cAAc;SACd;QACD,YAAY,EAAE;YACb,qBAAqB;YACrB,wBAAwB;YACxB,mBAAmB;YACnB,oBAAoB;YACpB,cAAc;YACd,gBAAgB;YAChB,gBAAgB;YAChB,mBAAmB;YACnB,8BAA8B;YAC9B,eAAe;YACf,aAAa;YACb,cAAc;YACd,cAAc;YACd,YAAY;SACZ;QACD,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgDZ,yCAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAyDhB,mCAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgC3B,yCAAkB;;;;;;;;;;;;;;;;;;EAkBlB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAiEE,mCAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qIAkDuF,yCAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qEA+ClF;KACnE,CAAC;AACH,CAAC"}