opencode-skills-collection 4.1.3 → 4.1.4

package/bundled-skills/cline-pilot/references/decision-log.example.md

@@ -0,0 +1,9 @@
+# Decision Log — habits & preferences learned per TAG CLASS 决策流水（按标签类记）
+
+> Log each user correction/decision with its TAG CLASS.
+> ≥2 consistent samples in one tag class → distill into the 标签偏好区 section of SKILL.md.
+> 同标签类 ≥2 个一致样本 → 蒸馏进 SKILL.md 的标签偏好区。
+
+| Date 日期 | Tag class 标签类 | Scenario 场景 | My choice 我的选择 | User correction 用户纠正 | Reason 理由 |
+|------|--------|------|---------------|------------|---------|
+| — | — | — | — | — | — |

package/bundled-skills/cline-pilot/references/local-config.example.md

@@ -0,0 +1,26 @@
+# Local Config — YOUR MACHINE (private, not tracked)
+
+Copy this file to `local-config.md` and fill in YOUR values before first use.
+本文件为模板；复制为 `local-config.md` 后填入你自己的值。
+
+## Dev Environment 开发环境
+| Item 项目 | Value 值 |
+|----|-----|
+| conda env | e.g. `dev-env` |
+| Pre-launch | `source <your rc/env file> && conda activate <env>` |
+| Dirty-stack fix | `unset CONDA_PREFIX CONDA_PREFIX_1 CONDA_PROMPT_MODIFIER CONDA_SHLVL CONDA_DEFAULT_ENV` (if your agent session inherits broken CONDA state) |
+| Toolchain | e.g. `java` 21 / `mvn` 3.9+ / `node` |
+| Branch rules | e.g. main is push-protected; feature branches only |
+
+## Launch Template 启动模板
+```bash
+zsh -c '<unset CONDA_* if dirty>; source <env> && conda activate <env> && cd <project> && cline ...'
+```
+Self-check before launch: python points to target env / toolchain versions / `git branch --show-current` = task branch.
+
+## LLM Endpoint
+- base: `http://<your openai-compatible endpoint>/v1`, model: `<model-id>`
+- Probe before launch: `curl -s -H 'Authorization: Bearer <key>' <base>/models | head -c 200`
+
+## Scratch Workspace 临时工作区
+`<path>/worktree/` — worktrees / subagent dirs / temp builds MUST stay here; never scatter into `~`.

package/bundled-skills/cline-pilot/references/project-profiles.example.md

@@ -0,0 +1,10 @@
+# Project Profiles — intro + tags only, NO architecture 项目画像（仅简介+标签，不记架构）
+
+> Register a one-line intro + tags per project so learned preferences can be
+> applied by TAG CLASS. Architecture details live in the project's own memory
+> bank + clinerules, never here.
+> 按工程登记简介+标签，以便按“标签类”套用已学偏好。架构细节归工程自己的 memory bank，不放这里。
+
+| Project 工程 | Path 路径 | One-line intro 简介 | Side 端 | Lifecycle 生命周期 | Risk 风险面 |
+|------|------|----------|----|---------|--------|
+| — | — | — | backend/frontend 前后端 | long-term/short 长护/短期 | prod-data?/public API? 是否生产数据/对外接口 |

package/bundled-skills/cline-pilot/scripts/session_report.py

@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""session_report.py — Cline 会话活动摘要 + 工程进度硬证据。
+
+用法:
+  python3 session_report.py                # 最新会话 10 条 + 当前目录证据
+  python3 session_report.py 15             # 最近 15 条
+  python3 session_report.py /path/to/repo  # 指定工程目录（自动识别 sid 或路径）
+
+输出:
+  - 会话最近 N 条消息（role / text / tool / 结果摘要）
+  - 工程硬证据：分支、git status、最近 commit、最新测试报告首行（多栈：Maven surefire / JUnit-xml / pytest 等）
+    输出 / output: branch, git status, last commit, newest test-report lines (stack-agnostic)
+只读操作，不改任何文件。stdlib only。
+"""
+import glob
+import json
+import os
+import subprocess
+import sys
+
+
+SESSIONS_ROOT = os.path.join(os.path.expanduser("~"), ".cline", "data", "sessions")
+
+
+def latest_session_id():
+    if not os.path.isdir(SESSIONS_ROOT):
+        return None
+    entries = []
+    for e in os.listdir(SESSIONS_ROOT):
+        p = os.path.join(SESSIONS_ROOT, e)
+        if os.path.isdir(p):
+            entries.append((os.path.getmtime(p), e))
+    return max(entries)[1] if entries else None
+
+
+def load_session(sid):
+    p = os.path.join(SESSIONS_ROOT, sid, sid + ".messages.json")
+    if not os.path.exists(p):
+        return None, None
+    with open(p, encoding="utf-8") as f:
+        d = json.load(f)
+    return d.get("messages", []), d.get("updated_at")
+
+
+def summarize(msgs, n):
+    lines = []
+    for m in (msgs or [])[-n:]:
+        role = m.get("role", "?")
+        content = m.get("content")
+        if isinstance(content, str):
+            lines.append("[%s] %s" % (role, content[:160].strip()))
+            continue
+        for c in content or []:
+            t = c.get("type")
+            if t == "text":
+                lines.append("[%s|text] %s" % (role, (c.get("text") or "")[:160].strip()))
+            elif t in ("tool_use", "toolCall", "tool"):
+                name = c.get("name") or c.get("toolName") or ""
+                inp = c.get("input") or c.get("arguments") or {}
+                lines.append("[%s|tool:%s] %s" % (role, name, json.dumps(inp, ensure_ascii=False)[:150]))
+            elif t == "tool_result":
+                r = c.get("content") or c.get("output") or ""
+                r = r if isinstance(r, str) else json.dumps(r, ensure_ascii=False)
+                lines.append("[%s|result] %s" % (role, str(r)[:150]))
+            else:
+                lines.append("[%s|%s] %s" % (role, t, json.dumps(c, ensure_ascii=False)[:120]))
+    return lines
+
+
+def sh(cmd, cwd):
+    try:
+        r = subprocess.run(cmd, shell=True, cwd=cwd, capture_output=True, text=True, timeout=60)
+        out = r.stdout.strip()
+        return out if out else "(exit %d %s)" % (r.returncode, r.stderr.strip()[:60])
+    except Exception as e:
+        return "(error %s)" % e
+
+
+# 多栈测试报告候选（按优先级）/ multi-stack test-report candidate patterns
+REPORT_GLOBS = [
+    "**/target/surefire-reports/*.txt",   # Maven/JUnit
+    "**/junit-xml/TEST-*.xml",             # Node (vitest/jest jasmine2)
+    "**/build/test-results/test/*.xml",   # Kotlin/Gradle
+    "**/.pytest_cache/v/cache/lastfailed", # pytest
+    "**/coverage/*.html",                  # 覆盖率产物兜底
+]
+
+
+def repo_evidence(root):
+    if not os.path.exists(os.path.join(root, ".git")) and not os.path.isdir(os.path.join(root, ".git")):
+        try:
+            r = subprocess.run(["git", "rev-parse", "--show-toplevel"], cwd=root, capture_output=True, text=True, timeout=20)
+            if r.returncode != 0:
+                return ["(not a git repo: %s)" % root]
+            root = r.stdout.strip()
+        except Exception:
+            return ["(not a git repo: %s)" % root]
+    lines = [
+        "branch   : %s" % sh("git branch --show-current", root),
+        "status   : %s" % (sh("git status --short | head -15", root) or "(clean)"),
+        "commit   : %s" % sh("git log -1 --pretty='%h %s'", root),
+    ]
+    recent = []
+    for pat in REPORT_GLOBS:
+        hits = glob.glob(os.path.join(root, pat), recursive=True)
+        if hits:
+            recent.extend(hits)
+            break
+    recent = sorted(recent, key=lambda p: os.path.getmtime(p), reverse=True)[:6]
+    for f in recent:
+        try:
+            with open(f, encoding="utf-8", errors="replace") as fh:
+                first = fh.readline().strip()
+            lines.append("tests    : %s | %s" % (os.path.relpath(f, root), first[:140]))
+        except OSError:
+            pass
+    if not recent:
+        lines.append("tests    : (no test reports found / 未找到测试报告)")
+    return lines
+
+
+def main(argv):
+    n, repo, sid = 10, os.getcwd(), None
+    for a in argv:
+        if a.isdigit() and int(a) < 500:
+            n = max(1, int(a))
+        elif os.path.isdir(os.path.expanduser(a)):
+            repo = os.path.expanduser(a)
+        else:
+            sid = a
+    sid = sid or latest_session_id()
+    if not sid:
+        print("no cline sessions found under", SESSIONS_ROOT)
+        return 1
+    print("== session: %s ==" % sid)
+    msgs, updated = load_session(sid)
+    if msgs is None:
+        print("(messages.json not found)")
+        return 1
+    print("updated_at: %s | total messages: %d" % (updated, len(msgs)))
+    print("-- recent activity --")
+    for line in summarize(msgs, n):
+        print(line)
+    print("-- repo evidence: %s --" % repo)
+    for line in repo_evidence(repo):
+        print(line)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/bundled-skills/cross-chain-relayer-audit/SKILL.md

@@ -0,0 +1,136 @@
+---
+name: cross-chain-relayer-audit
+description: 'Cross-chain relayer bridge audit register: message hash verifications, replay protection nonces, validator quorum, and withdrawal proofs.'
+category: engineering
+risk: safe
+source: self
+source_type: self
+date_added: "2026-10-01"
+author: Ranjeet2063
+tags: [cross-chain, bridge, relayer, security, cryptography, web3, stellar]
+tools: []
+source_repo: Ranjeet2063/agentic-awesome-skills
+---
+
+# Cross-Chain Relayer Security Audit
+
+**What it is:** Audits cross-chain message passing protocols, cryptographic commitment trees, and validator quorum consensus for cross-chain relayers.
+
+## Overview
+
+Provides a standardized, auditable framework and data model for **Cross-Chain Relayer Security Audit** operations across distributed engineering and decentralized application systems.
+
+## When to Use This Skill
+
+- When formalizing architectural contracts, security invariants, or operational limits for Cross-Chain Relayer Security Audit.
+- When cross-functional review is required between protocol developers, smart contract auditors, and AI engineering agents.
+- When generating reproducible CSV, SQL DDL, JSON Schema, and Notion property registers for tracking compliance.
+
+## How It Works
+
+1. Define the parameters, thresholds, and identity bindings required for the target operational register.
+2. Select appropriate boundary enforcement values from validated enum select sets.
+3. Export standardized artifacts (CSV table, SQL DDL, JSON Schema) to integrate into validation CI pipelines.
+
+## Field Reference
+
+| # | Field Name | Type | SQL Type | JSON Schema Type | Notion Property Type | Example Value |
+|---|------------|------|----------|------------------|----------------------|---------------|
+| 1 | Relayer Audit ID | `id` | `SERIAL PRIMARY KEY` | `integer` | Text | `REL-001` |
+| 2 | Source Chain Domain | `text` | `VARCHAR(32)` | `string` | Text | `Ethereum Sepolia` |
+| 3 | Destination Chain Domain | `text` | `VARCHAR(32)` | `string` | Text | `Stellar Testnet` |
+| 4 | Message Hash Verification | `select` | `VARCHAR(32)` | `string` | Select | `Keccak256 Verified` |
+| 5 | Replay Protection Nonce Check | `select` | `VARCHAR(32)` | `string` | Select | `Enforced Strict Sequence` |
+| 6 | Validator Quorum Threshold | `text` | `VARCHAR(16)` | `string` | Text | `5-of-7 Quorum` |
+| 7 | Slashing Condition Active | `select` | `VARCHAR(16)` | `string` | Select | `Yes` |
+| 8 | Withdrawal Proof Standard | `select` | `VARCHAR(64)` | `string` | Select | `Merkle Patricia Trie Proof` |
+| 9 | Finality Confirmation Blocks | `number` | `INTEGER` | `number` | Number | `32` |
+| 10 | Bridge Security Posture | `select` | `VARCHAR(32)` | `string` | Select | `Verified Secure` |
+| 11 | Audit Stamp Date | `date` | `DATE` | `string, format: date` | Date | `2026-10-01` |
+
+## Select Options
+
+**Message Hash Verification**
+
+```
+Keccak256 Verified | SHA256 Verified | Invalid Hash
+```
+
+**Replay Protection Nonce Check**
+
+```
+Enforced Strict Sequence | Bitmask Window | Unchecked
+```
+
+**Slashing Condition Active**
+
+```
+Yes | No
+```
+
+**Withdrawal Proof Standard**
+
+```
+Merkle Patricia Trie Proof | ZK-SNARK Validity Proof | Light Client Header
+```
+
+**Bridge Security Posture**
+
+```
+Verified Secure | Under Audit | Vulnerable Finding
+```
+
+## Relations
+
+- `Audit Reference` -> links to the formal review documentation or test repository.
+- `Target Architecture` -> links to the deployed contract or autonomous agent runtime component.
+
+## Examples
+
+**Prompt**
+
+```
+How do I configure and track Cross-Chain Relayer Security Audit for our production environment?
+```
+
+**Recommended Next Step**
+
+> Generate the unified field schema, SQL DDL migration, and JSON validation schema to register into your system catalog.
+>
+> Workflow: Define criteria -> Run automated verification -> Record baseline -> Monitor invariants.
+
+## Best Practices
+
+- Enforce strict typing on numerical bounds and currency amounts; avoid unstructured free-text fields for critical states.
+- Re-run validation test suites on every state-altering commit or parameter change.
+- Keep example data synthetic and isolated from production cryptographic keys or private endpoints.
+
+## Limitations
+
+- Provides architectural specifications, data models, and verification schemas; does not execute direct transaction signing without authorized external tooling.
+- Requires network connectivity and valid RPC credentials when querying on-chain states.
+
+## Security & Safety Notes
+
+- All parameters declare `risk: safe`. No unauthorized state modification or privileged credential access is performed.
+- Use synthetic dummy keys and mock addresses in test suites and local verification scripts.
+
+## Common Pitfalls
+
+- **Problem:** Mismatched decimal precision between contract runtime and database register.
+  **Solution:** Always verify decimals using the explicit field mapping in this reference.
+- **Problem:** Missing authorization checks prior to state update.
+  **Solution:** Cross-validate against the Security Audit register before deployment.
+
+## Related Skills
+
+- @smart-contract-formal-verification - verifies state invariants mathematically.
+- @web3-rate-limiting-circuit-breaker - provides operational guardrails and threshold breakers.
+- @stellar-anchor-integration - covers SEP-10 and SEP-24 anchor compliance flows.
+
+## Reusable Prompt
+
+```
+I want to establish a verified Cross-Chain Relayer Security Audit register for our production protocol.
+Guide me through the required field parameters and output the corresponding SQL DDL and JSON Schema.
+```

package/bundled-skills/defi-yield-strategy-allocator/SKILL.md

@@ -0,0 +1,124 @@
+---
+name: defi-yield-strategy-allocator
+description: 'Multi-vault automated yield strategy allocation register: APY benchmarks, impermanent loss risk tiers, and rebalancing triggers.'
+category: engineering
+risk: safe
+source: self
+source_type: self
+date_added: "2026-10-01"
+author: Ranjeet2063
+tags: [defi, yield, soroban, vault, liquidity, finance, stellar]
+tools: []
+source_repo: Ranjeet2063/agentic-awesome-skills
+---
+
+# DeFi Yield Strategy Allocation Register
+
+**What it is:** Monitors capital efficiency, yield compounding schedules, and downside protection bounds across decentralized finance yield protocols.
+
+## Overview
+
+Provides a standardized, auditable framework and data model for **DeFi Yield Strategy Allocation Register** operations across distributed engineering and decentralized application systems.
+
+## When to Use This Skill
+
+- When formalizing architectural contracts, security invariants, or operational limits for DeFi Yield Strategy Allocation Register.
+- When cross-functional review is required between protocol developers, smart contract auditors, and AI engineering agents.
+- When generating reproducible CSV, SQL DDL, JSON Schema, and Notion property registers for tracking compliance.
+
+## How It Works
+
+1. Define the parameters, thresholds, and identity bindings required for the target operational register.
+2. Select appropriate boundary enforcement values from validated enum select sets.
+3. Export standardized artifacts (CSV table, SQL DDL, JSON Schema) to integrate into validation CI pipelines.
+
+## Field Reference
+
+| # | Field Name | Type | SQL Type | JSON Schema Type | Notion Property Type | Example Value |
+|---|------------|------|----------|------------------|----------------------|---------------|
+| 1 | Strategy Allocation ID | `id` | `SERIAL PRIMARY KEY` | `integer` | Text | `YLD-001` |
+| 2 | Target Protocol Strategy | `text` | `VARCHAR(64)` | `string` | Text | `Soroban AMM Liquidity Staking` |
+| 3 | Allocated Capital Principal | `currency` | `NUMERIC(24,7)` | `number` | Number | `100000.0000000` |
+| 4 | Base APY Yield % | `number` | `NUMERIC(6,2)` | `number` | Number | `14.25` |
+| 5 | Impermanent Loss Risk Score | `select` | `VARCHAR(32)` | `string` | Select | `Low (Stablecoin Pair)` |
+| 6 | Max Protocol Drawdown Cap % | `number` | `NUMERIC(5,2)` | `number` | Number | `5.00` |
+| 7 | Automated Harvest Frequency Hours | `number` | `INTEGER` | `number` | Number | `12` |
+| 8 | Emergency Unwind Trigger | `select` | `VARCHAR(64)` | `string` | Select | `Price Divergence > 3%` |
+| 9 | Capital Allocation Health | `select` | `VARCHAR(32)` | `string` | Select | `Optimum Yield` |
+| 10 | Portfolio Manager | `text` | `VARCHAR(64)` | `string` | Text | `Ranjeet2063` |
+| 11 | Last Rebalance Date | `date` | `DATE` | `string, format: date` | Date | `2026-10-01` |
+
+## Select Options
+
+**Impermanent Loss Risk Score**
+
+```
+Low (Stablecoin Pair) | Moderate (Correlated) | High (Volatile)
+```
+
+**Emergency Unwind Trigger**
+
+```
+Price Divergence > 3% | TVL Drain > 20% | Oracle Failure
+```
+
+**Capital Allocation Health**
+
+```
+Optimum Yield | Underperforming | Unwinding | Liquidated
+```
+
+## Relations
+
+- `Audit Reference` -> links to the formal review documentation or test repository.
+- `Target Architecture` -> links to the deployed contract or autonomous agent runtime component.
+
+## Examples
+
+**Prompt**
+
+```
+How do I configure and track DeFi Yield Strategy Allocation Register for our production environment?
+```
+
+**Recommended Next Step**
+
+> Generate the unified field schema, SQL DDL migration, and JSON validation schema to register into your system catalog.
+>
+> Workflow: Define criteria -> Run automated verification -> Record baseline -> Monitor invariants.
+
+## Best Practices
+
+- Enforce strict typing on numerical bounds and currency amounts; avoid unstructured free-text fields for critical states.
+- Re-run validation test suites on every state-altering commit or parameter change.
+- Keep example data synthetic and isolated from production cryptographic keys or private endpoints.
+
+## Limitations
+
+- Provides architectural specifications, data models, and verification schemas; does not execute direct transaction signing without authorized external tooling.
+- Requires network connectivity and valid RPC credentials when querying on-chain states.
+
+## Security & Safety Notes
+
+- All parameters declare `risk: safe`. No unauthorized state modification or privileged credential access is performed.
+- Use synthetic dummy keys and mock addresses in test suites and local verification scripts.
+
+## Common Pitfalls
+
+- **Problem:** Mismatched decimal precision between contract runtime and database register.
+  **Solution:** Always verify decimals using the explicit field mapping in this reference.
+- **Problem:** Missing authorization checks prior to state update.
+  **Solution:** Cross-validate against the Security Audit register before deployment.
+
+## Related Skills
+
+- @soroban-liquidity-pool - covers AMM invariant and LP-share modelling.
+- @web3-rate-limiting-circuit-breaker - provides operational guardrails and threshold breakers.
+- @soroban-oracle-data-feed-audit - covers oracle heartbeat and stale-price handling.
+
+## Reusable Prompt
+
+```
+I want to establish a verified DeFi Yield Strategy Allocation Register register for our production protocol.
+Guide me through the required field parameters and output the corresponding SQL DDL and JSON Schema.
+```

package/bundled-skills/dropthehassle-publish/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: dropthehassle-publish
+description: "Publish a finished static site to a free HTTPS link with DropTheHassle: build it if needed, deploy, hand over the claim link, verify it is live, never spend money."
+category: devops
+risk: critical
+source: "https://github.com/bosmdavid-gif/dropthehassle-skill"
+source_repo: "bosmdavid-gif/dropthehassle-skill"
+source_type: official
+date_added: "2026-10-01"
+license: "MIT"
+license_source: "https://github.com/bosmdavid-gif/dropthehassle-skill/blob/main/LICENSE"
+author: bosmdavid-gif
+tags: [deploy, static-site, hosting, domain, mcp]
+tools: [claude, cursor, codex, windsurf]
+---
+
+# DropTheHassle publish
+
+## Overview
+
+DropTheHassle (https://dropthehassle.com) hosts finished static files (HTML, CSS, JS, images) on a
+free `name.dropthehassle.app` link with HTTPS, and can later put the same site on a real domain
+with no DNS editing. A first deploy needs no account: it returns a live URL and a claim link. This
+skill makes the agent check that the folder is a finished build, deploy it with the CLI or MCP
+server, give the human the claim link, and verify the site is live. No DropTheHassle tool can pay,
+and the agent must never try to. Adapted from the official skill, which also ships a local
+preflight script and longer references: https://github.com/bosmdavid-gif/dropthehassle-skill
+
+## When to Use This Skill
+
+- Use when the user asks to publish, deploy, host or share a site they built with an AI tool and
+  wants DropTheHassle, or wants it on a free link or their own domain without DNS work and has not
+  picked another host.
+- Use when the folder is static output: a hand-written `index.html`, or a Vite, Astro, Create React
+  App, Nuxt generate, Next.js `output: 'export'` or TanStack Start SPA build.
+- Do not use for apps that need a server at runtime (SSR, API routes, server functions, PHP). Say
+  that DropTheHassle only hosts static files.
+
+## How It Works
+
+### Step 1: Find the finished folder
+
+- Plain folder with `index.html` at the top: that is the site.
+- Project with a `build` script or a `vite.config.*`, `next.config.*`, `astro.config.*` or
+  `nuxt.config.*`: look for `index.html` in `dist/`, `build/`, `out/` or `.output/public/`. If
+  there is none, install with the lockfile's package manager and run the build first. Next.js
+  needs `output: 'export'` (writes `out/`).
+- An `index.html` that loads `/src/main.tsx` or another `.ts`, `.tsx`, `.jsx` or `/src/` script
+  is a dev entry. Build it.
+- The DropTheHassle CLI and MCP server never run the build. On unbuilt source they stop and print
+  the build command.
+
+### Step 2: Check the limits
+
+Before the site is claimed: 25 MB and 1,000 files, and no executables or archives
+(`.exe .msi .apk .dmg .scr .bat .zip .rar .7z .iso`). Signed in: 100 MB and 5,000 files. One
+network can create 5 new unclaimed sites per hour and 20 per day. `node_modules`, `.git` and
+hidden files are left out, except `.well-known`.
+
+### Step 3: Deploy
+
+CLI, run on the project folder after the build (or on the plain site folder):
+
+```bash
+npx -y dropthehassle deploy .
+```
+
+It prints the live URL and a claim link, and writes `.dropthehassle.json` in that folder so the
+next deploy from it updates the same site. That file holds the site's key: keep it out of git.
+`--login` puts the site on the human's account after a browser approval; `--slug name` only works
+with `--login`; `--code XXXX-XXXX` uses a 15-minute dashboard code for an existing site.
+
+MCP, in Claude Code:
+
+```bash
+claude mcp add dropthehassle -- npx -y dropthehassle-mcp
+```
+
+Then call `deploy_site` with `folder` set to the absolute path. The hosted connector
+`https://dropthehassle.com/mcp` cannot read the disk: send `files` inline as
+`{path, content, encoding}` (`utf8` or `base64`). Account tools need the human's token from
+dropthehassle.com, menu, Connect your AI, set as `DTH_TOKEN` by the human in their own config.
+
+### Step 4: Hand over and verify
+
+Tell the human the live URL and the claim link, and that the claim link works for 7 days. An
+unclaimed site can be removed after that. Then check:
+
+```bash
+curl -s "https://dropthehassle.com/api/v1/check?host=NAME.dropthehassle.app"
+```
+
+`outcome` should be `live` and `secure` true. The same check is on
+https://dropthehassle.com/is-my-website-down.
+
+### Step 5: Domains, only if asked
+
+Check names with the MCP `search_domain` tool or
+`curl -s "https://dropthehassle.com/api/v1/domains/search?q=NAME.com"`, and report only names the
+answer marks `available`, with the price it returned. Buying is the human's step: after they claim
+the site, `get_checkout_link` returns a `checkout.stripe.com` link for them to open and pay.
+
+## Examples
+
+### Example 1: Vite project
+
+```text
+User: Put this site online.
+Agent: No dist/ yet, so runs npm install && npm run build, then npx -y dropthehassle deploy .
+       Reports: Live at https://yourname.dropthehassle.app, plus the claim link (7 days).
+       Runs the live check: outcome "live", secure true.
+```
+
+### Example 2: Domain search
+
+```text
+User: Is there a .com for it?
+Agent: Checks three names with search_domain, lists the available ones with the returned price,
+       and asks which one they want. It does not create a payment link until they say so.
+```
+
+## Best Practices
+
+- ✅ Deploy the build output, not the source, and rebuild before every redeploy.
+- ✅ Run the CLI on the project folder so a rebuild of `dist/` does not delete the link file.
+- ✅ Give the human the claim link word for word, with the 7-day note.
+- ❌ Do not open, fill in or pay a payment link. A DropTheHassle payment link is always on
+  `checkout.stripe.com`.
+- ❌ Do not invent or commit a token, and do not loop new anonymous deploys.
+- ❌ Do not rename the free link (`choose_link`) without an explicit yes for that exact name.
+
+## Limitations
+
+- Static files only. Server code does not run; a separate HTTPS backend can be linked with the
+  `set_backend` tool (account token).
+- `npx dropthehassle status` and `rollback` need a folder linked with `--login` or `--code`.
+- On npm `dropthehassle-mcp` 0.4.2, `search_domain` needs a token; the hosted connector and the
+  HTTP route above work without one.
+- Cloud sandboxes (Claude Code on the web, Codex cloud) block dropthehassle.com by default: allow
+  the domain or use the hosted connector.
+- A plain deploy from a fresh machine creates a new site. Updating a claimed site needs a
+  dashboard code or the token.
+
+## Security & Safety Notes
+
+- Deploying publishes the folder on a public URL. Confirm the folder holds only what the user wants
+  public. Hidden files such as `.env` are left out, but secrets in JS bundles are not.
+- `.dropthehassle.json` contains a site key. Never commit or publish it.
+- The account token can deploy and create payment links but cannot pay. The human sets it in their
+  own MCP config; the agent should not ask for it in chat.
+- Never buy anything or create a payment link without the user asking.