docs: document storage.* MCP tools; bump vibn-frontend pointer

Made-with: Cursor

AI_CAPABILITIES.md

@@ -109,15 +109,16 @@ Version: **2.1.0**.
 |---|---|---|
 | `apps.list` | All Coolify apps in the workspace. | — |
 | `apps.get` | Single app details (status, fqdn, domains, git info). | `{ uuid }` |
-| `apps.create` | Create a Coolify app from a Gitea repo in the workspace's org, pinned to the workspace's SSH deploy key. Auto-domain `{name}.{slug}.vibnai.com`. | `{ repo, branch?, name?, ports?, buildPack?, domain?, envs?, instantDeploy? }` |
-| `apps.update` | PATCH a whitelisted set of fields (name, description, git branch, ports, build commands, base directory, Dockerfile location…). | `{ uuid, patch }` |
+| `apps.create` | Create a Coolify app from a Gitea repo in the workspace's org. Clones over **HTTPS with the workspace bot's PAT embedded in the URL** — SSH is not used because Gitea's SSH isn't reachable on the default port. Auto-domain `{name}.{slug}.vibnai.com`. | `{ repo, branch?, name?, ports?, buildPack?, domain?, envs?, instantDeploy?, dockerComposeLocation?, dockerfileLocation?, baseDirectory? }` |
+| `apps.update` | PATCH a whitelisted set of fields (name, description, git branch/commit, ports, build commands, base directory, Dockerfile location, docker-compose location…). | `{ uuid, patch }` |
+| `apps.rewire_git` | Re-point an app's `git_repository` at the canonical HTTPS+PAT clone URL. Use to recover older apps that were created with SSH URLs, or to refresh a rotated bot PAT. | `{ uuid, repo? }` — `repo` optional; inferred from current URL if omitted |
 | `apps.delete` | Destroy the app. Volumes kept by default. | `{ uuid, confirm }` — `confirm` must equal the app's exact name |
 | `apps.deploy` | Trigger a new deployment. | `{ uuid, force? }` |
 | `apps.deployments` | List recent deployments + status. | `{ uuid }` |
 | `apps.domains.list` | Current domain set. | `{ uuid }` |
 | `apps.domains.set` | Replace the domain set. All entries must end with `.{slug}.vibnai.com`. | `{ uuid, domains: string[] }` |
 | `apps.envs.list` | List env vars. Values returned are redacted for `shown-once` secrets. | `{ uuid }` |
-| `apps.envs.upsert` | Create or update an env var. | `{ uuid, key, value, isBuildTime?, isMultiline?, isLiteral?, isShownOnce? }` |
+| `apps.envs.upsert` | Create or update an env var. `is_build_time` is **ignored** — Coolify derives build-vs-runtime from Dockerfile `ARG` usage. | `{ uuid, key, value, isPreview?, isMultiline?, isLiteral?, isShownOnce? }` |
 | `apps.envs.delete` | Delete an env var. | `{ uuid, key }` |
 
 ### 3.4 Database tools
@@ -168,6 +169,23 @@ steps — search, register, attach, inspect — are agent-callable.
 | `domains.get` | Full record + last 20 lifecycle events. | `{ domain }` |
 | `domains.attach` | Wire a registered domain to a Coolify app (or arbitrary IP/CNAME): create Cloud DNS zone, write A/CNAME rrsets, update registrar-side nameservers, append FQDNs to the Coolify app's domain list. Idempotent; safe to retry. | `{ domain, appUuid? \| ip? \| cname?, subdomains?: string[] (default ["@","www"]), updateRegistrarNs? }` |
 
+### Object storage (GCS via S3-compatible HMAC)
+
+Every workspace gets a Canada-hosted GCS bucket, a dedicated service
+account, and an HMAC keypair so agent-built apps can use any AWS S3
+SDK. The HMAC *secret* is never returned through the API — it's written
+directly into Coolify apps via `storage.inject_env`.
+
+| Tool | Purpose | Params |
+|---|---|---|
+| `storage.describe` | Report the workspace bucket name, region, S3 endpoint, access-key id, and provision status. No secret returned. | — |
+| `storage.provision` | Idempotently create/reconcile the workspace's GCP service account, JSON keyfile, bucket (`vibn-ws-{slug}-{rand}`), IAM binding, and HMAC key. Safe to re-run. | — |
+| `storage.inject_env` | Push `STORAGE_*` env vars (endpoint, region, bucket, access key id, secret access key, force_path_style) into a Coolify app. The secret is written server-side with `is_shown_once=true`; it never transits the response body. | `{ uuid, prefix? }` — `prefix` defaults to `STORAGE_`; use `S3_` for apps that expect AWS-standard names |
+
+The bucket is S3-compatible: point any `aws-sdk` / `@aws-sdk/client-s3`
+/ `boto3` at `STORAGE_ENDPOINT` with `force_path_style=true` (`STORAGE_*`
+env vars are set by `storage.inject_env`).
+
 **Residency note:** Cloud DNS is global anycast — configuration is not
 Canadian-pinned at the storage layer. The workspace-level `dns_provider`
 flag (default `cloud_dns`) will let us swap in CIRA D-Zone for strict