fix(uipath-automationhub): say what to do when Automation Hub isn't available on the tenant (backport to release/v1.201)

skills/uipath-automationhub/SKILL.md

@@ -68,5 +68,6 @@ Every addition keeps the skill's three invariants: collect inputs before the fir
 ## Notes
 
 - **Cloud token only** — authorization is the user's real AH permissions; you see and can do exactly what their AH role allows.
+- **If Automation Hub isn't available on the tenant, say so plainly and stop** — never let it surface as a generic failure. Not enabled → *"Please contact your administrator to enable Automation Hub on this tenant."* Reachable but not yet set up → *"Automation Hub is reachable for this tenant but has not finished setup. Open Automation Hub in the browser once to complete it, then retry."* Signals and exact wording: [`references/api-endpoints.md`](references/api-endpoints.md) → **Automation Hub not available on this tenant** (CLI equivalents in [`references/cli-commands.md`](references/cli-commands.md)).
 - The publish flow fetches the idea-flow schema live, so it adapts automatically if fields change on the tenant.
 - **Open dependency:** in a hosted runtime (e.g. Process Scribe/Delegate) the cloud token is expected via the environment (Authentication, option 1). Confirm the runtime provides `UIPATH_CLI_AUTH_TOKEN` (or an equivalent) before relying on it in production.

skills/uipath-automationhub/references/api-endpoints.md

@@ -138,5 +138,19 @@ Linked components for the process.
 | 400 | Validation — missing required field, invalid enum, empty `user_inputs`, missing `OVERVIEW_NAME` |
 | 401 | Unauthorized — token missing/expired, or `x-ah-openapi-auth` was wrongly sent |
 | 403 | Forbidden — the user lacks the AH permission (authorization = the user's real AH role) |
-| 404 | Wrong URL, or AH not enabled on the tenant |
+| 404 | Wrong URL, or AH not available on the tenant — see **Automation Hub not available on this tenant** below |
 | 409 | Duplicate process name |
+
+### Automation Hub not available on this tenant
+
+Two distinct cases, with **different remedies** — don't collapse them, the advice differs:
+
+**1. AH is not enabled for the tenant.** The tenant has no Automation Hub service at all. Signals: a **404** whose body says `not found in organization`, or a **3xx redirect** to `portal_/unregistered` (following it would surface an HTML portal page as a JSON parse error). The user cannot fix this themselves — report exactly:
+
+> Please contact your administrator to enable Automation Hub on this tenant.
+
+**2. AH is reachable but the tenant was never onboarded into it.** The service answers **422 Tenant Lookup Error** on every call. This one *is* self-service — report exactly:
+
+> Automation Hub is reachable for this tenant but has not finished setup. Open Automation Hub in the browser once to complete it, then retry.
+
+In both cases: **stop after reporting** — do not retry, do not fall back to an admin OpenAPI token, and do not attempt the write against another tenant unless the user asks.

skills/uipath-automationhub/references/cli-commands.md

@@ -12,6 +12,15 @@ The CLI wraps the same Open API endpoints as [`api-endpoints.md`](api-endpoints.
 
 If a command fails with an authentication error, tell the user to run `uip login` — never ask for or handle a raw token yourself.
 
+## Automation Hub not available on this tenant
+
+The CLI already classifies this for you — read its `Instructions` field:
+
+- `Instructions` mentioning **"not provisioned on this tenant"** → AH is not enabled. Report: *"Please contact your administrator to enable Automation Hub on this tenant."*
+- `Instructions` mentioning **"no tenant record of its own yet"** → reachable but not onboarded. Report: *"Automation Hub is reachable for this tenant but has not finished setup. Open Automation Hub in the browser once to complete it, then retry."*
+
+Either way **stop** — don't retry and don't try another tenant unless asked. Full detail (and the raw signals behind each) in [`api-endpoints.md`](api-endpoints.md) → **Automation Hub not available on this tenant**.
+
 ## Output envelope (every command)
 
 Always pass `--output json`. Success:

skills/uipath-automationhub/references/get-process-cli-guide.md

@@ -19,6 +19,8 @@ Fetches one process (by id or search) and its documents, and downloads document
 uip ah automations get $PROCESS_ID --output json
 ```
 
+If the command fails with `Instructions` about AH **not being provisioned** on the tenant, or about the tenant having **no AH record yet**, report the matching message from [`cli-commands.md`](cli-commands.md) (**Automation Hub not available on this tenant**) — for the not-enabled case: *"Please contact your administrator to enable Automation Hub on this tenant."* — and stop.
+
 `Data` is the projected record (`Id`, `Name`, `Phase`, `PhaseStatus`, `Tags`, …). Add `--all-fields` only when you need the raw record (e.g. `process_slug` for the deep link). `Failure` with not-found → no such process; auth error → `uip login`.
 
 ## Step 3: Fetch the documents

skills/uipath-automationhub/references/get-process.md

@@ -21,7 +21,7 @@ curl -s -w "\n%{http_code}" -H "Authorization: Bearer $ACCESS_TOKEN" \
   "$BASE_URL/$ORG/$TENANT/automationhub_/api/v1/openapi/automations/$PROCESS_ID"
 ```
 - **200** → keep the record; project to the useful fields for display (name, status/phase, category, owner, description). The raw record is large — don't dump it all unless asked.
-- **401** → re-authenticate. **403** → the user can't view this process. **404** → no such process.
+- **401** → re-authenticate. **403** → the user can't view this process. **404** → no such process — *unless* the body says `not found in organization` (or the call 3xx-redirects to `portal_/unregistered`, or answers **422 tenant lookup**), which means AH itself is not available on this tenant: report the matching message from [`api-endpoints.md`](api-endpoints.md) (**Automation Hub not available on this tenant**) and stop.
 
 ## Step 3: Fetch the documents
 

skills/uipath-automationhub/references/publish-process-cli-guide.md

@@ -12,7 +12,7 @@ uip ah idea-flows list --output json
 
 - `Result: Success` → keep `Data` (flow names + ids) and tell the user "Connected to Automation Hub."
 - Auth failure → tell the user to run `uip login` (or, in Delegate, to sign in). Never ask for a raw token.
-- `Failure` mentioning the tenant/enablement → AH is not enabled on this tenant; stop.
+- `Failure` mentioning the tenant/enablement → AH is not available on this tenant. Report the matching message from [`cli-commands.md`](cli-commands.md) (**Automation Hub not available on this tenant**) — for the not-enabled case: *"Please contact your administrator to enable Automation Hub on this tenant."* — then **stop**; nothing later in this flow can succeed.
 
 ## Step 2: Pick the idea flow
 

skills/uipath-automationhub/references/publish-process.md

@@ -17,7 +17,7 @@ curl -s -w "\n%{http_code}" \
 - **200** → save the `data` array (reused in Step 2) and tell the user "Connected to Automation Hub."
 - **401** → token missing/expired: if it came from `~/.uipath/.auth`, ask the user to run `uip login` again; re-resolve and retry. **Never** add `x-ah-openapi-auth` to "fix" a 401 — that routes to the admin-token path and guarantees failure.
 - **403** → the user is authenticated but lacks AH access on this tenant.
-- **404 / network** → wrong URL or AH not enabled; confirm the org/tenant.
+- **404 / 3xx to `portal_/unregistered` / 422 tenant lookup** → AH is not available on this tenant. Confirm the org/tenant first; if they're right, report the matching message from [`api-endpoints.md`](api-endpoints.md) (**Automation Hub not available on this tenant**) — for the not-enabled case: *"Please contact your administrator to enable Automation Hub on this tenant."* — then **stop**.
 
 Do not proceed until you have a 200.