@ainyc/canonry 1.48.2 → 2.0.0

package/dist/{chunk-YPTVJRJY.js → chunk-YZKLIUH4.js}

@@ -1,11 +1,14 @@
 import {
   IntelligenceService,
+  agentSessions,
   apiKeys,
   auditLog,
   bingCoverageSnapshots,
   bingUrlInspections,
   competitors,
   createLogger,
+  dropLegacyCredentialColumns,
+  extractLegacyCredentials,
   gaAiReferrals,
   gaSocialReferrals,
   gaTrafficSnapshots,
@@ -23,7 +26,7 @@ import {
   runs,
   schedules,
   usageCounters
-} from "./chunk-JTKHPNGL.js";
+} from "./chunk-GH6WGN5B.js";
 
 // src/config.ts
 import fs from "fs";
@@ -335,10 +338,10 @@ function printCliError(err, format) {
 // src/server.ts
 import { createRequire as createRequire2 } from "module";
 import crypto23 from "crypto";
-import fs7 from "fs";
-import path8 from "path";
+import fs8 from "fs";
+import path9 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { eq as eq24, sql as sql6 } from "drizzle-orm";
+import { eq as eq25 } from "drizzle-orm";
 import Fastify from "fastify";
 
 // ../contracts/src/config-schema.ts
@@ -600,6 +603,13 @@ function notImplemented(message) {
 function deliveryFailed(message) {
   return new AppError("DELIVERY_FAILED", message, 502);
 }
+function agentBusy(projectName) {
+  return new AppError(
+    "AGENT_BUSY",
+    `Aero is already running a turn for '${projectName}'. Retry after the current turn settles.`,
+    409
+  );
+}
 
 // ../contracts/src/google.ts
 import { z as z5 } from "zod";
@@ -887,6 +897,37 @@ var wordpressDiffDtoSchema = z7.object({
   })
 });
 
+// ../contracts/src/providers.ts
+var ProviderIds = {
+  claude: "claude",
+  openai: "openai",
+  gemini: "gemini",
+  perplexity: "perplexity",
+  local: "local",
+  cdpChatgpt: "cdp:chatgpt",
+  zai: "zai"
+};
+var PROVIDER_IDS = Object.values(ProviderIds);
+var SweepProviderIds = {
+  claude: ProviderIds.claude,
+  openai: ProviderIds.openai,
+  gemini: ProviderIds.gemini,
+  perplexity: ProviderIds.perplexity,
+  local: ProviderIds.local,
+  cdpChatgpt: ProviderIds.cdpChatgpt
+};
+var SWEEP_PROVIDER_IDS = Object.values(SweepProviderIds);
+var AgentProviderIds = {
+  claude: ProviderIds.claude,
+  openai: ProviderIds.openai,
+  gemini: ProviderIds.gemini,
+  zai: ProviderIds.zai
+};
+var AGENT_PROVIDER_IDS = Object.values(AgentProviderIds);
+function isAgentProviderId(value) {
+  return AGENT_PROVIDER_IDS.includes(value);
+}
+
 // ../contracts/src/run.ts
 import { z as z8 } from "zod";
 var runStatusSchema = z8.enum(["queued", "running", "completed", "partial", "failed", "cancelled"]);
@@ -2379,7 +2420,7 @@ async function deliverWebhook(target, payload, webhookSecret) {
   const body = JSON.stringify(payload);
   const isHttps = target.url.protocol === "https:";
   const port = target.url.port ? Number(target.url.port) : isHttps ? 443 : 80;
-  const path9 = `${target.url.pathname}${target.url.search}`;
+  const path10 = `${target.url.pathname}${target.url.search}`;
   const headers = {
     "Content-Length": String(Buffer.byteLength(body)),
     "Content-Type": "application/json",
@@ -2395,7 +2436,7 @@ async function deliverWebhook(target, payload, webhookSecret) {
       headers,
       hostname: target.address,
       method: "POST",
-      path: path9,
+      path: path10,
       port,
       timeout: REQUEST_TIMEOUT_MS
     };
@@ -5565,10 +5606,91 @@ var routeCatalog = [
     }
   }
 ];
+var canonryLocalRouteCatalog = [
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/agent/transcript",
+    summary: "Get the rolling Aero transcript for this project",
+    description: "Returns the full message history of the project-scoped Aero session plus the persisted model provider/id and last-updated timestamp. Empty messages array when the project has no session yet.",
+    tags: ["agent"],
+    parameters: [nameParameter],
+    responses: {
+      200: { description: "Transcript returned." },
+      404: { description: "Project not found." }
+    }
+  },
+  {
+    method: "delete",
+    path: "/api/v1/projects/{name}/agent/transcript",
+    summary: "Reset the Aero transcript + queued follow-ups",
+    description: "Evicts any live Agent instance, clears the persisted messages and follow_up_queue. A subsequent prompt starts a fresh session.",
+    tags: ["agent"],
+    parameters: [nameParameter],
+    responses: {
+      200: { description: "Session reset." },
+      404: { description: "Project not found." }
+    }
+  },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/agent/providers",
+    summary: "List the LLM providers Aero can route to",
+    description: "Returns every provider Aero knows about with its default model, whether a usable API key is configured, and where the key resolved from (`config` | `env`). `defaultProvider` is the one Aero auto-picks when a caller omits `provider` on the prompt endpoint. Path is project-scoped for auth symmetry; the response does not vary per project today.",
+    tags: ["agent"],
+    parameters: [nameParameter],
+    responses: {
+      200: { description: "Providers returned." },
+      404: { description: "Project not found." }
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/agent/prompt",
+    summary: "Send a prompt to Aero and stream events back as SSE",
+    description: 'Posts a prompt into the project\'s Aero session and streams `AgentEvent` frames as `text/event-stream`. Each frame is `data: <JSON>\\n\\n`. The server brackets the stream with `{"type":"stream_open"}` and `{"type":"stream_close"}` control frames; `{"type":"error","message":"..."}` surfaces in-stream failures without collapsing the stream. Returns 409 `AGENT_BUSY` if another turn is already in flight for this project. Body field `scope` accepts "all" | "read-only"; omitted defaults to "read-only" (safe dashboard surface). The CLI passes "all" to keep write tools available.',
+    tags: ["agent"],
+    parameters: [nameParameter],
+    requestBody: {
+      required: true,
+      content: {
+        "application/json": {
+          schema: {
+            type: "object",
+            required: ["prompt"],
+            properties: {
+              prompt: { type: "string", description: "The user's message for Aero." },
+              provider: {
+                type: "string",
+                enum: [...AGENT_PROVIDER_IDS],
+                description: "Override the persisted LLM provider for this and subsequent turns."
+              },
+              modelId: {
+                type: "string",
+                description: "Override the persisted model id for this and subsequent turns."
+              },
+              scope: {
+                type: "string",
+                enum: ["all", "read-only"],
+                description: 'Tool surface scope. Default "read-only". Set "all" to enable write tools.'
+              }
+            }
+          }
+        }
+      }
+    },
+    responses: {
+      200: { description: "SSE stream of AgentEvent frames." },
+      400: { description: "Missing or empty prompt." },
+      404: { description: "Project not found." },
+      409: { description: "Another Aero turn is already in flight." }
+    }
+  }
+];
 function buildOpenApiDocument(info = {}) {
   const BASE_PREFIX = "/api/v1";
   const prefix = info.routePrefix ?? BASE_PREFIX;
-  const paths = routeCatalog.reduce((acc, route) => {
+  const fullCatalog = info.includeCanonryLocal ? [...routeCatalog, ...canonryLocalRouteCatalog] : routeCatalog;
+  const paths = fullCatalog.reduce((acc, route) => {
     const subpath = route.path.startsWith(BASE_PREFIX) ? route.path.slice(BASE_PREFIX.length) : route.path;
     const fullPath = prefix + subpath;
     const operation = {
@@ -5616,8 +5738,8 @@ async function openApiRoutes(app, opts = {}) {
     return reply.type("application/json").send(buildOpenApiDocument(opts));
   });
 }
-function buildOperationId(method, path9) {
-  const parts = path9.split("/").filter(Boolean).map((part) => {
+function buildOperationId(method, path10) {
+  const parts = path10.split("/").filter(Boolean).map((part) => {
     if (part.startsWith("{") && part.endsWith("}")) {
       return `by-${part.slice(1, -1)}`;
     }
@@ -9263,10 +9385,10 @@ function buildAuthErrorMessage(res, responseText) {
   }
   return "WordPress credentials are invalid or lack permission for this action";
 }
-async function fetchJson(connection, siteUrl, path9, init) {
+async function fetchJson(connection, siteUrl, path10, init) {
   if (siteUrl.startsWith("http:")) {
   }
-  const res = await fetch(`${normalizeSiteUrl(siteUrl)}${path9}`, {
+  const res = await fetch(`${normalizeSiteUrl(siteUrl)}${path10}`, {
     ...init,
     headers: {
       "Authorization": `Basic ${encodeBasicAuth(connection.username, connection.appPassword)}`,
@@ -10856,41 +10978,14 @@ async function apiRoutes(app, opts) {
       googleConnectionStore: opts.googleConnectionStore,
       getGoogleAuthConfig: opts.getGoogleAuthConfig
     });
+    if (opts.registerAuthenticatedRoutes) {
+      await opts.registerAuthenticatedRoutes(api);
+    }
   }, { prefix: opts.routePrefix ?? "/api/v1" });
 }
 
-// src/agent-webhook.ts
-import crypto18 from "crypto";
-import { eq as eq18 } from "drizzle-orm";
-var AGENT_WEBHOOK_EVENTS = ["run.completed", "insight.critical", "insight.high", "citation.gained"];
-function buildAgentWebhookUrl(gatewayPort) {
-  return `http://localhost:${gatewayPort}/hooks/canonry`;
-}
-function attachAgentWebhookDirect(db, projectId, gatewayPort) {
-  const agentUrl = buildAgentWebhookUrl(gatewayPort);
-  const existing = db.select().from(notifications).where(eq18(notifications.projectId, projectId)).all();
-  const hasAgent = existing.some((n) => {
-    const cfg = parseJsonColumn(n.config, {});
-    return cfg.source === "agent";
-  });
-  if (hasAgent) return "already-attached";
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  db.insert(notifications).values({
-    id: crypto18.randomUUID(),
-    projectId,
-    channel: "webhook",
-    config: JSON.stringify({
-      url: agentUrl,
-      events: [...AGENT_WEBHOOK_EVENTS],
-      source: "agent"
-    }),
-    enabled: 1,
-    webhookSecret: crypto18.randomUUID(),
-    createdAt: now,
-    updatedAt: now
-  }).run();
-  return "attached";
-}
+// src/server.ts
+import os5 from "os";
 
 // ../provider-gemini/src/normalize.ts
 import { GoogleGenAI } from "@google/genai";
@@ -13343,11 +13438,11 @@ function removeWordpressConnection(config, projectName) {
 }
 
 // src/job-runner.ts
-import crypto19 from "crypto";
+import crypto18 from "crypto";
 import fs4 from "fs";
 import path5 from "path";
 import os4 from "os";
-import { and as and7, eq as eq19, inArray as inArray3, sql as sql4 } from "drizzle-orm";
+import { and as and7, eq as eq18, inArray as inArray3, sql as sql4 } from "drizzle-orm";
 
 // src/citation-utils.ts
 function domainMatches(domain, canonicalDomain) {
@@ -13583,7 +13678,7 @@ var JobRunner = class {
     if (stale.length === 0) return;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     for (const run of stale) {
-      this.db.update(runs).set({ status: "failed", finishedAt: now, error: "Server restarted while run was in progress" }).where(eq19(runs.id, run.id)).run();
+      this.db.update(runs).set({ status: "failed", finishedAt: now, error: "Server restarted while run was in progress" }).where(eq18(runs.id, run.id)).run();
       log.warn("run.recovered-stale", { runId: run.id, previousStatus: run.status });
     }
   }
@@ -13611,10 +13706,10 @@ var JobRunner = class {
         throw new Error(`Run ${runId} is not executable from status '${existingRun.status}'`);
       }
       if (existingRun.status === "queued") {
-        this.db.update(runs).set({ status: "running", startedAt: now }).where(and7(eq19(runs.id, runId), eq19(runs.status, "queued"))).run();
+        this.db.update(runs).set({ status: "running", startedAt: now }).where(and7(eq18(runs.id, runId), eq18(runs.status, "queued"))).run();
       }
       this.throwIfRunCancelled(runId);
-      const project = this.db.select().from(projects).where(eq19(projects.id, projectId)).get();
+      const project = this.db.select().from(projects).where(eq18(projects.id, projectId)).get();
       if (!project) {
         throw new Error(`Project ${projectId} not found`);
       }
@@ -13634,8 +13729,8 @@ var JobRunner = class {
         throw new Error("No providers configured. Add at least one provider API key.");
       }
       log.info("run.dispatch", { runId, providerCount: activeProviders.length, providers: activeProviders.map((p) => p.adapter.name) });
-      projectKeywords = this.db.select().from(keywords).where(eq19(keywords.projectId, projectId)).all();
-      const projectCompetitors = this.db.select().from(competitors).where(eq19(competitors.projectId, projectId)).all();
+      projectKeywords = this.db.select().from(keywords).where(eq18(keywords.projectId, projectId)).all();
+      const projectCompetitors = this.db.select().from(competitors).where(eq18(competitors.projectId, projectId)).all();
       const competitorDomains = projectCompetitors.map((c) => c.domain);
       const allDomains = effectiveDomains({
         canonicalDomain: project.canonicalDomain,
@@ -13651,7 +13746,7 @@ var JobRunner = class {
       const todayPeriod = getCurrentUsageDay();
       for (const p of activeProviders) {
         const providerScope = `${projectId}:${p.adapter.name}`;
-        const providerUsage = this.db.select().from(usageCounters).where(eq19(usageCounters.scope, providerScope)).all().filter((r) => r.period === todayPeriod && r.metric === "queries").reduce((sum, r) => sum + r.count, 0);
+        const providerUsage = this.db.select().from(usageCounters).where(eq18(usageCounters.scope, providerScope)).all().filter((r) => r.period === todayPeriod && r.metric === "queries").reduce((sum, r) => sum + r.count, 0);
         const limit = p.config.quotaPolicy.maxRequestsPerDay;
         if (providerUsage + queriesPerProvider > limit) {
           throw new Error(
@@ -13711,7 +13806,7 @@ var JobRunner = class {
             );
             let screenshotRelPath = null;
             if (raw.screenshotPath && fs4.existsSync(raw.screenshotPath)) {
-              const snapshotId = crypto19.randomUUID();
+              const snapshotId = crypto18.randomUUID();
               const screenshotDir = path5.join(os4.homedir(), ".canonry", "screenshots", runId);
               if (!fs4.existsSync(screenshotDir)) fs4.mkdirSync(screenshotDir, { recursive: true });
               const destPath = path5.join(screenshotDir, `${snapshotId}.png`);
@@ -13741,7 +13836,7 @@ var JobRunner = class {
               }).run();
             } else {
               this.db.insert(querySnapshots).values({
-                id: crypto19.randomUUID(),
+                id: crypto18.randomUUID(),
                 runId,
                 keywordId: kw.id,
                 provider: providerName,
@@ -13792,12 +13887,12 @@ var JobRunner = class {
       const someFailed = providerErrors.size > 0;
       if (allFailed) {
         const errorDetail = JSON.stringify(Object.fromEntries(providerErrors));
-        this.db.update(runs).set({ status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq19(runs.id, runId)).run();
+        this.db.update(runs).set({ status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq18(runs.id, runId)).run();
       } else if (someFailed) {
         const errorDetail = JSON.stringify(Object.fromEntries(providerErrors));
-        this.db.update(runs).set({ status: "partial", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq19(runs.id, runId)).run();
+        this.db.update(runs).set({ status: "partial", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq18(runs.id, runId)).run();
       } else {
-        this.db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq19(runs.id, runId)).run();
+        this.db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq18(runs.id, runId)).run();
       }
       this.flushProviderUsage(projectId, providerDispatchCounts);
       const finalStatus = allFailed ? "failed" : someFailed ? "partial" : "completed";
@@ -13832,7 +13927,7 @@ var JobRunner = class {
         status: "failed",
         finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
         error: errorMessage
-      }).where(eq19(runs.id, runId)).run();
+      }).where(eq18(runs.id, runId)).run();
       this.flushProviderUsage(projectId, providerDispatchCounts);
       trackEvent("run.completed", {
         status: "failed",
@@ -13853,7 +13948,7 @@ var JobRunner = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const period = now.slice(0, 10);
     this.db.insert(usageCounters).values({
-      id: crypto19.randomUUID(),
+      id: crypto18.randomUUID(),
       scope,
       period,
       metric,
@@ -13875,7 +13970,7 @@ var JobRunner = class {
       status: runs.status,
       finishedAt: runs.finishedAt,
       error: runs.error
-    }).from(runs).where(eq19(runs.id, runId)).get();
+    }).from(runs).where(eq18(runs.id, runId)).get();
   }
   isRunCancelled(runId) {
     return this.getRunState(runId)?.status === "cancelled";
@@ -13891,7 +13986,7 @@ var JobRunner = class {
       this.db.update(runs).set({
         finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
         error: currentRun.error ?? "Cancelled by user"
-      }).where(eq19(runs.id, runId)).run();
+      }).where(eq18(runs.id, runId)).run();
     }
     trackEvent("run.completed", {
       status: "cancelled",
@@ -13913,8 +14008,8 @@ function getCurrentUsageDay() {
 }
 
 // src/gsc-sync.ts
-import crypto20 from "crypto";
-import { eq as eq20, and as and8, sql as sql5 } from "drizzle-orm";
+import crypto19 from "crypto";
+import { eq as eq19, and as and8, sql as sql5 } from "drizzle-orm";
 var log2 = createLogger("GscSync");
 function formatDate2(d) {
   return d.toISOString().split("T")[0];
@@ -13926,13 +14021,13 @@ function daysAgo(n) {
 }
 async function executeGscSync(db, runId, projectId, opts) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  db.update(runs).set({ status: "running", startedAt: now }).where(eq20(runs.id, runId)).run();
+  db.update(runs).set({ status: "running", startedAt: now }).where(eq19(runs.id, runId)).run();
   try {
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
     if (!googleClientId || !googleClientSecret) {
       throw new Error("Google OAuth is not configured in the local Canonry config");
     }
-    const project = db.select().from(projects).where(eq20(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq19(projects.id, projectId)).get();
     if (!project) {
       throw new Error(`Project not found: ${projectId}`);
     }
@@ -13967,7 +14062,7 @@ async function executeGscSync(db, runId, projectId, opts) {
     log2.info("fetch.complete", { runId, projectId, rowCount: rows.length });
     db.delete(gscSearchData).where(
       and8(
-        eq20(gscSearchData.projectId, projectId),
+        eq19(gscSearchData.projectId, projectId),
         sql5`${gscSearchData.date} >= ${startDate}`,
         sql5`${gscSearchData.date} <= ${endDate}`
       )
@@ -13979,7 +14074,7 @@ async function executeGscSync(db, runId, projectId, opts) {
       for (const row of batch) {
         const [query, page, country, device, date] = row.keys;
         db.insert(gscSearchData).values({
-          id: crypto20.randomUUID(),
+          id: crypto19.randomUUID(),
           projectId,
           syncRunId: runId,
           date: date ?? "",
@@ -14013,7 +14108,7 @@ async function executeGscSync(db, runId, projectId, opts) {
         const rich = ir.richResultsResult;
         const inspectedAt = (/* @__PURE__ */ new Date()).toISOString();
         db.insert(gscUrlInspections).values({
-          id: crypto20.randomUUID(),
+          id: crypto19.randomUUID(),
           projectId,
           syncRunId: runId,
           url: pageUrl,
@@ -14034,7 +14129,7 @@ async function executeGscSync(db, runId, projectId, opts) {
         log2.error("inspect.url-failed", { runId, projectId, url: pageUrl, error: err instanceof Error ? err.message : String(err) });
       }
     }
-    const allInspections = db.select().from(gscUrlInspections).where(eq20(gscUrlInspections.projectId, projectId)).all();
+    const allInspections = db.select().from(gscUrlInspections).where(eq19(gscUrlInspections.projectId, projectId)).all();
     const latestByUrl = /* @__PURE__ */ new Map();
     for (const row of allInspections) {
       const existing = latestByUrl.get(row.url);
@@ -14055,9 +14150,9 @@ async function executeGscSync(db, runId, projectId, opts) {
       }
     }
     const snapshotDate = formatDate2(/* @__PURE__ */ new Date());
-    db.delete(gscCoverageSnapshots).where(and8(eq20(gscCoverageSnapshots.projectId, projectId), eq20(gscCoverageSnapshots.date, snapshotDate))).run();
+    db.delete(gscCoverageSnapshots).where(and8(eq19(gscCoverageSnapshots.projectId, projectId), eq19(gscCoverageSnapshots.date, snapshotDate))).run();
     db.insert(gscCoverageSnapshots).values({
-      id: crypto20.randomUUID(),
+      id: crypto19.randomUUID(),
       projectId,
       syncRunId: runId,
       date: snapshotDate,
@@ -14066,19 +14161,19 @@ async function executeGscSync(db, runId, projectId, opts) {
       reasonBreakdown: JSON.stringify(reasonCounts),
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     }).run();
-    db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(runs.id, runId)).run();
+    db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq19(runs.id, runId)).run();
     log2.info("sync.completed", { runId, projectId, searchDataRows: rows.length, urlInspections: topPages.length, indexed: snapIndexed, notIndexed: snapNotIndexed });
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(runs.id, runId)).run();
+    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq19(runs.id, runId)).run();
     log2.error("sync.failed", { runId, projectId, error: errorMsg });
     throw err;
   }
 }
 
 // src/gsc-inspect-sitemap.ts
-import crypto21 from "crypto";
-import { eq as eq21, and as and9 } from "drizzle-orm";
+import crypto20 from "crypto";
+import { eq as eq20, and as and9 } from "drizzle-orm";
 
 // src/sitemap-parser.ts
 var LOC_REGEX = /<loc>\s*([^<]+?)\s*<\/loc>/gi;
@@ -14147,13 +14242,13 @@ async function parseSitemapRecursive(url, urls, depth) {
 var log3 = createLogger("InspectSitemap");
 async function executeInspectSitemap(db, runId, projectId, opts) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  db.update(runs).set({ status: "running", startedAt: now }).where(eq21(runs.id, runId)).run();
+  db.update(runs).set({ status: "running", startedAt: now }).where(eq20(runs.id, runId)).run();
   try {
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
     if (!googleClientId || !googleClientSecret) {
       throw new Error("Google OAuth is not configured in the local Canonry config");
     }
-    const project = db.select().from(projects).where(eq21(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq20(projects.id, projectId)).get();
     if (!project) {
       throw new Error(`Project not found: ${projectId}`);
     }
@@ -14194,7 +14289,7 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
         const rich = ir.richResultsResult;
         const inspectedAt = (/* @__PURE__ */ new Date()).toISOString();
         db.insert(gscUrlInspections).values({
-          id: crypto21.randomUUID(),
+          id: crypto20.randomUUID(),
           projectId,
           syncRunId: runId,
           url: pageUrl,
@@ -14221,7 +14316,7 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
         await new Promise((r) => setTimeout(r, 1e3));
       }
     }
-    const allInspections = db.select().from(gscUrlInspections).where(eq21(gscUrlInspections.projectId, projectId)).all();
+    const allInspections = db.select().from(gscUrlInspections).where(eq20(gscUrlInspections.projectId, projectId)).all();
     const latestByUrl = /* @__PURE__ */ new Map();
     for (const row of allInspections) {
       const existing = latestByUrl.get(row.url);
@@ -14242,9 +14337,9 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
       }
     }
     const snapshotDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-    db.delete(gscCoverageSnapshots).where(and9(eq21(gscCoverageSnapshots.projectId, projectId), eq21(gscCoverageSnapshots.date, snapshotDate))).run();
+    db.delete(gscCoverageSnapshots).where(and9(eq20(gscCoverageSnapshots.projectId, projectId), eq20(gscCoverageSnapshots.date, snapshotDate))).run();
     db.insert(gscCoverageSnapshots).values({
-      id: crypto21.randomUUID(),
+      id: crypto20.randomUUID(),
       projectId,
       syncRunId: runId,
       date: snapshotDate,
@@ -14254,11 +14349,11 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     }).run();
     const status = errors > 0 && inspected > 0 ? "partial" : errors === urls.length ? "failed" : "completed";
-    db.update(runs).set({ status, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq21(runs.id, runId)).run();
+    db.update(runs).set({ status, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(runs.id, runId)).run();
     log3.info("inspect.completed", { runId, projectId, inspected, errors, total: urls.length, indexed: snapIndexed, notIndexed: snapNotIndexed });
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq21(runs.id, runId)).run();
+    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(runs.id, runId)).run();
     log3.error("inspect.failed", { runId, projectId, error: errorMsg });
     throw err;
   }
@@ -14317,7 +14412,7 @@ var ProviderRegistry = class {
 
 // src/scheduler.ts
 import cron from "node-cron";
-import { eq as eq22 } from "drizzle-orm";
+import { eq as eq21 } from "drizzle-orm";
 var log4 = createLogger("Scheduler");
 var Scheduler = class {
   db;
@@ -14329,7 +14424,7 @@ var Scheduler = class {
   }
   /** Load all enabled schedules from DB and register cron jobs. */
   start() {
-    const allSchedules = this.db.select().from(schedules).where(eq22(schedules.enabled, 1)).all();
+    const allSchedules = this.db.select().from(schedules).where(eq21(schedules.enabled, 1)).all();
     for (const schedule of allSchedules) {
       const missedRunAt = schedule.nextRunAt;
       this.registerCronTask(schedule);
@@ -14354,7 +14449,7 @@ var Scheduler = class {
       this.stopTask(projectId, existing, "Stopped");
       this.tasks.delete(projectId);
     }
-    const schedule = this.db.select().from(schedules).where(eq22(schedules.projectId, projectId)).get();
+    const schedule = this.db.select().from(schedules).where(eq21(schedules.projectId, projectId)).get();
     if (schedule && schedule.enabled === 1) {
       this.registerCronTask(schedule);
     }
@@ -14387,14 +14482,14 @@ var Scheduler = class {
     this.db.update(schedules).set({
       nextRunAt: task.getNextRun()?.toISOString() ?? null,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq22(schedules.id, scheduleId)).run();
+    }).where(eq21(schedules.id, scheduleId)).run();
     const label = schedule.preset ?? cronExpr;
     log4.info("cron.registered", { projectId, schedule: label, timezone });
   }
   triggerRun(scheduleId, projectId) {
     try {
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const currentSchedule = this.db.select().from(schedules).where(eq22(schedules.id, scheduleId)).get();
+      const currentSchedule = this.db.select().from(schedules).where(eq21(schedules.id, scheduleId)).get();
       if (!currentSchedule || currentSchedule.enabled !== 1) {
         log4.warn("schedule.stale", { scheduleId, projectId, msg: "schedule no longer exists or is disabled" });
         this.remove(projectId);
@@ -14402,7 +14497,7 @@ var Scheduler = class {
       }
       const task = this.tasks.get(projectId);
       const nextRunAt = task?.getNextRun()?.toISOString() ?? null;
-      const project = this.db.select().from(projects).where(eq22(projects.id, projectId)).get();
+      const project = this.db.select().from(projects).where(eq21(projects.id, projectId)).get();
       if (!project) {
         log4.error("project.not-found", { projectId, msg: "skipping scheduled run" });
         this.remove(projectId);
@@ -14431,7 +14526,7 @@ var Scheduler = class {
         this.db.update(schedules).set({
           nextRunAt,
           updatedAt: now
-        }).where(eq22(schedules.id, currentSchedule.id)).run();
+        }).where(eq21(schedules.id, currentSchedule.id)).run();
         return;
       }
       const runId = queueResult.runId;
@@ -14439,7 +14534,7 @@ var Scheduler = class {
         lastRunAt: now,
         nextRunAt,
         updatedAt: now
-      }).where(eq22(schedules.id, currentSchedule.id)).run();
+      }).where(eq21(schedules.id, currentSchedule.id)).run();
       const scheduleProviders = parseJsonColumn(currentSchedule.providers, []);
       const providers = scheduleProviders.length > 0 ? scheduleProviders : void 0;
       log4.info("run.triggered", { runId, projectName: project.name, providers: providers ?? "all" });
@@ -14451,8 +14546,8 @@ var Scheduler = class {
 };
 
 // src/notifier.ts
-import { eq as eq23, desc as desc8, and as and10, or as or2 } from "drizzle-orm";
-import crypto22 from "crypto";
+import { eq as eq22, desc as desc8, and as and10, or as or2 } from "drizzle-orm";
+import crypto21 from "crypto";
 var log5 = createLogger("Notifier");
 var Notifier = class {
   db;
@@ -14464,18 +14559,18 @@ var Notifier = class {
   /** Called after a run completes (success, partial, or failed). */
   async onRunCompleted(runId, projectId) {
     log5.info("run.completed", { runId, projectId });
-    const notifs = this.db.select().from(notifications).where(eq23(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
+    const notifs = this.db.select().from(notifications).where(eq22(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
     if (notifs.length === 0) {
       log5.info("notifications.none-enabled", { projectId });
       return;
     }
     log5.info("notifications.found", { projectId, count: notifs.length });
-    const run = this.db.select().from(runs).where(eq23(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq22(runs.id, runId)).get();
     if (!run) {
       log5.error("run.not-found", { runId, msg: "skipping notification dispatch" });
       return;
     }
-    const project = this.db.select().from(projects).where(eq23(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq22(projects.id, projectId)).get();
     if (!project) {
       log5.error("project.not-found", { projectId, msg: "skipping notification dispatch" });
       return;
@@ -14522,11 +14617,11 @@ var Notifier = class {
     if (criticalInsights.length > 0) insightEvents.push("insight.critical");
     if (highInsights.length > 0) insightEvents.push("insight.high");
     if (insightEvents.length === 0) return;
-    const notifs = this.db.select().from(notifications).where(eq23(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
+    const notifs = this.db.select().from(notifications).where(eq22(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
     if (notifs.length === 0) return;
-    const run = this.db.select().from(runs).where(eq23(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq22(runs.id, runId)).get();
     if (!run) return;
-    const project = this.db.select().from(projects).where(eq23(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq22(projects.id, projectId)).get();
     if (!project) return;
     for (const notif of notifs) {
       const config = parseJsonColumn(notif.config, { url: "", events: [] });
@@ -14558,8 +14653,8 @@ var Notifier = class {
   computeTransitions(runId, projectId) {
     const recentRuns = this.db.select().from(runs).where(
       and10(
-        eq23(runs.projectId, projectId),
-        or2(eq23(runs.status, "completed"), eq23(runs.status, "partial"))
+        eq22(runs.projectId, projectId),
+        or2(eq22(runs.status, "completed"), eq22(runs.status, "partial"))
       )
     ).orderBy(desc8(runs.createdAt)).limit(2).all();
     if (recentRuns.length < 2) return [];
@@ -14571,12 +14666,12 @@ var Notifier = class {
       keyword: keywords.keyword,
       provider: querySnapshots.provider,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).leftJoin(keywords, eq23(querySnapshots.keywordId, keywords.id)).where(eq23(querySnapshots.runId, currentRunId)).all();
+    }).from(querySnapshots).leftJoin(keywords, eq22(querySnapshots.keywordId, keywords.id)).where(eq22(querySnapshots.runId, currentRunId)).all();
     const previousSnapshots = this.db.select({
       keywordId: querySnapshots.keywordId,
       provider: querySnapshots.provider,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).where(eq23(querySnapshots.runId, previousRunId)).all();
+    }).from(querySnapshots).where(eq22(querySnapshots.runId, previousRunId)).all();
     const prevMap = /* @__PURE__ */ new Map();
     for (const s of previousSnapshots) {
       prevMap.set(`${s.keywordId}:${s.provider}`, s.citationState);
@@ -14634,7 +14729,7 @@ var Notifier = class {
   }
   logDelivery(projectId, notificationId, event, status, error) {
     this.db.insert(auditLog).values({
-      id: crypto22.randomUUID(),
+      id: crypto21.randomUUID(),
       projectId,
       actor: "scheduler",
       action: `notification.${status}`,
@@ -14649,19 +14744,23 @@ var Notifier = class {
 // src/run-coordinator.ts
 var log6 = createLogger("RunCoordinator");
 var RunCoordinator = class {
-  constructor(notifier, intelligenceService, onInsightsGenerated) {
+  constructor(notifier, intelligenceService, onInsightsGenerated, onAeroEvent) {
     this.notifier = notifier;
     this.intelligenceService = intelligenceService;
     this.onInsightsGenerated = onInsightsGenerated;
+    this.onAeroEvent = onAeroEvent;
   }
   async onRunCompleted(runId, projectId) {
+    let insightCount = 0;
+    let criticalOrHigh = 0;
     try {
       const result = this.intelligenceService.analyzeAndPersist(runId, projectId);
-      if (result && this.onInsightsGenerated) {
-        const hasHighSeverity = result.insights.some(
+      if (result) {
+        insightCount = result.insights.length;
+        criticalOrHigh = result.insights.filter(
           (i) => i.severity === "critical" || i.severity === "high"
-        );
-        if (hasHighSeverity) {
+        ).length;
+        if (this.onInsightsGenerated && criticalOrHigh > 0) {
           try {
             await this.onInsightsGenerated(runId, projectId, result);
           } catch (err) {
@@ -14677,148 +14776,1692 @@ var RunCoordinator = class {
     } catch (err) {
       log6.error("notifier.failed", { runId, error: err instanceof Error ? err.message : String(err) });
     }
+    if (this.onAeroEvent) {
+      try {
+        await this.onAeroEvent({ runId, projectId, insightCount, criticalOrHigh });
+      } catch (err) {
+        log6.error("aero.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+      }
+    }
   }
 };
 
-// src/snapshot-service.ts
-import { runAeoAudit } from "@ainyc/aeo-audit";
+// src/agent/session-registry.ts
+import crypto22 from "crypto";
+import { eq as eq23 } from "drizzle-orm";
 
-// src/site-fetch.ts
-import https2 from "https";
-var FETCH_TIMEOUT_MS = 1e4;
-var MAX_TEXT_LENGTH = 4e3;
-var MAX_BODY_BYTES = 512e3;
-var USER_AGENT = "Canonry/1.0 (site-analysis)";
-function extractHostname(domain) {
-  let hostname = domain;
-  try {
-    if (hostname.includes("://")) {
-      hostname = new URL(hostname).hostname;
-    }
-  } catch {
+// src/agent/session.ts
+import fs7 from "fs";
+import path8 from "path";
+import { Agent } from "@mariozechner/pi-agent-core";
+import { registerBuiltInApiProviders } from "@mariozechner/pi-ai";
+
+// src/agent/providers.ts
+import { getEnvApiKey, getModel } from "@mariozechner/pi-ai";
+var AGENT_PROVIDERS = {
+  [AgentProviderIds.claude]: {
+    piAiProvider: "anthropic",
+    label: "Anthropic (Claude)",
+    defaultModel: "claude-opus-4-7",
+    autoDetectPriority: 0
+  },
+  [AgentProviderIds.openai]: {
+    piAiProvider: "openai",
+    label: "OpenAI",
+    defaultModel: "gpt-5.1",
+    autoDetectPriority: 1
+  },
+  [AgentProviderIds.gemini]: {
+    piAiProvider: "google",
+    label: "Google (Gemini)",
+    defaultModel: "gemini-2.5-pro",
+    autoDetectPriority: 2
+  },
+  [AgentProviderIds.zai]: {
+    piAiProvider: "zai",
+    label: "Z.ai (GLM)",
+    defaultModel: "glm-5.1",
+    autoDetectPriority: 3
   }
-  return hostname.replace(/^www\./, "");
+};
+function agentProvidersByPriority() {
+  return Object.keys(AGENT_PROVIDERS).slice().sort((a, b) => AGENT_PROVIDERS[a].autoDetectPriority - AGENT_PROVIDERS[b].autoDetectPriority);
 }
-function fetchWithPinnedAddress(target) {
-  return new Promise((resolve) => {
-    const port = target.url.port ? Number(target.url.port) : 443;
-    const path9 = target.url.pathname + target.url.search;
-    const req = https2.request(
-      {
-        hostname: target.address,
-        family: target.family,
-        port,
-        path: path9,
-        method: "GET",
-        timeout: FETCH_TIMEOUT_MS,
-        servername: target.url.hostname,
-        // SNI for TLS
-        headers: {
-          Host: target.url.host,
-          "User-Agent": USER_AGENT,
-          Accept: "text/html"
-        }
-      },
-      (res) => {
-        if (res.statusCode && (res.statusCode < 200 || res.statusCode >= 300)) {
-          if (res.statusCode >= 300 && res.statusCode < 400) {
-            const location = res.headers.location ?? "";
-            res.resume();
-            resolve(`REDIRECT:${location}`);
-            return;
-          }
-          res.resume();
-          resolve("");
-          return;
-        }
-        const contentType = res.headers["content-type"] ?? "";
-        if (!contentType.includes("text/html")) {
-          res.resume();
-          resolve("");
-          return;
-        }
-        const chunks = [];
-        let totalBytes = 0;
-        res.on("data", (chunk) => {
-          totalBytes += chunk.length;
-          if (totalBytes <= MAX_BODY_BYTES) {
-            chunks.push(chunk);
-          }
-        });
-        res.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-        res.on("error", () => resolve(""));
-      }
+function listAgentProviders() {
+  return AGENT_PROVIDER_IDS;
+}
+function getAgentProvider(name) {
+  return AGENT_PROVIDERS[name];
+}
+function coerceAgentProvider(value) {
+  if (!value) return void 0;
+  return isAgentProviderId(value) ? value : void 0;
+}
+function resolveModelForProvider(provider, modelId) {
+  const entry = AGENT_PROVIDERS[provider];
+  const id = modelId ?? entry.defaultModel;
+  const model = getModel(entry.piAiProvider, id);
+  if (!model) {
+    throw new Error(
+      `Model '${id}' not found for pi-ai provider '${entry.piAiProvider}'. Verify AGENT_PROVIDERS[${provider}].defaultModel against the installed @mariozechner/pi-ai catalog.`
     );
-    req.on("timeout", () => req.destroy(new Error("timeout")));
-    req.on("error", () => resolve(""));
-    req.end();
-  });
+  }
+  return model;
 }
-async function fetchSiteText(domain) {
-  const hostname = extractHostname(domain);
-  const url = `https://${hostname}`;
-  const targetCheck = await resolveWebhookTarget(url);
-  if (!targetCheck.ok) return "";
-  try {
-    const result = await fetchWithPinnedAddress(targetCheck.target);
-    if (result.startsWith("REDIRECT:")) {
-      const location = result.slice("REDIRECT:".length);
-      if (!location) return "";
-      const redirectUrl = new URL(location, url).href;
-      const redirectCheck = await resolveWebhookTarget(redirectUrl);
-      if (!redirectCheck.ok) return "";
-      const redirectResult = await fetchWithPinnedAddress(redirectCheck.target);
-      if (redirectResult.startsWith("REDIRECT:")) return "";
-      return stripHtml2(redirectResult);
-    }
-    return stripHtml2(result);
-  } catch {
-    return "";
+function validateAgentProviderRegistry() {
+  for (const provider of listAgentProviders()) {
+    resolveModelForProvider(provider);
   }
 }
-function stripHtml2(html) {
-  if (!html) return "";
-  let text = html.replace(/<script[\s\S]*?<\/script>/gi, " ");
-  text = text.replace(/<style[\s\S]*?<\/style>/gi, " ");
-  text = text.replace(/<[^>]+>/g, " ");
-  text = text.replace(/&amp;/g, "&");
-  text = text.replace(/&lt;/g, "<");
-  text = text.replace(/&gt;/g, ">");
-  text = text.replace(/&quot;/g, '"');
-  text = text.replace(/&#39;/g, "'");
-  text = text.replace(/&nbsp;/g, " ");
-  text = text.replace(/\s+/g, " ").trim();
-  if (text.length > MAX_TEXT_LENGTH) {
-    text = text.slice(0, MAX_TEXT_LENGTH);
+function resolveApiKeyFor(providerOrPiAi, config) {
+  return resolveApiKeySource(providerOrPiAi, config)?.key;
+}
+function resolveApiKeySource(providerOrPiAi, config) {
+  const id = resolveAgentId(providerOrPiAi);
+  if (!id) return void 0;
+  const entry = AGENT_PROVIDERS[id];
+  const fromConfig = config.providers?.[id]?.apiKey;
+  if (fromConfig) return { key: fromConfig, source: "config" };
+  const fromEnv = getEnvApiKey(entry.piAiProvider);
+  if (fromEnv) return { key: fromEnv, source: "env" };
+  return void 0;
+}
+function resolveAgentId(providerOrPiAi) {
+  if (isAgentProviderId(providerOrPiAi)) return providerOrPiAi;
+  for (const id of AGENT_PROVIDER_IDS) {
+    if (AGENT_PROVIDERS[id].piAiProvider === providerOrPiAi) return id;
   }
-  return text;
+  return void 0;
+}
+function buildAgentProvidersResponse(config) {
+  const providers = listAgentProviders().map((id) => {
+    const entry = AGENT_PROVIDERS[id];
+    const source = resolveApiKeySource(id, config);
+    return {
+      id,
+      label: entry.label,
+      defaultModel: entry.defaultModel,
+      configured: source !== void 0,
+      keySource: source?.source ?? null
+    };
+  });
+  const firstConfigured = agentProvidersByPriority().find((p) => resolveApiKeySource(p, config));
+  return {
+    providers,
+    defaultProvider: firstConfigured ?? null
+  };
 }
 
-// src/snapshot-format.ts
-function formatAuditFactorScore(factor) {
-  return `${factor.score}/100 (${factor.weight}% weight)`;
+// src/agent/skill-paths.ts
+import fs5 from "fs";
+import path6 from "path";
+import { fileURLToPath } from "url";
+function resolveAeroSkillDir(pkgDir) {
+  const here = pkgDir ?? path6.dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    path6.join(here, "../assets/agent-workspace/skills/aero"),
+    path6.join(here, "../../assets/agent-workspace/skills/aero"),
+    path6.join(here, "../../../../skills/aero")
+  ];
+  for (const candidate of candidates) {
+    if (fs5.existsSync(path6.join(candidate, "SKILL.md"))) return candidate;
+  }
+  throw new Error(`Aero skill not found. Searched:
+  ${candidates.join("\n  ")}`);
 }
 
-// src/snapshot-service.ts
-var log7 = createLogger("Snapshot");
-var ANALYSIS_PROVIDER_PRIORITY = ["openai", "claude", "gemini", "perplexity", "local"];
-var SNAPSHOT_QUERY_COUNT = 6;
-var ProviderExecutionGate2 = class {
-  constructor(maxConcurrency, maxPerMinute) {
-    this.maxConcurrency = maxConcurrency;
-    this.maxPerMinute = maxPerMinute;
+// src/agent/skill-tools.ts
+import fs6 from "fs";
+import path7 from "path";
+import { Type } from "@sinclair/typebox";
+var MAX_DOC_CHARS = 2e4;
+function textResult(details) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(details, null, 2) }],
+    details
+  };
+}
+function parseDescription(body) {
+  if (!body.startsWith("---")) return "(no description)";
+  const end = body.indexOf("\n---", 3);
+  if (end === -1) return "(no description)";
+  const block = body.slice(3, end);
+  for (const line of block.split("\n")) {
+    const match = line.match(/^description:\s*(.+)$/);
+    if (match) return match[1].trim().replace(/^["']|["']$/g, "");
+  }
+  return "(no description)";
+}
+function scanSkillDocs(skillDir) {
+  const refsDir = path7.join(skillDir ?? resolveAeroSkillDir(), "references");
+  if (!fs6.existsSync(refsDir)) return [];
+  const entries = [];
+  for (const file of fs6.readdirSync(refsDir)) {
+    if (!file.endsWith(".md")) continue;
+    const filePath = path7.join(refsDir, file);
+    const body = fs6.readFileSync(filePath, "utf-8");
+    entries.push({
+      slug: file.replace(/\.md$/, ""),
+      description: parseDescription(body),
+      bytes: Buffer.byteLength(body, "utf-8")
+    });
   }
-  window = [];
-  waiters = [];
-  rateLimitChain = Promise.resolve();
-  inFlight = 0;
-  async run(task) {
-    await this.acquire();
-    try {
-      await this.waitForRateLimit();
-      return await task();
-    } finally {
-      this.release();
+  entries.sort((a, b) => a.slug.localeCompare(b.slug));
+  return entries;
+}
+var ListSchema = Type.Object({});
+function buildListSkillDocsTool() {
+  return {
+    name: "list_skill_docs",
+    label: "List skill docs",
+    description: "List reference playbooks bundled with the Aero skill. Each entry has a slug, a short description of when to use it, and byte size. Call this before read_skill_doc to pick the right doc.",
+    parameters: ListSchema,
+    execute: async () => {
+      return textResult({ docs: scanSkillDocs() });
+    }
+  };
+}
+var ReadSchema = Type.Object({
+  slug: Type.String({
+    description: "Doc slug (no extension, no path). Must match a slug from list_skill_docs \u2014 unknown slugs return an error listing valid options."
+  })
+});
+function buildReadSkillDocTool() {
+  return {
+    name: "read_skill_doc",
+    label: "Read skill doc",
+    description: 'Load the full content of a reference playbook by slug. Use when a task matches one of the docs returned by list_skill_docs \u2014 e.g. "regression-playbook" when investigating lost citations.',
+    parameters: ReadSchema,
+    execute: async (_toolCallId, params) => {
+      const skillDir = resolveAeroSkillDir();
+      const docs = scanSkillDocs(skillDir);
+      const match = docs.find((d) => d.slug === params.slug);
+      if (!match) {
+        return textResult({
+          error: `Unknown slug "${params.slug}".`,
+          availableSlugs: docs.map((d) => d.slug)
+        });
+      }
+      const filePath = path7.join(skillDir, "references", `${match.slug}.md`);
+      const content = fs6.readFileSync(filePath, "utf-8");
+      if (content.length > MAX_DOC_CHARS) {
+        return textResult({
+          slug: match.slug,
+          content: content.slice(0, MAX_DOC_CHARS),
+          truncated: true,
+          totalBytes: match.bytes
+        });
+      }
+      return textResult({ slug: match.slug, content, truncated: false });
+    }
+  };
+}
+function buildSkillDocTools() {
+  return [
+    buildListSkillDocsTool(),
+    buildReadSkillDocTool()
+  ];
+}
+
+// src/agent/tools.ts
+import { Type as Type2 } from "@sinclair/typebox";
+var MAX_TOOL_RESULT_CHARS = 2e4;
+function truncate(json) {
+  if (json.length <= MAX_TOOL_RESULT_CHARS) return json;
+  return json.slice(0, MAX_TOOL_RESULT_CHARS) + "\n... (truncated \u2014 result too large)";
+}
+function textResult2(details) {
+  return {
+    content: [{ type: "text", text: truncate(JSON.stringify(details, null, 2)) }],
+    details
+  };
+}
+var StatusSchema = Type2.Object({
+  runLimit: Type2.Optional(
+    Type2.Number({
+      description: "Max recent runs to include. Default 5.",
+      minimum: 1,
+      maximum: 50
+    })
+  )
+});
+function buildGetStatusTool(ctx) {
+  return {
+    name: "get_status",
+    label: "Get status",
+    description: "Current project overview with its most recent runs.",
+    parameters: StatusSchema,
+    execute: async (_toolCallId, params) => {
+      const runLimit = params.runLimit ?? 5;
+      const [project, runs2] = await Promise.all([
+        ctx.client.getProject(ctx.projectName),
+        ctx.client.listRuns(ctx.projectName, runLimit)
+      ]);
+      return textResult2({ project, runs: runs2 });
+    }
+  };
+}
+var HealthSchema = Type2.Object({});
+function buildGetHealthTool(ctx) {
+  return {
+    name: "get_health",
+    label: "Get health",
+    description: "Latest visibility health snapshot including overall cited rate, pair counts, and per-provider breakdown.",
+    parameters: HealthSchema,
+    execute: async () => {
+      const health = await ctx.client.getHealth(ctx.projectName);
+      return textResult2(health);
+    }
+  };
+}
+var TimelineSchema = Type2.Object({
+  keyword: Type2.Optional(
+    Type2.String({
+      description: "Restrict the timeline to a single keyword. Omit to return all keywords."
+    })
+  )
+});
+function buildGetTimelineTool(ctx) {
+  return {
+    name: "get_timeline",
+    label: "Get timeline",
+    description: "Per-keyword citation timeline showing how visibility evolved across runs. Use to identify regressions, emerging citations, or competitor movement.",
+    parameters: TimelineSchema,
+    execute: async (_toolCallId, params) => {
+      const timeline = await ctx.client.getTimeline(ctx.projectName);
+      const filtered = params.keyword ? timeline.filter((row) => row.keyword === params.keyword) : timeline;
+      return textResult2(filtered);
+    }
+  };
+}
+var InsightsSchema = Type2.Object({
+  includeDismissed: Type2.Optional(
+    Type2.Boolean({
+      description: "Include dismissed insights. Default false (only active insights)."
+    })
+  ),
+  runId: Type2.Optional(
+    Type2.String({
+      description: "Restrict insights to a specific run id. Omit for all runs."
+    })
+  )
+});
+function buildGetInsightsTool(ctx) {
+  return {
+    name: "get_insights",
+    label: "Get insights",
+    description: "Insights produced by the canonry intelligence engine \u2014 regressions, gains, and opportunities with cause/recommendation metadata. Query this before re-deriving conclusions from raw timeline data.",
+    parameters: InsightsSchema,
+    execute: async (_toolCallId, params) => {
+      const insights2 = await ctx.client.getInsights(ctx.projectName, {
+        dismissed: params.includeDismissed,
+        runId: params.runId
+      });
+      return textResult2(insights2);
+    }
+  };
+}
+var KeywordsSchema = Type2.Object({});
+function buildListKeywordsTool(ctx) {
+  return {
+    name: "list_keywords",
+    label: "List keywords",
+    description: "All keywords currently tracked for this project.",
+    parameters: KeywordsSchema,
+    execute: async () => {
+      const keywords2 = await ctx.client.listKeywords(ctx.projectName);
+      return textResult2(keywords2);
+    }
+  };
+}
+var CompetitorsSchema = Type2.Object({});
+function buildListCompetitorsTool(ctx) {
+  return {
+    name: "list_competitors",
+    label: "List competitors",
+    description: "Competitor domains tracked alongside this project for side-by-side comparison.",
+    parameters: CompetitorsSchema,
+    execute: async () => {
+      const competitors2 = await ctx.client.listCompetitors(ctx.projectName);
+      return textResult2(competitors2);
+    }
+  };
+}
+var RunDetailSchema = Type2.Object({
+  runId: Type2.String({
+    description: "Run id (UUID) to fetch. Typically obtained from get_status runs[].id."
+  })
+});
+function buildGetRunTool(ctx) {
+  return {
+    name: "get_run",
+    label: "Get run detail",
+    description: "Full detail for a specific run including per-keyword snapshots, error messages, and provider breakdown. Use to investigate failed runs or drill into a particular sweep.",
+    parameters: RunDetailSchema,
+    execute: async (_toolCallId, params) => {
+      const run = await ctx.client.getRun(params.runId);
+      return textResult2(run);
+    }
+  };
+}
+function buildReadTools(ctx) {
+  return [
+    buildGetStatusTool(ctx),
+    buildGetHealthTool(ctx),
+    buildGetTimelineTool(ctx),
+    buildGetInsightsTool(ctx),
+    buildListKeywordsTool(ctx),
+    buildListCompetitorsTool(ctx),
+    buildGetRunTool(ctx)
+  ];
+}
+var RunSweepSchema = Type2.Object({
+  providers: Type2.Optional(
+    Type2.Array(Type2.String(), {
+      description: "Subset of providers to run. Omit to use every configured provider on the project."
+    })
+  ),
+  noLocation: Type2.Optional(
+    Type2.Boolean({
+      description: "Run without a location context. Default: use the project default location."
+    })
+  )
+});
+function buildRunSweepTool(ctx) {
+  return {
+    name: "run_sweep",
+    label: "Trigger sweep",
+    description: "Trigger a new answer-visibility sweep for this project across configured AI providers. Returns the run id(s). Use when fresh citation data is needed.",
+    parameters: RunSweepSchema,
+    execute: async (_toolCallId, params) => {
+      const body = {};
+      if (params.providers?.length) body.providers = params.providers;
+      if (params.noLocation) body.noLocation = true;
+      const result = await ctx.client.triggerRun(ctx.projectName, body);
+      return textResult2(result);
+    }
+  };
+}
+var DismissInsightSchema = Type2.Object({
+  insightId: Type2.String({
+    description: "Insight id to dismiss. Obtain from get_insights details[].id."
+  })
+});
+function buildDismissInsightTool(ctx) {
+  return {
+    name: "dismiss_insight",
+    label: "Dismiss insight",
+    description: "Mark an insight as dismissed so it no longer surfaces in active insight lists. Reversible via the dashboard.",
+    parameters: DismissInsightSchema,
+    execute: async (_toolCallId, params) => {
+      const result = await ctx.client.dismissInsight(ctx.projectName, params.insightId);
+      return textResult2(result);
+    }
+  };
+}
+var AddKeywordsSchema = Type2.Object({
+  keywords: Type2.Array(Type2.String(), {
+    minItems: 1,
+    description: "Keywords to add to the tracking list. Duplicates against existing keywords are ignored server-side."
+  })
+});
+function buildAddKeywordsTool(ctx) {
+  return {
+    name: "add_keywords",
+    label: "Add keywords",
+    description: "Append keywords to the project tracking list. Additive only \u2014 existing keywords are preserved. Use exact phrasing you want tracked.",
+    parameters: AddKeywordsSchema,
+    execute: async (_toolCallId, params) => {
+      await ctx.client.appendKeywords(ctx.projectName, params.keywords);
+      return textResult2({ added: params.keywords });
+    }
+  };
+}
+var AddCompetitorsSchema = Type2.Object({
+  domains: Type2.Array(Type2.String(), {
+    minItems: 1,
+    description: 'Competitor domains to track. Provide bare domains (e.g. "example.com"), not URLs.'
+  })
+});
+function buildAddCompetitorsTool(ctx) {
+  return {
+    name: "add_competitors",
+    label: "Add competitors",
+    description: "Append competitor domains to the project. Fetches the current set, merges with the requested domains (dedup on exact domain match), and persists the combined list.",
+    parameters: AddCompetitorsSchema,
+    execute: async (_toolCallId, params) => {
+      const existing = await ctx.client.listCompetitors(ctx.projectName);
+      const existingDomains = new Set(existing.map((c) => c.domain));
+      const newDomains = params.domains.filter((d) => !existingDomains.has(d));
+      if (newDomains.length === 0) {
+        return textResult2({ added: [], alreadyTracked: params.domains });
+      }
+      const merged = [...existing.map((c) => c.domain), ...newDomains];
+      await ctx.client.putCompetitors(ctx.projectName, merged);
+      return textResult2({ added: newDomains, alreadyTracked: params.domains.filter((d) => existingDomains.has(d)) });
+    }
+  };
+}
+var UpdateScheduleSchema = Type2.Object({
+  cron: Type2.Optional(
+    Type2.String({ description: 'Cron expression (e.g. "0 */6 * * *"). Provide cron OR preset, not both.' })
+  ),
+  preset: Type2.Optional(
+    Type2.String({ description: 'Preset keyword (e.g. "daily", "hourly"). Provide cron OR preset, not both.' })
+  ),
+  timezone: Type2.Optional(Type2.String({ description: 'IANA timezone. Default: "UTC".' })),
+  enabled: Type2.Optional(
+    Type2.Boolean({ description: "Whether the schedule is active. Default: true." })
+  ),
+  providers: Type2.Optional(
+    Type2.Array(Type2.String(), {
+      description: "Providers to run on each scheduled sweep. Omit to use all configured providers."
+    })
+  )
+});
+function buildUpdateScheduleTool(ctx) {
+  return {
+    name: "update_schedule",
+    label: "Update schedule",
+    description: "Create or update the recurring sweep schedule for this project. Provide exactly one of `cron` (expression) or `preset` (keyword). Fully replaces any existing schedule.",
+    parameters: UpdateScheduleSchema,
+    execute: async (_toolCallId, params) => {
+      if (params.cron && params.preset || !params.cron && !params.preset) {
+        throw new Error("update_schedule: provide exactly one of `cron` or `preset`");
+      }
+      const body = {};
+      if (params.cron) body.cron = params.cron;
+      if (params.preset) body.preset = params.preset;
+      if (params.timezone) body.timezone = params.timezone;
+      if (params.enabled !== void 0) body.enabled = params.enabled;
+      if (params.providers?.length) body.providers = params.providers;
+      const result = await ctx.client.putSchedule(ctx.projectName, body);
+      return textResult2(result);
+    }
+  };
+}
+var AttachAgentWebhookSchema = Type2.Object({
+  url: Type2.String({
+    description: "External agent webhook URL. Canonry will POST run.completed, insight.critical, insight.high, and citation.gained events to it."
+  })
+});
+function buildAttachAgentWebhookTool(ctx) {
+  return {
+    name: "attach_agent_webhook",
+    label: "Attach agent webhook",
+    description: "Register an external agent webhook for this project. Use when wiring a Claude Code / Codex / custom agent to receive canonry run and insight events. Idempotent \u2014 skips if one already exists.",
+    parameters: AttachAgentWebhookSchema,
+    execute: async (_toolCallId, params) => {
+      const existing = await ctx.client.listNotifications(ctx.projectName);
+      const hasAgent = existing.some((n) => n.source === "agent");
+      if (hasAgent) {
+        return textResult2({ status: "already-attached" });
+      }
+      const result = await ctx.client.createNotification(ctx.projectName, {
+        channel: "webhook",
+        url: params.url,
+        events: ["run.completed", "insight.critical", "insight.high", "citation.gained"],
+        source: "agent"
+      });
+      return textResult2({ status: "attached", notificationId: result.id, url: params.url });
+    }
+  };
+}
+function buildWriteTools(ctx) {
+  return [
+    buildRunSweepTool(ctx),
+    buildDismissInsightTool(ctx),
+    buildAddKeywordsTool(ctx),
+    buildAddCompetitorsTool(ctx),
+    buildUpdateScheduleTool(ctx),
+    buildAttachAgentWebhookTool(ctx)
+  ];
+}
+function buildAllTools(ctx) {
+  return [...buildReadTools(ctx), ...buildWriteTools(ctx)];
+}
+
+// src/agent/session.ts
+var builtinsRegistered = false;
+function ensureBuiltinsRegistered() {
+  if (!builtinsRegistered) {
+    registerBuiltInApiProviders();
+    validateAgentProviderRegistry();
+    builtinsRegistered = true;
+  }
+}
+function loadAeroSystemPrompt(pkgDir) {
+  const skillDir = resolveAeroSkillDir(pkgDir);
+  const skillBody = fs7.readFileSync(path8.join(skillDir, "SKILL.md"), "utf-8");
+  const soulPath = path8.join(skillDir, "soul.md");
+  if (!fs7.existsSync(soulPath)) return skillBody;
+  const soulBody = fs7.readFileSync(soulPath, "utf-8");
+  return `${soulBody.trimEnd()}
+
+---
+
+${skillBody}`;
+}
+function missingProviderMessage() {
+  const configHints = agentProvidersByPriority().join(", ");
+  const envHints = agentProvidersByPriority().map((p) => `${AGENT_PROVIDERS[p].piAiProvider.toUpperCase()}_API_KEY`).join(" / ");
+  return `No agent LLM provider configured. Add an API key for one of: ${configHints} in ~/.canonry/config.yaml, or export ${envHints}.`;
+}
+function detectAgentProvider(config) {
+  for (const provider of agentProvidersByPriority()) {
+    if (resolveApiKeyFor(provider, config)) return provider;
+  }
+  return void 0;
+}
+function resolveAeroModel(provider, modelId) {
+  ensureBuiltinsRegistered();
+  return resolveModelForProvider(provider, modelId);
+}
+function buildApiKeyResolver(config) {
+  return (piAiProvider) => resolveApiKeyFor(piAiProvider, config);
+}
+function createAeroSession(opts) {
+  const systemPrompt = opts.systemPromptOverride ?? loadAeroSystemPrompt();
+  const provider = opts.provider ?? detectAgentProvider(opts.config);
+  if (!provider) throw new Error(missingProviderMessage());
+  const model = resolveAeroModel(provider, opts.modelId);
+  const toolScope = opts.toolScope ?? "all";
+  const stateTools = toolScope === "read-only" ? buildReadTools({ client: opts.client, projectName: opts.projectName }) : buildAllTools({ client: opts.client, projectName: opts.projectName });
+  const defaultTools = [...stateTools, ...buildSkillDocTools()];
+  const tools = opts.tools ?? defaultTools;
+  return new Agent({
+    initialState: {
+      systemPrompt,
+      model,
+      tools,
+      ...opts.initialMessages ? { messages: opts.initialMessages } : {}
+    },
+    streamFn: opts.streamFn,
+    getApiKey: buildApiKeyResolver(opts.config)
+  });
+}
+function resolveSessionProviderAndModel(config, opts) {
+  const provider = opts?.provider ?? detectAgentProvider(config);
+  if (!provider) throw new Error(missingProviderMessage());
+  const modelId = opts?.modelId ?? getAgentProvider(provider).defaultModel;
+  return { provider, modelId };
+}
+
+// src/agent/session-registry.ts
+var log7 = createLogger("SessionRegistry");
+var SessionRegistry = class {
+  live = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  /** Last tool scope used on the live Agent for a project. Read in getOrCreate to know when to swap. */
+  scopes = /* @__PURE__ */ new Map();
+  opts;
+  constructor(opts) {
+    this.opts = opts;
+  }
+  /** Read-only access to the config snapshot the registry was built with. */
+  getConfig() {
+    return this.opts.config;
+  }
+  /**
+   * Returns the live Agent for a project, hydrating from DB or creating
+   * fresh. Applies caller preferences on fresh/hydrated construction. Does
+   * NOT mutate an already-cached Agent — that path goes through
+   * `acquireForTurn`, which gates scope/model changes behind a busy check
+   * so an in-flight turn can't have its tools swapped out from under it.
+   */
+  getOrCreate(projectName, preferences) {
+    const cached = this.live.get(projectName);
+    if (cached) return cached;
+    const projectId = this.resolveProjectId(projectName);
+    const row = this.loadRow(projectId);
+    if (row) {
+      const persistedMessages = parseJsonColumn(row.messages, []);
+      const queued = parseJsonColumn(row.followUpQueue, []);
+      const effectiveProvider = preferences?.provider ?? row.modelProvider;
+      const effectiveModelId = preferences?.modelId ?? row.modelId;
+      if (preferences?.provider || preferences?.modelId) {
+        this.opts.db.update(agentSessions).set({
+          modelProvider: effectiveProvider,
+          modelId: effectiveModelId,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }).where(eq23(agentSessions.projectId, projectId)).run();
+      }
+      const agent2 = createAeroSession({
+        projectName,
+        client: this.opts.client,
+        config: this.opts.config,
+        provider: effectiveProvider,
+        modelId: effectiveModelId,
+        systemPromptOverride: row.systemPrompt,
+        initialMessages: persistedMessages,
+        toolScope: preferences?.toolScope
+      });
+      this.scopes.set(projectName, preferences?.toolScope ?? "all");
+      if (queued.length > 0) {
+        this.appendPending(projectName, queued);
+        this.updateRow(projectId, { followUpQueue: "[]" });
+      }
+      this.live.set(projectName, agent2);
+      this.registerDrainHook(agent2, projectName);
+      return agent2;
+    }
+    const { provider, modelId } = resolveSessionProviderAndModel(this.opts.config, preferences);
+    const systemPrompt = loadAeroSystemPrompt();
+    const agent = createAeroSession({
+      projectName,
+      client: this.opts.client,
+      config: this.opts.config,
+      provider,
+      modelId,
+      systemPromptOverride: systemPrompt,
+      toolScope: preferences?.toolScope
+    });
+    this.scopes.set(projectName, preferences?.toolScope ?? "all");
+    this.insertRow({
+      projectId,
+      systemPrompt,
+      modelProvider: provider,
+      modelId,
+      messages: [],
+      followUpQueue: []
+    });
+    this.live.set(projectName, agent);
+    this.registerDrainHook(agent, projectName);
+    return agent;
+  }
+  /**
+   * Acquire the Agent for an upcoming prompt/turn.
+   *
+   * Busy-check runs FIRST, before any state mutation — if two requests race
+   * on the same project, one gets the 409 and the other's in-flight turn is
+   * untouched. Only after confirming idle do we:
+   *   - align `state.tools` to the requested scope (CLI full vs dashboard
+   *     read-only share the same cached Agent; each request re-scopes it).
+   *   - align `state.model` when the caller passes `provider` or `modelId`,
+   *     honoring `--provider` / `--model` on hot sessions (not just on
+   *     fresh/hydrated construction).
+   *
+   * Persists the new model choice to the DB row so subsequent invocations
+   * stay on it unless overridden again.
+   */
+  acquireForTurn(projectName, preferences) {
+    const agent = this.getOrCreate(projectName);
+    if (agent.state.isStreaming) {
+      throw agentBusy(projectName);
+    }
+    this.alignScope(projectName, agent, preferences?.toolScope ?? "all");
+    if (preferences?.provider || preferences?.modelId) {
+      this.alignModel(projectName, agent, preferences);
+    }
+    return agent;
+  }
+  alignScope(projectName, agent, wantScope) {
+    if (this.scopes.get(projectName) === wantScope) return;
+    const stateTools = wantScope === "read-only" ? buildReadTools({ client: this.opts.client, projectName }) : buildAllTools({ client: this.opts.client, projectName });
+    agent.state.tools = [...stateTools, ...buildSkillDocTools()];
+    this.scopes.set(projectName, wantScope);
+  }
+  alignModel(projectName, agent, preferences) {
+    const projectId = this.tryResolveProjectId(projectName);
+    if (!projectId) return;
+    const row = this.loadRow(projectId);
+    const currentProvider = row?.modelProvider ?? AgentProviderIds.claude;
+    const currentModelId = row?.modelId;
+    const nextProvider = preferences.provider ?? currentProvider;
+    const nextModelId = preferences.modelId ?? (preferences.provider ? getAgentProvider(nextProvider).defaultModel : currentModelId);
+    if (!nextModelId) return;
+    if (nextProvider === currentProvider && nextModelId === currentModelId) return;
+    agent.state.model = resolveAeroModel(nextProvider, nextModelId);
+    this.opts.db.update(agentSessions).set({
+      modelProvider: nextProvider,
+      modelId: nextModelId,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }).where(eq23(agentSessions.projectId, projectId)).run();
+  }
+  /** Persist a session's transcript back to the DB. Call after any run settles. */
+  save(projectName) {
+    const agent = this.live.get(projectName);
+    if (!agent) return;
+    const projectId = this.resolveProjectId(projectName);
+    this.updateRow(projectId, {
+      messages: JSON.stringify(agent.state.messages)
+    });
+  }
+  /**
+   * Enqueue a message for the next turn.
+   *
+   * - Live session exists: append to the in-memory pending queue. The next
+   *   `consumePending`-backed prompt, a `drainNow` call, or the post-`agent_end`
+   *   drain hook will process it.
+   * - No live session: persist to the DB follow-up queue. The next
+   *   `getOrCreate` hydrates the agent and migrates the queue into pending.
+   *
+   * Crucially writes to exactly ONE of the two sinks to avoid the duplicate
+   * message we saw during the first end-to-end dogfood (run.completed fired,
+   * both the in-memory pending and the DB-queue migration produced copies).
+   */
+  queueFollowUp(projectName, message) {
+    if (this.live.has(projectName)) {
+      this.appendPending(projectName, [message]);
+    } else {
+      this.persistQueueAppend(projectName, message);
+    }
+  }
+  /** Consume (and clear) the pending queue for a project. Caller prompts with the result. */
+  consumePending(projectName) {
+    const msgs = this.pending.get(projectName) ?? [];
+    if (msgs.length === 0) return [];
+    this.pending.delete(projectName);
+    const projectId = this.tryResolveProjectId(projectName);
+    if (projectId) this.updateRow(projectId, { followUpQueue: "[]" });
+    return msgs;
+  }
+  /**
+   * Proactive drain — hydrate if needed, consume pending, prompt the agent.
+   *
+   * No-op when:
+   *   - there are no pending messages in memory AND no persisted queue in
+   *     the DB (post-restart / never-hydrated sessions still need to wake)
+   *   - the agent is currently streaming (it will pick them up on the next turn)
+   *
+   * Fire-and-forget safe: failures are logged, never thrown. This is what
+   * RunCoordinator calls after a run completes to wake Aero unprompted.
+   */
+  async drainNow(projectName) {
+    if (!this.hasPendingWork(projectName)) return;
+    try {
+      let agent;
+      try {
+        const scope = this.scopes.get(projectName) ?? "read-only";
+        agent = this.acquireForTurn(projectName, { toolScope: scope });
+      } catch (err) {
+        if (err.code === "AGENT_BUSY") return;
+        throw err;
+      }
+      const msgs = this.consumePending(projectName);
+      if (msgs.length === 0) return;
+      await agent.prompt(msgs);
+      this.save(projectName);
+    } catch (err) {
+      log7.error("drain.failed", {
+        projectName,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  /** Drop the live Agent for a project. Next lookup rehydrates from DB. */
+  evict(projectName) {
+    this.live.delete(projectName);
+  }
+  /**
+   * Authoritative reset for a project's session state. Drops the live Agent,
+   * clears the in-memory pending follow-up buffer, and forgets the cached
+   * tool scope. Caller is responsible for wiping the durable row; this only
+   * touches the in-process state the registry holds.
+   *
+   * Use this (not `evict`) when the caller guarantees the conversation is
+   * being wiped — e.g. `DELETE /agent/transcript`. `evict` alone leaves any
+   * in-memory follow-ups queued on a hot session, which would leak into the
+   * next turn after the reset.
+   */
+  reset(projectName) {
+    this.live.delete(projectName);
+    this.pending.delete(projectName);
+    this.scopes.delete(projectName);
+  }
+  /** Evict every live Agent. Durable state in DB is untouched. */
+  clear() {
+    this.live.clear();
+  }
+  /** Visible so tests can assert whether a session is hot. */
+  isLive(projectName) {
+    return this.live.has(projectName);
+  }
+  /** Visible so tests can peek at the pending queue without consuming. */
+  peekPending(projectName) {
+    return this.pending.get(projectName) ?? [];
+  }
+  // ──────────────────────────────────────────────────────────────────
+  /**
+   * True when there's in-memory pending work OR a persisted follow-up queue
+   * for this project. Checked by `drainNow` before doing any hydration work
+   * so proactive wake-up fires even on cold / post-restart sessions where
+   * the follow-up lives only in the DB row.
+   */
+  hasPendingWork(projectName) {
+    if ((this.pending.get(projectName) ?? []).length > 0) return true;
+    const projectId = this.tryResolveProjectId(projectName);
+    if (!projectId) return false;
+    const row = this.loadRow(projectId);
+    if (!row) return false;
+    return parseJsonColumn(row.followUpQueue, []).length > 0;
+  }
+  appendPending(projectName, messages) {
+    if (messages.length === 0) return;
+    const existing = this.pending.get(projectName) ?? [];
+    this.pending.set(projectName, [...existing, ...messages]);
+  }
+  persistQueueAppend(projectName, message) {
+    const projectId = this.tryResolveProjectId(projectName);
+    if (!projectId) return;
+    const row = this.loadRow(projectId);
+    if (!row) {
+      this.insertRow({
+        projectId,
+        systemPrompt: loadAeroSystemPrompt(),
+        ...resolveSessionProviderAndModel(this.opts.config),
+        messages: [],
+        followUpQueue: [message]
+      });
+      return;
+    }
+    const existing = parseJsonColumn(row.followUpQueue, []);
+    this.updateRow(projectId, { followUpQueue: JSON.stringify([...existing, message]) });
+  }
+  /**
+   * Subscribe to agent_end so any pending messages that landed during a run
+   * (from RunCoordinator callbacks or steered follow-ups) drain automatically
+   * after the current turn settles. Without this, a RunCoordinator event that
+   * arrives mid-CLI-turn would sit in pending until someone called drainNow.
+   */
+  registerDrainHook(agent, projectName) {
+    agent.subscribe((event) => {
+      if (event.type !== "agent_end") return;
+      if ((this.pending.get(projectName) ?? []).length === 0) return;
+      void this.drainNow(projectName);
+    });
+  }
+  resolveProjectId(projectName) {
+    const id = this.tryResolveProjectId(projectName);
+    if (!id) throw new Error(`Project "${projectName}" not found`);
+    return id;
+  }
+  tryResolveProjectId(projectName) {
+    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq23(projects.name, projectName)).get();
+    return row?.id;
+  }
+  loadRow(projectId) {
+    const row = this.opts.db.select().from(agentSessions).where(eq23(agentSessions.projectId, projectId)).get();
+    return row ?? null;
+  }
+  insertRow(params) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.opts.db.insert(agentSessions).values({
+      id: crypto22.randomUUID(),
+      projectId: params.projectId,
+      systemPrompt: params.systemPrompt,
+      modelProvider: params.provider ?? params.modelProvider ?? AgentProviderIds.claude,
+      modelId: params.modelId ?? "claude-opus-4-7",
+      messages: JSON.stringify(params.messages),
+      followUpQueue: JSON.stringify(params.followUpQueue),
+      createdAt: now,
+      updatedAt: now
+    }).run();
+  }
+  updateRow(projectId, patch) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq23(agentSessions.projectId, projectId)).run();
+  }
+};
+
+// src/agent/agent-routes.ts
+import { eq as eq24 } from "drizzle-orm";
+function resolveProject2(db, name) {
+  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq24(projects.name, name)).get();
+  if (!row) throw notFound("project", name);
+  return row;
+}
+function registerAgentRoutes(app, opts) {
+  app.get(
+    "/projects/:name/agent/transcript",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      const row = opts.db.select().from(agentSessions).where(eq24(agentSessions.projectId, project.id)).get();
+      if (!row) {
+        return { messages: [], modelProvider: null, modelId: null, updatedAt: null };
+      }
+      return {
+        messages: parseJsonColumn(row.messages, []),
+        modelProvider: row.modelProvider,
+        modelId: row.modelId,
+        updatedAt: row.updatedAt
+      };
+    }
+  );
+  app.get(
+    "/projects/:name/agent/providers",
+    async (request) => {
+      resolveProject2(opts.db, request.params.name);
+      return buildAgentProvidersResponse(opts.sessionRegistry.getConfig());
+    }
+  );
+  app.delete(
+    "/projects/:name/agent/transcript",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      opts.sessionRegistry.reset(project.name);
+      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq24(agentSessions.projectId, project.id)).run();
+      return { status: "reset" };
+    }
+  );
+  app.post("/projects/:name/agent/prompt", async (request, reply) => {
+    const project = resolveProject2(opts.db, request.params.name);
+    const promptText = (request.body?.prompt ?? "").trim();
+    if (!promptText) throw validationError('"prompt" is required');
+    const requestedScope = request.body?.scope === "all" ? "all" : "read-only";
+    const agent = opts.sessionRegistry.acquireForTurn(project.name, {
+      provider: request.body?.provider,
+      modelId: request.body?.modelId,
+      toolScope: requestedScope
+    });
+    reply.raw.writeHead(200, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      "Connection": "keep-alive",
+      "X-Accel-Buffering": "no"
+    });
+    const write = (payload) => {
+      if (reply.raw.writableEnded) return;
+      try {
+        reply.raw.write(`data: ${JSON.stringify(payload)}
+
+`);
+      } catch {
+      }
+    };
+    write({ type: "stream_open" });
+    const unsubscribe = agent.subscribe((event) => {
+      write(event);
+    });
+    reply.raw.once("close", () => {
+      if (!reply.raw.writableEnded) {
+        agent.abort();
+      }
+    });
+    try {
+      const pending = opts.sessionRegistry.consumePending(project.name);
+      const userMessage = {
+        role: "user",
+        content: promptText,
+        timestamp: Date.now()
+      };
+      const batch = pending.length > 0 ? [...pending, userMessage] : userMessage;
+      await agent.prompt(batch);
+      await agent.waitForIdle();
+      opts.sessionRegistry.save(project.name);
+    } catch (err) {
+      write({ type: "error", message: err instanceof Error ? err.message : String(err) });
+    } finally {
+      unsubscribe();
+      write({ type: "stream_close" });
+      if (!reply.raw.writableEnded) {
+        reply.raw.end();
+      }
+    }
+    return reply;
+  });
+}
+
+// src/client.ts
+function createApiClient() {
+  const config = loadConfig();
+  const basePathResolved = !!config.basePath || "CANONRY_BASE_PATH" in process.env;
+  return new ApiClient(config.apiUrl, config.apiKey, { skipProbe: basePathResolved });
+}
+var ApiClient = class {
+  baseUrl;
+  originUrl;
+  apiKey;
+  probePromise = null;
+  probeSkipped;
+  constructor(baseUrl, apiKey, opts) {
+    this.originUrl = baseUrl.replace(/\/$/, "");
+    this.baseUrl = this.originUrl + "/api/v1";
+    this.apiKey = apiKey;
+    this.probeSkipped = opts?.skipProbe ?? false;
+  }
+  /**
+   * On first API call, probe /health to auto-discover basePath when the user
+   * hasn't configured one locally. This lets `canonry run` in a separate shell
+   * discover that the server is running at e.g. /canonry/ without requiring
+   * config.yaml edits or CANONRY_BASE_PATH in every shell.
+   */
+  probeBasePath() {
+    if (this.probeSkipped) return Promise.resolve();
+    if (!this.probePromise) {
+      this.probePromise = (async () => {
+        try {
+          const origin = new URL(this.originUrl).origin;
+          const res = await fetch(`${origin}/health`, {
+            signal: AbortSignal.timeout(2e3)
+          });
+          if (res.ok) {
+            const body = await res.json();
+            if (body.basePath && typeof body.basePath === "string") {
+              const normalized = "/" + body.basePath.replace(/^\/|\/$/g, "");
+              if (normalized !== "/") {
+                this.originUrl = origin + normalized;
+                this.baseUrl = this.originUrl + "/api/v1";
+              }
+            }
+          }
+        } catch {
+        }
+      })();
+    }
+    return this.probePromise;
+  }
+  async request(method, path10, body) {
+    await this.probeBasePath();
+    const url = `${this.baseUrl}${path10}`;
+    const serializedBody = body != null ? JSON.stringify(body) : void 0;
+    const headers = {
+      "Authorization": `Bearer ${this.apiKey}`,
+      "Accept": "application/json",
+      ...serializedBody != null ? { "Content-Type": "application/json" } : {}
+    };
+    let res;
+    try {
+      res = await fetch(url, {
+        method,
+        headers,
+        body: serializedBody
+      });
+    } catch (err) {
+      if (err instanceof CliError) throw err;
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes("fetch failed") || msg.includes("ECONNREFUSED") || msg.includes("connect ECONNREFUSED")) {
+        throw new CliError({
+          code: "CONNECTION_ERROR",
+          message: `Could not connect to canonry server at ${this.baseUrl.replace("/api/v1", "")}. Start it with "canonry serve" (or "canonry serve &" to run in background).`,
+          exitCode: EXIT_SYSTEM_ERROR
+        });
+      }
+      throw new CliError({ code: "CONNECTION_ERROR", message: msg, exitCode: EXIT_SYSTEM_ERROR });
+    }
+    if (!res.ok) {
+      let errorBody;
+      try {
+        errorBody = await res.json();
+      } catch {
+        errorBody = { error: { code: "UNKNOWN", message: res.statusText } };
+      }
+      const errorObj = errorBody && typeof errorBody === "object" && "error" in errorBody && errorBody.error && typeof errorBody.error === "object" ? errorBody.error : null;
+      const msg = errorObj?.message ? String(errorObj.message) : `HTTP ${res.status}: ${res.statusText}`;
+      const code = errorObj?.code ? String(errorObj.code) : "API_ERROR";
+      const exitCode = res.status >= 500 ? EXIT_SYSTEM_ERROR : EXIT_USER_ERROR;
+      throw new CliError({ code, message: msg, exitCode });
+    }
+    if (res.status === 204) {
+      return void 0;
+    }
+    return await res.json();
+  }
+  async getAgentTranscript(project) {
+    return this.request(
+      "GET",
+      `/projects/${encodeURIComponent(project)}/agent/transcript`
+    );
+  }
+  async resetAgentTranscript(project) {
+    await this.request(
+      "DELETE",
+      `/projects/${encodeURIComponent(project)}/agent/transcript`
+    );
+  }
+  async listAgentProviders(project) {
+    return this.request(
+      "GET",
+      `/projects/${encodeURIComponent(project)}/agent/providers`
+    );
+  }
+  /**
+   * POST a request whose response body the caller intends to consume as a
+   * stream (e.g. the Aero agent SSE endpoint). Shares the probe + auth +
+   * structured-error behavior of `request()`; the caller reads `res.body`
+   * and releases the response when done.
+   */
+  async streamPost(path10, body, signal) {
+    await this.probeBasePath();
+    const url = `${this.baseUrl}${path10}`;
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      "Content-Type": "application/json",
+      Accept: "text/event-stream"
+    };
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body ?? {}),
+        signal
+      });
+    } catch (err) {
+      if (err instanceof CliError) throw err;
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes("fetch failed") || msg.includes("ECONNREFUSED") || msg.includes("connect ECONNREFUSED")) {
+        throw new CliError({
+          code: "CONNECTION_ERROR",
+          message: `Could not connect to canonry server at ${this.baseUrl.replace("/api/v1", "")}. Start it with "canonry serve" (or "canonry serve &" to run in background).`,
+          exitCode: EXIT_SYSTEM_ERROR
+        });
+      }
+      throw new CliError({ code: "CONNECTION_ERROR", message: msg, exitCode: EXIT_SYSTEM_ERROR });
+    }
+    if (!res.ok || !res.body) {
+      let errorBody;
+      try {
+        errorBody = await res.json();
+      } catch {
+        errorBody = { error: { code: "UNKNOWN", message: res.statusText } };
+      }
+      const errorObj = errorBody && typeof errorBody === "object" && "error" in errorBody && errorBody.error ? errorBody.error : null;
+      const msg = errorObj?.message ? String(errorObj.message) : `HTTP ${res.status}: ${res.statusText}`;
+      const code = errorObj?.code ? String(errorObj.code) : "API_ERROR";
+      const exitCode = res.status >= 500 ? EXIT_SYSTEM_ERROR : EXIT_USER_ERROR;
+      throw new CliError({ code, message: msg, exitCode });
+    }
+    return res;
+  }
+  async putProject(name, body) {
+    return this.request("PUT", `/projects/${encodeURIComponent(name)}`, body);
+  }
+  async listProjects() {
+    return this.request("GET", "/projects");
+  }
+  async getProject(name) {
+    return this.request("GET", `/projects/${encodeURIComponent(name)}`);
+  }
+  async deleteProject(name) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(name)}`);
+  }
+  async putKeywords(project, keywords2) {
+    await this.request("PUT", `/projects/${encodeURIComponent(project)}/keywords`, { keywords: keywords2 });
+  }
+  async listKeywords(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/keywords`);
+  }
+  async deleteKeywords(project, keywords2) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/keywords`, { keywords: keywords2 });
+  }
+  async appendKeywords(project, keywords2) {
+    await this.request("POST", `/projects/${encodeURIComponent(project)}/keywords`, { keywords: keywords2 });
+  }
+  async putCompetitors(project, competitors2) {
+    await this.request("PUT", `/projects/${encodeURIComponent(project)}/competitors`, { competitors: competitors2 });
+  }
+  async listCompetitors(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/competitors`);
+  }
+  async triggerRun(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/runs`, body ?? {});
+  }
+  async listRuns(project, limit) {
+    const query = limit != null ? `?limit=${encodeURIComponent(String(limit))}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/runs${query}`);
+  }
+  async getRun(id) {
+    return this.request("GET", `/runs/${encodeURIComponent(id)}`);
+  }
+  async cancelRun(id) {
+    return this.request("POST", `/runs/${encodeURIComponent(id)}/cancel`);
+  }
+  async getTimeline(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/timeline`);
+  }
+  async getHistory(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/history`);
+  }
+  async getExport(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/export`);
+  }
+  async apply(config) {
+    return this.request("POST", "/apply", config);
+  }
+  async getStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}`);
+  }
+  async getSettings() {
+    return this.request("GET", "/settings");
+  }
+  async createSnapshot(body) {
+    return this.request("POST", "/snapshot", body);
+  }
+  async updateProvider(name, body) {
+    return this.request("PUT", `/settings/providers/${encodeURIComponent(name)}`, body);
+  }
+  async putSchedule(project, body) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/schedule`, body);
+  }
+  async getSchedule(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/schedule`);
+  }
+  async deleteSchedule(project) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/schedule`);
+  }
+  async createNotification(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/notifications`, body);
+  }
+  async listNotifications(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/notifications`);
+  }
+  async deleteNotification(project, id) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/notifications/${encodeURIComponent(id)}`);
+  }
+  async testNotification(project, id) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/notifications/${encodeURIComponent(id)}/test`);
+  }
+  async addLocation(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/locations`, body);
+  }
+  async listLocations(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/locations`);
+  }
+  async removeLocation(project, label) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/locations/${encodeURIComponent(label)}`);
+  }
+  async setDefaultLocation(project, label) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/locations/default`, { label });
+  }
+  async getTelemetry() {
+    return this.request("GET", "/telemetry");
+  }
+  async updateTelemetry(enabled) {
+    return this.request("PUT", "/telemetry", { enabled });
+  }
+  async generateKeywords(project, provider, count) {
+    return this.request(
+      "POST",
+      `/projects/${encodeURIComponent(project)}/keywords/generate`,
+      { provider, count }
+    );
+  }
+  // Google connection management
+  async googleConnect(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/connect`, body);
+  }
+  async googleConnections(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/connections`);
+  }
+  async googleDisconnect(project, type) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/google/connections/${encodeURIComponent(type)}`);
+  }
+  async googleProperties(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/properties`);
+  }
+  async googleSetProperty(project, type, propertyId) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/google/connections/${encodeURIComponent(type)}/property`, { propertyId });
+  }
+  async googleSetSitemap(project, type, sitemapUrl) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/google/connections/${encodeURIComponent(type)}/sitemap`, { sitemapUrl });
+  }
+  // GSC data
+  async gscSync(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/gsc/sync`, body ?? {});
+  }
+  async gscPerformance(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/performance${qs}`);
+  }
+  async gscInspect(project, url) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/gsc/inspect`, { url });
+  }
+  async gscInspections(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/inspections${qs}`);
+  }
+  async gscDeindexed(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/deindexed`);
+  }
+  async gscCoverage(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/coverage`);
+  }
+  async gscCoverageHistory(project, params) {
+    const qs = params?.limit != null ? `?limit=${params.limit}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/coverage/history${qs}`);
+  }
+  async gscInspectSitemap(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/gsc/inspect-sitemap`, body ?? {});
+  }
+  async gscSitemaps(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/sitemaps`);
+  }
+  async gscDiscoverSitemaps(project) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/gsc/discover-sitemaps`, {});
+  }
+  // Analytics
+  async getAnalyticsMetrics(project, window) {
+    const qs = window ? `?window=${encodeURIComponent(window)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/analytics/metrics${qs}`);
+  }
+  async getAnalyticsGaps(project, window) {
+    const qs = window ? `?window=${encodeURIComponent(window)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/analytics/gaps${qs}`);
+  }
+  async getAnalyticsSources(project, window) {
+    const qs = window ? `?window=${encodeURIComponent(window)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/analytics/sources${qs}`);
+  }
+  // Google Indexing API
+  async googleRequestIndexing(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/indexing/request`, body);
+  }
+  // Bing Webmaster Tools
+  async bingConnect(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/bing/connect`, body);
+  }
+  async bingDisconnect(project) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/bing/disconnect`);
+  }
+  async bingStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/status`);
+  }
+  async bingSites(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/sites`);
+  }
+  async bingSetSite(project, siteUrl) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/bing/set-site`, { siteUrl });
+  }
+  async bingCoverage(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/coverage`);
+  }
+  async bingCoverageHistory(project, params) {
+    const qs = params?.limit != null ? `?limit=${params.limit}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/coverage/history${qs}`);
+  }
+  async bingInspections(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/inspections${qs}`);
+  }
+  async bingInspectUrl(project, url) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/bing/inspect-url`, { url });
+  }
+  async bingRequestIndexing(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/bing/request-indexing`, body);
+  }
+  async bingPerformance(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/performance${qs}`);
+  }
+  // CDP browser provider
+  async getCdpStatus() {
+    return this.request("GET", "/cdp/status");
+  }
+  async cdpScreenshot(query, targets) {
+    return this.request("POST", "/cdp/screenshot", { query, targets });
+  }
+  async getBrowserDiff(project, runId) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/runs/${encodeURIComponent(runId)}/browser-diff`);
+  }
+  // Google Analytics 4
+  async gaConnect(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/ga/connect`, body);
+  }
+  async gaDisconnect(project) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/ga/disconnect`);
+  }
+  async gaStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/status`);
+  }
+  async gaSync(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/ga/sync`, body ?? {});
+  }
+  async gaTraffic(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/traffic${qs}`);
+  }
+  async gaCoverage(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/coverage`);
+  }
+  async gaAiReferralHistory(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/ai-referral-history${qs}`);
+  }
+  async gaSocialReferralHistory(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/social-referral-history${qs}`);
+  }
+  async gaSocialReferralTrend(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/social-referral-trend`);
+  }
+  async gaAttributionTrend(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/attribution-trend`);
+  }
+  async gaSessionHistory(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/session-history${qs}`);
+  }
+  async wordpressConnect(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/connect`, body);
+  }
+  async wordpressDisconnect(project) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/wordpress/disconnect`);
+  }
+  async wordpressStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/status`);
+  }
+  async wordpressPages(project, env) {
+    const qs = env ? `?env=${encodeURIComponent(env)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/pages${qs}`);
+  }
+  async wordpressPage(project, slug, env) {
+    const params = new URLSearchParams({ slug });
+    if (env) params.set("env", env);
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/page?${params.toString()}`);
+  }
+  async wordpressCreatePage(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/pages`, body);
+  }
+  async wordpressUpdatePage(project, body) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/wordpress/page`, body);
+  }
+  async wordpressSetMeta(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/page/meta`, body);
+  }
+  async wordpressBulkSetMeta(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/pages/meta/bulk`, body);
+  }
+  async wordpressSchema(project, slug, env) {
+    const params = new URLSearchParams({ slug });
+    if (env) params.set("env", env);
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/schema?${params.toString()}`);
+  }
+  async wordpressSetSchema(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/schema/manual`, body);
+  }
+  async wordpressSchemaDeploy(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/schema/deploy`, body);
+  }
+  async wordpressSchemaStatus(project, env) {
+    const params = new URLSearchParams();
+    if (env) params.set("env", env);
+    const qs = params.toString();
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/schema/status${qs ? `?${qs}` : ""}`);
+  }
+  async wordpressOnboard(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/onboard`, body);
+  }
+  async wordpressLlmsTxt(project, env) {
+    const qs = env ? `?env=${encodeURIComponent(env)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/llms-txt${qs}`);
+  }
+  async wordpressSetLlmsTxt(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/llms-txt/manual`, body);
+  }
+  async wordpressAudit(project, env) {
+    const qs = env ? `?env=${encodeURIComponent(env)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/audit${qs}`);
+  }
+  async wordpressDiff(project, slug) {
+    const params = new URLSearchParams({ slug });
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/diff?${params.toString()}`);
+  }
+  async wordpressStagingStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/staging/status`);
+  }
+  async wordpressStagingPush(project) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/staging/push`);
+  }
+  // ── Intelligence ──────────────────────────────────────────────────────
+  async getInsights(project, opts) {
+    const params = new URLSearchParams();
+    if (opts?.dismissed) params.set("dismissed", "true");
+    if (opts?.runId) params.set("runId", opts.runId);
+    const qs = params.toString();
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/insights${qs ? `?${qs}` : ""}`);
+  }
+  async dismissInsight(project, id) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/insights/${encodeURIComponent(id)}/dismiss`);
+  }
+  async getHealth(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/health/latest`);
+  }
+  async getHealthHistory(project, limit) {
+    const qs = limit ? `?limit=${limit}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/health/history${qs}`);
+  }
+};
+
+// src/snapshot-service.ts
+import { runAeoAudit } from "@ainyc/aeo-audit";
+
+// src/site-fetch.ts
+import https2 from "https";
+var FETCH_TIMEOUT_MS = 1e4;
+var MAX_TEXT_LENGTH = 4e3;
+var MAX_BODY_BYTES = 512e3;
+var USER_AGENT = "Canonry/1.0 (site-analysis)";
+function extractHostname(domain) {
+  let hostname = domain;
+  try {
+    if (hostname.includes("://")) {
+      hostname = new URL(hostname).hostname;
+    }
+  } catch {
+  }
+  return hostname.replace(/^www\./, "");
+}
+function fetchWithPinnedAddress(target) {
+  return new Promise((resolve) => {
+    const port = target.url.port ? Number(target.url.port) : 443;
+    const path10 = target.url.pathname + target.url.search;
+    const req = https2.request(
+      {
+        hostname: target.address,
+        family: target.family,
+        port,
+        path: path10,
+        method: "GET",
+        timeout: FETCH_TIMEOUT_MS,
+        servername: target.url.hostname,
+        // SNI for TLS
+        headers: {
+          Host: target.url.host,
+          "User-Agent": USER_AGENT,
+          Accept: "text/html"
+        }
+      },
+      (res) => {
+        if (res.statusCode && (res.statusCode < 200 || res.statusCode >= 300)) {
+          if (res.statusCode >= 300 && res.statusCode < 400) {
+            const location = res.headers.location ?? "";
+            res.resume();
+            resolve(`REDIRECT:${location}`);
+            return;
+          }
+          res.resume();
+          resolve("");
+          return;
+        }
+        const contentType = res.headers["content-type"] ?? "";
+        if (!contentType.includes("text/html")) {
+          res.resume();
+          resolve("");
+          return;
+        }
+        const chunks = [];
+        let totalBytes = 0;
+        res.on("data", (chunk) => {
+          totalBytes += chunk.length;
+          if (totalBytes <= MAX_BODY_BYTES) {
+            chunks.push(chunk);
+          }
+        });
+        res.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+        res.on("error", () => resolve(""));
+      }
+    );
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", () => resolve(""));
+    req.end();
+  });
+}
+async function fetchSiteText(domain) {
+  const hostname = extractHostname(domain);
+  const url = `https://${hostname}`;
+  const targetCheck = await resolveWebhookTarget(url);
+  if (!targetCheck.ok) return "";
+  try {
+    const result = await fetchWithPinnedAddress(targetCheck.target);
+    if (result.startsWith("REDIRECT:")) {
+      const location = result.slice("REDIRECT:".length);
+      if (!location) return "";
+      const redirectUrl = new URL(location, url).href;
+      const redirectCheck = await resolveWebhookTarget(redirectUrl);
+      if (!redirectCheck.ok) return "";
+      const redirectResult = await fetchWithPinnedAddress(redirectCheck.target);
+      if (redirectResult.startsWith("REDIRECT:")) return "";
+      return stripHtml2(redirectResult);
+    }
+    return stripHtml2(result);
+  } catch {
+    return "";
+  }
+}
+function stripHtml2(html) {
+  if (!html) return "";
+  let text = html.replace(/<script[\s\S]*?<\/script>/gi, " ");
+  text = text.replace(/<style[\s\S]*?<\/style>/gi, " ");
+  text = text.replace(/<[^>]+>/g, " ");
+  text = text.replace(/&amp;/g, "&");
+  text = text.replace(/&lt;/g, "<");
+  text = text.replace(/&gt;/g, ">");
+  text = text.replace(/&quot;/g, '"');
+  text = text.replace(/&#39;/g, "'");
+  text = text.replace(/&nbsp;/g, " ");
+  text = text.replace(/\s+/g, " ").trim();
+  if (text.length > MAX_TEXT_LENGTH) {
+    text = text.slice(0, MAX_TEXT_LENGTH);
+  }
+  return text;
+}
+
+// src/snapshot-format.ts
+function formatAuditFactorScore(factor) {
+  return `${factor.score}/100 (${factor.weight}% weight)`;
+}
+
+// src/snapshot-service.ts
+var log8 = createLogger("Snapshot");
+var ANALYSIS_PROVIDER_PRIORITY = ["openai", "claude", "gemini", "perplexity", "local"];
+var SNAPSHOT_QUERY_COUNT = 6;
+var ProviderExecutionGate2 = class {
+  constructor(maxConcurrency, maxPerMinute) {
+    this.maxConcurrency = maxConcurrency;
+    this.maxPerMinute = maxPerMinute;
+  }
+  window = [];
+  waiters = [];
+  rateLimitChain = Promise.resolve();
+  inFlight = 0;
+  async run(task) {
+    await this.acquire();
+    try {
+      await this.waitForRateLimit();
+      return await task();
+    } finally {
+      this.release();
     }
   }
   async acquire() {
@@ -14943,7 +16586,7 @@ var SnapshotService = class {
       return mapAuditReport(report);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log7.warn("audit.failed", { homepageUrl, error: message });
+      log8.warn("audit.failed", { homepageUrl, error: message });
       return {
         url: homepageUrl,
         finalUrl: homepageUrl,
@@ -14973,7 +16616,7 @@ var SnapshotService = class {
           phrases: parsedPhrases
         };
       } catch (err) {
-        log7.warn("profile.generation-failed", {
+        log8.warn("profile.generation-failed", {
           domain: ctx.domain,
           provider: ctx.analysisProvider.adapter.name,
           error: err instanceof Error ? err.message : String(err)
@@ -15115,7 +16758,7 @@ var SnapshotService = class {
         recommendedActions: uniqueStrings(parsed.recommendedActions ?? []).slice(0, 4)
       };
     } catch (err) {
-      log7.warn("response.analysis-failed", {
+      log8.warn("response.analysis-failed", {
         provider: ctx.analysisProvider.adapter.name,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -15397,499 +17040,6 @@ function clipText(value, length) {
   return `${value.slice(0, length - 3)}...`;
 }
 
-// src/agent-manager.ts
-import { execFileSync, spawn } from "child_process";
-import fs5 from "fs";
-import path6 from "path";
-var log8 = createLogger("AgentManager");
-var PROCESS_MARKER = "canonry-openclaw-gateway";
-var AgentManager = class {
-  constructor(config, stateDir) {
-    this.config = config;
-    this.stateDir = stateDir;
-    this.processJsonPath = path6.join(stateDir, "process.json");
-  }
-  processJsonPath;
-  /**
-   * Check if the gateway process is running.
-   * Cleans up stale process.json if the process is dead or belongs to a
-   * different process (PID reuse).
-   */
-  status() {
-    const info = this.readProcessInfo();
-    if (!info) {
-      return { state: "stopped" };
-    }
-    if (info.marker !== PROCESS_MARKER) {
-      this.removeProcessJson();
-      return { state: "stopped" };
-    }
-    if (isProcessAlive(info.pid) && this.verifyProcessIdentity(info.pid)) {
-      return {
-        state: "running",
-        pid: info.pid,
-        port: info.gatewayPort,
-        startedAt: info.startedAt
-      };
-    }
-    this.removeProcessJson();
-    return { state: "stopped" };
-  }
-  /**
-   * Start the OpenClaw gateway as a detached background process.
-   * Idempotent — no-op if already running.
-   * Waits briefly for the process to confirm it hasn't crashed on startup.
-   */
-  async start() {
-    const currentStatus = this.status();
-    if (currentStatus.state === "running") {
-      log8.info("already.running", { pid: currentStatus.pid });
-      return;
-    }
-    const binary = this.config.binary ?? "openclaw";
-    const profile = this.config.profile ?? "aero";
-    const port = this.config.gatewayPort ?? 3579;
-    if (!fs5.existsSync(this.stateDir)) {
-      fs5.mkdirSync(this.stateDir, { recursive: true });
-    }
-    const logFile = path6.join(this.stateDir, "gateway.log");
-    const logFd = fs5.openSync(logFile, "a");
-    const dotEnv = this.loadDotEnv();
-    const child = spawn(binary, ["--profile", profile, "gateway"], {
-      detached: true,
-      stdio: ["ignore", logFd, logFd],
-      env: {
-        ...process.env,
-        ...dotEnv,
-        OPENCLAW_PROFILE: profile,
-        OPENCLAW_GATEWAY_PORT: String(port),
-        OPENCLAW_STATE_DIR: this.stateDir
-      }
-    });
-    const startupResult = await new Promise((resolve) => {
-      let settled = false;
-      const settle = (r) => {
-        if (settled) return;
-        settled = true;
-        resolve(r);
-      };
-      child.on("error", (err) => settle({ error: err }));
-      child.on("exit", (code) => settle({ exitCode: code }));
-      setTimeout(() => settle({}), 500);
-    });
-    child.unref();
-    fs5.closeSync(logFd);
-    if (startupResult.error) {
-      throw new Error(`Failed to start OpenClaw gateway: ${startupResult.error.message}`);
-    }
-    if (startupResult.exitCode != null) {
-      throw new Error(`OpenClaw gateway exited immediately (code ${startupResult.exitCode}). Check ${path6.join(this.stateDir, "gateway.log")} for details.`);
-    }
-    if (child.pid == null) {
-      throw new Error("Failed to start OpenClaw gateway: no PID returned by spawn");
-    }
-    if (!isProcessAlive(child.pid)) {
-      throw new Error(`OpenClaw gateway exited immediately after spawn. Check ${path6.join(this.stateDir, "gateway.log")} for details.`);
-    }
-    const processInfo = {
-      pid: child.pid,
-      gatewayPort: port,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      marker: PROCESS_MARKER
-    };
-    fs5.writeFileSync(this.processJsonPath, JSON.stringify(processInfo, null, 2), "utf-8");
-    log8.info("started", { pid: child.pid, port });
-  }
-  /**
-   * Stop the gateway process.
-   * Uses DenchClaw escalation: SIGTERM → 800ms poll → SIGKILL.
-   * Idempotent — no-op if already stopped.
-   */
-  async stop() {
-    const info = this.readProcessInfo();
-    if (!info) return;
-    if (isProcessAlive(info.pid) && info.marker === PROCESS_MARKER && this.verifyProcessIdentity(info.pid)) {
-      await terminateWithEscalation(info.pid);
-    }
-    this.removeProcessJson();
-    log8.info("stopped", { pid: info.pid });
-  }
-  /**
-   * Stop the gateway, wipe the workspace directory, and prepare for re-seeding.
-   */
-  async reset() {
-    await this.stop();
-    const workspaceDir = path6.join(this.stateDir, "workspace");
-    if (fs5.existsSync(workspaceDir)) {
-      fs5.rmSync(workspaceDir, { recursive: true, force: true });
-      log8.info("workspace.wiped", { dir: workspaceDir });
-    }
-  }
-  /**
-   * Verify that the PID actually belongs to an openclaw process by checking
-   * the full command line. Requires "openclaw" in the args to avoid matching
-   * unrelated Node processes after PID reuse.
-   */
-  verifyProcessIdentity(pid) {
-    try {
-      if (process.platform === "darwin") {
-        const out = execFileSync("ps", ["-p", String(pid), "-o", "args="], {
-          encoding: "utf-8",
-          timeout: 2e3
-        }).trim();
-        return out.includes("openclaw");
-      }
-      if (process.platform === "linux") {
-        const cmdline = fs5.readFileSync(`/proc/${pid}/cmdline`, "utf-8");
-        return cmdline.includes("openclaw");
-      }
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  readProcessInfo() {
-    if (!fs5.existsSync(this.processJsonPath)) return null;
-    try {
-      return JSON.parse(fs5.readFileSync(this.processJsonPath, "utf-8"));
-    } catch {
-      return null;
-    }
-  }
-  removeProcessJson() {
-    try {
-      fs5.unlinkSync(this.processJsonPath);
-    } catch {
-    }
-  }
-  /** Parse a simple KEY=value dotenv file from the state dir. */
-  loadDotEnv() {
-    const envFile = path6.join(this.stateDir, ".env");
-    if (!fs5.existsSync(envFile)) return {};
-    const result = {};
-    for (const line of fs5.readFileSync(envFile, "utf-8").split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eq25 = trimmed.indexOf("=");
-      if (eq25 < 1) continue;
-      result[trimmed.slice(0, eq25)] = trimmed.slice(eq25 + 1);
-    }
-    return result;
-  }
-};
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    if (err.code === "EPERM") return true;
-    return false;
-  }
-}
-async function terminateWithEscalation(pid) {
-  try {
-    process.kill(pid, "SIGTERM");
-  } catch {
-    return;
-  }
-  const deadline = Date.now() + 800;
-  while (Date.now() < deadline) {
-    if (!isProcessAlive(pid)) return;
-    await new Promise((resolve) => setTimeout(resolve, 100));
-  }
-  try {
-    process.kill(pid, "SIGKILL");
-  } catch {
-  }
-}
-
-// src/agent-bootstrap.ts
-import { execFileSync as execFileSync2, execSync } from "child_process";
-import fs6 from "fs";
-import os5 from "os";
-import path7 from "path";
-import { fileURLToPath } from "url";
-var CACHE_TTL_MS = 5 * 60 * 1e3;
-var OPENCLAW_VERSION = "2026.4.14";
-var OPENCLAW_PACKAGE_SPEC = `openclaw@${OPENCLAW_VERSION}`;
-var MIN_NODE_VERSION = "22.14.0";
-var cachedResult = null;
-var cachedAt = 0;
-function getAeroStateDir(profile = "aero") {
-  return path7.join(os5.homedir(), `.openclaw-${profile}`);
-}
-async function detectOpenClaw(config) {
-  if (cachedResult && Date.now() - cachedAt < CACHE_TTL_MS) {
-    return cachedResult;
-  }
-  let result;
-  if (config?.binary) {
-    const version = probeVersion(config.binary);
-    if (version) {
-      result = { found: true, path: config.binary, version };
-      cachedResult = result;
-      cachedAt = Date.now();
-      return result;
-    }
-  }
-  const binaryPath = findInPath();
-  if (binaryPath) {
-    const version = probeVersion(binaryPath);
-    if (version) {
-      result = { found: true, path: binaryPath, version };
-      cachedResult = result;
-      cachedAt = Date.now();
-      return result;
-    }
-  }
-  result = { found: false };
-  cachedResult = result;
-  cachedAt = Date.now();
-  return result;
-}
-detectOpenClaw.resetCache = () => {
-  cachedResult = null;
-  cachedAt = 0;
-};
-function probeVersion(binaryPath) {
-  try {
-    const output = execFileSync2(binaryPath, ["--version"], {
-      timeout: 5e3,
-      encoding: "utf-8"
-    });
-    const match = output.toString().trim().match(/(\d+\.\d+\.\d+)/);
-    return match ? match[1] : output.toString().trim();
-  } catch {
-    return null;
-  }
-}
-function findInPath() {
-  const cmd = process.platform === "win32" ? "where" : "which";
-  try {
-    const output = execFileSync2(cmd, ["openclaw"], {
-      timeout: 5e3,
-      encoding: "utf-8"
-    });
-    return output.toString().trim().split("\n")[0] || null;
-  } catch {
-    return null;
-  }
-}
-async function installOpenClaw(opts) {
-  const unsupportedNodeError = getUnsupportedNodeError(opts?.nodeVersion);
-  if (unsupportedNodeError) {
-    return {
-      success: false,
-      error: unsupportedNodeError
-    };
-  }
-  try {
-    execSync(`npm install -g ${OPENCLAW_PACKAGE_SPEC}`, {
-      timeout: 12e4,
-      stdio: opts?.silent ? "pipe" : "inherit"
-    });
-  } catch (err) {
-    return {
-      success: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-  detectOpenClaw.resetCache();
-  const detection = await detectOpenClaw();
-  if (!detection.found) {
-    return {
-      success: false,
-      error: `npm install succeeded but the ${OPENCLAW_PACKAGE_SPEC} binary was not found in PATH`
-    };
-  }
-  if (detection.version) {
-    const expectedVersion = parseVersionTuple(OPENCLAW_VERSION);
-    const detectedVersion = parseVersionTuple(detection.version);
-    if (expectedVersion && detectedVersion && compareVersionTuples(detectedVersion, expectedVersion) !== 0) {
-      return {
-        success: false,
-        error: `Installed OpenClaw binary reports version ${detection.version}, but Canonry pinned ${OPENCLAW_VERSION}. A different openclaw binary may be shadowing the npm-installed package in PATH.`
-      };
-    }
-  }
-  return { success: true, detection };
-}
-function getUnsupportedNodeError(currentNodeVersionOverride) {
-  const currentNodeVersion = normalizeVersion(currentNodeVersionOverride ?? process.versions.node);
-  const minimumTuple = parseVersionTuple(MIN_NODE_VERSION);
-  const currentTuple = parseVersionTuple(currentNodeVersion);
-  if (!minimumTuple || !currentTuple || compareVersionTuples(currentTuple, minimumTuple) >= 0) {
-    return null;
-  }
-  return `Canonry requires Node.js >=${MIN_NODE_VERSION} and installs pinned OpenClaw ${OPENCLAW_VERSION}, but the current runtime is ${currentNodeVersion}. Upgrade Node.js before running "canonry agent setup".`;
-}
-function normalizeVersion(version) {
-  const tuple = parseVersionTuple(version);
-  if (!tuple) {
-    return version.trim().replace(/^v/i, "");
-  }
-  return tuple.join(".");
-}
-function parseVersionTuple(version) {
-  const match = version.trim().replace(/^v/i, "").match(/^(\d+)(?:\.(\d+))?(?:\.(\d+))?$/);
-  if (!match) {
-    return null;
-  }
-  return [
-    Number(match[1]),
-    Number(match[2] ?? 0),
-    Number(match[3] ?? 0)
-  ];
-}
-function compareVersionTuples(left, right) {
-  for (let index = 0; index < left.length; index++) {
-    const delta = left[index] - right[index];
-    if (delta !== 0) {
-      return delta;
-    }
-  }
-  return 0;
-}
-function seedWorkspace(stateDir) {
-  const workspaceDir = path7.join(stateDir, "workspace");
-  fs6.mkdirSync(workspaceDir, { recursive: true });
-  const __dirname = path7.dirname(fileURLToPath(import.meta.url));
-  const assetsDir = path7.join(__dirname, "..", "assets", "agent-workspace");
-  if (!fs6.existsSync(assetsDir)) {
-    return;
-  }
-  copyDirRecursive(assetsDir, workspaceDir);
-}
-function initializeOpenClawProfile(binary, profile, workspaceDir) {
-  try {
-    execFileSync2(binary, [
-      "--profile",
-      profile,
-      "onboard",
-      "--non-interactive",
-      "--accept-risk",
-      "--mode",
-      "local",
-      "--workspace",
-      workspaceDir,
-      "--skip-channels",
-      "--skip-skills",
-      "--skip-health",
-      "--no-install-daemon"
-    ], { timeout: 3e4, stdio: "pipe" });
-  } catch (err) {
-    const stderr = err instanceof Error && "stderr" in err ? String(err.stderr) : "";
-    if (stderr.toLowerCase().includes("already")) return;
-    throw new CliError({
-      code: "AGENT_PROFILE_INIT_FAILED",
-      message: `Failed to initialize OpenClaw profile: ${stderr || (err instanceof Error ? err.message : String(err))}`,
-      displayMessage: `Failed to initialize OpenClaw profile "${profile}".`
-    });
-  }
-}
-function configureOpenClawGateway(binary, profile, gatewayPort) {
-  const entries = [
-    ["gateway.mode", "local", false],
-    ["gateway.port", String(gatewayPort), true]
-  ];
-  for (const [key, value, strict] of entries) {
-    try {
-      const args = ["--profile", profile, "config", "set", key, value];
-      if (strict) args.push("--strict-json");
-      execFileSync2(binary, args, { timeout: 1e4, stdio: "pipe" });
-    } catch (err) {
-      throw new CliError({
-        code: "AGENT_GATEWAY_CONFIG_FAILED",
-        message: `Failed to set ${key}=${value}: ${err instanceof Error ? err.message : String(err)}`,
-        displayMessage: `Failed to configure OpenClaw gateway (${key}).`
-      });
-    }
-  }
-}
-function setOpenClawModel(binary, profile, model) {
-  try {
-    execFileSync2(binary, [
-      "--profile",
-      profile,
-      "models",
-      "set",
-      model
-    ], { timeout: 1e4, stdio: "pipe" });
-  } catch (err) {
-    throw new CliError({
-      code: "AGENT_MODEL_SET_FAILED",
-      message: `Failed to set agent model to ${model}: ${err instanceof Error ? err.message : String(err)}`,
-      displayMessage: `Failed to set agent model to "${model}".`
-    });
-  }
-}
-function providerEnvVar(provider) {
-  const map = {
-    anthropic: "ANTHROPIC_API_KEY",
-    openai: "OPENAI_API_KEY",
-    google: "GOOGLE_API_KEY",
-    "google-vertex": "GOOGLE_API_KEY",
-    groq: "GROQ_API_KEY",
-    mistral: "MISTRAL_API_KEY",
-    xai: "XAI_API_KEY",
-    openrouter: "OPENROUTER_API_KEY",
-    cerebras: "CEREBRAS_API_KEY"
-  };
-  return map[provider] ?? `${provider.toUpperCase().replace(/-/g, "_")}_API_KEY`;
-}
-function writeAgentEnv(stateDir, key, value) {
-  const envFile = path7.join(stateDir, ".env");
-  let lines = [];
-  if (fs6.existsSync(envFile)) {
-    lines = fs6.readFileSync(envFile, "utf-8").split("\n");
-  }
-  const prefix = `${key}=`;
-  const idx = lines.findIndex((l) => l.startsWith(prefix));
-  const entry = `${key}=${value}`;
-  if (idx >= 0) {
-    lines[idx] = entry;
-  } else {
-    lines.push(entry);
-  }
-  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
-  fs6.writeFileSync(envFile, lines.join("\n") + "\n", "utf-8");
-}
-function resolveAgentCredentials(opts) {
-  const provider = opts.agentProvider ?? "anthropic";
-  if (opts.agentKey) {
-    return { provider, key: opts.agentKey, model: opts.agentModel };
-  }
-  const envVar = providerEnvVar(provider);
-  const envKey = process.env[envVar];
-  if (envKey) {
-    return { provider, key: envKey, model: opts.agentModel };
-  }
-  const genericKey = process.env.CANONRY_AGENT_KEY;
-  if (genericKey) {
-    return { provider, key: genericKey, model: opts.agentModel };
-  }
-  const envFile = path7.join(opts.stateDir, ".env");
-  if (fs6.existsSync(envFile)) {
-    const hasKey = fs6.readFileSync(envFile, "utf-8").split("\n").some((l) => l.includes("_API_KEY="));
-    if (hasKey) {
-      return { provider, key: void 0, model: opts.agentModel };
-    }
-  }
-  return { provider, key: void 0, model: opts.agentModel };
-}
-function copyDirRecursive(src, dest) {
-  fs6.mkdirSync(dest, { recursive: true });
-  for (const entry of fs6.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path7.join(src, entry.name);
-    const destPath = path7.join(dest, entry.name);
-    if (entry.isDirectory()) {
-      copyDirRecursive(srcPath, destPath);
-    } else {
-      fs6.copyFileSync(srcPath, destPath);
-    }
-  }
-}
-
 // src/server.ts
 var _require2 = createRequire2(import.meta.url);
 var { version: PKG_VERSION } = _require2("../package.json");
@@ -15959,68 +17109,46 @@ function serializeSessionCookie(opts) {
   }
   return parts.join("; ");
 }
-function migrateDbCredentialsToConfig(db, config) {
-  try {
-    const googleColCheck = db.all(sql6.raw(
-      `SELECT COUNT(*) as c FROM pragma_table_info('google_connections') WHERE name = 'access_token'`
-    ));
-    if (googleColCheck[0]?.c) {
-      const rows = db.all(sql6.raw(
-        `SELECT domain, connection_type, property_id, sitemap_url, access_token, refresh_token, token_expires_at, scopes, created_at, updated_at FROM google_connections WHERE refresh_token IS NOT NULL AND refresh_token != ''`
-      ));
-      let migrated = 0;
-      for (const row of rows) {
-        const connType = row.connection_type;
-        const existing = getGoogleConnection(config, row.domain, connType);
-        if (existing?.refreshToken) continue;
-        upsertGoogleConnection(config, {
-          domain: row.domain,
-          connectionType: connType,
-          propertyId: row.property_id ?? null,
-          sitemapUrl: row.sitemap_url ?? null,
-          accessToken: row.access_token ?? void 0,
-          refreshToken: row.refresh_token ?? null,
-          tokenExpiresAt: row.token_expires_at ?? null,
-          scopes: parseJsonColumn(row.scopes, []),
-          createdAt: row.created_at,
-          updatedAt: row.updated_at
-        });
-        migrated++;
-      }
-      if (migrated > 0) {
-        saveConfigPatch({ google: config.google });
-        log9.info("credentials.migrated", { type: "google", count: migrated });
-      }
-    }
-    const gaColCheck = db.all(sql6.raw(
-      `SELECT COUNT(*) as c FROM pragma_table_info('ga_connections') WHERE name = 'private_key'`
-    ));
-    if (gaColCheck[0]?.c) {
-      const rows = db.all(sql6.raw(
-        `SELECT id, project_id, property_id, client_email, private_key, created_at, updated_at FROM ga_connections WHERE private_key IS NOT NULL AND private_key != ''`
-      ));
-      let migrated = 0;
-      for (const row of rows) {
-        const project = db.select({ name: projects.name }).from(projects).where(eq24(projects.id, row.project_id)).get();
-        if (!project) continue;
-        const existing = getGa4Connection(config, project.name);
-        if (existing?.privateKey) continue;
-        upsertGa4Connection(config, {
-          projectName: project.name,
-          propertyId: row.property_id,
-          clientEmail: row.client_email,
-          privateKey: row.private_key,
-          createdAt: row.created_at,
-          updatedAt: row.updated_at
-        });
-        migrated++;
-      }
-      if (migrated > 0) {
-        saveConfigPatch({ ga4: config.ga4 });
-        log9.info("credentials.migrated", { type: "ga4", count: migrated });
-      }
-    }
-  } catch {
+function applyLegacyCredentials(rows, config) {
+  let migratedGoogle = 0;
+  for (const row of rows.google) {
+    const existing = getGoogleConnection(config, row.domain, row.connectionType);
+    if (existing?.refreshToken) continue;
+    upsertGoogleConnection(config, {
+      domain: row.domain,
+      connectionType: row.connectionType,
+      propertyId: row.propertyId,
+      sitemapUrl: row.sitemapUrl,
+      accessToken: row.accessToken ?? void 0,
+      refreshToken: row.refreshToken,
+      tokenExpiresAt: row.tokenExpiresAt,
+      scopes: row.scopes,
+      createdAt: row.createdAt,
+      updatedAt: row.updatedAt
+    });
+    migratedGoogle++;
+  }
+  if (migratedGoogle > 0) {
+    saveConfigPatch({ google: config.google });
+    log9.info("credentials.migrated", { type: "google", count: migratedGoogle });
+  }
+  let migratedGa4 = 0;
+  for (const row of rows.ga4) {
+    const existing = getGa4Connection(config, row.projectName);
+    if (existing?.privateKey) continue;
+    upsertGa4Connection(config, {
+      projectName: row.projectName,
+      propertyId: row.propertyId,
+      clientEmail: row.clientEmail,
+      privateKey: row.privateKey,
+      createdAt: row.createdAt,
+      updatedAt: row.updatedAt
+    });
+    migratedGa4++;
+  }
+  if (migratedGa4 > 0) {
+    saveConfigPatch({ ga4: config.ga4 });
+    log9.info("credentials.migrated", { type: "ga4", count: migratedGa4 });
   }
 }
 async function createServer(opts) {
@@ -16047,7 +17175,15 @@ async function createServer(opts) {
       quota: opts.config.geminiQuota
     };
   }
-  migrateDbCredentialsToConfig(opts.db, opts.config);
+  try {
+    const legacyRows = extractLegacyCredentials(opts.db);
+    applyLegacyCredentials(legacyRows, opts.config);
+    dropLegacyCredentialColumns(opts.db);
+  } catch (err) {
+    log9.warn("credentials.migration.failed", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
   log9.info("providers.configured", { providers: Object.keys(providers).filter((k) => {
     const p = providers[k];
     return p?.apiKey || p?.baseUrl || p?.vertexProject;
@@ -16085,27 +17221,35 @@ async function createServer(opts) {
   jobRunner.recoverStaleRuns();
   const notifier = new Notifier(opts.db, serverUrl);
   const intelligenceService = new IntelligenceService(opts.db);
+  const aeroClient = new ApiClient(opts.config.apiUrl, opts.config.apiKey, { skipProbe: true });
+  const sessionRegistry = new SessionRegistry({
+    db: opts.db,
+    client: aeroClient,
+    config: opts.config
+  });
   const runCoordinator = new RunCoordinator(
     notifier,
     intelligenceService,
-    (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result)
+    (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result),
+    async ({ runId, projectId, insightCount, criticalOrHigh }) => {
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq25(projects.id, projectId)).get();
+      if (!project) return;
+      sessionRegistry.queueFollowUp(project.name, {
+        role: "user",
+        content: `[system] Run ${runId} completed for project ${project.name}. ${insightCount} insights generated (${criticalOrHigh} critical/high). Use get_run to inspect the run and get_insights to review new findings. Surface anything notable briefly \u2014 skip chit-chat.`,
+        timestamp: Date.now()
+      });
+      void sessionRegistry.drainNow(project.name);
+    }
   );
   jobRunner.onRunCompleted = (runId, projectId) => runCoordinator.onRunCompleted(runId, projectId);
   const snapshotService = new SnapshotService(registry);
-  let agentManager;
-  let agentAutoStarted = false;
-  if (opts.config.agent) {
-    const stateDir = getAeroStateDir(opts.config.agent.profile ?? "aero");
-    agentManager = new AgentManager(opts.config.agent, stateDir);
-    if (opts.config.agent.autoStart) {
-      try {
-        await agentManager.start();
-        agentAutoStarted = true;
-        app.log.info({ pid: agentManager.status().pid }, "Agent gateway started");
-      } catch (err) {
-        app.log.error({ err }, "Failed to auto-start agent gateway");
-      }
-    }
+  const orphanedOpenClawDir = path9.join(os5.homedir(), ".openclaw-aero");
+  if (fs8.existsSync(orphanedOpenClawDir)) {
+    app.log.warn(
+      { path: orphanedOpenClawDir },
+      "OpenClaw gateway is no longer used. Remove ~/.openclaw-aero/ manually to reclaim the directory."
+    );
   }
   const scheduler = new Scheduler(opts.db, {
     onRunCreated: (runId, projectId, providers2, location) => {
@@ -16228,7 +17372,7 @@ async function createServer(opts) {
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, keyHash)).get();
+    const existing = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
@@ -16280,7 +17424,7 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
   };
   const createPasswordSession = (reply) => {
     const key = getDefaultApiKey();
@@ -16337,12 +17481,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, hashApiKey(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq24(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq25(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
       reply.header("set-cookie", serializeSessionCookie({
         name: SESSION_COOKIE_NAME,
@@ -16374,6 +17518,11 @@ async function createServer(opts) {
     skipAuth: false,
     sessionCookieName: SESSION_COOKIE_NAME,
     resolveSessionApiKeyId,
+    // Local-only Aero agent routes. Registered here so they inherit api-routes'
+    // auth plugin — bare `registerAgentRoutes(app, ...)` would skip auth.
+    registerAuthenticatedRoutes: async (scope) => {
+      registerAgentRoutes(scope, { db: opts.db, sessionRegistry });
+    },
     getGoogleAuthConfig: () => getGoogleAuthConfig(opts.config),
     googleConnectionStore,
     googleStateSecret,
@@ -16406,7 +17555,8 @@ async function createServer(opts) {
     },
     openApiInfo: {
       title: "Canonry API",
-      version: PKG_VERSION
+      version: PKG_VERSION,
+      includeCanonryLocal: true
     },
     providerSummary,
     providerAdapters: [...API_ADAPTERS, ...BROWSER_ADAPTERS].map((a) => ({
@@ -16530,17 +17680,6 @@ async function createServer(opts) {
     onProjectDeleted: (projectId) => {
       scheduler.remove(projectId);
     },
-    onProjectUpserted: agentManager && opts.config.agent?.autoStart ? (_projectId, projectName) => {
-      try {
-        const gatewayPort = opts.config.agent?.gatewayPort ?? 3579;
-        const result = attachAgentWebhookDirect(opts.db, _projectId, gatewayPort);
-        if (result === "attached") {
-          app.log.info({ projectName }, "Auto-attached agent webhook");
-        }
-      } catch (err) {
-        app.log.error({ err, projectName }, "Failed to auto-attach agent webhook");
-      }
-    } : void 0,
     getTelemetryStatus: () => {
       const enabled = isTelemetryEnabled();
       return {
@@ -16625,15 +17764,15 @@ async function createServer(opts) {
       return snapshotService.createReport(input);
     }
   });
-  const dirname = path8.dirname(fileURLToPath2(import.meta.url));
-  const assetsDir = path8.join(dirname, "..", "assets");
-  if (fs7.existsSync(assetsDir)) {
-    const indexPath = path8.join(assetsDir, "index.html");
+  const dirname = path9.dirname(fileURLToPath2(import.meta.url));
+  const assetsDir = path9.join(dirname, "..", "assets");
+  if (fs8.existsSync(assetsDir)) {
+    const indexPath = path9.join(assetsDir, "index.html");
     const injectConfig = (html) => {
       const clientConfig = {};
       if (basePath) clientConfig.basePath = basePath;
       const configScript = `<script>window.__CANONRY_CONFIG__=${JSON.stringify(clientConfig)}</script>`;
-      const baseTag = basePath ? `<base href="${basePath}">` : "";
+      const baseTag = `<base href="${basePath ?? "/"}">`;
       return html.replace("<head>", `<head>${baseTag}`).replace("</head>", `${configScript}</head>`);
     };
     const fastifyStatic = await import("@fastify/static");
@@ -16646,8 +17785,8 @@ async function createServer(opts) {
       index: false
     });
     const serveIndex = (_request, reply) => {
-      if (fs7.existsSync(indexPath)) {
-        const html = fs7.readFileSync(indexPath, "utf-8");
+      if (fs8.existsSync(indexPath)) {
+        const html = fs8.readFileSync(indexPath, "utf-8");
         return reply.type("text/html").send(injectConfig(html));
       }
       return reply.status(404).send({ error: "Dashboard not built" });
@@ -16667,8 +17806,8 @@ async function createServer(opts) {
       if (basePath && !url.startsWith(basePath)) {
         return reply.status(404).send({ error: "Not found", path: request.url });
       }
-      if (fs7.existsSync(indexPath)) {
-        const html = fs7.readFileSync(indexPath, "utf-8");
+      if (fs8.existsSync(indexPath)) {
+        const html = fs8.readFileSync(indexPath, "utf-8");
         return reply.type("text/html").send(injectConfig(html));
       }
       return reply.status(404).send({ error: "Not found" });
@@ -16687,13 +17826,6 @@ async function createServer(opts) {
   scheduler.start();
   app.addHook("onClose", async () => {
     scheduler.stop();
-    if (agentManager && agentAutoStarted) {
-      try {
-        await agentManager.stop();
-      } catch (err) {
-        app.log.error({ err }, "Failed to stop agent gateway");
-      }
-    }
   });
   return app;
 }
@@ -16755,7 +17887,6 @@ export {
   isFirstRun,
   showFirstRunNotice,
   trackEvent,
-  EXIT_USER_ERROR,
   EXIT_SYSTEM_ERROR,
   CliError,
   usageError,
@@ -16774,21 +17905,10 @@ export {
   determineCitationState,
   computeCompetitorOverlap,
   extractRecommendedCompetitors,
+  createApiClient,
   setGoogleAuthConfig,
   formatAuditFactorScore,
-  AGENT_WEBHOOK_EVENTS,
-  buildAgentWebhookUrl,
-  attachAgentWebhookDirect,
-  AgentManager,
-  getAeroStateDir,
-  detectOpenClaw,
-  installOpenClaw,
-  seedWorkspace,
-  initializeOpenClawProfile,
-  configureOpenClawGateway,
-  setOpenClawModel,
-  providerEnvVar,
-  writeAgentEnv,
-  resolveAgentCredentials,
+  listAgentProviders,
+  coerceAgentProvider,
   createServer
 };