@ainyc/canonry 1.48.4 → 2.2.1

package/dist/{chunk-IPOVH342.js → chunk-2QNWFP6R.js}

@@ -1,5 +1,7 @@
 import {
   IntelligenceService,
+  agentMemory,
+  agentSessions,
   apiKeys,
   auditLog,
   bingCoverageSnapshots,
@@ -25,7 +27,7 @@ import {
   runs,
   schedules,
   usageCounters
-} from "./chunk-ZZ57GRV6.js";
+} from "./chunk-TAII35VC.js";
 
 // src/config.ts
 import fs from "fs";
@@ -336,11 +338,11 @@ function printCliError(err, format) {
 
 // src/server.ts
 import { createRequire as createRequire2 } from "module";
-import crypto23 from "crypto";
-import fs7 from "fs";
-import path8 from "path";
+import crypto24 from "crypto";
+import fs8 from "fs";
+import path9 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { eq as eq24 } from "drizzle-orm";
+import { eq as eq26 } from "drizzle-orm";
 import Fastify from "fastify";
 
 // ../contracts/src/config-schema.ts
@@ -602,6 +604,13 @@ function notImplemented(message) {
 function deliveryFailed(message) {
   return new AppError("DELIVERY_FAILED", message, 502);
 }
+function agentBusy(projectName) {
+  return new AppError(
+    "AGENT_BUSY",
+    `Aero is already running a turn for '${projectName}'. Retry after the current turn settles.`,
+    409
+  );
+}
 
 // ../contracts/src/google.ts
 import { z as z5 } from "zod";
@@ -889,6 +898,37 @@ var wordpressDiffDtoSchema = z7.object({
   })
 });
 
+// ../contracts/src/providers.ts
+var ProviderIds = {
+  claude: "claude",
+  openai: "openai",
+  gemini: "gemini",
+  perplexity: "perplexity",
+  local: "local",
+  cdpChatgpt: "cdp:chatgpt",
+  zai: "zai"
+};
+var PROVIDER_IDS = Object.values(ProviderIds);
+var SweepProviderIds = {
+  claude: ProviderIds.claude,
+  openai: ProviderIds.openai,
+  gemini: ProviderIds.gemini,
+  perplexity: ProviderIds.perplexity,
+  local: ProviderIds.local,
+  cdpChatgpt: ProviderIds.cdpChatgpt
+};
+var SWEEP_PROVIDER_IDS = Object.values(SweepProviderIds);
+var AgentProviderIds = {
+  claude: ProviderIds.claude,
+  openai: ProviderIds.openai,
+  gemini: ProviderIds.gemini,
+  zai: ProviderIds.zai
+};
+var AGENT_PROVIDER_IDS = Object.values(AgentProviderIds);
+function isAgentProviderId(value) {
+  return AGENT_PROVIDER_IDS.includes(value);
+}
+
 // ../contracts/src/run.ts
 import { z as z8 } from "zod";
 var runStatusSchema = z8.enum(["queued", "running", "completed", "partial", "failed", "cancelled"]);
@@ -1365,6 +1405,20 @@ function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../contracts/src/agent.ts
+import { z as z13 } from "zod";
+var memorySourceSchema = z13.enum(["aero", "user", "compaction"]);
+var MemorySources = memorySourceSchema.enum;
+var AGENT_MEMORY_VALUE_MAX_BYTES = 2 * 1024;
+var AGENT_MEMORY_KEY_MAX_LENGTH = 128;
+var agentMemoryUpsertRequestSchema = z13.object({
+  key: z13.string().min(1).max(AGENT_MEMORY_KEY_MAX_LENGTH),
+  value: z13.string().min(1)
+});
+var agentMemoryDeleteRequestSchema = z13.object({
+  key: z13.string().min(1).max(AGENT_MEMORY_KEY_MAX_LENGTH)
+});
+
 // ../api-routes/src/auth.ts
 import crypto2 from "crypto";
 import { eq } from "drizzle-orm";
@@ -2381,7 +2435,7 @@ async function deliverWebhook(target, payload, webhookSecret) {
   const body = JSON.stringify(payload);
   const isHttps = target.url.protocol === "https:";
   const port = target.url.port ? Number(target.url.port) : isHttps ? 443 : 80;
-  const path9 = `${target.url.pathname}${target.url.search}`;
+  const path10 = `${target.url.pathname}${target.url.search}`;
   const headers = {
     "Content-Length": String(Buffer.byteLength(body)),
     "Content-Type": "application/json",
@@ -2397,7 +2451,7 @@ async function deliverWebhook(target, payload, webhookSecret) {
       headers,
       hostname: target.address,
       method: "POST",
-      path: path9,
+      path: path10,
       port,
       timeout: REQUEST_TIMEOUT_MS
     };
@@ -5567,10 +5621,91 @@ var routeCatalog = [
     }
   }
 ];
+var canonryLocalRouteCatalog = [
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/agent/transcript",
+    summary: "Get the rolling Aero transcript for this project",
+    description: "Returns the full message history of the project-scoped Aero session plus the persisted model provider/id and last-updated timestamp. Empty messages array when the project has no session yet.",
+    tags: ["agent"],
+    parameters: [nameParameter],
+    responses: {
+      200: { description: "Transcript returned." },
+      404: { description: "Project not found." }
+    }
+  },
+  {
+    method: "delete",
+    path: "/api/v1/projects/{name}/agent/transcript",
+    summary: "Reset the Aero transcript + queued follow-ups",
+    description: "Evicts any live Agent instance, clears the persisted messages and follow_up_queue. A subsequent prompt starts a fresh session.",
+    tags: ["agent"],
+    parameters: [nameParameter],
+    responses: {
+      200: { description: "Session reset." },
+      404: { description: "Project not found." }
+    }
+  },
+  {
+    method: "get",
+    path: "/api/v1/projects/{name}/agent/providers",
+    summary: "List the LLM providers Aero can route to",
+    description: "Returns every provider Aero knows about with its default model, whether a usable API key is configured, and where the key resolved from (`config` | `env`). `defaultProvider` is the one Aero auto-picks when a caller omits `provider` on the prompt endpoint. Path is project-scoped for auth symmetry; the response does not vary per project today.",
+    tags: ["agent"],
+    parameters: [nameParameter],
+    responses: {
+      200: { description: "Providers returned." },
+      404: { description: "Project not found." }
+    }
+  },
+  {
+    method: "post",
+    path: "/api/v1/projects/{name}/agent/prompt",
+    summary: "Send a prompt to Aero and stream events back as SSE",
+    description: 'Posts a prompt into the project\'s Aero session and streams `AgentEvent` frames as `text/event-stream`. Each frame is `data: <JSON>\\n\\n`. The server brackets the stream with `{"type":"stream_open"}` and `{"type":"stream_close"}` control frames; `{"type":"error","message":"..."}` surfaces in-stream failures without collapsing the stream. Returns 409 `AGENT_BUSY` if another turn is already in flight for this project. Body field `scope` accepts "all" | "read-only"; omitted defaults to "read-only" (safe dashboard surface). The CLI passes "all" to keep write tools available.',
+    tags: ["agent"],
+    parameters: [nameParameter],
+    requestBody: {
+      required: true,
+      content: {
+        "application/json": {
+          schema: {
+            type: "object",
+            required: ["prompt"],
+            properties: {
+              prompt: { type: "string", description: "The user's message for Aero." },
+              provider: {
+                type: "string",
+                enum: [...AGENT_PROVIDER_IDS],
+                description: "Override the persisted LLM provider for this and subsequent turns."
+              },
+              modelId: {
+                type: "string",
+                description: "Override the persisted model id for this and subsequent turns."
+              },
+              scope: {
+                type: "string",
+                enum: ["all", "read-only"],
+                description: 'Tool surface scope. Default "read-only". Set "all" to enable write tools.'
+              }
+            }
+          }
+        }
+      }
+    },
+    responses: {
+      200: { description: "SSE stream of AgentEvent frames." },
+      400: { description: "Missing or empty prompt." },
+      404: { description: "Project not found." },
+      409: { description: "Another Aero turn is already in flight." }
+    }
+  }
+];
 function buildOpenApiDocument(info = {}) {
   const BASE_PREFIX = "/api/v1";
   const prefix = info.routePrefix ?? BASE_PREFIX;
-  const paths = routeCatalog.reduce((acc, route) => {
+  const fullCatalog = info.includeCanonryLocal ? [...routeCatalog, ...canonryLocalRouteCatalog] : routeCatalog;
+  const paths = fullCatalog.reduce((acc, route) => {
     const subpath = route.path.startsWith(BASE_PREFIX) ? route.path.slice(BASE_PREFIX.length) : route.path;
     const fullPath = prefix + subpath;
     const operation = {
@@ -5618,8 +5753,8 @@ async function openApiRoutes(app, opts = {}) {
     return reply.type("application/json").send(buildOpenApiDocument(opts));
   });
 }
-function buildOperationId(method, path9) {
-  const parts = path9.split("/").filter(Boolean).map((part) => {
+function buildOperationId(method, path10) {
+  const parts = path10.split("/").filter(Boolean).map((part) => {
     if (part.startsWith("{") && part.endsWith("}")) {
       return `by-${part.slice(1, -1)}`;
     }
@@ -9265,10 +9400,10 @@ function buildAuthErrorMessage(res, responseText) {
   }
   return "WordPress credentials are invalid or lack permission for this action";
 }
-async function fetchJson(connection, siteUrl, path9, init) {
+async function fetchJson(connection, siteUrl, path10, init) {
   if (siteUrl.startsWith("http:")) {
   }
-  const res = await fetch(`${normalizeSiteUrl(siteUrl)}${path9}`, {
+  const res = await fetch(`${normalizeSiteUrl(siteUrl)}${path10}`, {
     ...init,
     headers: {
       "Authorization": `Basic ${encodeBasicAuth(connection.username, connection.appPassword)}`,
@@ -10858,41 +10993,14 @@ async function apiRoutes(app, opts) {
       googleConnectionStore: opts.googleConnectionStore,
       getGoogleAuthConfig: opts.getGoogleAuthConfig
     });
+    if (opts.registerAuthenticatedRoutes) {
+      await opts.registerAuthenticatedRoutes(api);
+    }
   }, { prefix: opts.routePrefix ?? "/api/v1" });
 }
 
-// src/agent-webhook.ts
-import crypto18 from "crypto";
-import { eq as eq18 } from "drizzle-orm";
-var AGENT_WEBHOOK_EVENTS = ["run.completed", "insight.critical", "insight.high", "citation.gained"];
-function buildAgentWebhookUrl(gatewayPort) {
-  return `http://localhost:${gatewayPort}/hooks/canonry`;
-}
-function attachAgentWebhookDirect(db, projectId, gatewayPort) {
-  const agentUrl = buildAgentWebhookUrl(gatewayPort);
-  const existing = db.select().from(notifications).where(eq18(notifications.projectId, projectId)).all();
-  const hasAgent = existing.some((n) => {
-    const cfg = parseJsonColumn(n.config, {});
-    return cfg.source === "agent";
-  });
-  if (hasAgent) return "already-attached";
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  db.insert(notifications).values({
-    id: crypto18.randomUUID(),
-    projectId,
-    channel: "webhook",
-    config: JSON.stringify({
-      url: agentUrl,
-      events: [...AGENT_WEBHOOK_EVENTS],
-      source: "agent"
-    }),
-    enabled: 1,
-    webhookSecret: crypto18.randomUUID(),
-    createdAt: now,
-    updatedAt: now
-  }).run();
-  return "attached";
-}
+// src/server.ts
+import os5 from "os";
 
 // ../provider-gemini/src/normalize.ts
 import { GoogleGenAI } from "@google/genai";
@@ -13345,11 +13453,11 @@ function removeWordpressConnection(config, projectName) {
 }
 
 // src/job-runner.ts
-import crypto19 from "crypto";
+import crypto18 from "crypto";
 import fs4 from "fs";
 import path5 from "path";
 import os4 from "os";
-import { and as and7, eq as eq19, inArray as inArray3, sql as sql4 } from "drizzle-orm";
+import { and as and7, eq as eq18, inArray as inArray3, sql as sql4 } from "drizzle-orm";
 
 // src/citation-utils.ts
 function domainMatches(domain, canonicalDomain) {
@@ -13585,7 +13693,7 @@ var JobRunner = class {
     if (stale.length === 0) return;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     for (const run of stale) {
-      this.db.update(runs).set({ status: "failed", finishedAt: now, error: "Server restarted while run was in progress" }).where(eq19(runs.id, run.id)).run();
+      this.db.update(runs).set({ status: "failed", finishedAt: now, error: "Server restarted while run was in progress" }).where(eq18(runs.id, run.id)).run();
       log.warn("run.recovered-stale", { runId: run.id, previousStatus: run.status });
     }
   }
@@ -13613,10 +13721,10 @@ var JobRunner = class {
         throw new Error(`Run ${runId} is not executable from status '${existingRun.status}'`);
       }
       if (existingRun.status === "queued") {
-        this.db.update(runs).set({ status: "running", startedAt: now }).where(and7(eq19(runs.id, runId), eq19(runs.status, "queued"))).run();
+        this.db.update(runs).set({ status: "running", startedAt: now }).where(and7(eq18(runs.id, runId), eq18(runs.status, "queued"))).run();
       }
       this.throwIfRunCancelled(runId);
-      const project = this.db.select().from(projects).where(eq19(projects.id, projectId)).get();
+      const project = this.db.select().from(projects).where(eq18(projects.id, projectId)).get();
       if (!project) {
         throw new Error(`Project ${projectId} not found`);
       }
@@ -13636,8 +13744,8 @@ var JobRunner = class {
         throw new Error("No providers configured. Add at least one provider API key.");
       }
       log.info("run.dispatch", { runId, providerCount: activeProviders.length, providers: activeProviders.map((p) => p.adapter.name) });
-      projectKeywords = this.db.select().from(keywords).where(eq19(keywords.projectId, projectId)).all();
-      const projectCompetitors = this.db.select().from(competitors).where(eq19(competitors.projectId, projectId)).all();
+      projectKeywords = this.db.select().from(keywords).where(eq18(keywords.projectId, projectId)).all();
+      const projectCompetitors = this.db.select().from(competitors).where(eq18(competitors.projectId, projectId)).all();
       const competitorDomains = projectCompetitors.map((c) => c.domain);
       const allDomains = effectiveDomains({
         canonicalDomain: project.canonicalDomain,
@@ -13653,7 +13761,7 @@ var JobRunner = class {
       const todayPeriod = getCurrentUsageDay();
       for (const p of activeProviders) {
         const providerScope = `${projectId}:${p.adapter.name}`;
-        const providerUsage = this.db.select().from(usageCounters).where(eq19(usageCounters.scope, providerScope)).all().filter((r) => r.period === todayPeriod && r.metric === "queries").reduce((sum, r) => sum + r.count, 0);
+        const providerUsage = this.db.select().from(usageCounters).where(eq18(usageCounters.scope, providerScope)).all().filter((r) => r.period === todayPeriod && r.metric === "queries").reduce((sum, r) => sum + r.count, 0);
         const limit = p.config.quotaPolicy.maxRequestsPerDay;
         if (providerUsage + queriesPerProvider > limit) {
           throw new Error(
@@ -13713,7 +13821,7 @@ var JobRunner = class {
             );
             let screenshotRelPath = null;
             if (raw.screenshotPath && fs4.existsSync(raw.screenshotPath)) {
-              const snapshotId = crypto19.randomUUID();
+              const snapshotId = crypto18.randomUUID();
               const screenshotDir = path5.join(os4.homedir(), ".canonry", "screenshots", runId);
               if (!fs4.existsSync(screenshotDir)) fs4.mkdirSync(screenshotDir, { recursive: true });
               const destPath = path5.join(screenshotDir, `${snapshotId}.png`);
@@ -13743,7 +13851,7 @@ var JobRunner = class {
               }).run();
             } else {
               this.db.insert(querySnapshots).values({
-                id: crypto19.randomUUID(),
+                id: crypto18.randomUUID(),
                 runId,
                 keywordId: kw.id,
                 provider: providerName,
@@ -13794,12 +13902,12 @@ var JobRunner = class {
       const someFailed = providerErrors.size > 0;
       if (allFailed) {
         const errorDetail = JSON.stringify(Object.fromEntries(providerErrors));
-        this.db.update(runs).set({ status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq19(runs.id, runId)).run();
+        this.db.update(runs).set({ status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq18(runs.id, runId)).run();
       } else if (someFailed) {
         const errorDetail = JSON.stringify(Object.fromEntries(providerErrors));
-        this.db.update(runs).set({ status: "partial", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq19(runs.id, runId)).run();
+        this.db.update(runs).set({ status: "partial", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), error: errorDetail }).where(eq18(runs.id, runId)).run();
       } else {
-        this.db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq19(runs.id, runId)).run();
+        this.db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq18(runs.id, runId)).run();
       }
       this.flushProviderUsage(projectId, providerDispatchCounts);
       const finalStatus = allFailed ? "failed" : someFailed ? "partial" : "completed";
@@ -13834,7 +13942,7 @@ var JobRunner = class {
         status: "failed",
         finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
         error: errorMessage
-      }).where(eq19(runs.id, runId)).run();
+      }).where(eq18(runs.id, runId)).run();
       this.flushProviderUsage(projectId, providerDispatchCounts);
       trackEvent("run.completed", {
         status: "failed",
@@ -13855,7 +13963,7 @@ var JobRunner = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const period = now.slice(0, 10);
     this.db.insert(usageCounters).values({
-      id: crypto19.randomUUID(),
+      id: crypto18.randomUUID(),
       scope,
       period,
       metric,
@@ -13877,7 +13985,7 @@ var JobRunner = class {
       status: runs.status,
       finishedAt: runs.finishedAt,
       error: runs.error
-    }).from(runs).where(eq19(runs.id, runId)).get();
+    }).from(runs).where(eq18(runs.id, runId)).get();
   }
   isRunCancelled(runId) {
     return this.getRunState(runId)?.status === "cancelled";
@@ -13893,7 +14001,7 @@ var JobRunner = class {
       this.db.update(runs).set({
         finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
         error: currentRun.error ?? "Cancelled by user"
-      }).where(eq19(runs.id, runId)).run();
+      }).where(eq18(runs.id, runId)).run();
     }
     trackEvent("run.completed", {
       status: "cancelled",
@@ -13915,8 +14023,8 @@ function getCurrentUsageDay() {
 }
 
 // src/gsc-sync.ts
-import crypto20 from "crypto";
-import { eq as eq20, and as and8, sql as sql5 } from "drizzle-orm";
+import crypto19 from "crypto";
+import { eq as eq19, and as and8, sql as sql5 } from "drizzle-orm";
 var log2 = createLogger("GscSync");
 function formatDate2(d) {
   return d.toISOString().split("T")[0];
@@ -13928,13 +14036,13 @@ function daysAgo(n) {
 }
 async function executeGscSync(db, runId, projectId, opts) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  db.update(runs).set({ status: "running", startedAt: now }).where(eq20(runs.id, runId)).run();
+  db.update(runs).set({ status: "running", startedAt: now }).where(eq19(runs.id, runId)).run();
   try {
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
     if (!googleClientId || !googleClientSecret) {
       throw new Error("Google OAuth is not configured in the local Canonry config");
     }
-    const project = db.select().from(projects).where(eq20(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq19(projects.id, projectId)).get();
     if (!project) {
       throw new Error(`Project not found: ${projectId}`);
     }
@@ -13969,7 +14077,7 @@ async function executeGscSync(db, runId, projectId, opts) {
     log2.info("fetch.complete", { runId, projectId, rowCount: rows.length });
     db.delete(gscSearchData).where(
       and8(
-        eq20(gscSearchData.projectId, projectId),
+        eq19(gscSearchData.projectId, projectId),
         sql5`${gscSearchData.date} >= ${startDate}`,
         sql5`${gscSearchData.date} <= ${endDate}`
       )
@@ -13981,7 +14089,7 @@ async function executeGscSync(db, runId, projectId, opts) {
       for (const row of batch) {
         const [query, page, country, device, date] = row.keys;
         db.insert(gscSearchData).values({
-          id: crypto20.randomUUID(),
+          id: crypto19.randomUUID(),
           projectId,
           syncRunId: runId,
           date: date ?? "",
@@ -14015,7 +14123,7 @@ async function executeGscSync(db, runId, projectId, opts) {
         const rich = ir.richResultsResult;
         const inspectedAt = (/* @__PURE__ */ new Date()).toISOString();
         db.insert(gscUrlInspections).values({
-          id: crypto20.randomUUID(),
+          id: crypto19.randomUUID(),
           projectId,
           syncRunId: runId,
           url: pageUrl,
@@ -14036,7 +14144,7 @@ async function executeGscSync(db, runId, projectId, opts) {
         log2.error("inspect.url-failed", { runId, projectId, url: pageUrl, error: err instanceof Error ? err.message : String(err) });
       }
     }
-    const allInspections = db.select().from(gscUrlInspections).where(eq20(gscUrlInspections.projectId, projectId)).all();
+    const allInspections = db.select().from(gscUrlInspections).where(eq19(gscUrlInspections.projectId, projectId)).all();
     const latestByUrl = /* @__PURE__ */ new Map();
     for (const row of allInspections) {
       const existing = latestByUrl.get(row.url);
@@ -14057,9 +14165,9 @@ async function executeGscSync(db, runId, projectId, opts) {
       }
     }
     const snapshotDate = formatDate2(/* @__PURE__ */ new Date());
-    db.delete(gscCoverageSnapshots).where(and8(eq20(gscCoverageSnapshots.projectId, projectId), eq20(gscCoverageSnapshots.date, snapshotDate))).run();
+    db.delete(gscCoverageSnapshots).where(and8(eq19(gscCoverageSnapshots.projectId, projectId), eq19(gscCoverageSnapshots.date, snapshotDate))).run();
     db.insert(gscCoverageSnapshots).values({
-      id: crypto20.randomUUID(),
+      id: crypto19.randomUUID(),
       projectId,
       syncRunId: runId,
       date: snapshotDate,
@@ -14068,19 +14176,19 @@ async function executeGscSync(db, runId, projectId, opts) {
       reasonBreakdown: JSON.stringify(reasonCounts),
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     }).run();
-    db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(runs.id, runId)).run();
+    db.update(runs).set({ status: "completed", finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq19(runs.id, runId)).run();
     log2.info("sync.completed", { runId, projectId, searchDataRows: rows.length, urlInspections: topPages.length, indexed: snapIndexed, notIndexed: snapNotIndexed });
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(runs.id, runId)).run();
+    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq19(runs.id, runId)).run();
     log2.error("sync.failed", { runId, projectId, error: errorMsg });
     throw err;
   }
 }
 
 // src/gsc-inspect-sitemap.ts
-import crypto21 from "crypto";
-import { eq as eq21, and as and9 } from "drizzle-orm";
+import crypto20 from "crypto";
+import { eq as eq20, and as and9 } from "drizzle-orm";
 
 // src/sitemap-parser.ts
 var LOC_REGEX = /<loc>\s*([^<]+?)\s*<\/loc>/gi;
@@ -14149,13 +14257,13 @@ async function parseSitemapRecursive(url, urls, depth) {
 var log3 = createLogger("InspectSitemap");
 async function executeInspectSitemap(db, runId, projectId, opts) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  db.update(runs).set({ status: "running", startedAt: now }).where(eq21(runs.id, runId)).run();
+  db.update(runs).set({ status: "running", startedAt: now }).where(eq20(runs.id, runId)).run();
   try {
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
     if (!googleClientId || !googleClientSecret) {
       throw new Error("Google OAuth is not configured in the local Canonry config");
     }
-    const project = db.select().from(projects).where(eq21(projects.id, projectId)).get();
+    const project = db.select().from(projects).where(eq20(projects.id, projectId)).get();
     if (!project) {
       throw new Error(`Project not found: ${projectId}`);
     }
@@ -14196,7 +14304,7 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
         const rich = ir.richResultsResult;
         const inspectedAt = (/* @__PURE__ */ new Date()).toISOString();
         db.insert(gscUrlInspections).values({
-          id: crypto21.randomUUID(),
+          id: crypto20.randomUUID(),
           projectId,
           syncRunId: runId,
           url: pageUrl,
@@ -14223,7 +14331,7 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
         await new Promise((r) => setTimeout(r, 1e3));
       }
     }
-    const allInspections = db.select().from(gscUrlInspections).where(eq21(gscUrlInspections.projectId, projectId)).all();
+    const allInspections = db.select().from(gscUrlInspections).where(eq20(gscUrlInspections.projectId, projectId)).all();
     const latestByUrl = /* @__PURE__ */ new Map();
     for (const row of allInspections) {
       const existing = latestByUrl.get(row.url);
@@ -14244,9 +14352,9 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
       }
     }
     const snapshotDate = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-    db.delete(gscCoverageSnapshots).where(and9(eq21(gscCoverageSnapshots.projectId, projectId), eq21(gscCoverageSnapshots.date, snapshotDate))).run();
+    db.delete(gscCoverageSnapshots).where(and9(eq20(gscCoverageSnapshots.projectId, projectId), eq20(gscCoverageSnapshots.date, snapshotDate))).run();
     db.insert(gscCoverageSnapshots).values({
-      id: crypto21.randomUUID(),
+      id: crypto20.randomUUID(),
       projectId,
       syncRunId: runId,
       date: snapshotDate,
@@ -14256,11 +14364,11 @@ async function executeInspectSitemap(db, runId, projectId, opts) {
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     }).run();
     const status = errors > 0 && inspected > 0 ? "partial" : errors === urls.length ? "failed" : "completed";
-    db.update(runs).set({ status, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq21(runs.id, runId)).run();
+    db.update(runs).set({ status, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(runs.id, runId)).run();
     log3.info("inspect.completed", { runId, projectId, inspected, errors, total: urls.length, indexed: snapIndexed, notIndexed: snapNotIndexed });
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
-    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq21(runs.id, runId)).run();
+    db.update(runs).set({ status: "failed", error: errorMsg, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(runs.id, runId)).run();
     log3.error("inspect.failed", { runId, projectId, error: errorMsg });
     throw err;
   }
@@ -14319,7 +14427,7 @@ var ProviderRegistry = class {
 
 // src/scheduler.ts
 import cron from "node-cron";
-import { eq as eq22 } from "drizzle-orm";
+import { eq as eq21 } from "drizzle-orm";
 var log4 = createLogger("Scheduler");
 var Scheduler = class {
   db;
@@ -14331,7 +14439,7 @@ var Scheduler = class {
   }
   /** Load all enabled schedules from DB and register cron jobs. */
   start() {
-    const allSchedules = this.db.select().from(schedules).where(eq22(schedules.enabled, 1)).all();
+    const allSchedules = this.db.select().from(schedules).where(eq21(schedules.enabled, 1)).all();
     for (const schedule of allSchedules) {
       const missedRunAt = schedule.nextRunAt;
       this.registerCronTask(schedule);
@@ -14356,7 +14464,7 @@ var Scheduler = class {
       this.stopTask(projectId, existing, "Stopped");
       this.tasks.delete(projectId);
     }
-    const schedule = this.db.select().from(schedules).where(eq22(schedules.projectId, projectId)).get();
+    const schedule = this.db.select().from(schedules).where(eq21(schedules.projectId, projectId)).get();
     if (schedule && schedule.enabled === 1) {
       this.registerCronTask(schedule);
     }
@@ -14389,14 +14497,14 @@ var Scheduler = class {
     this.db.update(schedules).set({
       nextRunAt: task.getNextRun()?.toISOString() ?? null,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq22(schedules.id, scheduleId)).run();
+    }).where(eq21(schedules.id, scheduleId)).run();
     const label = schedule.preset ?? cronExpr;
     log4.info("cron.registered", { projectId, schedule: label, timezone });
   }
   triggerRun(scheduleId, projectId) {
     try {
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const currentSchedule = this.db.select().from(schedules).where(eq22(schedules.id, scheduleId)).get();
+      const currentSchedule = this.db.select().from(schedules).where(eq21(schedules.id, scheduleId)).get();
       if (!currentSchedule || currentSchedule.enabled !== 1) {
         log4.warn("schedule.stale", { scheduleId, projectId, msg: "schedule no longer exists or is disabled" });
         this.remove(projectId);
@@ -14404,7 +14512,7 @@ var Scheduler = class {
       }
       const task = this.tasks.get(projectId);
       const nextRunAt = task?.getNextRun()?.toISOString() ?? null;
-      const project = this.db.select().from(projects).where(eq22(projects.id, projectId)).get();
+      const project = this.db.select().from(projects).where(eq21(projects.id, projectId)).get();
       if (!project) {
         log4.error("project.not-found", { projectId, msg: "skipping scheduled run" });
         this.remove(projectId);
@@ -14433,7 +14541,7 @@ var Scheduler = class {
         this.db.update(schedules).set({
           nextRunAt,
           updatedAt: now
-        }).where(eq22(schedules.id, currentSchedule.id)).run();
+        }).where(eq21(schedules.id, currentSchedule.id)).run();
         return;
       }
       const runId = queueResult.runId;
@@ -14441,7 +14549,7 @@ var Scheduler = class {
         lastRunAt: now,
         nextRunAt,
         updatedAt: now
-      }).where(eq22(schedules.id, currentSchedule.id)).run();
+      }).where(eq21(schedules.id, currentSchedule.id)).run();
       const scheduleProviders = parseJsonColumn(currentSchedule.providers, []);
       const providers = scheduleProviders.length > 0 ? scheduleProviders : void 0;
       log4.info("run.triggered", { runId, projectName: project.name, providers: providers ?? "all" });
@@ -14453,8 +14561,8 @@ var Scheduler = class {
 };
 
 // src/notifier.ts
-import { eq as eq23, desc as desc8, and as and10, or as or2 } from "drizzle-orm";
-import crypto22 from "crypto";
+import { eq as eq22, desc as desc8, and as and10, or as or2 } from "drizzle-orm";
+import crypto21 from "crypto";
 var log5 = createLogger("Notifier");
 var Notifier = class {
   db;
@@ -14466,18 +14574,18 @@ var Notifier = class {
   /** Called after a run completes (success, partial, or failed). */
   async onRunCompleted(runId, projectId) {
     log5.info("run.completed", { runId, projectId });
-    const notifs = this.db.select().from(notifications).where(eq23(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
+    const notifs = this.db.select().from(notifications).where(eq22(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
     if (notifs.length === 0) {
       log5.info("notifications.none-enabled", { projectId });
       return;
     }
     log5.info("notifications.found", { projectId, count: notifs.length });
-    const run = this.db.select().from(runs).where(eq23(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq22(runs.id, runId)).get();
     if (!run) {
       log5.error("run.not-found", { runId, msg: "skipping notification dispatch" });
       return;
     }
-    const project = this.db.select().from(projects).where(eq23(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq22(projects.id, projectId)).get();
     if (!project) {
       log5.error("project.not-found", { projectId, msg: "skipping notification dispatch" });
       return;
@@ -14524,11 +14632,11 @@ var Notifier = class {
     if (criticalInsights.length > 0) insightEvents.push("insight.critical");
     if (highInsights.length > 0) insightEvents.push("insight.high");
     if (insightEvents.length === 0) return;
-    const notifs = this.db.select().from(notifications).where(eq23(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
+    const notifs = this.db.select().from(notifications).where(eq22(notifications.projectId, projectId)).all().filter((n) => n.enabled === 1);
     if (notifs.length === 0) return;
-    const run = this.db.select().from(runs).where(eq23(runs.id, runId)).get();
+    const run = this.db.select().from(runs).where(eq22(runs.id, runId)).get();
     if (!run) return;
-    const project = this.db.select().from(projects).where(eq23(projects.id, projectId)).get();
+    const project = this.db.select().from(projects).where(eq22(projects.id, projectId)).get();
     if (!project) return;
     for (const notif of notifs) {
       const config = parseJsonColumn(notif.config, { url: "", events: [] });
@@ -14560,8 +14668,8 @@ var Notifier = class {
   computeTransitions(runId, projectId) {
     const recentRuns = this.db.select().from(runs).where(
       and10(
-        eq23(runs.projectId, projectId),
-        or2(eq23(runs.status, "completed"), eq23(runs.status, "partial"))
+        eq22(runs.projectId, projectId),
+        or2(eq22(runs.status, "completed"), eq22(runs.status, "partial"))
       )
     ).orderBy(desc8(runs.createdAt)).limit(2).all();
     if (recentRuns.length < 2) return [];
@@ -14573,12 +14681,12 @@ var Notifier = class {
       keyword: keywords.keyword,
       provider: querySnapshots.provider,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).leftJoin(keywords, eq23(querySnapshots.keywordId, keywords.id)).where(eq23(querySnapshots.runId, currentRunId)).all();
+    }).from(querySnapshots).leftJoin(keywords, eq22(querySnapshots.keywordId, keywords.id)).where(eq22(querySnapshots.runId, currentRunId)).all();
     const previousSnapshots = this.db.select({
       keywordId: querySnapshots.keywordId,
       provider: querySnapshots.provider,
       citationState: querySnapshots.citationState
-    }).from(querySnapshots).where(eq23(querySnapshots.runId, previousRunId)).all();
+    }).from(querySnapshots).where(eq22(querySnapshots.runId, previousRunId)).all();
     const prevMap = /* @__PURE__ */ new Map();
     for (const s of previousSnapshots) {
       prevMap.set(`${s.keywordId}:${s.provider}`, s.citationState);
@@ -14636,7 +14744,7 @@ var Notifier = class {
   }
   logDelivery(projectId, notificationId, event, status, error) {
     this.db.insert(auditLog).values({
-      id: crypto22.randomUUID(),
+      id: crypto21.randomUUID(),
       projectId,
       actor: "scheduler",
       action: `notification.${status}`,
@@ -14651,19 +14759,23 @@ var Notifier = class {
 // src/run-coordinator.ts
 var log6 = createLogger("RunCoordinator");
 var RunCoordinator = class {
-  constructor(notifier, intelligenceService, onInsightsGenerated) {
+  constructor(notifier, intelligenceService, onInsightsGenerated, onAeroEvent) {
     this.notifier = notifier;
     this.intelligenceService = intelligenceService;
     this.onInsightsGenerated = onInsightsGenerated;
+    this.onAeroEvent = onAeroEvent;
   }
   async onRunCompleted(runId, projectId) {
+    let insightCount = 0;
+    let criticalOrHigh = 0;
     try {
       const result = this.intelligenceService.analyzeAndPersist(runId, projectId);
-      if (result && this.onInsightsGenerated) {
-        const hasHighSeverity = result.insights.some(
+      if (result) {
+        insightCount = result.insights.length;
+        criticalOrHigh = result.insights.filter(
           (i) => i.severity === "critical" || i.severity === "high"
-        );
-        if (hasHighSeverity) {
+        ).length;
+        if (this.onInsightsGenerated && criticalOrHigh > 0) {
           try {
             await this.onInsightsGenerated(runId, projectId, result);
           } catch (err) {
@@ -14679,141 +14791,2202 @@ var RunCoordinator = class {
     } catch (err) {
       log6.error("notifier.failed", { runId, error: err instanceof Error ? err.message : String(err) });
     }
+    if (this.onAeroEvent) {
+      try {
+        await this.onAeroEvent({ runId, projectId, insightCount, criticalOrHigh });
+      } catch (err) {
+        log6.error("aero.failed", { runId, error: err instanceof Error ? err.message : String(err) });
+      }
+    }
   }
 };
 
-// src/snapshot-service.ts
-import { runAeoAudit } from "@ainyc/aeo-audit";
+// src/agent/session-registry.ts
+import crypto23 from "crypto";
+import { eq as eq24 } from "drizzle-orm";
 
-// src/site-fetch.ts
-import https2 from "https";
-var FETCH_TIMEOUT_MS = 1e4;
-var MAX_TEXT_LENGTH = 4e3;
-var MAX_BODY_BYTES = 512e3;
-var USER_AGENT = "Canonry/1.0 (site-analysis)";
-function extractHostname(domain) {
-  let hostname = domain;
-  try {
-    if (hostname.includes("://")) {
-      hostname = new URL(hostname).hostname;
-    }
-  } catch {
+// src/agent/session.ts
+import fs7 from "fs";
+import path8 from "path";
+import { Agent } from "@mariozechner/pi-agent-core";
+import { registerBuiltInApiProviders } from "@mariozechner/pi-ai";
+
+// src/agent/providers.ts
+import { getEnvApiKey, getModel } from "@mariozechner/pi-ai";
+var AGENT_PROVIDERS = {
+  [AgentProviderIds.claude]: {
+    piAiProvider: "anthropic",
+    label: "Anthropic (Claude)",
+    defaultModel: "claude-opus-4-7",
+    autoDetectPriority: 0
+  },
+  [AgentProviderIds.openai]: {
+    piAiProvider: "openai",
+    label: "OpenAI",
+    defaultModel: "gpt-5.1",
+    autoDetectPriority: 1
+  },
+  [AgentProviderIds.gemini]: {
+    piAiProvider: "google",
+    label: "Google (Gemini)",
+    defaultModel: "gemini-2.5-flash",
+    autoDetectPriority: 2
+  },
+  [AgentProviderIds.zai]: {
+    piAiProvider: "zai",
+    label: "Z.ai (GLM)",
+    defaultModel: "glm-5.1",
+    autoDetectPriority: 3
   }
-  return hostname.replace(/^www\./, "");
+};
+function agentProvidersByPriority() {
+  return Object.keys(AGENT_PROVIDERS).slice().sort((a, b) => AGENT_PROVIDERS[a].autoDetectPriority - AGENT_PROVIDERS[b].autoDetectPriority);
 }
-function fetchWithPinnedAddress(target) {
-  return new Promise((resolve) => {
-    const port = target.url.port ? Number(target.url.port) : 443;
-    const path9 = target.url.pathname + target.url.search;
-    const req = https2.request(
-      {
-        hostname: target.address,
-        family: target.family,
-        port,
-        path: path9,
-        method: "GET",
-        timeout: FETCH_TIMEOUT_MS,
-        servername: target.url.hostname,
-        // SNI for TLS
-        headers: {
-          Host: target.url.host,
-          "User-Agent": USER_AGENT,
-          Accept: "text/html"
-        }
-      },
-      (res) => {
-        if (res.statusCode && (res.statusCode < 200 || res.statusCode >= 300)) {
-          if (res.statusCode >= 300 && res.statusCode < 400) {
-            const location = res.headers.location ?? "";
-            res.resume();
-            resolve(`REDIRECT:${location}`);
-            return;
-          }
-          res.resume();
-          resolve("");
-          return;
-        }
-        const contentType = res.headers["content-type"] ?? "";
-        if (!contentType.includes("text/html")) {
-          res.resume();
-          resolve("");
-          return;
-        }
-        const chunks = [];
-        let totalBytes = 0;
-        res.on("data", (chunk) => {
-          totalBytes += chunk.length;
-          if (totalBytes <= MAX_BODY_BYTES) {
-            chunks.push(chunk);
-          }
-        });
-        res.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-        res.on("error", () => resolve(""));
-      }
+function listAgentProviders() {
+  return AGENT_PROVIDER_IDS;
+}
+function getAgentProvider(name) {
+  return AGENT_PROVIDERS[name];
+}
+function coerceAgentProvider(value) {
+  if (!value) return void 0;
+  return isAgentProviderId(value) ? value : void 0;
+}
+function resolveModelForProvider(provider, modelId) {
+  const entry = AGENT_PROVIDERS[provider];
+  const id = modelId ?? entry.defaultModel;
+  const model = getModel(entry.piAiProvider, id);
+  if (!model) {
+    throw new Error(
+      `Model '${id}' not found for pi-ai provider '${entry.piAiProvider}'. Verify AGENT_PROVIDERS[${provider}].defaultModel against the installed @mariozechner/pi-ai catalog.`
     );
-    req.on("timeout", () => req.destroy(new Error("timeout")));
-    req.on("error", () => resolve(""));
-    req.end();
-  });
+  }
+  return model;
 }
-async function fetchSiteText(domain) {
-  const hostname = extractHostname(domain);
-  const url = `https://${hostname}`;
-  const targetCheck = await resolveWebhookTarget(url);
-  if (!targetCheck.ok) return "";
-  try {
-    const result = await fetchWithPinnedAddress(targetCheck.target);
-    if (result.startsWith("REDIRECT:")) {
-      const location = result.slice("REDIRECT:".length);
-      if (!location) return "";
-      const redirectUrl = new URL(location, url).href;
-      const redirectCheck = await resolveWebhookTarget(redirectUrl);
-      if (!redirectCheck.ok) return "";
-      const redirectResult = await fetchWithPinnedAddress(redirectCheck.target);
-      if (redirectResult.startsWith("REDIRECT:")) return "";
-      return stripHtml2(redirectResult);
-    }
-    return stripHtml2(result);
-  } catch {
-    return "";
+function validateAgentProviderRegistry() {
+  for (const provider of listAgentProviders()) {
+    resolveModelForProvider(provider);
   }
 }
-function stripHtml2(html) {
-  if (!html) return "";
-  let text = html.replace(/<script[\s\S]*?<\/script>/gi, " ");
-  text = text.replace(/<style[\s\S]*?<\/style>/gi, " ");
-  text = text.replace(/<[^>]+>/g, " ");
-  text = text.replace(/&amp;/g, "&");
-  text = text.replace(/&lt;/g, "<");
-  text = text.replace(/&gt;/g, ">");
-  text = text.replace(/&quot;/g, '"');
-  text = text.replace(/&#39;/g, "'");
-  text = text.replace(/&nbsp;/g, " ");
-  text = text.replace(/\s+/g, " ").trim();
-  if (text.length > MAX_TEXT_LENGTH) {
-    text = text.slice(0, MAX_TEXT_LENGTH);
+function resolveApiKeyFor(providerOrPiAi, config) {
+  return resolveApiKeySource(providerOrPiAi, config)?.key;
+}
+function resolveApiKeySource(providerOrPiAi, config) {
+  const id = resolveAgentId(providerOrPiAi);
+  if (!id) return void 0;
+  const entry = AGENT_PROVIDERS[id];
+  const fromConfig = config.providers?.[id]?.apiKey;
+  if (fromConfig) return { key: fromConfig, source: "config" };
+  const fromEnv = getEnvApiKey(entry.piAiProvider);
+  if (fromEnv) return { key: fromEnv, source: "env" };
+  return void 0;
+}
+function resolveAgentId(providerOrPiAi) {
+  if (isAgentProviderId(providerOrPiAi)) return providerOrPiAi;
+  for (const id of AGENT_PROVIDER_IDS) {
+    if (AGENT_PROVIDERS[id].piAiProvider === providerOrPiAi) return id;
   }
-  return text;
+  return void 0;
+}
+function buildAgentProvidersResponse(config) {
+  const providers = listAgentProviders().map((id) => {
+    const entry = AGENT_PROVIDERS[id];
+    const source = resolveApiKeySource(id, config);
+    return {
+      id,
+      label: entry.label,
+      defaultModel: entry.defaultModel,
+      configured: source !== void 0,
+      keySource: source?.source ?? null
+    };
+  });
+  const firstConfigured = agentProvidersByPriority().find((p) => resolveApiKeySource(p, config));
+  return {
+    providers,
+    defaultProvider: firstConfigured ?? null
+  };
 }
 
-// src/snapshot-format.ts
-function formatAuditFactorScore(factor) {
-  return `${factor.score}/100 (${factor.weight}% weight)`;
+// src/agent/skill-paths.ts
+import fs5 from "fs";
+import path6 from "path";
+import { fileURLToPath } from "url";
+function resolveAeroSkillDir(pkgDir) {
+  const here = pkgDir ?? path6.dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    path6.join(here, "../assets/agent-workspace/skills/aero"),
+    path6.join(here, "../../assets/agent-workspace/skills/aero"),
+    path6.join(here, "../../../../skills/aero")
+  ];
+  for (const candidate of candidates) {
+    if (fs5.existsSync(path6.join(candidate, "SKILL.md"))) return candidate;
+  }
+  throw new Error(`Aero skill not found. Searched:
+  ${candidates.join("\n  ")}`);
 }
 
-// src/snapshot-service.ts
-var log7 = createLogger("Snapshot");
-var ANALYSIS_PROVIDER_PRIORITY = ["openai", "claude", "gemini", "perplexity", "local"];
-var SNAPSHOT_QUERY_COUNT = 6;
-var ProviderExecutionGate2 = class {
-  constructor(maxConcurrency, maxPerMinute) {
-    this.maxConcurrency = maxConcurrency;
-    this.maxPerMinute = maxPerMinute;
+// src/agent/skill-tools.ts
+import fs6 from "fs";
+import path7 from "path";
+import { Type } from "@sinclair/typebox";
+var MAX_DOC_CHARS = 2e4;
+function textResult(details) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(details, null, 2) }],
+    details
+  };
+}
+function parseDescription(body) {
+  if (!body.startsWith("---")) return "(no description)";
+  const end = body.indexOf("\n---", 3);
+  if (end === -1) return "(no description)";
+  const block = body.slice(3, end);
+  for (const line of block.split("\n")) {
+    const match = line.match(/^description:\s*(.+)$/);
+    if (match) return match[1].trim().replace(/^["']|["']$/g, "");
+  }
+  return "(no description)";
+}
+function scanSkillDocs(skillDir) {
+  const refsDir = path7.join(skillDir ?? resolveAeroSkillDir(), "references");
+  if (!fs6.existsSync(refsDir)) return [];
+  const entries = [];
+  for (const file of fs6.readdirSync(refsDir)) {
+    if (!file.endsWith(".md")) continue;
+    const filePath = path7.join(refsDir, file);
+    const body = fs6.readFileSync(filePath, "utf-8");
+    entries.push({
+      slug: file.replace(/\.md$/, ""),
+      description: parseDescription(body),
+      bytes: Buffer.byteLength(body, "utf-8")
+    });
   }
-  window = [];
-  waiters = [];
-  rateLimitChain = Promise.resolve();
-  inFlight = 0;
+  entries.sort((a, b) => a.slug.localeCompare(b.slug));
+  return entries;
+}
+var ListSchema = Type.Object({});
+function buildListSkillDocsTool() {
+  return {
+    name: "list_skill_docs",
+    label: "List skill docs",
+    description: "List reference playbooks bundled with the Aero skill. Each entry has a slug, a short description of when to use it, and byte size. Call this before read_skill_doc to pick the right doc.",
+    parameters: ListSchema,
+    execute: async () => {
+      return textResult({ docs: scanSkillDocs() });
+    }
+  };
+}
+var ReadSchema = Type.Object({
+  slug: Type.String({
+    description: "Doc slug (no extension, no path). Must match a slug from list_skill_docs \u2014 unknown slugs return an error listing valid options."
+  })
+});
+function buildReadSkillDocTool() {
+  return {
+    name: "read_skill_doc",
+    label: "Read skill doc",
+    description: 'Load the full content of a reference playbook by slug. Use when a task matches one of the docs returned by list_skill_docs \u2014 e.g. "regression-playbook" when investigating lost citations.',
+    parameters: ReadSchema,
+    execute: async (_toolCallId, params) => {
+      const skillDir = resolveAeroSkillDir();
+      const docs = scanSkillDocs(skillDir);
+      const match = docs.find((d) => d.slug === params.slug);
+      if (!match) {
+        return textResult({
+          error: `Unknown slug "${params.slug}".`,
+          availableSlugs: docs.map((d) => d.slug)
+        });
+      }
+      const filePath = path7.join(skillDir, "references", `${match.slug}.md`);
+      const content = fs6.readFileSync(filePath, "utf-8");
+      if (content.length > MAX_DOC_CHARS) {
+        return textResult({
+          slug: match.slug,
+          content: content.slice(0, MAX_DOC_CHARS),
+          truncated: true,
+          totalBytes: match.bytes
+        });
+      }
+      return textResult({ slug: match.slug, content, truncated: false });
+    }
+  };
+}
+function buildSkillDocTools() {
+  return [
+    buildListSkillDocsTool(),
+    buildReadSkillDocTool()
+  ];
+}
+
+// src/agent/tools.ts
+import { Type as Type2 } from "@sinclair/typebox";
+
+// src/agent/memory-store.ts
+import crypto22 from "crypto";
+import { and as and11, desc as desc9, eq as eq23, like, sql as sql6 } from "drizzle-orm";
+var COMPACTION_KEY_PREFIX = "compaction:";
+var COMPACTION_NOTES_PER_SESSION = 3;
+function rowToDto(row) {
+  return {
+    id: row.id,
+    key: row.key,
+    value: row.value,
+    source: row.source,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+function listMemoryEntries(db, projectId, opts = {}) {
+  const query = db.select().from(agentMemory).where(eq23(agentMemory.projectId, projectId)).orderBy(desc9(agentMemory.updatedAt));
+  const rows = opts.limit === void 0 ? query.all() : query.limit(opts.limit).all();
+  return rows.map(rowToDto);
+}
+function upsertMemoryEntry(db, args) {
+  if (Buffer.byteLength(args.value, "utf8") > AGENT_MEMORY_VALUE_MAX_BYTES) {
+    throw new Error(
+      `memory value exceeds ${AGENT_MEMORY_VALUE_MAX_BYTES} bytes (got ${Buffer.byteLength(args.value, "utf8")})`
+    );
+  }
+  if (args.source !== MemorySources.compaction && args.key.startsWith(COMPACTION_KEY_PREFIX)) {
+    throw new Error(`memory key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`);
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const id = crypto22.randomUUID();
+  db.insert(agentMemory).values({
+    id,
+    projectId: args.projectId,
+    key: args.key,
+    value: args.value,
+    source: args.source,
+    createdAt: now,
+    updatedAt: now
+  }).onConflictDoUpdate({
+    target: [agentMemory.projectId, agentMemory.key],
+    set: {
+      value: args.value,
+      source: args.source,
+      updatedAt: now
+    }
+  }).run();
+  const row = db.select().from(agentMemory).where(and11(eq23(agentMemory.projectId, args.projectId), eq23(agentMemory.key, args.key))).get();
+  if (!row) throw new Error("memory upsert produced no row");
+  return rowToDto(row);
+}
+function deleteMemoryEntry(db, projectId, key) {
+  const result = db.delete(agentMemory).where(and11(eq23(agentMemory.projectId, projectId), eq23(agentMemory.key, key))).run();
+  const changes = result.changes ?? 0;
+  return changes > 0;
+}
+function loadRecentForHydrate(db, projectId, limit) {
+  return listMemoryEntries(db, projectId, { limit });
+}
+function writeCompactionNote(db, args) {
+  if (Buffer.byteLength(args.summary, "utf8") > AGENT_MEMORY_VALUE_MAX_BYTES) {
+    throw new Error(
+      `compaction summary exceeds ${AGENT_MEMORY_VALUE_MAX_BYTES} bytes; summarizer produced too much text`
+    );
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const key = `${COMPACTION_KEY_PREFIX}${args.sessionId}:${now}`;
+  const id = crypto22.randomUUID();
+  let inserted;
+  db.transaction((tx) => {
+    tx.insert(agentMemory).values({
+      id,
+      projectId: args.projectId,
+      key,
+      value: args.summary,
+      source: MemorySources.compaction,
+      createdAt: now,
+      updatedAt: now
+    }).run();
+    const sessionPrefix = `${COMPACTION_KEY_PREFIX}${args.sessionId}:`;
+    const existing = tx.select({ id: agentMemory.id, updatedAt: agentMemory.updatedAt }).from(agentMemory).where(
+      and11(
+        eq23(agentMemory.projectId, args.projectId),
+        like(agentMemory.key, `${sessionPrefix}%`)
+      )
+    ).orderBy(desc9(agentMemory.updatedAt)).all();
+    const stale = existing.slice(COMPACTION_NOTES_PER_SESSION).map((r) => r.id);
+    if (stale.length > 0) {
+      tx.delete(agentMemory).where(sql6`${agentMemory.id} IN (${sql6.join(stale.map((s) => sql6`${s}`), sql6`, `)})`).run();
+    }
+    const row = tx.select().from(agentMemory).where(and11(eq23(agentMemory.projectId, args.projectId), eq23(agentMemory.key, key))).get();
+    if (row) inserted = rowToDto(row);
+  });
+  if (!inserted) throw new Error("compaction note write produced no row");
+  return inserted;
+}
+
+// src/agent/tools.ts
+var MAX_TOOL_RESULT_CHARS = 2e4;
+function truncate(json) {
+  if (json.length <= MAX_TOOL_RESULT_CHARS) return json;
+  return json.slice(0, MAX_TOOL_RESULT_CHARS) + "\n... (truncated \u2014 result too large)";
+}
+function textResult2(details) {
+  return {
+    content: [{ type: "text", text: truncate(JSON.stringify(details, null, 2)) }],
+    details
+  };
+}
+var StatusSchema = Type2.Object({
+  runLimit: Type2.Optional(
+    Type2.Number({
+      description: "Max recent runs to include. Default 5.",
+      minimum: 1,
+      maximum: 50
+    })
+  )
+});
+function buildGetStatusTool(ctx) {
+  return {
+    name: "get_status",
+    label: "Get status",
+    description: "Current project overview with its most recent runs.",
+    parameters: StatusSchema,
+    execute: async (_toolCallId, params) => {
+      const runLimit = params.runLimit ?? 5;
+      const [project, runs2] = await Promise.all([
+        ctx.client.getProject(ctx.projectName),
+        ctx.client.listRuns(ctx.projectName, runLimit)
+      ]);
+      return textResult2({ project, runs: runs2 });
+    }
+  };
+}
+var HealthSchema = Type2.Object({});
+function buildGetHealthTool(ctx) {
+  return {
+    name: "get_health",
+    label: "Get health",
+    description: "Latest visibility health snapshot including overall cited rate, pair counts, and per-provider breakdown.",
+    parameters: HealthSchema,
+    execute: async () => {
+      const health = await ctx.client.getHealth(ctx.projectName);
+      return textResult2(health);
+    }
+  };
+}
+var TimelineSchema = Type2.Object({
+  keyword: Type2.Optional(
+    Type2.String({
+      description: "Restrict the timeline to a single keyword. Omit to return all keywords."
+    })
+  )
+});
+function buildGetTimelineTool(ctx) {
+  return {
+    name: "get_timeline",
+    label: "Get timeline",
+    description: "Per-keyword citation timeline showing how visibility evolved across runs. Use to identify regressions, emerging citations, or competitor movement.",
+    parameters: TimelineSchema,
+    execute: async (_toolCallId, params) => {
+      const timeline = await ctx.client.getTimeline(ctx.projectName);
+      const filtered = params.keyword ? timeline.filter((row) => row.keyword === params.keyword) : timeline;
+      return textResult2(filtered);
+    }
+  };
+}
+var InsightsSchema = Type2.Object({
+  includeDismissed: Type2.Optional(
+    Type2.Boolean({
+      description: "Include dismissed insights. Default false (only active insights)."
+    })
+  ),
+  runId: Type2.Optional(
+    Type2.String({
+      description: "Restrict insights to a specific run id. Omit for all runs."
+    })
+  )
+});
+function buildGetInsightsTool(ctx) {
+  return {
+    name: "get_insights",
+    label: "Get insights",
+    description: "Insights produced by the canonry intelligence engine \u2014 regressions, gains, and opportunities with cause/recommendation metadata. Query this before re-deriving conclusions from raw timeline data.",
+    parameters: InsightsSchema,
+    execute: async (_toolCallId, params) => {
+      const insights2 = await ctx.client.getInsights(ctx.projectName, {
+        dismissed: params.includeDismissed,
+        runId: params.runId
+      });
+      return textResult2(insights2);
+    }
+  };
+}
+var KeywordsSchema = Type2.Object({});
+function buildListKeywordsTool(ctx) {
+  return {
+    name: "list_keywords",
+    label: "List keywords",
+    description: "All keywords currently tracked for this project.",
+    parameters: KeywordsSchema,
+    execute: async () => {
+      const keywords2 = await ctx.client.listKeywords(ctx.projectName);
+      return textResult2(keywords2);
+    }
+  };
+}
+var CompetitorsSchema = Type2.Object({});
+function buildListCompetitorsTool(ctx) {
+  return {
+    name: "list_competitors",
+    label: "List competitors",
+    description: "Competitor domains tracked alongside this project for side-by-side comparison.",
+    parameters: CompetitorsSchema,
+    execute: async () => {
+      const competitors2 = await ctx.client.listCompetitors(ctx.projectName);
+      return textResult2(competitors2);
+    }
+  };
+}
+var RunDetailSchema = Type2.Object({
+  runId: Type2.String({
+    description: "Run id (UUID) to fetch. Typically obtained from get_status runs[].id."
+  })
+});
+function buildGetRunTool(ctx) {
+  return {
+    name: "get_run",
+    label: "Get run detail",
+    description: "Full detail for a specific run including per-keyword snapshots, error messages, and provider breakdown. Use to investigate failed runs or drill into a particular sweep.",
+    parameters: RunDetailSchema,
+    execute: async (_toolCallId, params) => {
+      const run = await ctx.client.getRun(params.runId);
+      return textResult2(run);
+    }
+  };
+}
+var RecallSchema = Type2.Object({
+  limit: Type2.Optional(
+    Type2.Number({
+      description: "Max notes to return, ordered newest-first. Default 50. Max 100.",
+      minimum: 1,
+      maximum: 100
+    })
+  )
+});
+function buildRecallTool(ctx) {
+  return {
+    name: "recall",
+    label: "Recall memory",
+    description: "Read project-scoped durable notes Aero has stored via `remember` (plus compaction summaries). Returns entries newest-first. The N most-recent entries are also injected into the system prompt at session start, so you usually do not need to call this \u2014 reach for it when you need older context or the full note value.",
+    parameters: RecallSchema,
+    execute: async (_toolCallId, params) => {
+      const entries = listMemoryEntries(ctx.db, ctx.projectId, { limit: params.limit ?? 50 });
+      return textResult2({ entries });
+    }
+  };
+}
+function buildReadTools(ctx) {
+  return [
+    buildGetStatusTool(ctx),
+    buildGetHealthTool(ctx),
+    buildGetTimelineTool(ctx),
+    buildGetInsightsTool(ctx),
+    buildListKeywordsTool(ctx),
+    buildListCompetitorsTool(ctx),
+    buildGetRunTool(ctx),
+    buildRecallTool(ctx)
+  ];
+}
+var RunSweepSchema = Type2.Object({
+  providers: Type2.Optional(
+    Type2.Array(Type2.String(), {
+      description: "Subset of providers to run. Omit to use every configured provider on the project."
+    })
+  ),
+  noLocation: Type2.Optional(
+    Type2.Boolean({
+      description: "Run without a location context. Default: use the project default location."
+    })
+  )
+});
+function buildRunSweepTool(ctx) {
+  return {
+    name: "run_sweep",
+    label: "Trigger sweep",
+    description: "Trigger a new answer-visibility sweep for this project across configured AI providers. Returns the run id(s). Use when fresh citation data is needed.",
+    parameters: RunSweepSchema,
+    execute: async (_toolCallId, params) => {
+      const body = {};
+      if (params.providers?.length) body.providers = params.providers;
+      if (params.noLocation) body.noLocation = true;
+      const result = await ctx.client.triggerRun(ctx.projectName, body);
+      return textResult2(result);
+    }
+  };
+}
+var DismissInsightSchema = Type2.Object({
+  insightId: Type2.String({
+    description: "Insight id to dismiss. Obtain from get_insights details[].id."
+  })
+});
+function buildDismissInsightTool(ctx) {
+  return {
+    name: "dismiss_insight",
+    label: "Dismiss insight",
+    description: "Mark an insight as dismissed so it no longer surfaces in active insight lists. Reversible via the dashboard.",
+    parameters: DismissInsightSchema,
+    execute: async (_toolCallId, params) => {
+      const result = await ctx.client.dismissInsight(ctx.projectName, params.insightId);
+      return textResult2(result);
+    }
+  };
+}
+var AddKeywordsSchema = Type2.Object({
+  keywords: Type2.Array(Type2.String(), {
+    minItems: 1,
+    description: "Keywords to add to the tracking list. Duplicates against existing keywords are ignored server-side."
+  })
+});
+function buildAddKeywordsTool(ctx) {
+  return {
+    name: "add_keywords",
+    label: "Add keywords",
+    description: "Append keywords to the project tracking list. Additive only \u2014 existing keywords are preserved. Use exact phrasing you want tracked.",
+    parameters: AddKeywordsSchema,
+    execute: async (_toolCallId, params) => {
+      await ctx.client.appendKeywords(ctx.projectName, params.keywords);
+      return textResult2({ added: params.keywords });
+    }
+  };
+}
+var AddCompetitorsSchema = Type2.Object({
+  domains: Type2.Array(Type2.String(), {
+    minItems: 1,
+    description: 'Competitor domains to track. Provide bare domains (e.g. "example.com"), not URLs.'
+  })
+});
+function buildAddCompetitorsTool(ctx) {
+  return {
+    name: "add_competitors",
+    label: "Add competitors",
+    description: "Append competitor domains to the project. Fetches the current set, merges with the requested domains (dedup on exact domain match), and persists the combined list.",
+    parameters: AddCompetitorsSchema,
+    execute: async (_toolCallId, params) => {
+      const existing = await ctx.client.listCompetitors(ctx.projectName);
+      const existingDomains = new Set(existing.map((c) => c.domain));
+      const newDomains = params.domains.filter((d) => !existingDomains.has(d));
+      if (newDomains.length === 0) {
+        return textResult2({ added: [], alreadyTracked: params.domains });
+      }
+      const merged = [...existing.map((c) => c.domain), ...newDomains];
+      await ctx.client.putCompetitors(ctx.projectName, merged);
+      return textResult2({ added: newDomains, alreadyTracked: params.domains.filter((d) => existingDomains.has(d)) });
+    }
+  };
+}
+var UpdateScheduleSchema = Type2.Object({
+  cron: Type2.Optional(
+    Type2.String({ description: 'Cron expression (e.g. "0 */6 * * *"). Provide cron OR preset, not both.' })
+  ),
+  preset: Type2.Optional(
+    Type2.String({ description: 'Preset keyword (e.g. "daily", "hourly"). Provide cron OR preset, not both.' })
+  ),
+  timezone: Type2.Optional(Type2.String({ description: 'IANA timezone. Default: "UTC".' })),
+  enabled: Type2.Optional(
+    Type2.Boolean({ description: "Whether the schedule is active. Default: true." })
+  ),
+  providers: Type2.Optional(
+    Type2.Array(Type2.String(), {
+      description: "Providers to run on each scheduled sweep. Omit to use all configured providers."
+    })
+  )
+});
+function buildUpdateScheduleTool(ctx) {
+  return {
+    name: "update_schedule",
+    label: "Update schedule",
+    description: "Create or update the recurring sweep schedule for this project. Provide exactly one of `cron` (expression) or `preset` (keyword). Fully replaces any existing schedule.",
+    parameters: UpdateScheduleSchema,
+    execute: async (_toolCallId, params) => {
+      if (params.cron && params.preset || !params.cron && !params.preset) {
+        throw new Error("update_schedule: provide exactly one of `cron` or `preset`");
+      }
+      const body = {};
+      if (params.cron) body.cron = params.cron;
+      if (params.preset) body.preset = params.preset;
+      if (params.timezone) body.timezone = params.timezone;
+      if (params.enabled !== void 0) body.enabled = params.enabled;
+      if (params.providers?.length) body.providers = params.providers;
+      const result = await ctx.client.putSchedule(ctx.projectName, body);
+      return textResult2(result);
+    }
+  };
+}
+var AttachAgentWebhookSchema = Type2.Object({
+  url: Type2.String({
+    description: "External agent webhook URL. Canonry will POST run.completed, insight.critical, insight.high, and citation.gained events to it."
+  })
+});
+function buildAttachAgentWebhookTool(ctx) {
+  return {
+    name: "attach_agent_webhook",
+    label: "Attach agent webhook",
+    description: "Register an external agent webhook for this project. Use when wiring a Claude Code / Codex / custom agent to receive canonry run and insight events. Idempotent \u2014 skips if one already exists.",
+    parameters: AttachAgentWebhookSchema,
+    execute: async (_toolCallId, params) => {
+      const existing = await ctx.client.listNotifications(ctx.projectName);
+      const hasAgent = existing.some((n) => n.source === "agent");
+      if (hasAgent) {
+        return textResult2({ status: "already-attached" });
+      }
+      const result = await ctx.client.createNotification(ctx.projectName, {
+        channel: "webhook",
+        url: params.url,
+        events: ["run.completed", "insight.critical", "insight.high", "citation.gained"],
+        source: "agent"
+      });
+      return textResult2({ status: "attached", notificationId: result.id, url: params.url });
+    }
+  };
+}
+var RememberSchema = Type2.Object({
+  key: Type2.String({
+    description: `Stable identifier for this note (max ${AGENT_MEMORY_KEY_MAX_LENGTH} chars). Writing the same key overwrites the prior value. Do NOT use the "${COMPACTION_KEY_PREFIX}" prefix \u2014 that namespace is reserved for transcript compaction summaries.`,
+    minLength: 1,
+    maxLength: AGENT_MEMORY_KEY_MAX_LENGTH
+  }),
+  value: Type2.String({
+    description: `Plain-text note to persist (max ${AGENT_MEMORY_VALUE_MAX_BYTES} bytes). Use for durable operator preferences, migration context, or non-obvious reasoning you'll want on a future turn. Do NOT duplicate data canonry already tracks (runs, insights, timelines) \u2014 query those instead.`,
+    minLength: 1
+  })
+});
+function buildRememberTool(ctx) {
+  return {
+    name: "remember",
+    label: "Remember",
+    description: "Persist a project-scoped durable note visible to every future Aero session for this project. Upsert \u2014 writing the same key replaces the prior value. Capped at 2 KB per note.",
+    parameters: RememberSchema,
+    execute: async (_toolCallId, params) => {
+      const entry = upsertMemoryEntry(ctx.db, {
+        projectId: ctx.projectId,
+        key: params.key,
+        value: params.value,
+        source: MemorySources.aero
+      });
+      return textResult2({ status: "remembered", entry });
+    }
+  };
+}
+var ForgetSchema = Type2.Object({
+  key: Type2.String({
+    description: "Exact key of the note to remove. No-op (status=missing) when no note exists for that key.",
+    minLength: 1,
+    maxLength: AGENT_MEMORY_KEY_MAX_LENGTH
+  })
+});
+function buildForgetTool(ctx) {
+  return {
+    name: "forget",
+    label: "Forget",
+    description: "Delete a durable note by key. Use when a previously-remembered fact is wrong or no longer relevant.",
+    parameters: ForgetSchema,
+    execute: async (_toolCallId, params) => {
+      if (params.key.startsWith(COMPACTION_KEY_PREFIX)) {
+        throw new Error(
+          `cannot forget compaction notes directly \u2014 they are pruned automatically (key prefix "${COMPACTION_KEY_PREFIX}" is reserved)`
+        );
+      }
+      const removed = deleteMemoryEntry(ctx.db, ctx.projectId, params.key);
+      return textResult2({ status: removed ? "forgotten" : "missing", key: params.key });
+    }
+  };
+}
+function buildWriteTools(ctx) {
+  return [
+    buildRunSweepTool(ctx),
+    buildDismissInsightTool(ctx),
+    buildAddKeywordsTool(ctx),
+    buildAddCompetitorsTool(ctx),
+    buildUpdateScheduleTool(ctx),
+    buildAttachAgentWebhookTool(ctx),
+    buildRememberTool(ctx),
+    buildForgetTool(ctx)
+  ];
+}
+function buildAllTools(ctx) {
+  return [...buildReadTools(ctx), ...buildWriteTools(ctx)];
+}
+
+// src/agent/session.ts
+var builtinsRegistered = false;
+function ensureBuiltinsRegistered() {
+  if (!builtinsRegistered) {
+    registerBuiltInApiProviders();
+    validateAgentProviderRegistry();
+    builtinsRegistered = true;
+  }
+}
+function loadAeroSystemPrompt(pkgDir) {
+  const skillDir = resolveAeroSkillDir(pkgDir);
+  const skillBody = fs7.readFileSync(path8.join(skillDir, "SKILL.md"), "utf-8");
+  const soulPath = path8.join(skillDir, "soul.md");
+  if (!fs7.existsSync(soulPath)) return skillBody;
+  const soulBody = fs7.readFileSync(soulPath, "utf-8");
+  return `${soulBody.trimEnd()}
+
+---
+
+${skillBody}`;
+}
+function missingProviderMessage() {
+  const configHints = agentProvidersByPriority().join(", ");
+  const envHints = agentProvidersByPriority().map((p) => `${AGENT_PROVIDERS[p].piAiProvider.toUpperCase()}_API_KEY`).join(" / ");
+  return `No agent LLM provider configured. Add an API key for one of: ${configHints} in ~/.canonry/config.yaml, or export ${envHints}.`;
+}
+function detectAgentProvider(config) {
+  for (const provider of agentProvidersByPriority()) {
+    if (resolveApiKeyFor(provider, config)) return provider;
+  }
+  return void 0;
+}
+function resolveAeroModel(provider, modelId) {
+  ensureBuiltinsRegistered();
+  return resolveModelForProvider(provider, modelId);
+}
+function buildApiKeyResolver(config) {
+  return (piAiProvider) => resolveApiKeyFor(piAiProvider, config);
+}
+function createAeroSession(opts) {
+  const systemPrompt = opts.systemPromptOverride ?? loadAeroSystemPrompt();
+  const provider = opts.provider ?? detectAgentProvider(opts.config);
+  if (!provider) throw new Error(missingProviderMessage());
+  const model = resolveAeroModel(provider, opts.modelId);
+  const toolScope = opts.toolScope ?? "all";
+  const toolCtx = {
+    client: opts.client,
+    projectName: opts.projectName,
+    db: opts.db,
+    projectId: opts.projectId
+  };
+  const stateTools = toolScope === "read-only" ? buildReadTools(toolCtx) : buildAllTools(toolCtx);
+  const defaultTools = [...stateTools, ...buildSkillDocTools()];
+  const tools = opts.tools ?? defaultTools;
+  return new Agent({
+    initialState: {
+      systemPrompt,
+      model,
+      tools,
+      ...opts.initialMessages ? { messages: opts.initialMessages } : {}
+    },
+    streamFn: opts.streamFn,
+    getApiKey: buildApiKeyResolver(opts.config)
+  });
+}
+function resolveSessionProviderAndModel(config, opts) {
+  const provider = opts?.provider ?? detectAgentProvider(config);
+  if (!provider) throw new Error(missingProviderMessage());
+  const modelId = opts?.modelId ?? getAgentProvider(provider).defaultModel;
+  return { provider, modelId };
+}
+
+// src/agent/compaction.ts
+import { complete } from "@mariozechner/pi-ai";
+
+// src/agent/compaction-config.ts
+var COMPACTION_TOKEN_THRESHOLD = 6e4;
+var COMPACTION_TARGET_RATIO = 0.5;
+var COMPACTION_PRESERVE_TAIL_MESSAGES = 10;
+var COMPACTION_MAX_MESSAGES = 400;
+
+// src/agent/token-counter.ts
+var CHARS_PER_TOKEN = 4;
+function estimateMessageTokens(message) {
+  const content = message.content;
+  if (content === void 0) return 0;
+  if (typeof content === "string") {
+    return Math.ceil(content.length / CHARS_PER_TOKEN);
+  }
+  if (!Array.isArray(content)) return 0;
+  let chars = 0;
+  for (const part of content) {
+    if (part && typeof part === "object" && "type" in part) {
+      const p = part;
+      switch (p.type) {
+        case "text":
+          chars += (p.text ?? "").length;
+          break;
+        case "thinking":
+          chars += (p.thinking ?? "").length;
+          break;
+        case "toolCall":
+          try {
+            chars += JSON.stringify(p.arguments ?? {}).length;
+          } catch {
+            chars += 64;
+          }
+          break;
+        case "image":
+          chars += 1024;
+          break;
+        default:
+          break;
+      }
+    }
+  }
+  return Math.ceil(chars / CHARS_PER_TOKEN);
+}
+function estimateTranscriptTokens(messages) {
+  let total = 0;
+  for (const m of messages) total += estimateMessageTokens(m);
+  return total;
+}
+
+// src/agent/compaction.ts
+function shouldCompact(messages) {
+  if (messages.length >= COMPACTION_MAX_MESSAGES) return true;
+  return estimateTranscriptTokens(messages) >= COMPACTION_TOKEN_THRESHOLD;
+}
+function findSafeSplit(messages, targetIndex) {
+  const maxSplit = messages.length - COMPACTION_PRESERVE_TAIL_MESSAGES;
+  if (maxSplit <= 0) return 0;
+  const boundedTarget = Math.max(0, Math.min(targetIndex, maxSplit));
+  for (let i = boundedTarget; i <= maxSplit; i++) {
+    const m = messages[i];
+    if (m && m.role === "user") return i;
+  }
+  return 0;
+}
+function toLlmMessages(messages) {
+  const out = [];
+  for (const m of messages) {
+    if (m.role === "user" || m.role === "assistant" || m.role === "toolResult") {
+      out.push(m);
+    }
+  }
+  return out;
+}
+var SUMMARY_SYSTEM_PROMPT = `You compress an AI agent conversation transcript into a short durable note.
+
+Extract only:
+- User intents and requests
+- Actions the agent took and their outcomes
+- Key findings, insights, decisions
+- Outstanding TODOs or deferred follow-ups
+
+Style: dense bullet points. No preamble, no closing remarks, no agent self-commentary. Keep the note under 1500 characters.`;
+function truncateToByteLimit(text, maxBytes) {
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) return text;
+  const suffix = "\u2026[truncated]";
+  const budget = maxBytes - Buffer.byteLength(suffix, "utf8");
+  let buf = Buffer.from(text, "utf8").subarray(0, budget);
+  while (buf.length > 0 && (buf[buf.length - 1] & 192) === 128) {
+    buf = buf.subarray(0, buf.length - 1);
+  }
+  return buf.toString("utf8") + suffix;
+}
+async function runSummaryLlm(args) {
+  const context = {
+    systemPrompt: SUMMARY_SYSTEM_PROMPT,
+    messages: toLlmMessages(args.chunk)
+  };
+  const apiKey = args.getApiKey?.(args.model.provider);
+  const resp = await complete(args.model, context, apiKey ? { apiKey } : {});
+  const parts = resp.content.filter((p) => p.type === "text");
+  const text = parts.map((p) => p.text).join("\n").trim();
+  if (!text) throw new Error("summary LLM returned no text content");
+  return text;
+}
+async function compactMessages(args) {
+  const target = Math.floor(args.messages.length * COMPACTION_TARGET_RATIO);
+  const split = findSafeSplit(args.messages, target);
+  if (split === 0) return null;
+  const chunk = args.messages.slice(0, split);
+  const suffix = args.messages.slice(split);
+  const summarize = args.summarize ?? runSummaryLlm;
+  const rawSummary = await summarize({ model: args.model, chunk, getApiKey: args.getApiKey });
+  const summary = truncateToByteLimit(rawSummary, AGENT_MEMORY_VALUE_MAX_BYTES);
+  writeCompactionNote(args.db, {
+    projectId: args.projectId,
+    sessionId: args.sessionId,
+    summary,
+    removedCount: chunk.length
+  });
+  return { messages: suffix, removedCount: chunk.length, summary };
+}
+
+// src/agent/session-registry.ts
+var log7 = createLogger("SessionRegistry");
+var MAX_HYDRATE_NOTES = 20;
+var MAX_HYDRATE_BYTES = 32 * 1024;
+function escapeMemoryFragment(value) {
+  return value.replace(/<(\/?)memory>/gi, "<$1\u200Cmemory>");
+}
+var SessionRegistry = class {
+  live = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  /** Last tool scope used on the live Agent for a project. Read in getOrCreate to know when to swap. */
+  scopes = /* @__PURE__ */ new Map();
+  /** Cached resolved project id per project name, used so alignScope can rebuild tool context without a DB roundtrip. */
+  projectIds = /* @__PURE__ */ new Map();
+  /**
+   * In-flight compaction promises keyed by project name. A second
+   * `acquireForTurn` that arrives while the first is still summarizing
+   * awaits the same promise instead of kicking off a duplicate LLM call.
+   */
+  compactions = /* @__PURE__ */ new Map();
+  opts;
+  constructor(opts) {
+    this.opts = opts;
+  }
+  /** Read-only access to the config snapshot the registry was built with. */
+  getConfig() {
+    return this.opts.config;
+  }
+  /**
+   * Returns the live Agent for a project, hydrating from DB or creating
+   * fresh. Applies caller preferences on fresh/hydrated construction. Does
+   * NOT mutate an already-cached Agent — that path goes through
+   * `acquireForTurn`, which gates scope/model changes behind a busy check
+   * so an in-flight turn can't have its tools swapped out from under it.
+   */
+  getOrCreate(projectName, preferences) {
+    const cached = this.live.get(projectName);
+    if (cached) return cached;
+    const projectId = this.resolveProjectId(projectName);
+    const row = this.loadRow(projectId);
+    if (row) {
+      const persistedMessages = parseJsonColumn(row.messages, []);
+      const queued = parseJsonColumn(row.followUpQueue, []);
+      const effectiveProvider = preferences?.provider ?? row.modelProvider;
+      const effectiveModelId = preferences?.modelId ?? row.modelId;
+      if (preferences?.provider || preferences?.modelId) {
+        this.opts.db.update(agentSessions).set({
+          modelProvider: effectiveProvider,
+          modelId: effectiveModelId,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }).where(eq24(agentSessions.projectId, projectId)).run();
+      }
+      const agent2 = createAeroSession({
+        projectName,
+        client: this.opts.client,
+        config: this.opts.config,
+        db: this.opts.db,
+        projectId,
+        provider: effectiveProvider,
+        modelId: effectiveModelId,
+        systemPromptOverride: this.buildHydratedSystemPrompt(projectId, row.systemPrompt),
+        initialMessages: persistedMessages,
+        toolScope: preferences?.toolScope
+      });
+      this.scopes.set(projectName, preferences?.toolScope ?? "all");
+      this.projectIds.set(projectName, projectId);
+      if (queued.length > 0) {
+        this.appendPending(projectName, queued);
+        this.updateRow(projectId, { followUpQueue: "[]" });
+      }
+      this.live.set(projectName, agent2);
+      this.registerDrainHook(agent2, projectName);
+      return agent2;
+    }
+    const { provider, modelId } = resolveSessionProviderAndModel(this.opts.config, preferences);
+    const systemPrompt = loadAeroSystemPrompt();
+    const agent = createAeroSession({
+      projectName,
+      client: this.opts.client,
+      config: this.opts.config,
+      db: this.opts.db,
+      projectId,
+      provider,
+      modelId,
+      // Hydrate on the fresh path too — a brand-new session may still see
+      // notes if they were seeded via CLI/API before the first prompt.
+      systemPromptOverride: this.buildHydratedSystemPrompt(projectId, systemPrompt),
+      toolScope: preferences?.toolScope
+    });
+    this.scopes.set(projectName, preferences?.toolScope ?? "all");
+    this.projectIds.set(projectName, projectId);
+    this.insertRow({
+      projectId,
+      // Persist the raw (unhydrated) prompt so the DB remains canonical —
+      // the `<memory>` block is rebuilt from the notes table on every load.
+      systemPrompt,
+      modelProvider: provider,
+      modelId,
+      messages: [],
+      followUpQueue: []
+    });
+    this.live.set(projectName, agent);
+    this.registerDrainHook(agent, projectName);
+    return agent;
+  }
+  /**
+   * Append the `<memory>` block to a base system prompt, sourced from the
+   * `agent_memory` table. Returns the base prompt unchanged when no notes
+   * exist — an empty block would just be prompt noise. Truncates to
+   * `MAX_HYDRATE_BYTES`, dropping oldest-first, so the block is bounded
+   * even when notes sit near their 2 KB cap.
+   *
+   * Note values come from LLM-authored compaction summaries and operator
+   * input, so they are treated as untrusted data: closing tags that could
+   * escape the `<memory>` wrapper are neutralized before interpolation.
+   */
+  buildHydratedSystemPrompt(projectId, basePrompt) {
+    const entries = loadRecentForHydrate(this.opts.db, projectId, MAX_HYDRATE_NOTES);
+    if (entries.length === 0) return basePrompt;
+    let totalBytes = 0;
+    const kept = [];
+    for (const entry of entries) {
+      const escaped = {
+        source: escapeMemoryFragment(entry.source),
+        key: escapeMemoryFragment(entry.key),
+        value: escapeMemoryFragment(entry.value)
+      };
+      const line = `- [${escaped.source}] ${escaped.key}: ${escaped.value}
+`;
+      const bytes = Buffer.byteLength(line, "utf8");
+      if (totalBytes + bytes > MAX_HYDRATE_BYTES) break;
+      kept.push(escaped);
+      totalBytes += bytes;
+    }
+    if (kept.length === 0) return basePrompt;
+    const lines = kept.map((e) => `- [${e.source}] ${e.key}: ${e.value}`);
+    return `${basePrompt.trimEnd()}
+
+---
+
+<memory>
+Project-scoped durable notes (newest first). Use remember/forget/recall to manage. Entries tagged [compaction] are LLM-summarized transcript slices.
+
+${lines.join("\n")}
+</memory>`;
+  }
+  /**
+   * Rebuild the live agent's system prompt from the latest `agent_memory`
+   * rows. Called after out-of-band memory writes (CLI/API PUT/DELETE) so
+   * the next turn on a hot session sees the updated notes without waiting
+   * for compaction or a cold restart. No-op when no live agent exists —
+   * the next `getOrCreate` will hydrate from DB anyway.
+   */
+  rehydrateLiveMemory(projectName) {
+    const agent = this.live.get(projectName);
+    if (!agent) return;
+    const projectId = this.tryResolveProjectId(projectName);
+    if (!projectId) return;
+    const row = this.loadRow(projectId);
+    if (!row) return;
+    agent.state.systemPrompt = this.buildHydratedSystemPrompt(projectId, row.systemPrompt);
+  }
+  /**
+   * Acquire the Agent for an upcoming prompt/turn.
+   *
+   * Busy-check runs FIRST, before any state mutation — if two requests race
+   * on the same project, one gets the 409 and the other's in-flight turn is
+   * untouched. Only after confirming idle do we:
+   *   - align `state.tools` to the requested scope (CLI full vs dashboard
+   *     read-only share the same cached Agent; each request re-scopes it).
+   *   - align `state.model` when the caller passes `provider` or `modelId`,
+   *     honoring `--provider` / `--model` on hot sessions (not just on
+   *     fresh/hydrated construction).
+   *
+   * Persists the new model choice to the DB row so subsequent invocations
+   * stay on it unless overridden again.
+   */
+  async acquireForTurn(projectName, preferences) {
+    const agent = this.getOrCreate(projectName);
+    if (agent.state.isStreaming) {
+      throw agentBusy(projectName);
+    }
+    this.alignScope(projectName, agent, preferences?.toolScope ?? "all");
+    if (preferences?.provider || preferences?.modelId) {
+      this.alignModel(projectName, agent, preferences);
+    }
+    await this.maybeCompact(projectName, agent);
+    return agent;
+  }
+  /**
+   * Summarize the oldest half of the transcript into a `compaction:`
+   * memory row when the transcript crosses the token/message threshold.
+   * Runs before the caller's next `agent.prompt()` so the model sees the
+   * trimmed transcript + a refreshed `<memory>` block that now includes
+   * the new summary.
+   *
+   * Races are deduped through `this.compactions`: a concurrent call for
+   * the same project awaits the in-flight promise instead of launching a
+   * duplicate summarizer run. Failures are logged and swallowed — a flaky
+   * summarizer must never block a user turn.
+   */
+  async maybeCompact(projectName, agent) {
+    const inflight = this.compactions.get(projectName);
+    if (inflight) {
+      await inflight;
+      return;
+    }
+    if (!shouldCompact(agent.state.messages)) return;
+    const promise = this.runCompaction(projectName, agent).finally(() => {
+      this.compactions.delete(projectName);
+    });
+    this.compactions.set(projectName, promise);
+    await promise;
+  }
+  async runCompaction(projectName, agent) {
+    const projectId = this.projectIds.get(projectName) ?? this.resolveProjectId(projectName);
+    this.projectIds.set(projectName, projectId);
+    const row = this.loadRow(projectId);
+    if (!row) return;
+    try {
+      const result = await compactMessages({
+        db: this.opts.db,
+        projectId,
+        sessionId: row.id,
+        messages: agent.state.messages,
+        model: agent.state.model,
+        getApiKey: buildApiKeyResolver(this.opts.config)
+      });
+      if (!result) return;
+      agent.state.messages = result.messages;
+      agent.state.systemPrompt = this.buildHydratedSystemPrompt(projectId, row.systemPrompt);
+      this.save(projectName);
+      log7.info("compaction.completed", {
+        projectName,
+        removedCount: result.removedCount,
+        summaryBytes: Buffer.byteLength(result.summary, "utf8")
+      });
+    } catch (err) {
+      log7.error("compaction.failed", {
+        projectName,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  alignScope(projectName, agent, wantScope) {
+    if (this.scopes.get(projectName) === wantScope) return;
+    const projectId = this.projectIds.get(projectName) ?? this.resolveProjectId(projectName);
+    this.projectIds.set(projectName, projectId);
+    const toolCtx = { client: this.opts.client, projectName, db: this.opts.db, projectId };
+    const stateTools = wantScope === "read-only" ? buildReadTools(toolCtx) : buildAllTools(toolCtx);
+    agent.state.tools = [...stateTools, ...buildSkillDocTools()];
+    this.scopes.set(projectName, wantScope);
+  }
+  alignModel(projectName, agent, preferences) {
+    const projectId = this.tryResolveProjectId(projectName);
+    if (!projectId) return;
+    const row = this.loadRow(projectId);
+    const currentProvider = row?.modelProvider ?? AgentProviderIds.claude;
+    const currentModelId = row?.modelId;
+    const nextProvider = preferences.provider ?? currentProvider;
+    const nextModelId = preferences.modelId ?? (preferences.provider ? getAgentProvider(nextProvider).defaultModel : currentModelId);
+    if (!nextModelId) return;
+    if (nextProvider === currentProvider && nextModelId === currentModelId) return;
+    agent.state.model = resolveAeroModel(nextProvider, nextModelId);
+    this.opts.db.update(agentSessions).set({
+      modelProvider: nextProvider,
+      modelId: nextModelId,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }).where(eq24(agentSessions.projectId, projectId)).run();
+  }
+  /** Persist a session's transcript back to the DB. Call after any run settles. */
+  save(projectName) {
+    const agent = this.live.get(projectName);
+    if (!agent) return;
+    const projectId = this.resolveProjectId(projectName);
+    this.updateRow(projectId, {
+      messages: JSON.stringify(agent.state.messages)
+    });
+  }
+  /**
+   * Enqueue a message for the next turn.
+   *
+   * - Live session exists: append to the in-memory pending queue. The next
+   *   `consumePending`-backed prompt, a `drainNow` call, or the post-`agent_end`
+   *   drain hook will process it.
+   * - No live session: persist to the DB follow-up queue. The next
+   *   `getOrCreate` hydrates the agent and migrates the queue into pending.
+   *
+   * Crucially writes to exactly ONE of the two sinks to avoid the duplicate
+   * message we saw during the first end-to-end dogfood (run.completed fired,
+   * both the in-memory pending and the DB-queue migration produced copies).
+   */
+  queueFollowUp(projectName, message) {
+    if (this.live.has(projectName)) {
+      this.appendPending(projectName, [message]);
+    } else {
+      this.persistQueueAppend(projectName, message);
+    }
+  }
+  /** Consume (and clear) the pending queue for a project. Caller prompts with the result. */
+  consumePending(projectName) {
+    const msgs = this.pending.get(projectName) ?? [];
+    if (msgs.length === 0) return [];
+    this.pending.delete(projectName);
+    const projectId = this.tryResolveProjectId(projectName);
+    if (projectId) this.updateRow(projectId, { followUpQueue: "[]" });
+    return msgs;
+  }
+  /**
+   * Proactive drain — hydrate if needed, consume pending, prompt the agent.
+   *
+   * No-op when:
+   *   - there are no pending messages in memory AND no persisted queue in
+   *     the DB (post-restart / never-hydrated sessions still need to wake)
+   *   - the agent is currently streaming (it will pick them up on the next turn)
+   *
+   * Fire-and-forget safe: failures are logged, never thrown. This is what
+   * RunCoordinator calls after a run completes to wake Aero unprompted.
+   */
+  async drainNow(projectName) {
+    if (!this.hasPendingWork(projectName)) return;
+    try {
+      let agent;
+      try {
+        const scope = this.scopes.get(projectName) ?? "read-only";
+        agent = await this.acquireForTurn(projectName, { toolScope: scope });
+      } catch (err) {
+        if (err.code === "AGENT_BUSY") return;
+        throw err;
+      }
+      const msgs = this.consumePending(projectName);
+      if (msgs.length === 0) return;
+      await agent.prompt(msgs);
+      this.save(projectName);
+    } catch (err) {
+      log7.error("drain.failed", {
+        projectName,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  /** Drop the live Agent for a project. Next lookup rehydrates from DB. */
+  evict(projectName) {
+    this.live.delete(projectName);
+  }
+  /**
+   * Authoritative reset for a project's session state. Drops the live Agent,
+   * clears the in-memory pending follow-up buffer, and forgets the cached
+   * tool scope. Caller is responsible for wiping the durable row; this only
+   * touches the in-process state the registry holds.
+   *
+   * Use this (not `evict`) when the caller guarantees the conversation is
+   * being wiped — e.g. `DELETE /agent/transcript`. `evict` alone leaves any
+   * in-memory follow-ups queued on a hot session, which would leak into the
+   * next turn after the reset.
+   */
+  reset(projectName) {
+    this.live.delete(projectName);
+    this.pending.delete(projectName);
+    this.scopes.delete(projectName);
+    this.projectIds.delete(projectName);
+  }
+  /** Evict every live Agent. Durable state in DB is untouched. */
+  clear() {
+    this.live.clear();
+  }
+  /** Visible so tests can assert whether a session is hot. */
+  isLive(projectName) {
+    return this.live.has(projectName);
+  }
+  /** Visible so tests can peek at the pending queue without consuming. */
+  peekPending(projectName) {
+    return this.pending.get(projectName) ?? [];
+  }
+  // ──────────────────────────────────────────────────────────────────
+  /**
+   * True when there's in-memory pending work OR a persisted follow-up queue
+   * for this project. Checked by `drainNow` before doing any hydration work
+   * so proactive wake-up fires even on cold / post-restart sessions where
+   * the follow-up lives only in the DB row.
+   */
+  hasPendingWork(projectName) {
+    if ((this.pending.get(projectName) ?? []).length > 0) return true;
+    const projectId = this.tryResolveProjectId(projectName);
+    if (!projectId) return false;
+    const row = this.loadRow(projectId);
+    if (!row) return false;
+    return parseJsonColumn(row.followUpQueue, []).length > 0;
+  }
+  appendPending(projectName, messages) {
+    if (messages.length === 0) return;
+    const existing = this.pending.get(projectName) ?? [];
+    this.pending.set(projectName, [...existing, ...messages]);
+  }
+  persistQueueAppend(projectName, message) {
+    const projectId = this.tryResolveProjectId(projectName);
+    if (!projectId) return;
+    const row = this.loadRow(projectId);
+    if (!row) {
+      this.insertRow({
+        projectId,
+        systemPrompt: loadAeroSystemPrompt(),
+        ...resolveSessionProviderAndModel(this.opts.config),
+        messages: [],
+        followUpQueue: [message]
+      });
+      return;
+    }
+    const existing = parseJsonColumn(row.followUpQueue, []);
+    this.updateRow(projectId, { followUpQueue: JSON.stringify([...existing, message]) });
+  }
+  /**
+   * Subscribe to agent_end so any pending messages that landed during a run
+   * (from RunCoordinator callbacks or steered follow-ups) drain automatically
+   * after the current turn settles. Without this, a RunCoordinator event that
+   * arrives mid-CLI-turn would sit in pending until someone called drainNow.
+   */
+  registerDrainHook(agent, projectName) {
+    agent.subscribe((event) => {
+      if (event.type !== "agent_end") return;
+      if ((this.pending.get(projectName) ?? []).length === 0) return;
+      void this.drainNow(projectName);
+    });
+  }
+  resolveProjectId(projectName) {
+    const id = this.tryResolveProjectId(projectName);
+    if (!id) throw new Error(`Project "${projectName}" not found`);
+    return id;
+  }
+  tryResolveProjectId(projectName) {
+    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq24(projects.name, projectName)).get();
+    return row?.id;
+  }
+  loadRow(projectId) {
+    const row = this.opts.db.select().from(agentSessions).where(eq24(agentSessions.projectId, projectId)).get();
+    return row ?? null;
+  }
+  insertRow(params) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.opts.db.insert(agentSessions).values({
+      id: crypto23.randomUUID(),
+      projectId: params.projectId,
+      systemPrompt: params.systemPrompt,
+      modelProvider: params.provider ?? params.modelProvider ?? AgentProviderIds.claude,
+      modelId: params.modelId ?? "claude-opus-4-7",
+      messages: JSON.stringify(params.messages),
+      followUpQueue: JSON.stringify(params.followUpQueue),
+      createdAt: now,
+      updatedAt: now
+    }).run();
+  }
+  updateRow(projectId, patch) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq24(agentSessions.projectId, projectId)).run();
+  }
+};
+
+// src/agent/agent-routes.ts
+import { eq as eq25 } from "drizzle-orm";
+function resolveProject2(db, name) {
+  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq25(projects.name, name)).get();
+  if (!row) throw notFound("project", name);
+  return row;
+}
+function registerAgentRoutes(app, opts) {
+  app.get(
+    "/projects/:name/agent/transcript",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      const row = opts.db.select().from(agentSessions).where(eq25(agentSessions.projectId, project.id)).get();
+      if (!row) {
+        return { messages: [], modelProvider: null, modelId: null, updatedAt: null };
+      }
+      return {
+        messages: parseJsonColumn(row.messages, []),
+        modelProvider: row.modelProvider,
+        modelId: row.modelId,
+        updatedAt: row.updatedAt
+      };
+    }
+  );
+  app.get(
+    "/projects/:name/agent/providers",
+    async (request) => {
+      resolveProject2(opts.db, request.params.name);
+      return buildAgentProvidersResponse(opts.sessionRegistry.getConfig());
+    }
+  );
+  app.delete(
+    "/projects/:name/agent/transcript",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      opts.sessionRegistry.reset(project.name);
+      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq25(agentSessions.projectId, project.id)).run();
+      return { status: "reset" };
+    }
+  );
+  app.post("/projects/:name/agent/prompt", async (request, reply) => {
+    const project = resolveProject2(opts.db, request.params.name);
+    const promptText = (request.body?.prompt ?? "").trim();
+    if (!promptText) throw validationError('"prompt" is required');
+    const requestedScope = request.body?.scope === "all" ? "all" : "read-only";
+    const agent = await opts.sessionRegistry.acquireForTurn(project.name, {
+      provider: request.body?.provider,
+      modelId: request.body?.modelId,
+      toolScope: requestedScope
+    });
+    reply.raw.writeHead(200, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      "Connection": "keep-alive",
+      "X-Accel-Buffering": "no"
+    });
+    const write = (payload) => {
+      if (reply.raw.writableEnded) return;
+      try {
+        reply.raw.write(`data: ${JSON.stringify(payload)}
+
+`);
+      } catch {
+      }
+    };
+    write({ type: "stream_open" });
+    const unsubscribe = agent.subscribe((event) => {
+      write(event);
+    });
+    reply.raw.once("close", () => {
+      if (!reply.raw.writableEnded) {
+        agent.abort();
+      }
+    });
+    try {
+      const pending = opts.sessionRegistry.consumePending(project.name);
+      const userMessage = {
+        role: "user",
+        content: promptText,
+        timestamp: Date.now()
+      };
+      const batch = pending.length > 0 ? [...pending, userMessage] : userMessage;
+      await agent.prompt(batch);
+      await agent.waitForIdle();
+      opts.sessionRegistry.save(project.name);
+    } catch (err) {
+      write({ type: "error", message: err instanceof Error ? err.message : String(err) });
+    } finally {
+      unsubscribe();
+      write({ type: "stream_close" });
+      if (!reply.raw.writableEnded) {
+        reply.raw.end();
+      }
+    }
+    return reply;
+  });
+  app.get(
+    "/projects/:name/agent/memory",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      return { entries: listMemoryEntries(opts.db, project.id) };
+    }
+  );
+  app.put(
+    "/projects/:name/agent/memory",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      const parsed = agentMemoryUpsertRequestSchema.safeParse(request.body);
+      if (!parsed.success) {
+        throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
+      }
+      if (parsed.data.key.startsWith(COMPACTION_KEY_PREFIX)) {
+        throw validationError(
+          `key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`
+        );
+      }
+      if (Buffer.byteLength(parsed.data.value, "utf8") > AGENT_MEMORY_VALUE_MAX_BYTES) {
+        throw validationError(`"value" exceeds ${AGENT_MEMORY_VALUE_MAX_BYTES} bytes`);
+      }
+      const entry = upsertMemoryEntry(opts.db, {
+        projectId: project.id,
+        key: parsed.data.key,
+        value: parsed.data.value,
+        source: MemorySources.user
+      });
+      opts.sessionRegistry.rehydrateLiveMemory(project.name);
+      return { status: "ok", entry };
+    }
+  );
+  app.delete(
+    "/projects/:name/agent/memory",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      const parsed = agentMemoryDeleteRequestSchema.safeParse(request.body);
+      if (!parsed.success) {
+        throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
+      }
+      if (parsed.data.key.startsWith(COMPACTION_KEY_PREFIX)) {
+        throw validationError(
+          `key prefix "${COMPACTION_KEY_PREFIX}" is reserved; compaction notes are pruned automatically`
+        );
+      }
+      const removed = deleteMemoryEntry(opts.db, project.id, parsed.data.key);
+      if (removed) opts.sessionRegistry.rehydrateLiveMemory(project.name);
+      return { status: removed ? "forgotten" : "missing", key: parsed.data.key };
+    }
+  );
+}
+
+// src/client.ts
+function createApiClient() {
+  const config = loadConfig();
+  const basePathResolved = !!config.basePath || "CANONRY_BASE_PATH" in process.env;
+  return new ApiClient(config.apiUrl, config.apiKey, { skipProbe: basePathResolved });
+}
+var ApiClient = class {
+  baseUrl;
+  originUrl;
+  apiKey;
+  probePromise = null;
+  probeSkipped;
+  constructor(baseUrl, apiKey, opts) {
+    this.originUrl = baseUrl.replace(/\/$/, "");
+    this.baseUrl = this.originUrl + "/api/v1";
+    this.apiKey = apiKey;
+    this.probeSkipped = opts?.skipProbe ?? false;
+  }
+  /**
+   * On first API call, probe /health to auto-discover basePath when the user
+   * hasn't configured one locally. This lets `canonry run` in a separate shell
+   * discover that the server is running at e.g. /canonry/ without requiring
+   * config.yaml edits or CANONRY_BASE_PATH in every shell.
+   */
+  probeBasePath() {
+    if (this.probeSkipped) return Promise.resolve();
+    if (!this.probePromise) {
+      this.probePromise = (async () => {
+        try {
+          const origin = new URL(this.originUrl).origin;
+          const res = await fetch(`${origin}/health`, {
+            signal: AbortSignal.timeout(2e3)
+          });
+          if (res.ok) {
+            const body = await res.json();
+            if (body.basePath && typeof body.basePath === "string") {
+              const normalized = "/" + body.basePath.replace(/^\/|\/$/g, "");
+              if (normalized !== "/") {
+                this.originUrl = origin + normalized;
+                this.baseUrl = this.originUrl + "/api/v1";
+              }
+            }
+          }
+        } catch {
+        }
+      })();
+    }
+    return this.probePromise;
+  }
+  async request(method, path10, body) {
+    await this.probeBasePath();
+    const url = `${this.baseUrl}${path10}`;
+    const serializedBody = body != null ? JSON.stringify(body) : void 0;
+    const headers = {
+      "Authorization": `Bearer ${this.apiKey}`,
+      "Accept": "application/json",
+      ...serializedBody != null ? { "Content-Type": "application/json" } : {}
+    };
+    let res;
+    try {
+      res = await fetch(url, {
+        method,
+        headers,
+        body: serializedBody
+      });
+    } catch (err) {
+      if (err instanceof CliError) throw err;
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes("fetch failed") || msg.includes("ECONNREFUSED") || msg.includes("connect ECONNREFUSED")) {
+        throw new CliError({
+          code: "CONNECTION_ERROR",
+          message: `Could not connect to canonry server at ${this.baseUrl.replace("/api/v1", "")}. Start it with "canonry serve" (or "canonry serve &" to run in background).`,
+          exitCode: EXIT_SYSTEM_ERROR
+        });
+      }
+      throw new CliError({ code: "CONNECTION_ERROR", message: msg, exitCode: EXIT_SYSTEM_ERROR });
+    }
+    if (!res.ok) {
+      let errorBody;
+      try {
+        errorBody = await res.json();
+      } catch {
+        errorBody = { error: { code: "UNKNOWN", message: res.statusText } };
+      }
+      const errorObj = errorBody && typeof errorBody === "object" && "error" in errorBody && errorBody.error && typeof errorBody.error === "object" ? errorBody.error : null;
+      const msg = errorObj?.message ? String(errorObj.message) : `HTTP ${res.status}: ${res.statusText}`;
+      const code = errorObj?.code ? String(errorObj.code) : "API_ERROR";
+      const exitCode = res.status >= 500 ? EXIT_SYSTEM_ERROR : EXIT_USER_ERROR;
+      throw new CliError({ code, message: msg, exitCode });
+    }
+    if (res.status === 204) {
+      return void 0;
+    }
+    return await res.json();
+  }
+  async getAgentTranscript(project) {
+    return this.request(
+      "GET",
+      `/projects/${encodeURIComponent(project)}/agent/transcript`
+    );
+  }
+  async resetAgentTranscript(project) {
+    await this.request(
+      "DELETE",
+      `/projects/${encodeURIComponent(project)}/agent/transcript`
+    );
+  }
+  async listAgentProviders(project) {
+    return this.request(
+      "GET",
+      `/projects/${encodeURIComponent(project)}/agent/providers`
+    );
+  }
+  async listAgentMemory(project) {
+    return this.request(
+      "GET",
+      `/projects/${encodeURIComponent(project)}/agent/memory`
+    );
+  }
+  async setAgentMemory(project, body) {
+    return this.request(
+      "PUT",
+      `/projects/${encodeURIComponent(project)}/agent/memory`,
+      body
+    );
+  }
+  async forgetAgentMemory(project, key) {
+    return this.request(
+      "DELETE",
+      `/projects/${encodeURIComponent(project)}/agent/memory`,
+      { key }
+    );
+  }
+  /**
+   * POST a request whose response body the caller intends to consume as a
+   * stream (e.g. the Aero agent SSE endpoint). Shares the probe + auth +
+   * structured-error behavior of `request()`; the caller reads `res.body`
+   * and releases the response when done.
+   */
+  async streamPost(path10, body, signal) {
+    await this.probeBasePath();
+    const url = `${this.baseUrl}${path10}`;
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      "Content-Type": "application/json",
+      Accept: "text/event-stream"
+    };
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body ?? {}),
+        signal
+      });
+    } catch (err) {
+      if (err instanceof CliError) throw err;
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes("fetch failed") || msg.includes("ECONNREFUSED") || msg.includes("connect ECONNREFUSED")) {
+        throw new CliError({
+          code: "CONNECTION_ERROR",
+          message: `Could not connect to canonry server at ${this.baseUrl.replace("/api/v1", "")}. Start it with "canonry serve" (or "canonry serve &" to run in background).`,
+          exitCode: EXIT_SYSTEM_ERROR
+        });
+      }
+      throw new CliError({ code: "CONNECTION_ERROR", message: msg, exitCode: EXIT_SYSTEM_ERROR });
+    }
+    if (!res.ok || !res.body) {
+      let errorBody;
+      try {
+        errorBody = await res.json();
+      } catch {
+        errorBody = { error: { code: "UNKNOWN", message: res.statusText } };
+      }
+      const errorObj = errorBody && typeof errorBody === "object" && "error" in errorBody && errorBody.error ? errorBody.error : null;
+      const msg = errorObj?.message ? String(errorObj.message) : `HTTP ${res.status}: ${res.statusText}`;
+      const code = errorObj?.code ? String(errorObj.code) : "API_ERROR";
+      const exitCode = res.status >= 500 ? EXIT_SYSTEM_ERROR : EXIT_USER_ERROR;
+      throw new CliError({ code, message: msg, exitCode });
+    }
+    return res;
+  }
+  async putProject(name, body) {
+    return this.request("PUT", `/projects/${encodeURIComponent(name)}`, body);
+  }
+  async listProjects() {
+    return this.request("GET", "/projects");
+  }
+  async getProject(name) {
+    return this.request("GET", `/projects/${encodeURIComponent(name)}`);
+  }
+  async deleteProject(name) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(name)}`);
+  }
+  async putKeywords(project, keywords2) {
+    await this.request("PUT", `/projects/${encodeURIComponent(project)}/keywords`, { keywords: keywords2 });
+  }
+  async listKeywords(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/keywords`);
+  }
+  async deleteKeywords(project, keywords2) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/keywords`, { keywords: keywords2 });
+  }
+  async appendKeywords(project, keywords2) {
+    await this.request("POST", `/projects/${encodeURIComponent(project)}/keywords`, { keywords: keywords2 });
+  }
+  async putCompetitors(project, competitors2) {
+    await this.request("PUT", `/projects/${encodeURIComponent(project)}/competitors`, { competitors: competitors2 });
+  }
+  async listCompetitors(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/competitors`);
+  }
+  async triggerRun(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/runs`, body ?? {});
+  }
+  async listRuns(project, limit) {
+    const query = limit != null ? `?limit=${encodeURIComponent(String(limit))}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/runs${query}`);
+  }
+  async getRun(id) {
+    return this.request("GET", `/runs/${encodeURIComponent(id)}`);
+  }
+  async cancelRun(id) {
+    return this.request("POST", `/runs/${encodeURIComponent(id)}/cancel`);
+  }
+  async getTimeline(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/timeline`);
+  }
+  async getHistory(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/history`);
+  }
+  async getExport(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/export`);
+  }
+  async apply(config) {
+    return this.request("POST", "/apply", config);
+  }
+  async getStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}`);
+  }
+  async getSettings() {
+    return this.request("GET", "/settings");
+  }
+  async createSnapshot(body) {
+    return this.request("POST", "/snapshot", body);
+  }
+  async updateProvider(name, body) {
+    return this.request("PUT", `/settings/providers/${encodeURIComponent(name)}`, body);
+  }
+  async putSchedule(project, body) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/schedule`, body);
+  }
+  async getSchedule(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/schedule`);
+  }
+  async deleteSchedule(project) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/schedule`);
+  }
+  async createNotification(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/notifications`, body);
+  }
+  async listNotifications(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/notifications`);
+  }
+  async deleteNotification(project, id) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/notifications/${encodeURIComponent(id)}`);
+  }
+  async testNotification(project, id) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/notifications/${encodeURIComponent(id)}/test`);
+  }
+  async addLocation(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/locations`, body);
+  }
+  async listLocations(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/locations`);
+  }
+  async removeLocation(project, label) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/locations/${encodeURIComponent(label)}`);
+  }
+  async setDefaultLocation(project, label) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/locations/default`, { label });
+  }
+  async getTelemetry() {
+    return this.request("GET", "/telemetry");
+  }
+  async updateTelemetry(enabled) {
+    return this.request("PUT", "/telemetry", { enabled });
+  }
+  async generateKeywords(project, provider, count) {
+    return this.request(
+      "POST",
+      `/projects/${encodeURIComponent(project)}/keywords/generate`,
+      { provider, count }
+    );
+  }
+  // Google connection management
+  async googleConnect(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/connect`, body);
+  }
+  async googleConnections(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/connections`);
+  }
+  async googleDisconnect(project, type) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/google/connections/${encodeURIComponent(type)}`);
+  }
+  async googleProperties(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/properties`);
+  }
+  async googleSetProperty(project, type, propertyId) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/google/connections/${encodeURIComponent(type)}/property`, { propertyId });
+  }
+  async googleSetSitemap(project, type, sitemapUrl) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/google/connections/${encodeURIComponent(type)}/sitemap`, { sitemapUrl });
+  }
+  // GSC data
+  async gscSync(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/gsc/sync`, body ?? {});
+  }
+  async gscPerformance(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/performance${qs}`);
+  }
+  async gscInspect(project, url) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/gsc/inspect`, { url });
+  }
+  async gscInspections(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/inspections${qs}`);
+  }
+  async gscDeindexed(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/deindexed`);
+  }
+  async gscCoverage(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/coverage`);
+  }
+  async gscCoverageHistory(project, params) {
+    const qs = params?.limit != null ? `?limit=${params.limit}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/coverage/history${qs}`);
+  }
+  async gscInspectSitemap(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/gsc/inspect-sitemap`, body ?? {});
+  }
+  async gscSitemaps(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/google/gsc/sitemaps`);
+  }
+  async gscDiscoverSitemaps(project) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/gsc/discover-sitemaps`, {});
+  }
+  // Analytics
+  async getAnalyticsMetrics(project, window) {
+    const qs = window ? `?window=${encodeURIComponent(window)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/analytics/metrics${qs}`);
+  }
+  async getAnalyticsGaps(project, window) {
+    const qs = window ? `?window=${encodeURIComponent(window)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/analytics/gaps${qs}`);
+  }
+  async getAnalyticsSources(project, window) {
+    const qs = window ? `?window=${encodeURIComponent(window)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/analytics/sources${qs}`);
+  }
+  // Google Indexing API
+  async googleRequestIndexing(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/google/indexing/request`, body);
+  }
+  // Bing Webmaster Tools
+  async bingConnect(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/bing/connect`, body);
+  }
+  async bingDisconnect(project) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/bing/disconnect`);
+  }
+  async bingStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/status`);
+  }
+  async bingSites(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/sites`);
+  }
+  async bingSetSite(project, siteUrl) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/bing/set-site`, { siteUrl });
+  }
+  async bingCoverage(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/coverage`);
+  }
+  async bingCoverageHistory(project, params) {
+    const qs = params?.limit != null ? `?limit=${params.limit}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/coverage/history${qs}`);
+  }
+  async bingInspections(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/inspections${qs}`);
+  }
+  async bingInspectUrl(project, url) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/bing/inspect-url`, { url });
+  }
+  async bingRequestIndexing(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/bing/request-indexing`, body);
+  }
+  async bingPerformance(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/bing/performance${qs}`);
+  }
+  // CDP browser provider
+  async getCdpStatus() {
+    return this.request("GET", "/cdp/status");
+  }
+  async cdpScreenshot(query, targets) {
+    return this.request("POST", "/cdp/screenshot", { query, targets });
+  }
+  async getBrowserDiff(project, runId) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/runs/${encodeURIComponent(runId)}/browser-diff`);
+  }
+  // Google Analytics 4
+  async gaConnect(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/ga/connect`, body);
+  }
+  async gaDisconnect(project) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/ga/disconnect`);
+  }
+  async gaStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/status`);
+  }
+  async gaSync(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/ga/sync`, body ?? {});
+  }
+  async gaTraffic(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/traffic${qs}`);
+  }
+  async gaCoverage(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/coverage`);
+  }
+  async gaAiReferralHistory(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/ai-referral-history${qs}`);
+  }
+  async gaSocialReferralHistory(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/social-referral-history${qs}`);
+  }
+  async gaSocialReferralTrend(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/social-referral-trend`);
+  }
+  async gaAttributionTrend(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/attribution-trend`);
+  }
+  async gaSessionHistory(project, params) {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/ga/session-history${qs}`);
+  }
+  async wordpressConnect(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/connect`, body);
+  }
+  async wordpressDisconnect(project) {
+    await this.request("DELETE", `/projects/${encodeURIComponent(project)}/wordpress/disconnect`);
+  }
+  async wordpressStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/status`);
+  }
+  async wordpressPages(project, env) {
+    const qs = env ? `?env=${encodeURIComponent(env)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/pages${qs}`);
+  }
+  async wordpressPage(project, slug, env) {
+    const params = new URLSearchParams({ slug });
+    if (env) params.set("env", env);
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/page?${params.toString()}`);
+  }
+  async wordpressCreatePage(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/pages`, body);
+  }
+  async wordpressUpdatePage(project, body) {
+    return this.request("PUT", `/projects/${encodeURIComponent(project)}/wordpress/page`, body);
+  }
+  async wordpressSetMeta(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/page/meta`, body);
+  }
+  async wordpressBulkSetMeta(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/pages/meta/bulk`, body);
+  }
+  async wordpressSchema(project, slug, env) {
+    const params = new URLSearchParams({ slug });
+    if (env) params.set("env", env);
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/schema?${params.toString()}`);
+  }
+  async wordpressSetSchema(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/schema/manual`, body);
+  }
+  async wordpressSchemaDeploy(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/schema/deploy`, body);
+  }
+  async wordpressSchemaStatus(project, env) {
+    const params = new URLSearchParams();
+    if (env) params.set("env", env);
+    const qs = params.toString();
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/schema/status${qs ? `?${qs}` : ""}`);
+  }
+  async wordpressOnboard(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/onboard`, body);
+  }
+  async wordpressLlmsTxt(project, env) {
+    const qs = env ? `?env=${encodeURIComponent(env)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/llms-txt${qs}`);
+  }
+  async wordpressSetLlmsTxt(project, body) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/llms-txt/manual`, body);
+  }
+  async wordpressAudit(project, env) {
+    const qs = env ? `?env=${encodeURIComponent(env)}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/audit${qs}`);
+  }
+  async wordpressDiff(project, slug) {
+    const params = new URLSearchParams({ slug });
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/diff?${params.toString()}`);
+  }
+  async wordpressStagingStatus(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/wordpress/staging/status`);
+  }
+  async wordpressStagingPush(project) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/wordpress/staging/push`);
+  }
+  // ── Intelligence ──────────────────────────────────────────────────────
+  async getInsights(project, opts) {
+    const params = new URLSearchParams();
+    if (opts?.dismissed) params.set("dismissed", "true");
+    if (opts?.runId) params.set("runId", opts.runId);
+    const qs = params.toString();
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/insights${qs ? `?${qs}` : ""}`);
+  }
+  async dismissInsight(project, id) {
+    return this.request("POST", `/projects/${encodeURIComponent(project)}/insights/${encodeURIComponent(id)}/dismiss`);
+  }
+  async getHealth(project) {
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/health/latest`);
+  }
+  async getHealthHistory(project, limit) {
+    const qs = limit ? `?limit=${limit}` : "";
+    return this.request("GET", `/projects/${encodeURIComponent(project)}/health/history${qs}`);
+  }
+};
+
+// src/snapshot-service.ts
+import { runAeoAudit } from "@ainyc/aeo-audit";
+
+// src/site-fetch.ts
+import https2 from "https";
+var FETCH_TIMEOUT_MS = 1e4;
+var MAX_TEXT_LENGTH = 4e3;
+var MAX_BODY_BYTES = 512e3;
+var USER_AGENT = "Canonry/1.0 (site-analysis)";
+function extractHostname(domain) {
+  let hostname = domain;
+  try {
+    if (hostname.includes("://")) {
+      hostname = new URL(hostname).hostname;
+    }
+  } catch {
+  }
+  return hostname.replace(/^www\./, "");
+}
+function fetchWithPinnedAddress(target) {
+  return new Promise((resolve) => {
+    const port = target.url.port ? Number(target.url.port) : 443;
+    const path10 = target.url.pathname + target.url.search;
+    const req = https2.request(
+      {
+        hostname: target.address,
+        family: target.family,
+        port,
+        path: path10,
+        method: "GET",
+        timeout: FETCH_TIMEOUT_MS,
+        servername: target.url.hostname,
+        // SNI for TLS
+        headers: {
+          Host: target.url.host,
+          "User-Agent": USER_AGENT,
+          Accept: "text/html"
+        }
+      },
+      (res) => {
+        if (res.statusCode && (res.statusCode < 200 || res.statusCode >= 300)) {
+          if (res.statusCode >= 300 && res.statusCode < 400) {
+            const location = res.headers.location ?? "";
+            res.resume();
+            resolve(`REDIRECT:${location}`);
+            return;
+          }
+          res.resume();
+          resolve("");
+          return;
+        }
+        const contentType = res.headers["content-type"] ?? "";
+        if (!contentType.includes("text/html")) {
+          res.resume();
+          resolve("");
+          return;
+        }
+        const chunks = [];
+        let totalBytes = 0;
+        res.on("data", (chunk) => {
+          totalBytes += chunk.length;
+          if (totalBytes <= MAX_BODY_BYTES) {
+            chunks.push(chunk);
+          }
+        });
+        res.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+        res.on("error", () => resolve(""));
+      }
+    );
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", () => resolve(""));
+    req.end();
+  });
+}
+async function fetchSiteText(domain) {
+  const hostname = extractHostname(domain);
+  const url = `https://${hostname}`;
+  const targetCheck = await resolveWebhookTarget(url);
+  if (!targetCheck.ok) return "";
+  try {
+    const result = await fetchWithPinnedAddress(targetCheck.target);
+    if (result.startsWith("REDIRECT:")) {
+      const location = result.slice("REDIRECT:".length);
+      if (!location) return "";
+      const redirectUrl = new URL(location, url).href;
+      const redirectCheck = await resolveWebhookTarget(redirectUrl);
+      if (!redirectCheck.ok) return "";
+      const redirectResult = await fetchWithPinnedAddress(redirectCheck.target);
+      if (redirectResult.startsWith("REDIRECT:")) return "";
+      return stripHtml2(redirectResult);
+    }
+    return stripHtml2(result);
+  } catch {
+    return "";
+  }
+}
+function stripHtml2(html) {
+  if (!html) return "";
+  let text = html.replace(/<script[\s\S]*?<\/script>/gi, " ");
+  text = text.replace(/<style[\s\S]*?<\/style>/gi, " ");
+  text = text.replace(/<[^>]+>/g, " ");
+  text = text.replace(/&amp;/g, "&");
+  text = text.replace(/&lt;/g, "<");
+  text = text.replace(/&gt;/g, ">");
+  text = text.replace(/&quot;/g, '"');
+  text = text.replace(/&#39;/g, "'");
+  text = text.replace(/&nbsp;/g, " ");
+  text = text.replace(/\s+/g, " ").trim();
+  if (text.length > MAX_TEXT_LENGTH) {
+    text = text.slice(0, MAX_TEXT_LENGTH);
+  }
+  return text;
+}
+
+// src/snapshot-format.ts
+function formatAuditFactorScore(factor) {
+  return `${factor.score}/100 (${factor.weight}% weight)`;
+}
+
+// src/snapshot-service.ts
+var log8 = createLogger("Snapshot");
+var ANALYSIS_PROVIDER_PRIORITY = ["openai", "claude", "gemini", "perplexity", "local"];
+var SNAPSHOT_QUERY_COUNT = 6;
+var ProviderExecutionGate2 = class {
+  constructor(maxConcurrency, maxPerMinute) {
+    this.maxConcurrency = maxConcurrency;
+    this.maxPerMinute = maxPerMinute;
+  }
+  window = [];
+  waiters = [];
+  rateLimitChain = Promise.resolve();
+  inFlight = 0;
   async run(task) {
     await this.acquire();
     try {
@@ -14945,7 +17118,7 @@ var SnapshotService = class {
       return mapAuditReport(report);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log7.warn("audit.failed", { homepageUrl, error: message });
+      log8.warn("audit.failed", { homepageUrl, error: message });
       return {
         url: homepageUrl,
         finalUrl: homepageUrl,
@@ -14975,7 +17148,7 @@ var SnapshotService = class {
           phrases: parsedPhrases
         };
       } catch (err) {
-        log7.warn("profile.generation-failed", {
+        log8.warn("profile.generation-failed", {
           domain: ctx.domain,
           provider: ctx.analysisProvider.adapter.name,
           error: err instanceof Error ? err.message : String(err)
@@ -15117,7 +17290,7 @@ var SnapshotService = class {
         recommendedActions: uniqueStrings(parsed.recommendedActions ?? []).slice(0, 4)
       };
     } catch (err) {
-      log7.warn("response.analysis-failed", {
+      log8.warn("response.analysis-failed", {
         provider: ctx.analysisProvider.adapter.name,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -15399,499 +17572,6 @@ function clipText(value, length) {
   return `${value.slice(0, length - 3)}...`;
 }
 
-// src/agent-manager.ts
-import { execFileSync, spawn } from "child_process";
-import fs5 from "fs";
-import path6 from "path";
-var log8 = createLogger("AgentManager");
-var PROCESS_MARKER = "canonry-openclaw-gateway";
-var AgentManager = class {
-  constructor(config, stateDir) {
-    this.config = config;
-    this.stateDir = stateDir;
-    this.processJsonPath = path6.join(stateDir, "process.json");
-  }
-  processJsonPath;
-  /**
-   * Check if the gateway process is running.
-   * Cleans up stale process.json if the process is dead or belongs to a
-   * different process (PID reuse).
-   */
-  status() {
-    const info = this.readProcessInfo();
-    if (!info) {
-      return { state: "stopped" };
-    }
-    if (info.marker !== PROCESS_MARKER) {
-      this.removeProcessJson();
-      return { state: "stopped" };
-    }
-    if (isProcessAlive(info.pid) && this.verifyProcessIdentity(info.pid)) {
-      return {
-        state: "running",
-        pid: info.pid,
-        port: info.gatewayPort,
-        startedAt: info.startedAt
-      };
-    }
-    this.removeProcessJson();
-    return { state: "stopped" };
-  }
-  /**
-   * Start the OpenClaw gateway as a detached background process.
-   * Idempotent — no-op if already running.
-   * Waits briefly for the process to confirm it hasn't crashed on startup.
-   */
-  async start() {
-    const currentStatus = this.status();
-    if (currentStatus.state === "running") {
-      log8.info("already.running", { pid: currentStatus.pid });
-      return;
-    }
-    const binary = this.config.binary ?? "openclaw";
-    const profile = this.config.profile ?? "aero";
-    const port = this.config.gatewayPort ?? 3579;
-    if (!fs5.existsSync(this.stateDir)) {
-      fs5.mkdirSync(this.stateDir, { recursive: true });
-    }
-    const logFile = path6.join(this.stateDir, "gateway.log");
-    const logFd = fs5.openSync(logFile, "a");
-    const dotEnv = this.loadDotEnv();
-    const child = spawn(binary, ["--profile", profile, "gateway"], {
-      detached: true,
-      stdio: ["ignore", logFd, logFd],
-      env: {
-        ...process.env,
-        ...dotEnv,
-        OPENCLAW_PROFILE: profile,
-        OPENCLAW_GATEWAY_PORT: String(port),
-        OPENCLAW_STATE_DIR: this.stateDir
-      }
-    });
-    const startupResult = await new Promise((resolve) => {
-      let settled = false;
-      const settle = (r) => {
-        if (settled) return;
-        settled = true;
-        resolve(r);
-      };
-      child.on("error", (err) => settle({ error: err }));
-      child.on("exit", (code) => settle({ exitCode: code }));
-      setTimeout(() => settle({}), 500);
-    });
-    child.unref();
-    fs5.closeSync(logFd);
-    if (startupResult.error) {
-      throw new Error(`Failed to start OpenClaw gateway: ${startupResult.error.message}`);
-    }
-    if (startupResult.exitCode != null) {
-      throw new Error(`OpenClaw gateway exited immediately (code ${startupResult.exitCode}). Check ${path6.join(this.stateDir, "gateway.log")} for details.`);
-    }
-    if (child.pid == null) {
-      throw new Error("Failed to start OpenClaw gateway: no PID returned by spawn");
-    }
-    if (!isProcessAlive(child.pid)) {
-      throw new Error(`OpenClaw gateway exited immediately after spawn. Check ${path6.join(this.stateDir, "gateway.log")} for details.`);
-    }
-    const processInfo = {
-      pid: child.pid,
-      gatewayPort: port,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      marker: PROCESS_MARKER
-    };
-    fs5.writeFileSync(this.processJsonPath, JSON.stringify(processInfo, null, 2), "utf-8");
-    log8.info("started", { pid: child.pid, port });
-  }
-  /**
-   * Stop the gateway process.
-   * Uses DenchClaw escalation: SIGTERM → 800ms poll → SIGKILL.
-   * Idempotent — no-op if already stopped.
-   */
-  async stop() {
-    const info = this.readProcessInfo();
-    if (!info) return;
-    if (isProcessAlive(info.pid) && info.marker === PROCESS_MARKER && this.verifyProcessIdentity(info.pid)) {
-      await terminateWithEscalation(info.pid);
-    }
-    this.removeProcessJson();
-    log8.info("stopped", { pid: info.pid });
-  }
-  /**
-   * Stop the gateway, wipe the workspace directory, and prepare for re-seeding.
-   */
-  async reset() {
-    await this.stop();
-    const workspaceDir = path6.join(this.stateDir, "workspace");
-    if (fs5.existsSync(workspaceDir)) {
-      fs5.rmSync(workspaceDir, { recursive: true, force: true });
-      log8.info("workspace.wiped", { dir: workspaceDir });
-    }
-  }
-  /**
-   * Verify that the PID actually belongs to an openclaw process by checking
-   * the full command line. Requires "openclaw" in the args to avoid matching
-   * unrelated Node processes after PID reuse.
-   */
-  verifyProcessIdentity(pid) {
-    try {
-      if (process.platform === "darwin") {
-        const out = execFileSync("ps", ["-p", String(pid), "-o", "args="], {
-          encoding: "utf-8",
-          timeout: 2e3
-        }).trim();
-        return out.includes("openclaw");
-      }
-      if (process.platform === "linux") {
-        const cmdline = fs5.readFileSync(`/proc/${pid}/cmdline`, "utf-8");
-        return cmdline.includes("openclaw");
-      }
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  readProcessInfo() {
-    if (!fs5.existsSync(this.processJsonPath)) return null;
-    try {
-      return JSON.parse(fs5.readFileSync(this.processJsonPath, "utf-8"));
-    } catch {
-      return null;
-    }
-  }
-  removeProcessJson() {
-    try {
-      fs5.unlinkSync(this.processJsonPath);
-    } catch {
-    }
-  }
-  /** Parse a simple KEY=value dotenv file from the state dir. */
-  loadDotEnv() {
-    const envFile = path6.join(this.stateDir, ".env");
-    if (!fs5.existsSync(envFile)) return {};
-    const result = {};
-    for (const line of fs5.readFileSync(envFile, "utf-8").split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eq25 = trimmed.indexOf("=");
-      if (eq25 < 1) continue;
-      result[trimmed.slice(0, eq25)] = trimmed.slice(eq25 + 1);
-    }
-    return result;
-  }
-};
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    if (err.code === "EPERM") return true;
-    return false;
-  }
-}
-async function terminateWithEscalation(pid) {
-  try {
-    process.kill(pid, "SIGTERM");
-  } catch {
-    return;
-  }
-  const deadline = Date.now() + 800;
-  while (Date.now() < deadline) {
-    if (!isProcessAlive(pid)) return;
-    await new Promise((resolve) => setTimeout(resolve, 100));
-  }
-  try {
-    process.kill(pid, "SIGKILL");
-  } catch {
-  }
-}
-
-// src/agent-bootstrap.ts
-import { execFileSync as execFileSync2, execSync } from "child_process";
-import fs6 from "fs";
-import os5 from "os";
-import path7 from "path";
-import { fileURLToPath } from "url";
-var CACHE_TTL_MS = 5 * 60 * 1e3;
-var OPENCLAW_VERSION = "2026.4.14";
-var OPENCLAW_PACKAGE_SPEC = `openclaw@${OPENCLAW_VERSION}`;
-var MIN_NODE_VERSION = "22.14.0";
-var cachedResult = null;
-var cachedAt = 0;
-function getAeroStateDir(profile = "aero") {
-  return path7.join(os5.homedir(), `.openclaw-${profile}`);
-}
-async function detectOpenClaw(config) {
-  if (cachedResult && Date.now() - cachedAt < CACHE_TTL_MS) {
-    return cachedResult;
-  }
-  let result;
-  if (config?.binary) {
-    const version = probeVersion(config.binary);
-    if (version) {
-      result = { found: true, path: config.binary, version };
-      cachedResult = result;
-      cachedAt = Date.now();
-      return result;
-    }
-  }
-  const binaryPath = findInPath();
-  if (binaryPath) {
-    const version = probeVersion(binaryPath);
-    if (version) {
-      result = { found: true, path: binaryPath, version };
-      cachedResult = result;
-      cachedAt = Date.now();
-      return result;
-    }
-  }
-  result = { found: false };
-  cachedResult = result;
-  cachedAt = Date.now();
-  return result;
-}
-detectOpenClaw.resetCache = () => {
-  cachedResult = null;
-  cachedAt = 0;
-};
-function probeVersion(binaryPath) {
-  try {
-    const output = execFileSync2(binaryPath, ["--version"], {
-      timeout: 5e3,
-      encoding: "utf-8"
-    });
-    const match = output.toString().trim().match(/(\d+\.\d+\.\d+)/);
-    return match ? match[1] : output.toString().trim();
-  } catch {
-    return null;
-  }
-}
-function findInPath() {
-  const cmd = process.platform === "win32" ? "where" : "which";
-  try {
-    const output = execFileSync2(cmd, ["openclaw"], {
-      timeout: 5e3,
-      encoding: "utf-8"
-    });
-    return output.toString().trim().split("\n")[0] || null;
-  } catch {
-    return null;
-  }
-}
-async function installOpenClaw(opts) {
-  const unsupportedNodeError = getUnsupportedNodeError(opts?.nodeVersion);
-  if (unsupportedNodeError) {
-    return {
-      success: false,
-      error: unsupportedNodeError
-    };
-  }
-  try {
-    execSync(`npm install -g ${OPENCLAW_PACKAGE_SPEC}`, {
-      timeout: 12e4,
-      stdio: opts?.silent ? "pipe" : "inherit"
-    });
-  } catch (err) {
-    return {
-      success: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-  detectOpenClaw.resetCache();
-  const detection = await detectOpenClaw();
-  if (!detection.found) {
-    return {
-      success: false,
-      error: `npm install succeeded but the ${OPENCLAW_PACKAGE_SPEC} binary was not found in PATH`
-    };
-  }
-  if (detection.version) {
-    const expectedVersion = parseVersionTuple(OPENCLAW_VERSION);
-    const detectedVersion = parseVersionTuple(detection.version);
-    if (expectedVersion && detectedVersion && compareVersionTuples(detectedVersion, expectedVersion) !== 0) {
-      return {
-        success: false,
-        error: `Installed OpenClaw binary reports version ${detection.version}, but Canonry pinned ${OPENCLAW_VERSION}. A different openclaw binary may be shadowing the npm-installed package in PATH.`
-      };
-    }
-  }
-  return { success: true, detection };
-}
-function getUnsupportedNodeError(currentNodeVersionOverride) {
-  const currentNodeVersion = normalizeVersion(currentNodeVersionOverride ?? process.versions.node);
-  const minimumTuple = parseVersionTuple(MIN_NODE_VERSION);
-  const currentTuple = parseVersionTuple(currentNodeVersion);
-  if (!minimumTuple || !currentTuple || compareVersionTuples(currentTuple, minimumTuple) >= 0) {
-    return null;
-  }
-  return `Canonry requires Node.js >=${MIN_NODE_VERSION} and installs pinned OpenClaw ${OPENCLAW_VERSION}, but the current runtime is ${currentNodeVersion}. Upgrade Node.js before running "canonry agent setup".`;
-}
-function normalizeVersion(version) {
-  const tuple = parseVersionTuple(version);
-  if (!tuple) {
-    return version.trim().replace(/^v/i, "");
-  }
-  return tuple.join(".");
-}
-function parseVersionTuple(version) {
-  const match = version.trim().replace(/^v/i, "").match(/^(\d+)(?:\.(\d+))?(?:\.(\d+))?$/);
-  if (!match) {
-    return null;
-  }
-  return [
-    Number(match[1]),
-    Number(match[2] ?? 0),
-    Number(match[3] ?? 0)
-  ];
-}
-function compareVersionTuples(left, right) {
-  for (let index = 0; index < left.length; index++) {
-    const delta = left[index] - right[index];
-    if (delta !== 0) {
-      return delta;
-    }
-  }
-  return 0;
-}
-function seedWorkspace(stateDir) {
-  const workspaceDir = path7.join(stateDir, "workspace");
-  fs6.mkdirSync(workspaceDir, { recursive: true });
-  const __dirname = path7.dirname(fileURLToPath(import.meta.url));
-  const assetsDir = path7.join(__dirname, "..", "assets", "agent-workspace");
-  if (!fs6.existsSync(assetsDir)) {
-    return;
-  }
-  copyDirRecursive(assetsDir, workspaceDir);
-}
-function initializeOpenClawProfile(binary, profile, workspaceDir) {
-  try {
-    execFileSync2(binary, [
-      "--profile",
-      profile,
-      "onboard",
-      "--non-interactive",
-      "--accept-risk",
-      "--mode",
-      "local",
-      "--workspace",
-      workspaceDir,
-      "--skip-channels",
-      "--skip-skills",
-      "--skip-health",
-      "--no-install-daemon"
-    ], { timeout: 3e4, stdio: "pipe" });
-  } catch (err) {
-    const stderr = err instanceof Error && "stderr" in err ? String(err.stderr) : "";
-    if (stderr.toLowerCase().includes("already")) return;
-    throw new CliError({
-      code: "AGENT_PROFILE_INIT_FAILED",
-      message: `Failed to initialize OpenClaw profile: ${stderr || (err instanceof Error ? err.message : String(err))}`,
-      displayMessage: `Failed to initialize OpenClaw profile "${profile}".`
-    });
-  }
-}
-function configureOpenClawGateway(binary, profile, gatewayPort) {
-  const entries = [
-    ["gateway.mode", "local", false],
-    ["gateway.port", String(gatewayPort), true]
-  ];
-  for (const [key, value, strict] of entries) {
-    try {
-      const args = ["--profile", profile, "config", "set", key, value];
-      if (strict) args.push("--strict-json");
-      execFileSync2(binary, args, { timeout: 1e4, stdio: "pipe" });
-    } catch (err) {
-      throw new CliError({
-        code: "AGENT_GATEWAY_CONFIG_FAILED",
-        message: `Failed to set ${key}=${value}: ${err instanceof Error ? err.message : String(err)}`,
-        displayMessage: `Failed to configure OpenClaw gateway (${key}).`
-      });
-    }
-  }
-}
-function setOpenClawModel(binary, profile, model) {
-  try {
-    execFileSync2(binary, [
-      "--profile",
-      profile,
-      "models",
-      "set",
-      model
-    ], { timeout: 1e4, stdio: "pipe" });
-  } catch (err) {
-    throw new CliError({
-      code: "AGENT_MODEL_SET_FAILED",
-      message: `Failed to set agent model to ${model}: ${err instanceof Error ? err.message : String(err)}`,
-      displayMessage: `Failed to set agent model to "${model}".`
-    });
-  }
-}
-function providerEnvVar(provider) {
-  const map = {
-    anthropic: "ANTHROPIC_API_KEY",
-    openai: "OPENAI_API_KEY",
-    google: "GOOGLE_API_KEY",
-    "google-vertex": "GOOGLE_API_KEY",
-    groq: "GROQ_API_KEY",
-    mistral: "MISTRAL_API_KEY",
-    xai: "XAI_API_KEY",
-    openrouter: "OPENROUTER_API_KEY",
-    cerebras: "CEREBRAS_API_KEY"
-  };
-  return map[provider] ?? `${provider.toUpperCase().replace(/-/g, "_")}_API_KEY`;
-}
-function writeAgentEnv(stateDir, key, value) {
-  const envFile = path7.join(stateDir, ".env");
-  let lines = [];
-  if (fs6.existsSync(envFile)) {
-    lines = fs6.readFileSync(envFile, "utf-8").split("\n");
-  }
-  const prefix = `${key}=`;
-  const idx = lines.findIndex((l) => l.startsWith(prefix));
-  const entry = `${key}=${value}`;
-  if (idx >= 0) {
-    lines[idx] = entry;
-  } else {
-    lines.push(entry);
-  }
-  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
-  fs6.writeFileSync(envFile, lines.join("\n") + "\n", "utf-8");
-}
-function resolveAgentCredentials(opts) {
-  const provider = opts.agentProvider ?? "anthropic";
-  if (opts.agentKey) {
-    return { provider, key: opts.agentKey, model: opts.agentModel };
-  }
-  const envVar = providerEnvVar(provider);
-  const envKey = process.env[envVar];
-  if (envKey) {
-    return { provider, key: envKey, model: opts.agentModel };
-  }
-  const genericKey = process.env.CANONRY_AGENT_KEY;
-  if (genericKey) {
-    return { provider, key: genericKey, model: opts.agentModel };
-  }
-  const envFile = path7.join(opts.stateDir, ".env");
-  if (fs6.existsSync(envFile)) {
-    const hasKey = fs6.readFileSync(envFile, "utf-8").split("\n").some((l) => l.includes("_API_KEY="));
-    if (hasKey) {
-      return { provider, key: void 0, model: opts.agentModel };
-    }
-  }
-  return { provider, key: void 0, model: opts.agentModel };
-}
-function copyDirRecursive(src, dest) {
-  fs6.mkdirSync(dest, { recursive: true });
-  for (const entry of fs6.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path7.join(src, entry.name);
-    const destPath = path7.join(dest, entry.name);
-    if (entry.isDirectory()) {
-      copyDirRecursive(srcPath, destPath);
-    } else {
-      fs6.copyFileSync(srcPath, destPath);
-    }
-  }
-}
-
 // src/server.ts
 var _require2 = createRequire2(import.meta.url);
 var { version: PKG_VERSION } = _require2("../package.json");
@@ -15926,7 +17606,7 @@ function summarizeProviderConfig(provider, config) {
   };
 }
 function hashApiKey(key) {
-  return crypto23.createHash("sha256").update(key).digest("hex");
+  return crypto24.createHash("sha256").update(key).digest("hex");
 }
 function parseCookies2(header) {
   if (!header) return {};
@@ -16073,27 +17753,35 @@ async function createServer(opts) {
   jobRunner.recoverStaleRuns();
   const notifier = new Notifier(opts.db, serverUrl);
   const intelligenceService = new IntelligenceService(opts.db);
+  const aeroClient = new ApiClient(opts.config.apiUrl, opts.config.apiKey, { skipProbe: true });
+  const sessionRegistry = new SessionRegistry({
+    db: opts.db,
+    client: aeroClient,
+    config: opts.config
+  });
   const runCoordinator = new RunCoordinator(
     notifier,
     intelligenceService,
-    (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result)
+    (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result),
+    async ({ runId, projectId, insightCount, criticalOrHigh }) => {
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq26(projects.id, projectId)).get();
+      if (!project) return;
+      sessionRegistry.queueFollowUp(project.name, {
+        role: "user",
+        content: `[system] Run ${runId} completed for project ${project.name}. ${insightCount} insights generated (${criticalOrHigh} critical/high). Use get_run to inspect the run and get_insights to review new findings. Surface anything notable briefly \u2014 skip chit-chat.`,
+        timestamp: Date.now()
+      });
+      void sessionRegistry.drainNow(project.name);
+    }
   );
   jobRunner.onRunCompleted = (runId, projectId) => runCoordinator.onRunCompleted(runId, projectId);
   const snapshotService = new SnapshotService(registry);
-  let agentManager;
-  let agentAutoStarted = false;
-  if (opts.config.agent) {
-    const stateDir = getAeroStateDir(opts.config.agent.profile ?? "aero");
-    agentManager = new AgentManager(opts.config.agent, stateDir);
-    if (opts.config.agent.autoStart) {
-      try {
-        await agentManager.start();
-        agentAutoStarted = true;
-        app.log.info({ pid: agentManager.status().pid }, "Agent gateway started");
-      } catch (err) {
-        app.log.error({ err }, "Failed to auto-start agent gateway");
-      }
-    }
+  const orphanedOpenClawDir = path9.join(os5.homedir(), ".openclaw-aero");
+  if (fs8.existsSync(orphanedOpenClawDir)) {
+    app.log.warn(
+      { path: orphanedOpenClawDir },
+      "OpenClaw gateway is no longer used. Remove ~/.openclaw-aero/ manually to reclaim the directory."
+    );
   }
   const scheduler = new Scheduler(opts.db, {
     onRunCreated: (runId, projectId, providers2, location) => {
@@ -16170,7 +17858,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto23.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto24.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -16216,11 +17904,11 @@ async function createServer(opts) {
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, keyHash)).get();
+    const existing = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto23.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto24.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -16244,7 +17932,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto23.randomBytes(32).toString("hex");
+    const sessionId = crypto24.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -16268,7 +17956,7 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
   };
   const createPasswordSession = (reply) => {
     const key = getDefaultApiKey();
@@ -16325,12 +18013,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq24(apiKeys.keyHash, hashApiKey(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq24(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq26(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
       reply.header("set-cookie", serializeSessionCookie({
         name: SESSION_COOKIE_NAME,
@@ -16362,6 +18050,11 @@ async function createServer(opts) {
     skipAuth: false,
     sessionCookieName: SESSION_COOKIE_NAME,
     resolveSessionApiKeyId,
+    // Local-only Aero agent routes. Registered here so they inherit api-routes'
+    // auth plugin — bare `registerAgentRoutes(app, ...)` would skip auth.
+    registerAuthenticatedRoutes: async (scope) => {
+      registerAgentRoutes(scope, { db: opts.db, sessionRegistry });
+    },
     getGoogleAuthConfig: () => getGoogleAuthConfig(opts.config),
     googleConnectionStore,
     googleStateSecret,
@@ -16394,7 +18087,8 @@ async function createServer(opts) {
     },
     openApiInfo: {
       title: "Canonry API",
-      version: PKG_VERSION
+      version: PKG_VERSION,
+      includeCanonryLocal: true
     },
     providerSummary,
     providerAdapters: [...API_ADAPTERS, ...BROWSER_ADAPTERS].map((a) => ({
@@ -16471,7 +18165,7 @@ async function createServer(opts) {
         const targetProjectIds = affectedProjectIds.length > 0 ? affectedProjectIds : [null];
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(targetProjectIds.map((projectId) => ({
-          id: crypto23.randomUUID(),
+          id: crypto24.randomUUID(),
           projectId,
           actor: "api",
           action: existing ? "provider.updated" : "provider.created",
@@ -16518,17 +18212,6 @@ async function createServer(opts) {
     onProjectDeleted: (projectId) => {
       scheduler.remove(projectId);
     },
-    onProjectUpserted: agentManager && opts.config.agent?.autoStart ? (_projectId, projectName) => {
-      try {
-        const gatewayPort = opts.config.agent?.gatewayPort ?? 3579;
-        const result = attachAgentWebhookDirect(opts.db, _projectId, gatewayPort);
-        if (result === "attached") {
-          app.log.info({ projectName }, "Auto-attached agent webhook");
-        }
-      } catch (err) {
-        app.log.error({ err, projectName }, "Failed to auto-attach agent webhook");
-      }
-    } : void 0,
     getTelemetryStatus: () => {
       const enabled = isTelemetryEnabled();
       return {
@@ -16613,15 +18296,15 @@ async function createServer(opts) {
       return snapshotService.createReport(input);
     }
   });
-  const dirname = path8.dirname(fileURLToPath2(import.meta.url));
-  const assetsDir = path8.join(dirname, "..", "assets");
-  if (fs7.existsSync(assetsDir)) {
-    const indexPath = path8.join(assetsDir, "index.html");
+  const dirname = path9.dirname(fileURLToPath2(import.meta.url));
+  const assetsDir = path9.join(dirname, "..", "assets");
+  if (fs8.existsSync(assetsDir)) {
+    const indexPath = path9.join(assetsDir, "index.html");
     const injectConfig = (html) => {
       const clientConfig = {};
       if (basePath) clientConfig.basePath = basePath;
       const configScript = `<script>window.__CANONRY_CONFIG__=${JSON.stringify(clientConfig)}</script>`;
-      const baseTag = basePath ? `<base href="${basePath}">` : "";
+      const baseTag = `<base href="${basePath ?? "/"}">`;
       return html.replace("<head>", `<head>${baseTag}`).replace("</head>", `${configScript}</head>`);
     };
     const fastifyStatic = await import("@fastify/static");
@@ -16634,8 +18317,8 @@ async function createServer(opts) {
       index: false
     });
     const serveIndex = (_request, reply) => {
-      if (fs7.existsSync(indexPath)) {
-        const html = fs7.readFileSync(indexPath, "utf-8");
+      if (fs8.existsSync(indexPath)) {
+        const html = fs8.readFileSync(indexPath, "utf-8");
         return reply.type("text/html").send(injectConfig(html));
       }
       return reply.status(404).send({ error: "Dashboard not built" });
@@ -16655,8 +18338,8 @@ async function createServer(opts) {
       if (basePath && !url.startsWith(basePath)) {
         return reply.status(404).send({ error: "Not found", path: request.url });
       }
-      if (fs7.existsSync(indexPath)) {
-        const html = fs7.readFileSync(indexPath, "utf-8");
+      if (fs8.existsSync(indexPath)) {
+        const html = fs8.readFileSync(indexPath, "utf-8");
         return reply.type("text/html").send(injectConfig(html));
       }
       return reply.status(404).send({ error: "Not found" });
@@ -16675,13 +18358,6 @@ async function createServer(opts) {
   scheduler.start();
   app.addHook("onClose", async () => {
     scheduler.stop();
-    if (agentManager && agentAutoStarted) {
-      try {
-        await agentManager.stop();
-      } catch (err) {
-        app.log.error({ err }, "Failed to stop agent gateway");
-      }
-    }
   });
   return app;
 }
@@ -16743,7 +18419,6 @@ export {
   isFirstRun,
   showFirstRunNotice,
   trackEvent,
-  EXIT_USER_ERROR,
   EXIT_SYSTEM_ERROR,
   CliError,
   usageError,
@@ -16762,21 +18437,10 @@ export {
   determineCitationState,
   computeCompetitorOverlap,
   extractRecommendedCompetitors,
+  createApiClient,
   setGoogleAuthConfig,
   formatAuditFactorScore,
-  AGENT_WEBHOOK_EVENTS,
-  buildAgentWebhookUrl,
-  attachAgentWebhookDirect,
-  AgentManager,
-  getAeroStateDir,
-  detectOpenClaw,
-  installOpenClaw,
-  seedWorkspace,
-  initializeOpenClawProfile,
-  configureOpenClawGateway,
-  setOpenClawModel,
-  providerEnvVar,
-  writeAgentEnv,
-  resolveAgentCredentials,
+  listAgentProviders,
+  coerceAgentProvider,
   createServer
 };