@ainyc/canonry 4.100.1 → 4.101.0

package/dist/{chunk-ALJSES3X.js → chunk-O3SFVGDF.js}

@@ -1,5 +1,6 @@
 import {
   ApiClient,
+  CanonryMcpToolNames,
   CliError,
   PACKAGE_VERSION,
   canonryMcpTools,
@@ -9,7 +10,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-IDI6LMYL.js";
+} from "./chunk-2YPVK75M.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -24,6 +25,7 @@ import {
   adsInsightsDaily,
   agentMemory,
   agentSessions,
+  agentToolEvents,
   aiUserFetchEventsHourly,
   apiKeys,
   apiRoutes,
@@ -88,6 +90,7 @@ import {
   listLocations,
   listMonthlyKeywords,
   listPlaceActionLinks,
+  llmUsageEvents,
   loadDuckdb,
   markSessionFailed,
   migrate,
@@ -111,7 +114,7 @@ import {
   siteAuditPages,
   siteAuditSnapshots,
   usageCounters
-} from "./chunk-YBIT5O62.js";
+} from "./chunk-AV3DHH6B.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -171,7 +174,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-JF7EXHGA.js";
+} from "./chunk-HUL5FUBD.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -459,7 +462,7 @@ function checkLatestVersionForServer(opts) {
 
 // src/server.ts
 import { createRequire as createRequire3 } from "module";
-import crypto20 from "crypto";
+import crypto22 from "crypto";
 import fs8 from "fs";
 import path9 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -6403,7 +6406,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-TWCEKVKZ.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-R6QJ3KC2.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -7979,7 +7982,7 @@ function analysisResultFromInsights(insights2) {
 }
 
 // src/agent/session-registry.ts
-import crypto19 from "crypto";
+import crypto21 from "crypto";
 import { eq as eq18 } from "drizzle-orm";
 
 // src/agent/session.ts
@@ -8140,6 +8143,11 @@ function resolveModelForCapability(provider, capability, modelIdOverride) {
       `Model '${id}' not found for pi-ai provider '${entry.piAiProvider}'. Verify PROVIDER_MODELS[${provider}][${capability}] against the installed @mariozechner/pi-ai catalog.`
     );
   }
+  if (provider === AgentProviderIds.gemini && process.env.GEMINI_BASE_URL) {
+    const base = process.env.GEMINI_BASE_URL.replace(/\/+$/, "");
+    const baseUrl = base.endsWith("/v1beta") ? base : `${base}/v1beta`;
+    return { ...model, baseUrl };
+  }
   return model;
 }
 function buildOpenAiCompatibleModel(entry, id, suppressThinking = false) {
@@ -8332,6 +8340,9 @@ function buildSkillDocTools() {
   ];
 }
 
+// src/agent/tools.ts
+import { Type as Type3 } from "@sinclair/typebox";
+
 // src/agent/mcp-to-agent-tool.ts
 import { Type as Type2 } from "@sinclair/typebox";
 var MAX_TOOL_RESULT_CHARS = 2e4;
@@ -8431,19 +8442,431 @@ function mcpToAgentTool(tool, ctx) {
   };
 }
 var AERO_EXCLUDED_MCP_TOOLS = /* @__PURE__ */ new Set([
-  "canonry_agent_clear"
+  CanonryMcpToolNames.canonry_agent_clear
 ]);
 function buildMcpAgentTools(registry, ctx, opts = {}) {
-  return registry.filter((tool) => !AERO_EXCLUDED_MCP_TOOLS.has(tool.name)).filter((tool) => opts.readOnly ? tool.access === "read" : true).map((tool) => mcpToAgentTool(tool, ctx));
+  return registry.filter((tool) => !AERO_EXCLUDED_MCP_TOOLS.has(tool.name)).filter((tool) => opts.includeNames ? opts.includeNames.has(tool.name) : true).filter((tool) => opts.readOnly ? tool.access === "read" : true).map((tool) => mcpToAgentTool(tool, ctx));
 }
 
 // src/agent/tools.ts
+var AeroToolScopes = Object.freeze({
+  all: "all",
+  readOnly: "read-only"
+});
+var AERO_TOOL_SCOPES = [
+  AeroToolScopes.all,
+  AeroToolScopes.readOnly
+];
+var AeroToolProfiles = Object.freeze({
+  default: "default",
+  adsOperator: "ads-operator"
+});
+var AERO_TOOL_PROFILES = [
+  AeroToolProfiles.default,
+  AeroToolProfiles.adsOperator
+];
+function isAeroToolProfile(value) {
+  return value !== void 0 && AERO_TOOL_PROFILES.includes(value);
+}
+var AeroAgentToolNames = Object.freeze({
+  adsOperatorContext: "canonry_ads_operator_context"
+});
+var AERO_ADS_OPERATOR_CONTEXT_TOOL_NAME = AeroAgentToolNames.adsOperatorContext;
+var AERO_ADS_OPERATOR_MCP_TOOL_NAMES = /* @__PURE__ */ new Set([
+  CanonryMcpToolNames.canonry_project_get,
+  CanonryMcpToolNames.canonry_project_overview,
+  CanonryMcpToolNames.canonry_search,
+  CanonryMcpToolNames.canonry_doctor,
+  CanonryMcpToolNames.canonry_analytics_metrics,
+  CanonryMcpToolNames.canonry_analytics_sources,
+  CanonryMcpToolNames.canonry_runs_list,
+  CanonryMcpToolNames.canonry_runs_latest,
+  CanonryMcpToolNames.canonry_run_get,
+  CanonryMcpToolNames.canonry_insights_list,
+  CanonryMcpToolNames.canonry_insight_get,
+  CanonryMcpToolNames.canonry_health_latest,
+  CanonryMcpToolNames.canonry_queries_list,
+  CanonryMcpToolNames.canonry_competitors_list,
+  CanonryMcpToolNames.canonry_schedule_get,
+  CanonryMcpToolNames.canonry_memory_list,
+  CanonryMcpToolNames.canonry_memory_set,
+  CanonryMcpToolNames.canonry_memory_forget,
+  CanonryMcpToolNames.canonry_run_trigger,
+  CanonryMcpToolNames.canonry_ads_status,
+  CanonryMcpToolNames.canonry_ads_campaigns,
+  CanonryMcpToolNames.canonry_ads_insights,
+  CanonryMcpToolNames.canonry_ads_summary,
+  CanonryMcpToolNames.canonry_ads_sync
+]);
+function toolResult(details) {
+  return {
+    content: [{ type: "text", text: truncateToolResult(details) }],
+    details
+  };
+}
+async function readSection(fn) {
+  try {
+    return { status: "ok", data: await fn() };
+  } catch (err) {
+    return {
+      status: "error",
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function clampInteger(value, fallback, min, max) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
+  return Math.max(min, Math.min(max, Math.trunc(value)));
+}
+function isoDateDaysAgo(days) {
+  const d = new Date(Date.now() - (days - 1) * 24 * 60 * 60 * 1e3);
+  return d.toISOString().slice(0, 10);
+}
+function todayIsoDate() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function compactOverview(overview) {
+  return {
+    project: overview.project,
+    contextLabel: overview.contextLabel,
+    dateRangeLabel: overview.dateRangeLabel,
+    latestRun: overview.latestRun,
+    health: overview.health,
+    scores: overview.scores,
+    queryCounts: overview.queryCounts,
+    providers: overview.providers,
+    citationMovement: overview.citationMovement,
+    mentionMovement: overview.mentionMovement,
+    movementComparison: overview.movementComparison,
+    topInsights: overview.topInsights?.slice(0, 5) ?? [],
+    attentionItems: overview.attentionItems?.slice(0, 8) ?? [],
+    competitors: overview.competitors?.slice(0, 12) ?? []
+  };
+}
+function compactCampaigns(response, limit) {
+  return {
+    campaignCount: response.campaigns.length,
+    campaigns: response.campaigns.slice(0, limit).map((campaign) => ({
+      id: campaign.id,
+      name: campaign.name,
+      status: campaign.status,
+      biddingType: campaign.biddingType,
+      dailySpendLimitMicros: campaign.dailySpendLimitMicros,
+      lifetimeSpendLimitMicros: campaign.lifetimeSpendLimitMicros,
+      adGroupCount: campaign.adGroups.length,
+      adGroups: campaign.adGroups.slice(0, 8).map((group) => ({
+        id: group.id,
+        name: group.name,
+        status: group.status,
+        billingEventType: group.billingEventType,
+        maxBidMicros: group.maxBidMicros,
+        contextHintCount: group.contextHints.length,
+        contextHints: group.contextHints.slice(0, 3),
+        adCount: group.ads.length,
+        ads: group.ads.slice(0, 4).map((ad) => ({
+          id: ad.id,
+          name: ad.name,
+          status: ad.status,
+          reviewStatus: ad.reviewStatus,
+          creative: ad.creative ? {
+            type: ad.creative.type,
+            title: ad.creative.title,
+            body: ad.creative.body,
+            targetUrl: ad.creative.targetUrl
+          } : ad.creative
+        }))
+      }))
+    }))
+  };
+}
+function compactInsights(response, rowLimit) {
+  return {
+    currencyCode: response.currencyCode,
+    rowCount: response.rows.length,
+    rows: response.rows.slice(-rowLimit)
+  };
+}
+function buildAdsOperatorContextTool(ctx) {
+  return {
+    name: AERO_ADS_OPERATOR_CONTEXT_TOOL_NAME,
+    label: "Get ads operator context",
+    description: "One-call Aero context pack for ads operations. Reads the project overview, ads connection, paid summary, bounded campaign snapshots, recent paid rollups, ads doctor checks, and recent Aero memory. Use before diagnosing ChatGPT ads performance or planning the next operator action.",
+    parameters: Type3.Object({
+      windowDays: Type3.Optional(Type3.Integer({
+        minimum: 1,
+        maximum: 90,
+        description: "Lookback window for paid rollup rows. Default 30 days."
+      })),
+      campaignLimit: Type3.Optional(Type3.Integer({
+        minimum: 1,
+        maximum: 25,
+        description: "Max campaign snapshots to include. Default 8."
+      })),
+      insightRowLimit: Type3.Optional(Type3.Integer({
+        minimum: 1,
+        maximum: 100,
+        description: "Max paid rollup rows to include per level. Default 40."
+      }))
+    }),
+    execute: async (_toolCallId, rawParams) => {
+      const params = rawParams;
+      const windowDays = clampInteger(params.windowDays, 30, 1, 90);
+      const campaignLimit = clampInteger(params.campaignLimit, 8, 1, 25);
+      const insightRowLimit = clampInteger(params.insightRowLimit, 40, 1, 100);
+      const from = isoDateDaysAgo(windowDays);
+      const to = todayIsoDate();
+      const [
+        overview,
+        adsStatus,
+        adsSummary,
+        campaigns,
+        campaignInsights,
+        adGroupInsights,
+        doctor,
+        memory
+      ] = await Promise.all([
+        readSection(() => ctx.client.getProjectOverview(ctx.projectName)),
+        readSection(() => ctx.client.getAdsStatus(ctx.projectName)),
+        readSection(() => ctx.client.getAdsSummary(ctx.projectName)),
+        readSection(async () => compactCampaigns(await ctx.client.getAdsCampaigns(ctx.projectName), campaignLimit)),
+        readSection(
+          async () => compactInsights(
+            await ctx.client.getAdsInsights(ctx.projectName, { level: "campaign", from, to }),
+            insightRowLimit
+          )
+        ),
+        readSection(
+          async () => compactInsights(
+            await ctx.client.getAdsInsights(ctx.projectName, { level: "ad_group", from, to }),
+            insightRowLimit
+          )
+        ),
+        readSection(() => ctx.client.runDoctor({ project: ctx.projectName, checkIds: ["ads.*"] })),
+        readSection(async () => {
+          const result = await ctx.client.listAgentMemory(ctx.projectName);
+          return { entries: result.entries.slice(0, 10) };
+        })
+      ]);
+      return toolResult({
+        project: ctx.projectName,
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        window: { days: windowDays, from, to },
+        overview: overview.status === "ok" && overview.data ? { status: "ok", data: compactOverview(overview.data) } : overview,
+        ads: {
+          status: adsStatus,
+          summary: adsSummary,
+          campaigns,
+          insights: {
+            campaign: campaignInsights,
+            adGroup: adGroupInsights
+          }
+        },
+        doctor,
+        memory
+      });
+    }
+  };
+}
 function buildReadTools(ctx) {
   return buildMcpAgentTools(canonryMcpTools, ctx, { readOnly: true });
 }
 function buildAllTools(ctx) {
   return buildMcpAgentTools(canonryMcpTools, ctx);
 }
+function buildAdsOperatorTools(ctx, opts = {}) {
+  const mcpTools = buildMcpAgentTools(canonryMcpTools, ctx, {
+    readOnly: opts.scope === AeroToolScopes.readOnly,
+    includeNames: AERO_ADS_OPERATOR_MCP_TOOL_NAMES
+  });
+  return [buildAdsOperatorContextTool(ctx), ...mcpTools];
+}
+function buildAeroStateTools(ctx, opts = {}) {
+  const scope = opts.scope ?? AeroToolScopes.all;
+  const profile = opts.profile ?? AeroToolProfiles.default;
+  if (profile === AeroToolProfiles.adsOperator) {
+    return buildAdsOperatorTools(ctx, { scope });
+  }
+  return scope === AeroToolScopes.readOnly ? buildReadTools(ctx) : buildAllTools(ctx);
+}
+
+// src/agent/llm-usage.ts
+import crypto18 from "crypto";
+var AeroLlmUsageFeatures = {
+  turn: "aero.turn"
+};
+var AERO_PROMPT_FAMILY = "aero";
+var AERO_PROMPT_VERSION = "aero-system-v1";
+function dollarsToMillicents(dollars) {
+  if (!Number.isFinite(dollars) || dollars <= 0) return 0;
+  return Math.round(dollars * 1e5);
+}
+function nonNegativeInteger(value) {
+  if (!Number.isFinite(value) || value === void 0 || value <= 0) return 0;
+  return Math.round(value);
+}
+function recordLlmUsageEvent(args) {
+  try {
+    const usage = args.message.usage;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    args.db.insert(llmUsageEvents).values({
+      id: crypto18.randomUUID(),
+      projectId: args.projectId,
+      runId: args.runId,
+      agentSessionId: args.agentSessionId,
+      feature: args.feature,
+      provider: args.message.provider,
+      model: args.message.model,
+      responseId: args.message.responseId,
+      inputTokens: nonNegativeInteger(usage.input),
+      outputTokens: nonNegativeInteger(usage.output),
+      cacheReadTokens: nonNegativeInteger(usage.cacheRead),
+      cacheWriteTokens: nonNegativeInteger(usage.cacheWrite),
+      totalTokens: nonNegativeInteger(usage.totalTokens),
+      costMillicents: dollarsToMillicents(usage.cost.total),
+      promptFamily: args.promptFamily,
+      promptVersion: args.promptVersion,
+      metadata: args.metadata,
+      createdAt: now
+    }).run();
+  } catch {
+  }
+}
+
+// src/agent/prompt-cache.ts
+var AERO_MEMORY_SEPARATOR = "\n\n---\n\n";
+var AERO_MEMORY_BLOCK_PREFIX = `${AERO_MEMORY_SEPARATOR}<memory>
+`;
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function isTextSystemBlock(value) {
+  return isRecord(value) && value.type === "text" && typeof value.text === "string";
+}
+function splitAeroHydratedSystemPrompt(systemPrompt) {
+  const idx = systemPrompt.lastIndexOf(AERO_MEMORY_BLOCK_PREFIX);
+  if (idx < 0) return { basePrompt: systemPrompt };
+  return {
+    basePrompt: systemPrompt.slice(0, idx).trimEnd(),
+    memoryBlock: systemPrompt.slice(idx + AERO_MEMORY_SEPARATOR.length)
+  };
+}
+function splitAeroAnthropicSystemCachePayload(payload, model) {
+  if (model.api !== "anthropic-messages") return void 0;
+  if (!isRecord(payload) || !Array.isArray(payload.system)) return void 0;
+  let changed = false;
+  const nextSystem = [];
+  for (const block of payload.system) {
+    if (!isTextSystemBlock(block)) {
+      nextSystem.push(block);
+      continue;
+    }
+    const split = splitAeroHydratedSystemPrompt(block.text);
+    if (!split.memoryBlock) {
+      nextSystem.push(block);
+      continue;
+    }
+    const memoryBlock = {
+      ...block,
+      text: split.memoryBlock
+    };
+    delete memoryBlock.cache_control;
+    nextSystem.push({
+      ...block,
+      text: split.basePrompt
+    });
+    nextSystem.push(memoryBlock);
+    changed = true;
+  }
+  if (!changed) return void 0;
+  return {
+    ...payload,
+    system: nextSystem
+  };
+}
+
+// src/agent/tool-usage.ts
+import crypto19 from "crypto";
+var AeroToolEventStatuses = {
+  success: "success",
+  error: "error"
+};
+function jsonBytes(value) {
+  try {
+    return Buffer.byteLength(JSON.stringify(value), "utf8");
+  } catch {
+    return 0;
+  }
+}
+function nonNegativeInteger2(value) {
+  if (!Number.isFinite(value) || value === void 0 || value <= 0) return 0;
+  return Math.round(value);
+}
+function resultTextChars(content) {
+  let total = 0;
+  for (const block of content) {
+    if (block.type === "text") {
+      total += block.text.length;
+    } else {
+      total += block.data.length;
+    }
+  }
+  return total;
+}
+function createAeroToolUsageHooks(args) {
+  const startedAt = /* @__PURE__ */ new Map();
+  return {
+    beforeToolCall: async ({ toolCall }) => {
+      startedAt.set(toolCall.id, Date.now());
+      return void 0;
+    },
+    afterToolCall: async ({ assistantMessage, toolCall, args: toolArgs, result, isError, context }) => {
+      const start = startedAt.get(toolCall.id);
+      startedAt.delete(toolCall.id);
+      recordAgentToolEvent({
+        db: args.db,
+        projectId: args.projectId,
+        agentSessionId: args.agentSessionId,
+        toolCallId: toolCall.id,
+        toolName: toolCall.name,
+        assistantResponseId: assistantMessage.responseId,
+        provider: assistantMessage.provider,
+        model: assistantMessage.model,
+        status: isError ? AeroToolEventStatuses.error : AeroToolEventStatuses.success,
+        durationMs: start === void 0 ? 0 : Date.now() - start,
+        argsBytes: jsonBytes(toolArgs),
+        resultTextChars: resultTextChars(result.content),
+        resultBytes: jsonBytes(result),
+        metadata: {
+          ...args.metadata,
+          toolCount: context.tools?.length ?? 0
+        }
+      });
+      return void 0;
+    }
+  };
+}
+function recordAgentToolEvent(args) {
+  try {
+    args.db.insert(agentToolEvents).values({
+      id: crypto19.randomUUID(),
+      projectId: args.projectId,
+      agentSessionId: args.agentSessionId,
+      toolCallId: args.toolCallId,
+      toolName: args.toolName,
+      assistantResponseId: args.assistantResponseId,
+      provider: args.provider,
+      model: args.model,
+      status: args.status,
+      durationMs: nonNegativeInteger2(args.durationMs),
+      argsBytes: nonNegativeInteger2(args.argsBytes),
+      resultTextChars: nonNegativeInteger2(args.resultTextChars),
+      resultBytes: nonNegativeInteger2(args.resultBytes),
+      metadata: args.metadata,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    }).run();
+  } catch {
+  }
+}
 
 // src/agent/session.ts
 var builtinsRegistered = false;
@@ -8502,20 +8925,30 @@ function resolveAeroModel(provider, modelId) {
 function buildApiKeyResolver(config) {
   return (piAiProvider) => resolveApiKeyFor(piAiProvider, config);
 }
+function buildAeroProviderSessionId(opts) {
+  return `canonry:aero:${opts.agentSessionId ?? opts.projectId ?? opts.projectName}`;
+}
 function createAeroSession(opts) {
   const systemPrompt = opts.systemPromptOverride ?? loadAeroSystemPrompt();
   const provider = opts.provider ?? detectAgentProvider(opts.config);
   if (!provider) throw new Error(missingProviderMessage());
   const model = resolveAeroModel(provider, opts.modelId);
-  const toolScope = opts.toolScope ?? "all";
+  const toolScope = opts.toolScope ?? AeroToolScopes.all;
+  const toolProfile = opts.toolProfile ?? AeroToolProfiles.default;
   const toolCtx = {
     client: opts.client,
     projectName: opts.projectName
   };
-  const stateTools = toolScope === "read-only" ? buildReadTools(toolCtx) : buildAllTools(toolCtx);
+  const stateTools = buildAeroStateTools(toolCtx, { scope: toolScope, profile: toolProfile });
   const defaultTools = [...stateTools, ...buildSkillDocTools()];
   const tools = opts.tools ?? defaultTools;
-  return new Agent({
+  const toolUsageHooks = opts.db ? createAeroToolUsageHooks({
+    db: opts.db,
+    projectId: opts.projectId,
+    agentSessionId: opts.agentSessionId,
+    metadata: { projectName: opts.projectName }
+  }) : {};
+  const agent = new Agent({
     initialState: {
       systemPrompt,
       model,
@@ -8523,8 +8956,29 @@ function createAeroSession(opts) {
       ...opts.initialMessages ? { messages: opts.initialMessages } : {}
     },
     streamFn: opts.streamFn,
+    sessionId: buildAeroProviderSessionId(opts),
+    onPayload: splitAeroAnthropicSystemCachePayload,
+    ...toolUsageHooks,
     getApiKey: buildApiKeyResolver(opts.config)
   });
+  const telemetryDb = opts.db;
+  if (telemetryDb) {
+    agent.subscribe((event) => {
+      if (event.type !== "turn_end") return;
+      if (event.message.role !== "assistant") return;
+      recordLlmUsageEvent({
+        db: telemetryDb,
+        projectId: opts.projectId,
+        agentSessionId: opts.agentSessionId,
+        feature: AeroLlmUsageFeatures.turn,
+        promptFamily: AERO_PROMPT_FAMILY,
+        promptVersion: AERO_PROMPT_VERSION,
+        message: event.message,
+        metadata: { projectName: opts.projectName, toolCount: agent.state.tools.length }
+      });
+    });
+  }
+  return agent;
 }
 function resolveSessionProviderAndModel(config, opts) {
   const provider = opts?.provider ?? detectAgentProvider(config);
@@ -8534,7 +8988,7 @@ function resolveSessionProviderAndModel(config, opts) {
 }
 
 // src/agent/remote-mcp.ts
-import { Type as Type3 } from "@sinclair/typebox";
+import { Type as Type4 } from "@sinclair/typebox";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 var log18 = createLogger("RemoteMcp");
@@ -8561,7 +9015,7 @@ function isReadOnly(tool) {
   return tool.annotations?.readOnlyHint === true;
 }
 function adaptRemoteTool(client, tool) {
-  const parameters = Type3.Unsafe(
+  const parameters = Type4.Unsafe(
     tool.inputSchema ?? { type: "object", properties: {} }
   );
   const execute = async (_toolCallId, params) => {
@@ -8621,7 +9075,7 @@ async function loadExternalMcpTools(servers, opts = {}) {
 }
 
 // src/agent/memory-store.ts
-import crypto18 from "crypto";
+import crypto20 from "crypto";
 import { and as and13, desc as desc6, eq as eq17, like, sql as sql5 } from "drizzle-orm";
 var COMPACTION_KEY_PREFIX = "compaction:";
 var COMPACTION_NOTES_PER_SESSION = 3;
@@ -8650,7 +9104,7 @@ function upsertMemoryEntry(db, args) {
     throw new Error(`memory key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`);
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = crypto18.randomUUID();
+  const id = crypto20.randomUUID();
   db.insert(agentMemory).values({
     id,
     projectId: args.projectId,
@@ -8687,7 +9141,7 @@ function writeCompactionNote(db, args) {
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const key = `${COMPACTION_KEY_PREFIX}${args.sessionId}:${now}`;
-  const id = crypto18.randomUUID();
+  const id = crypto20.randomUUID();
   let inserted;
   db.transaction((tx) => {
     tx.insert(agentMemory).values({
@@ -8854,6 +9308,8 @@ var SessionRegistry = class {
   pending = /* @__PURE__ */ new Map();
   /** Last tool scope used on the live Agent for a project. Read in getOrCreate to know when to swap. */
   scopes = /* @__PURE__ */ new Map();
+  /** Last profile used on the live Agent for a project. Paired with scopes when rebuilding tools. */
+  profiles = /* @__PURE__ */ new Map();
   /** Cached resolved project id per project name, used so alignScope can rebuild tool context without a DB roundtrip. */
   projectIds = /* @__PURE__ */ new Map();
   /**
@@ -8945,9 +9401,14 @@ var SessionRegistry = class {
         modelId: effectiveModelId,
         systemPromptOverride: this.buildHydratedSystemPrompt(projectId, row.systemPrompt),
         initialMessages: persistedMessages,
-        toolScope: preferences?.toolScope
+        toolScope: preferences?.toolScope,
+        toolProfile: preferences?.toolProfile,
+        db: this.opts.db,
+        projectId,
+        agentSessionId: row.id
       });
-      this.scopes.set(projectName, preferences?.toolScope ?? "all");
+      this.scopes.set(projectName, preferences?.toolScope ?? AeroToolScopes.all);
+      this.profiles.set(projectName, preferences?.toolProfile ?? AeroToolProfiles.default);
       this.projectIds.set(projectName, projectId);
       if (queued.length > 0) {
         this.appendPending(projectName, queued);
@@ -8959,6 +9420,7 @@ var SessionRegistry = class {
     }
     const { provider, modelId } = resolveSessionProviderAndModel(this.opts.config, preferences);
     const systemPrompt = loadAeroSystemPrompt();
+    const sessionId = crypto21.randomUUID();
     const agent = createAeroSession({
       projectName,
       client: this.opts.client,
@@ -8968,11 +9430,17 @@ var SessionRegistry = class {
       // Hydrate on the fresh path too — a brand-new session may still see
       // notes if they were seeded via CLI/API before the first prompt.
       systemPromptOverride: this.buildHydratedSystemPrompt(projectId, systemPrompt),
-      toolScope: preferences?.toolScope
+      toolScope: preferences?.toolScope,
+      toolProfile: preferences?.toolProfile,
+      db: this.opts.db,
+      projectId,
+      agentSessionId: sessionId
     });
-    this.scopes.set(projectName, preferences?.toolScope ?? "all");
+    this.scopes.set(projectName, preferences?.toolScope ?? AeroToolScopes.all);
+    this.profiles.set(projectName, preferences?.toolProfile ?? AeroToolProfiles.default);
     this.projectIds.set(projectName, projectId);
     this.insertRow({
+      id: sessionId,
       projectId,
       // Persist the raw (unhydrated) prompt so the DB remains canonical —
       // the `<memory>` block is rebuilt from the notes table on every load.
@@ -9049,8 +9517,9 @@ ${lines.join("\n")}
    * Busy-check runs FIRST, before any state mutation — if two requests race
    * on the same project, one gets the 409 and the other's in-flight turn is
    * untouched. Only after confirming idle do we:
-   *   - align `state.tools` to the requested scope (CLI full vs dashboard
-   *     read-only share the same cached Agent; each request re-scopes it).
+   *   - align `state.tools` to the requested scope/profile (CLI full vs
+   *     dashboard read-only share the same cached Agent; each request
+   *     re-scopes it).
    *   - align `state.model` when the caller passes `provider` or `modelId`,
    *     honoring `--provider` / `--model` on hot sessions (not just on
    *     fresh/hydrated construction).
@@ -9063,7 +9532,10 @@ ${lines.join("\n")}
     if (agent.state.isStreaming) {
       throw agentBusy(projectName);
     }
-    this.alignScope(projectName, agent, preferences?.toolScope ?? "all");
+    this.alignToolSurface(projectName, agent, {
+      scope: preferences?.toolScope ?? AeroToolScopes.all,
+      profile: preferences?.toolProfile ?? AeroToolProfiles.default
+    });
     if (preferences?.provider || preferences?.modelId) {
       this.alignModel(projectName, agent, preferences);
     }
@@ -9126,14 +9598,17 @@ ${lines.join("\n")}
       });
     }
   }
-  alignScope(projectName, agent, wantScope) {
-    if (this.scopes.get(projectName) === wantScope) return;
+  alignToolSurface(projectName, agent, want) {
+    if (this.scopes.get(projectName) === want.scope && this.profiles.get(projectName) === want.profile) {
+      return;
+    }
     const projectId = this.projectIds.get(projectName) ?? this.resolveProjectId(projectName);
     this.projectIds.set(projectName, projectId);
     const toolCtx = { client: this.opts.client, projectName };
-    const stateTools = wantScope === "read-only" ? buildReadTools(toolCtx) : buildAllTools(toolCtx);
+    const stateTools = buildAeroStateTools(toolCtx, want);
     agent.state.tools = [...stateTools, ...buildSkillDocTools()];
-    this.scopes.set(projectName, wantScope);
+    this.scopes.set(projectName, want.scope);
+    this.profiles.set(projectName, want.profile);
   }
   alignModel(projectName, agent, preferences) {
     const projectId = this.tryResolveProjectId(projectName);
@@ -9206,8 +9681,9 @@ ${lines.join("\n")}
     try {
       let agent;
       try {
-        const scope = this.scopes.get(projectName) ?? "read-only";
-        agent = await this.acquireForTurn(projectName, { toolScope: scope });
+        const scope = this.scopes.get(projectName) ?? AeroToolScopes.readOnly;
+        const profile = this.profiles.get(projectName) ?? AeroToolProfiles.default;
+        agent = await this.acquireForTurn(projectName, { toolScope: scope, toolProfile: profile });
       } catch (err) {
         if (err.code === "AGENT_BUSY") return;
         throw err;
@@ -9242,6 +9718,7 @@ ${lines.join("\n")}
     this.live.delete(projectName);
     this.pending.delete(projectName);
     this.scopes.delete(projectName);
+    this.profiles.delete(projectName);
     this.projectIds.delete(projectName);
   }
   /** Evict every live Agent. Durable state in DB is untouched. */
@@ -9322,7 +9799,7 @@ ${lines.join("\n")}
   insertRow(params) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.opts.db.insert(agentSessions).values({
-      id: crypto19.randomUUID(),
+      id: params.id ?? crypto21.randomUUID(),
       projectId: params.projectId,
       systemPrompt: params.systemPrompt,
       modelProvider: params.provider ?? params.modelProvider ?? AgentProviderIds.claude,
@@ -9381,13 +9858,16 @@ function registerAgentRoutes(app, opts) {
   );
   app.post("/projects/:name/agent/prompt", async (request, reply) => {
     const project = resolveProject(opts.db, request.params.name);
-    const promptText = (request.body?.prompt ?? "").trim();
+    const body = request.body;
+    const promptText = (body?.prompt ?? "").trim();
     if (!promptText) throw validationError('"prompt" is required');
-    const requestedScope = request.body?.scope === "all" ? "all" : "read-only";
+    const requestedScope = body?.scope === AeroToolScopes.all ? AeroToolScopes.all : AeroToolScopes.readOnly;
+    const requestedProfile = isAeroToolProfile(body?.profile) ? body.profile : AeroToolProfiles.default;
     const agent = await opts.sessionRegistry.acquireForTurn(project.name, {
-      provider: request.body?.provider,
-      modelId: request.body?.modelId,
-      toolScope: requestedScope
+      provider: body?.provider,
+      modelId: body?.modelId,
+      toolScope: requestedScope,
+      toolProfile: requestedProfile
     });
     reply.raw.writeHead(200, {
       "Content-Type": "text/event-stream",
@@ -9500,7 +9980,7 @@ Output requirements:
 - Final bullet: the expected outcome if executed (recovered citations, ranking lift, etc.).
 - No preamble, no closing pleasantries, no markdown headers.
 - Maximum 600 characters total. Be dense.`;
-function dollarsToMillicents(dollars) {
+function dollarsToMillicents2(dollars) {
   if (!Number.isFinite(dollars) || dollars <= 0) return 0;
   return Math.round(dollars * 1e5);
 }
@@ -9607,7 +10087,7 @@ function createRecommendationExplainer(opts) {
       provider,
       model: model.id,
       responseText: text,
-      costMillicents: dollarsToMillicents(resp.usage.cost.total)
+      costMillicents: dollarsToMillicents2(resp.usage.cost.total)
     };
   };
 }
@@ -9685,7 +10165,7 @@ Your previous reply was not valid JSON. Return ONLY a JSON object with exactly t
           provider,
           model: model.id,
           brief,
-          costMillicents: dollarsToMillicents(totalCostDollars)
+          costMillicents: dollarsToMillicents2(totalCostDollars)
         };
       }
     }
@@ -10447,14 +10927,14 @@ function summarizeProviderConfig(config) {
   };
 }
 function hashApiKey(key) {
-  return crypto20.createHash("sha256").update(key).digest("hex");
+  return crypto22.createHash("sha256").update(key).digest("hex");
 }
 var DASHBOARD_SCRYPT_KEYLEN = 64;
 var DASHBOARD_SCRYPT_COST = 1 << 15;
 var DASHBOARD_SCRYPT_MAXMEM = 64 * 1024 * 1024;
 function hashDashboardPassword(password) {
-  const salt = crypto20.randomBytes(16);
-  const derived = crypto20.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
+  const salt = crypto22.randomBytes(16);
+  const derived = crypto22.scryptSync(password, salt, DASHBOARD_SCRYPT_KEYLEN, {
     N: DASHBOARD_SCRYPT_COST,
     maxmem: DASHBOARD_SCRYPT_MAXMEM
   });
@@ -10475,14 +10955,14 @@ function verifyDashboardPassword(password, storedHash) {
     } catch {
       return { ok: false, needsRehash: false };
     }
-    const derived = crypto20.scryptSync(password, salt, expected.length, {
+    const derived = crypto22.scryptSync(password, salt, expected.length, {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
     if (derived.length !== expected.length)
       return { ok: false, needsRehash: false };
     return {
-      ok: crypto20.timingSafeEqual(derived, expected),
+      ok: crypto22.timingSafeEqual(derived, expected),
       needsRehash: false
     };
   }
@@ -10491,7 +10971,7 @@ function verifyDashboardPassword(password, storedHash) {
     const expected = Buffer.from(storedHash, "hex");
     if (candidate.length !== expected.length)
       return { ok: false, needsRehash: false };
-    const ok = crypto20.timingSafeEqual(candidate, expected);
+    const ok = crypto22.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
   return { ok: false, needsRehash: false };
@@ -10961,7 +11441,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto20.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto22.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -11022,7 +11502,7 @@ async function createServer(opts) {
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto20.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto22.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -11046,7 +11526,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto20.randomBytes(32).toString("hex");
+    const sessionId = crypto22.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -11346,7 +11826,7 @@ async function createServer(opts) {
         deps: {
           enqueueAutoExtract: ({ projectId, release: r }) => {
             const now = (/* @__PURE__ */ new Date()).toISOString();
-            const runId = crypto20.randomUUID();
+            const runId = crypto22.randomUUID();
             opts.db.insert(runs).values({
               id: runId,
               projectId,
@@ -11564,7 +12044,7 @@ async function createServer(opts) {
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(
           targetProjectIds.map((projectId) => ({
-            id: crypto20.randomUUID(),
+            id: crypto22.randomUUID(),
             projectId,
             actor: "api",
             action: existing ? "provider.updated" : "provider.created",
@@ -11896,5 +12376,7 @@ export {
   checkLatestVersionForCli,
   listAgentProviders,
   coerceAgentProvider,
+  AERO_TOOL_PROFILES,
+  isAeroToolProfile,
   createServer
 };