@ainyc/canonry 4.98.0 → 4.99.1

package/dist/{chunk-7COFPNMH.js → chunk-4Q3LBD7A.js}

@@ -9,7 +9,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-3TH54726.js";
+} from "./chunk-IDI6LMYL.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -111,7 +111,7 @@ import {
   siteAuditPages,
   siteAuditSnapshots,
   usageCounters
-} from "./chunk-DJVUNURL.js";
+} from "./chunk-YBIT5O62.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -171,7 +171,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-CWFTMFEU.js";
+} from "./chunk-JF7EXHGA.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -1473,7 +1473,8 @@ function extractWebSearchToolErrors(rawResponse) {
     if (!content) return [];
     for (const block of content) {
       if (block.type !== "web_search_tool_result") continue;
-      if (block.content === null || typeof block.content !== "object" || Array.isArray(block.content)) continue;
+      if (block.content === null || typeof block.content !== "object" || Array.isArray(block.content))
+        continue;
       const errorCode = block.content.error_code;
       if (typeof errorCode === "string" && errorCode.length > 0) {
         errors.add(errorCode);
@@ -6402,7 +6403,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-QHBXW4KI.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-TWCEKVKZ.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -8331,13 +8332,63 @@ function buildSkillDocTools() {
 // src/agent/mcp-to-agent-tool.ts
 import { Type as Type2 } from "@sinclair/typebox";
 var MAX_TOOL_RESULT_CHARS = 2e4;
-function truncate(json) {
-  if (json.length <= MAX_TOOL_RESULT_CHARS) return json;
-  return json.slice(0, MAX_TOOL_RESULT_CHARS) + "\n... (truncated \u2014 result too large)";
+var TRUNCATION_NOTE = "... (truncated \u2014 result too large)";
+function serializeResult(value) {
+  return JSON.stringify(value, null, 2);
+}
+function largestArrayKey(obj) {
+  let best;
+  let bestLen = -1;
+  for (const [k, v] of Object.entries(obj)) {
+    if (!Array.isArray(v)) continue;
+    const len = serializeResult(v).length;
+    if (len > bestLen) {
+      bestLen = len;
+      best = k;
+    }
+  }
+  return best;
+}
+function trimRowsToFit(rows, render) {
+  let kept = rows.slice();
+  while (kept.length > 0 && render(kept).length > MAX_TOOL_RESULT_CHARS) {
+    kept = kept.slice(0, -1);
+  }
+  return kept;
+}
+function truncateToolResult(details) {
+  const full = serializeResult(details);
+  if (full.length <= MAX_TOOL_RESULT_CHARS) return full;
+  if (Array.isArray(details)) {
+    const kept = trimRowsToFit(
+      details,
+      (rows) => serializeResult({ items: rows, __truncated: true, __omittedRows: details.length - rows.length })
+    );
+    return serializeResult({ items: kept, __truncated: true, __omittedRows: details.length - kept.length });
+  }
+  if (details && typeof details === "object") {
+    const obj = details;
+    const arrayKey = largestArrayKey(obj);
+    if (arrayKey) {
+      const rows = obj[arrayKey];
+      const kept = trimRowsToFit(
+        rows,
+        (r) => serializeResult({ ...obj, [arrayKey]: r, __truncated: true, __omittedRows: rows.length - r.length })
+      );
+      const out = serializeResult({
+        ...obj,
+        [arrayKey]: kept,
+        __truncated: true,
+        __omittedRows: rows.length - kept.length
+      });
+      if (out.length <= MAX_TOOL_RESULT_CHARS) return out;
+    }
+  }
+  return full.slice(0, MAX_TOOL_RESULT_CHARS) + "\n" + TRUNCATION_NOTE;
 }
 function textResult2(details) {
   return {
-    content: [{ type: "text", text: truncate(JSON.stringify(details, null, 2)) }],
+    content: [{ type: "text", text: truncateToolResult(details) }],
     details
   };
 }
@@ -8404,13 +8455,31 @@ function loadAeroSystemPrompt(pkgDir) {
   const skillDir = resolveAeroSkillDir(pkgDir);
   const skillBody = fs7.readFileSync(path8.join(skillDir, "SKILL.md"), "utf-8");
   const soulPath = path8.join(skillDir, "soul.md");
-  if (!fs7.existsSync(soulPath)) return skillBody;
-  const soulBody = fs7.readFileSync(soulPath, "utf-8");
-  return `${soulBody.trimEnd()}
+  const base = fs7.existsSync(soulPath) ? `${fs7.readFileSync(soulPath, "utf-8").trimEnd()}
 
 ---
 
-${skillBody}`;
+${skillBody}` : skillBody;
+  return appendSystemPromptExtras(base);
+}
+function appendSystemPromptExtras(base, env = process.env) {
+  const inline = env.AERO_SYSTEM_PROMPT_APPEND?.trim();
+  let fileBody = "";
+  const filePath = env.AERO_SYSTEM_PROMPT_FILE?.trim();
+  if (filePath) {
+    try {
+      fileBody = fs7.readFileSync(filePath, "utf-8").trim();
+    } catch {
+      fileBody = "";
+    }
+  }
+  const extras = [inline, fileBody].filter((s) => !!s && s.length > 0);
+  if (extras.length === 0) return base;
+  return `${base.trimEnd()}
+
+---
+
+${extras.join("\n\n")}`;
 }
 function missingProviderMessage() {
   const configHints = agentProvidersByPriority().join(", ");
@@ -8461,6 +8530,93 @@ function resolveSessionProviderAndModel(config, opts) {
   return { provider, modelId };
 }
 
+// src/agent/remote-mcp.ts
+import { Type as Type3 } from "@sinclair/typebox";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+var log18 = createLogger("RemoteMcp");
+var AERO_EXCLUDED_MCP_TOOLS2 = /* @__PURE__ */ new Set([]);
+var MAX_TOOL_RESULT_CHARS2 = 2e4;
+function truncate(text) {
+  if (text.length <= MAX_TOOL_RESULT_CHARS2) return text;
+  return text.slice(0, MAX_TOOL_RESULT_CHARS2) + "\n... (truncated, result too large)";
+}
+async function connectStreamableHttp(server) {
+  const transport = new StreamableHTTPClientTransport(new URL(server.url), {
+    requestInit: {
+      headers: { Authorization: `Bearer ${server.token}` }
+    }
+  });
+  const client = new Client(
+    { name: "canonry-aero", version: "1.0.0" },
+    { capabilities: {} }
+  );
+  await client.connect(transport);
+  return client;
+}
+function isReadOnly(tool) {
+  return tool.annotations?.readOnlyHint === true;
+}
+function adaptRemoteTool(client, tool) {
+  const parameters = Type3.Unsafe(
+    tool.inputSchema ?? { type: "object", properties: {} }
+  );
+  const execute = async (_toolCallId, params) => {
+    const result = await client.callTool({ name: tool.name, arguments: params });
+    return {
+      content: [{ type: "text", text: truncate(JSON.stringify(result, null, 2)) }],
+      details: result
+    };
+  };
+  return {
+    name: tool.name,
+    label: tool.annotations?.title ?? tool.name,
+    description: tool.description ?? "",
+    parameters,
+    execute
+  };
+}
+async function loadExternalMcpTools(servers, opts = {}) {
+  if (!servers || servers.length === 0) return [];
+  const connect = opts.connect ?? connectStreamableHttp;
+  const excluded = opts.excluded ?? AERO_EXCLUDED_MCP_TOOLS2;
+  const tools = [];
+  for (const server of servers) {
+    const label = server.label ?? server.url;
+    let client;
+    try {
+      client = await connect(server);
+    } catch (err) {
+      log18.error("external-mcp.connect-failed", {
+        label,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      continue;
+    }
+    let listed;
+    try {
+      listed = await client.listTools();
+    } catch (err) {
+      log18.error("external-mcp.list-failed", {
+        label,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      continue;
+    }
+    for (const tool of listed.tools) {
+      if (excluded.has(tool.name)) continue;
+      if (!isReadOnly(tool)) continue;
+      tools.push(adaptRemoteTool(client, tool));
+    }
+    log18.info("external-mcp.loaded", {
+      label,
+      discovered: listed.tools.length,
+      adopted: tools.length
+    });
+  }
+  return tools;
+}
+
 // src/agent/memory-store.ts
 import crypto18 from "crypto";
 import { and as and13, desc as desc6, eq as eq17, like, sql as sql5 } from "drizzle-orm";
@@ -8684,7 +8840,7 @@ async function compactMessages(args) {
 }
 
 // src/agent/session-registry.ts
-var log18 = createLogger("SessionRegistry");
+var log19 = createLogger("SessionRegistry");
 var MAX_HYDRATE_NOTES = 20;
 var MAX_HYDRATE_BYTES = 32 * 1024;
 function escapeMemoryFragment(value) {
@@ -8703,10 +8859,53 @@ var SessionRegistry = class {
    * awaits the same promise instead of kicking off a duplicate LLM call.
    */
   compactions = /* @__PURE__ */ new Map();
+  /**
+   * Read-only tools loaded once from the injected remote MCP servers (OSS-A).
+   * The server set is static config, so we connect + adapt a single time and
+   * cache the promise; every session merges the same AgentTool list. Resolves
+   * to `[]` when no servers are configured or all fail to connect (the load is
+   * fail-soft and never throws).
+   */
+  externalToolsPromise;
   opts;
   constructor(opts) {
     this.opts = opts;
   }
+  /**
+   * Lazily load + cache the injected remote MCP tools. The seam OSS-A exposes:
+   * `loadExternalMcpTools` connects to each configured server over the frozen
+   * bearer-gated Streamable HTTP transport, lists tools, and adapts the
+   * read-only, non-excluded ones into AgentTools. Cached so we connect once per
+   * registry lifetime regardless of how many projects or turns run.
+   */
+  loadExternalTools() {
+    if (!this.externalToolsPromise) {
+      this.externalToolsPromise = loadExternalMcpTools(this.opts.config.externalMcpServers).catch(
+        (err) => {
+          log19.error("external-mcp.load-failed", {
+            error: err instanceof Error ? err.message : String(err)
+          });
+          return [];
+        }
+      );
+    }
+    return this.externalToolsPromise;
+  }
+  /**
+   * Append the cached external MCP tools to the live agent's tool list, idempotently.
+   * Called after scope/model alignment in `acquireForTurn` (which rebuilds
+   * `state.tools` from the local registry), so the remote read-only tools ride
+   * alongside the local ones for the upcoming turn. No-op when none are configured.
+   */
+  async mergeExternalTools(agent) {
+    const external = await this.loadExternalTools();
+    if (external.length === 0) return;
+    const current = agent.state.tools;
+    const present = new Set(current.map((t) => t.name));
+    const additions = external.filter((t) => !present.has(t.name));
+    if (additions.length === 0) return;
+    agent.state.tools = [...current, ...additions];
+  }
   /** Read-only access to the config snapshot the registry was built with. */
   getConfig() {
     return this.opts.config;
@@ -8865,6 +9064,7 @@ ${lines.join("\n")}
     if (preferences?.provider || preferences?.modelId) {
       this.alignModel(projectName, agent, preferences);
     }
+    await this.mergeExternalTools(agent);
     await this.maybeCompact(projectName, agent);
     return agent;
   }
@@ -8911,13 +9111,13 @@ ${lines.join("\n")}
       agent.state.messages = result.messages;
       agent.state.systemPrompt = this.buildHydratedSystemPrompt(projectId, row.systemPrompt);
       this.save(projectName);
-      log18.info("compaction.completed", {
+      log19.info("compaction.completed", {
         projectName,
         removedCount: result.removedCount,
         summaryBytes: Buffer.byteLength(result.summary, "utf8")
       });
     } catch (err) {
-      log18.error("compaction.failed", {
+      log19.error("compaction.failed", {
         projectName,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -9014,7 +9214,7 @@ ${lines.join("\n")}
       await agent.prompt(msgs);
       this.save(projectName);
     } catch (err) {
-      log18.error("drain.failed", {
+      log19.error("drain.failed", {
         projectName,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -9612,7 +9812,7 @@ function formatAuditFactorScore(factor) {
 }
 
 // src/snapshot-service.ts
-var log19 = createLogger("Snapshot");
+var log20 = createLogger("Snapshot");
 var ANALYSIS_PROVIDER_PRIORITY = ["openai", "claude", "gemini", "perplexity", "local"];
 var SNAPSHOT_QUERY_COUNT = 6;
 var ProviderExecutionGate2 = class {
@@ -9758,7 +9958,7 @@ var SnapshotService = class {
       return mapAuditReport(report);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log19.warn("audit.failed", { homepageUrl, error: message });
+      log20.warn("audit.failed", { homepageUrl, error: message });
       return {
         url: homepageUrl,
         finalUrl: homepageUrl,
@@ -9787,7 +9987,7 @@ var SnapshotService = class {
           queries: parsedQueries
         };
       } catch (err) {
-        log19.warn("profile.generation-failed", {
+        log20.warn("profile.generation-failed", {
           domain: ctx.domain,
           provider: ctx.analysisProvider.adapter.name,
           error: err instanceof Error ? err.message : String(err)
@@ -9929,7 +10129,7 @@ var SnapshotService = class {
         recommendedActions: uniqueStrings(parsed.recommendedActions ?? []).slice(0, 4)
       };
     } catch (err) {
-      log19.warn("response.analysis-failed", {
+      log20.warn("response.analysis-failed", {
         provider: ctx.analysisProvider.adapter.name,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -10211,7 +10411,7 @@ function clipText(value, length) {
 // src/server.ts
 var _require3 = createRequire3(import.meta.url);
 var { version: PKG_VERSION2 } = _require3("../package.json");
-var log20 = createLogger("Server");
+var log21 = createLogger("Server");
 var DEFAULT_QUOTA = {
   maxConcurrency: 2,
   maxRequestsPerMinute: 10,
@@ -10226,9 +10426,7 @@ var API_ADAPTERS = [
   localAdapter,
   perplexityAdapter
 ];
-var BROWSER_ADAPTERS = [
-  cdpChatgptAdapter
-];
+var BROWSER_ADAPTERS = [cdpChatgptAdapter];
 var adapterMap = Object.fromEntries(
   API_ADAPTERS.map((a) => [a.name, a])
 );
@@ -10278,13 +10476,18 @@ function verifyDashboardPassword(password, storedHash) {
       N: DASHBOARD_SCRYPT_COST,
       maxmem: DASHBOARD_SCRYPT_MAXMEM
     });
-    if (derived.length !== expected.length) return { ok: false, needsRehash: false };
-    return { ok: crypto20.timingSafeEqual(derived, expected), needsRehash: false };
+    if (derived.length !== expected.length)
+      return { ok: false, needsRehash: false };
+    return {
+      ok: crypto20.timingSafeEqual(derived, expected),
+      needsRehash: false
+    };
   }
   if (/^[a-f0-9]{64}$/i.test(storedHash)) {
     const candidate = Buffer.from(hashApiKey(password), "hex");
     const expected = Buffer.from(storedHash, "hex");
-    if (candidate.length !== expected.length) return { ok: false, needsRehash: false };
+    if (candidate.length !== expected.length)
+      return { ok: false, needsRehash: false };
     const ok = crypto20.timingSafeEqual(candidate, expected);
     return { ok, needsRehash: ok };
   }
@@ -10326,7 +10529,11 @@ function serializeSessionCookie(opts) {
 function applyLegacyCredentials(rows, config) {
   let migratedGoogle = 0;
   for (const row of rows.google) {
-    const existing = getGoogleConnection(config, row.domain, row.connectionType);
+    const existing = getGoogleConnection(
+      config,
+      row.domain,
+      row.connectionType
+    );
     if (existing?.refreshToken) continue;
     upsertGoogleConnection(config, {
       domain: row.domain,
@@ -10344,7 +10551,7 @@ function applyLegacyCredentials(rows, config) {
   }
   if (migratedGoogle > 0) {
     saveConfigPatch({ google: config.google });
-    log20.info("credentials.migrated", { type: "google", count: migratedGoogle });
+    log21.info("credentials.migrated", { type: "google", count: migratedGoogle });
   }
   let migratedGa4 = 0;
   for (const row of rows.ga4) {
@@ -10362,7 +10569,7 @@ function applyLegacyCredentials(rows, config) {
   }
   if (migratedGa4 > 0) {
     saveConfigPatch({ ga4: config.ga4 });
-    log20.info("credentials.migrated", { type: "ga4", count: migratedGa4 });
+    log21.info("credentials.migrated", { type: "ga4", count: migratedGa4 });
   }
 }
 function isLoopbackBindHost(host) {
@@ -10401,14 +10608,16 @@ async function createServer(opts) {
     applyLegacyCredentials(legacyRows, opts.config);
     dropLegacyCredentialColumns(opts.db);
   } catch (err) {
-    log20.warn("credentials.migration.failed", {
+    log21.warn("credentials.migration.failed", {
       error: err instanceof Error ? err.message : String(err)
     });
   }
-  log20.info("providers.configured", { providers: Object.keys(providers).filter((k) => {
-    const p = providers[k];
-    return p?.apiKey || p?.baseUrl || p?.vertexProject;
-  }) });
+  log21.info("providers.configured", {
+    providers: Object.keys(providers).filter((k) => {
+      const p = providers[k];
+      return p?.apiKey || p?.baseUrl || p?.vertexProject;
+    })
+  });
   for (const adapter of API_ADAPTERS) {
     const entry = providers[adapter.name];
     if (!entry) continue;
@@ -10428,7 +10637,11 @@ async function createServer(opts) {
   }
   const cdpConfig = opts.config.cdp;
   if (cdpConfig?.host || cdpConfig?.port) {
-    const CDP_DEFAULT_QUOTA = { maxConcurrency: 1, maxRequestsPerMinute: 4, maxRequestsPerDay: 200 };
+    const CDP_DEFAULT_QUOTA = {
+      maxConcurrency: 1,
+      maxRequestsPerMinute: 4,
+      maxRequestsPerDay: 200
+    };
     const cdpEndpoint = `ws://${cdpConfig.host ?? "localhost"}:${cdpConfig.port ?? 9222}`;
     registry.register(cdpChatgptAdapter, {
       provider: "cdp:chatgpt",
@@ -10442,7 +10655,9 @@ async function createServer(opts) {
   jobRunner.recoverStaleRuns();
   const notifier = new Notifier(opts.db, serverUrl);
   const intelligenceService = new IntelligenceService(opts.db);
-  const aeroClient = new ApiClient(opts.config.apiUrl, opts.config.apiKey, { skipProbe: true });
+  const aeroClient = new ApiClient(opts.config.apiUrl, opts.config.apiKey, {
+    skipProbe: true
+  });
   const agentEnabled = resolveAgentEnabled(process.env, opts.config);
   const sessionRegistry = agentEnabled ? new SessionRegistry({
     db: opts.db,
@@ -10489,7 +10704,9 @@ async function createServer(opts) {
   const runGbpSync = (runId, projectId, syncOpts) => {
     const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
     if (!googleClientId || !googleClientSecret) {
-      app.log.error("GBP sync requested but Google OAuth credentials are not configured in the local config");
+      app.log.error(
+        "GBP sync requested but Google OAuth credentials are not configured in the local config"
+      );
       return;
     }
     executeGbpSync(opts.db, runId, projectId, {
@@ -10542,7 +10759,14 @@ async function createServer(opts) {
     },
     onTrafficSyncRequested: (projectName, sourceId) => {
       aeroClient.trafficSync(projectName, sourceId).catch((err) => {
-        app.log.error({ projectName, sourceId, err: err instanceof Error ? err.message : String(err) }, "Scheduled traffic sync failed");
+        app.log.error(
+          {
+            projectName,
+            sourceId,
+            err: err instanceof Error ? err.message : String(err)
+          },
+          "Scheduled traffic sync failed"
+        );
       });
     },
     onGbpSyncRequested: (runId, projectId) => {
@@ -10557,21 +10781,33 @@ async function createServer(opts) {
     onBacklinksSyncRequested: (projectName) => {
       void (async () => {
         const probed = await probeLatestRelease().catch((err) => {
-          app.log.warn({ projectName, err }, "Scheduled backlinks sync: latest-release probe failed");
+          app.log.warn(
+            { projectName, err },
+            "Scheduled backlinks sync: latest-release probe failed"
+          );
           return null;
         });
         if (!probed) return;
-        const alreadySynced = opts.db.select().from(ccReleaseSyncs).where(and14(
-          eq20(ccReleaseSyncs.release, probed.release),
-          eq20(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
-        )).limit(1).get();
+        const alreadySynced = opts.db.select().from(ccReleaseSyncs).where(
+          and14(
+            eq20(ccReleaseSyncs.release, probed.release),
+            eq20(ccReleaseSyncs.status, CcReleaseSyncStatuses.ready)
+          )
+        ).limit(1).get();
         if (alreadySynced) {
-          app.log.info({ projectName, release: probed.release }, "Scheduled backlinks sync: already up to date, skipping");
+          app.log.info(
+            { projectName, release: probed.release },
+            "Scheduled backlinks sync: already up to date, skipping"
+          );
           return;
         }
         aeroClient.backlinksTriggerSync(probed.release).catch((err) => {
           app.log.error(
-            { projectName, release: probed.release, err: err instanceof Error ? err.message : String(err) },
+            {
+              projectName,
+              release: probed.release,
+              err: err instanceof Error ? err.message : String(err)
+            },
             "Scheduled backlinks sync failed"
           );
         });
@@ -10580,7 +10816,10 @@ async function createServer(opts) {
       if (project && bingConnectionStore.getConnection(project.canonicalDomain)) {
         aeroClient.backlinksBingSync(projectName).catch((err) => {
           app.log.error(
-            { projectName, err: err instanceof Error ? err.message : String(err) },
+            {
+              projectName,
+              err: err instanceof Error ? err.message : String(err)
+            },
             "Scheduled Bing backlinks sync failed"
           );
         });
@@ -10602,7 +10841,9 @@ async function createServer(opts) {
     vertexConfigured: adapter.name === "gemini" ? !!opts.config.providers?.gemini?.vertexProject : void 0
   }));
   const googleSettingsSummary = {
-    configured: Boolean(opts.config.google?.clientId && opts.config.google?.clientSecret)
+    configured: Boolean(
+      opts.config.google?.clientId && opts.config.google?.clientSecret
+    )
   };
   const bingSettingsSummary = {
     // Treat Bing as configured if there is at least one connection with an API key,
@@ -10619,8 +10860,13 @@ async function createServer(opts) {
     upsertConnection: (connection) => {
       if (!opts.config.bing) opts.config.bing = {};
       if (!opts.config.bing.connections) opts.config.bing.connections = [];
-      const idx = opts.config.bing.connections.findIndex((c) => c.domain === connection.domain);
-      const normalized = { ...connection, createdByProjectId: connection.createdByProjectId ?? null };
+      const idx = opts.config.bing.connections.findIndex(
+        (c) => c.domain === connection.domain
+      );
+      const normalized = {
+        ...connection,
+        createdByProjectId: connection.createdByProjectId ?? null
+      };
       if (idx >= 0) {
         opts.config.bing.connections[idx] = normalized;
       } else {
@@ -10630,7 +10876,9 @@ async function createServer(opts) {
       return normalized;
     },
     updateConnection: (domain, patch) => {
-      const conn = opts.config.bing?.connections?.find((c) => c.domain === domain);
+      const conn = opts.config.bing?.connections?.find(
+        (c) => c.domain === domain
+      );
       if (!conn) return void 0;
       Object.assign(conn, patch);
       saveConfigPatch(opts.config);
@@ -10638,7 +10886,9 @@ async function createServer(opts) {
     },
     deleteConnection: (domain) => {
       if (!opts.config.bing?.connections) return false;
-      const idx = opts.config.bing.connections.findIndex((c) => c.domain === domain);
+      const idx = opts.config.bing.connections.findIndex(
+        (c) => c.domain === domain
+      );
       if (idx < 0) return false;
       opts.config.bing.connections.splice(idx, 1);
       saveConfigPatch(opts.config);
@@ -10685,7 +10935,10 @@ async function createServer(opts) {
       return updated;
     },
     deleteConnection: (projectName) => {
-      const removed = removeWordpressTrafficConnection(opts.config, projectName);
+      const removed = removeWordpressTrafficConnection(
+        opts.config,
+        projectName
+      );
       if (removed) saveConfigPatch(opts.config);
       return removed;
     }
@@ -10715,12 +10968,21 @@ async function createServer(opts) {
       return updated;
     },
     updateConnection: (domain, connectionType, patch) => {
-      const updated = patchGoogleConnection(opts.config, domain, connectionType, patch);
+      const updated = patchGoogleConnection(
+        opts.config,
+        domain,
+        connectionType,
+        patch
+      );
       if (updated) saveConfigPatch(opts.config);
       return updated;
     },
     deleteConnection: (domain, connectionType) => {
-      const removed = removeGoogleConnection(opts.config, domain, connectionType);
+      const removed = removeGoogleConnection(
+        opts.config,
+        domain,
+        connectionType
+      );
       if (removed) saveConfigPatch(opts.config);
       return removed;
     }
@@ -10811,13 +11073,16 @@ async function createServer(opts) {
     const key = getDefaultApiKey();
     if (!key || key.revokedAt) return false;
     const sessionId = createSession(key.id);
-    reply.header("set-cookie", serializeSessionCookie({
-      name: SESSION_COOKIE_NAME,
-      value: sessionId,
-      path: sessionCookiePath,
-      secure: sessionCookieSecure,
-      ttlMs: SESSION_TTL_MS
-    }));
+    reply.header(
+      "set-cookie",
+      serializeSessionCookie({
+        name: SESSION_COOKIE_NAME,
+        value: sessionId,
+        path: sessionCookiePath,
+        secure: sessionCookieSecure,
+        ttlMs: SESSION_TTL_MS
+      })
+    );
     return true;
   };
   const boundToLoopback = isLoopbackBindHost(opts.host);
@@ -10838,7 +11103,9 @@ async function createServer(opts) {
   });
   app.post(apiPrefix + "/session/setup", async (request, reply) => {
     if (!boundToLoopback && !requestHasValidApiKey(request)) {
-      const err = authRequired("This server is network-reachable; setting the dashboard password requires a valid API key.");
+      const err = authRequired(
+        "This server is network-reachable; setting the dashboard password requires a valid API key."
+      );
       return reply.status(err.statusCode).send(err.toJSON());
     }
     if (opts.config.dashboardPasswordHash) {
@@ -10863,19 +11130,31 @@ async function createServer(opts) {
     const apiKey = request.body?.apiKey?.trim();
     if (password) {
       if (!opts.config.dashboardPasswordHash) {
-        const err2 = validationError("No dashboard password configured \u2014 use /session/setup first");
+        const err2 = validationError(
+          "No dashboard password configured \u2014 use /session/setup first"
+        );
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      const verification = verifyDashboardPassword(password, opts.config.dashboardPasswordHash);
+      const verification = verifyDashboardPassword(
+        password,
+        opts.config.dashboardPasswordHash
+      );
       if (!verification.ok) {
-        return reply.status(401).send({ error: { code: "AUTH_INVALID", message: "Incorrect password" } });
+        return reply.status(401).send({
+          error: { code: "AUTH_INVALID", message: "Incorrect password" }
+        });
       }
       if (verification.needsRehash) {
         opts.config.dashboardPasswordHash = hashDashboardPassword(password);
         saveConfigPatch(opts.config);
       }
       if (!createPasswordSession(reply)) {
-        return reply.status(401).send({ error: { code: "AUTH_INVALID", message: "Server API key not found \u2014 re-run canonry init" } });
+        return reply.status(401).send({
+          error: {
+            code: "AUTH_INVALID",
+            message: "Server API key not found \u2014 re-run canonry init"
+          }
+        });
       }
       return reply.send({ authenticated: true });
     }
@@ -10887,13 +11166,16 @@ async function createServer(opts) {
       }
       opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq20(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
-      reply.header("set-cookie", serializeSessionCookie({
-        name: SESSION_COOKIE_NAME,
-        value: sessionId,
-        path: sessionCookiePath,
-        secure: sessionCookieSecure,
-        ttlMs: SESSION_TTL_MS
-      }));
+      reply.header(
+        "set-cookie",
+        serializeSessionCookie({
+          name: SESSION_COOKIE_NAME,
+          value: sessionId,
+          path: sessionCookiePath,
+          secure: sessionCookieSecure,
+          ttlMs: SESSION_TTL_MS
+        })
+      );
       return reply.send({ authenticated: true });
     }
     const err = validationError("Either password or apiKey is required");
@@ -10902,13 +11184,16 @@ async function createServer(opts) {
   app.delete(apiPrefix + "/session", async (request, reply) => {
     const sessionId = parseCookies(request.headers.cookie)[SESSION_COOKIE_NAME];
     clearSession(sessionId);
-    reply.header("set-cookie", serializeSessionCookie({
-      name: SESSION_COOKIE_NAME,
-      value: null,
-      path: sessionCookiePath,
-      secure: sessionCookieSecure,
-      ttlMs: SESSION_TTL_MS
-    }));
+    reply.header(
+      "set-cookie",
+      serializeSessionCookie({
+        name: SESSION_COOKIE_NAME,
+        value: null,
+        path: sessionCookiePath,
+        secure: sessionCookieSecure,
+        ttlMs: SESSION_TTL_MS
+      })
+    );
     return reply.status(204).send();
   });
   const LATEST_RELEASE_TTL_MS = 5 * 60 * 1e3;
@@ -10933,8 +11218,12 @@ async function createServer(opts) {
     latestReleaseCache = { value, expiresAt: now + LATEST_RELEASE_TTL_MS };
     return value;
   };
-  const explainContentRecommendation = createRecommendationExplainer({ config: opts.config });
-  const briefContentRecommendation = createRecommendationBriefSynthesizer({ config: opts.config });
+  const explainContentRecommendation = createRecommendationExplainer({
+    config: opts.config
+  });
+  const briefContentRecommendation = createRecommendationBriefSynthesizer({
+    config: opts.config
+  });
   await app.register(apiRoutes, {
     db: opts.db,
     routePrefix: apiPrefix,
@@ -10996,7 +11285,9 @@ async function createServer(opts) {
     onGscSyncRequested: (runId, projectId, syncOpts) => {
       const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
       if (!googleClientId || !googleClientSecret) {
-        app.log.error("GSC sync requested but Google OAuth credentials are not configured in the local config");
+        app.log.error(
+          "GSC sync requested but Google OAuth credentials are not configured in the local config"
+        );
         return;
       }
       executeGscSync(opts.db, runId, projectId, {
@@ -11009,7 +11300,9 @@ async function createServer(opts) {
     onInspectSitemapRequested: (runId, projectId, inspectOpts) => {
       const { clientId: googleClientId, clientSecret: googleClientSecret } = getGoogleAuthConfig(opts.config);
       if (!googleClientId || !googleClientSecret) {
-        app.log.error("Inspect sitemap requested but Google OAuth credentials are not configured");
+        app.log.error(
+          "Inspect sitemap requested but Google OAuth credentials are not configured"
+        );
         return;
       }
       executeInspectSitemap(opts.db, runId, projectId, {
@@ -11034,7 +11327,9 @@ async function createServer(opts) {
       pluginDir: PLUGIN_DIR
     }),
     onInstallBacklinks: async () => {
-      const result = await installDuckdb({ onLog: (line) => app.log.info({ line }, "duckdb install") });
+      const result = await installDuckdb({
+        onLog: (line) => app.log.info({ line }, "duckdb install")
+      });
       return {
         installed: true,
         version: result.version,
@@ -11057,8 +11352,13 @@ async function createServer(opts) {
               trigger: RunTriggers.scheduled,
               createdAt: now
             }).run();
-            executeBacklinkExtract(opts.db, runId, projectId, { release: r }).catch((err) => {
-              app.log.error({ runId, projectId, err }, "Auto backlink extract failed");
+            executeBacklinkExtract(opts.db, runId, projectId, {
+              release: r
+            }).catch((err) => {
+              app.log.error(
+                { runId, projectId, err },
+                "Auto backlink extract failed"
+              );
             });
           }
         }
@@ -11067,9 +11367,11 @@ async function createServer(opts) {
       });
     },
     onBacklinkExtractRequested: (runId, projectId, release) => {
-      executeBacklinkExtract(opts.db, runId, projectId, { release }).catch((err) => {
-        app.log.error({ runId, err }, "Backlink extract failed");
-      });
+      executeBacklinkExtract(opts.db, runId, projectId, { release }).catch(
+        (err) => {
+          app.log.error({ runId, err }, "Backlink extract failed");
+        }
+      );
     },
     onBingBacklinkSyncRequested: (runId, projectId) => {
       executeBingBacklinkSync(opts.db, runId, projectId, {
@@ -11104,9 +11406,16 @@ async function createServer(opts) {
     embedQueries: (queriesToEmbed) => {
       const cfg = registry.get("gemini")?.config;
       if (!cfg?.apiKey) {
-        return Promise.reject(new Error("Gemini API key not configured; harvest semantic novelty unavailable"));
+        return Promise.reject(
+          new Error(
+            "Gemini API key not configured; harvest semantic novelty unavailable"
+          )
+        );
       }
-      return embedQueries(queriesToEmbed, { apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+      return embedQueries(queriesToEmbed, {
+        apiKey: cfg.apiKey,
+        baseUrl: cfg.baseUrl
+      });
     },
     onSiteAuditRequested: (runId, projectId, auditOpts) => {
       runSiteAudit(runId, projectId, auditOpts);
@@ -11122,7 +11431,10 @@ async function createServer(opts) {
       const cached = listCachedReleases();
       const syncByRelease = /* @__PURE__ */ new Map();
       for (const row of opts.db.select().from(ccReleaseSyncs).all()) {
-        syncByRelease.set(row.release, { status: row.status, updatedAt: row.updatedAt });
+        syncByRelease.set(row.release, {
+          status: row.status,
+          updatedAt: row.updatedAt
+        });
       }
       return cached.map((entry) => {
         const sync = syncByRelease.get(entry.release);
@@ -11171,16 +11483,20 @@ async function createServer(opts) {
     wordpressTrafficCredentialStore,
     vercelTrafficCredentialStore,
     onTrafficSynced: (event) => {
-      trackEvent("traffic.synced", {
-        status: event.status,
-        sourceType: event.sourceType,
-        sourceId: event.sourceId,
-        pulledEvents: event.pulledEvents,
-        selfTrafficExcluded: event.selfTrafficExcluded,
-        crawlerHits: event.crawlerHits,
-        aiReferralHits: event.aiReferralHits,
-        durationMs: event.durationMs
-      }, event.errorCode ? { errorCode: event.errorCode } : void 0);
+      trackEvent(
+        "traffic.synced",
+        {
+          status: event.status,
+          sourceType: event.sourceType,
+          sourceId: event.sourceId,
+          pulledEvents: event.pulledEvents,
+          selfTrafficExcluded: event.selfTrafficExcluded,
+          crawlerHits: event.crawlerHits,
+          aiReferralHits: event.aiReferralHits,
+          durationMs: event.durationMs
+        },
+        event.errorCode ? { errorCode: event.errorCode } : void 0
+      );
     },
     onRunCreated: (runId, projectId, providers2, location) => {
       jobRunner.executeRun(runId, projectId, providers2, location).catch((err) => {
@@ -11243,16 +11559,18 @@ async function createServer(opts) {
         }).map((project) => project.id);
         const targetProjectIds = affectedProjectIds.length > 0 ? affectedProjectIds : [null];
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-        opts.db.insert(auditLog).values(targetProjectIds.map((projectId) => ({
-          id: crypto20.randomUUID(),
-          projectId,
-          actor: "api",
-          action: existing ? "provider.updated" : "provider.created",
-          entityType: "provider",
-          entityId: name,
-          diff,
-          createdAt
-        }))).run();
+        opts.db.insert(auditLog).values(
+          targetProjectIds.map((projectId) => ({
+            id: crypto20.randomUUID(),
+            projectId,
+            actor: "api",
+            action: existing ? "provider.updated" : "provider.created",
+            entityType: "provider",
+            entityId: name,
+            diff,
+            createdAt
+          }))
+        ).run();
       }
       return {
         name,
@@ -11300,7 +11618,10 @@ async function createServer(opts) {
             "aliases changed \u2014 recomputed mention fields on historical snapshots"
           );
         } catch (err) {
-          app.log.error({ err, projectId, projectName }, "alias-triggered backfill failed");
+          app.log.error(
+            { err, projectId, projectName },
+            "alias-triggered backfill failed"
+          );
         }
       });
     },
@@ -11329,7 +11650,11 @@ async function createServer(opts) {
         app.log.error({ err }, "Failed to save CDP config");
         throw err;
       }
-      const CDP_DEFAULT_QUOTA = { maxConcurrency: 1, maxRequestsPerMinute: 4, maxRequestsPerDay: 200 };
+      const CDP_DEFAULT_QUOTA = {
+        maxConcurrency: 1,
+        maxRequestsPerMinute: 4,
+        maxRequestsPerDay: 200
+      };
       registry.register(cdpChatgptAdapter, {
         provider: "cdp:chatgpt",
         cdpEndpoint: `ws://${host}:${port2}`,
@@ -11361,16 +11686,19 @@ async function createServer(opts) {
         conn.config
       );
       const raw = result.rawResponse;
-      return [{
-        target: targets?.[0] ?? "chatgpt",
-        screenshotPath: result.screenshotPath ?? "",
-        answerText: raw.answerText ?? "",
-        citations: raw.groundingSources ?? []
-      }];
+      return [
+        {
+          target: targets?.[0] ?? "chatgpt",
+          screenshotPath: result.screenshotPath ?? "",
+          answerText: raw.answerText ?? "",
+          citations: raw.groundingSources ?? []
+        }
+      ];
     },
     onGenerateQueries: async (providerName, count, project) => {
       const provider = registry.get(providerName);
-      if (!provider) throw new Error(`Provider "${providerName}" is not configured`);
+      if (!provider)
+        throw new Error(`Provider "${providerName}" is not configured`);
       const siteText = await fetchSiteText(project.domain);
       const prompt = buildQueryGenerationPrompt({
         domain: project.domain,
@@ -11423,11 +11751,11 @@ async function createServer(opts) {
       // Without this, the browser hits the server for every JS chunk on
       // every page load, defeating most of the dashboard's first-paint
       // budget.
-      setHeaders: (reply, filePath) => {
-        if (filePath.endsWith(".html")) {
-          reply.setHeader("Cache-Control", "no-cache, must-revalidate");
+      setHeaders: (res, path10) => {
+        if (path10.endsWith(".html")) {
+          res.setHeader("Cache-Control", "no-cache, must-revalidate");
         } else {
-          reply.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+          res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
         }
       }
     });
@@ -11491,10 +11819,18 @@ function buildQueryGenerationPrompt(ctx) {
   lines.push(`Country: ${ctx.country}`);
   lines.push(`Language: ${ctx.language}`);
   if (ctx.siteText) {
-    lines.push("", "--- Site Content ---", ctx.siteText, "--- End Site Content ---");
+    lines.push(
+      "",
+      "--- Site Content ---",
+      ctx.siteText,
+      "--- End Site Content ---"
+    );
   }
   if (ctx.existingQueries.length > 0) {
-    lines.push("", `Already tracking (do NOT duplicate): ${ctx.existingQueries.join(", ")}`);
+    lines.push(
+      "",
+      `Already tracking (do NOT duplicate): ${ctx.existingQueries.join(", ")}`
+    );
   }
   lines.push(
     "",
@@ -11516,7 +11852,10 @@ function parseQueryResponse(raw, count) {
     let cleaned = line.replace(/^\s*(?:\d+[.)]\s*|[-*•]\s*)/, "").trim();
     cleaned = cleaned.replace(/^["']|["']$/g, "").trim();
     if (!cleaned) continue;
-    if (/^(?:here are|sure|certainly|of course|i['’]ve|these are|below are)/i.test(cleaned)) continue;
+    if (/^(?:here are|sure|certainly|of course|i['’]ve|these are|below are)/i.test(
+      cleaned
+    ))
+      continue;
     if (cleaned.split(/\s+/).length > 8) continue;
     const key = cleaned.toLowerCase();
     if (seen.has(key)) continue;