@ainyc/canonry 5.5.0 → 5.8.0

package/dist/{chunk-75ECQ77U.js → chunk-BO53QARL.js}

@@ -16,12 +16,12 @@ import {
   resolveOperatorApiKeyIds,
   runWithUsageTags,
   saveConfigPatch
-} from "./chunk-KKDXJWDK.js";
+} from "./chunk-S4DBS5DP.js";
 import {
   deleteSiteCrawlGraphLayout,
   persistSiteCrawlGraphLayout,
   prepareSiteCrawlGraphLayout
-} from "./chunk-LQAOGFFK.js";
+} from "./chunk-R4COV5KR.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-AOJU5LKX.js";
@@ -152,6 +152,7 @@ import {
   refreshAccessToken,
   registerOAuthAdminRoutes,
   registerOAuthRoutes,
+  requireInstanceAdministrator,
   researchRunQueries,
   researchRuns,
   resolveDestination,
@@ -176,7 +177,7 @@ import {
   siteLivenessState,
   toAlertView,
   usageCounters
-} from "./chunk-BL3FMPSM.js";
+} from "./chunk-5E4ASNU4.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_NONE,
@@ -329,7 +330,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-REQEWYNF.js";
+} from "./chunk-D3DKDTXP.js";
 
 // src/runtime-context.ts
 function cliRuntimeContext(env = process.env, stdio = process) {
@@ -6040,6 +6041,13 @@ function resolveAgentEnabled(env, config) {
   }
   return config.agent?.mode !== "disabled";
 }
+function resolveAgentProactiveEnabled(env, config) {
+  const raw = env.CANONRY_AGENT_PROMPT_ONLY?.trim();
+  if (raw) {
+    return !(raw === "1" || raw.toLowerCase() === "true");
+  }
+  return config.agent?.mode !== "prompt-only";
+}
 
 // src/places-config.ts
 var DEFAULT_TIER = "atmosphere";
@@ -6468,7 +6476,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "6545acf727b981bb820e18cd53d860ebd9b8be05" : void 0;
+  const embedded = true ? "6009ba08439de17b373d8958bae95b4794f02af0" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -11762,7 +11770,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-CU7W5AVC.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-4XMMO3JK.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -13656,11 +13664,18 @@ var PROVIDER_MODELS = {
     [LlmCapabilities.classify]: "glm-5-turbo"
   },
   [AgentProviderIds.deepinfra]: {
-    // DeepInfra `org/Model` slugs. GLM-5.2 (Sonnet-class) on all three tiers —
-    // it undercuts the Claude tiers it replaces, so the cheaper tiers take no
-    // quality hit. Resolved into a custom openai-completions model, not pi-ai's
-    // catalog.
-    [LlmCapabilities.agent]: "zai-org/GLM-5.2",
+    // DeepInfra `org/Model` slugs, resolved into a custom openai-completions
+    // model rather than pi-ai's catalog.
+    //
+    // The agent tier is pinned explicitly: the dashboard picker sends a
+    // provider and no model, so whatever sits here is what selecting DeepInfra
+    // pins a session to.
+    //
+    // analyze + classify stay on GLM on purpose. Those tiers suppress the
+    // reasoning trace through GLM's chat-template switch, and that branch
+    // applies only to a model declared `reasoning: true`; moving them to
+    // DeepSeek-V4-Flash (which is not) would quietly stop suppressing anything.
+    [LlmCapabilities.agent]: "deepseek-ai/DeepSeek-V4-Flash",
     [LlmCapabilities.analyze]: "zai-org/GLM-5.2",
     [LlmCapabilities.classify]: "zai-org/GLM-5.2"
   }
@@ -13718,7 +13733,7 @@ var AGENT_PROVIDERS = {
       },
       // Best-effort metadata. Costs are USD/1M tokens (DeepInfra published
       // rates: GLM-5.2 ~$0.95 in / $0.18 cached / $3.00 out; DeepSeek-V4-Flash
-      // ~$0.10 in / $0.20 out). contextWindow is DeepInfra's 1M (fp4) serving
+      // $0.09 in / $0.18 out). contextWindow is DeepInfra's 1M (fp4) serving
       // window for both models; it's descriptive (see OpenAiCompatibleModelMeta),
       // so it documents the real window rather than gating compaction.
       knownModels: {
@@ -13732,7 +13747,7 @@ var AGENT_PROVIDERS = {
           contextWindow: 1048576,
           maxTokens: 32768,
           reasoning: false,
-          cost: { input: 0.1, output: 0.2, cacheRead: 0, cacheWrite: 0 }
+          cost: { input: 0.09, output: 0.18, cacheRead: 0, cacheWrite: 0 }
         }
       },
       // Fallback for arbitrary `--model` slugs we don't ship as tiers. cost is
@@ -15065,6 +15080,10 @@ var SessionRegistry = class {
   constructor(opts) {
     this.opts = opts;
   }
+  /** False only in prompt-only mode; absent means proactive, as it always was. */
+  get proactive() {
+    return this.opts.proactive !== false;
+  }
   /**
    * Lazily load + cache the injected remote MCP tools. The seam OSS-A exposes:
    * `loadExternalMcpTools` connects to each configured server over the frozen
@@ -15149,7 +15168,7 @@ var SessionRegistry = class {
       this.scopes.set(projectName, preferences?.toolScope ?? AeroToolScopes.all);
       this.profiles.set(projectName, preferences?.toolProfile ?? AeroToolProfiles.default);
       this.projectIds.set(projectName, projectId);
-      if (queued.length > 0) {
+      if (queued.length > 0 && this.proactive) {
         this.appendPending(projectName, queued);
         this.updateRow(projectId, { followUpQueue: "[]" });
       }
@@ -15395,6 +15414,7 @@ ${lines.join("\n")}
    * both the in-memory pending and the DB-queue migration produced copies).
    */
   queueFollowUp(projectName, message) {
+    if (!this.proactive) return;
     if (this.live.has(projectName)) {
       this.appendPending(projectName, [message]);
     } else {
@@ -15403,6 +15423,7 @@ ${lines.join("\n")}
   }
   /** Consume (and clear) the pending queue for a project. Caller prompts with the result. */
   consumePending(projectName) {
+    if (!this.proactive) return [];
     const msgs = this.pending.get(projectName) ?? [];
     if (msgs.length === 0) return [];
     this.pending.delete(projectName);
@@ -15422,6 +15443,7 @@ ${lines.join("\n")}
    * RunCoordinator calls after a run completes to wake Aero unprompted.
    */
   async drainNow(projectName) {
+    if (!this.proactive) return;
     if (!this.hasPendingWork(projectName)) return;
     try {
       let agent;
@@ -15786,13 +15808,15 @@ function registerAgentRoutes(app, opts) {
   app.get(
     "/projects/:name/agent/transcript",
     async (request) => {
+      requireInstanceAdministrator(request);
       const project = resolveProject(opts.db, request.params.name);
       const row = opts.db.select().from(agentSessions).where(eq22(agentSessions.projectId, project.id)).get();
       if (!row) {
         return { messages: [], modelProvider: null, modelId: null, updatedAt: null };
       }
+      const messages = parseJsonColumn(row.messages, []);
       return {
-        messages: parseJsonColumn(row.messages, []),
+        messages,
         modelProvider: row.modelProvider,
         modelId: row.modelId,
         updatedAt: row.updatedAt
@@ -15802,6 +15826,7 @@ function registerAgentRoutes(app, opts) {
   app.get(
     "/projects/:name/agent/providers",
     async (request) => {
+      requireInstanceAdministrator(request);
       resolveProject(opts.db, request.params.name);
       return buildAgentProvidersResponse(opts.sessionRegistry.getConfig());
     }
@@ -15809,6 +15834,7 @@ function registerAgentRoutes(app, opts) {
   app.delete(
     "/projects/:name/agent/transcript",
     async (request) => {
+      requireInstanceAdministrator(request);
       const project = resolveProject(opts.db, request.params.name);
       opts.sessionRegistry.reset(project.name);
       opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq22(agentSessions.projectId, project.id)).run();
@@ -15816,6 +15842,7 @@ function registerAgentRoutes(app, opts) {
     }
   );
   app.post("/projects/:name/agent/prompt", async (request, reply) => {
+    requireInstanceAdministrator(request);
     const project = resolveProject(opts.db, request.params.name);
     const body = request.body;
     const promptText = (body?.prompt ?? "").trim();
@@ -15877,6 +15904,7 @@ function registerAgentRoutes(app, opts) {
   app.get(
     "/projects/:name/agent/memory",
     async (request) => {
+      requireInstanceAdministrator(request);
       const project = resolveProject(opts.db, request.params.name);
       return { entries: listMemoryEntries(opts.db, project.id) };
     }
@@ -15884,6 +15912,7 @@ function registerAgentRoutes(app, opts) {
   app.put(
     "/projects/:name/agent/memory",
     async (request) => {
+      requireInstanceAdministrator(request);
       const project = resolveProject(opts.db, request.params.name);
       const parsed = agentMemoryUpsertRequestSchema.safeParse(request.body);
       if (!parsed.success) {
@@ -15910,6 +15939,7 @@ function registerAgentRoutes(app, opts) {
   app.delete(
     "/projects/:name/agent/memory",
     async (request) => {
+      requireInstanceAdministrator(request);
       const project = resolveProject(opts.db, request.params.name);
       const parsed = agentMemoryDeleteRequestSchema.safeParse(request.body);
       if (!parsed.success) {
@@ -17597,10 +17627,12 @@ async function createServer(opts) {
     skipProbe: true
   });
   const agentEnabled = resolveAgentEnabled(process.env, opts.config);
+  const agentProactive = resolveAgentProactiveEnabled(process.env, opts.config);
   const sessionRegistry = agentEnabled ? new SessionRegistry({
     db: opts.db,
     client: aeroClient,
-    config: opts.config
+    config: opts.config,
+    proactive: agentProactive
   }) : void 0;
   const runCoordinator = new RunCoordinator(
     opts.db,
@@ -17609,6 +17641,7 @@ async function createServer(opts) {
     (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result),
     async (ctx) => {
       if (!sessionRegistry) return;
+      if (!agentProactive) return;
       const project = opts.db.select({ name: projects.name }).from(projects).where(eq25(projects.id, ctx.projectId)).get();
       if (!project) return;
       let content;