@canonry/canonry 4.167.1 → 4.169.0

package/dist/{chunk-7M3QVRJD.js → chunk-U2X42SKN.js}

@@ -584,7 +584,7 @@ import {
   wordpressSchemaDeployResultDtoSchema,
   wordpressSchemaStatusResultDtoSchema,
   wordpressStatusDtoSchema
-} from "./chunk-TP4KXU3E.js";
+} from "./chunk-K7XXDKYY.js";
 
 // src/intelligence-service.ts
 import { eq as eq59, desc as desc26, asc as asc11, and as and47, ne as ne7, or as or13, inArray as inArray21, gte as gte14, lte as lte12 } from "drizzle-orm";
@@ -56963,7 +56963,85 @@ function readInstalledManifest(skillDir) {
     return null;
   }
 }
-var AGENT_CHECKS = [skillsInstalledCheck, skillsCurrentCheck];
+var SKILL_DESCRIPTION_MAX = 1024;
+var SKILL_DESCRIPTION_MIN = 80;
+var skillsTriggerSurfaceCheck = {
+  id: "agent.skills.trigger-surface",
+  category: CheckCategories.agent,
+  scope: CheckScopes.global,
+  title: "Agent skill trigger surface",
+  run: (ctx) => {
+    const bundled = ctx.bundledSkills;
+    if (!bundled || bundled.length === 0) {
+      return {
+        status: CheckStatuses.skipped,
+        code: "agent.skills.bundle-unavailable",
+        summary: "This deployment does not ship bundled skills, so there is no trigger surface to measure.",
+        remediation: null,
+        details: {}
+      };
+    }
+    const skills = bundled.map((skill) => {
+      const description = skill.description ?? "";
+      return {
+        name: skill.name,
+        length: description.length,
+        // The CLI binary name is the single likeliest token to appear in a
+        // request that should load the skill, and the one most easily left out
+        // because the author is thinking in product names.
+        namesCli: /\bcnry\b|\bcanonry\b/i.test(description),
+        missing: skill.description === void 0
+      };
+    });
+    const totalLength = skills.reduce((sum, s) => sum + s.length, 0);
+    const details = { skills, totalDescriptionLength: totalLength };
+    const missing = skills.filter((s) => s.missing).map((s) => s.name);
+    if (missing.length > 0) {
+      return {
+        status: CheckStatuses.fail,
+        code: "agent.skills.description-missing",
+        summary: `No description frontmatter on: ${missing.join(", ")}. Without it the skill can never be selected.`,
+        remediation: "Add a `description:` to each SKILL.md saying what the skill does and when to load it.",
+        details
+      };
+    }
+    const tooLong = skills.filter((s) => s.length > SKILL_DESCRIPTION_MAX).map((s) => s.name);
+    if (tooLong.length > 0) {
+      return {
+        status: CheckStatuses.fail,
+        code: "agent.skills.description-too-long",
+        summary: `Description over the ${SKILL_DESCRIPTION_MAX}-character limit on: ${tooLong.join(", ")}.`,
+        remediation: "Shorten it. Detail belongs in the skill body; the description is only the trigger.",
+        details
+      };
+    }
+    const tooShort = skills.filter((s) => s.length < SKILL_DESCRIPTION_MIN).map((s) => s.name);
+    const unnamed = skills.filter((s) => !s.namesCli).map((s) => s.name);
+    const weak = [.../* @__PURE__ */ new Set([...tooShort, ...unnamed])];
+    if (weak.length > 0) {
+      const reasons = [];
+      if (tooShort.length > 0) reasons.push(`under ${SKILL_DESCRIPTION_MIN} characters (${tooShort.join(", ")})`);
+      if (unnamed.length > 0) reasons.push(`never names the CLI (${unnamed.join(", ")})`);
+      return {
+        status: CheckStatuses.warn,
+        code: "agent.skills.description-weak",
+        summary: `A skill description is the whole trigger surface, and one is ${reasons.join("; ")}.`,
+        remediation: "Name the commands and phrases an operator actually types, `cnry` included, and say when to load the skill.",
+        details
+      };
+    }
+    return {
+      status: CheckStatuses.ok,
+      code: "agent.skills.trigger-surface-ok",
+      // Deliberately not "the skill will load": nothing forces a model to load
+      // one. This measures the surface, never the outcome.
+      summary: `${skills.length} skill descriptions look loadable (${totalLength} chars total). This measures the trigger surface, not whether an agent actually loads it.`,
+      remediation: null,
+      details
+    };
+  }
+};
+var AGENT_CHECKS = [skillsInstalledCheck, skillsCurrentCheck, skillsTriggerSurfaceCheck];
 
 // ../api-routes/src/doctor/checks/backlinks.ts
 import { and as and41, eq as eq49 } from "drizzle-orm";

package/dist/cli.js

@@ -14,44 +14,48 @@ import {
   coerceAgentProvider,
   createServer,
   detectAndTrackUpgrade,
-  emitInstallSummary,
   formatAuditFactorScore,
   getCloudflareTrafficConnectionBySourceId,
-  getMissingUserSkillsNudge,
   getOrCreateAnonymousId,
-  installSkills,
   isAeroToolProfile,
   isFirstRun,
   isTelemetryEnabled,
   listAgentProviders,
-  listSkills,
-  parseSkillsClient,
   setGoogleAuthConfig,
   setTelemetrySource,
   showFirstRunNotice,
   trackCliCommandFinished,
   trackEvent
-} from "./chunk-NFG2BPQP.js";
+} from "./chunk-T2UJAYTX.js";
+import {
+  autoSyncSkills,
+  formatAutoSyncNotice
+} from "./chunk-ANA3GJSC.js";
 import {
   CliError,
   EXIT_SYSTEM_ERROR,
   EXIT_USER_ERROR,
   configExists,
   createApiClient,
+  emitInstallSummary,
   getConfigDir,
   getConfigPath,
+  getMissingUserSkillsNudge,
+  installSkills,
   isEndpointMissing,
   isMachineFormat,
+  listSkills,
   loadConfig,
   loadConfigRaw,
   measurementDraftOperationSchema,
+  parseSkillsClient,
   printCliError,
   runMeasurementDraftAction,
   saveConfig,
   saveConfigPatch,
   systemError,
   usageError
-} from "./chunk-P5LR3NDQ.js";
+} from "./chunk-HVBAGSQC.js";
 import {
   CLOUDFLARE_WORKER_BINDINGS,
   CLOUDFLARE_WORKER_GENERATED_MARKER,
@@ -65,7 +69,7 @@ import {
   projects,
   queries,
   renderReportHtml
-} from "./chunk-7M3QVRJD.js";
+} from "./chunk-U2X42SKN.js";
 import {
   AdsDeliverySnapshotStatuses,
   AdsHistoricalCampaignRollupStatuses,
@@ -130,7 +134,7 @@ import {
   providerQuotaPolicySchema,
   resolveProviderInput,
   winnabilityClassSchema
-} from "./chunk-TP4KXU3E.js";
+} from "./chunk-K7XXDKYY.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -18147,6 +18151,10 @@ async function runCli(args = process.argv.slice(2)) {
   const resolvedCommand = resolveCommandIdentifier(args, REGISTERED_CLI_COMMANDS);
   const shouldTrackCommand = !isHelpRequest && command !== "telemetry" && isTelemetryEnabled();
   const shouldTrackCommandStart = shouldTrackCommand && command !== "init";
+  void autoSyncSkills().then((result) => {
+    const notice = formatAutoSyncNotice(result);
+    if (notice && process.stderr.isTTY) console.error(notice);
+  });
   if (shouldTrackCommandStart) {
     detectAndTrackUpgrade();
     const setupState = buildSetupState();

package/dist/index.d.ts

@@ -299,6 +299,25 @@ interface CanonryConfig {
     telemetry?: boolean;
     anonymousId?: string;
     lastSeenVersion?: string;
+    /**
+     * The engine version the installed skill trees were last synced against.
+     *
+     * Deliberately separate from `lastSeenVersion`, which telemetry owns. Both
+     * fields answer "have we seen this build before?", but they are consumed by
+     * different subsystems and whichever writes first silences the other:
+     * `detectAndTrackUpgrade` returns early on `lastSeenVersion === VERSION`, so
+     * when auto-sync shared that field it permanently suppressed `cli.upgraded`.
+     */
+    lastSkillsSyncedVersion?: string;
+    /**
+     * When the installed skill trees were last verified against the bundled
+     * copies. Drives the interval half of the skills auto-sync: a version bump
+     * is not the only way an installed copy goes wrong (hand-deleted files, a
+     * partial install, a `$HOME` shared across machines), so the check also runs
+     * on a timer. The comparison is local hash vs local hash, so it costs no
+     * network. See `skills-autosync.ts`.
+     */
+    lastSkillsVerifiedAt?: string;
     /** Set once when the first-activation notice has been shown; never unset. */
     activationNoticeShown?: boolean;
     updateCheck?: boolean;

package/dist/index.js

@@ -1,11 +1,11 @@
 import {
   createServer
-} from "./chunk-NFG2BPQP.js";
+} from "./chunk-T2UJAYTX.js";
 import {
   loadConfig
-} from "./chunk-P5LR3NDQ.js";
-import "./chunk-7M3QVRJD.js";
-import "./chunk-TP4KXU3E.js";
+} from "./chunk-HVBAGSQC.js";
+import "./chunk-U2X42SKN.js";
+import "./chunk-K7XXDKYY.js";
 export {
   createServer,
   loadConfig

package/dist/{intelligence-service-ULDOVV5Y.js → intelligence-service-6ZYTEFXX.js}

@@ -1,7 +1,7 @@
 import {
   IntelligenceService
-} from "./chunk-7M3QVRJD.js";
-import "./chunk-TP4KXU3E.js";
+} from "./chunk-U2X42SKN.js";
+import "./chunk-K7XXDKYY.js";
 export {
   IntelligenceService
 };

package/dist/mcp.js

@@ -1,12 +1,15 @@
+import {
+  autoSyncSkills
+} from "./chunk-ANA3GJSC.js";
 import {
   CliError,
   PACKAGE_VERSION,
   canonryMcpTools,
   createApiClient
-} from "./chunk-P5LR3NDQ.js";
+} from "./chunk-HVBAGSQC.js";
 import {
   isReadOnlyKey
-} from "./chunk-TP4KXU3E.js";
+} from "./chunk-K7XXDKYY.js";
 
 // src/mcp/cli.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -266,6 +269,22 @@ var DynamicToolCatalog = class {
 function createCanonryMcpServer(options = {}) {
   return createCanonryMcpServerWithCatalog(options).server;
 }
+var SERVER_INSTRUCTIONS = `Canonry tracks how AI answer engines mention a brand and cite a domain.
+
+Load the "canonry" skill before operator work (project setup, integrations, traffic sources, sweeps, diagnosis). It carries the procedures and the failure modes; this text is only a pointer. Use "aero" for analyst work: regression diagnosis, reporting.
+
+Two signals, never interchangeable:
+- mentioned = the brand appears in the answer TEXT the model wrote.
+- cited = the domain appears in the SOURCE links behind the answer.
+A model can do either, both or neither. Never compute one from the other, and never report a number for one under the other's name.
+
+Sweeps and probes spend provider quota and write rows. Get explicit approval before any run, apply, or other mutation.
+
+Most reads are free. Five ads reads are NOT: canonry_ads_account, canonry_ads_geo_search, canonry_ads_live_delivery, canonry_ads_conversion_pixels and canonry_ads_conversion_event_settings call the provider live and spend against the advertiser account. They are marked read, so nothing in the tool list warns you. Get approval for those exactly as for a mutation.
+
+A null answerMentioned means NOT CHECKED, not "not mentioned". Never coerce it to false.
+
+If no sweep has run, say so. Never state a mention or citation figure that no run produced.`;
 function createCanonryMcpServerWithCatalog(options = {}) {
   const clientFactory = options.clientFactory ?? createApiClient;
   const client = clientFactory();
@@ -273,6 +292,8 @@ function createCanonryMcpServerWithCatalog(options = {}) {
   const server = new McpServer({
     name: "canonry",
     version: PACKAGE_VERSION
+  }, {
+    instructions: SERVER_INSTRUCTIONS
   });
   server.validateToolInput = async (_tool, args) => args;
   const entries = [];
@@ -365,6 +386,7 @@ async function main(argv = process.argv.slice(2)) {
     }
     throw error;
   }
+  void autoSyncSkills();
   const client = createApiClient();
   const scope = await resolveEffectiveScope(client, options.scope);
   const server = createCanonryMcpServer({ scope, eager: options.eager, clientFactory: () => client });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonry/canonry",
-  "version": "4.167.1",
+  "version": "4.169.0",
   "type": "module",
   "description": "Agent-first open-source AEO operating platform - track how answer engines cite your domain",
   "license": "FSL-1.1-ALv2",
@@ -71,27 +71,29 @@
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
     "@ainyc/canonry-api-client": "0.0.0",
-    "@ainyc/canonry-api-routes": "0.0.0",
     "@ainyc/canonry-config": "0.0.0",
-    "@ainyc/canonry-contracts": "0.0.0",
     "@ainyc/canonry-db": "0.0.0",
-    "@ainyc/canonry-integration-cloudflare-queue": "0.0.0",
+    "@ainyc/canonry-contracts": "0.0.0",
+    "@ainyc/canonry-api-routes": "0.0.0",
+    "@ainyc/canonry-integration-bing": "0.0.0",
     "@ainyc/canonry-integration-cloudflare-worker": "0.0.0",
+    "@ainyc/canonry-integration-cloudflare-queue": "0.0.0",
+    "@ainyc/canonry-integration-openai-ads": "0.0.0",
     "@ainyc/canonry-integration-cloud-run": "0.0.0",
     "@ainyc/canonry-integration-commoncrawl": "0.0.0",
-    "@ainyc/canonry-integration-openai-ads": "0.0.0",
-    "@ainyc/canonry-integration-bing": "0.0.0",
+    "@ainyc/canonry-integration-google-ads": "0.0.0",
     "@ainyc/canonry-integration-google": "0.0.0",
     "@ainyc/canonry-integration-google-places": "0.0.0",
     "@ainyc/canonry-integration-traffic": "0.0.0",
-    "@ainyc/canonry-integration-wordpress": "0.0.0",
     "@ainyc/canonry-integration-google-business-profile": "0.0.0",
+    "@ainyc/canonry-integration-google-tag-manager": "0.0.0",
+    "@ainyc/canonry-integration-wordpress": "0.0.0",
     "@ainyc/canonry-intelligence": "0.0.0",
-    "@ainyc/canonry-provider-cdp": "0.0.0",
     "@ainyc/canonry-provider-claude": "0.0.0",
+    "@ainyc/canonry-provider-cdp": "0.0.0",
     "@ainyc/canonry-provider-gemini": "0.0.0",
-    "@ainyc/canonry-provider-local": "0.0.0",
     "@ainyc/canonry-provider-openai": "0.0.0",
+    "@ainyc/canonry-provider-local": "0.0.0",
     "@ainyc/canonry-provider-perplexity": "0.0.0"
   },
   "scripts": {