@canonry/canonry 7.22.0 → 7.23.0

package/assets/agent-workspace/skills/canonry/references/canonry-cli.md

@@ -12,6 +12,7 @@ cnry stop                                      # stop daemon
 cnry serve                                     # foreground mode
 cnry serve --host 0.0.0.0 --port 4100
 cnry serve --embed --embed-allow-origin https://app.example.com   # read-only embed mode (#716)
+cnry dashboard reset-password                  # clear a forgotten dashboard password (edits local config.yaml)
 cnry --version
 ```
 
@@ -41,6 +42,19 @@ install's server, or restart it, to apply the saved providers. Any other
 rejected reload reports `failed` and exits nonzero; the saved config remains
 available. Bootstrap never reloads a remote server automatically.
 
+`cnry dashboard reset-password` clears a forgotten dashboard password. It edits
+`config.yaml` under `$CANONRY_CONFIG_DIR` on this machine and never calls the
+server, so run it where the server's config lives. A missing file is a
+`CONFIG_REQUIRED` error, not "nothing to reset". Restart the server afterward:
+until then it still accepts the old password. The dashboard then asks for a new
+password under the first-run rules, so stop any port forwarder first and set it
+right away. `--format json` returns
+`{ reset, configPath, restartRequired, namedAccounts, nextSteps[] }`; `reset` is
+`false` when no password was set. On an install with named accounts
+(`namedAccounts: true`) the shared password is not used, so clearing it changes
+nothing: restore an account with `cnry user delete <name>` and `cnry user
+create`. The command has no API route and no MCP tool.
+
 ### Read-only embed mode (#716)
 
 Opt-in, OFF by default. Renders the dashboard "chromeless" (no nav/topbar/settings) so it can be iframed read-only, and emits a fail-closed framing contract. With `--embed` absent, served HTML + headers are byte-for-byte unchanged.

package/dist/{chunk-6Z2LFFRT.js → chunk-3OPV5XBY.js}

@@ -20,7 +20,7 @@ import {
   saveConfig,
   saveConfigPatch,
   sentimentInstallReadiness
-} from "./chunk-NDQOCFJQ.js";
+} from "./chunk-UF7MH6TU.js";
 import {
   computeFactorAverages,
   deleteSiteCrawlGraphLayout,
@@ -3572,7 +3572,7 @@ import path8 from "path";
 import { isIP } from "net";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { setImmediate as yieldToEventLoop4 } from "timers/promises";
-import { and as and24, eq as eq29, isNotNull as isNotNull4, isNull as isNull4, lte as lte2, ne as ne3, or as or3, sql as sql11 } from "drizzle-orm";
+import { and as and24, eq as eq29, isNotNull as isNotNull4, isNull as isNull4, lte as lte2, max, ne as ne3, or as or3, sql as sql11 } from "drizzle-orm";
 
 // ../integration-typesafe/src/classifier.ts
 import { createHash } from "crypto";
@@ -8052,7 +8052,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "d61f9e21fee5d1062ab9af132047f3c6474e0dea" : void 0;
+  const embedded = true ? "8c7755db32156f7620744d4a8993c66ac41c40d8" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -10715,10 +10715,10 @@ async function executeGscSync(db, runId, projectId, opts) {
         createdAt: dailyTotalsNow
       }).run();
     }
-    const observedThrough = totalRows.map((row) => row.keys[0] ?? "").filter((date) => date !== "").reduce((max, date) => max === null || date > max ? date : max, null);
+    const observedThrough = totalRows.map((row) => row.keys[0] ?? "").filter((date) => date !== "").reduce((max2, date) => max2 === null || date > max2 ? date : max2, null);
     if (observedThrough !== null || endDate) {
       const existing = db.select().from(gscDataWatermarks).where(eq5(gscDataWatermarks.projectId, projectId)).get();
-      const nextThrough = [existing?.dataThroughDate ?? null, observedThrough].filter((d) => d !== null).reduce((max, d) => max === null || d > max ? d : max, null);
+      const nextThrough = [existing?.dataThroughDate ?? null, observedThrough].filter((d) => d !== null).reduce((max2, d) => max2 === null || d > max2 ? d : max2, null);
       if (nextThrough !== null) {
         db.insert(gscDataWatermarks).values({
           projectId,
@@ -13420,7 +13420,7 @@ function buildSeedPrompt(input) {
     `Generate EXACTLY ${QUERIES_PER_INTENT_BUCKET} queries per bucket \u2014 ${QUERIES_PER_INTENT_BUCKET * 5} total. Return ONE query per line. Plain text only \u2014 no numbering, bullets, quotes, bucket labels, or commentary.`
   ].join("\n");
 }
-function parseQueryLines(text, max) {
+function parseQueryLines(text, max2) {
   const lines = text.split("\n");
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -13434,7 +13434,7 @@ function parseQueryLines(text, max) {
     if (seen.has(key)) continue;
     seen.add(key);
     out.push(line);
-    if (out.length >= max) break;
+    if (out.length >= max2) break;
   }
   return out;
 }
@@ -17059,9 +17059,9 @@ function largestArrayKey(obj) {
 function fitsCap(text) {
   return text.length <= MAX_TOOL_RESULT_CHARS;
 }
-function largestFitting(max, fits) {
+function largestFitting(max2, fits) {
   let low = 0;
-  let high = max;
+  let high = max2;
   while (low < high) {
     const middle = Math.ceil((low + high) / 2);
     if (fits(middle)) low = middle;
@@ -17211,7 +17211,7 @@ function trimNestedArrays(full) {
   };
   const fits = () => spent <= TRUNCATION_SERIALIZE_BUDGET_CHARS && fitsCap(render2());
   const members2 = (stage) => lists.flatMap((_, index) => stagesOf[index].includes(stage) ? [index] : []);
-  const longest = (indexes) => indexes.reduce((max, index) => Math.max(max, lists[index].rows.length), 0);
+  const longest = (indexes) => indexes.reduce((max2, index) => Math.max(max2, lists[index].rows.length), 0);
   let out = render2();
   let fittedAt = -1;
   for (let stage = 0; stage < TRIM_STAGES.length && !fitsCap(out); stage++) {
@@ -17695,9 +17695,9 @@ async function readSection(fn) {
     };
   }
 }
-function clampInteger(value, fallback, min, max) {
+function clampInteger(value, fallback, min, max2) {
   if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
-  return Math.max(min, Math.min(max, Math.trunc(value)));
+  return Math.max(min, Math.min(max2, Math.trunc(value)));
 }
 function isoDateDaysAgo(days) {
   const d = new Date(Date.now() - (days - 1) * 24 * 60 * 60 * 1e3);
@@ -19776,9 +19776,9 @@ function viewerAeroDailyLimitExceeded(limit) {
 var VIEWER_AERO_KEY_PREFIX = "aero-viewer:";
 var VIEWER_AERO_PROMPT = "\n\nThis conversation is with a view-only account. You can read this project's data but cannot change anything, start or schedule sweeps, or spend on live provider reads. If asked to, say an administrator has to do it. You cannot see the operator's own Aero conversations or notes.";
 var MAX_VIEWER_MESSAGES = 40;
-function trimViewerTranscript(messages, max = MAX_VIEWER_MESSAGES) {
-  if (messages.length <= max) return messages;
-  for (let i = messages.length - max; i < messages.length; i++) {
+function trimViewerTranscript(messages, max2 = MAX_VIEWER_MESSAGES) {
+  if (messages.length <= max2) return messages;
+  for (let i = messages.length - max2; i < messages.length; i++) {
     if (messages[i].role === "user") return messages.slice(i);
   }
   const lastUser = messages.map((message) => message.role).lastIndexOf("user");
@@ -23005,6 +23005,19 @@ async function createServer(opts) {
       ne3(dashboardSessions.passwordFingerprint, currentPasswordFingerprint())
     )
   )).run();
+  if (!opts.config.dashboardPasswordHash) {
+    const lastPasswordEventAt = (action) => opts.db.select({ at: max(auditLog.createdAt) }).from(auditLog).where(and24(eq29(auditLog.entityType, "dashboard-password"), eq29(auditLog.action, action))).get()?.at ?? null;
+    const createdAt = lastPasswordEventAt("dashboard-password.created");
+    const clearedAt = lastPasswordEventAt("dashboard-password.cleared");
+    if (createdAt !== null && (clearedAt === null || clearedAt < createdAt)) {
+      writeAuditLog(opts.db, {
+        actor: "system",
+        action: "dashboard-password.cleared",
+        entityType: "dashboard-password",
+        diff: { detectedAt: "startup" }
+      });
+    }
+  }
   const createSession = (key, passwordBased = false, db = opts.db) => {
     const now = /* @__PURE__ */ new Date();
     db.delete(dashboardSessions).where(lte2(dashboardSessions.expiresAt, now.toISOString())).run();
@@ -23121,7 +23134,8 @@ async function createServer(opts) {
       const err = serverApiKeyMissing();
       return reply.status(err.statusCode).send(err.toJSON());
     }
-    opts.config.dashboardPasswordHash = hashDashboardPassword(password);
+    const passwordHash = hashDashboardPassword(password);
+    opts.config.dashboardPasswordHash = passwordHash;
     let sessionId;
     try {
       sessionId = opts.db.transaction((tx) => {
@@ -23134,7 +23148,7 @@ async function createServer(opts) {
           diff: { authorizedBy: presentedRootKey ? "root-api-key" : "local-request" }
         }));
         const created = createSession(defaultKey, true, tx);
-        saveConfigPatch(opts.config);
+        saveConfigPatch(opts.config, { setDashboardPasswordHash: passwordHash });
         return created;
       });
     } catch (err) {

package/dist/{chunk-6H2BC5EY.js → chunk-KWBFKTOA.js}

@@ -4,7 +4,7 @@ import {
   installSkills,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-NDQOCFJQ.js";
+} from "./chunk-UF7MH6TU.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-5IXQAOVK.js";

package/dist/{chunk-NDQOCFJQ.js → chunk-UF7MH6TU.js}

@@ -582,17 +582,20 @@ function saveConfig(config) {
   const yaml = stringify(merged);
   writeConfigAtomically(configPath, yaml);
 }
-function saveConfigPatch(patch) {
+function saveConfigPatch(patch, options = {}) {
   const configDir = getConfigDir();
   if (!fs.existsSync(configDir)) {
     fs.mkdirSync(configDir, { recursive: true });
   }
   const configPath = getConfigPath();
   let base = {};
+  let baseRead = false;
   if (fs.existsSync(configPath)) {
     try {
       const raw = fs.readFileSync(configPath, "utf-8");
-      base = parse(raw) ?? {};
+      const parsed = parse(raw);
+      base = parsed ?? {};
+      baseRead = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed);
     } catch {
       base = {};
     }
@@ -602,6 +605,8 @@ function saveConfigPatch(patch) {
   if (base.apiKey) merged.apiKey = base.apiKey;
   if (base.anonymousId) merged.anonymousId = base.anonymousId;
   if (base.dashboardPasswordHash) merged.dashboardPasswordHash = base.dashboardPasswordHash;
+  else if (options.setDashboardPasswordHash) merged.dashboardPasswordHash = options.setDashboardPasswordHash;
+  else if (baseRead) delete merged.dashboardPasswordHash;
   if (base.sentiment === void 0) delete merged.sentiment;
   else merged.sentiment = base.sentiment;
   if (base.providers && patch.providers) {
@@ -614,6 +619,35 @@ function saveConfigPatch(patch) {
   const yaml = stringify(merged);
   writeConfigAtomically(configPath, yaml);
 }
+function clearDashboardPassword() {
+  const configPath = getConfigPath();
+  if (!fs.existsSync(configPath)) {
+    throw new CliError({
+      code: "CONFIG_REQUIRED",
+      message: `No config found at ${configPath}. If the server uses another config directory, set CANONRY_CONFIG_DIR to it and retry.`
+    });
+  }
+  const raw = fs.readFileSync(configPath, "utf-8");
+  let parsed;
+  try {
+    parsed = parse(raw) ?? {};
+  } catch {
+    parsed = void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new CliError({
+      code: "CONFIG_INVALID",
+      message: `Invalid config at ${configPath}: it could not be read as YAML settings. Repair the file and retry.`
+    });
+  }
+  const config = parsed;
+  if (!config.dashboardPasswordHash) {
+    return { cleared: false, configPath };
+  }
+  delete config.dashboardPasswordHash;
+  writeConfigAtomically(configPath, stringify(config));
+  return { cleared: true, configPath };
+}
 function configExists() {
   return fs.existsSync(getConfigPath());
 }
@@ -10590,6 +10624,7 @@ export {
   loadConfigRaw,
   saveConfig,
   saveConfigPatch,
+  clearDashboardPassword,
   configExists,
   BUNDLED_SKILL_NAMES,
   getBundledSkillSnapshots,

package/dist/cli.js

@@ -35,12 +35,13 @@ import {
   trackCliCommandFinished,
   trackEvent,
   waitForServerRuntimeStartup
-} from "./chunk-6Z2LFFRT.js";
+} from "./chunk-3OPV5XBY.js";
 import {
   autoSyncSkills,
   formatAutoSyncNotice
-} from "./chunk-6H2BC5EY.js";
+} from "./chunk-KWBFKTOA.js";
 import {
+  clearDashboardPassword,
   configExists,
   createApiClient,
   emitInstallSummary,
@@ -57,7 +58,7 @@ import {
   saveConfigPatch,
   shouldPrintServeSkillsNudge,
   withBootstrapProviderDefaults
-} from "./chunk-NDQOCFJQ.js";
+} from "./chunk-UF7MH6TU.js";
 import {
   DEFAULT_DEMO_TRUSTED_PROXIES,
   trustedProxiesProblem,
@@ -82,6 +83,7 @@ import {
   CLOUDFLARE_WRANGLER_GENERATED_MARKER,
   DEFAULT_BOT_LIST,
   aiUserFetchEventsHourly,
+  anyUsersExist,
   apiKeys,
   auditLog,
   backfillProjectAnswerMentions,
@@ -3015,6 +3017,80 @@ var CDP_CLI_COMMANDS = [
   }
 ];
 
+// src/commands/dashboard.ts
+import fs2 from "fs";
+function namedAccountsInUse() {
+  const database = loadConfigRaw()?.database;
+  if (typeof database !== "string" || !fs2.existsSync(database)) return false;
+  try {
+    const db = createClient(database);
+    try {
+      return anyUsersExist(db);
+    } finally {
+      db.$client.close();
+    }
+  } catch {
+    return false;
+  }
+}
+function nextStepsFor(cleared, namedAccounts) {
+  if (namedAccounts) {
+    return [
+      "This install signs in with named accounts, so the shared dashboard password is not used and clearing it does not change who can sign in.",
+      'To restore an account, run "canonry user list", then "canonry user delete <name>" and "canonry user create".'
+    ];
+  }
+  if (!cleared) {
+    return ["If the dashboard still asks for a password, restart the server: it keeps the password it started with."];
+  }
+  return [
+    "Restart the server to apply the reset. Until then it still accepts the old password.",
+    // First-run setup on a loopback bind takes the password from any process
+    // that can open a loopback connection (docs/deployment.md).
+    "Then open the dashboard and create the new password right away. Until one is set, a server that listens only on this machine accepts it from any local connection, so stop any port forwarder (ssh -R, ngrok tcp, tailscale serve --tcp) first."
+  ];
+}
+async function resetDashboardPassword(opts) {
+  const { cleared, configPath } = clearDashboardPassword();
+  const namedAccounts = namedAccountsInUse();
+  const nextSteps = nextStepsFor(cleared, namedAccounts);
+  if (isMachineFormat(opts.format)) {
+    console.log(JSON.stringify({
+      reset: cleared,
+      configPath,
+      restartRequired: cleared && !namedAccounts,
+      namedAccounts,
+      nextSteps
+    }, null, 2));
+    return;
+  }
+  console.log(cleared ? `Dashboard password cleared from ${configPath}.` : `No dashboard password is set in ${configPath}; nothing to reset.`);
+  for (const step of nextSteps) console.log(step);
+}
+
+// src/cli-commands/dashboard.ts
+var DASHBOARD_CLI_COMMANDS = [
+  {
+    path: ["dashboard", "reset-password"],
+    usage: "canonry dashboard reset-password [--format json]",
+    help: "Clears the dashboard password from config.yaml, so the dashboard asks for a new one after a restart.\nLocal only: it edits the config file under CANONRY_CONFIG_DIR and does not call the server.",
+    run: async (input) => {
+      await resetDashboardPassword({ format: input.format });
+    }
+  },
+  {
+    path: ["dashboard"],
+    usage: "canonry dashboard <reset-password>",
+    run: async (input) => {
+      unknownSubcommand(input.positionals[0], {
+        command: "dashboard",
+        usage: "canonry dashboard <reset-password>",
+        available: ["reset-password"]
+      });
+    }
+  }
+];
+
 // src/commands/discover.ts
 var TERMINAL_DISCOVERY_STATUSES = /* @__PURE__ */ new Set([
   "completed",
@@ -3360,7 +3436,7 @@ async function pollSession(client, project2, sessionId, quiet = false) {
 }
 
 // src/commands/discover-eval.ts
-import fs2 from "fs";
+import fs3 from "fs";
 import path from "path";
 
 // src/discovery-eval.ts
@@ -3589,7 +3665,7 @@ async function discoverEvalWithClient(client, opts) {
   const baselinePath = path.resolve(opts.baseline ?? DEFAULT_BASELINE_PATH);
   if (opts.updateBaseline) {
     const baseline2 = { capturedAt: (/* @__PURE__ */ new Date()).toISOString(), scorecards };
-    fs2.writeFileSync(baselinePath, JSON.stringify(baseline2, null, 2) + "\n");
+    fs3.writeFileSync(baselinePath, JSON.stringify(baseline2, null, 2) + "\n");
     if (opts.format === "json" || opts.format === "jsonl") {
       console.log(JSON.stringify({ scorecards, baselineWritten: baselinePath }, null, 2));
     } else {
@@ -3598,14 +3674,14 @@ async function discoverEvalWithClient(client, opts) {
     }
     return;
   }
-  if (!fs2.existsSync(baselinePath)) {
+  if (!fs3.existsSync(baselinePath)) {
     throw new CliError({
       code: "EVAL_NO_BASELINE",
       message: `no baseline at ${baselinePath}; run with --update-baseline to capture one`,
       exitCode: EXIT_USER_ERROR
     });
   }
-  const baseline = JSON.parse(fs2.readFileSync(baselinePath, "utf8"));
+  const baseline = JSON.parse(fs3.readFileSync(baselinePath, "utf8"));
   const verdict = compareToBaseline(scorecards, baseline);
   if (opts.format === "json" || opts.format === "jsonl") {
     console.log(JSON.stringify({ scorecards, verdict, baseline: { capturedAt: baseline.capturedAt } }, null, 2));
@@ -4437,7 +4513,7 @@ var DOCTOR_CLI_COMMANDS = [
 ];
 
 // src/commands/ads.ts
-import fs3 from "fs";
+import fs4 from "fs";
 function getClient6() {
   return createApiClient();
 }
@@ -4450,7 +4526,7 @@ function readRequest(inputPath, schema) {
     });
   }
   try {
-    const raw = fs3.readFileSync(inputPath === "-" ? 0 : inputPath, "utf8");
+    const raw = fs4.readFileSync(inputPath === "-" ? 0 : inputPath, "utf8");
     return schema.parse(JSON.parse(raw));
   } catch (err) {
     if (err instanceof CliError) throw err;
@@ -5326,9 +5402,9 @@ async function gaConnect(project2, opts) {
     propertyId: opts.propertyId
   };
   if (opts.keyFile) {
-    const fs19 = await import("fs");
+    const fs20 = await import("fs");
     try {
-      const content = fs19.readFileSync(opts.keyFile, "utf-8");
+      const content = fs20.readFileSync(opts.keyFile, "utf-8");
       JSON.parse(content);
       body.keyJson = content;
     } catch (e) {
@@ -6916,7 +6992,7 @@ var GBP_CLI_COMMANDS = [
 ];
 
 // src/commands/google-marketing.ts
-import fs4 from "fs";
+import fs5 from "fs";
 function printMachine(value, format) {
   if (!isMachineFormat(format)) return false;
   console.log(JSON.stringify(value, null, 2));
@@ -6957,7 +7033,7 @@ function readConversionTrackingContractInput(inputPath) {
     });
   }
   try {
-    const raw = fs4.readFileSync(inputPath === "-" ? 0 : inputPath, "utf8");
+    const raw = fs5.readFileSync(inputPath === "-" ? 0 : inputPath, "utf8");
     return conversionTrackingContractWriteRequestSchema.parse(JSON.parse(raw));
   } catch (err) {
     const message = describeError(err);
@@ -7671,12 +7747,12 @@ var GET_CLI_COMMANDS = [
 ];
 
 // src/commands/traffic.ts
-import fs6 from "fs";
+import fs7 from "fs";
 
 // src/cloudflare-worker-deploy.ts
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import fs5 from "fs";
+import fs6 from "fs";
 import os from "os";
 import path2 from "path";
 import { stripVTControlCharacters } from "util";
@@ -7694,7 +7770,7 @@ function projectSlug(project2) {
 }
 function lstatIfPresent(filePath) {
   try {
-    return fs5.lstatSync(filePath);
+    return fs6.lstatSync(filePath);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -7712,7 +7788,7 @@ function prepareCloudflareWorkerOutputDirectory(outputDirectory) {
       throw new Error(`output directory is not a regular directory: ${resolved}`);
     }
   } else {
-    fs5.mkdirSync(resolved, { recursive: true, mode: 448 });
+    fs6.mkdirSync(resolved, { recursive: true, mode: 448 });
   }
   const artifacts = {
     outputDirectory: resolved,
@@ -7725,7 +7801,7 @@ function prepareCloudflareWorkerOutputDirectory(outputDirectory) {
     if (!stat.isFile() || stat.isSymbolicLink()) {
       throw new Error(`artifact path is not a regular file: ${artifactPath}`);
     }
-    const contents = fs5.readFileSync(artifactPath, "utf-8");
+    const contents = fs6.readFileSync(artifactPath, "utf-8");
     if (!isRecognizablyCanonryGenerated(artifactPath, contents)) {
       throw new Error(`refusing to overwrite an operator-owned artifact: ${artifactPath}`);
     }
@@ -7738,7 +7814,7 @@ function readRegularArtifact(filePath) {
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`artifact path is not a regular file: ${filePath}`);
   }
-  return fs5.readFileSync(filePath, "utf-8");
+  return fs6.readFileSync(filePath, "utf-8");
 }
 function isRecognizablyCanonryGenerated(filePath, contents) {
   if (path2.basename(filePath) === "worker.js") {
@@ -7755,22 +7831,22 @@ function writePrivateTemporaryFile(filePath, contents) {
     path2.dirname(filePath),
     `.${path2.basename(filePath)}.${randomUUID()}.tmp`
   );
-  const fd = fs5.openSync(temporaryPath, "wx", 384);
+  const fd = fs6.openSync(temporaryPath, "wx", 384);
   let closed = false;
   try {
-    fs5.writeFileSync(fd, contents, "utf-8");
-    fs5.fsyncSync(fd);
-    fs5.closeSync(fd);
+    fs6.writeFileSync(fd, contents, "utf-8");
+    fs6.fsyncSync(fd);
+    fs6.closeSync(fd);
     closed = true;
   } catch (error) {
     if (!closed) {
       try {
-        fs5.closeSync(fd);
+        fs6.closeSync(fd);
       } catch {
       }
     }
     try {
-      fs5.unlinkSync(temporaryPath);
+      fs6.unlinkSync(temporaryPath);
     } catch {
     }
     throw error;
@@ -7804,10 +7880,10 @@ function writeCloudflareWorkerArtifacts(artifacts, contents) {
         throw new Error(`artifact changed during update: ${change.filePath}`);
       }
       if (change.previous === null) {
-        fs5.linkSync(change.temporaryPath, change.filePath);
-        fs5.unlinkSync(change.temporaryPath);
+        fs6.linkSync(change.temporaryPath, change.filePath);
+        fs6.unlinkSync(change.temporaryPath);
       } else {
-        fs5.renameSync(change.temporaryPath, change.filePath);
+        fs6.renameSync(change.temporaryPath, change.filePath);
       }
       applied.push(change);
     }
@@ -7816,10 +7892,10 @@ function writeCloudflareWorkerArtifacts(artifacts, contents) {
       try {
         if (readRegularArtifact(change.filePath) !== change.contents) continue;
         if (change.previous === null) {
-          fs5.unlinkSync(change.filePath);
+          fs6.unlinkSync(change.filePath);
         } else {
           const restorePath = writePrivateTemporaryFile(change.filePath, change.previous);
-          fs5.renameSync(restorePath, change.filePath);
+          fs6.renameSync(restorePath, change.filePath);
         }
       } catch {
       }
@@ -7828,7 +7904,7 @@ function writeCloudflareWorkerArtifacts(artifacts, contents) {
   } finally {
     for (const change of pending) {
       try {
-        if (fs5.existsSync(change.temporaryPath)) fs5.unlinkSync(change.temporaryPath);
+        if (fs6.existsSync(change.temporaryPath)) fs6.unlinkSync(change.temporaryPath);
       } catch {
       }
     }
@@ -7914,7 +7990,7 @@ async function preflightCloudflareWrangler(opts = {}) {
   if (missing.length > 0) {
     throw new Error(`Wrangler deploy does not support required flags: ${missing.join(", ")}`);
   }
-  const tempDirectory = fs5.mkdtempSync(path2.join(
+  const tempDirectory = fs6.mkdtempSync(path2.join(
     opts.tempRoot ?? os.tmpdir(),
     "canonry-cloudflare-wrangler-preflight-"
   ));
@@ -7922,13 +7998,13 @@ async function preflightCloudflareWrangler(opts = {}) {
   const wranglerTomlPath = path2.join(tempDirectory, "wrangler.toml");
   const secretsPath = path2.join(tempDirectory, "secrets.json");
   try {
-    fs5.chmodSync(tempDirectory, 448);
-    fs5.writeFileSync(workerScriptPath, generateWorkerScript({
+    fs6.chmodSync(tempDirectory, 448);
+    fs6.writeFileSync(workerScriptPath, generateWorkerScript({
       deliveryMode,
       workerVersion: "preflight",
       botList: DEFAULT_BOT_LIST
     }), { encoding: "utf-8", flag: "wx", mode: 384 });
-    fs5.writeFileSync(wranglerTomlPath, generateWranglerToml(
+    fs6.writeFileSync(wranglerTomlPath, generateWranglerToml(
       deliveryMode === "queue-pull" ? {
         deliveryMode,
         sourceId: "preflight",
@@ -7944,7 +8020,7 @@ async function preflightCloudflareWrangler(opts = {}) {
       }
     ), { encoding: "utf-8", flag: "wx", mode: 384 });
     if (deliveryMode === "direct-push") {
-      fs5.writeFileSync(secretsPath, JSON.stringify({
+      fs6.writeFileSync(secretsPath, JSON.stringify({
         [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: "preflight-bearer",
         [CLOUDFLARE_WORKER_BINDINGS.hmacSecret]: "preflight-hmac"
       }), { encoding: "utf-8", flag: "wx", mode: 384 });
@@ -7972,7 +8048,7 @@ ${wranglerDiagnostic(validationOutput)}`
       );
     }
   } finally {
-    fs5.rmSync(tempDirectory, { recursive: true, force: true });
+    fs6.rmSync(tempDirectory, { recursive: true, force: true });
   }
 }
 async function deployCloudflareWorker(opts) {
@@ -7988,11 +8064,11 @@ async function deployCloudflareWorker(opts) {
   }
   if (!opts.secrets) throw new Error("Direct-push Worker deploy requires bearer and HMAC secrets");
   const secrets = opts.secrets;
-  const tempDirectory = fs5.mkdtempSync(path2.join(opts.tempRoot ?? os.tmpdir(), "canonry-cloudflare-secrets-"));
+  const tempDirectory = fs6.mkdtempSync(path2.join(opts.tempRoot ?? os.tmpdir(), "canonry-cloudflare-secrets-"));
   const secretsPath = path2.join(tempDirectory, "secrets.json");
   try {
-    fs5.chmodSync(tempDirectory, 448);
-    fs5.writeFileSync(
+    fs6.chmodSync(tempDirectory, 448);
+    fs6.writeFileSync(
       secretsPath,
       JSON.stringify({
         [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: secrets.bearerToken,
@@ -8000,7 +8076,7 @@ async function deployCloudflareWorker(opts) {
       }),
       { encoding: "utf-8", flag: "wx", mode: 384 }
     );
-    fs5.chmodSync(secretsPath, 384);
+    fs6.chmodSync(secretsPath, 384);
     const runner = opts.run ?? runWrangler;
     await runner(
       "wrangler",
@@ -8016,9 +8092,9 @@ async function deployCloudflareWorker(opts) {
     );
   } finally {
     try {
-      if (fs5.existsSync(secretsPath)) fs5.unlinkSync(secretsPath);
+      if (fs6.existsSync(secretsPath)) fs6.unlinkSync(secretsPath);
     } finally {
-      fs5.rmSync(tempDirectory, { recursive: true, force: true });
+      fs6.rmSync(tempDirectory, { recursive: true, force: true });
     }
   }
 }
@@ -8048,11 +8124,11 @@ function requireCloudflareQueueOption(project2, value, option) {
 }
 function readCloudflareQueueApiToken(project2, tokenFile) {
   try {
-    const stat = fs6.lstatSync(tokenFile);
+    const stat = fs7.lstatSync(tokenFile);
     if (!stat.isFile() || stat.isSymbolicLink()) {
       throw new Error("not a regular file");
     }
-    const apiToken = fs6.readFileSync(tokenFile, "utf-8").trim();
+    const apiToken = fs7.readFileSync(tokenFile, "utf-8").trim();
     if (!apiToken) throw new Error("file is empty");
     return apiToken;
   } catch (error) {
@@ -8334,9 +8410,9 @@ async function trafficConnectWordpress(project2, opts) {
   }
   let applicationPassword = opts.appPassword?.trim() ?? "";
   if (!applicationPassword && opts.appPasswordFile) {
-    const fs19 = await import("fs");
+    const fs20 = await import("fs");
     try {
-      applicationPassword = fs19.readFileSync(opts.appPasswordFile, "utf-8").trim();
+      applicationPassword = fs20.readFileSync(opts.appPasswordFile, "utf-8").trim();
     } catch (e) {
       const msg = describeError(e);
       throw new CliError({
@@ -8392,10 +8468,10 @@ async function trafficConnectCloudRun(project2, opts) {
       details: { project: project2 }
     });
   }
-  const fs19 = await import("fs");
+  const fs20 = await import("fs");
   let keyJson;
   try {
-    keyJson = fs19.readFileSync(opts.serviceAccountKey, "utf-8");
+    keyJson = fs20.readFileSync(opts.serviceAccountKey, "utf-8");
     JSON.parse(keyJson);
   } catch (e) {
     const msg = describeError(e);
@@ -8455,9 +8531,9 @@ async function trafficConnectVercel(project2, opts) {
   }
   let token = opts.token?.trim() ?? "";
   if (!token && opts.tokenFile) {
-    const fs19 = await import("fs");
+    const fs20 = await import("fs");
     try {
-      token = fs19.readFileSync(opts.tokenFile, "utf-8").trim();
+      token = fs20.readFileSync(opts.tokenFile, "utf-8").trim();
     } catch (e) {
       const msg = describeError(e);
       throw new CliError({
@@ -11504,7 +11580,7 @@ var USERS_CLI_COMMANDS = [
 ];
 
 // src/commands/keyword.ts
-import fs7 from "fs";
+import fs8 from "fs";
 function getClient14() {
   return createApiClient();
 }
@@ -11572,7 +11648,7 @@ async function listKeywords(project2, format) {
   }
 }
 async function importKeywords(project2, filePath, format) {
-  if (!fs7.existsSync(filePath)) {
+  if (!fs8.existsSync(filePath)) {
     throw new CliError({
       code: "KEYWORD_IMPORT_FILE_NOT_FOUND",
       message: `File not found: ${filePath}`,
@@ -11583,7 +11659,7 @@ async function importKeywords(project2, filePath, format) {
       }
     });
   }
-  const content = fs7.readFileSync(filePath, "utf-8");
+  const content = fs8.readFileSync(filePath, "utf-8");
   const keywords = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   if (keywords.length === 0) {
     if (isMachineFormat(format)) {
@@ -11784,7 +11860,7 @@ var KEYWORD_CLI_COMMANDS = [
 ];
 
 // src/commands/query.ts
-import fs8 from "fs";
+import fs9 from "fs";
 function getClient15() {
   return createApiClient();
 }
@@ -11875,7 +11951,7 @@ async function listQueries(project2, format) {
   }
 }
 async function importQueries(project2, filePath, format) {
-  if (!fs8.existsSync(filePath)) {
+  if (!fs9.existsSync(filePath)) {
     throw new CliError({
       code: "QUERY_IMPORT_FILE_NOT_FOUND",
       message: `File not found: ${filePath}`,
@@ -11886,7 +11962,7 @@ async function importQueries(project2, filePath, format) {
       }
     });
   }
-  const content = fs8.readFileSync(filePath, "utf-8");
+  const content = fs9.readFileSync(filePath, "utf-8");
   const queries2 = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   if (queries2.length === 0) {
     if (isMachineFormat(format)) {
@@ -11950,16 +12026,16 @@ Saved ${result.queries.length} ${result.queries.length === 1 ? "query" : "querie
 
 // src/commands/measurement-plan.ts
 import crypto from "crypto";
-import fs9 from "fs";
+import fs10 from "fs";
 import { parse as parse2 } from "yaml";
 import { z as z2 } from "zod";
 function readPlan(source) {
-  const content = source === "-" ? fs9.readFileSync(0, "utf8") : fs9.readFileSync(source, "utf8");
+  const content = source === "-" ? fs10.readFileSync(0, "utf8") : fs10.readFileSync(source, "utf8");
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse2(content);
   return measurementPlanInputSchema.parse(parsed);
 }
 function readDiscoveryRule(source) {
-  const content = source === "-" ? fs9.readFileSync(0, "utf8") : fs9.readFileSync(source, "utf8");
+  const content = source === "-" ? fs10.readFileSync(0, "utf8") : fs10.readFileSync(source, "utf8");
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse2(content);
   return measurementDiscoveryRuleSchema.parse(parsed);
 }
@@ -12012,7 +12088,7 @@ var advancedDeactivateInputSchema = z2.object({
 }).strict();
 function readAdvancedMeasurementInput(source) {
   if (source === void 0) return {};
-  const content = source === "-" ? fs9.readFileSync(0, "utf8") : fs9.readFileSync(source, "utf8");
+  const content = source === "-" ? fs10.readFileSync(0, "utf8") : fs10.readFileSync(source, "utf8");
   return JSON.parse(content);
 }
 var advancedMeasurementCollectionKeys = {
@@ -12211,7 +12287,7 @@ async function replaceMeasurementPlanAssignments(project2, opts) {
   console.log(JSON.stringify({ preview, result }, null, 2));
 }
 function readGroupMembershipCsv(source) {
-  return source === "-" ? fs9.readFileSync(0, "utf8") : fs9.readFileSync(source, "utf8");
+  return source === "-" ? fs10.readFileSync(0, "utf8") : fs10.readFileSync(source, "utf8");
 }
 async function previewMeasurementPlanGroups(project2, source) {
   const preview = await createApiClient().previewMeasurementDraftGroupMembership(project2, {
@@ -12562,7 +12638,7 @@ var QUERY_CLI_COMMANDS = [
 ];
 
 // src/commands/mcp.ts
-import fs10 from "fs";
+import fs11 from "fs";
 import path4 from "path";
 import { createRequire } from "module";
 
@@ -12678,8 +12754,8 @@ function renderClientSnippet(client, serverName, entry) {
   return renderJsonSnippet(serverName, entry, client.format);
 }
 function readJsonConfig(configPath) {
-  if (!fs10.existsSync(configPath)) return {};
-  const raw = fs10.readFileSync(configPath, "utf-8").trim();
+  if (!fs11.existsSync(configPath)) return {};
+  const raw = fs11.readFileSync(configPath, "utf-8").trim();
   if (!raw) return {};
   try {
     const parsed = JSON.parse(raw);
@@ -12697,14 +12773,14 @@ function readJsonConfig(configPath) {
   }
 }
 function writeJsonConfig(configPath, value) {
-  fs10.mkdirSync(path4.dirname(configPath), { recursive: true });
-  fs10.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}
+  fs11.mkdirSync(path4.dirname(configPath), { recursive: true });
+  fs11.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}
 `, "utf-8");
 }
 function backupConfigIfPresent(configPath) {
-  if (!fs10.existsSync(configPath)) return void 0;
+  if (!fs11.existsSync(configPath)) return void 0;
   const backupPath = `${configPath}.canonry.bak`;
-  fs10.copyFileSync(configPath, backupPath);
+  fs11.copyFileSync(configPath, backupPath);
   return backupPath;
 }
 function findClientOrThrow(id) {
@@ -13067,13 +13143,13 @@ var NOTIFY_CLI_COMMANDS = [
 ];
 
 // src/commands/apply.ts
-import fs11 from "fs";
+import fs12 from "fs";
 import { parseAllDocuments } from "yaml";
 async function applyConfigFile(filePath) {
-  if (!fs11.existsSync(filePath)) {
+  if (!fs12.existsSync(filePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
-  const content = fs11.readFileSync(filePath, "utf-8");
+  const content = fs12.readFileSync(filePath, "utf-8");
   const docs = parseAllDocuments(content);
   const client = createApiClient();
   const errors = [];
@@ -13539,7 +13615,7 @@ async function loadLatestRunForExport(client, project2) {
 }
 
 // src/commands/results-export.ts
-import fs12 from "fs";
+import fs13 from "fs";
 import path5 from "path";
 async function exportResults(project2, opts) {
   const { output, ...request } = opts;
@@ -13549,8 +13625,8 @@ async function exportResults(project2, opts) {
     return;
   }
   const target = output ? path5.resolve(output) : path5.resolve(process.cwd(), path5.basename(artifact.filename));
-  fs12.mkdirSync(path5.dirname(target), { recursive: true });
-  fs12.writeFileSync(target, artifact.content, "utf8");
+  fs13.mkdirSync(path5.dirname(target), { recursive: true });
+  fs13.writeFileSync(target, artifact.content, "utf8");
   console.log(`Results export written to ${target}`);
 }
 
@@ -15852,11 +15928,11 @@ var SKILLS_CLI_COMMANDS = [
 ];
 
 // src/commands/snapshot.ts
-import fs14 from "fs";
+import fs15 from "fs";
 import path7 from "path";
 
 // src/snapshot-pdf.ts
-import fs13 from "fs";
+import fs14 from "fs";
 import path6 from "path";
 import { PDFDocument, StandardFonts, rgb } from "pdf-lib";
 var PAGE_WIDTH = 612;
@@ -16070,8 +16146,8 @@ async function writeSnapshotPdf(report, outputPath) {
   renderQueries(pdf, report);
   const bytes = await doc.save();
   const resolvedPath = path6.resolve(outputPath);
-  fs13.mkdirSync(path6.dirname(resolvedPath), { recursive: true });
-  fs13.writeFileSync(resolvedPath, bytes);
+  fs14.mkdirSync(path6.dirname(resolvedPath), { recursive: true });
+  fs14.writeFileSync(resolvedPath, bytes);
   return resolvedPath;
 }
 function renderCover(pdf, report) {
@@ -16232,8 +16308,8 @@ PDF saved: ${savedPdfPath}`);
 }
 function writeSnapshotMarkdown(report, outputPath) {
   const resolvedPath = path7.resolve(outputPath);
-  fs14.mkdirSync(path7.dirname(resolvedPath), { recursive: true });
-  fs14.writeFileSync(resolvedPath, formatSnapshotMarkdown(report), "utf-8");
+  fs15.mkdirSync(path7.dirname(resolvedPath), { recursive: true });
+  fs15.writeFileSync(resolvedPath, formatSnapshotMarkdown(report), "utf-8");
   return resolvedPath;
 }
 function formatSnapshotMarkdown(report) {
@@ -17569,7 +17645,7 @@ async function bootstrapCommand(opts) {
 
 // src/commands/daemon.ts
 import { spawn as spawn2 } from "child_process";
-import fs15 from "fs";
+import fs16 from "fs";
 import path9 from "path";
 
 // src/operator-url.ts
@@ -17640,8 +17716,8 @@ function buildServeForwardArgs(opts) {
 async function startDaemon(opts) {
   const pidPath = getPidPath();
   const format = opts.format ?? "text";
-  if (fs15.existsSync(pidPath)) {
-    const existingPid = parseInt(fs15.readFileSync(pidPath, "utf-8").trim(), 10);
+  if (fs16.existsSync(pidPath)) {
+    const existingPid = parseInt(fs16.readFileSync(pidPath, "utf-8").trim(), 10);
     if (!isNaN(existingPid) && isProcessAlive(existingPid)) {
       throw new CliError({
         code: "DAEMON_ALREADY_RUNNING",
@@ -17652,7 +17728,7 @@ async function startDaemon(opts) {
         }
       });
     }
-    fs15.unlinkSync(pidPath);
+    fs16.unlinkSync(pidPath);
   }
   const config = loadConfig();
   const endpoint = resolveDaemonEndpoint(opts, process.env, config.port);
@@ -17675,10 +17751,10 @@ async function startDaemon(opts) {
     });
   }
   const configDir = getConfigDir();
-  if (!fs15.existsSync(configDir)) {
-    fs15.mkdirSync(configDir, { recursive: true });
+  if (!fs16.existsSync(configDir)) {
+    fs16.mkdirSync(configDir, { recursive: true });
   }
-  fs15.writeFileSync(pidPath, String(child.pid), "utf-8");
+  fs16.writeFileSync(pidPath, String(child.pid), "utf-8");
   if (!isMachineFormat(format)) {
     process.stderr.write("Waiting for server to start...");
   }
@@ -17689,7 +17765,7 @@ async function startDaemon(opts) {
     } catch {
     }
     try {
-      fs15.unlinkSync(pidPath);
+      fs16.unlinkSync(pidPath);
     } catch {
     }
     throw new CliError({
@@ -17721,7 +17797,7 @@ async function startDaemon(opts) {
 }
 function stopDaemon(format = "text") {
   const pidPath = getPidPath();
-  if (!fs15.existsSync(pidPath)) {
+  if (!fs16.existsSync(pidPath)) {
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
         stopped: false,
@@ -17732,7 +17808,7 @@ function stopDaemon(format = "text") {
     console.log("Canonry is not running (no PID file found)");
     return;
   }
-  const pid = parseInt(fs15.readFileSync(pidPath, "utf-8").trim(), 10);
+  const pid = parseInt(fs16.readFileSync(pidPath, "utf-8").trim(), 10);
   if (isNaN(pid)) {
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
@@ -17743,7 +17819,7 @@ function stopDaemon(format = "text") {
     } else {
       console.error("Invalid PID file. Removing it.");
     }
-    fs15.unlinkSync(pidPath);
+    fs16.unlinkSync(pidPath);
     return;
   }
   if (!isProcessAlive(pid)) {
@@ -17757,12 +17833,12 @@ function stopDaemon(format = "text") {
     } else {
       console.log(`Canonry is not running (stale PID: ${pid}). Cleaning up.`);
     }
-    fs15.unlinkSync(pidPath);
+    fs16.unlinkSync(pidPath);
     return;
   }
   try {
     process.kill(pid, "SIGTERM");
-    fs15.unlinkSync(pidPath);
+    fs16.unlinkSync(pidPath);
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
         stopped: true,
@@ -17786,7 +17862,7 @@ function stopDaemon(format = "text") {
 
 // src/commands/init.ts
 import crypto3 from "crypto";
-import fs16 from "fs";
+import fs17 from "fs";
 import readline2 from "readline";
 import path10 from "path";
 var pendingServeHandoff = false;
@@ -17824,7 +17900,7 @@ var PROJECT_MARKERS = [".git", "canonry.yaml", "canonry.yml", "package.json"];
 function cwdLooksLikeProject(dir) {
   const home = process.env.HOME ?? "";
   if (home && path10.resolve(dir) === path10.resolve(home)) return false;
-  return PROJECT_MARKERS.some((marker) => fs16.existsSync(path10.join(dir, marker)));
+  return PROJECT_MARKERS.some((marker) => fs17.existsSync(path10.join(dir, marker)));
 }
 var DEFAULT_AGENT_MODELS = {
   anthropic: "anthropic/claude-sonnet-4-6",
@@ -17855,8 +17931,8 @@ async function initCommand(opts) {
     return void 0;
   }
   const configDir = getConfigDir();
-  if (!fs16.existsSync(configDir)) {
-    fs16.mkdirSync(configDir, { recursive: true });
+  if (!fs17.existsSync(configDir)) {
+    fs17.mkdirSync(configDir, { recursive: true });
   }
   const bootstrapEnv = getBootstrapEnv(process.env, {
     GEMINI_API_KEY: opts?.geminiKey,
@@ -18208,7 +18284,7 @@ async function repairPathsOnce(db, name, repair) {
 }
 
 // src/agent-plugin.ts
-import fs17 from "fs";
+import fs18 from "fs";
 import path11 from "path";
 var CANONRY_PLUGIN_ID = "canonry@canonry";
 var REQUIRED_SKILLS = ["canonry", "aero"];
@@ -18253,7 +18329,7 @@ function isCanonryPluginId(value) {
 }
 function readJson(filePath) {
   try {
-    return JSON.parse(fs17.readFileSync(filePath, "utf8"));
+    return JSON.parse(fs18.readFileSync(filePath, "utf8"));
   } catch {
     return null;
   }
@@ -18272,7 +18348,7 @@ function readCodexPluginConfigured(filePath) {
   try {
     let currentPlugin = null;
     let inPluginsTable = false;
-    for (const line of fs17.readFileSync(filePath, "utf8").split(/\r?\n/)) {
+    for (const line of fs18.readFileSync(filePath, "utf8").split(/\r?\n/)) {
       const section = /^\s*\[plugins\.(?:"([^"]+)"|'([^']+)'|(\S+))\]\s*(?:#.*)?$/.exec(line);
       if (section) {
         const captures = section.slice(1, 4);
@@ -18305,7 +18381,7 @@ function readCodexPluginConfigured(filePath) {
   }
 }
 function verifiedPluginVersion(root, client) {
-  if (client === "codex" && fs17.existsSync(path11.join(root, "plugin.json"))) {
+  if (client === "codex" && fs18.existsSync(path11.join(root, "plugin.json"))) {
     const manifest2 = readJson(path11.join(root, "plugin.json"));
     if (manifest2 && typeof manifest2 === "object") {
       const plugin2 = manifest2;
@@ -18319,7 +18395,7 @@ function verifiedPluginVersion(root, client) {
         if (portableMcp.$schema !== AGENT_PLUGINS_MCP_SCHEMA || portableMcp.mcpServers?.canonry?.type !== "stdio" || portableMcp.mcpServers.canonry.command !== "canonry-mcp") {
           return null;
         }
-        return REQUIRED_SKILLS.every((name) => fs17.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin2.version : null;
+        return REQUIRED_SKILLS.every((name) => fs18.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin2.version : null;
       }
       if (typeof plugin2.$schema === "string" && plugin2.$schema.startsWith("https://agent-plugins.org/schemas/")) {
         return null;
@@ -18337,7 +18413,7 @@ function verifiedPluginVersion(root, client) {
   if (!mcp || typeof mcp !== "object") return null;
   const canonryServer = mcp.mcpServers?.canonry;
   if (canonryServer?.command !== "canonry-mcp") return null;
-  return REQUIRED_SKILLS.every((name) => fs17.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin.version : null;
+  return REQUIRED_SKILLS.every((name) => fs18.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin.version : null;
 }
 function readClaudeUserInstallPaths(claudeConfigDir) {
   const parsed = readJson(path11.join(claudeConfigDir, "plugins", "installed_plugins.json"));
@@ -18354,7 +18430,7 @@ function readClaudeUserInstallPaths(claudeConfigDir) {
 }
 function listDirectories(dir) {
   try {
-    return fs17.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path11.join(dir, entry.name));
+    return fs18.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path11.join(dir, entry.name));
   } catch {
     return [];
   }
@@ -20242,7 +20318,7 @@ var VISIBILITY_STATS_CLI_COMMANDS = [
 ];
 
 // src/cli-commands/wordpress.ts
-import fs18 from "fs";
+import fs19 from "fs";
 
 // src/commands/wordpress.ts
 function getClient28() {
@@ -20481,12 +20557,12 @@ async function wordpressSetMeta(project2, body) {
   printPageDetail(result);
 }
 async function wordpressBulkSetMeta(project2, opts) {
-  const fs19 = await import("fs/promises");
+  const fs20 = await import("fs/promises");
   const path12 = await import("path");
   const filePath = path12.resolve(opts.from);
   let raw;
   try {
-    raw = await fs19.readFile(filePath, "utf8");
+    raw = await fs20.readFile(filePath, "utf8");
   } catch {
     throw new CliError({
       code: "FILE_READ_ERROR",
@@ -20583,13 +20659,13 @@ async function wordpressSetSchema(project2, body) {
   printManualAssist(`Schema update for "${body.slug}"`, result);
 }
 async function wordpressSchemaDeploy(project2, opts) {
-  const fs19 = await import("fs/promises");
+  const fs20 = await import("fs/promises");
   const path12 = await import("path");
   const yaml = await loadYamlModule();
   const filePath = path12.resolve(opts.profile);
   let raw;
   try {
-    raw = await fs19.readFile(filePath, "utf8");
+    raw = await fs20.readFile(filePath, "utf8");
   } catch {
     throw new CliError({
       code: "FILE_READ_ERROR",
@@ -20694,13 +20770,13 @@ async function wordpressOnboard(project2, opts) {
   }
   let profileData;
   if (opts.profile) {
-    const fs19 = await import("fs/promises");
+    const fs20 = await import("fs/promises");
     const path12 = await import("path");
     const yaml = await loadYamlModule();
     const filePath = path12.resolve(opts.profile);
     let raw;
     try {
-      raw = await fs19.readFile(filePath, "utf8");
+      raw = await fs20.readFile(filePath, "utf8");
     } catch {
       throw new CliError({
         code: "FILE_READ_ERROR",
@@ -20849,7 +20925,7 @@ function resolveContent(input, command, usage, options) {
   }
   if (contentFile) {
     try {
-      return fs18.readFileSync(contentFile, "utf-8");
+      return fs19.readFileSync(contentFile, "utf-8");
     } catch (error) {
       const message = describeError(error);
       throw usageError(`Error: could not read --content-file "${contentFile}": ${message}`, {
@@ -22165,6 +22241,7 @@ var REGISTERED_CLI_COMMANDS = [
   ...USERS_CLI_COMMANDS,
   ...COMPETITOR_CLI_COMMANDS,
   ...SETTINGS_CLI_COMMANDS,
+  ...DASHBOARD_CLI_COMMANDS,
   ...SKILLS_CLI_COMMANDS,
   ...SNAPSHOT_CLI_COMMANDS,
   ...RUN_CLI_COMMANDS,
@@ -22304,6 +22381,7 @@ Automation:
 
 Admin:
   settings              Show/update provider and quota settings
+  dashboard             Reset the dashboard password
   backfill              Backfill answer visibility or insights
   telemetry             Manage anonymous telemetry
   history <project>     Show audit trail

package/dist/index.js

@@ -3,10 +3,10 @@ import {
   createGoogleMarketingCredentialStore,
   createGoogleMarketingRuntime,
   createServer
-} from "./chunk-6Z2LFFRT.js";
+} from "./chunk-3OPV5XBY.js";
 import {
   loadConfig
-} from "./chunk-NDQOCFJQ.js";
+} from "./chunk-UF7MH6TU.js";
 import "./chunk-222NAFTY.js";
 import "./chunk-5IXQAOVK.js";
 import "./chunk-46JZR2IV.js";

package/dist/mcp.js

@@ -1,10 +1,10 @@
 import {
   autoSyncSkills
-} from "./chunk-6H2BC5EY.js";
+} from "./chunk-KWBFKTOA.js";
 import {
   createApiClient,
   createCanonryMcpServer
-} from "./chunk-NDQOCFJQ.js";
+} from "./chunk-UF7MH6TU.js";
 import "./chunk-5IXQAOVK.js";
 import {
   isReadOnlyKey,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonry/canonry",
-  "version": "7.22.0",
+  "version": "7.23.0",
   "type": "module",
   "description": "Self-hosted AI visibility (AEO) platform: track how ChatGPT, Claude, Gemini, and Perplexity cite your domain, join it with Search Console, GA4, server-side traffic, and paid media, and fix what you find through agent tools (CLI, REST, MCP). Local SQLite.",
   "keywords": [
@@ -85,34 +85,34 @@
     "@types/node-cron": "^3.0.11",
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
-    "@ainyc/canonry-api-client": "0.0.0",
-    "@ainyc/canonry-api-routes": "0.0.0",
     "@ainyc/canonry-web": "0.0.0",
+    "@ainyc/canonry-api-routes": "0.0.0",
+    "@ainyc/canonry-api-client": "0.0.0",
     "@ainyc/canonry-config": "0.0.0",
-    "@ainyc/canonry-db": "0.0.0",
     "@ainyc/canonry-contracts": "0.0.0",
+    "@ainyc/canonry-db": "0.0.0",
+    "@ainyc/canonry-integration-bing": "0.0.0",
     "@ainyc/canonry-integration-cloud-run": "0.0.0",
     "@ainyc/canonry-integration-cloudflare-queue": "0.0.0",
     "@ainyc/canonry-integration-commoncrawl": "0.0.0",
     "@ainyc/canonry-integration-google": "0.0.0",
     "@ainyc/canonry-integration-cloudflare-worker": "0.0.0",
-    "@ainyc/canonry-integration-bing": "0.0.0",
-    "@ainyc/canonry-integration-google-ads": "0.0.0",
-    "@ainyc/canonry-integration-google-places": "0.0.0",
-    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
     "@ainyc/canonry-integration-google-tag-manager": "0.0.0",
+    "@ainyc/canonry-integration-google-business-profile": "0.0.0",
+    "@ainyc/canonry-integration-google-places": "0.0.0",
+    "@ainyc/canonry-integration-google-ads": "0.0.0",
     "@ainyc/canonry-integration-openai-ads": "0.0.0",
     "@ainyc/canonry-integration-traffic": "0.0.0",
     "@ainyc/canonry-integration-wordpress": "0.0.0",
-    "@ainyc/canonry-intelligence": "0.0.0",
-    "@ainyc/canonry-provider-gemini": "0.0.0",
     "@ainyc/canonry-provider-cdp": "0.0.0",
     "@ainyc/canonry-provider-claude": "0.0.0",
-    "@ainyc/canonry-provider-local": "0.0.0",
+    "@ainyc/canonry-intelligence": "0.0.0",
+    "@ainyc/canonry-provider-gemini": "0.0.0",
+    "@ainyc/canonry-provider-muse": "0.0.0",
     "@ainyc/canonry-provider-openai": "0.0.0",
+    "@ainyc/canonry-integration-typesafe": "0.0.0",
     "@ainyc/canonry-provider-perplexity": "0.0.0",
-    "@ainyc/canonry-provider-muse": "0.0.0",
-    "@ainyc/canonry-integration-typesafe": "0.0.0"
+    "@ainyc/canonry-provider-local": "0.0.0"
   },
   "scripts": {
     "build": "pnpm run build:cli && pnpm run build:web",