@canonry/canonry 7.22.0 → 7.24.0

package/dist/cli.js

@@ -14,13 +14,16 @@ import {
   getOrCreateAnonymousId,
   getPrintedUpdateAvailable,
   getTelemetryStatus,
+  installAttribution,
   isAeroToolProfile,
   isFirstRun,
   isLoopbackBindHost,
   isTelemetryEnabled,
   listAgentProviders,
   notePrintedUpdateAvailable,
+  outcomeFailure,
   readCachedUpdateAvailable,
+  recordInstallRef,
   registeredProviderNames,
   reparseStoredResult,
   reparseStoredResult2,
@@ -34,13 +37,16 @@ import {
   showFirstRunNotice,
   trackCliCommandFinished,
   trackEvent,
+  trackFeatureCompleted,
+  trackIntegrationConnection,
   waitForServerRuntimeStartup
-} from "./chunk-6Z2LFFRT.js";
+} from "./chunk-SG3MPCDL.js";
 import {
   autoSyncSkills,
   formatAutoSyncNotice
-} from "./chunk-6H2BC5EY.js";
+} from "./chunk-YCPTP2NC.js";
 import {
+  clearDashboardPassword,
   configExists,
   createApiClient,
   emitInstallSummary,
@@ -57,14 +63,16 @@ import {
   saveConfigPatch,
   shouldPrintServeSkillsNudge,
   withBootstrapProviderDefaults
-} from "./chunk-NDQOCFJQ.js";
+} from "./chunk-JJBVYL45.js";
 import {
   DEFAULT_DEMO_TRUSTED_PROXIES,
   trustedProxiesProblem,
   trustedProxyProblem
 } from "./chunk-RB2F4D3Z.js";
-import "./chunk-222NAFTY.js";
+import "./chunk-7Q7QCBJ3.js";
 import {
+  CANONRY_DISCORD_URL,
+  CANONRY_ISSUES_URL,
   CliError,
   EXIT_SYSTEM_ERROR,
   EXIT_USER_ERROR,
@@ -75,13 +83,14 @@ import {
   runMeasurementDraftAction,
   systemError,
   usageError
-} from "./chunk-5IXQAOVK.js";
+} from "./chunk-DS2ZKB3T.js";
 import {
   CLOUDFLARE_WORKER_BINDINGS,
   CLOUDFLARE_WORKER_GENERATED_MARKER,
   CLOUDFLARE_WRANGLER_GENERATED_MARKER,
   DEFAULT_BOT_LIST,
   aiUserFetchEventsHourly,
+  anyUsersExist,
   apiKeys,
   auditLog,
   backfillProjectAnswerMentions,
@@ -107,7 +116,7 @@ import {
   rawEventSamples,
   readMarketCompetitorNames,
   runs
-} from "./chunk-46JZR2IV.js";
+} from "./chunk-O5UMRQVN.js";
 import {
   AdsDeliverySnapshotStatuses,
   AdsHistoricalCampaignRollupStatuses,
@@ -126,6 +135,8 @@ import {
   GaMoverChangeBases,
   MeasurementEvidenceShapes,
   OUTSTANDING_PROVIDER_BATCH_STATUSES,
+  OutcomeReasonCodes,
+  OutcomeTriggers,
   ProviderBatchStatuses,
   ProviderNames,
   ProviderReloadErrorReasons,
@@ -164,6 +175,7 @@ import {
   buildModelChangeNotice,
   canonicalizeGtmAccountId,
   canonicalizeGtmResourceSelection,
+  classifyOutcomeError,
   competitorAutoAliasModeSchema,
   competitorLandscapeQuerySchema,
   computeCompetitorOverlap,
@@ -241,7 +253,7 @@ import {
   visibilityCompareSelectionSchema,
   visibilityReportRequestSchema,
   winnabilityClassSchema
-} from "./chunk-MRKV43TV.js";
+} from "./chunk-IM2BFAAT.js";
 
 // src/cli.ts
 import { pathToFileURL } from "url";
@@ -290,9 +302,9 @@ Usage:  ${spec.usage}
   if (spec.help) console.log(`${spec.help}
 `);
 }
-function matchesPath(args, path12) {
-  if (args.length < path12.length) return false;
-  return path12.every((segment, index) => args[index] === segment);
+function matchesPath(args, path13) {
+  if (args.length < path13.length) return false;
+  return path13.every((segment, index) => args[index] === segment);
 }
 function withGlobalOptions(options) {
   const base = options ? { ...options } : {};
@@ -787,7 +799,7 @@ function parseDemoTrustedProxies(values) {
 async function demoCommand(options) {
   const { host, port } = parseDemoListenOptions(options);
   const trustProxy = parseDemoTrustedProxies(options.trustProxy);
-  const { createDemoServer } = await import("./demo-server-32PU7BM6.js");
+  const { createDemoServer } = await import("./demo-server-C7UGXXN7.js");
   const app = await createDemoServer({ trustProxy });
   let stopping = false;
   const stop = () => {
@@ -1201,7 +1213,7 @@ No DB writes performed. Re-run without --dry-run to apply.`);
   }
 }
 async function backfillInsightsCommand(project2, opts) {
-  const { IntelligenceService } = await import("./intelligence-service-256DQBVR.js");
+  const { IntelligenceService } = await import("./intelligence-service-37TX4YV7.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -2824,6 +2836,11 @@ var BING_CLI_COMMANDS = [
   }
 ];
 
+// src/cli-connection-telemetry.ts
+function trackCliConnection(properties) {
+  trackIntegrationConnection({ ...properties, surface: "cli", agent: cliRuntimeContext().agent });
+}
+
 // src/commands/cdp.ts
 function getClient3() {
   return createApiClient();
@@ -2837,7 +2854,13 @@ async function cdpConnect(opts) {
     host,
     port
   };
-  saveConfigPatch(config);
+  try {
+    saveConfigPatch(config);
+  } catch (err) {
+    trackCliConnection({ integration: "cdp", action: "connect", status: "failed", ...outcomeFailure(err) });
+    throw err;
+  }
+  trackCliConnection({ integration: "cdp", action: "connect", status: "succeeded" });
   if (isMachineFormat(opts.format)) {
     console.log(JSON.stringify({
       host,
@@ -3015,6 +3038,80 @@ var CDP_CLI_COMMANDS = [
   }
 ];
 
+// src/commands/dashboard.ts
+import fs2 from "fs";
+function namedAccountsInUse() {
+  const database = loadConfigRaw()?.database;
+  if (typeof database !== "string" || !fs2.existsSync(database)) return false;
+  try {
+    const db = createClient(database);
+    try {
+      return anyUsersExist(db);
+    } finally {
+      db.$client.close();
+    }
+  } catch {
+    return false;
+  }
+}
+function nextStepsFor(cleared, namedAccounts) {
+  if (namedAccounts) {
+    return [
+      "This install signs in with named accounts, so the shared dashboard password is not used and clearing it does not change who can sign in.",
+      'To restore an account, run "canonry user list", then "canonry user delete <name>" and "canonry user create".'
+    ];
+  }
+  if (!cleared) {
+    return ["If the dashboard still asks for a password, restart the server: it keeps the password it started with."];
+  }
+  return [
+    "Restart the server to apply the reset. Until then it still accepts the old password.",
+    // First-run setup on a loopback bind takes the password from any process
+    // that can open a loopback connection (docs/deployment.md).
+    "Then open the dashboard and create the new password right away. Until one is set, a server that listens only on this machine accepts it from any local connection, so stop any port forwarder (ssh -R, ngrok tcp, tailscale serve --tcp) first."
+  ];
+}
+async function resetDashboardPassword(opts) {
+  const { cleared, configPath } = clearDashboardPassword();
+  const namedAccounts = namedAccountsInUse();
+  const nextSteps = nextStepsFor(cleared, namedAccounts);
+  if (isMachineFormat(opts.format)) {
+    console.log(JSON.stringify({
+      reset: cleared,
+      configPath,
+      restartRequired: cleared && !namedAccounts,
+      namedAccounts,
+      nextSteps
+    }, null, 2));
+    return;
+  }
+  console.log(cleared ? `Dashboard password cleared from ${configPath}.` : `No dashboard password is set in ${configPath}; nothing to reset.`);
+  for (const step of nextSteps) console.log(step);
+}
+
+// src/cli-commands/dashboard.ts
+var DASHBOARD_CLI_COMMANDS = [
+  {
+    path: ["dashboard", "reset-password"],
+    usage: "canonry dashboard reset-password [--format json]",
+    help: "Clears the dashboard password from config.yaml, so the dashboard asks for a new one after a restart.\nLocal only: it edits the config file under CANONRY_CONFIG_DIR and does not call the server.",
+    run: async (input) => {
+      await resetDashboardPassword({ format: input.format });
+    }
+  },
+  {
+    path: ["dashboard"],
+    usage: "canonry dashboard <reset-password>",
+    run: async (input) => {
+      unknownSubcommand(input.positionals[0], {
+        command: "dashboard",
+        usage: "canonry dashboard <reset-password>",
+        available: ["reset-password"]
+      });
+    }
+  }
+];
+
 // src/commands/discover.ts
 var TERMINAL_DISCOVERY_STATUSES = /* @__PURE__ */ new Set([
   "completed",
@@ -3360,7 +3457,7 @@ async function pollSession(client, project2, sessionId, quiet = false) {
 }
 
 // src/commands/discover-eval.ts
-import fs2 from "fs";
+import fs3 from "fs";
 import path from "path";
 
 // src/discovery-eval.ts
@@ -3589,7 +3686,7 @@ async function discoverEvalWithClient(client, opts) {
   const baselinePath = path.resolve(opts.baseline ?? DEFAULT_BASELINE_PATH);
   if (opts.updateBaseline) {
     const baseline2 = { capturedAt: (/* @__PURE__ */ new Date()).toISOString(), scorecards };
-    fs2.writeFileSync(baselinePath, JSON.stringify(baseline2, null, 2) + "\n");
+    fs3.writeFileSync(baselinePath, JSON.stringify(baseline2, null, 2) + "\n");
     if (opts.format === "json" || opts.format === "jsonl") {
       console.log(JSON.stringify({ scorecards, baselineWritten: baselinePath }, null, 2));
     } else {
@@ -3598,14 +3695,14 @@ async function discoverEvalWithClient(client, opts) {
     }
     return;
   }
-  if (!fs2.existsSync(baselinePath)) {
+  if (!fs3.existsSync(baselinePath)) {
     throw new CliError({
       code: "EVAL_NO_BASELINE",
       message: `no baseline at ${baselinePath}; run with --update-baseline to capture one`,
       exitCode: EXIT_USER_ERROR
     });
   }
-  const baseline = JSON.parse(fs2.readFileSync(baselinePath, "utf8"));
+  const baseline = JSON.parse(fs3.readFileSync(baselinePath, "utf8"));
   const verdict = compareToBaseline(scorecards, baseline);
   if (opts.format === "json" || opts.format === "jsonl") {
     console.log(JSON.stringify({ scorecards, verdict, baseline: { capturedAt: baseline.capturedAt } }, null, 2));
@@ -4437,7 +4534,7 @@ var DOCTOR_CLI_COMMANDS = [
 ];
 
 // src/commands/ads.ts
-import fs3 from "fs";
+import fs4 from "fs";
 function getClient6() {
   return createApiClient();
 }
@@ -4450,7 +4547,7 @@ function readRequest(inputPath, schema) {
     });
   }
   try {
-    const raw = fs3.readFileSync(inputPath === "-" ? 0 : inputPath, "utf8");
+    const raw = fs4.readFileSync(inputPath === "-" ? 0 : inputPath, "utf8");
     return schema.parse(JSON.parse(raw));
   } catch (err) {
     if (err instanceof CliError) throw err;
@@ -5326,9 +5423,9 @@ async function gaConnect(project2, opts) {
     propertyId: opts.propertyId
   };
   if (opts.keyFile) {
-    const fs19 = await import("fs");
+    const fs21 = await import("fs");
     try {
-      const content = fs19.readFileSync(opts.keyFile, "utf-8");
+      const content = fs21.readFileSync(opts.keyFile, "utf-8");
       JSON.parse(content);
       body.keyJson = content;
     } catch (e) {
@@ -6916,7 +7013,7 @@ var GBP_CLI_COMMANDS = [
 ];
 
 // src/commands/google-marketing.ts
-import fs4 from "fs";
+import fs5 from "fs";
 function printMachine(value, format) {
   if (!isMachineFormat(format)) return false;
   console.log(JSON.stringify(value, null, 2));
@@ -6957,7 +7054,7 @@ function readConversionTrackingContractInput(inputPath) {
     });
   }
   try {
-    const raw = fs4.readFileSync(inputPath === "-" ? 0 : inputPath, "utf8");
+    const raw = fs5.readFileSync(inputPath === "-" ? 0 : inputPath, "utf8");
     return conversionTrackingContractWriteRequestSchema.parse(JSON.parse(raw));
   } catch (err) {
     const message = describeError(err);
@@ -7609,9 +7706,9 @@ async function getCommand(opts) {
     console.log(JSON.stringify(leaf, null, 2));
   }
 }
-function walkPath(value, path12) {
-  if (!path12 || path12 === ".") return value;
-  const segments = path12.split(".").flatMap((part) => {
+function walkPath(value, path13) {
+  if (!path13 || path13 === ".") return value;
+  const segments = path13.split(".").flatMap((part) => {
     const tokens = [];
     let i = 0;
     const bracketStart = part.indexOf("[");
@@ -7659,24 +7756,24 @@ var GET_CLI_COMMANDS = [
     },
     run: async (input) => {
       const project2 = requireProject(input, "get", USAGE2);
-      const path12 = requirePositional(input, 1, {
+      const path13 = requirePositional(input, 1, {
         command: "get",
         usage: USAGE2,
         message: 'path is required (e.g. "scores.mentionShare.value")'
       });
       const from = getString(input.values, "from");
-      await getCommand({ project: project2, path: path12, from, format: input.format });
+      await getCommand({ project: project2, path: path13, from, format: input.format });
     }
   }
 ];
 
 // src/commands/traffic.ts
-import fs6 from "fs";
+import fs7 from "fs";
 
 // src/cloudflare-worker-deploy.ts
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import fs5 from "fs";
+import fs6 from "fs";
 import os from "os";
 import path2 from "path";
 import { stripVTControlCharacters } from "util";
@@ -7694,7 +7791,7 @@ function projectSlug(project2) {
 }
 function lstatIfPresent(filePath) {
   try {
-    return fs5.lstatSync(filePath);
+    return fs6.lstatSync(filePath);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -7712,7 +7809,7 @@ function prepareCloudflareWorkerOutputDirectory(outputDirectory) {
       throw new Error(`output directory is not a regular directory: ${resolved}`);
     }
   } else {
-    fs5.mkdirSync(resolved, { recursive: true, mode: 448 });
+    fs6.mkdirSync(resolved, { recursive: true, mode: 448 });
   }
   const artifacts = {
     outputDirectory: resolved,
@@ -7725,7 +7822,7 @@ function prepareCloudflareWorkerOutputDirectory(outputDirectory) {
     if (!stat.isFile() || stat.isSymbolicLink()) {
       throw new Error(`artifact path is not a regular file: ${artifactPath}`);
     }
-    const contents = fs5.readFileSync(artifactPath, "utf-8");
+    const contents = fs6.readFileSync(artifactPath, "utf-8");
     if (!isRecognizablyCanonryGenerated(artifactPath, contents)) {
       throw new Error(`refusing to overwrite an operator-owned artifact: ${artifactPath}`);
     }
@@ -7738,7 +7835,7 @@ function readRegularArtifact(filePath) {
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`artifact path is not a regular file: ${filePath}`);
   }
-  return fs5.readFileSync(filePath, "utf-8");
+  return fs6.readFileSync(filePath, "utf-8");
 }
 function isRecognizablyCanonryGenerated(filePath, contents) {
   if (path2.basename(filePath) === "worker.js") {
@@ -7755,22 +7852,22 @@ function writePrivateTemporaryFile(filePath, contents) {
     path2.dirname(filePath),
     `.${path2.basename(filePath)}.${randomUUID()}.tmp`
   );
-  const fd = fs5.openSync(temporaryPath, "wx", 384);
+  const fd = fs6.openSync(temporaryPath, "wx", 384);
   let closed = false;
   try {
-    fs5.writeFileSync(fd, contents, "utf-8");
-    fs5.fsyncSync(fd);
-    fs5.closeSync(fd);
+    fs6.writeFileSync(fd, contents, "utf-8");
+    fs6.fsyncSync(fd);
+    fs6.closeSync(fd);
     closed = true;
   } catch (error) {
     if (!closed) {
       try {
-        fs5.closeSync(fd);
+        fs6.closeSync(fd);
       } catch {
       }
     }
     try {
-      fs5.unlinkSync(temporaryPath);
+      fs6.unlinkSync(temporaryPath);
     } catch {
     }
     throw error;
@@ -7804,10 +7901,10 @@ function writeCloudflareWorkerArtifacts(artifacts, contents) {
         throw new Error(`artifact changed during update: ${change.filePath}`);
       }
       if (change.previous === null) {
-        fs5.linkSync(change.temporaryPath, change.filePath);
-        fs5.unlinkSync(change.temporaryPath);
+        fs6.linkSync(change.temporaryPath, change.filePath);
+        fs6.unlinkSync(change.temporaryPath);
       } else {
-        fs5.renameSync(change.temporaryPath, change.filePath);
+        fs6.renameSync(change.temporaryPath, change.filePath);
       }
       applied.push(change);
     }
@@ -7816,10 +7913,10 @@ function writeCloudflareWorkerArtifacts(artifacts, contents) {
       try {
         if (readRegularArtifact(change.filePath) !== change.contents) continue;
         if (change.previous === null) {
-          fs5.unlinkSync(change.filePath);
+          fs6.unlinkSync(change.filePath);
         } else {
           const restorePath = writePrivateTemporaryFile(change.filePath, change.previous);
-          fs5.renameSync(restorePath, change.filePath);
+          fs6.renameSync(restorePath, change.filePath);
         }
       } catch {
       }
@@ -7828,7 +7925,7 @@ function writeCloudflareWorkerArtifacts(artifacts, contents) {
   } finally {
     for (const change of pending) {
       try {
-        if (fs5.existsSync(change.temporaryPath)) fs5.unlinkSync(change.temporaryPath);
+        if (fs6.existsSync(change.temporaryPath)) fs6.unlinkSync(change.temporaryPath);
       } catch {
       }
     }
@@ -7914,7 +8011,7 @@ async function preflightCloudflareWrangler(opts = {}) {
   if (missing.length > 0) {
     throw new Error(`Wrangler deploy does not support required flags: ${missing.join(", ")}`);
   }
-  const tempDirectory = fs5.mkdtempSync(path2.join(
+  const tempDirectory = fs6.mkdtempSync(path2.join(
     opts.tempRoot ?? os.tmpdir(),
     "canonry-cloudflare-wrangler-preflight-"
   ));
@@ -7922,13 +8019,13 @@ async function preflightCloudflareWrangler(opts = {}) {
   const wranglerTomlPath = path2.join(tempDirectory, "wrangler.toml");
   const secretsPath = path2.join(tempDirectory, "secrets.json");
   try {
-    fs5.chmodSync(tempDirectory, 448);
-    fs5.writeFileSync(workerScriptPath, generateWorkerScript({
+    fs6.chmodSync(tempDirectory, 448);
+    fs6.writeFileSync(workerScriptPath, generateWorkerScript({
       deliveryMode,
       workerVersion: "preflight",
       botList: DEFAULT_BOT_LIST
     }), { encoding: "utf-8", flag: "wx", mode: 384 });
-    fs5.writeFileSync(wranglerTomlPath, generateWranglerToml(
+    fs6.writeFileSync(wranglerTomlPath, generateWranglerToml(
       deliveryMode === "queue-pull" ? {
         deliveryMode,
         sourceId: "preflight",
@@ -7944,7 +8041,7 @@ async function preflightCloudflareWrangler(opts = {}) {
       }
     ), { encoding: "utf-8", flag: "wx", mode: 384 });
     if (deliveryMode === "direct-push") {
-      fs5.writeFileSync(secretsPath, JSON.stringify({
+      fs6.writeFileSync(secretsPath, JSON.stringify({
         [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: "preflight-bearer",
         [CLOUDFLARE_WORKER_BINDINGS.hmacSecret]: "preflight-hmac"
       }), { encoding: "utf-8", flag: "wx", mode: 384 });
@@ -7972,7 +8069,7 @@ ${wranglerDiagnostic(validationOutput)}`
       );
     }
   } finally {
-    fs5.rmSync(tempDirectory, { recursive: true, force: true });
+    fs6.rmSync(tempDirectory, { recursive: true, force: true });
   }
 }
 async function deployCloudflareWorker(opts) {
@@ -7988,11 +8085,11 @@ async function deployCloudflareWorker(opts) {
   }
   if (!opts.secrets) throw new Error("Direct-push Worker deploy requires bearer and HMAC secrets");
   const secrets = opts.secrets;
-  const tempDirectory = fs5.mkdtempSync(path2.join(opts.tempRoot ?? os.tmpdir(), "canonry-cloudflare-secrets-"));
+  const tempDirectory = fs6.mkdtempSync(path2.join(opts.tempRoot ?? os.tmpdir(), "canonry-cloudflare-secrets-"));
   const secretsPath = path2.join(tempDirectory, "secrets.json");
   try {
-    fs5.chmodSync(tempDirectory, 448);
-    fs5.writeFileSync(
+    fs6.chmodSync(tempDirectory, 448);
+    fs6.writeFileSync(
       secretsPath,
       JSON.stringify({
         [CLOUDFLARE_WORKER_BINDINGS.bearerToken]: secrets.bearerToken,
@@ -8000,7 +8097,7 @@ async function deployCloudflareWorker(opts) {
       }),
       { encoding: "utf-8", flag: "wx", mode: 384 }
     );
-    fs5.chmodSync(secretsPath, 384);
+    fs6.chmodSync(secretsPath, 384);
     const runner = opts.run ?? runWrangler;
     await runner(
       "wrangler",
@@ -8016,9 +8113,9 @@ async function deployCloudflareWorker(opts) {
     );
   } finally {
     try {
-      if (fs5.existsSync(secretsPath)) fs5.unlinkSync(secretsPath);
+      if (fs6.existsSync(secretsPath)) fs6.unlinkSync(secretsPath);
     } finally {
-      fs5.rmSync(tempDirectory, { recursive: true, force: true });
+      fs6.rmSync(tempDirectory, { recursive: true, force: true });
     }
   }
 }
@@ -8048,11 +8145,11 @@ function requireCloudflareQueueOption(project2, value, option) {
 }
 function readCloudflareQueueApiToken(project2, tokenFile) {
   try {
-    const stat = fs6.lstatSync(tokenFile);
+    const stat = fs7.lstatSync(tokenFile);
     if (!stat.isFile() || stat.isSymbolicLink()) {
       throw new Error("not a regular file");
     }
-    const apiToken = fs6.readFileSync(tokenFile, "utf-8").trim();
+    const apiToken = fs7.readFileSync(tokenFile, "utf-8").trim();
     if (!apiToken) throw new Error("file is empty");
     return apiToken;
   } catch (error) {
@@ -8334,9 +8431,9 @@ async function trafficConnectWordpress(project2, opts) {
   }
   let applicationPassword = opts.appPassword?.trim() ?? "";
   if (!applicationPassword && opts.appPasswordFile) {
-    const fs19 = await import("fs");
+    const fs21 = await import("fs");
     try {
-      applicationPassword = fs19.readFileSync(opts.appPasswordFile, "utf-8").trim();
+      applicationPassword = fs21.readFileSync(opts.appPasswordFile, "utf-8").trim();
     } catch (e) {
       const msg = describeError(e);
       throw new CliError({
@@ -8392,10 +8489,10 @@ async function trafficConnectCloudRun(project2, opts) {
       details: { project: project2 }
     });
   }
-  const fs19 = await import("fs");
+  const fs21 = await import("fs");
   let keyJson;
   try {
-    keyJson = fs19.readFileSync(opts.serviceAccountKey, "utf-8");
+    keyJson = fs21.readFileSync(opts.serviceAccountKey, "utf-8");
     JSON.parse(keyJson);
   } catch (e) {
     const msg = describeError(e);
@@ -8455,9 +8552,9 @@ async function trafficConnectVercel(project2, opts) {
   }
   let token = opts.token?.trim() ?? "";
   if (!token && opts.tokenFile) {
-    const fs19 = await import("fs");
+    const fs21 = await import("fs");
     try {
-      token = fs19.readFileSync(opts.tokenFile, "utf-8").trim();
+      token = fs21.readFileSync(opts.tokenFile, "utf-8").trim();
     } catch (e) {
       const msg = describeError(e);
       throw new CliError({
@@ -11504,7 +11601,7 @@ var USERS_CLI_COMMANDS = [
 ];
 
 // src/commands/keyword.ts
-import fs7 from "fs";
+import fs8 from "fs";
 function getClient14() {
   return createApiClient();
 }
@@ -11572,7 +11669,7 @@ async function listKeywords(project2, format) {
   }
 }
 async function importKeywords(project2, filePath, format) {
-  if (!fs7.existsSync(filePath)) {
+  if (!fs8.existsSync(filePath)) {
     throw new CliError({
       code: "KEYWORD_IMPORT_FILE_NOT_FOUND",
       message: `File not found: ${filePath}`,
@@ -11583,7 +11680,7 @@ async function importKeywords(project2, filePath, format) {
       }
     });
   }
-  const content = fs7.readFileSync(filePath, "utf-8");
+  const content = fs8.readFileSync(filePath, "utf-8");
   const keywords = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   if (keywords.length === 0) {
     if (isMachineFormat(format)) {
@@ -11784,7 +11881,7 @@ var KEYWORD_CLI_COMMANDS = [
 ];
 
 // src/commands/query.ts
-import fs8 from "fs";
+import fs9 from "fs";
 function getClient15() {
   return createApiClient();
 }
@@ -11875,7 +11972,7 @@ async function listQueries(project2, format) {
   }
 }
 async function importQueries(project2, filePath, format) {
-  if (!fs8.existsSync(filePath)) {
+  if (!fs9.existsSync(filePath)) {
     throw new CliError({
       code: "QUERY_IMPORT_FILE_NOT_FOUND",
       message: `File not found: ${filePath}`,
@@ -11886,7 +11983,7 @@ async function importQueries(project2, filePath, format) {
       }
     });
   }
-  const content = fs8.readFileSync(filePath, "utf-8");
+  const content = fs9.readFileSync(filePath, "utf-8");
   const queries2 = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   if (queries2.length === 0) {
     if (isMachineFormat(format)) {
@@ -11950,16 +12047,16 @@ Saved ${result.queries.length} ${result.queries.length === 1 ? "query" : "querie
 
 // src/commands/measurement-plan.ts
 import crypto from "crypto";
-import fs9 from "fs";
+import fs10 from "fs";
 import { parse as parse2 } from "yaml";
 import { z as z2 } from "zod";
 function readPlan(source) {
-  const content = source === "-" ? fs9.readFileSync(0, "utf8") : fs9.readFileSync(source, "utf8");
+  const content = source === "-" ? fs10.readFileSync(0, "utf8") : fs10.readFileSync(source, "utf8");
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse2(content);
   return measurementPlanInputSchema.parse(parsed);
 }
 function readDiscoveryRule(source) {
-  const content = source === "-" ? fs9.readFileSync(0, "utf8") : fs9.readFileSync(source, "utf8");
+  const content = source === "-" ? fs10.readFileSync(0, "utf8") : fs10.readFileSync(source, "utf8");
   const parsed = source.endsWith(".json") ? JSON.parse(content) : parse2(content);
   return measurementDiscoveryRuleSchema.parse(parsed);
 }
@@ -12012,7 +12109,7 @@ var advancedDeactivateInputSchema = z2.object({
 }).strict();
 function readAdvancedMeasurementInput(source) {
   if (source === void 0) return {};
-  const content = source === "-" ? fs9.readFileSync(0, "utf8") : fs9.readFileSync(source, "utf8");
+  const content = source === "-" ? fs10.readFileSync(0, "utf8") : fs10.readFileSync(source, "utf8");
   return JSON.parse(content);
 }
 var advancedMeasurementCollectionKeys = {
@@ -12211,7 +12308,7 @@ async function replaceMeasurementPlanAssignments(project2, opts) {
   console.log(JSON.stringify({ preview, result }, null, 2));
 }
 function readGroupMembershipCsv(source) {
-  return source === "-" ? fs9.readFileSync(0, "utf8") : fs9.readFileSync(source, "utf8");
+  return source === "-" ? fs10.readFileSync(0, "utf8") : fs10.readFileSync(source, "utf8");
 }
 async function previewMeasurementPlanGroups(project2, source) {
   const preview = await createApiClient().previewMeasurementDraftGroupMembership(project2, {
@@ -12562,7 +12659,7 @@ var QUERY_CLI_COMMANDS = [
 ];
 
 // src/commands/mcp.ts
-import fs10 from "fs";
+import fs11 from "fs";
 import path4 from "path";
 import { createRequire } from "module";
 
@@ -12678,8 +12775,8 @@ function renderClientSnippet(client, serverName, entry) {
   return renderJsonSnippet(serverName, entry, client.format);
 }
 function readJsonConfig(configPath) {
-  if (!fs10.existsSync(configPath)) return {};
-  const raw = fs10.readFileSync(configPath, "utf-8").trim();
+  if (!fs11.existsSync(configPath)) return {};
+  const raw = fs11.readFileSync(configPath, "utf-8").trim();
   if (!raw) return {};
   try {
     const parsed = JSON.parse(raw);
@@ -12697,14 +12794,14 @@ function readJsonConfig(configPath) {
   }
 }
 function writeJsonConfig(configPath, value) {
-  fs10.mkdirSync(path4.dirname(configPath), { recursive: true });
-  fs10.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}
+  fs11.mkdirSync(path4.dirname(configPath), { recursive: true });
+  fs11.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}
 `, "utf-8");
 }
 function backupConfigIfPresent(configPath) {
-  if (!fs10.existsSync(configPath)) return void 0;
+  if (!fs11.existsSync(configPath)) return void 0;
   const backupPath = `${configPath}.canonry.bak`;
-  fs10.copyFileSync(configPath, backupPath);
+  fs11.copyFileSync(configPath, backupPath);
   return backupPath;
 }
 function findClientOrThrow(id) {
@@ -13067,13 +13164,13 @@ var NOTIFY_CLI_COMMANDS = [
 ];
 
 // src/commands/apply.ts
-import fs11 from "fs";
+import fs12 from "fs";
 import { parseAllDocuments } from "yaml";
 async function applyConfigFile(filePath) {
-  if (!fs11.existsSync(filePath)) {
+  if (!fs12.existsSync(filePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
-  const content = fs11.readFileSync(filePath, "utf-8");
+  const content = fs12.readFileSync(filePath, "utf-8");
   const docs = parseAllDocuments(content);
   const client = createApiClient();
   const errors = [];
@@ -13539,7 +13636,7 @@ async function loadLatestRunForExport(client, project2) {
 }
 
 // src/commands/results-export.ts
-import fs12 from "fs";
+import fs13 from "fs";
 import path5 from "path";
 async function exportResults(project2, opts) {
   const { output, ...request } = opts;
@@ -13549,8 +13646,8 @@ async function exportResults(project2, opts) {
     return;
   }
   const target = output ? path5.resolve(output) : path5.resolve(process.cwd(), path5.basename(artifact.filename));
-  fs12.mkdirSync(path5.dirname(target), { recursive: true });
-  fs12.writeFileSync(target, artifact.content, "utf8");
+  fs13.mkdirSync(path5.dirname(target), { recursive: true });
+  fs13.writeFileSync(target, artifact.content, "utf8");
   console.log(`Results export written to ${target}`);
 }
 
@@ -15852,11 +15949,11 @@ var SKILLS_CLI_COMMANDS = [
 ];
 
 // src/commands/snapshot.ts
-import fs14 from "fs";
+import fs15 from "fs";
 import path7 from "path";
 
 // src/snapshot-pdf.ts
-import fs13 from "fs";
+import fs14 from "fs";
 import path6 from "path";
 import { PDFDocument, StandardFonts, rgb } from "pdf-lib";
 var PAGE_WIDTH = 612;
@@ -16070,8 +16167,8 @@ async function writeSnapshotPdf(report, outputPath) {
   renderQueries(pdf, report);
   const bytes = await doc.save();
   const resolvedPath = path6.resolve(outputPath);
-  fs13.mkdirSync(path6.dirname(resolvedPath), { recursive: true });
-  fs13.writeFileSync(resolvedPath, bytes);
+  fs14.mkdirSync(path6.dirname(resolvedPath), { recursive: true });
+  fs14.writeFileSync(resolvedPath, bytes);
   return resolvedPath;
 }
 function renderCover(pdf, report) {
@@ -16232,8 +16329,8 @@ PDF saved: ${savedPdfPath}`);
 }
 function writeSnapshotMarkdown(report, outputPath) {
   const resolvedPath = path7.resolve(outputPath);
-  fs14.mkdirSync(path7.dirname(resolvedPath), { recursive: true });
-  fs14.writeFileSync(resolvedPath, formatSnapshotMarkdown(report), "utf-8");
+  fs15.mkdirSync(path7.dirname(resolvedPath), { recursive: true });
+  fs15.writeFileSync(resolvedPath, formatSnapshotMarkdown(report), "utf-8");
   return resolvedPath;
 }
 function formatSnapshotMarkdown(report) {
@@ -17472,7 +17569,17 @@ async function bootstrapCommand(opts) {
   };
   const providersChanged = !isDeepStrictEqual(persistedValue(existingRaw?.providers ?? {}), persistedValue(mergedProviders));
   const configChanged = !existingRaw || existingRaw.apiUrl !== apiUrl || existingRaw.database !== databasePath || existingRaw.apiKey !== rawApiKey || providersChanged || !isDeepStrictEqual(persistedValue(existingRaw.google), persistedValue(mergedGoogle));
-  if (configChanged) saveConfig(nextConfig);
+  const providerConnections = Object.keys(env.providers).filter((name) => env.providers[name] && !isDeepStrictEqual(persistedValue(existingRaw?.providers?.[name]), persistedValue(mergedProviders[name]))).map((name) => ({ integration: "provider", provider: name, action: existingRaw?.providers?.[name] ? "reauth" : "connect" }));
+  if (configChanged) {
+    try {
+      saveConfig(nextConfig);
+    } catch (err) {
+      for (const connection of providerConnections) trackCliConnection({ ...connection, status: "failed", ...outcomeFailure(err) });
+      throw err;
+    }
+  }
+  if (isTelemetryEnabled()) recordInstallRef(opts?.ref);
+  for (const connection of providerConnections) trackCliConnection({ ...connection, status: "succeeded" });
   const status = !existing ? "created" : configChanged || keyChanged ? "updated" : "unchanged";
   const providerFree = registeredProviderNames(nextConfig).length === 0;
   const serverUrl = loadConfig().apiUrl;
@@ -17567,9 +17674,24 @@ async function bootstrapCommand(opts) {
   if (reloadFailure) throw reloadFailure;
 }
 
+// src/commands/support.ts
+var FEEDBACK_COMMAND = 'canonry feedback "<what happened>"';
+function supportCommand(format) {
+  if (isMachineFormat(format)) {
+    console.log(JSON.stringify({ discord: CANONRY_DISCORD_URL, issues: CANONRY_ISSUES_URL, feedbackCommand: FEEDBACK_COMMAND }, null, 2));
+    return;
+  }
+  console.log([
+    "Get help with Canonry:",
+    `  Discord:   ${CANONRY_DISCORD_URL}`,
+    `  Issues:    ${CANONRY_ISSUES_URL}`,
+    `  From here: ${FEEDBACK_COMMAND}`
+  ].join("\n"));
+}
+
 // src/commands/daemon.ts
 import { spawn as spawn2 } from "child_process";
-import fs15 from "fs";
+import fs16 from "fs";
 import path9 from "path";
 
 // src/operator-url.ts
@@ -17640,8 +17762,8 @@ function buildServeForwardArgs(opts) {
 async function startDaemon(opts) {
   const pidPath = getPidPath();
   const format = opts.format ?? "text";
-  if (fs15.existsSync(pidPath)) {
-    const existingPid = parseInt(fs15.readFileSync(pidPath, "utf-8").trim(), 10);
+  if (fs16.existsSync(pidPath)) {
+    const existingPid = parseInt(fs16.readFileSync(pidPath, "utf-8").trim(), 10);
     if (!isNaN(existingPid) && isProcessAlive(existingPid)) {
       throw new CliError({
         code: "DAEMON_ALREADY_RUNNING",
@@ -17652,7 +17774,7 @@ async function startDaemon(opts) {
         }
       });
     }
-    fs15.unlinkSync(pidPath);
+    fs16.unlinkSync(pidPath);
   }
   const config = loadConfig();
   const endpoint = resolveDaemonEndpoint(opts, process.env, config.port);
@@ -17675,10 +17797,10 @@ async function startDaemon(opts) {
     });
   }
   const configDir = getConfigDir();
-  if (!fs15.existsSync(configDir)) {
-    fs15.mkdirSync(configDir, { recursive: true });
+  if (!fs16.existsSync(configDir)) {
+    fs16.mkdirSync(configDir, { recursive: true });
   }
-  fs15.writeFileSync(pidPath, String(child.pid), "utf-8");
+  fs16.writeFileSync(pidPath, String(child.pid), "utf-8");
   if (!isMachineFormat(format)) {
     process.stderr.write("Waiting for server to start...");
   }
@@ -17689,7 +17811,7 @@ async function startDaemon(opts) {
     } catch {
     }
     try {
-      fs15.unlinkSync(pidPath);
+      fs16.unlinkSync(pidPath);
     } catch {
     }
     throw new CliError({
@@ -17721,7 +17843,7 @@ async function startDaemon(opts) {
 }
 function stopDaemon(format = "text") {
   const pidPath = getPidPath();
-  if (!fs15.existsSync(pidPath)) {
+  if (!fs16.existsSync(pidPath)) {
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
         stopped: false,
@@ -17732,7 +17854,7 @@ function stopDaemon(format = "text") {
     console.log("Canonry is not running (no PID file found)");
     return;
   }
-  const pid = parseInt(fs15.readFileSync(pidPath, "utf-8").trim(), 10);
+  const pid = parseInt(fs16.readFileSync(pidPath, "utf-8").trim(), 10);
   if (isNaN(pid)) {
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
@@ -17743,7 +17865,7 @@ function stopDaemon(format = "text") {
     } else {
       console.error("Invalid PID file. Removing it.");
     }
-    fs15.unlinkSync(pidPath);
+    fs16.unlinkSync(pidPath);
     return;
   }
   if (!isProcessAlive(pid)) {
@@ -17757,12 +17879,12 @@ function stopDaemon(format = "text") {
     } else {
       console.log(`Canonry is not running (stale PID: ${pid}). Cleaning up.`);
     }
-    fs15.unlinkSync(pidPath);
+    fs16.unlinkSync(pidPath);
     return;
   }
   try {
     process.kill(pid, "SIGTERM");
-    fs15.unlinkSync(pidPath);
+    fs16.unlinkSync(pidPath);
     if (isMachineFormat(format)) {
       console.log(JSON.stringify({
         stopped: true,
@@ -17786,7 +17908,7 @@ function stopDaemon(format = "text") {
 
 // src/commands/init.ts
 import crypto3 from "crypto";
-import fs16 from "fs";
+import fs17 from "fs";
 import readline2 from "readline";
 import path10 from "path";
 var pendingServeHandoff = false;
@@ -17824,7 +17946,7 @@ var PROJECT_MARKERS = [".git", "canonry.yaml", "canonry.yml", "package.json"];
 function cwdLooksLikeProject(dir) {
   const home = process.env.HOME ?? "";
   if (home && path10.resolve(dir) === path10.resolve(home)) return false;
-  return PROJECT_MARKERS.some((marker) => fs16.existsSync(path10.join(dir, marker)));
+  return PROJECT_MARKERS.some((marker) => fs17.existsSync(path10.join(dir, marker)));
 }
 var DEFAULT_AGENT_MODELS = {
   anthropic: "anthropic/claude-sonnet-4-6",
@@ -17855,8 +17977,8 @@ async function initCommand(opts) {
     return void 0;
   }
   const configDir = getConfigDir();
-  if (!fs16.existsSync(configDir)) {
-    fs16.mkdirSync(configDir, { recursive: true });
+  if (!fs17.existsSync(configDir)) {
+    fs17.mkdirSync(configDir, { recursive: true });
   }
   const bootstrapEnv = getBootstrapEnv(process.env, {
     GEMINI_API_KEY: opts?.geminiKey,
@@ -18104,6 +18226,7 @@ ${mcpTip}`);
   }
   if (isTelemetryEnabled()) {
     const postInitSetupState = buildSetupState();
+    recordInstallRef(opts?.ref);
     trackEvent("cli.init", {
       providerCount: providerNames.length,
       providers: providerNames,
@@ -18126,8 +18249,12 @@ ${mcpTip}`);
         hasAgent: !!agentLLM
       }),
       skillsInstalled: !!skillsSummary,
+      ...installAttribution(),
       ...cliRuntimeContext()
     });
+    for (const provider of Object.keys(providers)) {
+      trackCliConnection({ integration: "provider", provider, action: "connect", status: "succeeded" });
+    }
   }
   if (!isMachineFormat(format) && process.stdin.isTTY && process.stdout.isTTY) {
     const answer = await prompt("\nStart the dashboard now? [Y/n]: ");
@@ -18208,7 +18335,7 @@ async function repairPathsOnce(db, name, repair) {
 }
 
 // src/agent-plugin.ts
-import fs17 from "fs";
+import fs18 from "fs";
 import path11 from "path";
 var CANONRY_PLUGIN_ID = "canonry@canonry";
 var REQUIRED_SKILLS = ["canonry", "aero"];
@@ -18253,7 +18380,7 @@ function isCanonryPluginId(value) {
 }
 function readJson(filePath) {
   try {
-    return JSON.parse(fs17.readFileSync(filePath, "utf8"));
+    return JSON.parse(fs18.readFileSync(filePath, "utf8"));
   } catch {
     return null;
   }
@@ -18272,7 +18399,7 @@ function readCodexPluginConfigured(filePath) {
   try {
     let currentPlugin = null;
     let inPluginsTable = false;
-    for (const line of fs17.readFileSync(filePath, "utf8").split(/\r?\n/)) {
+    for (const line of fs18.readFileSync(filePath, "utf8").split(/\r?\n/)) {
       const section = /^\s*\[plugins\.(?:"([^"]+)"|'([^']+)'|(\S+))\]\s*(?:#.*)?$/.exec(line);
       if (section) {
         const captures = section.slice(1, 4);
@@ -18305,7 +18432,7 @@ function readCodexPluginConfigured(filePath) {
   }
 }
 function verifiedPluginVersion(root, client) {
-  if (client === "codex" && fs17.existsSync(path11.join(root, "plugin.json"))) {
+  if (client === "codex" && fs18.existsSync(path11.join(root, "plugin.json"))) {
     const manifest2 = readJson(path11.join(root, "plugin.json"));
     if (manifest2 && typeof manifest2 === "object") {
       const plugin2 = manifest2;
@@ -18319,7 +18446,7 @@ function verifiedPluginVersion(root, client) {
         if (portableMcp.$schema !== AGENT_PLUGINS_MCP_SCHEMA || portableMcp.mcpServers?.canonry?.type !== "stdio" || portableMcp.mcpServers.canonry.command !== "canonry-mcp") {
           return null;
         }
-        return REQUIRED_SKILLS.every((name) => fs17.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin2.version : null;
+        return REQUIRED_SKILLS.every((name) => fs18.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin2.version : null;
       }
       if (typeof plugin2.$schema === "string" && plugin2.$schema.startsWith("https://agent-plugins.org/schemas/")) {
         return null;
@@ -18337,7 +18464,7 @@ function verifiedPluginVersion(root, client) {
   if (!mcp || typeof mcp !== "object") return null;
   const canonryServer = mcp.mcpServers?.canonry;
   if (canonryServer?.command !== "canonry-mcp") return null;
-  return REQUIRED_SKILLS.every((name) => fs17.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin.version : null;
+  return REQUIRED_SKILLS.every((name) => fs18.existsSync(path11.join(root, "skills", name, "SKILL.md"))) ? plugin.version : null;
 }
 function readClaudeUserInstallPaths(claudeConfigDir) {
   const parsed = readJson(path11.join(claudeConfigDir, "plugins", "installed_plugins.json"));
@@ -18354,7 +18481,7 @@ function readClaudeUserInstallPaths(claudeConfigDir) {
 }
 function listDirectories(dir) {
   try {
-    return fs17.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path11.join(dir, entry.name));
+    return fs18.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path11.join(dir, entry.name));
   } catch {
     return [];
   }
@@ -18401,6 +18528,80 @@ function detectCanonryAgentPlugin(opts = {}) {
   return { configuredClients, verifiedClients, verifiedClientVersions };
 }
 
+// src/server-crash-telemetry.ts
+import fs19 from "fs";
+import path12 from "path";
+var CRASH_MARKER = "crash-telemetry.json";
+var MAX_MARKER_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+function telemetryAllowed() {
+  try {
+    return isTelemetryEnabled();
+  } catch {
+    return false;
+  }
+}
+function markerPath(configDir) {
+  return path12.join(configDir, CRASH_MARKER);
+}
+function trackServerStartFailure(err, reasonCode) {
+  try {
+    const classified = classifyOutcomeError(err);
+    const code = err?.code;
+    const reason = reasonCode ?? (code === "EADDRINUSE" ? OutcomeReasonCodes.PORT_IN_USE : classified.reasonCode);
+    trackFeatureCompleted({
+      feature: "server",
+      operation: "start",
+      status: "failed",
+      trigger: OutcomeTriggers.startup,
+      reasonCode: reason,
+      ...classified.errorName ? { errorName: classified.errorName } : {}
+    });
+  } catch {
+  }
+}
+var watched = /* @__PURE__ */ new WeakSet();
+function watchServerCrashes(configDir = getConfigDir(), proc = process, now = Date.now) {
+  if (watched.has(proc)) return;
+  watched.add(proc);
+  proc.on("uncaughtExceptionMonitor", (err, origin) => {
+    if (!telemetryAllowed()) return;
+    try {
+      const { errorName } = classifyOutcomeError(err);
+      fs19.writeFileSync(markerPath(configDir), JSON.stringify({
+        origin: origin === "unhandledRejection" ? "unhandledRejection" : "uncaughtException",
+        at: now(),
+        ...errorName ? { errorName } : {}
+      }));
+    } catch {
+    }
+  });
+}
+function reportPreviousServerCrash(configDir = getConfigDir(), now = Date.now) {
+  if (!telemetryAllowed()) return;
+  const file = markerPath(configDir);
+  let marker;
+  try {
+    marker = JSON.parse(fs19.readFileSync(file, "utf8"));
+  } catch {
+    return;
+  }
+  try {
+    fs19.rmSync(file, { force: true });
+  } catch {
+    return;
+  }
+  if (typeof marker.at !== "number" || now() - marker.at > MAX_MARKER_AGE_MS) return;
+  const errorName = typeof marker.errorName === "string" && /^[A-Z_$][\w$]{0,39}$/i.test(marker.errorName) ? marker.errorName : void 0;
+  trackFeatureCompleted({
+    feature: "server",
+    operation: "crash",
+    status: "failed",
+    trigger: OutcomeTriggers.startup,
+    reasonCode: marker.origin === "unhandledRejection" ? OutcomeReasonCodes.UNHANDLED_REJECTION : OutcomeReasonCodes.UNCAUGHT_EXCEPTION,
+    ...errorName ? { errorName } : {}
+  });
+}
+
 // src/commands/serve.ts
 function readServeOpenState(db) {
   try {
@@ -18449,7 +18650,12 @@ async function serveCommand(format = "text") {
   const host = process.env.CANONRY_HOST ?? "127.0.0.1";
   config.port = port;
   const db = createClient(config.database);
-  migrate(db);
+  try {
+    migrate(db);
+  } catch (err) {
+    trackServerStartFailure(err, "MIGRATION_FAILED");
+    throw err;
+  }
   try {
     const result = await repairNormalizedPathsOnStartup(db);
     if (result && result.updated > 0 && format === "text") {
@@ -18526,10 +18732,13 @@ Canonry server running at ${url}`);
       }, null, 2));
     }
     setTelemetrySource("cli-server");
+    watchServerCrashes();
+    reportPreviousServerCrash();
     const providerNames = registeredProviderNames(config);
     trackEvent("serve.started", {
       providerCount: providerNames.length,
       providers: providerNames,
+      ...installAttribution(),
       // Who launched the server: an agent-started install is its own funnel.
       ...cliRuntimeContext()
     });
@@ -18540,6 +18749,7 @@ Canonry server running at ${url}`);
 `);
       return;
     }
+    trackServerStartFailure(err);
     try {
       await closeWithIdleSweep(app);
     } catch (closeErr) {
@@ -18732,10 +18942,11 @@ var SYSTEM_CLI_COMMANDS = [
   },
   {
     path: ["init"],
-    usage: "canonry init [--force] [--gemini-key <key>] [--openai-key <key>] [--claude-key <key>] [--perplexity-key <key>] [--muse-key <key>] [--local-url <url>] [--local-model <name>] [--local-key <key>] [--google-client-id <id>] [--google-client-secret <key>] [--skip-skills] [--skip-mcp] [--skills-dir <path>] [--format json]",
+    usage: "canonry init [--force] [--ref <tag>] [--gemini-key <key>] [--openai-key <key>] [--claude-key <key>] [--perplexity-key <key>] [--muse-key <key>] [--local-url <url>] [--local-model <name>] [--local-key <key>] [--google-client-id <id>] [--google-client-secret <key>] [--skip-skills] [--skip-mcp] [--skills-dir <path>] [--format json]",
     help: 'Optional interactive provider and OAuth setup. First-run Page Health does not need this: use "canonry bootstrap", then "canonry serve". At least one provider is required here. --format json needs provider flags or environment variables.',
     options: {
       force: { type: "boolean", short: "f", default: false },
+      ref: stringOption(),
       "gemini-key": stringOption(),
       "openai-key": stringOption(),
       "claude-key": stringOption(),
@@ -18754,6 +18965,7 @@ var SYSTEM_CLI_COMMANDS = [
     run: async (input) => {
       await initCommand({
         force: getBoolean(input.values, "force"),
+        ref: getString(input.values, "ref"),
         geminiKey: getString(input.values, "gemini-key"),
         openaiKey: getString(input.values, "openai-key"),
         claudeKey: getString(input.values, "claude-key"),
@@ -18773,17 +18985,19 @@ var SYSTEM_CLI_COMMANDS = [
   },
   {
     path: ["bootstrap"],
-    usage: "canonry bootstrap [--format json]",
+    usage: "canonry bootstrap [--ref <tag>] [--format json]",
     help: "Create or reconcile the local config, SQLite database, and default API key from supported environment variables. Provider credentials are optional. Safe to rerun: existing settings are preserved and the result reports created, updated, or unchanged. The legacy --force/-f flag is accepted but has no effect.",
     options: {
       // Compatibility for scripts written before bootstrap became idempotent.
       // Keep this out of usage: the flag is unnecessary and has no behavior.
-      force: { type: "boolean", short: "f", default: false }
+      force: { type: "boolean", short: "f", default: false },
+      ref: stringOption()
     },
     allowPositionals: false,
     run: async (input) => {
       await bootstrapCommand({
-        format: input.format
+        format: input.format,
+        ref: getString(input.values, "ref")
       });
     }
   },
@@ -18839,6 +19053,15 @@ var SYSTEM_CLI_COMMANDS = [
       stopDaemon(input.format);
     }
   },
+  {
+    path: ["support"],
+    usage: "canonry support [--format json]",
+    help: "Where to get help: the Canonry Discord, the issue tracker, and canonry feedback.",
+    allowPositionals: false,
+    run: async (input) => {
+      supportCommand(input.format);
+    }
+  },
   {
     path: ["feedback"],
     usage: FEEDBACK_USAGE,
@@ -19851,14 +20074,14 @@ Usage: ${usage}`, {
     }
   }
 ];
-function siteHealthAlias(sourcePath, path12, usage) {
+function siteHealthAlias(sourcePath, path13, usage) {
   const source = TECHNICAL_AEO_CLI_COMMANDS_BASE.find(
     (candidate) => candidate.path.join(" ") === sourcePath.join(" ")
   );
   if (!source) throw new Error(`Missing Site Health compatibility source: ${sourcePath.join(" ")}`);
   return {
     ...source,
-    path: path12,
+    path: path13,
     usage,
     run: async (input) => {
       try {
@@ -19869,7 +20092,7 @@ function siteHealthAlias(sourcePath, path12, usage) {
         throw usageError(`${firstLine}
 Usage: ${usage}`, {
           message: error.message,
-          details: { ...error.details, command: path12.join("."), usage }
+          details: { ...error.details, command: path13.join("."), usage }
         });
       }
     }
@@ -20242,7 +20465,7 @@ var VISIBILITY_STATS_CLI_COMMANDS = [
 ];
 
 // src/cli-commands/wordpress.ts
-import fs18 from "fs";
+import fs20 from "fs";
 
 // src/commands/wordpress.ts
 function getClient28() {
@@ -20481,12 +20704,12 @@ async function wordpressSetMeta(project2, body) {
   printPageDetail(result);
 }
 async function wordpressBulkSetMeta(project2, opts) {
-  const fs19 = await import("fs/promises");
-  const path12 = await import("path");
-  const filePath = path12.resolve(opts.from);
+  const fs21 = await import("fs/promises");
+  const path13 = await import("path");
+  const filePath = path13.resolve(opts.from);
   let raw;
   try {
-    raw = await fs19.readFile(filePath, "utf8");
+    raw = await fs21.readFile(filePath, "utf8");
   } catch {
     throw new CliError({
       code: "FILE_READ_ERROR",
@@ -20583,13 +20806,13 @@ async function wordpressSetSchema(project2, body) {
   printManualAssist(`Schema update for "${body.slug}"`, result);
 }
 async function wordpressSchemaDeploy(project2, opts) {
-  const fs19 = await import("fs/promises");
-  const path12 = await import("path");
+  const fs21 = await import("fs/promises");
+  const path13 = await import("path");
   const yaml = await loadYamlModule();
-  const filePath = path12.resolve(opts.profile);
+  const filePath = path13.resolve(opts.profile);
   let raw;
   try {
-    raw = await fs19.readFile(filePath, "utf8");
+    raw = await fs21.readFile(filePath, "utf8");
   } catch {
     throw new CliError({
       code: "FILE_READ_ERROR",
@@ -20694,13 +20917,13 @@ async function wordpressOnboard(project2, opts) {
   }
   let profileData;
   if (opts.profile) {
-    const fs19 = await import("fs/promises");
-    const path12 = await import("path");
+    const fs21 = await import("fs/promises");
+    const path13 = await import("path");
     const yaml = await loadYamlModule();
-    const filePath = path12.resolve(opts.profile);
+    const filePath = path13.resolve(opts.profile);
     let raw;
     try {
-      raw = await fs19.readFile(filePath, "utf8");
+      raw = await fs21.readFile(filePath, "utf8");
     } catch {
       throw new CliError({
         code: "FILE_READ_ERROR",
@@ -20849,7 +21072,7 @@ function resolveContent(input, command, usage, options) {
   }
   if (contentFile) {
     try {
-      return fs18.readFileSync(contentFile, "utf-8");
+      return fs20.readFileSync(contentFile, "utf-8");
     } catch (error) {
       const message = describeError(error);
       throw usageError(`Error: could not read --content-file "${contentFile}": ${message}`, {
@@ -21327,6 +21550,7 @@ async function agentAttach(opts) {
   const existing = await client.listNotifications(opts.project);
   const hasAgent = existing.some((n) => n.source === "agent");
   if (hasAgent) {
+    trackCliConnection({ integration: "agent_webhook", action: "connect", status: "cancelled", reasonCode: "ALREADY_CONNECTED" });
     if (isMachineFormat(opts.format)) {
       console.log(JSON.stringify({ status: "already-attached", project: opts.project }));
     } else {
@@ -21351,6 +21575,7 @@ async function agentDetach(opts) {
   const existing = await client.listNotifications(opts.project);
   const agentNotif = existing.find((n) => n.source === "agent");
   if (!agentNotif) {
+    trackCliConnection({ integration: "agent_webhook", action: "disconnect", status: "cancelled", reasonCode: "NOT_CONNECTED" });
     if (isMachineFormat(opts.format)) {
       console.log(JSON.stringify({ status: "not-attached", project: opts.project }));
     } else {
@@ -22165,6 +22390,7 @@ var REGISTERED_CLI_COMMANDS = [
   ...USERS_CLI_COMMANDS,
   ...COMPETITOR_CLI_COMMANDS,
   ...SETTINGS_CLI_COMMANDS,
+  ...DASHBOARD_CLI_COMMANDS,
   ...SKILLS_CLI_COMMANDS,
   ...SNAPSHOT_CLI_COMMANDS,
   ...RUN_CLI_COMMANDS,
@@ -22304,9 +22530,11 @@ Automation:
 
 Admin:
   settings              Show/update provider and quota settings
+  dashboard             Reset the dashboard password
   backfill              Backfill answer visibility or insights
   telemetry             Manage anonymous telemetry
   history <project>     Show audit trail
+  support               Get help: Canonry Discord and issue tracker
 
 Global options:
   --format json         Machine-readable output: one JSON document (all commands)