@mediamonks/canopy-cli 0.7.15 → 0.7.17

package/dist/{db-DKnJQPm5.mjs → db-DUVadyyv.mjs}

@@ -1,6 +1,6 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { i as unwrap, n as reportErrors, o as apiDataRequest, r as requireTty, u as withContext } from "./ui-B1Px5y7q.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-C6EcKD6a.mjs";
+import { a as unwrap, d as withContext, i as requireTty, r as reportErrors, s as apiDataRequest } from "./ui-BUBYpqoC.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CuLRUDsH.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-CnxJ4TE6.mjs → deploy-DLehZzUr.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, n as reportErrors, o as apiDataRequest, s as apiDownload, u as withContext } from "./ui-B1Px5y7q.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-C6EcKD6a.mjs";
+import { a as unwrap, c as apiDownload, d as withContext, l as apiRequest, r as reportErrors, s as apiDataRequest, t as formatDateTime } from "./ui-BUBYpqoC.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CuLRUDsH.mjs";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -290,7 +290,7 @@ async function pickVersion(deploys, live, message, initial) {
 		message,
 		options: deploys.map((deploy) => ({
 			value: deploy.version,
-			label: `v${deploy.version}  ${deploy.created_at}  (${deploy.source})`,
+			label: `v${deploy.version}  ${formatDateTime(deploy.created_at)}  (${deploy.source})`,
 			hint: deploy.version === live ? "live" : void 0
 		})),
 		initialValue: initial

package/dist/{dev-CyJT6EfQ.mjs → dev-Bvqpc0zN.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { a as ApiError, c as apiRequest, n as reportErrors, u as withContext } from "./ui-B1Px5y7q.mjs";
-import { r as readMigrationFiles } from "./migrations-C6EcKD6a.mjs";
+import { d as withContext, l as apiRequest, o as ApiError, r as reportErrors, t as formatDateTime } from "./ui-BUBYpqoC.mjs";
+import { r as readMigrationFiles } from "./migrations-CuLRUDsH.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
 import { existsSync } from "node:fs";
@@ -160,12 +160,12 @@ async function devRemote(flags, slug) {
 	for (const note of worker?.notes ?? []) console.log(note);
 	console.log("");
 	server.printUrls();
-	console.log(`\n  Dev token expires ${expires_at} — restart canopy dev after that.`);
+	console.log(`\n  Dev token expires ${formatDateTime(expires_at)} — restart canopy dev after that.`);
 }
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-BQxsp-ZQ.mjs");
+		const { fetchProjectDump } = await import("./local-zKGeU9o5.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -180,7 +180,7 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-BQxsp-ZQ.mjs");
+	const { createSandbox } = await import("./local-zKGeU9o5.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/dev-DAyB0TRG.mjs

@@ -0,0 +1,2 @@
+import { t as devCommand } from "./dev-Bvqpc0zN.mjs";
+export { devCommand };

package/dist/docs/cli-docs.md

@@ -10,12 +10,14 @@ description: Read the Canopy docs from the terminal — live from the platform,
 ```bash
 canopy docs                 # list all topics
 canopy docs <topic>         # print one topic
+canopy docs search <terms…> # keyword search across all docs
 canopy docs <topic> --refresh
 ```
 
 ## Arguments & flags
 
 - `[topic]` — positional: the topic slug to print. Omit it to list every topic with a one-line summary, grouped by section. Guides keep bare slugs (`deploy`, `staging`); other sections prefix theirs (`sdk-database`, `cli-deploy`, `platform-schedules`).
+- `search <terms…>` — search every doc for the given terms instead of printing one. Case-insensitive; a doc matches only when every term appears somewhere in its title, summary, or body. Results come back best-first (title and summary hits outrank body mentions), each with the matching lines, capped at ten.
 - `--refresh` — re-fetch from the platform, bypassing the local cache. Default `false`.
 
 ## How it works
@@ -30,6 +32,8 @@ That last step is why `canopy docs` works with no network and no login: a fresh
 
 Asking for an unknown topic errors with the list of available slugs. Everything prints as plain Markdown to stdout, so it pipes cleanly into a pager or an agent's context.
 
+Search runs entirely on the local corpus — the cache plus the bundled snapshot — so it's instant and works offline. It's a locator, not a reader: find the topic, then print it with `canopy docs <topic>` (which fetches fresh content when it can).
+
 ## Examples
 
 ```bash
@@ -38,6 +42,12 @@ canopy docs
 
 Lists every topic with its summary — the starting point when you're not sure which guide covers what you're doing.
 
+```bash
+canopy docs search egress allowlist
+```
+
+Finds the docs that mention both terms — useful when the summaries don't tell you which doc covers a detail, like a specific error code or environment variable.
+
 ```bash
 canopy docs deploy --refresh
 ```

package/dist/docs/cli-skill.md

@@ -1,32 +1,33 @@
 ---
 title: canopy skill
-description: Install the Canopy agent skill into a repo so coding agents know how to drive the platform.
+description: Install the Canopy agent skill so coding agents know how to drive the platform — globally by default, or into a repo.
 ---
 
-`canopy skill install` writes the Canopy agent skill into the current repository, teaching AI coding agents (Claude Code and others) how to use the platform: checking install and login state, creating vs. initializing projects, choosing templates, reading `canopy docs` before guessing, and treating `db restore`, `delete`, and deploys with appropriate care.
+`canopy skill install` writes the Canopy agent skill, teaching AI coding agents (Claude Code and others) how to use the platform: checking install and login state, creating vs. initializing projects, choosing templates, working feedback reports, reading `canopy docs` before guessing, and treating `db restore`, `delete`, and deploys with appropriate care.
 
 ## Usage
 
 ```bash
-canopy skill install
+canopy skill install          # global — applies in every repo (default)
+canopy skill install --repo   # into the current repo instead
 ```
 
 `install` is currently the only subcommand.
 
 ## Arguments & flags
 
-None — it always installs into the repository at the current working directory.
+- `--repo` — install into the repository at the current working directory instead of globally. Use this when you want the skill committed with a project so teammates and CI agents get it with the repo.
 
 ## How it works
 
-The skill files ship inside the CLI package, so installing needs no network. Two paths are written:
+The skill files ship inside the CLI package, so installing needs no network. Two paths are written — under your home directory by default, or under the repo with `--repo`:
 
 - `.agents/skills/canopy/` — the source of truth, in the tool-neutral `.agents/` tree so any agent tooling can read it (no vendor lock-in).
-- `.claude/skills/canopy` — a **symlink** to the `.agents/` copy, so Claude Code picks the skill up. Where symlinks aren't available (e.g. Windows without developer mode), the CLI falls back to a real copy and says so.
+- `.claude/skills/canopy` — a **symlink** to the `.agents/` copy, so Claude Code picks the skill up (the global install lands in `~/.claude/skills/`, Claude Code's user scope, so it applies in every repo). Where symlinks aren't available (e.g. Windows without developer mode), the CLI falls back to a real copy and says so.
 
-Installation is a clean replace: any existing skill directory is removed first, and the installed copy is stamped with the CLI version that wrote it. That stamp is how the skill stays fresh — [`canopy upgrade`](https://docs.canopy.website/cli/upgrade) detects an installed skill in the repo and re-runs `canopy skill install` with the new CLI, so the skill always matches the CLI version in use. If that auto-refresh ever fails, re-run `canopy skill install` yourself.
+Installation is a clean replace: any existing skill directory is removed first, and the installed copy is stamped with the CLI version that wrote it. That stamp is how the skill stays fresh — [`canopy upgrade`](https://docs.canopy.website/cli/upgrade) re-runs `canopy skill install` with the new CLI for the global copy and for a repo copy in the directory you upgrade from, so no stale install shadows a fresh one. If that auto-refresh ever fails, re-run `canopy skill install` yourself.
 
-Commit the `.agents/` directory (and the `.claude/` link) so teammates and CI agents get the skill with the repo.
+With `--repo`, commit the `.agents/` directory (and the `.claude/` link) so teammates and CI agents get the skill with the repo.
 
 ## Examples
 
@@ -34,6 +35,12 @@ Commit the `.agents/` directory (and the `.claude/` link) so teammates and CI ag
 canopy skill install
 ```
 
-From a repo root: installs the skill, prints where the files went and whether `.claude/skills/canopy` is a symlink or a copy, and suggests trying `canopy docs`.
+Installs the skill globally, prints where the files went and whether `.claude/skills/canopy` is a symlink or a copy, and suggests trying `canopy docs`.
+
+```bash
+canopy skill install --repo
+```
+
+From a repo root: same, but into this repository — commit the result.
 
 See also [canopy docs](https://docs.canopy.website/cli/docs) — the always-current documentation the skill points agents at — and [canopy upgrade](https://docs.canopy.website/cli/upgrade).

package/dist/docs/cli.md

@@ -83,4 +83,5 @@ See `canopy docs ci` for wiring push-to-main deploys.
   Upgrading also refreshes the installed Canopy agent skill.
 - `canopy docs [topic]` — list docs, or print one. `--refresh` re-fetches from
   the platform.
-- `canopy skill install` — (re)install the Canopy agent skill into this repo.
+- `canopy skill install` — (re)install the Canopy agent skill, globally by
+  default; `--repo` installs into the current repo instead.

package/dist/docs/index.json

@@ -274,7 +274,7 @@
         {
           "slug": "cli-skill",
           "title": "canopy skill",
-          "summary": "Install the Canopy agent skill into a repo so coding agents know how to drive the platform."
+          "summary": "Install the Canopy agent skill so coding agents know how to drive the platform — globally by default, or into a repo."
         },
         {
           "slug": "cli-upgrade",

package/dist/docs/porting-nextjs.md

@@ -173,6 +173,31 @@ Rules of the road for the worker:
 - Frontend calls are plain `fetch("/api/…")` — same origin, the platform
   session cookie rides along automatically.
 
+### Fetching your own API from the worker
+
+Ported server code often calls the app's own routes with an absolute URL —
+`fetch(BASE_URL + "/api/…")` — because server-side fetch has no origin to
+resolve against. On Vercel that request loops through their edge; on Canopy a
+worker's fetch is a real outbound request, so it would normally hit the
+egress allowlist, and even an allowed hop would arrive without your session.
+
+The platform recognizes this shape and short-circuits it: a fetch to the
+project's **own hostname** (or to `localhost` on any port — the common
+`BASE_URL` fallback) with a path under `/api/` re-enters your worker directly,
+in-process. No network hop, no allowlist entry, and `env.USER` is the same
+caller who made the original request. Two things to know:
+
+- The loopback covers `/api/*` only. A self-fetch to any other path fails
+  like any other non-allowlisted host.
+- Routes fetching each other in a cycle are cut off after 8 hops with a
+  `self_fetch_loop` error, instead of hanging.
+
+Set `NEXT_PUBLIC_BASE_URL` (or whatever your helpers read) to the project's
+own origin so absolute URLs get built at all — an unset value that falls back
+to `http://localhost:3000` also works. Where a restructure is cheap, importing
+the shared function instead of fetching your own route is still the simpler
+pattern; the loopback exists so you don't have to.
+
 ## Step 4 — swap the data layer
 
 Replace the ORM and connection strings with the project's own database:

package/dist/{docs-BlzdYmou.mjs → docs-DOopUT5k.mjs}

@@ -1,7 +1,7 @@
-import { t as version } from "./package-CF0dX7UA.mjs";
+import { t as version } from "./package-X1HbEiNB.mjs";
 import { n as siteConfig } from "./site-BUlQR117.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { n as reportErrors } from "./ui-B1Px5y7q.mjs";
+import { r as reportErrors } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -14,6 +14,10 @@ import { fileURLToPath } from "node:url";
 * never goes stale, with a local cache and a bundled snapshot as offline
 * fallbacks. The listing is grouped per docs-site section.
 *
+* `canopy docs search <terms…>` greps the locally available corpus (cache +
+* bundled snapshot) — the corpus is small enough (~60 docs) that keyword
+* matching beats any index, and it works fully offline.
+*
 * The platform requires a login for docs (internal platform), so fetches carry
 * the CLI token when there is one; without it we simply fall back to the
 * bundled snapshot, so `canopy docs` still works before sign-in.
@@ -140,6 +144,75 @@ function bodyFromFallback(slug) {
 		}
 	}
 }
+const SEARCH_LIMIT = 10;
+const LINE_LIMIT = 2;
+const LINE_WIDTH = 120;
+/** A matching body line, trimmed and windowed around the first term hit. */
+function excerpt(line, matchIndex) {
+	const clean = line.replace(/\s+/g, " ").trim();
+	if (clean.length <= LINE_WIDTH) return clean;
+	const start = Math.max(0, Math.min(matchIndex - Math.floor(LINE_WIDTH / 3), clean.length - LINE_WIDTH));
+	const slice = clean.slice(start, start + LINE_WIDTH);
+	return `${start > 0 ? "…" : ""}${slice}${start + LINE_WIDTH < clean.length ? "…" : ""}`;
+}
+/**
+* Keyword search over the docs corpus: case-insensitive, every term must match
+* somewhere in a doc (title, summary, or body). Title and summary hits weigh
+* more than body occurrences; results come back best-first.
+*/
+function searchDocs(entries, query) {
+	const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
+	if (terms.length === 0) return [];
+	const hits = [];
+	for (const entry of entries) {
+		const title = entry.title.toLowerCase();
+		const summary = entry.summary.toLowerCase();
+		const body = entry.body.toLowerCase();
+		let score = 0;
+		let matchesAll = true;
+		for (const term of terms) {
+			let termScore = 0;
+			if (title.includes(term)) termScore += 10;
+			if (summary.includes(term)) termScore += 5;
+			let count = 0;
+			for (let i = body.indexOf(term); i !== -1 && count < 20; i = body.indexOf(term, i + term.length)) count++;
+			termScore += count;
+			if (termScore === 0) {
+				matchesAll = false;
+				break;
+			}
+			score += termScore;
+		}
+		if (!matchesAll) continue;
+		const lines = [];
+		for (const line of entry.body.split("\n")) {
+			const lower = line.toLowerCase();
+			const at = terms.map((t) => lower.indexOf(t)).find((i) => i !== -1);
+			if (at !== void 0 && line.trim()) {
+				lines.push(excerpt(line, at));
+				if (lines.length >= LINE_LIMIT) break;
+			}
+		}
+		hits.push({
+			slug: entry.slug,
+			title: entry.title,
+			score,
+			lines
+		});
+	}
+	return hits.sort((a, b) => b.score - a.score || a.slug.localeCompare(b.slug));
+}
+/**
+* Every topic paired with its locally available body (cache first, bundled
+* snapshot second). A topic with no local body still gets searched by title
+* and summary — search never hits the network per doc.
+*/
+function searchEntries(index) {
+	return index.topics.map((t) => ({
+		...t,
+		body: bodyFromFallback(t.slug) ?? ""
+	}));
+}
 async function listIndex(refresh) {
 	const { apiUrl } = siteConfig();
 	if (refresh || !cacheFresh()) {
@@ -174,7 +247,7 @@ const docsCommand = defineCommand({
 		topic: {
 			type: "positional",
 			required: false,
-			description: "Topic to print (omit to list)"
+			description: "Topic to print (omit to list), or `search <terms…>`"
 		},
 		refresh: {
 			type: "boolean",
@@ -187,6 +260,23 @@ const docsCommand = defineCommand({
 		const topic = args.topic;
 		const latest = latestKnownVersion();
 		if (latest && compareSemver(version, latest) < 0) console.error(`Note: these docs describe CLI ${latest}; you have ${version} — commands or flags they mention may not exist here. Run \`canopy upgrade\`.\n`);
+		if (topic === "search") {
+			const query = args._.slice(1).join(" ").trim();
+			if (!query) throw new Error("Usage: canopy docs search <terms…>");
+			const hits = searchDocs(searchEntries(await listIndex(refresh)), query);
+			if (hits.length === 0) {
+				console.log(`No docs match "${query}". Run \`canopy docs\` to list all topics.`);
+				return;
+			}
+			const shown = hits.slice(0, SEARCH_LIMIT);
+			console.log(`${hits.length} doc${hits.length === 1 ? "" : "s"} match "${query}" — run \`canopy docs <topic>\` to read one:\n`);
+			for (const hit of shown) {
+				console.log(`${hit.slug} — ${hit.title}`);
+				for (const line of hit.lines) console.log(`    ${line}`);
+			}
+			if (hits.length > shown.length) console.log(`\n…and ${hits.length - shown.length} more — add terms to narrow it down.`);
+			return;
+		}
 		if (!topic) {
 			const index = await listIndex(refresh);
 			if (index.topics.length === 0) throw new Error("No docs available — check your connection, or reinstall the CLI.");

package/dist/{egress-PJp0SZy2.mjs → egress-D-Y0vANf.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-B1Px5y7q.mjs";
+import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/egress.ts
@@ -20,7 +20,7 @@ function printList({ mode, hosts, denied, enforced }, slug) {
 		console.log(`\nRecently blocked (allow with \`canopy egress allow <host>\`):`);
 		for (const d of denied) {
 			const why = d.reason === "rate_limited" ? "rate limited" : "blocked";
-			console.log(`  ${d.host}  ×${d.count}  ${why}, last ${d.last_seen}`);
+			console.log(`  ${d.host}  ×${d.count}  ${why}, last ${formatDateTime(d.last_seen)}`);
 		}
 	}
 	if (!enforced) console.error("(note: this site's target does not enforce egress yet — the policy is recorded for when it does)");
@@ -175,7 +175,7 @@ const egressCommand = defineCommand({
 					console.log(`No outbound traffic recorded for ${slug} yet.`);
 					return;
 				}
-				for (const v of visits) console.log(`${v.host}  ×${v.count}  last ${v.last_seen}`);
+				for (const v of visits) console.log(`${v.host}  ×${v.count}  last ${formatDateTime(v.last_seen)}`);
 			})
 		})
 	}

package/dist/{feedback-h_j6DBBZ.mjs → feedback-Dmrn3SW3.mjs}

@@ -1,6 +1,6 @@
-import { t as version } from "./package-CF0dX7UA.mjs";
+import { t as version } from "./package-X1HbEiNB.mjs";
 import { a as projectDirArgs, c as resolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { c as apiRequest, l as apiUpload, n as reportErrors, s as apiDownload } from "./ui-B1Px5y7q.mjs";
+import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 import { basename, extname, join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";
@@ -140,7 +140,7 @@ const showCommand = defineCommand({
 			return;
 		}
 		const { item, comments } = detail;
-		console.log(`${item.kind} · ${item.status} · via ${item.source} · ${item.created_at}`);
+		console.log(`${item.kind} · ${item.status} · via ${item.source} · ${formatDateTime(item.created_at)}`);
 		console.log(`reported by ${item.reporter_name || item.reporter_email || "unknown"}` + (item.deployment_id ? ` on ${item.deployment_id}` : "") + (item.channel === "staging" ? " (staging)" : ""));
 		console.log(`\n${item.body}\n`);
 		if (item.context) {
@@ -166,7 +166,7 @@ const showCommand = defineCommand({
 			const author = entry.author_name || entry.author_email || "unknown";
 			const move = entry.status_to ? `  [${entry.status_from} → ${entry.status_to}]` : "";
 			const internal = entry.internal ? "  [internal]" : "";
-			console.log(`--- ${author} · ${entry.created_at}${move}${internal}`);
+			console.log(`--- ${author} · ${formatDateTime(entry.created_at)}${move}${internal}`);
 			if (entry.body) console.log(entry.body);
 		}
 		if (args.download && shots.length > 0) {

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-CF0dX7UA.mjs";
+import { t as version } from "./package-X1HbEiNB.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BUlQR117.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -60,30 +60,30 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-BDTO3nVw.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-BDTO3nVw.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-BDTO3nVw.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-MMbv7MmK.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-MMbv7MmK.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-MMbv7MmK.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-MMbv7MmK.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-BqLvttKc.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-CnxJ4TE6.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-CnxJ4TE6.mjs").then((m) => m.promoteCommand),
-		staging: () => import("./staging-D8G4amjO.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-CnxJ4TE6.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-CnxJ4TE6.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-BUxgRJVA.mjs").then((m) => m.tokenCommand),
-		egress: () => import("./egress-PJp0SZy2.mjs").then((m) => m.egressCommand),
-		schedule: () => import("./schedule-Cq9K0rnE.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-h_j6DBBZ.mjs").then((m) => m.feedbackCommand),
-		db: () => import("./db-DKnJQPm5.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-DjNngyvy.mjs").then((m) => m.usageCommand),
-		open: () => import("./open-C5x3tX6I.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-BlzdYmou.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-DaaxgqEk.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-DG-7xwOs.mjs").then((m) => m.upgradeCommand),
-		logs: () => import("./logs-C53y2eAS.mjs").then((m) => m.logsCommand)
+		login: () => import("./login-CqM5bZNZ.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-CqM5bZNZ.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-CqM5bZNZ.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-C6tqDIV_.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-C6tqDIV_.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-C6tqDIV_.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-C6tqDIV_.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-DAyB0TRG.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-DLehZzUr.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-DLehZzUr.mjs").then((m) => m.promoteCommand),
+		staging: () => import("./staging-CL0Q2v6t.mjs").then((m) => m.stagingCommand),
+		rollback: () => import("./deploy-DLehZzUr.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-DLehZzUr.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-HAniLS_l.mjs").then((m) => m.tokenCommand),
+		egress: () => import("./egress-D-Y0vANf.mjs").then((m) => m.egressCommand),
+		schedule: () => import("./schedule-lZA3TPTm.mjs").then((m) => m.scheduleCommand),
+		feedback: () => import("./feedback-Dmrn3SW3.mjs").then((m) => m.feedbackCommand),
+		db: () => import("./db-DUVadyyv.mjs").then((m) => m.dbCommand),
+		usage: () => import("./usage-XCARqs3z.mjs").then((m) => m.usageCommand),
+		open: () => import("./open-BXP6rJ7R.mjs").then((m) => m.openCommand),
+		docs: () => import("./docs-DOopUT5k.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-Beg6Wyik.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-D297Aze4.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-DuQmfRoW.mjs").then((m) => m.logsCommand)
 	}
 });
 if (process.argv[2] !== "upgrade") notifyOfUpdate(version);

package/dist/{local-BQxsp-ZQ.mjs → local-zKGeU9o5.mjs}

@@ -1,6 +1,6 @@
-import { o as apiDataRequest } from "./ui-B1Px5y7q.mjs";
+import { s as apiDataRequest } from "./ui-BUBYpqoC.mjs";
 import { n as META_COLUMNS, r as blobRouter, t as dbRouter } from "./src-Bu4Ze32I.mjs";
-import { n as rewriteApiPath } from "./dev-CyJT6EfQ.mjs";
+import { n as rewriteApiPath } from "./dev-Bvqpc0zN.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";

package/dist/{login-BDTO3nVw.mjs → login-CqM5bZNZ.mjs}

@@ -1,5 +1,5 @@
 import { _ as getBakedProfile, d as clearAllProfileTokens, f as listBakedProfiles, g as writeConfigFile, h as upsertProfileAuth, m as setActiveProfile, n as siteConfig, p as readConfigFile, v as isProfileId } from "./site-BUlQR117.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-B1Px5y7q.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 import { createHash, randomBytes } from "node:crypto";

package/dist/{logs-C53y2eAS.mjs → logs-DuQmfRoW.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-B1Px5y7q.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 //#region src/logs.ts
 /**

package/dist/{migrations-C6EcKD6a.mjs → migrations-CuLRUDsH.mjs}

@@ -1,5 +1,5 @@
 import { u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { o as apiDataRequest } from "./ui-B1Px5y7q.mjs";
+import { s as apiDataRequest } from "./ui-BUBYpqoC.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-C5x3tX6I.mjs → open-BXP6rJ7R.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-BUlQR117.mjs";
-import { n as reportErrors, t as openBrowser } from "./ui-B1Px5y7q.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-CF0dX7UA.mjs → package-X1HbEiNB.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.15";
+var version = "0.7.17";
 //#endregion
 export { version as t };

package/dist/{projects-MMbv7MmK.mjs → projects-C6tqDIV_.mjs}

@@ -1,5 +1,5 @@
 import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty } from "./ui-B1Px5y7q.mjs";
+import { a as unwrap, i as requireTty, l as apiRequest, r as reportErrors } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/{schedule-Cq9K0rnE.mjs → schedule-lZA3TPTm.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-B1Px5y7q.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 //#region src/schedule.ts
 /**
@@ -13,7 +13,7 @@ function renderSchedules(schedules) {
 	const cronWidth = Math.max(...schedules.map((s) => s.cron.length));
 	return schedules.map((s) => {
 		const state = s.enabled ? "enabled " : "disabled";
-		const lastRun = s.last_run_at ? `last run ${s.last_run_at} ${s.last_status ?? ""}`.trimEnd() + (s.last_error ? ` (${s.last_error})` : "") : "never run";
+		const lastRun = s.last_run_at ? `last run ${formatDateTime(s.last_run_at)} ${s.last_status ?? ""}`.trimEnd() + (s.last_error ? ` (${s.last_error})` : "") : "never run";
 		return `${s.name.padEnd(nameWidth)}  ${s.cron.padEnd(cronWidth)}  ${state}  ${lastRun}`;
 	}).join("\n");
 }

package/dist/skill/canopy/SKILL.md

@@ -4,8 +4,9 @@ description: >-
   Build, run, and deploy projects on Canopy — Monks' managed platform for
   vibecoded apps (hosting + database + blob storage + AI). Use this whenever the
   user wants to create a Canopy project, run/deploy one, manage its data or
-  deploy tokens, or asks how to use the `canopy` CLI. All platform docs are
-  available offline via `canopy docs`.
+  deploy tokens, work a project's feedback inbox (reports/issues/bugs filed by
+  users — look one up, investigate, fix, resolve), or asks how to use the
+  `canopy` CLI. All platform docs are available offline via `canopy docs`.
 ---
 
 # Canopy
@@ -71,8 +72,9 @@ The CLI ships the full documentation and keeps it fresh from the platform. List
 the topics and read the relevant one _before_ running unfamiliar commands:
 
 ```bash
-canopy docs            # list all topics
-canopy docs deploy     # print one topic
+canopy docs                          # list all topics
+canopy docs deploy                   # print one topic
+canopy docs search egress allowlist  # find the topics that mention all terms
 ```
 
 The listing is grouped by section: guides (`getting-started`, `deploy`, `dev`,
@@ -97,9 +99,31 @@ and never go stale.
 - Open the live site: `canopy open`
 - Manage data: `canopy db pull | snapshot | snapshots | restore | migrate`
 - Work bug reports & feedback: `canopy feedback list | show | comment | status | report`
-  — see `canopy docs platform-feedback` for the triage and reporting loops
+  — see [Working feedback reports](#working-feedback-reports-issues) below
 - CI credentials: `canopy token create | list | revoke`
 
+## Working feedback reports (issues)
+
+Project members file bugs & feedback through the in-app widget; the CLI is how
+an agent works them. Report, issue, feedback item — same thing. Read
+`canopy docs platform-feedback` before triaging; it defines the loop. The
+short version:
+
+- `canopy feedback list --status investigate` shows what nobody has looked at;
+  `canopy feedback show <id>` has the body, captured context, and comment
+  trail. The context includes the deploy version that served the bug —
+  reproduce against that, not whatever is live now.
+- Investigated ≠ fixed: write findings with
+  `canopy feedback status <id> investigated --comment "<root cause>"`.
+- **`accepted` means a person said "build this."** Never set it on your own —
+  only when the user you're working with says to build the thing.
+- Put tech-heavy notes (stack traces, table names, root-cause detail) in an
+  internal comment (`canopy feedback comment <id> "…" --internal`) so they
+  never reach the reporter.
+- Resolve only once the fix is actually live, and name the version:
+  `canopy feedback status <id> resolved --comment "fixed in v42"`. Attach
+  proof when it's visual: `canopy feedback attach <id> ./after-fix.png`.
+
 ## Custom tables & migrations (devs; Drizzle recommended)
 
 The document API (`canopy.db.collection(…)`) needs no schema — prefer it. When
@@ -129,7 +153,7 @@ for it only when the app is genuinely trivial** — a page or two with light SDK
 use. Its SDK is served untyped from the platform (`/_api/data/v1/sdk.js`): no
 autocomplete, no type-checking, mistakes only show up in the browser.
 
-Prefer **`spa`** the moment either is true — which covers most real projects:
+Prefer **`spa`** over **`static`** the moment either is true — which covers most real projects:
 
 - **You lean on the SDK** (`db` queries, `blob`, `ai` — anything past a stray
   `auth.user()`). `spa` installs the SDK from npm (`@mediamonks/canopy`), fully

package/dist/{skill-DaaxgqEk.mjs → skill-Beg6Wyik.mjs}

@@ -1,18 +1,23 @@
-import { t as version } from "./package-CF0dX7UA.mjs";
-import { n as reportErrors } from "./ui-B1Px5y7q.mjs";
+import { t as version } from "./package-X1HbEiNB.mjs";
+import { r as reportErrors } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 //#region src/skill.ts
 /**
-* canopy skill install — write the Canopy agent skill into the current repo.
+* canopy skill install — write the Canopy agent skill for coding agents.
 *
-* To avoid vendor lock-in the skill lives in the tool-neutral `.agents/skills/`
-* tree, and `.claude/skills/canopy` is a symlink to it (so Claude Code picks it
-* up while other agents can read `.agents/`). The skill files are bundled with
-* the CLI (dist/skill in the published package, packages/cli/skill in dev), so
-* `canopy upgrade` re-runs this to keep the installed skill in sync.
+* Installs globally by default (`~/.agents/skills/canopy`, with
+* `~/.claude/skills/canopy` symlinked to it — Claude Code's user scope, so the
+* skill applies in every repo). `--repo` writes the same layout into the
+* current repo instead, for teams that want the skill committed with a
+* project. To avoid vendor lock-in the skill lives in the tool-neutral
+* `.agents/skills/` tree either way, and `.claude` is only a symlink. The
+* skill files are bundled with the CLI (dist/skill in the published package,
+* packages/cli/skill in dev), so `canopy upgrade` re-runs this to keep every
+* existing install — global and repo — in sync.
 */
 const SKILL_NAME = "canopy";
 const AGENTS_REL = join(".agents", "skills", SKILL_NAME);
@@ -64,18 +69,24 @@ function skillInstalled(root) {
 const skillCommand = defineCommand({
 	meta: {
 		name: "skill",
-		description: "Manage the Canopy agent skill in this repo"
+		description: "Manage the Canopy agent skill"
 	},
 	subCommands: { install: () => defineCommand({
 		meta: {
 			name: "install",
-			description: "Install/refresh the Canopy skill (.agents + .claude)"
+			description: "Install/refresh the Canopy skill — global by default, --repo for this repo"
 		},
-		run: reportErrors("skill install", async () => {
-			const { claudeMode } = installSkill(process.cwd());
-			console.log(`Installed the Canopy skill (v${version}):`);
-			console.log(`  .agents/skills/${SKILL_NAME}/   (source of truth)`);
-			console.log(claudeMode === "symlink" ? `  .claude/skills/${SKILL_NAME}    → symlink to .agents` : `  .claude/skills/${SKILL_NAME}    (copy — symlinks unavailable here)`);
+		args: { repo: {
+			type: "boolean",
+			description: "Install into the current repo (.agents + .claude here) instead of globally"
+		} },
+		run: reportErrors("skill install", async ({ args }) => {
+			const { claudeMode } = installSkill(args.repo ? process.cwd() : homedir());
+			const where = args.repo ? "into this repo" : "globally (~)";
+			const prefix = args.repo ? "" : "~/";
+			console.log(`Installed the Canopy skill ${where} (v${version}):`);
+			console.log(`  ${prefix}.agents/skills/${SKILL_NAME}/   (source of truth)`);
+			console.log(claudeMode === "symlink" ? `  ${prefix}.claude/skills/${SKILL_NAME}    → symlink to .agents` : `  ${prefix}.claude/skills/${SKILL_NAME}    (copy — symlinks unavailable here)`);
 			console.log("\nYour agent can now use Canopy. Try: canopy docs");
 		})
 	}) }

package/dist/{staging-D8G4amjO.mjs → staging-CL0Q2v6t.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-BUlQR117.mjs";
-import { c as apiRequest, i as unwrap, n as reportErrors, r as requireTty, u as withContext } from "./ui-B1Px5y7q.mjs";
+import { a as unwrap, d as withContext, i as requireTty, l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts
@@ -62,7 +62,7 @@ const stagingCommand = defineCommand({
 						message: "Version to serve on staging",
 						options: deploys.map((deploy) => ({
 							value: deploy.version,
-							label: `v${deploy.version}  ${deploy.created_at}  (${deploy.source})`,
+							label: `v${deploy.version}  ${formatDateTime(deploy.created_at)}  (${deploy.source})`,
 							hint: deploy.version === staged ? "staged" : deploy.version === live ? "live" : void 0
 						}))
 					}));

package/dist/{token-BUxgRJVA.mjs → token-HAniLS_l.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors } from "./ui-B1Px5y7q.mjs";
+import { l as apiRequest, r as reportErrors, t as formatDateTime } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {
@@ -42,7 +42,7 @@ const tokenCommand = defineCommand({
 					console.log(`No deploy tokens for ${slug} — create one with \`canopy token create\`.`);
 					return;
 				}
-				for (const t of tokens) console.log(`${t.id}  ${t.name ?? "(unnamed)"}  created ${t.created_at} by ${t.created_by ?? "?"}`);
+				for (const t of tokens) console.log(`${t.id}  ${t.name ?? "(unnamed)"}  created ${formatDateTime(t.created_at)} by ${t.created_by ?? "?"}`);
 			})
 		}),
 		revoke: defineCommand({

package/dist/{ui-B1Px5y7q.mjs → ui-BUBYpqoC.mjs}

@@ -383,6 +383,18 @@ function reportErrors(name, action) {
 function requireTty(hint) {
 	if (!process.stdin.isTTY) throw new Error(`This needs an interactive terminal — ${hint}`);
 }
+/**
+* API timestamps are UTC — ISO with a Z suffix, though a lagging API site may
+* still send the bare "YYYY-MM-DD HH:MM:SS" form. Parse either as UTC and
+* render compact local wall-clock time ("2026-08-25 14:23").
+*/
+function formatDateTime(raw) {
+	const hasZone = /(?:Z|[+-]\d{2}:?\d{2})$/i.test(raw);
+	const date = new Date(hasZone ? raw : raw.replace(" ", "T") + "Z");
+	if (Number.isNaN(date.getTime())) return raw;
+	const pad = (n) => String(n).padStart(2, "0");
+	return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
+}
 /** Open a URL in the default browser, fire-and-forget. */
 function openBrowser(url) {
 	spawn(process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open", [url], {
@@ -392,4 +404,4 @@ function openBrowser(url) {
 	}).on("error", () => {}).unref();
 }
 //#endregion
-export { ApiError as a, apiRequest as c, unwrap as i, apiUpload as l, reportErrors as n, apiDataRequest as o, requireTty as r, apiDownload as s, openBrowser as t, withContext as u };
+export { unwrap as a, apiDownload as c, withContext as d, requireTty as i, apiRequest as l, openBrowser as n, ApiError as o, reportErrors as r, apiDataRequest as s, formatDateTime as t, apiUpload as u };

package/dist/{upgrade-DG-7xwOs.mjs → upgrade-D297Aze4.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CcsA1QjI.mjs";
-import { n as reportErrors } from "./ui-B1Px5y7q.mjs";
+import { r as reportErrors } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,16 +112,27 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-DaaxgqEk.mjs");
-		const refreshSkill = skillInstalled(process.cwd());
+		const { skillInstalled } = await import("./skill-Beg6Wyik.mjs");
+		const { homedir } = await import("node:os");
+		const refreshGlobal = skillInstalled(homedir());
+		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());
 		console.log(`Upgrading via ${command}: ${command} ${cmd.join(" ")}`);
 		await run(command, cmd);
 		console.log(`\nDone. Run \`canopy --version\` to confirm.`);
-		if (refreshSkill) {
+		const warnSkill = (label) => (err) => {
+			console.warn(`Could not auto-refresh the ${label} skill (${err instanceof Error ? err.message : String(err)}). Run \`canopy skill install\` yourself.`);
+		};
+		if (refreshGlobal) {
+			console.log("Refreshing the global Canopy agent skill…");
+			await run("canopy", ["skill", "install"]).catch(warnSkill("global"));
+		}
+		if (refreshRepo) {
 			console.log("Refreshing the Canopy agent skill in this repo…");
-			await run("canopy", ["skill", "install"]).catch((err) => {
-				console.warn(`Could not auto-refresh the skill (${err instanceof Error ? err.message : String(err)}). Run \`canopy skill install\` yourself.`);
-			});
+			await run("canopy", [
+				"skill",
+				"install",
+				"--repo"
+			]).catch(warnSkill("repo"));
 		}
 	})
 });

package/dist/{usage-DjNngyvy.mjs → usage-XCARqs3z.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-BUlQR117.mjs";
-import { c as apiRequest, n as reportErrors, u as withContext } from "./ui-B1Px5y7q.mjs";
+import { d as withContext, l as apiRequest, r as reportErrors } from "./ui-BUBYpqoC.mjs";
 import { defineCommand } from "citty";
 //#region src/usage.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.15",
+  "version": "0.7.17",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"
@@ -20,8 +20,8 @@
     "esbuild": "^0.28.1",
     "hono": "^4.8.0",
     "vite-server": "npm:vite@^7",
-    "@mediamonks/canopy-data-plane": "0.0.4",
-    "@mediamonks/canopy": "0.0.5"
+    "@mediamonks/canopy": "0.0.5",
+    "@mediamonks/canopy-data-plane": "0.0.4"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/dist/dev-BqLvttKc.mjs

@@ -1,2 +0,0 @@
-import { t as devCommand } from "./dev-CyJT6EfQ.mjs";
-export { devCommand };