@mediamonks/canopy-cli 0.7.21 → 0.7.22

package/dist/docs/index.json

@@ -77,11 +77,6 @@
           "title": "CLI command reference",
           "summary": "Every canopy command, its flags, and what it does."
         },
-        {
-          "slug": "notifications",
-          "title": "Slack notifications",
-          "summary": "Canopy DMs you about your reports and projects — replies, new reports, blocked fetches, budget hits, failing schedules — and answers questions when you ask."
-        },
         {
           "slug": "static-serving",
           "title": "How static files are served",
@@ -129,6 +124,11 @@
           "title": "Google",
           "summary": "Let your project work with Google data — Sheets, Docs, Calendar, Drive, Gmail — without handling any OAuth yourself."
         },
+        {
+          "slug": "platform-slack",
+          "title": "Slack",
+          "summary": "Give your project its own Slack bot — Canopy creates and manages the app, your code handles the events."
+        },
         {
           "slug": "platform-members-and-access",
           "title": "Members & access",
@@ -139,6 +139,16 @@
           "title": "Feedback & bug reports",
           "summary": "A built-in feedback widget on every project, a ticket-lite inbox behind it, and a CLI that lets agents work the backlog."
         },
+        {
+          "slug": "platform-notifications",
+          "title": "Notifications",
+          "summary": "Canopy DMs you on Slack about your reports and projects — replies, new reports, blocked fetches, budget hits, failing schedules."
+        },
+        {
+          "slug": "platform-assistant",
+          "title": "The Canopy assistant",
+          "summary": "Ask questions about your projects and the platform in plain language — in Slack, or from the button in the corner of the docs and the dashboard."
+        },
         {
           "slug": "platform-client-access",
           "title": "Client access",
@@ -323,6 +333,11 @@
           "title": "Google",
           "summary": "Call Google APIs as the project's connected account or as the visitor's own — the platform holds the OAuth."
         },
+        {
+          "slug": "sdk-slack",
+          "title": "Slack",
+          "summary": "Handle your bot's events and slash commands in your worker, and post to Slack as the bot — no tokens in project code."
+        },
         {
           "slug": "sdk-services",
           "title": "Services",

package/dist/docs/platform-assistant.md

@@ -0,0 +1,50 @@
+---
+title: The Canopy assistant
+description: Ask questions about your projects and the platform in plain language — in Slack, or from the button in the corner of the docs and the dashboard.
+---
+
+Canopy has an assistant that answers questions about **your projects** and
+**how the platform works**. It reads the same things you can see — your
+projects, their deploys, reports, AI spend, egress log and schedules — plus
+these docs, and answers with a link to the guide it answered from.
+
+It can only read. It never deploys, rolls back, changes settings or touches
+your data; asked to, it points you at the dashboard or the `canopy` CLI.
+
+## Where to ask
+
+**In the docs and the dashboard.** The floating button in the bottom-right
+corner opens a choice: send feedback, or ask the assistant. Pick the second
+and type your question. The page you're on sets the context, so on a project's
+dashboard page "how many deploys today?" already knows which project you mean.
+
+Your conversation survives a reload — come back to the tab an hour later and
+it's still there. **New chat** clears it and starts over. Only one
+conversation is kept, and it lives in your own browser.
+
+**In Slack.** DM **Canopy**, or mention **@Canopy** in a channel. Same
+assistant, same answers. In a channel linked to a project it knows which
+project you mean; replying in a report's notification thread, it knows which
+report. See [Notifications](https://docs.canopy.website/platform/notifications).
+
+## What it's good at
+
+- **"Why is my fetch failing?"** — it checks the egress log and tells you
+  which host was blocked, and where to allow it.
+- **"What happened on my project today?"** — deploys, new reports, status
+  changes.
+- **"How do I promote staging to live?"** — it looks it up in these docs
+  rather than guessing.
+- **"What's the context on this report?"** — the body, the trail, and the
+  triage notes you're allowed to see.
+
+## What it can't do
+
+- **Change anything.** Read-only, by design.
+- **See projects you can't.** Every lookup runs as you: a project you're not
+  on simply doesn't resolve.
+- **Answer questions about your app's own content.** It knows Canopy and your
+  projects on it — not what's inside them.
+
+It runs on a small daily budget shared by everyone. On the rare day that runs
+out, it says so and comes back the next.

package/dist/docs/platform-feedback.md

@@ -18,6 +18,9 @@ boards.
 
 - Appears only for **signed-in Monks**. Client-password visitors never see it —
   the platform doesn't even send them the script.
+- On Canopy's own pages (these docs and the dashboard) the same button also
+  opens [the assistant](https://docs.canopy.website/platform/assistant); on your project it is a feedback
+  widget and nothing else.
 - On by default for every project. Turn it off per project in
   **Settings → Feedback widget**; the change applies on the next page load.
 - Submissions are always identified (your company sign-in), so there's no

package/dist/docs/{notifications.md → platform-notifications.md}

@@ -1,6 +1,6 @@
 ---
-title: Slack notifications
-description: Canopy DMs you about your reports and projects — replies, new reports, blocked fetches, budget hits, failing schedules — and answers questions when you ask.
+title: Notifications
+description: Canopy DMs you on Slack about your reports and projects — replies, new reports, blocked fetches, budget hits, failing schedules.
 ---
 
 Canopy sends you Slack DMs when something on the platform needs your
@@ -51,6 +51,10 @@ for that it points you at the dashboard or the CLI. In a channel that's
 linked to a project, it already knows which project you mean; replying in a
 report's notification thread, it knows which report.
 
+The same assistant answers from the button in the corner of these docs and
+the dashboard, if you'd rather not switch to Slack — see
+[The Canopy assistant](https://docs.canopy.website/platform/assistant).
+
 ## If DMs don't arrive
 
 The bot finds you by your work email. If your Slack account uses a different

package/dist/docs/platform-slack.md

@@ -0,0 +1,85 @@
+---
+title: Slack
+description: Give your project its own Slack bot — Canopy creates and manages the app, your code handles the events.
+---
+
+Your project can have its own Slack app: its own name and bot, in whatever
+workspace you choose. Canopy creates the app, keeps its settings in sync,
+holds every credential, and routes Slack's traffic to your backend. Your
+code never sees a bot token, a signing secret, or a webhook — it exports a
+handler and calls `canopy.slack`, both covered in
+[the SDK reference](https://docs.canopy.website/sdk/slack).
+
+Everything on this page happens on the project's **Services** tab.
+
+## One-time: your configuration token
+
+Creating Slack apps requires a Slack _app configuration token_, which is
+personal — it belongs to you, in one workspace. You set it up once and every
+project you manage shares it:
+
+1. Go to [api.slack.com/apps](https://api.slack.com/apps) and pick the
+   workspace your bots should live in — **that choice is baked into the
+   token**, and it's where every app you create will land.
+2. Under "Your App Configuration Tokens", generate a token and copy the
+   **refresh token** (the one starting `xoxe-1-`). The access token isn't
+   needed.
+3. Paste it into the token section of any project's Services tab and save.
+
+Canopy validates it against Slack, stores it encrypted, and keeps it fresh
+from then on — this is genuinely one-time. If it ever stops working (for
+example, it was revoked), existing bots keep running; only app-settings
+changes pause until you paste a fresh one.
+
+To create bots in a different workspace — a client's, say — generate a token
+for that workspace and save it. One workspace at a time per person.
+
+## Creating the app
+
+Name the bot, pick its features, create. Every app comes with a bot that can
+be invited to channels, post messages, and send people direct messages — the
+notification baseline, no options needed. On top of that:
+
+- **AI assistant** — people can chat with the bot: by @-mentioning it in
+  channels, in direct messages, and in Slack's assistant pane. Without it
+  the bot only sends; nobody can talk back. One caveat from Slack's side:
+  once on, it can't be turned off again.
+- **Slash commands** — each becomes a workspace command handled by your
+  backend. Command names aren't reserved per app, so pick ones another app
+  in the workspace isn't already using.
+
+## Installing to the workspace
+
+Creating the app doesn't put it in the workspace — installing does, and
+that's a human step by design: you approve the bot's permissions on Slack's
+own screen. Click **Install to workspace** and follow it through.
+
+If your workspace requires admin approval for new apps, the first attempt
+becomes an approval request instead. Once the admin approves (Slack DMs you
+about it), come back and click install again.
+
+The same button reappears whenever you change features in a way that needs
+new permissions — the card shows a clear warning when saved changes are
+waiting on a reinstall. Feature changes that don't widen permissions apply
+immediately.
+
+## Day to day
+
+- **The status line** shows where the app is installed and when Slack last
+  delivered something — the quickest "is it wired up" check.
+- **Enabled** is the kill switch: off, Slack traffic is accepted and
+  dropped, nothing reaches your code, and outbound sends are refused. The
+  app stays installed; flip it back anytime.
+- **Remove Slack app** deletes the app from the workspace too — bot,
+  commands, history access, all of it.
+
+Every message your project sends through the bot is counted per day, so a
+runaway loop is visible.
+
+## Local development
+
+Slack needs a public URL to deliver to, so `canopy dev` can't receive
+events or commands. Test inbound handling on a deployed project — a scratch
+project with a scratch bot works well — and unit-test your handler directly.
+Outbound (`canopy.slack.api`) works from `canopy dev` like any other SDK
+call.

package/dist/docs/sdk-slack.md

@@ -0,0 +1,132 @@
+---
+title: Slack
+description: Handle your bot's events and slash commands in your worker, and post to Slack as the bot — no tokens in project code.
+---
+
+Once your project has a Slack app ([set up on the Services
+tab](https://docs.canopy.website/platform/slack)), the integration is two halves: inbound events arrive
+at a `slack()` export in your worker, and outbound calls go through
+`canopy.slack`. The bot token and signing secret stay with the platform —
+Slack's signatures are verified before anything reaches your code.
+
+## The `slack()` handler
+
+Export it next to `fetch` and `scheduled`:
+
+```ts
+export default {
+  fetch(request, env) {
+    /* … */
+  },
+
+  async slack(event, env) {
+    if (event.kind === "command") {
+      return { response_type: "in_channel", text: `Running ${event.payload.command}…` };
+    }
+    // kind === "event": an @-mention, a DM, …
+  },
+};
+```
+
+**The event object:**
+
+- `kind` — `"event"` (Events API: `app_mention`, `message`, …) or
+  `"command"` (a slash command).
+- `payload` — Slack's payload, verbatim. For events that's the full
+  callback (the interesting part is `payload.event`); for commands it's the
+  command form fields (`command`, `text`, `channel_id`, `user_id`, …).
+- `responseUrl` — commands only: where a late reply can still be sent (see
+  below).
+- `user` — who triggered this, as Slack tells it: `{ id, name? }`. Present
+  whenever Slack names a person.
+- `teamId`, `appId` — which workspace and app this came from.
+- `retry` — set when Slack is redelivering. Delivery is at-least-once, so
+  handlers that create things should tolerate seeing an event twice.
+
+## Who is talking to the bot
+
+Two identities, at two trust levels:
+
+- **`env.USER`** is set when the bot lives in the Monks workspace and the
+  sender has a Canopy account: the same `{ sub, email, name }` your fetch
+  routes see for a signed-in visitor, so user-specific logic works the same
+  way. The mapping rides the corporate directory — Slack accounts and Canopy
+  sign-ins are the same people there.
+- In any other workspace — a client's, say — `env.USER` is `null` and
+  `event.user` is all you get: Slack's own word for who typed, nothing
+  Canopy has verified. Fine for personalising a reply; don't hang
+  authorization on it.
+
+Either way, payload text is written by whoever typed it in Slack — treat it
+as untrusted input. And SDK calls from the handler still run as the project
+itself (`canopy.auth.user()` reports kind `worker`), regardless of
+`env.USER`.
+
+## Answering a slash command
+
+Slack gives a command three seconds. Return quickly and Canopy relays your
+answer as the command's response:
+
+```ts
+async slack(event, env) {
+  if (event.kind === "command") {
+    return { response_type: "ephemeral", text: "Done." };
+  }
+}
+```
+
+Return a Slack message object, or a plain string (sent as ephemeral text).
+Return nothing and the command completes silently.
+
+If your handler needs longer — it queries something slow, calls a model —
+the command is acknowledged for you, and you answer afterwards through the
+`responseUrl`, which stays valid for 30 minutes:
+
+```ts
+if (event.kind === "command") {
+  const answer = await somethingSlow();
+  await canopy.slack.respond(event.responseUrl!, {
+    response_type: "in_channel",
+    text: answer,
+  });
+}
+```
+
+Events (`kind: "event"`) have no response channel — react by calling out,
+usually `chat.postMessage` back into the conversation the event names.
+
+## slack.api(method, args)
+
+Any [Slack Web API method](https://docs.slack.dev/reference/methods), called
+as your project's bot:
+
+```ts
+const result = await canopy.slack.api("chat.postMessage", {
+  channel: "C0123456789",
+  text: "Deploy finished.",
+});
+if (!result.ok) console.warn("slack said no:", result.error);
+```
+
+The response is Slack's own, `ok: false` included — check it for
+method-level outcomes like `channel_not_found` or `not_in_channel` (the bot
+can only post to channels it's been invited to, and to people's DMs).
+Workspace-management method families (`admin.*`, `tooling.*`, `apps.*`,
+`oauth.*`) are refused before Slack is ever contacted; everything else is
+bounded by the permissions the app was installed with.
+
+Backend and `canopy dev` only — pages can't call it, so a visitor can never
+act as your bot.
+
+## slack.respond(responseUrl, message)
+
+The late reply to a slash command, described above. `message` is a Slack
+message object or a plain string.
+
+## Errors
+
+Refusals arrive as thrown errors with stable codes: `slack_not_configured`
+(no app on this project), `slack_not_installed` (created but not installed
+to a workspace), `slack_disabled` (switched off on the Services tab), and
+`slack_method_not_allowed`. A network-level failure reaching Slack is
+`slack_api_error`.

package/dist/{docs-fiC6q9Ce.mjs → docs-c0CdeBxh.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-C_DLlB96.mjs";
+import { t as version } from "./package-BuwV_mje.mjs";
 import { n as siteConfig } from "./site-BFaWfSVu.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
 import { r as reportErrors } from "./ui--atbZ-TM.mjs";

package/dist/{feedback-CAwUHwWa.mjs → feedback-QhD8k6Ph.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-C_DLlB96.mjs";
+import { t as version } from "./package-BuwV_mje.mjs";
 import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-BFaWfSVu.mjs";
 import { c as apiDownload, l as apiRequest, r as reportErrors, t as formatDateTime, u as apiUpload } from "./ui--atbZ-TM.mjs";
 import { defineCommand } from "citty";
@@ -89,6 +89,10 @@ function firstLine(body) {
 	const line = body.split("\n")[0] ?? "";
 	return line.length > 72 ? `${line.slice(0, 71)}…` : line;
 }
+/** List label: the AI-written title when there is one, else the first line. */
+function itemLabel(item) {
+	return firstLine(item.title || item.body);
+}
 function printItems(items) {
 	if (items.length === 0) {
 		console.log("No matching feedback items.");
@@ -97,7 +101,7 @@ function printItems(items) {
 	for (const item of items) {
 		const comments = item.comment_count ? `  💬${item.comment_count}` : "";
 		const shots = item.attachment_count ? `  📎${item.attachment_count}` : "";
-		console.log(`${item.id}  ${item.status}  ${item.kind}  ${firstLine(item.body)}${comments}${shots}`);
+		console.log(`${item.id}  ${item.status}  ${item.kind}  ${itemLabel(item)}${comments}${shots}`);
 	}
 }
 const listCommand = defineCommand({
@@ -153,6 +157,7 @@ const showCommand = defineCommand({
 			return;
 		}
 		const { item, comments } = detail;
+		if (item.title) console.log(item.title);
 		console.log(`${item.kind} · ${item.status} · via ${item.source} · ${formatDateTime(item.created_at)}`);
 		console.log(`reported by ${item.reporter_name || item.reporter_email || "unknown"}` + (item.deployment_id ? ` on ${item.deployment_id}` : "") + (item.channel === "staging" ? " (staging)" : ""));
 		console.log(`\n${item.body}\n`);
@@ -276,7 +281,7 @@ const mineCommand = defineCommand({
 			console.log("You haven't filed any reports.");
 			return;
 		}
-		for (const item of items) console.log(`${item.id}  ${item.status}  ${item.kind}  [${item.project_slug}]  ${firstLine(item.body)}`);
+		for (const item of items) console.log(`${item.id}  ${item.status}  ${item.kind}  [${item.project_slug}]  ${itemLabel(item)}`);
 	})
 });
 const reportCommand = defineCommand({

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-C_DLlB96.mjs";
+import { t as version } from "./package-BuwV_mje.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-BFaWfSVu.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -60,9 +60,9 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-DRYaJcfT.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-DRYaJcfT.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-DRYaJcfT.mjs").then((m) => m.logoutCommand),
+		login: () => import("./login-BrEDKrb3.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-BrEDKrb3.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-BrEDKrb3.mjs").then((m) => m.logoutCommand),
 		create: () => import("./projects-1r5387ui.mjs").then((m) => m.createCommand),
 		init: () => import("./projects-1r5387ui.mjs").then((m) => m.initCommand),
 		projects: () => import("./projects-1r5387ui.mjs").then((m) => m.projectsCommand),
@@ -76,13 +76,13 @@ const main = defineCommand({
 		token: () => import("./token-C8Bmzwfl.mjs").then((m) => m.tokenCommand),
 		egress: () => import("./egress-BhbQfjjV.mjs").then((m) => m.egressCommand),
 		schedule: () => import("./schedule-DK_Cv6Xf.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-CAwUHwWa.mjs").then((m) => m.feedbackCommand),
+		feedback: () => import("./feedback-QhD8k6Ph.mjs").then((m) => m.feedbackCommand),
 		db: () => import("./db-TaSLpQZ5.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-CRpVLLi6.mjs").then((m) => m.usageCommand),
+		usage: () => import("./usage-C1-cvS2-.mjs").then((m) => m.usageCommand),
 		open: () => import("./open-D7f1wNn3.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-fiC6q9Ce.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-CmgMU2Iq.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-D1j0WV4l.mjs").then((m) => m.upgradeCommand),
+		docs: () => import("./docs-c0CdeBxh.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-BvoYCIKk.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-0lmdjvom.mjs").then((m) => m.upgradeCommand),
 		logs: () => import("./logs-Beqz--Df.mjs").then((m) => m.logsCommand)
 	}
 });