@mediamonks/canopy-cli 0.7.32 → 0.7.34

package/dist/repo-1RQ1vBMv.mjs

@@ -0,0 +1,2 @@
+import { i as repoCommand } from "./repo-Bb9ntNa4.mjs";
+export { repoCommand };

package/dist/repo-Bb9ntNa4.mjs

@@ -0,0 +1,423 @@
+import { a as projectDirArgs, c as resolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
+import { i as apiRequest, o as withContext } from "./api-C4rMhE7i.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";
+import { a as parseCredentialInput, i as helperCommand, o as runCredentialHelper, r as fileTokenCache, t as RepoCredentialError } from "./repo-credential-CNDRM-tG.mjs";
+import { defineCommand } from "citty";
+import { existsSync, realpathSync } from "node:fs";
+import { delimiter, join, resolve } from "node:path";
+import { execFile, spawn } from "node:child_process";
+import * as p from "@clack/prompts";
+//#region src/git.ts
+/**
+* The little git the CLI needs for Canopy git repositories (OpenSpec change
+* project-git-repos): find git, run it, and read or write a working copy's
+* local configuration. Only `canopy repo` (and `canopy create --repo`) use
+* it; nothing else in the CLI requires git to be installed.
+*/
+/** Run git and capture its output. Never throws on a non-zero exit. */
+function git(args, opts = {}) {
+	return new Promise((resolve, reject) => {
+		execFile("git", args, {
+			cwd: opts.cwd,
+			maxBuffer: 16 * 1024 * 1024
+		}, (err, stdout, stderr) => {
+			if (err && err.code === "ENOENT") {
+				reject(new GitNotFound());
+				return;
+			}
+			resolve({
+				code: err ? Number(err.code ?? 1) || 1 : 0,
+				stdout: String(stdout),
+				stderr: String(stderr)
+			});
+		});
+	});
+}
+/** Run git with its output on the user's terminal (clone progress and the like). */
+function gitInteractive(args, opts = {}) {
+	return new Promise((resolve, reject) => {
+		const child = spawn("git", args, {
+			cwd: opts.cwd,
+			stdio: "inherit"
+		});
+		child.on("error", (err) => reject(err.code === "ENOENT" ? new GitNotFound() : err));
+		child.on("close", (code) => resolve(code ?? 1));
+	});
+}
+var GitNotFound = class extends Error {
+	constructor() {
+		super("git is not installed (or not on your PATH). Install it from https://git-scm.com/downloads — on a Mac, `xcode-select --install` — and try again.");
+	}
+};
+/** Throws GitNotFound when git is missing; returns the version string otherwise. */
+async function requireGit() {
+	const { stdout } = await git(["--version"]);
+	return stdout.trim();
+}
+/** True when `dir` is inside a git working copy. */
+async function isWorkingCopy(dir) {
+	const { code, stdout } = await git(["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+	return code === 0 && stdout.trim() === "true";
+}
+/** The working copy's remotes, name → fetch URL. */
+async function remotes(dir) {
+	const { stdout } = await git(["remote", "-v"], { cwd: dir });
+	const out = /* @__PURE__ */ new Map();
+	for (const line of stdout.split("\n")) {
+		const match = /^(\S+)\s+(\S+)\s+\(fetch\)$/.exec(line.trim());
+		if (match) out.set(match[1], match[2]);
+	}
+	return out;
+}
+/** Replace every value of a key in the local configuration with `values`, in order. */
+async function setLocalConfig(dir, key, values) {
+	const unset = await git([
+		"config",
+		"--local",
+		"--unset-all",
+		key
+	], { cwd: dir });
+	if (unset.code !== 0 && unset.code !== 5) throw new Error(`git config --unset-all ${key} failed: ${unset.stderr.trim()}`);
+	for (const value of values) {
+		const add = await git([
+			"config",
+			"--local",
+			"--add",
+			key,
+			value
+		], { cwd: dir });
+		if (add.code !== 0) throw new Error(`git config --add ${key} failed: ${add.stderr.trim()}`);
+	}
+}
+//#endregion
+//#region src/repo.ts
+/**
+* canopy repo — the project's git repository (OpenSpec change
+* project-git-repos).
+*
+* A project has at most one repository: a Canopy repository, which Canopy
+* keeps for it, or one it links. For a Canopy repository:
+*
+*  - `create`  makes it, then sets up the current folder when it is the project;
+*  - `clone`   clones it into a new folder;
+*  - `connect` sets up an existing folder;
+*  - `show`    says which repository the project has (`--json` for agents);
+*  - `delete`  removes it and its history (owner only).
+*
+* Setting up a folder points a remote at the repository and registers
+* `canopy repo credential` as git's credential helper for that one
+* repository. No token is ever written
+* into the folder or its git configuration; git asks the helper on each fetch
+* and push, and it hands over a short-lived token for the CLI sign-in.
+*/
+/** Plain words for the API's repository errors. */
+const REPO_FIXES = {
+	repos_not_configured: "Git repositories are not available on this site yet. Use your own GitHub repository instead.",
+	repo_exists: "This project already has a repository — `canopy repo show` says which.",
+	repo_already_linked: "This project is linked to its own GitHub repository; a project has one repository.",
+	repo_name_taken: "A leftover repository with this name exists on the git host. Ask a platform admin to remove it, then try again.",
+	owner_only: "Only the project owner can delete its repository.",
+	no_repo: "This project has no Canopy repository — create one with `canopy repo create`."
+};
+const fetchRepo = (slug) => withContext(apiRequest("GET", `/projects/${slug}/repo`), {
+	action: `read ${slug}'s repository`,
+	fixes: REPO_FIXES
+});
+/**
+* How git should start this CLI for the credential helper: the `canopy` (or
+* `canopy-dev`) on PATH when it is this very install, so upgrades keep
+* working; otherwise this node binary and script, by absolute path.
+*/
+function cliInvocation() {
+	const script = realpathSync(process.argv[1]);
+	for (const dir of (process.env["PATH"] ?? "").split(delimiter)) for (const name of ["canopy", "canopy-dev"]) {
+		const candidate = join(dir, name);
+		try {
+			if (existsSync(candidate) && realpathSync(candidate) === script) return [candidate];
+		} catch {}
+	}
+	return [process.execPath, script];
+}
+/** The git config lines that route this repository's credentials to the helper. */
+function credentialConfig(gitUrl, profile, slug) {
+	const section = `credential.${gitUrl}`;
+	return [[`${section}.helper`, ["", helperCommand(cliInvocation(), profile, slug, gitUrl)]], [`${section}.useHttpPath`, ["true"]]];
+}
+function currentProfile() {
+	const profile = siteConfig().profileId;
+	if (!profile) throw new Error("Git repositories need a named site — pass --profile main, staging or gcp-pilot.");
+	return profile;
+}
+function requireCanopyRepo(slug, repo) {
+	if (repo.kind === "canopy") return repo;
+	if (repo.kind === "linked") throw new Error(`${slug} is linked to ${repo.linked_repository}; use that repository with your own git credentials.`);
+	throw new Error(`${slug} has no repository yet — create one with \`canopy repo create\`.`);
+}
+/**
+* Set up `dir` as a working copy of the project's Canopy repository: a git
+* repository if it isn't one, the remote (`origin`, or `canopy` when origin
+* points elsewhere) and the credential helper. Returns the remote's name.
+*/
+async function connectFolder(dir, slug, repo) {
+	await requireGit();
+	if (!await isWorkingCopy(dir)) {
+		const init = await git([
+			"init",
+			"-q",
+			"-b",
+			"main"
+		], { cwd: dir });
+		if (init.code !== 0) throw new Error(`git init failed: ${init.stderr.trim()}`);
+	}
+	const existing = await remotes(dir);
+	let name = "origin";
+	const already = [...existing].find(([, url]) => url === repo.remote);
+	if (already) name = already[0];
+	else {
+		if (existing.has("origin")) name = "canopy";
+		if (existing.has(name)) throw new Error(`This folder already has a remote named "${name}" pointing elsewhere (${existing.get(name)}). Remove or rename it, then run \`canopy repo connect\` again.`);
+		const add = await git([
+			"remote",
+			"add",
+			name,
+			repo.remote
+		], { cwd: dir });
+		if (add.code !== 0) throw new Error(`git remote add failed: ${add.stderr.trim()}`);
+	}
+	for (const [key, values] of credentialConfig(repo.remote, currentProfile(), slug)) await setLocalConfig(dir, key, values);
+	return name;
+}
+const showCommand = defineCommand({
+	meta: {
+		name: "show",
+		description: "Show the project's git repository"
+	},
+	args: {
+		...projectDirArgs,
+		json: {
+			type: "boolean",
+			default: false,
+			description: "Print JSON (for scripts and agents)"
+		}
+	},
+	run: reportErrors("repo show", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		const repo = await fetchRepo(slug);
+		if (args.json) {
+			console.log(JSON.stringify(repo, null, 2));
+			return;
+		}
+		if (repo.kind === "none") console.log(`${slug} has no git repository. Create one with \`canopy repo create\`.`);
+		else if (repo.kind === "linked") console.log(`${slug} is linked to ${repo.linked_repository}.`);
+		else {
+			console.log(`${slug} has a Canopy git repository.`);
+			console.log(`  remote     ${repo.remote}`);
+			console.log(`  created    ${repo.created_at ? formatDateTime(repo.created_at) : "—"}`);
+			console.log(`  last push  ${repo.last_push_at ? formatDateTime(repo.last_push_at) : "never"}`);
+			console.log(`\nClone it with \`canopy repo clone ${slug}\`.`);
+		}
+	})
+});
+const createCommand = defineCommand({
+	meta: {
+		name: "create",
+		description: "Create a Canopy git repository for the project"
+	},
+	args: { ...projectDirArgs },
+	run: reportErrors("repo create", async ({ args }) => {
+		const { dir, slug } = resolveProject(args);
+		const repo = await withContext(apiRequest("POST", `/projects/${slug}/repo`), {
+			action: `create a git repository for ${slug}`,
+			fixes: REPO_FIXES
+		});
+		p.log.success(`Created a git repository for ${slug}.`);
+		if (tryReadCanopyJson(dir)?.slug === slug) {
+			const remote = await connectFolder(dir, slug, repo);
+			p.log.info(`This folder pushes to it as "${remote}". Commit and push as usual:`);
+			console.log(`  git add -A && git commit -m "Initial commit" && git push -u ${remote} main`);
+		} else p.log.info(`Clone it with \`canopy repo clone ${slug}\`.`);
+	})
+});
+const connectCommand = defineCommand({
+	meta: {
+		name: "connect",
+		description: "Set up a folder to push to the project's Canopy git repository"
+	},
+	args: { ...projectDirArgs },
+	run: reportErrors("repo connect", async ({ args }) => {
+		const { dir, slug } = resolveProject(args);
+		const remote = await connectFolder(dir, slug, requireCanopyRepo(slug, await fetchRepo(slug)));
+		p.log.success(`This folder now pushes to ${slug}'s repository as "${remote}".`);
+	})
+});
+const cloneCommand = defineCommand({
+	meta: {
+		name: "clone",
+		description: "Clone a project's Canopy git repository"
+	},
+	args: {
+		slug: {
+			type: "positional",
+			description: "Project slug",
+			required: true
+		},
+		target: {
+			type: "positional",
+			description: "Folder to clone into (defaults to the slug)",
+			required: false
+		}
+	},
+	run: reportErrors("repo clone", async ({ args }) => {
+		const slug = args.slug;
+		const repo = requireCanopyRepo(slug, await fetchRepo(slug));
+		await requireGit();
+		const target = resolve(args.target ?? slug);
+		const code = await gitInteractive([
+			"clone",
+			...credentialConfig(repo.remote, currentProfile(), slug).flatMap(([key, values]) => values.flatMap((value) => ["-c", `${key}=${value}`])),
+			repo.remote,
+			target
+		]);
+		if (code !== 0) throw new Error(`git clone failed (exit ${code}).`);
+		p.log.success(`Cloned ${slug} into ${target}.`);
+	})
+});
+const deleteCommand = defineCommand({
+	meta: {
+		name: "delete",
+		description: "Delete the project's Canopy git repository and its history"
+	},
+	args: {
+		...projectDirArgs,
+		yes: {
+			type: "boolean",
+			default: false,
+			description: "Skip the type-the-slug confirmation"
+		}
+	},
+	run: reportErrors("repo delete", async ({ args }) => {
+		const { slug } = resolveProject(args);
+		if (!args.yes) {
+			requireTty("pass --yes to delete without confirmation.");
+			if (unwrap(await p.text({ message: `Delete ${slug}'s git repository and all its history? Type the slug to confirm.` })).trim() !== slug) {
+				p.cancel("Aborted.");
+				return;
+			}
+		}
+		await withContext(apiRequest("DELETE", `/projects/${slug}/repo`), {
+			action: `delete ${slug}'s git repository`,
+			fixes: REPO_FIXES
+		});
+		p.log.success(`Deleted ${slug}'s git repository.`);
+	})
+});
+/** Exchange this site's CLI sign-in for a repository token (never a deploy token). */
+async function mintRepoToken(profile, slug) {
+	const config = siteConfig();
+	const login = `run \`canopy login --profile ${profile}\``;
+	if (!config.token) throw new RepoCredentialError(`not signed in to ${profile} — ${login}.`);
+	const path = `/projects/${encodeURIComponent(slug)}/repo/token`;
+	const res = await fetch(`${config.apiUrl}/control/v1${path}`, {
+		method: "POST",
+		headers: { authorization: `Bearer ${config.token}` }
+	}).catch(() => null);
+	if (!res) throw new RepoCredentialError(`could not reach Canopy (${config.apiUrl}).`);
+	if (res.status === 201) return await res.json();
+	const body = await res.json().catch(() => ({}));
+	if (res.status === 401) throw new RepoCredentialError(`your ${profile} sign-in has expired — ${login}.`);
+	if (res.status === 404) throw new RepoCredentialError(`you don't have access to ${slug}'s repository (or it no longer exists).`);
+	throw new RepoCredentialError(body.detail ?? body.error ?? `Canopy answered HTTP ${res.status}.`);
+}
+const credentialCommand = defineCommand({
+	meta: {
+		name: "credential",
+		description: "git credential helper (set up by clone/connect)",
+		hidden: true
+	},
+	args: {
+		action: {
+			type: "positional",
+			description: "get | store | erase",
+			required: true
+		},
+		project: {
+			type: "string",
+			description: "Project slug",
+			required: true
+		},
+		url: {
+			type: "string",
+			description: "Repository URL git talks to",
+			required: true
+		}
+	},
+	run: async ({ args }) => {
+		const profile = siteConfig().profileId;
+		const input = parseCredentialInput(await readStdin());
+		const out = profile ? await runCredentialHelper(args.action, input, {
+			cacheKey: `${profile}/${args.project}`,
+			repoUrl: args.url,
+			cache: fileTokenCache(),
+			mint: () => mintRepoToken(profile, args.project)
+		}) : {
+			stdout: "quit=1\n",
+			stderr: "canopy: this repository's site is unknown — run `canopy repo connect` again.\n"
+		};
+		process.stderr.write(out.stderr);
+		process.stdout.write(out.stdout);
+	}
+});
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8");
+}
+const repoCommand = defineCommand({
+	meta: {
+		name: "repo",
+		description: "The project's git repository (clone, connect, create)"
+	},
+	subCommands: {
+		show: showCommand,
+		clone: cloneCommand,
+		connect: connectCommand,
+		create: createCommand,
+		delete: deleteCommand,
+		credential: credentialCommand
+	}
+});
+/** Whether this site offers Canopy git repositories (the `repos` capability). */
+async function reposAvailable() {
+	const platform = await apiRequest("GET", "/platform").catch(() => null);
+	return Boolean(platform?.capabilities?.repos);
+}
+/**
+* The repository step of `canopy create` (design D-H). `--repo` creates one,
+* `--no-repo` doesn't; otherwise an interactive run is asked (default no) when
+* the site offers repositories and the folder doesn't already push to GitHub.
+* A repository that can't be created never fails the project creation.
+* Returns the remote name when the folder was set up.
+*/
+async function offerRepoOnCreate(slug, dir, flag) {
+	if (flag === false) return null;
+	if (flag === void 0) {
+		if (!process.stdin.isTTY || !await reposAvailable()) return null;
+		const origin = await isWorkingCopy(dir).catch(() => false) ? (await remotes(dir)).get("origin") : void 0;
+		if (origin && /github\.com[:/]/.test(origin)) return null;
+		if (!unwrap(await p.confirm({
+			message: "Create a git repository for this project on Canopy?",
+			initialValue: false
+		}))) return null;
+	}
+	try {
+		return await connectFolder(dir, slug, await withContext(apiRequest("POST", `/projects/${slug}/repo`), {
+			action: `create a git repository for ${slug}`,
+			fixes: REPO_FIXES
+		}));
+	} catch (err) {
+		p.log.warn(`The project was created, but its git repository wasn't: ${err instanceof Error ? err.message : String(err)}\nTry again later with \`canopy repo create\`.`);
+		return null;
+	}
+}
+//#endregion
+export { repoCommand as i, connectFolder as n, offerRepoOnCreate as r, cliInvocation as t };

package/dist/repo-credential-CNDRM-tG.mjs

@@ -0,0 +1,118 @@
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+/** Why no token could be had — shown to the user, then git is told to quit. */
+var RepoCredentialError = class extends Error {};
+const REPO_TOKEN_CACHE_PATH = join(homedir(), ".canopy", "repo-tokens.json");
+/** The on-disk cache: one JSON object, owner-only. */
+function fileTokenCache(path = REPO_TOKEN_CACHE_PATH) {
+	const read = () => {
+		try {
+			return JSON.parse(readFileSync(path, "utf8"));
+		} catch {
+			return {};
+		}
+	};
+	const write = (all) => {
+		mkdirSync(dirname(path), {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(path, `${JSON.stringify(all, null, 2)}\n`, { mode: 384 });
+		chmodSync(path, 384);
+	};
+	return {
+		get: (key) => read()[key],
+		set: (key, value) => write({
+			...read(),
+			[key]: value
+		}),
+		delete: (key) => {
+			const all = read();
+			if (!(key in all)) return;
+			delete all[key];
+			write(all);
+		}
+	};
+}
+/** `canopy logout` forgets every cached repository token. */
+function clearRepoTokenCache(path = REPO_TOKEN_CACHE_PATH) {
+	rmSync(path, { force: true });
+}
+/** git's credential protocol: `key=value` lines, terminated by a blank line or EOF. */
+function parseCredentialInput(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		if (line === "") break;
+		const eq = line.indexOf("=");
+		if (eq > 0) out.set(line.slice(0, eq), line.slice(eq + 1));
+	}
+	return out;
+}
+const normalize = (url) => url.replace(/\/+$/, "").replace(/\.git$/, "");
+/** Whether git is asking about exactly the repository this helper was registered for. */
+function requestMatches(input, repoUrl) {
+	const protocol = input.get("protocol");
+	const host = input.get("host");
+	const path = input.get("path");
+	if (protocol !== "https" || !host || !path) return false;
+	return normalize(`${protocol}://${host}/${path}`) === normalize(repoUrl);
+}
+/** Answer one git credential request. */
+async function runCredentialHelper(action, input, opts) {
+	const now = opts.now ?? Date.now;
+	if (!requestMatches(input, opts.repoUrl)) return {
+		stdout: "",
+		stderr: ""
+	};
+	if (action === "erase") {
+		opts.cache.delete(opts.cacheKey);
+		return {
+			stdout: "",
+			stderr: ""
+		};
+	}
+	if (action !== "get") return {
+		stdout: "",
+		stderr: ""
+	};
+	let token = opts.cache.get(opts.cacheKey);
+	if (!token || Date.parse(token.expires_at) - now() <= 3e5) {
+		try {
+			token = await opts.mint();
+		} catch (err) {
+			opts.cache.delete(opts.cacheKey);
+			return {
+				stdout: "quit=1\n",
+				stderr: `canopy: ${err instanceof RepoCredentialError ? err.message : String(err)}\n`
+			};
+		}
+		opts.cache.set(opts.cacheKey, token);
+	}
+	const expiry = Math.floor(Date.parse(token.expires_at) / 1e3);
+	return {
+		stdout: `username=x-access-token\npassword=${token.token}\npassword_expiry_utc=${expiry}\n`,
+		stderr: ""
+	};
+}
+/**
+* The shell command git runs for the helper, as written into
+* `credential.<url>.helper`. Absolute paths, so GUI git clients without the
+* user's PATH still find it.
+*/
+function helperCommand(cli, profile, slug, repoUrl) {
+	const quote = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+	return `!${[
+		...cli.map(quote),
+		"repo",
+		"credential",
+		"--profile",
+		quote(profile),
+		"--project",
+		quote(slug),
+		"--url",
+		quote(repoUrl)
+	].join(" ")}`;
+}
+//#endregion
+export { parseCredentialInput as a, helperCommand as i, clearRepoTokenCache as n, runCredentialHelper as o, fileTokenCache as r, RepoCredentialError as t };

package/dist/skill/canopy/SKILL.md

@@ -97,6 +97,12 @@ and never go stale.
   (own database cloned from live; `canopy staging status | sync | destroy`)
 - Roll back: `canopy rollback`
 - Open the live site: `canopy open`
+- **Look at a deployed project in your own browser** (Playwright, a browser
+  tool, curl): `canopy browse <slug> --json` prints a one-time sign-in link
+  (`--staging`, `--path /page`). Open it within a minute; that browser is
+  then signed in to that one project, as the user, for an hour. On a sign-in
+  page later, run it again. Never ask the user for their session cookie
+  (`canopy docs agent-browsing`).
 - Manage data: `canopy db pull | snapshot | snapshots | restore | migrate`
 - Use AI (`canopy.ai`): run `canopy ai models` before naming a model in code.
   Prefer the aliases `auto/low` (default) / `auto/mid` / `auto/high` over
@@ -104,6 +110,11 @@ and never go stale.
 - Work bug reports & feedback: `canopy feedback list | show | comment | status | report`
   — see [Working feedback reports](#working-feedback-reports-issues) below
 - CI credentials: `canopy token create | list | revoke`
+- Git: `canopy repo show --json` (is there a repository, and its remote) ·
+  `canopy repo create` · `canopy repo clone <slug>` · `canopy repo connect`
+  (set up an existing folder). Then plain `git`: the CLI gives git
+  short-lived credentials itself, so never ask for, paste or store a git
+  token. Pushing doesn't deploy — `canopy deploy` does.
 
 ## Working feedback reports (issues)
 
@@ -183,7 +194,8 @@ Non-interactive: `canopy create "My App" --template spa`. **When unsure between
 
 ## Safety rules
 
-- **Destructive commands** — `canopy db restore` and `canopy delete` wipe data.
+- **Destructive commands** — `canopy db restore`, `canopy delete` and
+  `canopy repo delete` (the project's git history) wipe data.
   Confirm intent with the user first, and take a `canopy db snapshot` before
   restores.
 - **Deploys are public.** `canopy deploy` makes a version live. Confirm before

package/dist/{skill-CM7R-4Bq.mjs → skill-DfSAZ2cW.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-YGjjin4p.mjs";
+import { t as version } from "./package-Doigafvd.mjs";
 import { r as reportErrors } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

package/dist/{src-BkACMkol.mjs → src-DE37PKho.mjs}

@@ -857,7 +857,11 @@ const AGENT_CREDENTIAL_HEADER = "x-canopy-agent-credential";
 */
 const CALLER_HEADER = "x-canopy-caller";
 /** Cookies that authenticate to Canopy itself — the monk session and the client-page session. */
-const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set(["canopy_session", "canopy_client"]);
+const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set([
+	"canopy_session",
+	"canopy_client",
+	"canopy_agent"
+]);
 /**
 * Strip Canopy's own credentials from a request before untrusted project code
 * sees it (R-01).
@@ -870,7 +874,7 @@ const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set(["canopy_session", "canopy_c
 *
 * Redaction is surgical on purpose: an app's own cookies and its own
 * Authorization scheme survive, because those belong to the app. Only
-* `canopy_session` / `canopy_client` and a `cnpy_` bearer are removed.
+* `canopy_session` / `canopy_client` / `canopy_agent` and a `cnpy_` bearer are removed.
 *
 * `env.CANOPY.fetch` still authenticates as the visitor — the host passes it
 * the unredacted headers — so nothing about the platform-facing behaviour

package/dist/templates/spa/AGENTS.md

@@ -35,6 +35,19 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
   `canopy promote` ships the exact tested version. Never promote with failing
   checks.
 
+## Git
+
+Code can live in a git repository Canopy keeps for the project (no GitHub
+account needed). `canopy repo show --json` says whether there is one and gives
+its remote; `canopy repo create` makes one, `canopy repo clone <slug>` or
+`canopy repo connect` sets a folder up. After that it is plain `git` — the CLI
+hands git short-lived credentials by itself:
+
+- Never ask for, paste or store a git token or password.
+- Pushing doesn't deploy — `canopy deploy` still does.
+- The `.github/workflows` file here only runs on GitHub; on a Canopy
+  repository it is kept but never runs.
+
 ## Boundaries
 
 - Do not add auth — the platform authenticates every request before it

package/dist/templates/spa/_gitignore

@@ -2,3 +2,7 @@ node_modules/
 dist/
 .canopy/
 .DS_Store
+# Local secrets never go into git (secrets belong in `canopy secrets`).
+.dev.vars
+.env*
+!.env.example

package/dist/templates/static/AGENTS.md

@@ -34,6 +34,17 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
   `canopy promote` ships the exact tested version. Never promote with failing
   checks.
 
+## Git
+
+Code can live in a git repository Canopy keeps for the project (no GitHub
+account needed). `canopy repo show --json` says whether there is one and gives
+its remote; `canopy repo create` makes one, `canopy repo clone <slug>` or
+`canopy repo connect` sets a folder up. After that it is plain `git` — the CLI
+hands git short-lived credentials by itself:
+
+- Never ask for, paste or store a git token or password.
+- Pushing doesn't deploy — `canopy deploy` still does.
+
 ## Boundaries
 
 - Do not add auth — the platform authenticates every request before it

package/dist/templates/static/_gitignore

@@ -1,2 +1,6 @@
 .canopy/
 .DS_Store
+# Local secrets never go into git (secrets belong in `canopy secrets`).
+.dev.vars
+.env*
+!.env.example

package/dist/templates/worker/AGENTS.md

@@ -51,6 +51,19 @@ the [Canopy dashboard](https://dashboard.thanarie.dev).
   `canopy promote` ships the exact tested version. Never promote with failing
   checks.
 
+## Git
+
+Code can live in a git repository Canopy keeps for the project (no GitHub
+account needed). `canopy repo show --json` says whether there is one and gives
+its remote; `canopy repo create` makes one, `canopy repo clone <slug>` or
+`canopy repo connect` sets a folder up. After that it is plain `git` — the CLI
+hands git short-lived credentials by itself:
+
+- Never ask for, paste or store a git token or password.
+- Pushing doesn't deploy — `canopy deploy` still does.
+- The `.github/workflows` file here only runs on GitHub; on a Canopy
+  repository it is kept but never runs.
+
 ## Boundaries
 
 - Do not add auth — the platform authenticates every request before it