@mediamonks/canopy-cli 0.7.33 → 0.7.35

package/dist/browse-Dycwj0V_.mjs

@@ -0,0 +1,89 @@
+import { d as tryResolveProject, n as siteConfig } from "./site-DM2J10CB.mjs";
+import { i as apiRequest, t as ApiError } from "./api-C4rMhE7i.mjs";
+import { defineCommand } from "citty";
+//#region src/browse.ts
+/**
+* canopy browse — a one-time sign-in link to a project for an agent's
+* browser (agent-browse-sessions). Opening it within a minute gives that
+* browser an hour on this one project and channel, as the signed-in Monk;
+* nothing else on Canopy. The link is the only thing printed: no cookie, no
+* token, nothing written to disk, and no browser opened (that is `canopy open`).
+*/
+var BrowseError = class extends Error {
+	name = "BrowseError";
+};
+/** The control plane's refusal, in words that say what to do about it. */
+function explainBrowseRefusal(code, slug, detail) {
+	switch (code) {
+		case "members_only": return `${slug} is limited to its collaborators — ask the owner to add you.`;
+		case "project_not_found": return `There is no project ${slug} on this site — check the slug and --profile.`;
+		case "project_paused": return `${slug} is paused.`;
+		case "project_moved": return `${slug} has moved${detail ? ` (${detail})` : ""}.`;
+		case "staging_not_enabled": return `${slug} has no staging channel yet — drop --staging, or create it with \`canopy deploy --staging\`.`;
+		case "invalid_path": return "--path must be a page on the project, starting with / (for example /settings).";
+		case "cli_session_required": return "Browse links need your own CLI sign-in, not a deploy token — run `canopy login`.";
+		case "not_configured": return "This site has no public project hostnames, so it can't hand out browse links.";
+		default: return detail ? `${code}: ${detail}` : code;
+	}
+}
+const browseCommand = defineCommand({
+	meta: {
+		name: "browse",
+		description: "Print a one-time sign-in link to a project for an agent's browser"
+	},
+	args: {
+		slug: {
+			type: "positional",
+			description: "Project slug (defaults to canopy.json in the current directory)",
+			required: false
+		},
+		staging: {
+			type: "boolean",
+			default: false,
+			description: "Link to the staging channel instead of live"
+		},
+		path: {
+			type: "string",
+			description: "Page to land on after signing in (default /)"
+		},
+		json: {
+			type: "boolean",
+			default: false,
+			description: "Print only { url, expires_at } as JSON"
+		}
+	},
+	async run({ args }) {
+		try {
+			const slug = tryResolveProject({ project: args.slug }).slug;
+			if (!slug) throw new BrowseError("No project named — pass a slug (`canopy browse <slug>`) or run from a project directory.");
+			if (process.env["CANOPY_DEPLOY_TOKEN"]) throw new BrowseError("Browse links use your own sign-in, not a deploy token — unset CANOPY_DEPLOY_TOKEN and run `canopy login`.");
+			if (!siteConfig().token) throw new BrowseError("Not signed in to this site — run `canopy login` first.");
+			let link;
+			try {
+				link = await apiRequest("POST", `/projects/${slug}/browse-ticket`, {
+					channel: args.staging ? "staging" : "live",
+					...args.path !== void 0 && { path: args.path }
+				});
+			} catch (err) {
+				if (err instanceof ApiError && err.status !== 401) throw new BrowseError(explainBrowseRefusal(err.code, slug, err.detail));
+				throw err;
+			}
+			if (args.json) {
+				process.stdout.write(`${JSON.stringify({
+					url: link.url,
+					expires_at: link.expires_at
+				})}\n`);
+				return;
+			}
+			console.log(`\n  ${link.url}\n`);
+			console.log("  Open it within a minute; it works once. The browser that opens it is signed in to");
+			console.log(`  ${slug}${args.staging ? " (staging)" : ""} as you for an hour, and to nothing else on Canopy.\n`);
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			process.stderr.write(`canopy browse: ${message}\n`);
+			process.exitCode = 1;
+		}
+	}
+});
+//#endregion
+export { browseCommand };

package/dist/dev-CID2LCES.mjs

@@ -0,0 +1,2 @@
+import { n as devCommand } from "./dev-oS4nYMSn.mjs";
+export { devCommand };

package/dist/{dev-CkhBnSlv.mjs → dev-oS4nYMSn.mjs}

@@ -2,12 +2,13 @@ import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as sit
 import { i as apiRequest, o as withContext, t as ApiError } from "./api-C4rMhE7i.mjs";
 import { r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";
 import { r as readMigrationFiles } from "./migrations-Czlcddyz.mjs";
-import { r as stampWorkerHeaders } from "./src-BkACMkol.mjs";
+import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER } from "./src-CxzGOEhP.mjs";
 import { n as writeDevServerRecord } from "./dev-server-file-Dk9pk4AR.mjs";
 import { createRequire } from "node:module";
 import { defineCommand } from "citty";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
+import { randomBytes } from "node:crypto";
 import { pathToFileURL } from "node:url";
 //#region src/dev.ts
 /**
@@ -33,14 +34,14 @@ function workerDialect(flags) {
 * gateway serves it in production (dev-worker.ts). Returns the plugin plus
 * the notice lines to print, or undefined when the project has no worker.
 */
-async function workerPlugin(flags, slug) {
+async function workerPlugin(flags, slug, workerAttest) {
 	const entry = tryReadCanopyJson(flags.dir)?.worker;
 	if (entry === void 0) return void 0;
 	if (!existsSync(join(flags.dir, entry))) {
 		console.log(`note: canopy.json points "worker" at ${entry}, which does not exist — skipping.`);
 		return;
 	}
-	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-CaCsGBkn.mjs");
+	const { missingSecretNames, readDevVars, workerDevPlugin } = await import("./dev-worker-CpSB_Okh.mjs");
 	const secrets = readDevVars(flags.dir);
 	const email = siteConfig().email;
 	const plugin = workerDevPlugin({
@@ -54,7 +55,8 @@ async function workerPlugin(flags, slug) {
 			email,
 			name: "Local Dev"
 		} : null,
-		dialect: workerDialect(flags)
+		dialect: workerDialect(flags),
+		workerAttest
 	});
 	const notes = [`  /api/* is served by ${entry} (edit and refresh; no build step)`];
 	if (Object.keys(secrets).length > 0) notes.push(`  worker secrets from .dev.vars: ${Object.keys(secrets).sort().join(", ")}`);
@@ -168,6 +170,8 @@ async function bridgeToSandbox(sandbox, req, res) {
 	const headers = new Headers();
 	if (req.headers["content-type"]) headers.set("content-type", req.headers["content-type"]);
 	if (req.headers["accept"]) headers.set("accept", req.headers["accept"]);
+	const attest = req.headers[WORKER_ATTEST_HEADER];
+	if (typeof attest === "string") headers.set(WORKER_ATTEST_HEADER, attest);
 	const response = await sandbox.handle(new Request(`http://canopy.local${req.url ?? ""}`, {
 		method: req.method,
 		headers,
@@ -225,7 +229,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-DAYCNUyz.mjs");
+		const { fetchProjectDump } = await import("./local-Cc8H3NUw.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -240,12 +244,14 @@ async function devLocal(flags, slug) {
 		const reason = err instanceof ApiError ? err.explain().why : String(err);
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
-	const { createSandbox } = await import("./local-DAYCNUyz.mjs");
+	const workerAttest = randomBytes(24).toString("base64url");
+	const { createSandbox } = await import("./local-Cc8H3NUw.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),
 		email: siteConfig().email,
-		dialect: flags.dialect
+		dialect: flags.dialect,
+		workerAttest
 	});
 	if (dump !== void 0) {
 		await sandbox.applyDump(dump);
@@ -276,7 +282,7 @@ async function devLocal(flags, slug) {
 		headers: { authorization: `Bearer ${remote.token}` },
 		rewrite: rewriteApiPath
 	};
-	const worker = await workerPlugin(flags, slug);
+	const worker = await workerPlugin(flags, slug, workerAttest);
 	const server = await startVite(flags, { proxy: {
 		...remoteEntry && {
 			"/_api/data/v1/ai": remoteEntry,

package/dist/{dev-worker-CaCsGBkn.mjs → dev-worker-CpSB_Okh.mjs}

@@ -1,4 +1,4 @@
-import { n as redactCanopyCredentials, r as stampWorkerHeaders, t as CALLER_HEADER } from "./src-BkACMkol.mjs";
+import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER, r as redactCanopyCredentials, t as CALLER_HEADER } from "./src-CxzGOEhP.mjs";
 import { readFileSync } from "node:fs";
 import { relative, resolve, sep } from "node:path";
 //#region src/dev-worker.ts
@@ -97,7 +97,7 @@ function rewriteCanopyUrl(raw, base) {
 * dev server's `/_api` mount so the running mode decides what answers.
 * Credentials stay in the proxy; nothing here carries a token.
 */
-function createCanopyFetch(apiBase, slug, channel, fetchImpl = fetch) {
+function createCanopyFetch(apiBase, slug, channel, fetchImpl = fetch, workerAttest) {
 	return async (input, init) => {
 		const url = rewriteCanopyUrl(typeof input === "string" ? input : input instanceof URL ? input.href : input.url, apiBase());
 		const headers = stampWorkerHeaders(new Headers(input instanceof Request ? input.headers : init?.headers), {
@@ -106,6 +106,8 @@ function createCanopyFetch(apiBase, slug, channel, fetchImpl = fetch) {
 		});
 		headers.delete("authorization");
 		headers.delete("cookie");
+		if (workerAttest) headers.set(WORKER_ATTEST_HEADER, workerAttest);
+		else headers.delete(WORKER_ATTEST_HEADER);
 		const method = (input instanceof Request ? input.method : init?.method) ?? "GET";
 		const body = input instanceof Request ? input.body : init?.body;
 		const outbound = {
@@ -263,7 +265,7 @@ async function sendResponse(res, response) {
 function workerDevPlugin(options) {
 	const moduleId = entryModuleId(options.dir, options.entry);
 	let apiBase = "";
-	const canopyFetch = createCanopyFetch(() => apiBase, options.slug, options.channel);
+	const canopyFetch = createCanopyFetch(() => apiBase, options.slug, options.channel, fetch, options.workerAttest);
 	return {
 		name: "canopy-project-worker",
 		configureServer(server) {

package/dist/docs/agent-browsing.md

@@ -0,0 +1,58 @@
+---
+title: Let your agent browse a project
+description: Give an AI agent's browser a short sign-in to one project, so it can look at and click through your app as you.
+---
+
+Coding agents often need to see the app they're working on: check that a page renders, click through a flow, or read what a screen shows. Every Canopy project sits behind the Monks sign-in, which an agent can't get through on its own.
+
+`canopy browse` gives the agent a way in that doesn't involve handing over your own browser session:
+
+```bash
+canopy browse my-app --json
+```
+
+It prints a one-time link. Whatever browser opens it is signed in to **my-app**, as you, for **an hour**, and to nothing else on Canopy.
+
+## What the agent gets
+
+- **One project, one channel.** The live site, or staging with `--staging`. The browser is not signed in to your other projects, or to the dashboard.
+- **You.** The app sees you as the visitor, exactly as when you open it yourself. Your backend's `env.USER` is you, and data you can see, the agent can see. On a collaborators-only project you have to be a collaborator.
+- **An hour.** After that the agent meets the sign-in page and can run `canopy browse` again.
+- **Marked as an agent.** Your backend can tell the request came from an agent: `mcpCaller(request, env).agent` from `@mediamonks/canopy/mcp` is `true`.
+
+The link itself works **once**, within **a minute**. Opening it a second time shows a page saying to run `canopy browse` again.
+
+## Using it from different tools
+
+**Playwright, or a browser tool in your agent:** open the URL. The browser is redirected to the page and stays signed in.
+
+```ts
+await page.goto(url); // lands on the project, signed in
+```
+
+**curl:** keep the cookie in a jar and follow the redirect.
+
+```bash
+curl -c jar.txt -L "$(canopy browse my-app --json | jq -r .url)"
+curl -b jar.txt https://my-app.canopy.website/api/notes
+```
+
+**A specific page:** `canopy browse my-app --path /settings` lands there directly.
+
+## Stopping it
+
+The agent's session ends when the hour is up. It also ends early if you:
+
+- run `canopy logout`,
+- revoke that CLI sign-in on your Account page in the dashboard, or
+- sign out everywhere.
+
+If you lose access to a collaborators-only project, the agent loses it too.
+
+## Good to know
+
+- Your project's backend needs a redeploy after this feature shipped before an agent can call its `/api/*` routes. Until then those calls answer "redeploy required", while pages still load.
+- The feedback widget doesn't appear for agents.
+- Never give an agent your own browser session cookie. It opens every project and the dashboard, as you.
+
+See also [canopy browse](https://docs.canopy.website/cli/browse), and [Agent tools](https://docs.canopy.website/guides/agent-tools) for letting agents call your backend directly.

package/dist/docs/cli-browse.md

@@ -0,0 +1,48 @@
+---
+title: canopy browse
+description: Print a one-time sign-in link that lets an agent's browser open a project as you.
+---
+
+`canopy browse` prints a link for an AI agent's browser: Playwright, a browser tool in Claude or Cursor, or plain `curl`. Opening the link signs that browser in to **one project**, as you, for **one hour**. It reaches nothing else on Canopy: no other projects, and not the dashboard.
+
+Read [Let your agent browse a project](https://docs.canopy.website/guides/agent-browsing) for the full picture.
+
+## Usage
+
+```bash
+canopy browse [slug] [--staging] [--path <page>] [--json]
+```
+
+## Arguments & flags
+
+- `[slug]` — the project. Defaults to the `canopy.json` in the current directory.
+- `--staging` — link to the project's [staging channel](https://docs.canopy.website/guides/staging) instead of the live site.
+- `--path <page>` — the page to land on after signing in, such as `/settings`. Defaults to `/`.
+- `--json` — print only `{ "url", "expires_at" }`, for an agent to read.
+
+The site comes from the active profile, as for every command (`--profile staging` links to the project on the staging site).
+
+## How it works
+
+The command uses your `canopy login` sign-in to ask Canopy for a link to the project, under the same rules as opening it yourself. Collaborators-only projects only give links to collaborators.
+
+- The link **works once** and **expires after a minute**. Run the command again for a new one.
+- The browser that opens it is signed in to that project and channel for an hour. After that it sees the sign-in page again.
+- Running `canopy logout`, revoking the CLI sign-in on your Account page, or signing out everywhere also signs the agent out.
+- The command never opens a browser itself (that's [canopy open](https://docs.canopy.website/cli/open)), never prints a cookie, and saves nothing.
+
+## Examples
+
+```bash
+canopy browse my-app --json
+```
+
+Prints `{"url":"https://my-app.…/__canopy/agent-login?ticket=…","expires_at":"…"}`. Hand the URL to your agent's browser.
+
+```bash
+canopy browse --staging --path /admin
+```
+
+A link to the staging channel of the project in this folder, landing on `/admin`.
+
+See also [canopy mcp](https://docs.canopy.website/cli/mcp), which lets agents call your project's backend as tools instead of using its pages.

package/dist/docs/cli-dev.md

@@ -25,9 +25,9 @@ canopy dev --local --pull       # sandbox hydrated from a fresh prod export
 
 ## How it works
 
-**Remote-first (default).** The CLI mints a short-lived, project-scoped dev token from the platform, then starts Vite with a proxy: every `/_api/*` request is forwarded to the real platform API with that token attached. The token stays inside the proxy — browser code never holds a credential. When the token expires (the expiry is printed at startup), restart `canopy dev`. Because you're on live data, the startup banner suggests `canopy db snapshot` before risky changes, or switching to `--local --pull`.
+**Remote-first (default).** The CLI mints a short-lived, project-scoped dev token from the platform, then starts Vite with a proxy: every `/_api/*` request is forwarded to the real platform API with that token attached. The token stays inside the proxy — browser code never holds a credential. When the token expires (the expiry is printed at startup), restart `canopy dev`. Because every call from your browser carries that token, the `private_` rule doesn't apply to your own pages in this mode; use `--local` to test it. Because you're on live data, the startup banner suggests `canopy db snapshot` before risky changes, or switching to `--local --pull`.
 
-**Local sandbox (`--local`).** Database, file, and auth requests are answered entirely on your machine, from a sandbox stored under `.canopy/local/` in the project directory — no database to install, and writes never reach the platform. The sandbox behaves the same as the real API, so code that works locally works deployed. Two things still go remote: `ai` and `services` calls go through to the real platform (metered as usual) when you're logged in — fully offline, they return errors until you log in and restart.
+**Local sandbox (`--local`).** Database, file, and auth requests are answered entirely on your machine, from a sandbox stored under `.canopy/local/` in the project directory — no database to install, and writes never reach the platform. The sandbox behaves the same as the real API, so code that works locally works deployed. That includes [`private_` collections and tables](https://docs.canopy.website/sdk/database): your pages get the same refusal they would get deployed, while your worker keeps full access. The one setting it doesn't copy is **Browser access** on the Data tab: locally, pages always get read and write. Two things still go remote: `ai` and `services` calls go through to the real platform (metered as usual) when you're logged in — fully offline, they return errors until you log in and restart.
 
 **Matching your site's SQL dialect.** The document API (`canopy.db.collection(…)`) behaves identically everywhere, but raw `canopy.db.sql()` speaks your site's dialect — SQLite or Postgres (see [dialect()](https://docs.canopy.website/guides/data)). The sandbox defaults to Postgres. If your project uses raw SQL written for a SQLite site, lock the dialect in `canopy.json`:
 

package/dist/docs/index.json

@@ -77,6 +77,11 @@
           "title": "Agent tools (MCP)",
           "summary": "Let AI agents like Claude Code and Cursor use your project's backend as tools — as the person running them."
         },
+        {
+          "slug": "agent-browsing",
+          "title": "Let your agent browse a project",
+          "summary": "Give an AI agent's browser a short sign-in to one project, so it can look at and click through your app as you."
+        },
         {
           "slug": "porting-nextjs",
           "title": "Porting a Next.js app",
@@ -311,6 +316,11 @@
           "title": "canopy open",
           "summary": "Open the deployed project in your browser."
         },
+        {
+          "slug": "cli-browse",
+          "title": "canopy browse",
+          "summary": "Print a one-time sign-in link that lets an agent's browser open a project as you."
+        },
         {
           "slug": "cli-docs",
           "title": "canopy docs",

package/dist/docs/platform-google.md

@@ -210,6 +210,14 @@ Disconnecting also tells Google the grant is over, so access stops immediately
 rather than lingering. Visitors can drop their own connection with
 `canopy.google.user().disconnect()`.
 
+## Daily limit
+
+Each project can make 10,000 Google calls a day. Calls Google turns down count
+too. Once a project reaches its limit, further calls fail until the count starts
+over at midnight UTC. The **Usage** tab shows today's count, the limit, and when
+it resets. If your project needs more, ask the Canopy team; they can raise the
+limit for your project.
+
 ## Local development
 
 `canopy dev` uses the real connections, so Google works the same on your

package/dist/docs/sdk-database.md

@@ -141,6 +141,9 @@ the dashboard (or `canopy db access` from the terminal):
   `collection("private_notes")` get a 403. Raw SQL cannot be checked table by
   table, so while your database holds any `private_` name, `db.sql()` from a
   page is refused too; use collections there, or run the SQL in the worker.
+  `canopy dev --local` applies the same rule, so you can test it on your
+  laptop. Plain `canopy dev` doesn't: your browser shares the dev server's
+  token there.
 
 Everyone who opens the app gets the same rule — colleagues signed in with
 OneLogin and, if you turned on [client access](https://docs.canopy.website/platform/client-access),

package/dist/{docs-BP5jmD10.mjs → docs-CGrXLl7G.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-CQIPmdcO.mjs";
+import { t as version } from "./package-BOXNJrWP.mjs";
 import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
 import { r as reportErrors } from "./ui-C_jSc1Kz.mjs";

package/dist/{feedback-5oPSxAz0.mjs → feedback-CrmDfqmZ.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-CQIPmdcO.mjs";
+import { t as version } from "./package-BOXNJrWP.mjs";
 import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
 import { a as apiUpload, i as apiRequest, r as apiDownload } from "./api-C4rMhE7i.mjs";
 import { r as reportErrors, t as formatDateTime } from "./ui-C_jSc1Kz.mjs";

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-CQIPmdcO.mjs";
+import { t as version } from "./package-BOXNJrWP.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-DM2J10CB.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -20,6 +20,7 @@ import { defineCommand, runMain } from "citty";
 *   ai models             the site's AI models and auto/* aliases
 *   mcp add|serve         a project's tools for AI agents (docs/49)
 *   open                  open the deployed project / dashboard   [phase 1]
+*   browse                one-time sign-in link for an agent's browser
 */
 if (process.env["CANOPY_UPDATE_REFRESH"] === "1") {
 	await runRefresh();
@@ -69,7 +70,7 @@ const main = defineCommand({
 		init: () => import("./projects-DQAhCZm8.mjs").then((m) => m.initCommand),
 		projects: () => import("./projects-DQAhCZm8.mjs").then((m) => m.projectsCommand),
 		delete: () => import("./projects-DQAhCZm8.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-MoHHjQh1.mjs").then((m) => m.devCommand),
+		dev: () => import("./dev-CID2LCES.mjs").then((m) => m.devCommand),
 		deploy: () => import("./deploy-Ka2lHkyy.mjs").then((m) => m.deployCommand),
 		promote: () => import("./deploy-Ka2lHkyy.mjs").then((m) => m.promoteCommand),
 		staging: () => import("./staging-BZVty57b.mjs").then((m) => m.stagingCommand),
@@ -79,16 +80,17 @@ const main = defineCommand({
 		egress: () => import("./egress-If_Gsx_M.mjs").then((m) => m.egressCommand),
 		secrets: () => import("./secrets-BSEjZnxg.mjs").then((m) => m.secretsCommand),
 		schedule: () => import("./schedule-C5lMf3ny.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-5oPSxAz0.mjs").then((m) => m.feedbackCommand),
+		feedback: () => import("./feedback-CrmDfqmZ.mjs").then((m) => m.feedbackCommand),
 		db: () => import("./db-BB6O6085.mjs").then((m) => m.dbCommand),
 		usage: () => import("./usage-CUYrWxv0.mjs").then((m) => m.usageCommand),
 		ai: () => import("./ai-DHLnyqfq.mjs").then((m) => m.aiCommand),
 		open: () => import("./open-DcaQKi1v.mjs").then((m) => m.openCommand),
-		docs: () => import("./docs-BP5jmD10.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-Dg7dQF0k.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-huJDjhrV.mjs").then((m) => m.upgradeCommand),
+		browse: () => import("./browse-Dycwj0V_.mjs").then((m) => m.browseCommand),
+		docs: () => import("./docs-CGrXLl7G.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-GPJrYL61.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-DSTg2cgu.mjs").then((m) => m.upgradeCommand),
 		logs: () => import("./logs-DQQOawOG.mjs").then((m) => m.logsCommand),
-		mcp: () => import("./mcp-DXfTYVN_.mjs").then((m) => m.mcpCommand),
+		mcp: () => import("./mcp-DAaO4SQc.mjs").then((m) => m.mcpCommand),
 		repo: () => import("./repo-1RQ1vBMv.mjs").then((m) => m.repoCommand)
 	}
 });

package/dist/{local-DAYCNUyz.mjs → local-Cc8H3NUw.mjs}

@@ -1,10 +1,54 @@
 import { n as apiDataRequest } from "./api-C4rMhE7i.mjs";
-import { a as dbRouter, i as realtimeRouter, o as META_COLUMNS, s as blobRouter } from "./src-BkACMkol.mjs";
-import { i as rewriteApiPath } from "./dev-CkhBnSlv.mjs";
+import { a as realtimeRouter, c as META_COLUMNS, l as blobRouter, n as WORKER_ATTEST_HEADER, o as dbRouter, s as hasPrivateNames } from "./src-CxzGOEhP.mjs";
+import { i as rewriteApiPath } from "./dev-oS4nYMSn.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";
 import { Hono } from "hono";
+//#region ../data-plane/src/db-access.ts
+/** The worker-only marker: `private_` at the start of a collection or table name. */
+const PRIVATE_PREFIX = "private_";
+const isPrivateName = (name) => name.startsWith(PRIVATE_PREFIX);
+const CHANGE_HINT = "Change it under Data in the dashboard, or move this call into the worker.";
+/** The policy matrix. Only meaningful for callers where isBrowserOnProject() is true. */
+function decideBrowserDbAccess(level, op) {
+	if (level === "off") return {
+		allow: false,
+		error: "browser_db_access",
+		detail: `Browser access to this project's database is off. ${CHANGE_HINT}`
+	};
+	if ((op.kind === "read" || op.kind === "write") && isPrivateName(op.collection)) return {
+		allow: false,
+		error: "private_collection",
+		detail: `"${op.collection}" is a private_ collection — only the project's worker can use it.`
+	};
+	if (op.kind === "sql") {
+		if (op.privateTables) return {
+			allow: false,
+			error: "private_tables_present",
+			detail: "This project has private_ tables or collections, so raw SQL is not available from the browser. Use collections here, or run the SQL in the worker."
+		};
+		if (level === "readonly") {
+			if (op.readonly === false) return {
+				allow: false,
+				error: "browser_db_access",
+				detail: `Browser access to this project's database is read-only. ${CHANGE_HINT}`
+			};
+			return {
+				allow: true,
+				forceReadonly: true
+			};
+		}
+		return { allow: true };
+	}
+	if (op.kind === "write" && level === "readonly") return {
+		allow: false,
+		error: "browser_db_access",
+		detail: `Browser access to this project's database is read-only. ${CHANGE_HINT}`
+	};
+	return { allow: true };
+}
+//#endregion
 //#region ../data-plane/src/dialect-postgres.ts
 /**
 * Postgres doc-store dialect (Cloud SQL, PGlite). Same table shape as SQLite
@@ -778,6 +822,7 @@ async function createPgliteDb(persistDir) {
 			const tables = (await db.query(`SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename`)).rows;
 			for (const { tablename } of tables) await db.exec(`DROP TABLE IF EXISTS "${tablename.replaceAll("\"", "\"\"")}" CASCADE`);
 		},
+		withoutForeignKeys: (fn) => fn(),
 		close: () => db.close()
 	};
 }
@@ -811,6 +856,14 @@ async function createSqliteDb(persistDir) {
 			for (const name of listTables(`sql LIKE 'CREATE VIRTUAL TABLE%'`)) db.exec(`DROP TABLE IF EXISTS "${name.replaceAll("\"", "\"\"")}"`);
 			for (const name of listTables(`name NOT LIKE 'sqlite_%'`)) db.exec(`DROP TABLE IF EXISTS "${name.replaceAll("\"", "\"\"")}"`);
 		},
+		withoutForeignKeys: async (fn) => {
+			db.exec("PRAGMA foreign_keys = OFF");
+			try {
+				return await fn();
+			} finally {
+				db.exec("PRAGMA foreign_keys = ON");
+			}
+		},
 		close: async () => {
 			db.close();
 		}
@@ -827,10 +880,25 @@ async function createSandbox(options) {
 		const requested = c.req.header("x-canopy-project") ?? c.req.query("project");
 		return requested === void 0 || requested === options.slug ? null : c.json({ error: "project_not_found" }, 404);
 	};
-	app.route("/data/v1", dbRouter({ store: async (c) => ownProject(c) ?? {
-		store,
-		dialect
-	} }));
+	app.route("/data/v1", dbRouter({
+		store: async (c) => ownProject(c) ?? {
+			store,
+			dialect
+		},
+		guard: async (c, op, resolved) => {
+			const attest = c.req.header(WORKER_ATTEST_HEADER);
+			if (options.workerAttest && attest === options.workerAttest) return void 0;
+			const decision = decideBrowserDbAccess("full", op.kind === "sql" ? {
+				kind: "sql",
+				readonly: op.readonly,
+				privateTables: await hasPrivateNames(resolved.store, resolved.dialect.name, PRIVATE_PREFIX)
+			} : op);
+			return decision.allow ? void 0 : c.json({
+				error: decision.error,
+				detail: decision.detail
+			}, 403);
+		}
+	}));
 	app.route("/data/v1", blobRouter({
 		store: async (c) => ownProject(c) ?? {
 			slug: options.slug,
@@ -900,15 +968,17 @@ async function createSandbox(options) {
 		return app.fetch(new Request(`http://sandbox${pathname}${url.search}`, request));
 	}
 	async function applyDump(sql) {
-		await db.reset();
-		for (const statement of splitSqlStatements(sql)) {
-			if (/^(BEGIN|COMMIT|ROLLBACK|SET\s+search_path|PRAGMA)\b/i.test(statement)) continue;
-			try {
-				await db.exec(statement);
-			} catch (err) {
-				throw new Error(`Dump statement failed: ${err instanceof Error ? err.message : String(err)}\n  in: ${statement.slice(0, 120)}${statement.length > 120 ? "…" : ""}`);
+		await db.withoutForeignKeys(async () => {
+			await db.reset();
+			for (const statement of splitSqlStatements(sql)) {
+				if (/^(BEGIN|COMMIT|ROLLBACK|SET\s+search_path|PRAGMA)\b/i.test(statement)) continue;
+				try {
+					await db.exec(statement);
+				} catch (err) {
+					throw new Error(`Dump statement failed: ${err instanceof Error ? err.message : String(err)}\n  in: ${statement.slice(0, 120)}${statement.length > 120 ? "…" : ""}`);
+				}
 			}
-		}
+		});
 		await rebuildFtsIndex(store, dialect);
 	}
 	return {

package/dist/{mcp-DXfTYVN_.mjs → mcp-DAaO4SQc.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-CQIPmdcO.mjs";
+import { t as version } from "./package-BOXNJrWP.mjs";
 import { d as tryResolveProject, l as stagingUrl, n as siteConfig, s as projectUrl } from "./site-DM2J10CB.mjs";
 import { i as apiRequest, t as ApiError } from "./api-C4rMhE7i.mjs";
 import { t as liveDevServer } from "./dev-server-file-Dk9pk4AR.mjs";

package/dist/{package-CQIPmdcO.mjs → package-BOXNJrWP.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.33";
+var version = "0.7.35";
 //#endregion
 export { version as t };

package/dist/skill/canopy/SKILL.md

@@ -97,6 +97,12 @@ and never go stale.
   (own database cloned from live; `canopy staging status | sync | destroy`)
 - Roll back: `canopy rollback`
 - Open the live site: `canopy open`
+- **Look at a deployed project in your own browser** (Playwright, a browser
+  tool, curl): `canopy browse <slug> --json` prints a one-time sign-in link
+  (`--staging`, `--path /page`). Open it within a minute; that browser is
+  then signed in to that one project, as the user, for an hour. On a sign-in
+  page later, run it again. Never ask the user for their session cookie
+  (`canopy docs agent-browsing`).
 - Manage data: `canopy db pull | snapshot | snapshots | restore | migrate`
 - Use AI (`canopy.ai`): run `canopy ai models` before naming a model in code.
   Prefer the aliases `auto/low` (default) / `auto/mid` / `auto/high` over

package/dist/{skill-Dg7dQF0k.mjs → skill-GPJrYL61.mjs}

@@ -1,4 +1,4 @@
-import { t as version } from "./package-CQIPmdcO.mjs";
+import { t as version } from "./package-BOXNJrWP.mjs";
 import { r as reportErrors } from "./ui-C_jSc1Kz.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";

package/dist/{src-BkACMkol.mjs → src-CxzGOEhP.mjs}

@@ -292,6 +292,21 @@ async function introspectSchema(store, dialect) {
 		tables
 	};
 }
+/**
+* Does the database hold any table or doc collection whose name starts with
+* `prefix`? Two cheap probes — the browser-SQL guard (canopy-api, docs/35)
+* asks this on every page-originated raw-SQL call, so it must not walk the
+* schema. `prefix` is interpolated as a LIKE pattern; callers pass a fixed
+* identifier fragment (`private_`), never user input.
+*/
+async function hasPrivateNames(store, dialect, prefix) {
+	const pattern = lit(`${prefix.replaceAll("_", "\\_")}%`);
+	const [table, collection] = await Promise.all([store.query(dialect === "postgres" ? `SELECT 1 AS found FROM information_schema.tables
+              WHERE table_schema = current_schema() AND table_type = 'BASE TABLE'
+                AND table_name LIKE ${pattern} ESCAPE '\\' LIMIT 1` : `SELECT 1 AS found FROM sqlite_master
+              WHERE type = 'table' AND name LIKE ${pattern} ESCAPE '\\' LIMIT 1`).then((r) => r.results.length > 0), store.query(`SELECT 1 AS found FROM _canopy_docs WHERE collection LIKE ${pattern} ESCAPE '\\' LIMIT 1`).then((r) => r.results.length > 0).catch(() => false)]);
+	return table || collection;
+}
 //#endregion
 //#region ../data-plane/src/db.ts
 /**
@@ -844,6 +859,12 @@ const IDENTITY_STAMP_HEADERS = [
 	"x-canopy-user-name"
 ];
 /**
+* Header carrying the project's worker token as runtime-origin proof (docs/35).
+* The data plane verifies it to exempt the worker from browser DB access even
+* when the worker is acting as a visitor (forwarding their cookie).
+*/
+const WORKER_ATTEST_HEADER = "x-canopy-worker-attest";
+/**
 * Header the gateway attaches to a project tools call (`/__canopy/mcp`,
 * docs/49): the caller's agent token. A credential like the session cookie —
 * the host keeps it for `env.CANOPY.fetch` and redacts it from the bundle.
@@ -857,7 +878,11 @@ const AGENT_CREDENTIAL_HEADER = "x-canopy-agent-credential";
 */
 const CALLER_HEADER = "x-canopy-caller";
 /** Cookies that authenticate to Canopy itself — the monk session and the client-page session. */
-const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set(["canopy_session", "canopy_client"]);
+const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set([
+	"canopy_session",
+	"canopy_client",
+	"canopy_agent"
+]);
 /**
 * Strip Canopy's own credentials from a request before untrusted project code
 * sees it (R-01).
@@ -870,7 +895,7 @@ const CANOPY_COOKIE_NAMES = /* @__PURE__ */ new Set(["canopy_session", "canopy_c
 *
 * Redaction is surgical on purpose: an app's own cookies and its own
 * Authorization scheme survive, because those belong to the app. Only
-* `canopy_session` / `canopy_client` and a `cnpy_` bearer are removed.
+* `canopy_session` / `canopy_client` / `canopy_agent` and a `cnpy_` bearer are removed.
 *
 * `env.CANOPY.fetch` still authenticates as the visitor — the host passes it
 * the unredacted headers — so nothing about the platform-facing behaviour
@@ -903,4 +928,4 @@ function stampWorkerHeaders(headers, ctx) {
 	return headers;
 }
 //#endregion
-export { dbRouter as a, realtimeRouter as i, redactCanopyCredentials as n, META_COLUMNS as o, stampWorkerHeaders as r, blobRouter as s, CALLER_HEADER as t };
+export { realtimeRouter as a, META_COLUMNS as c, stampWorkerHeaders as i, blobRouter as l, WORKER_ATTEST_HEADER as n, dbRouter as o, redactCanopyCredentials as r, hasPrivateNames as s, CALLER_HEADER as t };

package/dist/{upgrade-huJDjhrV.mjs → upgrade-DSTg2cgu.mjs}

@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-Dg7dQF0k.mjs");
+		const { skillInstalled } = await import("./skill-GPJrYL61.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.33",
+  "version": "0.7.35",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/dev-MoHHjQh1.mjs

@@ -1,2 +0,0 @@
-import { n as devCommand } from "./dev-CkhBnSlv.mjs";
-export { devCommand };