@mediamonks/canopy-cli 0.7.37 → 0.7.39

package/README.md

@@ -11,12 +11,15 @@ canopy deploy [--no-build]        # authorize → signed upload → complete
 canopy rollback / deploys / download
 canopy db pull | snapshot | snapshots | restore
 canopy token create | list | revoke
-canopy usage / docs / whoami / logout
+canopy feedback list | show | comment | note | status | report | watch
+canopy usage / docs / whoami [--json] / logout
 ```
 
 Control-plane calls go through `src/api.ts` (`/control/v1` on the active
 site's `api.` host, bearer token — `CANOPY_DEPLOY_TOKEN` in CI wins over the
-login token); database safety runs on the data plane (`apiDataRequest` with
+login token; every request says which AI agent drives the CLI, if any, as
+`x-canopy-agent`: `CANOPY_AGENT=<name>`, `none` to opt out, else `claude-code`
+under `CLAUDECODE=1`); database safety runs on the data plane (`apiDataRequest` with
 `X-Canopy-Project`). `canopy deploy` streams bundle bytes straight to
 `/data/v1/uploads/:grant` under a short-lived signed grant — they never
 transit the control plane (docs/09-plane-split.md D-d). Multi-site profiles:

package/dist/{ai-CjvrcBIz.mjs → ai-EyrXJC5z.mjs}

@@ -1,5 +1,5 @@
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 //#region src/ai.ts
 /**

package/dist/{api-BPEYm9ts.mjs → api-ArfD6-t5.mjs}

@@ -213,6 +213,41 @@ function randomHex(bytes) {
 function traceHeaders() {
 	return { traceparent: `00-${TRACE_ID}-${randomHex(8)}-01` };
 }
+/**
+* Which AI agent drives this process, if any (report-agent). The platform
+* records it next to what the caller writes — "Arjan's agent (claude-code)" —
+* without changing who the author is or what they may do. `CANOPY_AGENT`
+* names it (`none` opts out, e.g. a person running the CLI from a shell that
+* inherited the variable); otherwise Claude Code is recognised by the
+* `CLAUDECODE=1` it sets in every shell it spawns.
+*/
+const AGENT_RE = /^[a-z0-9-]{1,40}$/;
+const warnedAgents = /* @__PURE__ */ new Set();
+function agentName(env = process.env) {
+	const named = env["CANOPY_AGENT"];
+	if (named !== void 0 && named !== "") {
+		if (named === "none") return void 0;
+		if (AGENT_RE.test(named)) return named;
+		if (!warnedAgents.has(named)) {
+			warnedAgents.add(named);
+			console.error(`warning: ignoring CANOPY_AGENT=${JSON.stringify(named)} — use 1–40 characters from a-z, 0-9 and -, or \`none\` to send no agent name.`);
+		}
+		return;
+	}
+	return env["CLAUDECODE"] === "1" ? "claude-code" : void 0;
+}
+/** The `x-canopy-agent` header for every platform request (empty when no agent drives us). */
+function agentHeaders(env = process.env) {
+	const agent = agentName(env);
+	return agent ? { "x-canopy-agent": agent } : {};
+}
+/** Headers every control/data-plane request carries besides auth: trace + agent. */
+function commonHeaders() {
+	return {
+		...traceHeaders(),
+		...agentHeaders()
+	};
+}
 var ApiError = class extends Error {
 	status;
 	code;
@@ -297,7 +332,7 @@ async function apiRequest(method, path, body, rawContentType, headers) {
 	const response = await fetch(`${apiUrl}/control/v1${path}`, {
 		method,
 		headers: {
-			...traceHeaders(),
+			...commonHeaders(),
 			authorization: `Bearer ${token}`,
 			...body === void 0 || isForm ? {} : { "content-type": rawContentType ?? "application/json" },
 			...headers
@@ -317,7 +352,7 @@ async function apiUpload(path, bytes, contentType) {
 	const response = await fetch(`${apiUrl}/control/v1${path}`, {
 		method: "POST",
 		headers: {
-			...traceHeaders(),
+			...commonHeaders(),
 			authorization: `Bearer ${token}`,
 			"content-type": contentType
 		},
@@ -330,7 +365,7 @@ async function apiUpload(path, bytes, contentType) {
 async function apiDownload(path) {
 	const { apiUrl, token, isDeployToken } = credentials();
 	const response = await fetch(`${apiUrl}/control/v1${path}`, { headers: {
-		...traceHeaders(),
+		...commonHeaders(),
 		authorization: `Bearer ${token}`
 	} });
 	if (!response.ok) return fail(response, isDeployToken, "GET", path);
@@ -346,7 +381,7 @@ async function apiDataRequest(method, path, projectSlug, body, rawContentType, c
 	const response = await fetch(`${apiUrl}/data/v1${path}`, {
 		method,
 		headers: {
-			...traceHeaders(),
+			...commonHeaders(),
 			authorization: `Bearer ${token}`,
 			"x-canopy-project": projectSlug,
 			...channel === "staging" ? { "x-canopy-channel": "staging" } : {},
@@ -359,4 +394,4 @@ async function apiDataRequest(method, path, projectSlug, body, rawContentType, c
 	return await response.json();
 }
 //#endregion
-export { apiUpload as a, apiRequest as i, apiDataRequest as n, withContext as o, apiDownload as r, ApiError as t };
+export { apiRequest as a, credentials as c, apiDownload as i, withContext as l, agentHeaders as n, apiUpload as o, apiDataRequest as r, commonHeaders as s, ApiError as t };

package/dist/{browse-CBelCgnW.mjs → browse-DEhnJAPT.mjs}

@@ -1,5 +1,5 @@
 import { d as tryResolveProject, n as siteConfig } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, t as ApiError } from "./api-BPEYm9ts.mjs";
+import { a as apiRequest, t as ApiError } from "./api-ArfD6-t5.mjs";
 import { defineCommand } from "citty";
 //#region src/browse.ts
 /**

package/dist/{db-CbqgjfYz.mjs → db-DGrCgj-R.mjs}

@@ -1,7 +1,7 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, n as apiDataRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CHfKV6lG.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CF1iNZ7F.mjs";
+import { a as apiRequest, l as withContext, r as apiDataRequest } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CaHgvvkJ.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CG_O5Ghw.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-CqCyry4o.mjs → deploy-B7KItUnh.mjs}

@@ -1,7 +1,7 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, n as apiDataRequest, o as withContext, r as apiDownload } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CF1iNZ7F.mjs";
+import { a as apiRequest, i as apiDownload, l as withContext, r as apiDataRequest } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CG_O5Ghw.mjs";
 import { builtinModules } from "node:module";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";

package/dist/{dev-BtnEuAnS.mjs → dev-BMWj4NDZ.mjs}

@@ -1,7 +1,7 @@
 import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext, t as ApiError } from "./api-BPEYm9ts.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
-import { r as readMigrationFiles } from "./migrations-CF1iNZ7F.mjs";
+import { a as apiRequest, l as withContext, t as ApiError } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
+import { r as readMigrationFiles } from "./migrations-CG_O5Ghw.mjs";
 import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER } from "./src-CxzGOEhP.mjs";
 import { n as writeDevServerRecord } from "./dev-server-file-Dk9pk4AR.mjs";
 import { createRequire } from "node:module";
@@ -251,7 +251,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-BfqTheMP.mjs");
+		const { fetchProjectDump } = await import("./local-BnfAEwso.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -267,7 +267,7 @@ async function devLocal(flags, slug) {
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
 	const workerAttest = randomBytes(24).toString("base64url");
-	const { createSandbox } = await import("./local-BfqTheMP.mjs");
+	const { createSandbox } = await import("./local-BnfAEwso.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/dev-BdSq6CGD.mjs

@@ -0,0 +1,2 @@
+import { n as devCommand } from "./dev-BMWj4NDZ.mjs";
+export { devCommand };

package/dist/docs/cli-create.md

@@ -11,6 +11,7 @@ description: Register a new project on Canopy and scaffold it locally from a sta
 canopy create                             # fully interactive
 canopy create "My Portfolio" --slug my-portfolio --template spa
 canopy create existing-app --no-scaffold  # register only, no files written
+canopy create "My Retro" --from retro-board  # start from a template
 ```
 
 ## Arguments & flags
@@ -20,6 +21,7 @@ canopy create existing-app --no-scaffold  # register only, no files written
 - `--template <id>` — starter to scaffold: `static` (plain HTML/CSS/JS, no build step, untyped SDK from the platform — simplest apps), `spa` (Vite + React + TypeScript with the typed SDK from npm — best for real SDK use or growth), or `worker` (`spa` plus a backend worker in `worker/` — for server-side code: secrets, schedules, calling external APIs). A picker appears when omitted on a TTY; `static` is the default otherwise.
 - `--scaffold` / `--no-scaffold` — whether to write `./<slug>/` from the template. When neither is given, the CLI scaffolds unless the current directory already has a `canopy.json` (in which case it assumes you're registering an existing app and only registers).
 - `--repo` / `--no-repo` — also create a git repository for the project on Canopy and set up the new folder to push to it (see [`canopy repo`](https://docs.canopy.website/cli/repo)). When neither is given, an interactive run asks (default no) on sites that offer repositories; non-interactive runs create none.
+- `--from <template>` — start from a template project instead of a starter: the new project gets a copy of the template's code in its own git repository, cloned into `./<slug>/`, plus the setup the code needs. The CLI shows what comes along and asks before creating. `--template`, `--scaffold` and `--repo` don't apply. See [Start from a template](https://docs.canopy.website/guides/templates).
 - `--profile <site>` — global flag (or `CANOPY_PROFILE`): which site to create the project on. The chosen profile is pinned into the scaffolded `canopy.json`.
 
 ## How it works

package/dist/docs/cli-feedback.md

@@ -13,10 +13,12 @@ ones.
 canopy feedback list --status investigate
 canopy feedback show <id>
 canopy feedback comment <id> "root cause: the upload grant expires too early"
+canopy feedback note <id> "stack trace and table names for the team"
 canopy feedback status <id> investigated --comment "root cause: the grant expires too early"
 canopy feedback list --status accepted
 canopy feedback status <id> resolved --comment "fixed in v42"
 canopy feedback mine
+canopy feedback watch --project my-project
 canopy feedback report "canopy deploy exits 1 after upload" --command "canopy deploy"
 canopy feedback report "the header overlaps the logo" --attach ./shot.png
 canopy feedback attach <id> ./after-fix.png --comment "fixed — see the shot"
@@ -46,6 +48,9 @@ machine-readable output.
   updates). `--internal` (members only) keeps the note off the reporter's
   view — for stack traces, table names, and other working detail that would
   only confuse them.
+- `note <id> <text>` — post an internal note: the same as
+  `comment <id> <text> --internal`, with no way to make it public. Handy
+  when you let an agent post notes but not replies the reporter sees.
 - `attach <id> <file> [--attach <more>] [--caption <text>] [--comment <text>] [--internal]` —
   add screenshots to an existing report. With `--comment`, the comment is
   posted first and the screenshots hang off that trail entry — how you show
@@ -56,6 +61,12 @@ machine-readable output.
   findings: pass `--comment`, or comment first.
 - `mine [--project <slug>] [--json]` — your own reports across all projects,
   with current statuses.
+- `watch [--project <slug>]... [--since <time>] [--after <cursor>] [--json]` —
+  follow new reports, comments and status changes on projects you're a member
+  of, live, until you stop it. Repeat `--project` to follow several. With
+  `--json` each event is one line of JSON carrying an `id`; pass the last one
+  back as `--after` to pick up where you left off. Events say what happened
+  and who did it, not the text — use `show` for that.
 - `report <text> [--kind bug|feedback] [--project <slug>] [--command <cmd>] [--error <output>] [--attach <file>] [--caption <text>]` —
   file a new report. **Without `--project` it goes to the platform inbox**
   (Canopy itself) — the right target when a `canopy` command misbehaves. The
@@ -65,6 +76,21 @@ machine-readable output.
   itself is the write-up of what you found, `accepted` when the person you are
   working with asked for it.
 
+## Agents and people
+
+Every report and comment remembers how it was made: from the dashboard or
+widget, by a person at the CLI, or by an AI agent driving the CLI. Agent
+entries read as "Ana's agent (claude-code)" in the dashboard, in Slack and
+in `show`, so you can tell what you wrote from what your agent wrote.
+
+The CLI notices on its own when Claude Code runs it. For another agent, set
+`CANOPY_AGENT=<name>` (letters, digits and dashes) in its environment. To
+mark a command as yours even inside an agent's shell, set
+`CANOPY_AGENT=none`.
+
+You get a Slack message when your own agent does something on a report you
+follow, even though you never get one for your own actions.
+
 ## For agents
 
 Two loops.
@@ -77,7 +103,7 @@ Stop there — say what it would take to fix and let the person decide.
 Split your findings by audience: the status comment is what the **reporter**
 reads, so keep it plain ("the upload fails for files over 5 MB — looking into
 it"). The tech-loaded version — stack traces, table names, reproduction
-queries — goes in `comment <id> "<detail>" --internal`, which only project
+queries — goes in `note <id> "<detail>"`, which only project
 members see. An internal note counts as findings for `investigated`.
 
 **Build:** `list --status accepted` is what a person has asked for. Do the

package/dist/docs/cli-projects.md

@@ -10,12 +10,14 @@ description: List your Canopy projects with their status, role, and live URLs.
 ```bash
 canopy projects
 canopy projects --all
+canopy projects --templates
 canopy --profile staging projects
 ```
 
 ## Arguments & flags
 
 - `--all` — include projects you can't edit. By default the list shows only projects where you're an owner or editor (admins always see everything, since they can edit everything).
+- `--templates` — list the templates anyone can start a project from, with their owners. See [Start from a template](https://docs.canopy.website/guides/templates).
 - `--profile <site>` — global flag (or `CANOPY_PROFILE`): each site has its own project registry, so listing on `staging` shows a completely different set than `main`.
 
 ## Details

package/dist/docs/cli-secrets.md

@@ -25,7 +25,8 @@ target directory, or `--project <slug>` to override — and honor the global
 `--profile <site>` / `CANOPY_PROFILE`.
 
 - `list` — print the secret names and when each was last set. Values are
-  never shown.
+  never shown. For a project started from a template, names it still needs a
+  value for are listed as missing.
 - `set <name>` — store a value. Names are `UPPER_SNAKE_CASE`, up to 64
   characters. The value comes from **stdin** when piped (one trailing newline
   is trimmed, so `echo` works too), from `--from-env <VAR>` to read an

package/dist/docs/cli-template.md

@@ -0,0 +1,47 @@
+---
+title: canopy template
+description: Offer a project as a template, or see what a template gives a new project.
+---
+
+`canopy template` controls whether others can start a project from yours, and
+shows what a template gives a new project. To start from one, use
+[`canopy create --from`](https://docs.canopy.website/cli/create).
+
+## Usage
+
+```bash
+canopy template mark [--yes]
+canopy template unmark
+canopy template show <slug>
+```
+
+## Arguments & flags
+
+`mark` and `unmark` resolve the project the usual way: `canopy.json` in the
+target folder, or `--project <slug>`. All of them honour the global
+`--profile <site>` / `CANOPY_PROFILE`.
+
+- `mark` — let anyone on the site start a project from this one. Owner only.
+  The project needs a Canopy git repository with code pushed to it. Asks for
+  confirmation; `--yes` skips it in scripts. Warns when `canopy.json` names no
+  migrations folder, because new projects then start without any tables.
+- `unmark` — stop new projects starting from this one. Existing copies are not
+  affected.
+- `show <slug>` — what a new project gets from a template: the code, outbound
+  hosts, page settings, Google access, schedules (turned off) and secret names.
+
+## Examples
+
+```bash
+canopy template mark
+```
+
+Offers the project in this folder as a template.
+
+```bash
+canopy template show retro-board
+```
+
+Shows what `canopy create --from retro-board` would give you.
+
+Read [Start from a template](https://docs.canopy.website/guides/templates) for the bigger picture.

package/dist/docs/index.json

@@ -72,6 +72,11 @@
           "title": "Keep your code in git",
           "summary": "Give your project a git repository on Canopy — history, backup and sharing, no GitHub account needed."
         },
+        {
+          "slug": "templates",
+          "title": "Start from a template",
+          "summary": "Begin a project from someone else's working one — a copy of their code and setup, never their data."
+        },
         {
           "slug": "agent-tools",
           "title": "Agent tools (MCP)",
@@ -266,6 +271,11 @@
           "title": "canopy repo",
           "summary": "Create, clone and set up the project's git repository on Canopy."
         },
+        {
+          "slug": "cli-template",
+          "title": "canopy template",
+          "summary": "Offer a project as a template, or see what a template gives a new project."
+        },
         {
           "slug": "cli-egress",
           "title": "canopy egress",

package/dist/docs/platform-schedules.md

@@ -91,6 +91,27 @@ of truth for _when_ a job runs, so you can change `daily-digest` from 6:00 to
 7:30 — or pause it — without touching code or redeploying. The name is the
 stable contract between the dashboard and your handler.
 
+## How long a run may take
+
+Plan for **at most 5 minutes** per run. A run that takes longer can be cut
+off before it finishes, and is then recorded as failed. If a job grows past
+that, split it: handle a batch per run and remember where you stopped (in
+the database), or run the schedule more often.
+
+What happens around a run:
+
+- **No retries.** A failed run is recorded on the schedule row, members are
+  notified the first time it fails, and the next attempt is simply the next
+  tick.
+- **No overlap protection.** Every tick starts a fresh run, and **Run now**
+  can run alongside a scheduled one. Make the handler safe to run twice: write
+  idempotently, or take a lock row in the database and skip when it's held.
+- **Deploys don't stop a run.** A run in progress finishes on the version it
+  started with, and keeps its data access while it does. New code takes over
+  from the next run. Database migrations in a deploy apply right away, so a
+  run on the old version may meet the new schema. Additive migrations keep
+  that safe.
+
 ## Things to know
 
 - **Cron runs as the project, not as a person.** Data access works (see

package/dist/docs/templates.md

@@ -0,0 +1,84 @@
+---
+title: Start from a template
+description: Begin a project from someone else's working one — a copy of their code and setup, never their data.
+---
+
+Some projects are worth starting from: a retro board, a feedback form, a small
+dashboard on an internal API. When the owner offers one as a **template**,
+anyone on Canopy can start a project of their own from it. You get a copy of
+the code and the setup the code needs, then change it however you like.
+
+Your copy is yours. Later changes to the template don't reach it, and nothing
+you do reaches the template.
+
+## Find one
+
+```bash
+canopy projects --templates
+canopy template show retro-board
+```
+
+`show` lists exactly what a new project gets. In the dashboard, switch on the
+**Templates** filter on the project list; each template has a **Use as
+template** button that shows the same list.
+
+## Start your project
+
+```bash
+canopy create "My Retro" --slug my-retro --from retro-board
+```
+
+Canopy creates the project, gives it its own git repository with the
+template's code in one fresh commit, and clones it into `./my-retro/`. It then
+tells you what is left, usually:
+
+```bash
+cd my-retro
+canopy secrets set OPENAI_KEY
+canopy deploy
+```
+
+The first deploy runs the template's migrations, so your database starts with
+its tables and nothing else.
+
+## What you get, and what you don't
+
+You get:
+
+- the code in the template's repository, as it is right now, without its
+  history;
+- its allowed outbound hosts and page settings;
+- the Google access it asks visitors for (restricted Google access stays off
+  until a Canopy admin unlocks it for your project);
+- its schedules, **turned off** — turn each one on when you're ready;
+- the **names** of its secrets, so you know what to fill in. `canopy secrets
+list` shows the ones still missing.
+
+You never get its data, stored files, secret values, members, client password,
+budgets, feedback or deploy history. Your project starts with the usual
+defaults for those.
+
+## Offer your project as a template
+
+Your project needs a Canopy git repository with your code pushed to it (see
+[Keep your code in git](https://docs.canopy.website/guides/git)). Then:
+
+```bash
+canopy template mark
+```
+
+or **Settings → Template** in the dashboard. Only the owner can do this.
+
+Before you do:
+
+- **Everyone on the site can copy the code.** Make sure the repository holds no
+  keys, passwords or client data.
+- **Put sample data in migrations.** The database never comes along, so any
+  starting rows belong in your migrations. Without a migrations folder, new
+  projects start with an empty database.
+- **Explain setup in the README.** It's the first thing people read in their
+  copy.
+
+`canopy template unmark` stops new copies. Projects already started from it
+are not affected. The template's Settings page shows how many projects started
+from it.

package/dist/{docs-DvCUaI1O.mjs → docs-Bplp4sOY.mjs}

@@ -1,7 +1,8 @@
-import { t as version } from "./package-BY69Tjq_.mjs";
+import { t as version } from "./package-CJJpjVh_.mjs";
 import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { n as agentHeaders } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -62,7 +63,10 @@ function parseFrontmatter(raw) {
 /** Bearer header from the deploy token (CI) or the CLI login, if either exists. */
 function authHeaders() {
 	const token = process.env["CANOPY_DEPLOY_TOKEN"] || siteConfig().token;
-	return token ? { authorization: `Bearer ${token}` } : {};
+	return token ? {
+		authorization: `Bearer ${token}`,
+		...agentHeaders()
+	} : {};
 }
 async function fetchRes(url) {
 	try {

package/dist/{egress-ButFsQ2N.mjs → egress-CzxRD6Tp.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/egress.ts