@mediamonks/canopy-cli 0.7.38 → 0.7.39

package/README.md

@@ -11,12 +11,15 @@ canopy deploy [--no-build]        # authorize → signed upload → complete
 canopy rollback / deploys / download
 canopy db pull | snapshot | snapshots | restore
 canopy token create | list | revoke
-canopy usage / docs / whoami / logout
+canopy feedback list | show | comment | note | status | report | watch
+canopy usage / docs / whoami [--json] / logout
 ```
 
 Control-plane calls go through `src/api.ts` (`/control/v1` on the active
 site's `api.` host, bearer token — `CANOPY_DEPLOY_TOKEN` in CI wins over the
-login token); database safety runs on the data plane (`apiDataRequest` with
+login token; every request says which AI agent drives the CLI, if any, as
+`x-canopy-agent`: `CANOPY_AGENT=<name>`, `none` to opt out, else `claude-code`
+under `CLAUDECODE=1`); database safety runs on the data plane (`apiDataRequest` with
 `X-Canopy-Project`). `canopy deploy` streams bundle bytes straight to
 `/data/v1/uploads/:grant` under a short-lived signed grant — they never
 transit the control plane (docs/09-plane-split.md D-d). Multi-site profiles:

package/dist/{ai-CjvrcBIz.mjs → ai-EyrXJC5z.mjs}

@@ -1,5 +1,5 @@
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 //#region src/ai.ts
 /**

package/dist/{api-BPEYm9ts.mjs → api-ArfD6-t5.mjs}

@@ -213,6 +213,41 @@ function randomHex(bytes) {
 function traceHeaders() {
 	return { traceparent: `00-${TRACE_ID}-${randomHex(8)}-01` };
 }
+/**
+* Which AI agent drives this process, if any (report-agent). The platform
+* records it next to what the caller writes — "Arjan's agent (claude-code)" —
+* without changing who the author is or what they may do. `CANOPY_AGENT`
+* names it (`none` opts out, e.g. a person running the CLI from a shell that
+* inherited the variable); otherwise Claude Code is recognised by the
+* `CLAUDECODE=1` it sets in every shell it spawns.
+*/
+const AGENT_RE = /^[a-z0-9-]{1,40}$/;
+const warnedAgents = /* @__PURE__ */ new Set();
+function agentName(env = process.env) {
+	const named = env["CANOPY_AGENT"];
+	if (named !== void 0 && named !== "") {
+		if (named === "none") return void 0;
+		if (AGENT_RE.test(named)) return named;
+		if (!warnedAgents.has(named)) {
+			warnedAgents.add(named);
+			console.error(`warning: ignoring CANOPY_AGENT=${JSON.stringify(named)} — use 1–40 characters from a-z, 0-9 and -, or \`none\` to send no agent name.`);
+		}
+		return;
+	}
+	return env["CLAUDECODE"] === "1" ? "claude-code" : void 0;
+}
+/** The `x-canopy-agent` header for every platform request (empty when no agent drives us). */
+function agentHeaders(env = process.env) {
+	const agent = agentName(env);
+	return agent ? { "x-canopy-agent": agent } : {};
+}
+/** Headers every control/data-plane request carries besides auth: trace + agent. */
+function commonHeaders() {
+	return {
+		...traceHeaders(),
+		...agentHeaders()
+	};
+}
 var ApiError = class extends Error {
 	status;
 	code;
@@ -297,7 +332,7 @@ async function apiRequest(method, path, body, rawContentType, headers) {
 	const response = await fetch(`${apiUrl}/control/v1${path}`, {
 		method,
 		headers: {
-			...traceHeaders(),
+			...commonHeaders(),
 			authorization: `Bearer ${token}`,
 			...body === void 0 || isForm ? {} : { "content-type": rawContentType ?? "application/json" },
 			...headers
@@ -317,7 +352,7 @@ async function apiUpload(path, bytes, contentType) {
 	const response = await fetch(`${apiUrl}/control/v1${path}`, {
 		method: "POST",
 		headers: {
-			...traceHeaders(),
+			...commonHeaders(),
 			authorization: `Bearer ${token}`,
 			"content-type": contentType
 		},
@@ -330,7 +365,7 @@ async function apiUpload(path, bytes, contentType) {
 async function apiDownload(path) {
 	const { apiUrl, token, isDeployToken } = credentials();
 	const response = await fetch(`${apiUrl}/control/v1${path}`, { headers: {
-		...traceHeaders(),
+		...commonHeaders(),
 		authorization: `Bearer ${token}`
 	} });
 	if (!response.ok) return fail(response, isDeployToken, "GET", path);
@@ -346,7 +381,7 @@ async function apiDataRequest(method, path, projectSlug, body, rawContentType, c
 	const response = await fetch(`${apiUrl}/data/v1${path}`, {
 		method,
 		headers: {
-			...traceHeaders(),
+			...commonHeaders(),
 			authorization: `Bearer ${token}`,
 			"x-canopy-project": projectSlug,
 			...channel === "staging" ? { "x-canopy-channel": "staging" } : {},
@@ -359,4 +394,4 @@ async function apiDataRequest(method, path, projectSlug, body, rawContentType, c
 	return await response.json();
 }
 //#endregion
-export { apiUpload as a, apiRequest as i, apiDataRequest as n, withContext as o, apiDownload as r, ApiError as t };
+export { apiRequest as a, credentials as c, apiDownload as i, withContext as l, agentHeaders as n, apiUpload as o, apiDataRequest as r, commonHeaders as s, ApiError as t };

package/dist/{browse-CBelCgnW.mjs → browse-DEhnJAPT.mjs}

@@ -1,5 +1,5 @@
 import { d as tryResolveProject, n as siteConfig } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, t as ApiError } from "./api-BPEYm9ts.mjs";
+import { a as apiRequest, t as ApiError } from "./api-ArfD6-t5.mjs";
 import { defineCommand } from "citty";
 //#region src/browse.ts
 /**

package/dist/{db-CbqgjfYz.mjs → db-DGrCgj-R.mjs}

@@ -1,7 +1,7 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, n as apiDataRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CHfKV6lG.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CF1iNZ7F.mjs";
+import { a as apiRequest, l as withContext, r as apiDataRequest } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CaHgvvkJ.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CG_O5Ghw.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
 import * as p from "@clack/prompts";

package/dist/{deploy-CqCyry4o.mjs → deploy-B7KItUnh.mjs}

@@ -1,7 +1,7 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, n as siteConfig, o as projectFlagArgs, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, n as apiDataRequest, o as withContext, r as apiDownload } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
-import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CF1iNZ7F.mjs";
+import { a as apiRequest, i as apiDownload, l as withContext, r as apiDataRequest } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
+import { n as migrateProject, r as readMigrationFiles, t as describeMigrateResult } from "./migrations-CG_O5Ghw.mjs";
 import { builtinModules } from "node:module";
 import { defineCommand } from "citty";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";

package/dist/{dev-BtnEuAnS.mjs → dev-BMWj4NDZ.mjs}

@@ -1,7 +1,7 @@
 import { a as projectDirArgs, c as resolveProject, i as projectDialect, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext, t as ApiError } from "./api-BPEYm9ts.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
-import { r as readMigrationFiles } from "./migrations-CF1iNZ7F.mjs";
+import { a as apiRequest, l as withContext, t as ApiError } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
+import { r as readMigrationFiles } from "./migrations-CG_O5Ghw.mjs";
 import { i as stampWorkerHeaders, n as WORKER_ATTEST_HEADER } from "./src-CxzGOEhP.mjs";
 import { n as writeDevServerRecord } from "./dev-server-file-Dk9pk4AR.mjs";
 import { createRequire } from "node:module";
@@ -251,7 +251,7 @@ async function devRemote(flags, slug) {
 async function devLocal(flags, slug) {
 	let dump;
 	if (flags.pull) {
-		const { fetchProjectDump } = await import("./local-BfqTheMP.mjs");
+		const { fetchProjectDump } = await import("./local-BnfAEwso.mjs");
 		console.log(`Pulling a fresh export of ${slug}${flags.staging ? " [staging]" : ""}…`);
 		dump = await fetchProjectDump(slug, flags.staging ? "staging" : "live");
 	}
@@ -267,7 +267,7 @@ async function devLocal(flags, slug) {
 		console.log(`Note: ai/services will be unavailable — could not reach the platform (${reason}).`);
 	}
 	const workerAttest = randomBytes(24).toString("base64url");
-	const { createSandbox } = await import("./local-BfqTheMP.mjs");
+	const { createSandbox } = await import("./local-BnfAEwso.mjs");
 	const sandbox = await createSandbox({
 		slug,
 		persistDir: join(flags.dir, ".canopy", "local"),

package/dist/dev-BdSq6CGD.mjs

@@ -0,0 +1,2 @@
+import { n as devCommand } from "./dev-BMWj4NDZ.mjs";
+export { devCommand };

package/dist/docs/cli-feedback.md

@@ -13,10 +13,12 @@ ones.
 canopy feedback list --status investigate
 canopy feedback show <id>
 canopy feedback comment <id> "root cause: the upload grant expires too early"
+canopy feedback note <id> "stack trace and table names for the team"
 canopy feedback status <id> investigated --comment "root cause: the grant expires too early"
 canopy feedback list --status accepted
 canopy feedback status <id> resolved --comment "fixed in v42"
 canopy feedback mine
+canopy feedback watch --project my-project
 canopy feedback report "canopy deploy exits 1 after upload" --command "canopy deploy"
 canopy feedback report "the header overlaps the logo" --attach ./shot.png
 canopy feedback attach <id> ./after-fix.png --comment "fixed — see the shot"
@@ -46,6 +48,9 @@ machine-readable output.
   updates). `--internal` (members only) keeps the note off the reporter's
   view — for stack traces, table names, and other working detail that would
   only confuse them.
+- `note <id> <text>` — post an internal note: the same as
+  `comment <id> <text> --internal`, with no way to make it public. Handy
+  when you let an agent post notes but not replies the reporter sees.
 - `attach <id> <file> [--attach <more>] [--caption <text>] [--comment <text>] [--internal]` —
   add screenshots to an existing report. With `--comment`, the comment is
   posted first and the screenshots hang off that trail entry — how you show
@@ -56,6 +61,12 @@ machine-readable output.
   findings: pass `--comment`, or comment first.
 - `mine [--project <slug>] [--json]` — your own reports across all projects,
   with current statuses.
+- `watch [--project <slug>]... [--since <time>] [--after <cursor>] [--json]` —
+  follow new reports, comments and status changes on projects you're a member
+  of, live, until you stop it. Repeat `--project` to follow several. With
+  `--json` each event is one line of JSON carrying an `id`; pass the last one
+  back as `--after` to pick up where you left off. Events say what happened
+  and who did it, not the text — use `show` for that.
 - `report <text> [--kind bug|feedback] [--project <slug>] [--command <cmd>] [--error <output>] [--attach <file>] [--caption <text>]` —
   file a new report. **Without `--project` it goes to the platform inbox**
   (Canopy itself) — the right target when a `canopy` command misbehaves. The
@@ -65,6 +76,21 @@ machine-readable output.
   itself is the write-up of what you found, `accepted` when the person you are
   working with asked for it.
 
+## Agents and people
+
+Every report and comment remembers how it was made: from the dashboard or
+widget, by a person at the CLI, or by an AI agent driving the CLI. Agent
+entries read as "Ana's agent (claude-code)" in the dashboard, in Slack and
+in `show`, so you can tell what you wrote from what your agent wrote.
+
+The CLI notices on its own when Claude Code runs it. For another agent, set
+`CANOPY_AGENT=<name>` (letters, digits and dashes) in its environment. To
+mark a command as yours even inside an agent's shell, set
+`CANOPY_AGENT=none`.
+
+You get a Slack message when your own agent does something on a report you
+follow, even though you never get one for your own actions.
+
 ## For agents
 
 Two loops.
@@ -77,7 +103,7 @@ Stop there — say what it would take to fix and let the person decide.
 Split your findings by audience: the status comment is what the **reporter**
 reads, so keep it plain ("the upload fails for files over 5 MB — looking into
 it"). The tech-loaded version — stack traces, table names, reproduction
-queries — goes in `comment <id> "<detail>" --internal`, which only project
+queries — goes in `note <id> "<detail>"`, which only project
 members see. An internal note counts as findings for `investigated`.
 
 **Build:** `list --status accepted` is what a person has asked for. Do the

package/dist/docs/platform-schedules.md

@@ -91,6 +91,27 @@ of truth for _when_ a job runs, so you can change `daily-digest` from 6:00 to
 7:30 — or pause it — without touching code or redeploying. The name is the
 stable contract between the dashboard and your handler.
 
+## How long a run may take
+
+Plan for **at most 5 minutes** per run. A run that takes longer can be cut
+off before it finishes, and is then recorded as failed. If a job grows past
+that, split it: handle a batch per run and remember where you stopped (in
+the database), or run the schedule more often.
+
+What happens around a run:
+
+- **No retries.** A failed run is recorded on the schedule row, members are
+  notified the first time it fails, and the next attempt is simply the next
+  tick.
+- **No overlap protection.** Every tick starts a fresh run, and **Run now**
+  can run alongside a scheduled one. Make the handler safe to run twice: write
+  idempotently, or take a lock row in the database and skip when it's held.
+- **Deploys don't stop a run.** A run in progress finishes on the version it
+  started with, and keeps its data access while it does. New code takes over
+  from the next run. Database migrations in a deploy apply right away, so a
+  run on the old version may meet the new schema. Additive migrations keep
+  that safe.
+
 ## Things to know
 
 - **Cron runs as the project, not as a person.** Data access works (see

package/dist/{docs-T1nuu00A.mjs → docs-Bplp4sOY.mjs}

@@ -1,7 +1,8 @@
-import { t as version } from "./package-CdDH35SE.mjs";
+import { t as version } from "./package-CJJpjVh_.mjs";
 import { n as siteConfig } from "./site-DM2J10CB.mjs";
 import { i as latestKnownVersion, r as compareSemver } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { n as agentHeaders } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -62,7 +63,10 @@ function parseFrontmatter(raw) {
 /** Bearer header from the deploy token (CI) or the CLI login, if either exists. */
 function authHeaders() {
 	const token = process.env["CANOPY_DEPLOY_TOKEN"] || siteConfig().token;
-	return token ? { authorization: `Bearer ${token}` } : {};
+	return token ? {
+		authorization: `Bearer ${token}`,
+		...agentHeaders()
+	} : {};
 }
 async function fetchRes(url) {
 	try {

package/dist/{egress-ButFsQ2N.mjs → egress-CzxRD6Tp.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/egress.ts

package/dist/{feedback-C5NKCOXQ.mjs → feedback-DFK0TXlt.mjs}

@@ -1,21 +1,272 @@
-import { t as version } from "./package-CdDH35SE.mjs";
+import { t as version } from "./package-CJJpjVh_.mjs";
 import { a as projectDirArgs, c as resolveProject, d as tryResolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { a as apiUpload, i as apiRequest, r as apiDownload } from "./api-BPEYm9ts.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, c as credentials, i as apiDownload, o as apiUpload, s as commonHeaders } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import { basename, extname, join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";
+//#region src/sse.ts
+/** Push-style parser: feed decoded text, collect events from the callback. */
+function createSseParser(onEvent) {
+	let buffer = "";
+	let first = true;
+	let lastId;
+	let event = "";
+	let data = [];
+	let sawId = false;
+	const dispatch = () => {
+		if (data.length > 0 || sawId) onEvent({
+			id: lastId,
+			event: event || "message",
+			data: data.join("\n")
+		});
+		event = "";
+		data = [];
+		sawId = false;
+	};
+	const line = (text) => {
+		if (text === "") return dispatch();
+		if (text.startsWith(":")) return;
+		const colon = text.indexOf(":");
+		const field = colon === -1 ? text : text.slice(0, colon);
+		let value = colon === -1 ? "" : text.slice(colon + 1);
+		if (value.startsWith(" ")) value = value.slice(1);
+		if (field === "data") data.push(value);
+		else if (field === "event") event = value;
+		else if (field === "id" && !value.includes("\0")) {
+			lastId = value;
+			sawId = true;
+		}
+	};
+	return {
+		feed(text) {
+			buffer += text;
+			if (first && buffer.length > 0) {
+				if (buffer.startsWith("")) buffer = buffer.slice(1);
+				first = false;
+			}
+			let start = 0;
+			for (;;) {
+				const cr = buffer.indexOf("\r", start);
+				const lf = buffer.indexOf("\n", start);
+				if (cr === -1 && lf === -1) break;
+				const end = cr === -1 ? lf : lf === -1 ? cr : Math.min(cr, lf);
+				if (buffer[end] === "\r" && end === buffer.length - 1) break;
+				line(buffer.slice(start, end));
+				start = end + (buffer[end] === "\r" && buffer[end + 1] === "\n" ? 2 : 1);
+			}
+			buffer = buffer.slice(start);
+		},
+		/** The stream ended: a trailing lone "\r" still ends its line. */
+		end() {
+			if (buffer.endsWith("\r")) {
+				line(buffer.slice(0, -1));
+				buffer = "";
+			}
+			buffer = "";
+			event = "";
+			data = [];
+			sawId = false;
+		}
+	};
+}
+/** Read a fetch body as SSE events, one at a time. */
+async function* readSse(body) {
+	const queue = [];
+	const parser = createSseParser((event) => queue.push(event));
+	const decoder = new TextDecoder();
+	const reader = body.getReader();
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) {
+				parser.feed(decoder.decode());
+				parser.end();
+				yield* queue.splice(0);
+				return;
+			}
+			parser.feed(decoder.decode(value, { stream: true }));
+			yield* queue.splice(0);
+		}
+	} finally {
+		reader.cancel().catch(() => {});
+	}
+}
+//#endregion
+//#region src/feedback-watch.ts
+/**
+* `canopy feedback watch` (report-agent): follow report activity on one or
+* more projects through GET /control/v1/feedback/events (SSE). The server
+* ends each stream after a few minutes; this loop reconnects from the last
+* cursor it saw, forever, until Ctrl-C or a refusal (401/403/404) it can't
+* fix by retrying.
+*/
+/**
+* How a report or trail entry names its author: the person, or — when their
+* agent did it — "Arjan van Wijk's agent (claude-code)".
+*/
+function authorLabel(name, via, agent) {
+	const person = name || "unknown";
+	return via === "agent" && agent ? `${person}'s agent (${agent})` : person;
+}
+/** One text line per event: time, key, type, actor, then status change / internal / kind. */
+function formatEvent(event) {
+	const type = event.type.replace(/^report\./, "");
+	const actor = authorLabel(event.actor?.name || event.actor?.email, event.via, event.agent);
+	const extra = [];
+	if (event.type === "report.created") {
+		if (event.kind) extra.push(event.kind);
+		if (event.status) extra.push(event.status);
+	}
+	if (event.status_to) extra.push(`${event.status_from ?? "?"} → ${event.status_to}`);
+	if (event.internal) extra.push("internal");
+	return [
+		formatDateTime(event.at),
+		event.key ?? event.item_id,
+		type,
+		actor,
+		...extra.length > 0 ? [extra.join(" · ")] : []
+	].join("  ");
+}
+/** The stream refused us for a reason retrying won't fix (401/403/404/other 4xx). */
+var WatchRefused = class extends Error {
+	status;
+	code;
+	detail;
+	constructor(status, code, detail) {
+		super(detail ? `${status} ${code}: ${detail}` : `${status} ${code}`);
+		this.status = status;
+		this.code = code;
+		this.detail = detail;
+		this.name = "WatchRefused";
+	}
+};
+const BACKOFF_START_MS = 1e3;
+const BACKOFF_MAX_MS = 3e4;
+/** A stream that ends sooner than this without an event counts as a failure (no hot loop). */
+const MIN_HEALTHY_STREAM_MS = 1e3;
+function defaultSleep(ms, signal) {
+	return new Promise((resolve) => {
+		if (signal?.aborted) return resolve();
+		const timer = setTimeout(done, ms);
+		function done() {
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", done);
+			resolve();
+		}
+		signal?.addEventListener("abort", done, { once: true });
+	});
+}
+/** The events URL for the next connection: the cursor, once we have one, replaces --since/--after. */
+function eventsUrl(apiUrl, projects, cursor, since) {
+	const params = new URLSearchParams({ projects: projects.join(",") });
+	if (cursor) params.set("after", cursor);
+	else if (since) params.set("since", since);
+	return `${apiUrl}/control/v1/feedback/events?${params.toString()}`;
+}
+/**
+* Follow the stream until `signal` aborts (resolves) or the server refuses
+* the request (rejects with WatchRefused). Network errors, 5xx and 429 back
+* off 1s, 2s, 4s… up to 30s; a stream that ends normally reconnects at once.
+*/
+async function watchFeedback(options) {
+	const doFetch = options.fetch ?? globalThis.fetch;
+	const sleep = options.sleep ?? defaultSleep;
+	const now = options.now ?? Date.now;
+	const { signal } = options;
+	let cursor = options.after || void 0;
+	let backoff = BACKOFF_START_MS;
+	let announced = false;
+	const wait = async (reason) => {
+		options.err(`${reason} — reconnecting in ${Math.round(backoff / 1e3)}s…`);
+		await sleep(backoff, signal);
+		backoff = Math.min(backoff * 2, BACKOFF_MAX_MS);
+	};
+	while (!signal?.aborted) {
+		const startedAt = now();
+		let response;
+		try {
+			response = await doFetch(eventsUrl(options.apiUrl, options.projects, cursor, options.since), {
+				headers: {
+					...options.headers?.(),
+					accept: "text/event-stream",
+					authorization: `Bearer ${options.token}`,
+					...cursor ? { "last-event-id": cursor } : {}
+				},
+				signal
+			});
+		} catch (error) {
+			if (signal?.aborted) return;
+			await wait(`connection failed (${errorText(error)})`);
+			continue;
+		}
+		if (!response.ok) {
+			const payload = await response.json().catch(() => ({}));
+			const code = payload.error ?? `http_${response.status}`;
+			if (response.status >= 500 || response.status === 429) {
+				await wait(`stream answered ${response.status} ${code}`);
+				continue;
+			}
+			throw new WatchRefused(response.status, code, payload.detail);
+		}
+		if (!response.body) {
+			await wait("stream had no body");
+			continue;
+		}
+		if (!announced) {
+			announced = true;
+			options.err(`Watching ${options.projects.join(", ")}… (Ctrl-C to stop)`);
+		}
+		let delivered = 0;
+		let dropped;
+		try {
+			for await (const event of readSse(response.body)) {
+				if (event.id) cursor = event.id;
+				if (event.data === "") continue;
+				let data;
+				try {
+					data = JSON.parse(event.data);
+				} catch {
+					options.err(`skipping an event that is not JSON: ${event.data.slice(0, 120)}`);
+					continue;
+				}
+				delivered++;
+				options.out(options.json ? JSON.stringify({
+					...data,
+					id: event.id ?? null
+				}) : formatEvent(data));
+			}
+		} catch (error) {
+			dropped = error ?? /* @__PURE__ */ new Error("stream error");
+		}
+		if (signal?.aborted) return;
+		const healthy = delivered > 0 || now() - startedAt >= MIN_HEALTHY_STREAM_MS;
+		if (healthy) backoff = BACKOFF_START_MS;
+		if (dropped !== void 0) await wait(`stream dropped (${errorText(dropped)})`);
+		else if (!healthy) await wait("stream closed immediately");
+	}
+}
+function errorText(error) {
+	if (error instanceof Error) {
+		const cause = error.cause;
+		return cause instanceof Error ? `${error.message}: ${cause.message}` : error.message;
+	}
+	return String(error);
+}
+//#endregion
 //#region src/feedback.ts
 /**
 * canopy feedback — the ticket-lite feedback system (docs/19, docs topic
 * `platform-feedback`). Two jobs:
 *
-*  - Work a project's inbox: `list`, `show`, `comment`, `status` — investigate
+*  - Work a project's inbox: `list`, `show`, `comment`, `note`, `status` — investigate
 *    what came in (`investigate` → comment the findings → `investigated`), and
 *    build what a human marked `accepted`.
 *  - File reports: `report` sends a bug/feedback item. With no `--project` it
 *    lands on the **platform inbox** (canopy itself) — the right target when a
 *    canopy command misbehaves while you're building something else.
+*  - Follow activity: `watch` streams new reports, comments and status
+*    changes as they happen (report-agent, feedback-watch.ts).
 */
 const STATUSES = [
 	"investigate",
@@ -45,13 +296,16 @@ const IMAGE_TYPES = {
 * `--attach a.png,b.png` works as well, since agents write it both ways.
 */
 function attachedPaths(value) {
-	const flag = "--attach";
+	return repeatedFlag("--attach", value);
+}
+/** Every occurrence of a repeatable string flag (citty keeps only the last), comma lists split. */
+function repeatedFlag(flag, value) {
 	const repeated = process.argv.flatMap((arg, index) => {
 		if (arg === flag) {
 			const next = process.argv[index + 1];
 			return next && !next.startsWith("-") ? [next] : [];
 		}
-		return arg.startsWith(`${flag}=`) ? [arg.slice(9)] : [];
+		return arg.startsWith(`${flag}=`) ? [arg.slice(flag.length + 1)] : [];
 	});
 	return (repeated.length > 0 ? repeated : value === void 0 ? [] : [String(value)]).flatMap((entry) => entry.split(",")).map((path) => path.trim()).filter((path) => path !== "");
 }
@@ -180,7 +434,7 @@ const showCommand = defineCommand({
 		const { item, comments } = detail;
 		if (item.title) console.log(item.title);
 		console.log(`${refOf(item)} · ${item.kind} · ${item.status} · via ${item.source} · ${formatDateTime(item.created_at)}`);
-		console.log(`reported by ${item.reporter_name || item.reporter_email || "unknown"}` + (item.deployment_id ? ` on ${item.deployment_id}` : "") + (item.channel === "staging" ? " (staging)" : ""));
+		console.log(`reported by ${authorLabel(item.reporter_name || item.reporter_email, item.source === "agent" ? "agent" : null, item.agent)}` + (item.deployment_id ? ` on ${item.deployment_id}` : "") + (item.channel === "staging" ? " (staging)" : ""));
 		console.log(`\n${item.body}\n`);
 		if (item.context) {
 			console.log("context:");
@@ -202,7 +456,7 @@ const showCommand = defineCommand({
 			console.log("");
 		}
 		for (const entry of comments) {
-			const author = entry.author_name || entry.author_email || "unknown";
+			const author = authorLabel(entry.author_name || entry.author_email, entry.via, entry.agent);
 			const move = entry.status_to ? `  [${entry.status_from} → ${entry.status_to}]` : "";
 			const internal = entry.internal ? "  [internal]" : "";
 			console.log(`--- ${author} · ${formatDateTime(entry.created_at)}${move}${internal}`);
@@ -243,11 +497,99 @@ const commentCommand = defineCommand({
 		...projectDirArgs
 	},
 	run: reportErrors("feedback comment", async ({ args }) => {
-		await apiRequest("POST", `/projects/${await resolveItemSlug(args, args.id)}/feedback/${encodeURIComponent(args.id)}/comments`, {
-			body: args.text,
-			...args.internal ? { internal: true } : {}
-		});
-		console.log(args.internal ? "Internal note added (hidden from the reporter)." : "Comment added.");
+		await postComment(args, Boolean(args.internal));
+	})
+});
+/** `comment` and `note` share one path: same ref resolution, same request. */
+async function postComment(args, internal) {
+	await apiRequest("POST", `/projects/${await resolveItemSlug(args, args.id)}/feedback/${encodeURIComponent(args.id)}/comments`, {
+		body: args.text,
+		...internal ? { internal: true } : {}
+	});
+	console.log(internal ? "Internal note added (hidden from the reporter)." : "Comment added.");
+}
+const noteCommand = defineCommand({
+	meta: {
+		name: "note",
+		description: "Add an internal note to an item — triager-only, never shown to the reporter (same as `comment --internal`; members only)"
+	},
+	args: {
+		id: {
+			type: "positional",
+			description: "Report key (my-project-17), or its number inside the project",
+			required: true
+		},
+		text: {
+			type: "positional",
+			description: "Note text",
+			required: true
+		},
+		...projectDirArgs
+	},
+	run: reportErrors("feedback note", async ({ args }) => {
+		await postComment(args, true);
+	})
+});
+const watchCommand = defineCommand({
+	meta: {
+		name: "watch",
+		description: "Follow report activity live (new reports, comments, status changes) on one or more projects; reconnects on its own until Ctrl-C (members only)"
+	},
+	args: {
+		project: {
+			type: "string",
+			description: "Project slug to follow; repeat (or comma-separate) for several (default: canopy.json)"
+		},
+		since: {
+			type: "string",
+			description: "Start with activity since this ISO time (at most 7 days back)"
+		},
+		after: {
+			type: "string",
+			description: "Resume after this cursor (the `id` of the last --json line you handled)"
+		},
+		json: {
+			type: "boolean",
+			description: "One JSON object per line: the event plus its `id` cursor (diagnostics on stderr)"
+		}
+	},
+	run: reportErrors("feedback watch", async ({ args }) => {
+		let projects = [...new Set(repeatedFlag("--project", args.project))];
+		if (projects.length === 0) {
+			const { slug } = tryResolveProject({});
+			if (!slug) throw new Error("No project to watch — pass --project <slug> (repeat it for several), or run inside a project with a canopy.json.");
+			projects = [slug];
+		} else tryResolveProject({});
+		if (args.since && args.after) throw new Error("Pass --since or --after, not both (--after already says where to resume).");
+		if (args.since && Number.isNaN(Date.parse(args.since))) throw new Error(`--since must be an ISO time such as 2026-10-23T09:00:00Z (got "${args.since}").`);
+		const { apiUrl, token } = credentials();
+		const controller = new AbortController();
+		const stop = () => controller.abort();
+		process.once("SIGINT", stop);
+		process.once("SIGTERM", stop);
+		try {
+			await watchFeedback({
+				apiUrl,
+				token,
+				projects,
+				since: args.since,
+				after: args.after,
+				json: Boolean(args.json),
+				out: (line) => process.stdout.write(`${line}\n`),
+				err: (line) => process.stderr.write(`${line}\n`),
+				headers: commonHeaders,
+				signal: controller.signal
+			});
+		} catch (error) {
+			if (error instanceof WatchRefused) {
+				const fix = error.status === 401 ? " — run `canopy login` again." : error.status === 403 ? " — watch needs your own CLI login and access to every project you name." : "";
+				throw new Error(`the activity stream refused the request: ${error.message}${fix}`);
+			}
+			throw error;
+		} finally {
+			process.off("SIGINT", stop);
+			process.off("SIGTERM", stop);
+		}
 	})
 });
 const statusCommand = defineCommand({
@@ -383,6 +725,7 @@ const feedbackCommand = defineCommand({
 		list: listCommand,
 		show: showCommand,
 		comment: commentCommand,
+		note: noteCommand,
 		attach: defineCommand({
 			meta: {
 				name: "attach",
@@ -439,7 +782,8 @@ const feedbackCommand = defineCommand({
 		}),
 		status: statusCommand,
 		mine: mineCommand,
-		report: reportCommand
+		report: reportCommand,
+		watch: watchCommand
 	}
 });
 //#endregion

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "./package-CdDH35SE.mjs";
+import { t as version } from "./package-CJJpjVh_.mjs";
 import { r as siteHeaderLine, t as setInvocationProfile } from "./site-DM2J10CB.mjs";
 import { a as notifyOfUpdate, o as runRefresh } from "./version-check-CcsA1QjI.mjs";
 import { defineCommand, runMain } from "citty";
@@ -63,36 +63,36 @@ const main = defineCommand({
 		description: "canopy — create and deploy vibecoded projects"
 	},
 	subCommands: {
-		login: () => import("./login-CtDWXICZ.mjs").then((m) => m.loginCommand),
-		whoami: () => import("./login-CtDWXICZ.mjs").then((m) => m.whoamiCommand),
-		logout: () => import("./login-CtDWXICZ.mjs").then((m) => m.logoutCommand),
-		create: () => import("./projects-Bm4oTodB.mjs").then((m) => m.createCommand),
-		init: () => import("./projects-Bm4oTodB.mjs").then((m) => m.initCommand),
-		projects: () => import("./projects-Bm4oTodB.mjs").then((m) => m.projectsCommand),
-		delete: () => import("./projects-Bm4oTodB.mjs").then((m) => m.deleteCommand),
-		dev: () => import("./dev-D_qzeLng.mjs").then((m) => m.devCommand),
-		deploy: () => import("./deploy-CqCyry4o.mjs").then((m) => m.deployCommand),
-		promote: () => import("./deploy-CqCyry4o.mjs").then((m) => m.promoteCommand),
-		staging: () => import("./staging-CU4QrzFX.mjs").then((m) => m.stagingCommand),
-		rollback: () => import("./deploy-CqCyry4o.mjs").then((m) => m.rollbackCommand),
-		download: () => import("./deploy-CqCyry4o.mjs").then((m) => m.downloadCommand),
-		token: () => import("./token-BWnLsWLg.mjs").then((m) => m.tokenCommand),
-		egress: () => import("./egress-ButFsQ2N.mjs").then((m) => m.egressCommand),
-		secrets: () => import("./secrets-BOKuWBYV.mjs").then((m) => m.secretsCommand),
-		schedule: () => import("./schedule-DdMq5eXC.mjs").then((m) => m.scheduleCommand),
-		feedback: () => import("./feedback-C5NKCOXQ.mjs").then((m) => m.feedbackCommand),
-		db: () => import("./db-CbqgjfYz.mjs").then((m) => m.dbCommand),
-		usage: () => import("./usage-Cqqvnzrf.mjs").then((m) => m.usageCommand),
-		ai: () => import("./ai-CjvrcBIz.mjs").then((m) => m.aiCommand),
-		open: () => import("./open-DXo60Ikf.mjs").then((m) => m.openCommand),
-		browse: () => import("./browse-CBelCgnW.mjs").then((m) => m.browseCommand),
-		docs: () => import("./docs-T1nuu00A.mjs").then((m) => m.docsCommand),
-		skill: () => import("./skill-3wOwhzDx.mjs").then((m) => m.skillCommand),
-		upgrade: () => import("./upgrade-BJ2dWjCG.mjs").then((m) => m.upgradeCommand),
-		logs: () => import("./logs-BltUi4Gp.mjs").then((m) => m.logsCommand),
-		mcp: () => import("./mcp-BwLRcfqz.mjs").then((m) => m.mcpCommand),
-		repo: () => import("./repo-DlYX_1tN.mjs").then((m) => m.repoCommand),
-		template: () => import("./project-template-DdT0dqpn.mjs").then((m) => m.templateCommand)
+		login: () => import("./login-B2FJGIrD.mjs").then((m) => m.loginCommand),
+		whoami: () => import("./login-B2FJGIrD.mjs").then((m) => m.whoamiCommand),
+		logout: () => import("./login-B2FJGIrD.mjs").then((m) => m.logoutCommand),
+		create: () => import("./projects-B3Wi01lw.mjs").then((m) => m.createCommand),
+		init: () => import("./projects-B3Wi01lw.mjs").then((m) => m.initCommand),
+		projects: () => import("./projects-B3Wi01lw.mjs").then((m) => m.projectsCommand),
+		delete: () => import("./projects-B3Wi01lw.mjs").then((m) => m.deleteCommand),
+		dev: () => import("./dev-BdSq6CGD.mjs").then((m) => m.devCommand),
+		deploy: () => import("./deploy-B7KItUnh.mjs").then((m) => m.deployCommand),
+		promote: () => import("./deploy-B7KItUnh.mjs").then((m) => m.promoteCommand),
+		staging: () => import("./staging-ypR79MlD.mjs").then((m) => m.stagingCommand),
+		rollback: () => import("./deploy-B7KItUnh.mjs").then((m) => m.rollbackCommand),
+		download: () => import("./deploy-B7KItUnh.mjs").then((m) => m.downloadCommand),
+		token: () => import("./token-CDrHQ5Xb.mjs").then((m) => m.tokenCommand),
+		egress: () => import("./egress-CzxRD6Tp.mjs").then((m) => m.egressCommand),
+		secrets: () => import("./secrets-CmY4dUHz.mjs").then((m) => m.secretsCommand),
+		schedule: () => import("./schedule-CbaDIJXr.mjs").then((m) => m.scheduleCommand),
+		feedback: () => import("./feedback-DFK0TXlt.mjs").then((m) => m.feedbackCommand),
+		db: () => import("./db-DGrCgj-R.mjs").then((m) => m.dbCommand),
+		usage: () => import("./usage-CP8rBVZi.mjs").then((m) => m.usageCommand),
+		ai: () => import("./ai-EyrXJC5z.mjs").then((m) => m.aiCommand),
+		open: () => import("./open-COFMburt.mjs").then((m) => m.openCommand),
+		browse: () => import("./browse-DEhnJAPT.mjs").then((m) => m.browseCommand),
+		docs: () => import("./docs-Bplp4sOY.mjs").then((m) => m.docsCommand),
+		skill: () => import("./skill-C2lGGz9n.mjs").then((m) => m.skillCommand),
+		upgrade: () => import("./upgrade-Caj1RsA7.mjs").then((m) => m.upgradeCommand),
+		logs: () => import("./logs-aJwWWaMx.mjs").then((m) => m.logsCommand),
+		mcp: () => import("./mcp-DuT6_wei.mjs").then((m) => m.mcpCommand),
+		repo: () => import("./repo-CmbakFVi.mjs").then((m) => m.repoCommand),
+		template: () => import("./project-template-DlzMx8Oj.mjs").then((m) => m.templateCommand)
 	}
 });
 const quiet = process.argv[2] === "mcp" && process.argv[3] === "serve" || process.argv[2] === "repo" && process.argv[3] === "credential";

package/dist/{local-BfqTheMP.mjs → local-BnfAEwso.mjs}

@@ -1,6 +1,6 @@
-import { n as apiDataRequest } from "./api-BPEYm9ts.mjs";
+import { r as apiDataRequest } from "./api-ArfD6-t5.mjs";
 import { a as realtimeRouter, c as META_COLUMNS, l as blobRouter, n as WORKER_ATTEST_HEADER, o as dbRouter, s as hasPrivateNames } from "./src-CxzGOEhP.mjs";
-import { a as rewriteApiPath } from "./dev-BtnEuAnS.mjs";
+import { a as rewriteApiPath } from "./dev-BMWj4NDZ.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";

package/dist/{login-CtDWXICZ.mjs → login-B2FJGIrD.mjs}

@@ -1,5 +1,6 @@
 import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-DM2J10CB.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { n as agentHeaders } from "./api-ArfD6-t5.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { n as clearRepoTokenCache } from "./repo-credential-CNDRM-tG.mjs";
 import { defineCommand } from "citty";
 import { hostname } from "node:os";
@@ -37,16 +38,29 @@ const whoamiCommand = defineCommand({
 		name: "whoami",
 		description: "Show the current Canopy login"
 	},
-	run: reportErrors("whoami", async () => {
+	args: { json: {
+		type: "boolean",
+		description: "Machine-readable JSON: { profile, email, apiUrl, cloud, tokenExpiresAt, expired }"
+	} },
+	run: reportErrors("whoami", async ({ args }) => {
 		const config = siteConfig();
 		if (!config.token) throw new Error("Not logged in — run `canopy login`.");
+		const expired = config.tokenExpiresAt !== void 0 && Date.parse(config.tokenExpiresAt) < Date.now();
+		if (args.json) {
+			console.log(JSON.stringify({
+				profile: config.profileId ?? null,
+				email: config.email ?? null,
+				apiUrl: config.apiUrl,
+				cloud: config.cloud ?? null,
+				tokenExpiresAt: config.tokenExpiresAt ?? null,
+				expired
+			}));
+			return;
+		}
 		console.log(config.email ?? "<unknown email>");
 		if (config.cloud) console.log(`Cloud: ${config.cloud}`);
 		console.log(`API: ${config.apiUrl}`);
-		if (config.tokenExpiresAt !== void 0) {
-			const expired = Date.parse(config.tokenExpiresAt) < Date.now();
-			console.log(expired ? `Token EXPIRED ${config.tokenExpiresAt} — run \`canopy login\` again.` : `Token expires ${config.tokenExpiresAt}.`);
-		}
+		if (config.tokenExpiresAt !== void 0) console.log(expired ? `Token EXPIRED ${config.tokenExpiresAt} — run \`canopy login\` again.` : `Token expires ${config.tokenExpiresAt}.`);
 	})
 });
 /**
@@ -60,7 +74,10 @@ async function revokeRemote(apiUrl, token) {
 	try {
 		const res = await fetch(`${apiUrl}/control/v1/account/token`, {
 			method: "DELETE",
-			headers: { authorization: `Bearer ${token}` }
+			headers: {
+				authorization: `Bearer ${token}`,
+				...agentHeaders()
+			}
 		});
 		if (res.ok || res.status === 401) return { ok: true };
 		return {

package/dist/{logs-BltUi4Gp.mjs → logs-aJwWWaMx.mjs}

@@ -1,6 +1,6 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 //#region src/logs.ts
 /**

package/dist/{mcp-BwLRcfqz.mjs → mcp-DuT6_wei.mjs}

@@ -1,6 +1,6 @@
-import { t as version } from "./package-CdDH35SE.mjs";
+import { t as version } from "./package-CJJpjVh_.mjs";
 import { d as tryResolveProject, l as stagingUrl, n as siteConfig, s as projectUrl } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, t as ApiError } from "./api-BPEYm9ts.mjs";
+import { a as apiRequest, t as ApiError } from "./api-ArfD6-t5.mjs";
 import { t as liveDevServer } from "./dev-server-file-Dk9pk4AR.mjs";
 import { defineCommand } from "citty";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";

package/dist/{migrations-CF1iNZ7F.mjs → migrations-CG_O5Ghw.mjs}

@@ -1,5 +1,5 @@
 import { u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { n as apiDataRequest } from "./api-BPEYm9ts.mjs";
+import { r as apiDataRequest } from "./api-ArfD6-t5.mjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/migrations.ts

package/dist/{open-DXo60Ikf.mjs → open-COFMburt.mjs}

@@ -1,5 +1,5 @@
 import { a as projectDirArgs, c as resolveProject, l as stagingUrl, s as projectUrl } from "./site-DM2J10CB.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { n as openBrowser, r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 //#region src/open.ts
 /**

package/dist/{package-CdDH35SE.mjs → package-CJJpjVh_.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.7.38";
+var version = "0.7.39";
 //#endregion
 export { version as t };

package/dist/project-template-DlzMx8Oj.mjs

@@ -0,0 +1,2 @@
+import { a as templateCommand } from "./project-template-DtTfXyLI.mjs";
+export { templateCommand };

package/dist/{project-template-BEr_tgIY.mjs → project-template-DtTfXyLI.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 /** Plain words for the API's template errors. */

package/dist/{projects-Bm4oTodB.mjs → projects-B3Wi01lw.mjs}

@@ -1,8 +1,8 @@
 import { n as siteConfig, s as projectUrl, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CHfKV6lG.mjs";
-import { i as nextSteps, n as describeCopy, r as fetchTemplate, t as TEMPLATE_FIXES } from "./project-template-BEr_tgIY.mjs";
-import { i as offerRepoOnCreate, n as cloneProjectRepo } from "./repo-CE22HpqZ.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors } from "./ui-CaHgvvkJ.mjs";
+import { i as nextSteps, n as describeCopy, r as fetchTemplate, t as TEMPLATE_FIXES } from "./project-template-DtTfXyLI.mjs";
+import { i as offerRepoOnCreate, n as cloneProjectRepo } from "./repo-4x-CJwCp.mjs";
 import { defineCommand } from "citty";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";

package/dist/{repo-CE22HpqZ.mjs → repo-4x-CJwCp.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, n as siteConfig, u as tryReadCanopyJson } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext, n as agentHeaders } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
 import { a as parseCredentialInput, i as helperCommand, o as runCredentialHelper, r as fileTokenCache, t as RepoCredentialError } from "./repo-credential-CNDRM-tG.mjs";
 import { defineCommand } from "citty";
 import { existsSync, realpathSync } from "node:fs";
@@ -322,7 +322,10 @@ async function mintRepoToken(profile, slug) {
 	const path = `/projects/${encodeURIComponent(slug)}/repo/token`;
 	const res = await fetch(`${config.apiUrl}/control/v1${path}`, {
 		method: "POST",
-		headers: { authorization: `Bearer ${config.token}` }
+		headers: {
+			authorization: `Bearer ${config.token}`,
+			...agentHeaders()
+		}
 	}).catch(() => null);
 	if (!res) throw new RepoCredentialError(`could not reach Canopy (${config.apiUrl}).`);
 	if (res.status === 201) return await res.json();

package/dist/repo-CmbakFVi.mjs

@@ -0,0 +1,2 @@
+import { a as repoCommand } from "./repo-4x-CJwCp.mjs";
+export { repoCommand };

package/dist/{schedule-DdMq5eXC.mjs → schedule-CbaDIJXr.mjs}

@@ -1,6 +1,6 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 //#region src/schedule.ts
 /**

package/dist/{secrets-BOKuWBYV.mjs → secrets-CmY4dUHz.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/secrets.ts

package/dist/skill/canopy/SKILL.md

@@ -107,7 +107,7 @@ and never go stale.
 - Use AI (`canopy.ai`): run `canopy ai models` before naming a model in code.
   Prefer the aliases `auto/low` (default) / `auto/mid` / `auto/high` over
   hard-coded ids — model ids outside that list are refused.
-- Work bug reports & feedback: `canopy feedback list | show | comment | status | report`
+- Work bug reports & feedback: `canopy feedback list | show | comment | note | status | report | watch`
   — see [Working feedback reports](#working-feedback-reports-issues) below
 - CI credentials: `canopy token create | list | revoke`
 - Git: `canopy repo show --json` (is there a repository, and its remote) ·
@@ -127,15 +127,18 @@ short version:
   `canopy feedback show <id>` has the body, captured context, and comment
   trail. The context includes the deploy version that served the bug —
   reproduce against that, not whatever is live now. The id is enough on its
-  own — `show`, `comment`, `status`, and `attach` work from any directory,
+  own — `show`, `comment`, `note`, `status`, and `attach` work from any directory,
   no `--project` needed.
 - Investigated ≠ fixed: write findings with
   `canopy feedback status <id> investigated --comment "<root cause>"`.
 - **`accepted` means a person said "build this."** Never set it on your own —
   only when the user you're working with says to build the thing.
 - Put tech-heavy notes (stack traces, table names, root-cause detail) in an
-  internal comment (`canopy feedback comment <id> "…" --internal`) so they
-  never reach the reporter.
+  internal note (`canopy feedback note <id> "…"`, same as `comment --internal`)
+  so they never reach the reporter.
+- `canopy feedback watch [--project <slug>]… [--json]` follows new reports,
+  comments and status changes live; it reconnects by itself. With `--json`
+  each line carries an `id` cursor — restart with `--after <id>` to resume.
 - Resolve only once the fix is actually live, and name the version:
   `canopy feedback status <id> resolved --comment "fixed in v42"`. Attach
   proof when it's visual: `canopy feedback attach <id> ./after-fix.png`.

package/dist/{skill-3wOwhzDx.mjs → skill-C2lGGz9n.mjs}

@@ -1,5 +1,5 @@
-import { t as version } from "./package-CdDH35SE.mjs";
-import { r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { t as version } from "./package-CJJpjVh_.mjs";
+import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{staging-CU4QrzFX.mjs → staging-ypR79MlD.mjs}

@@ -1,6 +1,6 @@
 import { c as resolveProject, l as stagingUrl, o as projectFlagArgs, s as projectUrl } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { a as unwrap, i as requireTty, r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import * as p from "@clack/prompts";
 //#region src/staging.ts

package/dist/{token-BWnLsWLg.mjs → token-CDrHQ5Xb.mjs}

@@ -1,6 +1,6 @@
 import { a as projectDirArgs, c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { i as apiRequest } from "./api-BPEYm9ts.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {

package/dist/{ui-CHfKV6lG.mjs → ui-CaHgvvkJ.mjs}

@@ -1,4 +1,4 @@
-import { t as ApiError } from "./api-BPEYm9ts.mjs";
+import { t as ApiError } from "./api-ArfD6-t5.mjs";
 import { spawn } from "node:child_process";
 import { cancel, isCancel } from "@clack/prompts";
 //#region src/ui.ts

package/dist/{upgrade-BJ2dWjCG.mjs → upgrade-Caj1RsA7.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-3wOwhzDx.mjs");
+		const { skillInstalled } = await import("./skill-C2lGGz9n.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/dist/{usage-Cqqvnzrf.mjs → usage-CP8rBVZi.mjs}

@@ -1,6 +1,6 @@
 import { c as resolveProject, o as projectFlagArgs } from "./site-DM2J10CB.mjs";
-import { i as apiRequest, o as withContext } from "./api-BPEYm9ts.mjs";
-import { r as reportErrors } from "./ui-CHfKV6lG.mjs";
+import { a as apiRequest, l as withContext } from "./api-ArfD6-t5.mjs";
+import { r as reportErrors } from "./ui-CaHgvvkJ.mjs";
 import { defineCommand } from "citty";
 //#region src/usage.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.38",
+  "version": "0.7.39",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/dev-D_qzeLng.mjs

@@ -1,2 +0,0 @@
-import { n as devCommand } from "./dev-BtnEuAnS.mjs";
-export { devCommand };

package/dist/project-template-DdT0dqpn.mjs

@@ -1,2 +0,0 @@
-import { a as templateCommand } from "./project-template-BEr_tgIY.mjs";
-export { templateCommand };

package/dist/repo-DlYX_1tN.mjs

@@ -1,2 +0,0 @@
-import { a as repoCommand } from "./repo-CE22HpqZ.mjs";
-export { repoCommand };