checkly 9.5.0 → 10.0.0-rc.1-prerelease-b6d3542

package/dist/ai-context/context.js

@@ -133,6 +133,7 @@ import { Frequency } from 'checkly/constructs'
 export default defineConfig({
   projectName: "Production Monitoring Suite",
   logicalId: "prod-monitoring-2025",
+  // Must be this repo's own remote (\`git remote get-url origin\` as https). Never copy this example value.
   repoUrl: "https://github.com/acme/monitoring",
   checks: {
     activated: true,

package/dist/ai-context/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/ai-context/context.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,gFAAgF;KAC9F;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,WAAW,EAAE,oFAAoF;KAClG;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,sDAAsD;KACpE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,sDAAsD;KACpE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,sDAAsD;KACpE;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,gFAAgF;KAC9F;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,wGAAwG;KACtH;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,uGAAuG;KACrH;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,WAAW,EAAE,8FAA8F;KAC5G;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,WAAW,EAAE,kDAAkD;KAChE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,+DAA+D;KAC7E;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,gPAAgP;KAC9P;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,WAAW,EAAE,6IAA6I;KAC3J;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,8RAA8R;KAC5S;CACO,CAAA;AAEV,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,4HAA4H;KAC1I;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,+GAA+G;KAC7H;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,WAAW,EAAE,wHAAwH;KACtI;CACO,CAAA;AAEV,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,uFAAuF;KACrG;CACO,CAAA;AAEV,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,4FAA4F;KAC1G;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,+FAA+F;KAC7G;CACO,CAAA;AAEV,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,iJAAiJ;CACtJ,CAAA;AAEV,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB;QACE,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,4EAA4E;KAC1F;IACD;QACE,EAAE,EAAE,WAAW;QACf,WAAW,EAAE,wFAAwF;QACrG,UAAU,EAAE,UAAU;KACvB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,0GAA0G;QACvH,UAAU,EAAE,sBAAsB;KACnC;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,mEAAmE;QAChF,UAAU,EAAE,sBAAsB;KACnC;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,2FAA2F;QACxG,UAAU,EAAE,iBAAiB;KAC9B;CACO,CAAA;AASV,MAAM,CAAC,MAAM,eAAe,GAAkC;IAC5D,cAAc,EAAE;QACd,cAAc,EAAE,kCAAkC;QAClD,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgClB;QACG,SAAS,EAAE,oDAAoD;KAChE;IACD,aAAa,EAAE;QACb,cAAc,EAAE,iCAAiC;QACjD,iBAAiB,EACf,+EAA+E;QACjF,SAAS,EAAE,0DAA0D;KACtE;IACD,gBAAgB,EAAE;QAChB,cAAc,EAAE,oCAAoC;QACpD,aAAa,EAAE;;;;;;;;;;;;;;CAclB;QACG,SAAS,EAAE,6DAA6D;KACzE;IACD,SAAS,EAAE;QACT,cAAc,EAAE,6BAA6B;QAC7C,iBAAiB,EACf,mEAAmE;QACrE,SAAS,EAAE,sDAAsD;KAClE;IACD,eAAe,EAAE;QACf,cAAc,EAAE,mCAAmC;QACnD,iBAAiB,EACf,sFAAsF;QACxF,SAAS,EAAE,4DAA4D;KACxE;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EAAE,qDAAqD;QACxE,SAAS,EAAE,wDAAwD;KACpE;IACD,iBAAiB,EAAE;QACjB,cAAc,EAAE,qCAAqC;QACrD,iBAAiB,EACf,iEAAiE;QACnE,SAAS,EAAE,8DAA8D;KAC1E;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EAAE,qDAAqD;QACxE,SAAS,EAAE,wDAAwD;KACpE;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EAAE,qDAAqD;QACxE,SAAS,EAAE,wDAAwD;KACpE;IACD,YAAY,EAAE;QACZ,cAAc,EAAE,gCAAgC;QAChD,iBAAiB,EAAE,uDAAuD;QAC1E,SAAS,EAAE,yDAAyD;KACrE;IACD,YAAY,EAAE;QACZ,cAAc,EAAE,gCAAgC;QAChD,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBlB;QACG,SAAS,EAAE,yDAAyD;KACrE;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBlB;QACG,SAAS,EAAE,wDAAwD;KACpE;IACD,kBAAkB,EAAE;QAClB,cAAc,EAAE,sCAAsC;QACtD,aAAa,EAAE;;;;;;;;;;;;;;;;;;;CAmBlB;QACG,SAAS,EAAE,+DAA+D;KAC3E;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EACf,4DAA4D;QAC9D,SAAS,EAAE,wDAAwD;KACpE;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EAAE,qDAAqD;QACxE,SAAS,EAAE,wDAAwD;KACpE;IACD,mBAAmB,EAAE;QACnB,cAAc,EAAE,uCAAuC;QACvD,iBAAiB,EACf,0DAA0D;QAC5D,SAAS,EAAE,gEAAgE;KAC5E;IACD,SAAS,EAAE;QACT,cAAc,EAAE,6BAA6B;QAC7C,iBAAiB,EACf,mEAAmE;QACrE,SAAS,EAAE,sDAAsD;KAClE;IACD,kBAAkB,EAAE;QAClB,cAAc,EAAE,sCAAsC;QACtD,iBAAiB,EACf,mEAAmE;QACrE,SAAS,EAAE,+DAA+D;KAC3E;IACD,gBAAgB,EAAE;QAChB,cAAc,EAAE,oCAAoC;QACpD,iBAAiB,EACf,+DAA+D;QACjE,SAAS,EAAE,6DAA6D;KACzE;IACD,mBAAmB,EAAE;QACnB,cAAc,EAAE,uCAAuC;QACvD,iBAAiB,EAAE,8CAA8C;QACjE,SAAS,EAAE,gEAAgE;KAC5E;IACD,wBAAwB,EAAE;QACxB,cAAc,EAAE,4CAA4C;QAC5D,iBAAiB,EAAE,wDAAwD;QAC3E,SAAS,EAAE,qEAAqE;KACjF;IACD,uBAAuB,EAAE;QACvB,cAAc,EAAE,2CAA2C;QAC3D,iBAAiB,EAAE,8DAA8D;QACjF,SAAS,EAAE,oEAAoE;KAChF;IACD,sBAAsB,EAAE;QACtB,cAAc,EAAE,0CAA0C;QAC1D,iBAAiB,EAAE,yDAAyD;QAC5E,SAAS,EAAE,mEAAmE;KAC/E;IACD,wBAAwB,EAAE;QACxB,cAAc,EAAE,4CAA4C;QAC5D,iBAAiB,EAAE,6DAA6D;QAChF,SAAS,EAAE,qEAAqE;KACjF;IACD,qBAAqB,EAAE;QACrB,cAAc,EAAE,yCAAyC;QACzD,iBAAiB,EAAE,sDAAsD;QACzE,SAAS,EAAE,kEAAkE;KAC9E;CACF,CAAA"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/ai-context/context.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,gFAAgF;KAC9F;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,WAAW,EAAE,oFAAoF;KAClG;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,sDAAsD;KACpE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,sDAAsD;KACpE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,sDAAsD;KACpE;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,gFAAgF;KAC9F;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,wGAAwG;KACtH;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,uGAAuG;KACrH;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,WAAW,EAAE,8FAA8F;KAC5G;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,WAAW,EAAE,kDAAkD;KAChE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,+DAA+D;KAC7E;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,gPAAgP;KAC9P;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,WAAW,EAAE,6IAA6I;KAC3J;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,8RAA8R;KAC5S;CACO,CAAA;AAEV,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,4HAA4H;KAC1I;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,+GAA+G;KAC7H;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,WAAW,EAAE,wHAAwH;KACtI;CACO,CAAA;AAEV,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,uFAAuF;KACrG;CACO,CAAA;AAEV,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,4FAA4F;KAC1G;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,+FAA+F;KAC7G;CACO,CAAA;AAEV,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,iJAAiJ;CACtJ,CAAA;AAEV,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB;QACE,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,4EAA4E;KAC1F;IACD;QACE,EAAE,EAAE,WAAW;QACf,WAAW,EAAE,wFAAwF;QACrG,UAAU,EAAE,UAAU;KACvB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,0GAA0G;QACvH,UAAU,EAAE,sBAAsB;KACnC;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,mEAAmE;QAChF,UAAU,EAAE,sBAAsB;KACnC;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,2FAA2F;QACxG,UAAU,EAAE,iBAAiB;KAC9B;CACO,CAAA;AASV,MAAM,CAAC,MAAM,eAAe,GAAkC;IAC5D,cAAc,EAAE;QACd,cAAc,EAAE,kCAAkC;QAClD,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiClB;QACG,SAAS,EAAE,oDAAoD;KAChE;IACD,aAAa,EAAE;QACb,cAAc,EAAE,iCAAiC;QACjD,iBAAiB,EACf,+EAA+E;QACjF,SAAS,EAAE,0DAA0D;KACtE;IACD,gBAAgB,EAAE;QAChB,cAAc,EAAE,oCAAoC;QACpD,aAAa,EAAE;;;;;;;;;;;;;;CAclB;QACG,SAAS,EAAE,6DAA6D;KACzE;IACD,SAAS,EAAE;QACT,cAAc,EAAE,6BAA6B;QAC7C,iBAAiB,EACf,mEAAmE;QACrE,SAAS,EAAE,sDAAsD;KAClE;IACD,eAAe,EAAE;QACf,cAAc,EAAE,mCAAmC;QACnD,iBAAiB,EACf,sFAAsF;QACxF,SAAS,EAAE,4DAA4D;KACxE;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EAAE,qDAAqD;QACxE,SAAS,EAAE,wDAAwD;KACpE;IACD,iBAAiB,EAAE;QACjB,cAAc,EAAE,qCAAqC;QACrD,iBAAiB,EACf,iEAAiE;QACnE,SAAS,EAAE,8DAA8D;KAC1E;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EAAE,qDAAqD;QACxE,SAAS,EAAE,wDAAwD;KACpE;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EAAE,qDAAqD;QACxE,SAAS,EAAE,wDAAwD;KACpE;IACD,YAAY,EAAE;QACZ,cAAc,EAAE,gCAAgC;QAChD,iBAAiB,EAAE,uDAAuD;QAC1E,SAAS,EAAE,yDAAyD;KACrE;IACD,YAAY,EAAE;QACZ,cAAc,EAAE,gCAAgC;QAChD,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBlB;QACG,SAAS,EAAE,yDAAyD;KACrE;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBlB;QACG,SAAS,EAAE,wDAAwD;KACpE;IACD,kBAAkB,EAAE;QAClB,cAAc,EAAE,sCAAsC;QACtD,aAAa,EAAE;;;;;;;;;;;;;;;;;;;CAmBlB;QACG,SAAS,EAAE,+DAA+D;KAC3E;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EACf,4DAA4D;QAC9D,SAAS,EAAE,wDAAwD;KACpE;IACD,WAAW,EAAE;QACX,cAAc,EAAE,+BAA+B;QAC/C,iBAAiB,EAAE,qDAAqD;QACxE,SAAS,EAAE,wDAAwD;KACpE;IACD,mBAAmB,EAAE;QACnB,cAAc,EAAE,uCAAuC;QACvD,iBAAiB,EACf,0DAA0D;QAC5D,SAAS,EAAE,gEAAgE;KAC5E;IACD,SAAS,EAAE;QACT,cAAc,EAAE,6BAA6B;QAC7C,iBAAiB,EACf,mEAAmE;QACrE,SAAS,EAAE,sDAAsD;KAClE;IACD,kBAAkB,EAAE;QAClB,cAAc,EAAE,sCAAsC;QACtD,iBAAiB,EACf,mEAAmE;QACrE,SAAS,EAAE,+DAA+D;KAC3E;IACD,gBAAgB,EAAE;QAChB,cAAc,EAAE,oCAAoC;QACpD,iBAAiB,EACf,+DAA+D;QACjE,SAAS,EAAE,6DAA6D;KACzE;IACD,mBAAmB,EAAE;QACnB,cAAc,EAAE,uCAAuC;QACvD,iBAAiB,EAAE,8CAA8C;QACjE,SAAS,EAAE,gEAAgE;KAC5E;IACD,wBAAwB,EAAE;QACxB,cAAc,EAAE,4CAA4C;QAC5D,iBAAiB,EAAE,wDAAwD;QAC3E,SAAS,EAAE,qEAAqE;KACjF;IACD,uBAAuB,EAAE;QACvB,cAAc,EAAE,2CAA2C;QAC3D,iBAAiB,EAAE,8DAA8D;QACjF,SAAS,EAAE,oEAAoE;KAChF;IACD,sBAAsB,EAAE;QACtB,cAAc,EAAE,0CAA0C;QAC1D,iBAAiB,EAAE,yDAAyD;QAC5E,SAAS,EAAE,mEAAmE;KAC/E;IACD,wBAAwB,EAAE;QACxB,cAAc,EAAE,4CAA4C;QAC5D,iBAAiB,EAAE,6DAA6D;QAChF,SAAS,EAAE,qEAAqE;KACjF;IACD,qBAAqB,EAAE;QACrB,cAAc,EAAE,yCAAyC;QACzD,iBAAiB,EAAE,sDAAsD;QACzE,SAAS,EAAE,kEAAkE;KAC9E;CACF,CAAA"}

package/dist/ai-context/onboarding-boilerplate/checkly-config-template.ts

@@ -10,6 +10,8 @@ const config = defineConfig({
   * See https://www.checklyhq.com/docs/cli/constructs/ to learn more about logical IDs.
   */
   logicalId: '{{logicalId}}',
+  /* The URL of this project's git repository, used to link checks to their source code */
+  repoUrl: '{{repoUrl}}',
   /* Sets default values for Checks */
   checks: {
     /* A default for how often your Check should run in minutes */

package/dist/ai-context/public-skills/checkly/SKILL.md

@@ -17,15 +17,28 @@ Before your first command that talks to the Checkly API, establish your path:
 1. **No shell access** (chat-only session): stop following this skill and use the Checkly MCP tools if they're connected; if not, tell the user you need either a shell or the Checkly MCP server to work with Checkly.
 2. **Shell access**: run `npx checkly whoami` once.
    - **Succeeds** → use the CLI for everything and keep following this skill, even when Checkly MCP tools are also connected.
-   - **Fails with an auth error** → route by task:
-     - *Authoring, testing, or deploying checks*: MCP cannot do this. Ask the user to authenticate — `npx checkly login`, or `CHECKLY_API_KEY` + `CHECKLY_ACCOUNT_ID` in the environment or `.env` — then re-run `whoami`. Don't work around a missing login.
-     - *Live account work* (status, results, test sessions, RCA, triggering, incidents): fall back to the Checkly MCP tools if they're connected. Call the MCP `whoami` tool first and tell the user which account you're operating on. If MCP isn't connected either, ask the user to authenticate the CLI as above.
+   - **Fails with an auth error, or prints an `action_required` login line** (not logged in) → route by task:
+     - *Authoring, testing, or deploying checks*: MCP cannot do this. Log in through the CLI yourself (see "Logging in as an agent" below), or, when the user prefers keys, ask for `CHECKLY_API_KEY` + `CHECKLY_ACCOUNT_ID` in the environment or `.env`. Then re-run `whoami`. Don't work around a missing login.
+     - *Live account work* (status, results, test sessions, RCA, triggering, incidents): fall back to the Checkly MCP tools if they're connected; ignore the login code. Call the MCP `whoami` tool first and tell the user which account you're operating on. If MCP isn't connected either, ask the user to authenticate the CLI as above.
 
 Two rules that survive any fallback:
 
 - **Account parity.** CLI auth and the MCP session can point at different accounts — users often belong to several. Never mix CLI and MCP results in one task without confirming both use the same account ID, and always name the account after a fallback.
 - **Writes still need confirmation.** The CLI's confirmation protocol (below) does not travel with you to MCP. If you fall back for a write action (e.g. creating an incident), present the intended change and get the user's approval before calling the tool.
 
+## Logging in as an agent
+
+`npx checkly login` needs no terminal, and any command that requires authentication starts it for you when no credentials are stored, so you rarely run it by hand. It prints one JSON line and exits; when another command started it, the line goes to stderr. Relay what it says; never guess:
+
+- `{"status":"action_required","reason":"login_required","verification_uri_complete":…,"user_code":…,"expires_in":…}` — a human must approve. Give the user the URL and the code (valid for `expires_in` seconds). Users without a Checkly account can sign up on the same page. Once they say they are done, run the same command again: it picks up the approval. (When another command started the login, run that command again; it picks up the approval and does its work.) Running it earlier shows the code again (or a new one when the old one is about to expire); always relay the latest `user_code`. Until the login is done, don't run several Checkly commands in parallel.
+  - If the line has a `verification_uri` but no `user_code`, the URL must be opened on the same machine as the CLI, and the command waits for it instead of exiting: run it in the background so you can relay the URL.
+  - If it has no URL and its `next` has no `when`, run that command now, in the background, relay what it prints, and run the original command again once the user is done (running it earlier only repeats this line).
+- `{"status":"action_required","reason":"select_account","choices":[…],"next":[…]}` — the key is stored, but the user belongs to several accounts. Ask the user which one (or use an id they already gave you) and run `npx checkly login --account-id <id>`. Never pick one yourself, even if you cannot ask: stop and say which accounts are available. There is no second browser step. The same command switches accounts later.
+- `{"status":"success","reason":…,"message":…,"accountId":…,"accountName":…}` — done. Tell the user which account you are on.
+- `{"status":"error","reason":…,"message":…}` — report the message; do not retry in a loop. `reason` is one of `access_denied`, `expired_token`, `code_used` (run the login again for a new code), `account_not_found`, `no_accounts`, `invalid_response`, `network_error` (the login server could not be reached), `api_error`, `env_credentials` (credentials are set in the environment; the user must remove them to log in) or `login_failed`. To log in as a different user, run `npx checkly logout` first.
+
+On a host without a browser set `CHECKLY_NO_BROWSER=1` so the CLI does not try to open one; the URL and code are printed regardless. The flag forms are `--account-id` and `--no-browser`.
+
 ## Always load the current action list first
 
 **Required:** Before answering any Checkly question, run `npx checkly skills` to get the current and up-to-date action list. Do not rely on memory or prior context — the CLI is the source of truth and actions might change between releases. `npx checkly skills` runs locally — it needs no authentication or API access, so it works before you've established your path above.
@@ -54,9 +67,9 @@ Run `npx checkly skills manage` for the full reference.
 
 ## Confirmation Protocol
 
-Write commands (e.g. `incidents create`, `deploy`, `destroy`) return exit code 2 with a `confirmation_required` JSON envelope instead of executing. **Always present the `changes` to the user and wait for approval before running the `confirmCommand`.** This applies to every write command individually — updates and resolutions need confirmation too, not just the initial create.
+Write commands (e.g. `incidents create`, `deploy`, `destroy`) return exit code 2 with a `confirmation_required` JSON envelope instead of executing. **Always present the `changes` to the user and wait for approval before running the `confirmCommand`.** This applies to every write command individually — updates and resolutions need confirmation too, not just the initial create. The one exception is a `checkly deploy` whose plan has no changes: there is nothing to approve, so it prints `No changes.`, records the deployment, schedules no checks unless `--schedule-on-deploy --schedule-on-deploy-scope=all` is passed, and exits with code 0. A deploy schedules checks only when `--schedule-on-deploy` is passed: then only the checks it changed, or with `--schedule-on-deploy-scope=all` every check, unless there are more of them than the scheduling threshold allows (`--schedule-on-deploy-threshold`, by default set by Checkly), leaving out the checks that run more often than the minimum frequency for deploys (`--schedule-on-deploy-min-frequency`, by default set by Checkly).
 
-The `confirmCommand` is the approved command, ready to run verbatim: it repeats the flags you passed and already ends in `--force`. Run it as-is once the user approves — don't add `--force` to a command yourself, and don't add flags the user didn't ask for.
+The `confirmCommand` is the approved command, ready to run verbatim: it starts with `npx checkly` so the project's own CLI runs, repeats the flags you passed (and, for `deploy`, pins the plan it showed with `--plan-token`) and already ends in `--force`. Run it as-is once the user approves — don't add `--force` to a command yourself, don't drop the `npx`, and don't add flags the user didn't ask for.
 
 Run `npx checkly skills communicate` for the full protocol details, or `npx checkly skills configure` for what `deploy` confirms.
 

package/dist/ai-context/skills-command/references/communicate.md

@@ -13,7 +13,7 @@ Write commands (`incidents create`, `incidents update`, `incidents resolve`, `de
   "description": "Create incident on status page",
   "classification": { "readOnly": false, "destructive": false, "idempotent": false },
   "changes": ["Will create incident \"DB outage\" on status page \"Acme\"", "Severity: major"],
-  "confirmCommand": "checkly incidents create --title=\"DB outage\" --status-page-id=\"sp-1\" --severity=\"major\" --force"
+  "confirmCommand": "npx checkly incidents create --title=\"DB outage\" --status-page-id=\"sp-1\" --severity=\"major\" --force"
 }
 ```
 
@@ -24,12 +24,15 @@ Write commands (`incidents create`, `incidents update`, `incidents resolve`, `de
 3. This applies to **every** write command, not just the first one. Incident updates and resolutions also require confirmation.
 4. Use `--dry-run` to preview what a command will do without executing or prompting.
 5. Read-only commands (`incidents list`, `status-pages list`) execute immediately without confirmation.
+6. A `checkly deploy` whose plan has no changes is the one write command that returns no envelope: it prints `No changes.`, records the deployment, schedules no checks unless `--schedule-on-deploy --schedule-on-deploy-scope=all` is passed, and exits with code 0. A deploy schedules checks only when `--schedule-on-deploy` is passed: then only the checks it changed, or with `--schedule-on-deploy-scope=all` every check, unless there are more of them than the scheduling threshold allows (`--schedule-on-deploy-threshold`, by default set by Checkly), leaving out the checks that run more often than the minimum frequency for deploys (`--schedule-on-deploy-min-frequency`, by default set by Checkly).
 
-The `confirmCommand` omits flags left at their default, so a bare `npx checkly deploy` confirms as `checkly deploy --force` rather than echoing back every boolean the parser filled in. Treat every flag you see there as deliberate.
+The `confirmCommand` omits flags left at their default, so a bare `npx checkly deploy` confirms as `npx checkly deploy --plan-token="<token>" --force`: the token of the plan it showed, and none of the booleans the parser filled in. Treat every flag you see there as deliberate.
 
 ### Commands that pin a resolved target
 
-A command that picks its own target before confirming writes that target back into the `confirmCommand`. `import commit` and `import cancel` do this: run without `--plan-id` they select the only candidate plan themselves, and confirm as `checkly import commit --plan-id="<resolved-id>" --force` — carrying a flag you never passed. That is deliberate: the pinned ID guarantees the approved run acts on the plan whose `changes` you showed the user, not on whatever happens to be pending by then. Run the `confirmCommand` exactly as returned; do not strip the flag or fall back to the bare command.
+A command that picks its own target before confirming writes that target back into the `confirmCommand`. `import commit` and `import cancel` do this: run without `--plan-id` they select the only candidate plan themselves, and confirm as `npx checkly import commit --plan-id="<resolved-id>" --force` — carrying a flag you never passed. That is deliberate: the pinned ID guarantees the approved run acts on the plan whose `changes` you showed the user, not on whatever happens to be pending by then. Run the `confirmCommand` exactly as returned; do not strip the flag or fall back to the bare command.
+
+`deploy` pins the same way, with `--plan-token`: the token identifies the state of the account the plan was computed against, and the pinned run refuses to deploy — writing nothing — if anything changed in between. Re-run `checkly deploy` in that case; it computes a fresh plan to confirm. A `deploy --no-plan` has no plan to pin and takes no token. Do not carry a token over from an earlier run, and do not re-send a refused one.
 
 ## Available Commands
 

package/dist/ai-context/skills-command/references/configure-api-checks.md

@@ -13,7 +13,7 @@
 **Reference:** https://www.checklyhq.com/docs/constructs/api-check/
 
 ```typescript
-import { AlertEscalationBuilder, ApiCheck, Frequency, RetryStrategyBuilder } from 'checkly/constructs'
+import { ApiCheck, Frequency, RetryStrategyBuilder } from 'checkly/constructs'
 
 new ApiCheck('example-api-check', {
   name: 'Example API Check',
@@ -25,19 +25,11 @@ new ApiCheck('example-api-check', {
   },
   degradedResponseTime: 5000,
   maxResponseTime: 20000,
-  activated: true,
   locations: [
     'eu-central-1',
     'eu-west-2',
   ],
   frequency: Frequency.EVERY_5M,
-  alertEscalationPolicy: AlertEscalationBuilder.runBasedEscalation(1, {
-    amount: 0,
-    interval: 5,
-  }, {
-    enabled: false,
-    percentage: 10,
-  }),
   retryStrategy: RetryStrategyBuilder.noRetries(),
   runParallel: true,
   request: {

package/dist/ai-context/skills-command/references/configure-browser-checks.md

@@ -10,7 +10,7 @@
 **Reference:** https://www.checklyhq.com/docs/constructs/browser-check/
 
 ```typescript
-import { AlertEscalationBuilder, BrowserCheck, Frequency, RetryStrategyBuilder } from 'checkly/constructs'
+import { BrowserCheck, Frequency, RetryStrategyBuilder } from 'checkly/constructs'
 
 new BrowserCheck('example-browser-check', {
   name: 'Example Browser Check',
@@ -23,13 +23,6 @@ new BrowserCheck('example-browser-check', {
     'eu-west-2',
   ],
   frequency: Frequency.EVERY_10M,
-  alertEscalationPolicy: AlertEscalationBuilder.runBasedEscalation(1, {
-    amount: 0,
-    interval: 5,
-  }, {
-    enabled: false,
-    percentage: 10,
-  }),
   retryStrategy: RetryStrategyBuilder.noRetries(),
   runParallel: true,
 })

package/dist/ai-context/skills-command/references/configure-check-groups.md

@@ -12,5 +12,6 @@ import { CheckGroupV2 } from 'checkly/constructs'
 
 export const exampleGroup = new CheckGroupV2('example-group', {
   name: 'Example Group',
+  concurrency: 1,
 })
 ```

package/dist/ai-context/skills-command/references/configure-dns-monitors.md

@@ -8,25 +8,17 @@
 **Reference:** https://www.checklyhq.com/docs/constructs/dns-monitor/
 
 ```typescript
-import { AlertEscalationBuilder, DnsAssertionBuilder, DnsMonitor, Frequency, RetryStrategyBuilder } from 'checkly/constructs'
+import { DnsAssertionBuilder, DnsMonitor, Frequency, RetryStrategyBuilder } from 'checkly/constructs'
 
 new DnsMonitor('example-dns-monitor', {
   name: 'Example DNS Monitor',
   degradedResponseTime: 500,
   maxResponseTime: 1000,
-  activated: true,
   locations: [
     'eu-central-1',
     'eu-north-1',
   ],
   frequency: Frequency.EVERY_10M,
-  alertEscalationPolicy: AlertEscalationBuilder.runBasedEscalation(1, {
-    amount: 0,
-    interval: 5,
-  }, {
-    enabled: false,
-    percentage: 10,
-  }),
   retryStrategy: RetryStrategyBuilder.noRetries(),
   request: {
     recordType: 'AAAA',

package/dist/ai-context/skills-command/references/configure-grpc-monitors.md

@@ -35,3 +35,27 @@ new GrpcMonitor('grpc-api-health', {
   },
 })
 ```
+
+## FlatBuffers services
+
+Only applies when the service uses FlatBuffers instead of Protobuf. Protobuf is the default; omit `grpcConfig.encoding` otherwise.
+
+- FlatBuffers requires `BEHAVIOR` mode; `HEALTH` mode always uses Protobuf.
+- Compile the `.fbs` source schema to a binary `.bfbs` schema with `flatc -b --schema --bfbs-builtins schema.fbs`. `--bfbs-builtins` preserves attributes used for streaming and nested FlatBuffers fields.
+- Set `grpcConfig.encoding` to `'FLATBUFFERS'` and load the compiled schema as base64 into `bfbsContent`. Do not set `serviceDefinition` or `protoContent`; FlatBuffers has no server reflection.
+
+```typescript
+import { readFileSync } from 'node:fs'
+
+request: {
+  url: 'grpc.example.com',
+  port: 443,
+  grpcConfig: {
+    mode: 'BEHAVIOR',
+    encoding: 'FLATBUFFERS',
+    bfbsContent: readFileSync('schema.bfbs').toString('base64'),
+    method: 'example.Greeter/Greet',
+    message: JSON.stringify({ name: 'Checkly' }),
+  },
+}
+```

package/dist/ai-context/skills-command/references/configure-heartbeat-monitors.md

@@ -5,7 +5,7 @@
 **Reference:** https://www.checklyhq.com/docs/constructs/heartbeat-monitor/
 
 ```typescript
-import { AlertEscalationBuilder, Frequency, HeartbeatMonitor, RetryStrategyBuilder } from 'checkly/constructs'
+import { Frequency, HeartbeatMonitor, RetryStrategyBuilder } from 'checkly/constructs'
 
 new HeartbeatMonitor('example-heartbeat-monitor', {
   name: 'Example Heartbeat Monitor',
@@ -13,15 +13,7 @@ new HeartbeatMonitor('example-heartbeat-monitor', {
   periodUnit: 'hours',
   grace: 30,
   graceUnit: 'minutes',
-  activated: true,
   frequency: Frequency.EVERY_10S,
-  alertEscalationPolicy: AlertEscalationBuilder.runBasedEscalation(1, {
-    amount: 0,
-    interval: 5,
-  }, {
-    enabled: false,
-    percentage: 10,
-  }),
   retryStrategy: RetryStrategyBuilder.noRetries(),
   runParallel: true,
 })

package/dist/ai-context/skills-command/references/configure-icmp-monitors.md

@@ -10,7 +10,7 @@
 **Reference:** https://www.checklyhq.com/docs/constructs/icmp-monitor/
 
 ```typescript
-import { AlertEscalationBuilder, Frequency, IcmpAssertionBuilder, IcmpMonitor, RetryStrategyBuilder } from 'checkly/constructs'
+import { Frequency, IcmpAssertionBuilder, IcmpMonitor, RetryStrategyBuilder } from 'checkly/constructs'
 
 new IcmpMonitor('example-icmp-monitor', {
   name: 'Example ICMP Monitor',
@@ -24,19 +24,11 @@ new IcmpMonitor('example-icmp-monitor', {
   },
   degradedPacketLossThreshold: 10,
   maxPacketLossThreshold: 20,
-  activated: true,
   locations: [
     'eu-central-1',
     'eu-north-1',
   ],
   frequency: Frequency.EVERY_10M,
-  alertEscalationPolicy: AlertEscalationBuilder.runBasedEscalation(1, {
-    amount: 0,
-    interval: 5,
-  }, {
-    enabled: false,
-    percentage: 10,
-  }),
   retryStrategy: RetryStrategyBuilder.noRetries(),
 })
 ```

package/dist/ai-context/skills-command/references/configure-multistep-checks.md

@@ -8,26 +8,18 @@
 **Reference:** https://www.checklyhq.com/docs/constructs/multistep-check/
 
 ```typescript
-import { AlertEscalationBuilder, Frequency, MultiStepCheck, RetryStrategyBuilder } from 'checkly/constructs'
+import { Frequency, MultiStepCheck, RetryStrategyBuilder } from 'checkly/constructs'
 
 new MultiStepCheck('example-multi-step-check', {
   name: 'Example Multistep Check',
   code: {
     entrypoint: './example-multistep-check.spec.ts',
   },
-  activated: true,
   locations: [
     'eu-central-1',
     'eu-west-2',
   ],
   frequency: Frequency.EVERY_1H,
-  alertEscalationPolicy: AlertEscalationBuilder.runBasedEscalation(1, {
-    amount: 0,
-    interval: 5,
-  }, {
-    enabled: false,
-    percentage: 10,
-  }),
   retryStrategy: RetryStrategyBuilder.noRetries(),
   runParallel: true,
 })

package/dist/ai-context/skills-command/references/configure-playwright-checks.md

@@ -19,7 +19,7 @@
   - The workspace's package manager binary must be available on the machine running the CLI. pnpm resolves against the workspace's own store plus cached registry metadata, npm reuses its cached metadata, and both only contact the registry for misses; yarn Berry and bun regenerate offline.
   - When pruning was needed but cannot run or cannot verify its result, the original lockfile ships unchanged and the CLI prints a note explaining why — follow it (a timed-out prune's note names `CHECKLY_LOCKFILE_PRUNE_TIMEOUT=<seconds>`, which raises the default 30 s budget). Skips are silent when there is nothing to prune, or when pruning is disabled via `CHECKLY_LOCKFILE_PRUNE=0`; silent skip reasons, a timed-out prune's partial package manager output, and per-entry embed match details are visible under `DEBUG='checkly:cli:services:check-parser:*'` and `DEBUG='checkly:cli:services:embedded-packages'`.
   - For pnpm projects with `patchedDependencies`, patches belonging to unbundled workspace members are filtered out automatically. A note naming stale patch declarations means the lockfile is out of date with the config — refresh it with a regular install.
-- Checkly caches installed dependencies between runs, keyed off the workspace's dependency inputs (the lock file, every workspace member's `package.json` and `.npmrc` — whether or not the member is in the bundle) plus the bundle's own install inputs, so the key can change without a file edit, e.g. when a different set of workspace members lands in the bundle. To force a reinstall for deployed checks, set `runner.cache.install.version` (a string or a safe integer) at the top level of `checkly.config.ts` — not per check — and change its value whenever the cache should be invalidated; deployed, scheduled checks pick up the change on the next `checkly deploy`. If the config still declares the deprecated `caching.dependencyCache.version`, remove it — setting both fails config loading. Unset or empty values leave the cache key unchanged, so a dynamic value such as `version: process.env.DEPENDENCY_CACHE_VERSION` is safe when the variable is not always set. For a one-off reinstall during an ad-hoc run, use the `--refresh-cache` flag on `checkly test`, `checkly pw-test`, `checkly trigger`, or `checkly checks run` instead.
+- Checkly caches installed dependencies between runs, keyed off the workspace's dependency inputs (the lock file, every workspace member's `package.json` and `.npmrc` — whether or not the member is in the bundle) plus the bundle's own install inputs, so the key can change without a file edit, e.g. when a different set of workspace members lands in the bundle. To force a reinstall for deployed checks, set `runner.cache.install.version` (a string or a safe integer) at the top level of `checkly.config.ts` — not per check — and change its value whenever the cache should be invalidated; deployed, scheduled checks pick up the change on the next `checkly deploy`. Unset or empty values leave the cache key unchanged, so a dynamic value such as `version: process.env.DEPENDENCY_CACHE_VERSION` is safe when the variable is not always set. For a one-off reinstall during an ad-hoc run, use the `--refresh-cache` flag on `checkly test`, `checkly pw-test`, `checkly trigger`, or `checkly checks run` instead.
 - If dependencies come from a private registry that Checkly's infrastructure cannot reach (for example an intranet-only Nexus mirror), list them in `bundle.packages.embed` in `checkly.config.ts` — a top-level section: `bundle: { packages: { embed: ['@acme/private-utils', 'legacy-private-pkg@2.1.0'] } }`. The CLI resolves the entries against the workspace-root lockfile (Yarn Classic v1 lockfiles are not supported), downloads their tarballs, verifies each tarball's integrity (recorded in the lockfile, or fetched from registry metadata for Yarn Berry), and ships them inside the code bundle so the runner can install them without reaching the registry. Applies to Playwright Check Suites only, not Browser or Multistep Checks.
   - Each entry is a package name (embeds every version found in the lockfile) or an exact `name@version` pin. Names may contain `*` wildcards (`@acme/*`; a single `*` never crosses `/`, while `**` does — `**` alone matches every package, and `**/utils` matches `utils` in any scope or none), and a `!` prefix turns an entry into an exclusion that subtracts from the entries before it — order matters: `['@acme/*', '!@acme/legacy']` embeds the scope except `@acme/legacy`. A selecting entry that matches nothing in the lockfile fails validation and blocks the deploy — do not add speculative names — and so does an entry whose only matches cannot be embedded (git/file/URL or integrity-less lockfile entries, which the runner must fetch itself); a `!` exclusion that matches nothing is a silent no-op, and a list that ends up selecting nothing overall only warns.
   - List every unreachable package by name, including private packages that only appear as transitive dependencies of other private packages — dependencies of listed packages are not embedded automatically.

package/dist/ai-context/skills-command/references/configure-supporting-constructs.md

@@ -133,8 +133,8 @@ new Dashboard('example-dashboard', {
 ## Maintenance Window
 
 - Import the `MaintenanceWindow` construct from `checkly/constructs`.
-- Maintenance windows are used to pause checks during maintenance periods so no alerts are sent.
-- Checks are referenced by their tags in the `tags` property.
+- Maintenance windows pause checks (`tags` or `pauseAllChecks`) and/or silence their alerts while the checks keep running (`silenceAlertsTags` or `silenceAllAlerts`).
+- Set `timezone` (an IANA name such as `America/New_York`) so recurring windows keep their local time.
 
 **Reference:** https://www.checklyhq.com/docs/constructs/maintenance-window/
 
@@ -151,6 +151,10 @@ new MaintenanceWindow('example-maintenance-window', {
   repeatInterval: 1,
   repeatUnit: 'WEEK',
   repeatEndsAt: new Date('2025-08-01T00:00:00.000Z'),
+  timezone: 'America/New_York',
+  silenceAlertsTags: [
+    'app:webshop',
+  ],
 })
 ```
 

package/dist/ai-context/skills-command/references/configure-tcp-monitors.md

@@ -7,31 +7,22 @@
 **Reference:** https://www.checklyhq.com/docs/constructs/tcp-monitor/
 
 ```typescript
-import { AlertEscalationBuilder, Frequency, RetryStrategyBuilder, TcpAssertionBuilder, TcpMonitor } from 'checkly/constructs'
+import { Frequency, RetryStrategyBuilder, TcpAssertionBuilder, TcpMonitor } from 'checkly/constructs'
 
 new TcpMonitor('example-tcp-monitor', {
   name: 'Example TCP Monitor',
   degradedResponseTime: 5000,
   maxResponseTime: 5000,
-  activated: true,
   locations: [
     'eu-central-1',
     'eu-west-2',
   ],
   frequency: Frequency.EVERY_1H,
-  alertEscalationPolicy: AlertEscalationBuilder.runBasedEscalation(1, {
-    amount: 0,
-    interval: 5,
-  }, {
-    enabled: false,
-    percentage: 10,
-  }),
   retryStrategy: RetryStrategyBuilder.noRetries(),
   runParallel: true,
   request: {
     hostname: 'INSERT_HOSTNAME',
     port: 4242,
-    ipFamily: 'IPv4',
     assertions: [
       TcpAssertionBuilder.responseTime().lessThan(200),
       TcpAssertionBuilder.responseData().isEmpty(),

package/dist/ai-context/skills-command/references/configure-url-monitors.md

@@ -8,30 +8,21 @@
 **Reference:** https://www.checklyhq.com/docs/constructs/url-monitor/
 
 ```typescript
-import { AlertEscalationBuilder, Frequency, RetryStrategyBuilder, UrlAssertionBuilder, UrlMonitor } from 'checkly/constructs'
+import { Frequency, RetryStrategyBuilder, UrlAssertionBuilder, UrlMonitor } from 'checkly/constructs'
 
 new UrlMonitor('example-url-monitor', {
   name: 'Example URL Monitor',
-  activated: true,
   locations: [
     'eu-central-1',
     'eu-west-2',
   ],
   frequency: Frequency.EVERY_5M,
-  alertEscalationPolicy: AlertEscalationBuilder.runBasedEscalation(1, {
-    amount: 0,
-    interval: 5,
-  }, {
-    enabled: false,
-    percentage: 10,
-  }),
   retryStrategy: RetryStrategyBuilder.noRetries(),
   runParallel: true,
   degradedResponseTime: 5000,
   maxResponseTime: 20000,
   request: {
     url: 'INSERT_URL',
-    ipFamily: 'IPv4',
     assertions: [
       UrlAssertionBuilder.statusCode().equals(200),
     ],

package/dist/ai-context/skills-command/references/configure.md

@@ -47,6 +47,7 @@ import { Frequency } from 'checkly/constructs'
 export default defineConfig({
   projectName: "Production Monitoring Suite",
   logicalId: "prod-monitoring-2025",
+  // Must be this repo's own remote (`git remote get-url origin` as https). Never copy this example value.
   repoUrl: "https://github.com/acme/monitoring",
   checks: {
     activated: true,
@@ -147,6 +148,8 @@ npx checkly account plan --output json
 
 This returns your exact entitlements and available locations. Use only locations where `available` is `true` in the `locations.all` array. A disabled feature may include an `upgradeUrl`; share it only when present. Without one, the feature is unavailable.
 
+Give every check at least one entry in `locations` or `privateLocations`, on the check, on its group, or as a default in `checks.locations` or `checks.privateLocations` of `checkly.config.ts`. A deployed check without any runs in a location chosen by Checkly, and `deploy` and `validate` warn about it.
+
 Run `npx checkly skills manage plan` for the full reference.
 
 ## Testing and Debugging
@@ -156,7 +159,13 @@ Run `npx checkly skills manage plan` for the full reference.
 ## Deploying
 
 - Deploy checks using the `npx checkly deploy` command. Use `--output` to see the created, updated, and deleted resources. Use `--verbose` to also include each resource's name and physical ID (UUID), which is useful for programmatically referencing deployed resources (e.g. `npx checkly checks get <id>`).
-- Use `--preview` to see what a deploy would change without applying it.
+- A deploy is planned: Checkly compares every resource with what is deployed, property by property, the deploy then writes only the resources that differ, and it refuses to run if the account changed after the plan was made. `--no-plan` deploys without a plan: every resource the project declares is written, and edits made outside the project are overwritten without being reported.
+- A resource Checkly has no baseline for (for example every resource already deployed on a project's first planned `checkly deploy` or on the first after any deploy with `--no-plan`, one added with `checkly import`, or one whose stored baseline a Checkly update made unusable) is updated once to set it, and the plan lists it as an update whether or not anything differs; a note under the overview counts these resources. Such an entry carries `basis: "live"` in the machine-readable plan, and its list of changes is not exhaustive: a value set only in Checkly, on a property the code does not set, may be reset without being shown. Later deploys show and write only what changed.
+- Use `--preview` to see which resources a deploy would create, update or delete, without applying it. It also shows the resources the deploy would keep as they are and a diff of each updated resource's construct as deployed against as in code, and a plain interactive `checkly deploy` prints that same preview before asking the user to apply the changes or cancel. The machine-readable forms (`--dry-run`, and the `confirmation_required` envelope) additionally carry the individual properties that would change; with `--no-plan` they list the deploy's options and the resources it would delete.
+- When the preview shows a resource that was edited outside the project (in the web app or through the API), an interactive `checkly deploy` offers a third choice next to apply and cancel: update the code with the values from Checkly and deploy nothing. It exists only in a terminal; there is no flag for it, and the `confirmation_required` envelope is unchanged.
+  - It rewrites literal values (strings, numbers, booleans, and arrays or objects of those; a multi-line string over a template literal is written as a template literal) and the helper-spelled properties `frequency` (`Frequency.EVERY_5M`), `retryStrategy` (`RetryStrategyBuilder`), `alertEscalationPolicy` (`AlertEscalationBuilder`) and `assertions` (the class's assertion builder) inside the `new SomeConstruct('id', { … })` call, adds a helper's import when the file lacks it, and leaves the rest of the file untouched. Covered: checks and check groups (including `runtimeId` on runtime checks and groups, the `request` of every check and monitor type, `sslCheckDomain` and `aiAutoRepairEnabled` on browser checks, and `aiAutoRepairEnabled` on multistep checks), alert channels of every type, private locations, dashboards, maintenance windows (`repeatInterval` and `repeatUnit` together), status pages (v2 and v3, each theme colour under an existing `themeColors.light`/`.dark`), status page services, v3 components and automation rules.
+  - It lists everything it could not update with the reason: references to other resources, secrets (a credential such as a webhook URL or API key is never written), scripts, a dashboard's `customCSS`, an incident trigger, an alert channel's type or a webhook-based channel's fixed type and method, Telegram's packed template, a helper call holding a variable, a check moved to the global alert policy, which needs `alertEscalationPolicy` removed by hand.
+- Use `--prune-relations` to also delete the alert channel subscriptions and private location assignments on this project's checks and groups that the project does not manage. Without it they are only reported. Not available with `--no-plan`.
 
 ### Deleted resources
 
@@ -166,16 +175,18 @@ This matters when the local project isn't the whole picture — a partial checko
 
 ### Confirmation
 
-`deploy` is a write command: without `--force` it returns exit code 2 and a `confirmation_required` envelope. Present its `changes` to the user and run the `confirmCommand` verbatim only after they approve.
+`deploy` is a write command: without `--force` it returns exit code 2 and a `confirmation_required` envelope. Present its `changes` to the user and run the `confirmCommand` verbatim only after they approve. The one exception is a `checkly deploy` whose plan has nothing to create, update, delete or detach and no relation to prune: it asks for no confirmation, prints `No changes.`, and completes with exit code 0. That run still records the deployment. It schedules no checks unless `--schedule-on-deploy --schedule-on-deploy-scope=all` is passed: a deploy schedules checks only with `--schedule-on-deploy`, and then only the checks it changed; with `all`, every check, unless there are more of them than the scheduling threshold allows (`--schedule-on-deploy-threshold`, by default set by Checkly), leaving out the checks that run more often than the minimum frequency for deploys (`--schedule-on-deploy-min-frequency`, by default set by Checkly). Its last line says whether it scheduled any.
+
+The confirmation happens **after** the project has been parsed. Unless the run passed `--preserve-resources`, Checkly has also been asked what the deploy would delete, and every resource to be deleted is named in `changes`. Show the user the deletions before you run the `confirmCommand`. Nothing has been written or uploaded at that point.
 
-That confirmation happens **before the project is parsed**, so it cannot tell you which resources would be deleted — its `changes` only warn that deletion is possible. There is a second, itemised guard that lists each doomed resource by name, but it is skipped by `--force`, and `--force` is exactly what the `confirmCommand` carries. **An agent following the confirmation protocol never sees that list.** It is a prompt for humans deploying by hand.
+With a plan, `changes` names every resource the deploy touches, and the envelope carries a `preview` object with the machine-readable plan — one entry per resource, with the properties that would change. If Checkly could not provide a plan, the run says so and continues as one with `--no-plan`: the envelope then has no `preview` object. The envelope's `preview.planToken` identifies the plan, and the `confirmCommand` carries it as `--plan-token`. The confirming run therefore applies that plan against the same Checkly state and aborts if the account moved in between; it does not pin your local code, so an edit you make between the two runs is previewed again and deployed without a second prompt (see "Commands that pin a resolved target" in the `communicate` skill).
 
-So when resources may have been removed from the code, don't rely on the confirmation to surface it — preview first:
+To look without confirming anything:
 
 ```bash
 npx checkly deploy --preview
 ```
 
-This is a dry run: nothing is applied and nothing is confirmed. It prints the resources that would be created, updated, and deleted (add `--verbose` for names and IDs). Show the user what would be deleted, and only then deploy.
+Nothing is applied and nothing is confirmed. It prints the resources that would be created, updated, deleted and kept, and the plan token (add `--verbose` for names and IDs). `--dry-run` does the same for machine consumption: it prints the `dry_run` envelope, with the same `preview` object, and exits 0. With `--no-plan`, neither form has a plan to show: `--preview` lists every existing resource as an update, and the `--dry-run` envelope has no `preview` object.
 
 Run `npx checkly skills communicate` for the full protocol.

package/dist/ai-context/skills-command/references/initialize.md

@@ -91,6 +91,14 @@ Use the output to create a `checkly.config.ts` (or `checkly.config.js` if the us
 
 Adjust the `checkMatch` property according to previous selection. Use only locations verified as available in the previous step.
 
+Set `repoUrl` to this repository's own remote:
+
+1. Run `git remote get-url origin`.
+2. Convert it to an `https://` URL (`git@github.com:owner/repo.git` → `https://github.com/owner/repo`). Drop any credentials and the trailing `.git`.
+3. Set the result as `repoUrl`. If there is no remote, leave `repoUrl` out.
+
+Never copy the `repoUrl` from the example config.
+
 Present the generated configuration to the user and ask if it looks correct. Allow the user to make changes.
 
 Congratulate the user on completing the config. Now it's time to test the configuration and turn everything into monitoring!
@@ -105,10 +113,10 @@ npx checkly whoami
 
 If the user is logged in, verify the information and if it's the correct account.
 
-If the user is NOT logged in, present two options (lead with env vars — they work for agents, CI, and interactive use):
+If the user is NOT logged in, run the login yourself unless the user prefers API keys:
 
-- **Option A: Environment variables (recommended)** — The user sets `CHECKLY_API_KEY` and `CHECKLY_ACCOUNT_ID` as environment variables. They can create an API key at https://app.checklyhq.com/accounts/settings/user/api-keys. This is the recommended approach as it works in all contexts (agentic, CI/CD, and interactive). Once both variables are set, re-run `npx checkly whoami` to verify.
-- **Option B: Interactive login** — The user runs `npx checkly login` themselves. This command opens a browser for OAuth authentication and **cannot be completed by an AI agent**. Tell the user to run the command, complete the browser flow, and let you know when they're done so you can re-run `npx checkly whoami` to verify.
+- **Option A: `npx checkly login`** — Works for agents. It prints a JSON `action_required` line with a URL and a short code and exits: give both to the user, and once they have approved, run it again. With several accounts it stops at a `select_account` line listing them; ask the user which one and run `npx checkly login --account-id <id>`. Details are in the skill's "Logging in as an agent" section. Any authenticated command starts this flow on its own when no credentials are stored.
+- **Option B: Environment variables** — For CI/CD, or when the user prefers keys: they set `CHECKLY_API_KEY` and `CHECKLY_ACCOUNT_ID` (API keys are created at https://app.checklyhq.com/accounts/settings/user/api-keys). Once both are set, re-run `npx checkly whoami` to verify.
 
 #### Step 6: Summarize and test the new monitoring configuration
 

package/dist/ai-context/skills-command/references/investigate-checks.md

@@ -13,7 +13,7 @@ npx checkly checks list --search "Homepage" --output json
 
 Flags:
 - `-t, --tag <tag>` — filter by tag (repeat for multiple)
-- `--type <type>` — filter by check type (`API`, `BROWSER`, `HEARTBEAT`, `MULTI_STEP`, `PLAYWRIGHT`, `TCP`, `ICMP`, `DNS`, `URL`, `AGENTIC`)
+- `--type <type>` — filter by check type (`API`, `BROWSER`, `HEARTBEAT`, `MULTI_STEP`, `PLAYWRIGHT`, `TCP`, `ICMP`, `DNS`, `URL`)
 - `-s, --search <name>` — filter by name (case-insensitive partial match)
 - `--status <status>` — filter by current status: `passing`, `failing`, or `degraded`
 - `-l, --limit <n>` — max checks to return (1-100, default 25)

package/dist/auth/api-key.d.ts

@@ -0,0 +1,24 @@
+import { type AxiosInstance } from 'axios';
+export interface ApiKeyExchangeDeps {
+    createClient: (accessToken: string) => AxiosInstance;
+    hostname: () => string;
+    sleep: (ms: number) => Promise<void>;
+}
+/**
+ * Trades an Auth0 access token for a long-lived Checkly API key, registering
+ * the user with Checkly first when the Auth0 identity is not known yet
+ * (that is what a fresh sign-up looks like from the CLI's point of view).
+ */
+export declare function exchangeAccessTokenForApiKey(accessToken: string, deps?: Partial<ApiKeyExchangeDeps>): Promise<{
+    key: string;
+}>;
+export interface Credentials {
+    /** Display name from the OpenID ID token. */
+    name: string;
+    /** Long-lived Checkly API key. */
+    key: string;
+}
+export declare function credentialsFromTokens(tokens: {
+    accessToken: string;
+    idToken: string;
+}, deps?: Partial<ApiKeyExchangeDeps>): Promise<Credentials>;