@base44-preview/cli 0.1.15-pr.630.66e368f → 0.1.15-pr.630.68db200

package/dist/cli/index.js

@@ -269450,1431 +269450,1482 @@ function getAgentsCommand() {
   return new Command2("agents").description("Manage project agents").addCommand(getAgentsPushCommand()).addCommand(getAgentsPullCommand());
 }
 
-// src/core/model.ts
-var MODELS = [
-  { name: "default", id: null, note: "let Base44 choose" },
-  { name: "Opus 5", id: "claude_opus_5" },
-  { name: "Sonnet 5", id: "claude-sonnet-5" },
-  { name: "Fable 5", id: "claude_fable_5", note: "uses more credits" },
-  { name: "GPT-5.6 Sol", id: "gpt_5_6_sol" },
-  { name: "Gemini 3.8 Flash", id: "gemini_3_8_flash", note: "fast" },
-  { name: "Base 1", id: "base1" }
-];
-var fold = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
-function resolvePick(input) {
-  const key = fold(input);
-  const byExact = MODELS.find((m) => fold(m.name) === key || m.id && fold(m.id) === key);
-  if (byExact)
-    return byExact;
-  const byContains = MODELS.filter((m) => fold(m.name).includes(key) || m.id && fold(m.id).includes(key));
-  if (byContains.length === 1)
-    return byContains[0];
-  const names = MODELS.map((m) => m.name).join(", ");
-  throw new InvalidInputError(byContains.length > 1 ? `"${input}" is ambiguous — matches ${byContains.map((m) => m.name).join(", ")}.` : `Unknown model "${input}". Choose one of: ${names}.`);
-}
-async function getMe() {
-  try {
-    return await base44Client.get("api/auth/me").json();
-  } catch (error) {
-    throw await ApiError.fromHttpError(error, "reading your account");
+// src/cli/commands/auth/password-login.ts
+import { dirname as dirname15, join as join21 } from "node:path";
+async function passwordLoginAction({ log, runTask }, action) {
+  const shouldEnable = action === "enable";
+  const { project } = await readProjectConfig();
+  const configDir = dirname15(project.configPath);
+  const authDir = join21(configDir, project.authDir);
+  const updated = await runTask("Updating local auth config", async () => {
+    const current = await readAuthConfig(authDir) ?? DEFAULT_AUTH_CONFIG;
+    const merged = { ...current, enableUsernamePassword: shouldEnable };
+    await writeAuthConfig(authDir, merged);
+    return merged;
+  });
+  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
+    log.warn("Disabling password auth will leave no login methods enabled. Users will be locked out.");
   }
+  const newStatus = shouldEnable ? "enabled" : "disabled";
+  return {
+    outroMessage: `Username & password authentication ${newStatus} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
+  };
 }
-async function saveBuilderModel(userId, modelId) {
-  try {
-    await base44Client.post(`api/auth/${userId}/update-user`, {
-      json: { builder_model: modelId }
-    });
-  } catch (error) {
-    if (error instanceof HTTPError && error.response.status === 400) {
-      throw new InvalidInputError("This account can't pick a builder model yet — enable the PER_USER_BUILDER_MODEL_SELECTION flag for it in PostHog, or the model isn't available in this workspace.");
-    }
-    throw await ApiError.fromHttpError(error, "saving your model choice");
+function getPasswordLoginCommand() {
+  return new Base44Command("password-login").description("Enable or disable username & password authentication").addArgument(new Argument2("<action>", "enable or disable password authentication").choices(["enable", "disable"])).action(passwordLoginAction);
+}
+
+// src/cli/commands/auth/pull.ts
+import { dirname as dirname16, join as join22 } from "node:path";
+async function pullAuthAction({
+  log,
+  runTask
+}) {
+  const { project } = await readProjectConfig();
+  const configDir = dirname16(project.configPath);
+  const authDir = join22(configDir, project.authDir);
+  const remoteConfig = await runTask("Fetching auth config from Base44", async () => {
+    return await pullAuthConfig();
+  }, {
+    successMessage: "Auth config fetched successfully",
+    errorMessage: "Failed to fetch auth config"
+  });
+  const { written } = await runTask("Syncing auth config file", async () => {
+    return await writeAuthConfig(authDir, remoteConfig);
+  }, {
+    successMessage: "Auth config file synced successfully",
+    errorMessage: "Failed to sync auth config file"
+  });
+  if (written) {
+    log.success("Auth config written to local file");
+  } else {
+    log.info("Auth config is already up to date");
   }
+  return {
+    outroMessage: `Pulled auth config to ${authDir} (overwrites local file)`
+  };
+}
+function getAuthPullCommand() {
+  return new Base44Command("pull").description("Pull auth config from Base44 to local file").action(pullAuthAction);
 }
-var displayName = (id) => MODELS.find((m) => m.id === id)?.name ?? id ?? "default";
 
-// src/cli/commands/app/model.ts
-async function modelAction({ log, jsonMode }, input) {
-  const me = await getMe();
-  const current = me.builder_model ?? null;
-  if (!input) {
-    if (jsonMode) {
-      return {
-        stdout: `${JSON.stringify({
-          current,
-          models: MODELS.map((m) => ({ name: m.name, id: m.id }))
-        })}
-`
-      };
-    }
-    for (const m of MODELS) {
-      const active = (m.id ?? null) === current;
-      const marker = active ? theme.styles.bold("●") : theme.styles.dim("○");
-      const note = m.note ? theme.styles.dim(`  (${m.note})`) : "";
-      log.message(`${marker} ${active ? theme.styles.bold(m.name) : m.name}${note}`);
-    }
+// src/cli/commands/auth/push.ts
+async function pushAuthAction({ isNonInteractive, log, runTask }, options) {
+  const { authConfig } = await readProjectConfig();
+  if (authConfig.length === 0) {
+    log.info("No local auth config found");
     return {
-      outroMessage: `Current: ${theme.styles.bold(displayName(current))}. Set with \`base44 app model <name>\`.`
+      outroMessage: "No auth config to push. Run `base44 auth pull` to fetch the remote config first."
     };
   }
-  const pick = resolvePick(input);
-  if ((pick.id ?? null) === current) {
-    return { outroMessage: `Already on ${theme.styles.bold(pick.name)}.` };
+  if (!hasAnyLoginMethod(authConfig[0])) {
+    log.warn("This config has no login methods enabled. Pushing it will lock out all users.");
   }
-  await saveBuilderModel(me.id, pick.id);
-  if (jsonMode)
-    return { stdout: `${JSON.stringify({ current: pick.id })}
-` };
+  if (!options.yes) {
+    if (isNonInteractive) {
+      throw new InvalidInputError("--yes is required in non-interactive mode");
+    }
+    const shouldPush = await Re({
+      message: "Push auth config to Base44?"
+    });
+    if (Ct(shouldPush) || !shouldPush) {
+      return { outroMessage: "Push cancelled" };
+    }
+  }
+  await runTask("Pushing auth config to Base44", async () => {
+    return await pushAuthConfig(authConfig[0] ?? null);
+  }, {
+    successMessage: "Auth config pushed successfully",
+    errorMessage: "Failed to push auth config"
+  });
   return {
-    outroMessage: pick.id === null ? "Model reset — Base44 chooses per app again." : `Builder model set to ${theme.styles.bold(pick.name)} for every new turn.`
+    outroMessage: "Auth config pushed to Base44"
   };
 }
-function getModelCommand() {
-  const command = new Base44Command("model", { requireAppContext: false });
-  command.description("Pick the builder model for your turns (account-wide). No argument lists models and the current pick; `default` clears it").argument("[model]", 'Model name or id, e.g. "Opus 5" or default').action(modelAction);
-  return command;
+function getAuthPushCommand() {
+  return new Base44Command("push").description("Push local auth config to Base44").option("-y, --yes", "Skip confirmation prompt").action(pushAuthAction);
 }
 
-// src/cli/commands/app/shared.ts
-import { mkdir as mkdir3, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join21 } from "node:path";
-
-// src/cli/commands/code/render.ts
-var TOOL_ALIASES = {
-  run_shell_command: "bash",
-  read_repo_file: "read",
-  write_repo_file: "write",
-  edit_repo_file: "edit",
-  set_secrets: "secrets",
-  generate_development_secrets: "secrets",
-  create_pull_request: "pr",
-  merge_pull_request: "merge",
-  list_pr_threads: "pr threads",
-  reply_to_pr_thread: "pr reply",
-  comment_on_pr: "pr comment",
-  resolve_pr_thread: "pr resolve",
-  reload_preview: "reload",
-  preview_execute_code: "preview js",
-  preview_screenshot: "screenshot",
-  connect_github_account: "github"
+// src/cli/commands/auth/social-login.ts
+import { dirname as dirname17, join as join23, resolve as resolve6 } from "node:path";
+var PROVIDER_LABELS = {
+  google: "Google",
+  microsoft: "Microsoft",
+  facebook: "Facebook",
+  apple: "Apple"
 };
-var QUIET_OK_RESULTS = new Set(["read", "write", "edit", "reload"]);
-function toolAlias(name) {
-  return TOOL_ALIASES[name] ?? name;
-}
-var ESC_CHAR = String.fromCharCode(27);
-var BEL = String.fromCharCode(7);
-var OSC8_CLOSE = `${ESC_CHAR}]8;;${BEL}`;
-function terminalLink(label, url) {
-  return `${ESC_CHAR}]8;;${url}${BEL}${source_default.dim.underline(label)}${OSC8_CLOSE}`;
-}
-function linkifyUrls(text) {
-  let n = 0;
-  return text.replace(/https?:\/\/[^\s]+/g, (raw) => {
-    const trailing = raw.match(/[.,;:!?)\]}'"]+$/)?.[0] ?? "";
-    const url = trailing ? raw.slice(0, -trailing.length) : raw;
-    const id = `b44-${n++}`;
-    return `${ESC_CHAR}]8;id=${id};${url}${BEL}${url}${OSC8_CLOSE}${trailing}`;
-  });
-}
-function hardWrapAnsi(text, width) {
-  const ESC = new RegExp(`^(?:${ESC_CHAR}\\[[0-9;]*m|${ESC_CHAR}\\]8;[^${BEL}]*${BEL})`);
-  const RESET = `${ESC_CHAR}[0m`;
-  const out = [];
-  for (const logical of text.split(`
-`)) {
-    let line = "";
-    let visible = 0;
-    let active = [];
-    let link = "";
-    let i = 0;
-    while (i < logical.length) {
-      const esc = ESC.exec(logical.slice(i));
-      if (esc) {
-        const seq = esc[0];
-        line += seq;
-        if (seq === RESET)
-          active = [];
-        else if (seq.endsWith("m"))
-          active.push(seq);
-        else if (seq === OSC8_CLOSE)
-          link = "";
-        else
-          link = seq;
-        i += seq.length;
-        continue;
-      }
-      if (visible >= width) {
-        out.push(`${line}${link ? OSC8_CLOSE : ""}${RESET}`);
-        line = active.join("") + link;
-        visible = 0;
-      }
-      line += logical[i];
-      visible++;
-      i++;
-    }
-    out.push(line);
+var VALID_PROVIDER_NAMES = Object.keys(SOCIAL_PROVIDERS);
+var PROVIDER_OAUTH_CLI = {
+  google: {
+    envVar: "google_oauth_client_secret",
+    promptMessage: "Enter Google OAuth client secret"
   }
-  return out;
+};
+function hasSecretOptions(options) {
+  return Boolean(options.clientSecret || options.clientSecretStdin || options.envFile);
 }
-function formatDuration2(ms) {
-  const seconds = Math.round(ms / 1000);
-  if (seconds < 90)
-    return `${seconds}s`;
-  return `${Math.floor(seconds / 60)}m ${String(seconds % 60).padStart(2, "0")}s`;
+function hasCustomOAuthOptions(options) {
+  return Boolean(options.clientId || hasSecretOptions(options));
 }
-function eventLine(event, elapsedMs) {
-  switch (event.kind) {
-    case "thinking":
-      return source_default.dim(`✻ ${event.text}`);
-    case "text":
-      return linkifyUrls(event.text);
-    case "tool_start":
-      return null;
-    case "waiting": {
-      const what = event.label || toolAlias(event.name);
-      return source_default.yellow(`⏸ ${what} — needs your input (answer in the editor)`);
-    }
-    case "tool_end": {
-      const alias = toolAlias(event.name);
-      const mark = event.ok ? source_default.green("✓") : source_default.red("✗");
-      const title = source_default.bold(event.label || alias);
-      const took = elapsedMs != null && elapsedMs >= 3000 ? ` ${source_default.dim(`· ${formatDuration2(elapsedMs)}`)}` : "";
-      const inlineDetail = !event.label && event.summary ? ` ${source_default.dim(event.summary)}` : "";
-      const paramsLine = event.label && event.summary ? `
-  ${source_default.dim(`${alias}: ${event.summary}`)}` : "";
-      const head = `${mark} ${title}${inlineDetail}${took}${paramsLine}`;
-      if (event.ok && (QUIET_OK_RESULTS.has(alias) || !event.result)) {
-        return head;
+async function socialLoginAction({ log, isNonInteractive, runTask }, provider, action, options) {
+  const shouldEnable = action === "enable";
+  const providerInfo = SOCIAL_PROVIDERS[provider];
+  const label = PROVIDER_LABELS[provider];
+  const hasOAuthOptions = hasCustomOAuthOptions(options);
+  if (hasOAuthOptions && !providerInfo.customOAuth) {
+    throw new InvalidInputError(`Custom OAuth options are only supported for providers with custom OAuth (e.g., google). Use: base44 auth social-login ${provider} ${action}`);
+  }
+  if (hasOAuthOptions && !shouldEnable) {
+    throw new InvalidInputError(`Custom OAuth options cannot be used with disable. To disable ${label} login: base44 auth social-login ${provider} disable`);
+  }
+  if (hasSecretOptions(options) && !options.clientId) {
+    throw new InvalidInputError(`--client-id is required when providing a client secret. Use: base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`);
+  }
+  const oauth = providerInfo.customOAuth;
+  const oauthCli = PROVIDER_OAUTH_CLI[provider];
+  const useCustomOAuth = shouldEnable && hasOAuthOptions && oauth != null;
+  let clientSecret;
+  if (useCustomOAuth && oauth && oauthCli && hasSecretOptions(options)) {
+    if (options.envFile) {
+      const secrets = await parseEnvFile(resolve6(options.envFile));
+      const value = secrets[oauthCli.envVar];
+      if (!value) {
+        throw new InvalidInputError(`Key "${oauthCli.envVar}" not found in ${options.envFile}.`);
       }
-      const result = event.ok ? source_default.dim(linkifyUrls(event.result)) : source_default.red(linkifyUrls(event.result));
-      return `${head}${event.result ? `
-  ${result}` : ""}`;
+      clientSecret = value;
+    } else {
+      clientSecret = await resolveSecret({
+        flagValue: options.clientSecret,
+        fromStdin: options.clientSecretStdin,
+        envVar: oauthCli.envVar,
+        promptMessage: oauthCli.promptMessage,
+        isNonInteractive,
+        name: "client secret",
+        hints: [
+          {
+            message: `Provide via flag:   base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`,
+            command: `base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`
+          },
+          {
+            message: `Provide via stdin:  echo <secret> | base44 auth social-login ${provider} enable --client-id <id> --client-secret-stdin`
+          },
+          {
+            message: `Provide via env:    ${oauthCli.envVar}=<secret> base44 auth social-login ${provider} enable --client-id <id>`
+          }
+        ]
+      });
     }
   }
+  const { project } = await readProjectConfig();
+  const configDir = dirname17(project.configPath);
+  const authDir = join23(configDir, project.authDir);
+  const { config: updated } = await runTask("Updating local auth config", async () => updateSocialLoginConfig(authDir, provider, shouldEnable, useCustomOAuth && options.clientId ? { clientId: options.clientId } : undefined));
+  if (clientSecret) {
+    await runTask("Saving client secret", async () => pushCustomOAuthSecret(provider, clientSecret));
+  }
+  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
+    log.warn(`Disabling ${label} login will leave no login methods enabled. Users will be locked out.`);
+  }
+  const newStatus = shouldEnable ? "enabled" : "disabled";
+  const oauthNote = useCustomOAuth ? " with custom OAuth" : "";
+  let outroMessage = `${label} login ${newStatus}${oauthNote} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`;
+  if (useCustomOAuth && !clientSecret) {
+    outroMessage += `
+Remember to push the client secret separately: base44 secrets set --env-file <path>`;
+  }
+  return { outroMessage };
 }
-var FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
-var MUSINGS = [
-  "Shmoozing",
-  "Shmoogling",
-  "Percolating",
-  "Noodling",
-  "Marinating",
-  "Brewing",
-  "Simmering",
-  "Conjuring",
-  "Tinkering",
-  "Scheming",
-  "Pondering",
-  "Mulling",
-  "Whirring",
-  "Crunching",
-  "Weaving",
-  "Sketching",
-  "Hatching",
-  "Riffing",
-  "Cooking",
-  "Composting ideas",
-  "Rummaging",
-  "Vibing responsibly",
-  "Untangling",
-  "Squinting at the repo"
-];
-var MUSING_ROTATE_MS = 6000;
-function idleMusing(seed) {
-  return `${MUSINGS[(seed + Math.floor(Date.now() / MUSING_ROTATE_MS)) % MUSINGS.length]}…`;
-}
-function createTurnStream(interactive, write = (text) => process.stdout.write(text), options = {}) {
-  const running = new Map;
-  const footer = options.footer ?? [];
-  let frame = 0;
-  let stopped = false;
-  let drawnLines = 0;
-  const musingSeed = Math.floor(Math.random() * MUSINGS.length);
-  const statusLabel = () => {
-    if (running.size === 0) {
-      if (options.idleLabel)
-        return `${options.idleLabel}…`;
-      const index = (musingSeed + Math.floor(Date.now() / MUSING_ROTATE_MS)) % MUSINGS.length;
-      return `${MUSINGS[index]}…`;
-    }
-    const newest = [...running.values()].at(-1);
-    const elapsed = Math.round((Date.now() - newest.startedAt) / 1000);
-    const others = running.size > 1 ? ` (+${running.size - 1} more)` : "";
-    const what = newest.label || `${newest.alias}${newest.summary ? ` ${newest.summary}` : ""}`;
-    return `${what}${others} · ${elapsed}s`;
-  };
-  const clearBlock = () => {
-    if (!drawnLines)
-      return;
-    write("\r\x1B[2K");
-    for (let i = 1;i < drawnLines; i++)
-      write("\x1B[1A\r\x1B[2K");
-    drawnLines = 0;
-  };
-  const drawBlock = () => {
-    if (!interactive || stopped)
-      return;
-    const lines = [
-      ...footer.length ? ["", ...footer] : [],
-      source_default.dim(`${FRAMES[frame]} ${statusLabel()}`)
-    ];
-    write(lines.join(`
-`));
-    drawnLines = lines.length;
-  };
-  const tick = () => {
-    if (!interactive || stopped)
-      return;
-    frame = (frame + 1) % FRAMES.length;
-    clearBlock();
-    drawBlock();
-  };
-  const timer = interactive ? setInterval(tick, 120) : null;
-  if (timer)
-    timer.unref?.();
-  return {
-    onEvent(event) {
-      if (event.kind === "tool_start") {
-        running.set(event.id, {
-          alias: toolAlias(event.name),
-          label: event.label,
-          summary: event.summary,
-          startedAt: Date.now()
-        });
-        if (interactive) {
-          clearBlock();
-          drawBlock();
-        }
-        return;
-      }
-      let elapsedMs;
-      if (event.kind === "tool_end") {
-        const started = running.get(event.id)?.startedAt;
-        if (started != null)
-          elapsedMs = Date.now() - started;
-        running.delete(event.id);
-      }
-      const line = eventLine(event, elapsedMs);
-      if (line == null)
-        return;
-      if (interactive) {
-        clearBlock();
-        write(`${line}
-`);
-        drawBlock();
-      } else {
-        write(`${line}
-`);
-      }
-    },
-    stop() {
-      if (interactive) {
-        clearBlock();
-        if (footer.length)
-          write(`
-${footer.join(`
-`)}
-`);
-      }
-      stopped = true;
-      if (timer)
-        clearInterval(timer);
-    }
-  };
+function getSocialLoginCommand() {
+  return new Base44Command("social-login").description("Enable or disable social login providers (google, microsoft, facebook, apple)").addArgument(new Argument2("<provider>", "social login provider").choices(VALID_PROVIDER_NAMES)).addArgument(new Argument2("<action>", "enable or disable the provider").choices([
+    "enable",
+    "disable"
+  ])).option("--client-id <id>", "custom OAuth client ID (Google only)").option("--client-secret <secret>", "custom OAuth client secret (Google only)").option("--client-secret-stdin", "read client secret from stdin (Google only)").option("--env-file <path>", "read client secret from a .env file (Google only)").action(socialLoginAction);
 }
 
-// src/core/resources/apps/api.ts
-var CreatedAppSchema = object({
-  id: string2().min(1),
-  name: string2().nullish(),
-  imported_repo_url: string2().nullish()
-});
-var AppStateSchema = object({
-  id: string2(),
-  status: object({
-    state: string2().nullish(),
-    message: string2().nullish()
-  }).nullish()
-});
-var ChatTurnSchema = object({
-  queued: boolean2().optional(),
-  status: object({
-    state: string2().nullish(),
-    message: string2().nullish(),
-    error_source: string2().nullish()
-  }).nullish(),
-  conversation: object({
-    messages: array(object({
-      role: string2().nullish(),
-      content: unknown().nullish()
-    })).nullish()
-  }).nullish()
-});
-var PreviewUrlSchema = object({
-  preview_url: string2().min(1)
-});
-var ConversationMessageSchema = object({
-  id: string2(),
-  role: string2(),
-  hidden: boolean2().nullish(),
-  outcome: unknown().nullish(),
-  content: unknown().nullish(),
-  reasoning: object({ content: string2().nullish() }).nullish(),
-  tool_calls: array(object({
-    id: string2(),
-    name: string2(),
-    arguments_string: string2().nullish(),
-    status: string2().nullish(),
-    results: unknown().nullish()
-  })).nullish()
-});
-var FullConversationSchema = object({
-  messages: array(ConversationMessageSchema).default([])
+// src/cli/commands/auth/sso.ts
+import { dirname as dirname18, join as join24, resolve as resolve7 } from "node:path";
+var SSOConfigFileSchema = object({
+  provider: _enum(Object.values(KNOWN_SSO_PROVIDERS)),
+  clientId: string2(),
+  clientSecret: string2(),
+  scope: string2().optional(),
+  discoveryUrl: string2().optional(),
+  tenantId: string2().optional(),
+  oktaDomain: string2().optional(),
+  authEndpoint: string2().optional(),
+  tokenEndpoint: string2().optional(),
+  userinfoEndpoint: string2().optional(),
+  jwksUri: string2().optional(),
+  ssoName: string2().optional()
 });
-var OAuthInitiateSchema = object({ authorization_url: string2().min(1) });
-function parseOrThrow(schema, payload, what) {
-  const result = schema.safeParse(payload);
+async function loadSSOConfigFile(filePath) {
+  const resolved = resolve7(filePath);
+  const raw = await readJsonFile(resolved);
+  const result = SSOConfigFileSchema.safeParse(raw);
   if (!result.success) {
-    throw new SchemaValidationError(`Invalid ${what} response from server`, result.error);
+    throw new SchemaValidationError("Invalid SSO config file", result.error, filePath);
   }
   return result.data;
 }
-function branchScope(branchId) {
-  return branchId ? { branch_id: branchId } : {};
+function mergeFileWithFlags(fileConfig, options) {
+  return {
+    provider: options.provider ?? fileConfig.provider,
+    clientId: options.clientId ?? fileConfig.clientId,
+    clientSecret: options.clientSecret ?? fileConfig.clientSecret,
+    clientSecretStdin: options.clientSecretStdin,
+    envFile: options.envFile,
+    scope: options.scope ?? fileConfig.scope,
+    discoveryUrl: options.discoveryUrl ?? fileConfig.discoveryUrl,
+    tenantId: options.tenantId ?? fileConfig.tenantId,
+    oktaDomain: options.oktaDomain ?? fileConfig.oktaDomain,
+    authEndpoint: options.authEndpoint ?? fileConfig.authEndpoint,
+    tokenEndpoint: options.tokenEndpoint ?? fileConfig.tokenEndpoint,
+    userinfoEndpoint: options.userinfoEndpoint ?? fileConfig.userinfoEndpoint,
+    jwksUri: options.jwksUri ?? fileConfig.jwksUri,
+    ssoName: options.ssoName ?? fileConfig.ssoName
+  };
 }
-async function createApp(options) {
-  let response;
-  try {
-    response = await base44Client.post("api/apps", {
-      timeout: false,
-      json: {
-        ...options.appName ? { name: options.appName } : {},
-        ...options.organizationId ? { organization_id: options.organizationId } : {},
-        ...options.prompt ? { initial_message: { content: options.prompt } } : {}
-      }
+var providerNames = Object.keys(KNOWN_SSO_PROVIDERS);
+var SECRET_KEY_TO_FLAG = {
+  ["sso_name" /* Name */]: "--sso-name",
+  ["sso_client_id" /* ClientId */]: "--client-id",
+  ["sso_client_secret" /* ClientSecret */]: "--client-secret",
+  ["sso_scope" /* Scope */]: "--scope",
+  ["sso_discovery_url" /* DiscoveryUrl */]: "--discovery-url",
+  ["sso_tenant_id" /* TenantId */]: "--tenant-id",
+  ["sso_auth_endpoint" /* AuthEndpoint */]: "--auth-endpoint",
+  ["sso_token_endpoint" /* TokenEndpoint */]: "--token-endpoint",
+  ["sso_userinfo_endpoint" /* UserinfoEndpoint */]: "--userinfo-endpoint",
+  ["sso_okta_domain" /* OktaDomain */]: "--okta-domain",
+  ["sso_jwks_uri" /* JwksUri */]: "--jwks-uri"
+};
+function secretKeyToFlag(key) {
+  return SECRET_KEY_TO_FLAG[key];
+}
+function exampleCommand(provider) {
+  let cmd = `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`;
+  if (provider === KNOWN_SSO_PROVIDERS.microsoft)
+    cmd += " --tenant-id <id>";
+  if (provider === KNOWN_SSO_PROVIDERS.okta)
+    cmd += " --okta-domain <domain>";
+  if (provider === KNOWN_SSO_PROVIDERS.custom)
+    cmd += " --sso-name <name> --auth-endpoint <url> --token-endpoint <url> --userinfo-endpoint <url> --jwks-uri <url>";
+  return cmd;
+}
+function validateProvider(provider) {
+  if (!provider) {
+    throw new InvalidInputError("Missing --provider.", {
+      hints: [
+        {
+          message: `Valid providers: ${providerNames.join(", ")}`,
+          command: "base44 auth sso enable --provider <provider> --client-id <id> --client-secret <secret>"
+        }
+      ]
     });
-  } catch (error) {
-    throw await ApiError.fromHttpError(error, "creating app");
   }
-  return parseOrThrow(CreatedAppSchema, await response.json(), "app");
+  return provider;
 }
-async function createImportedApp(options) {
-  let response;
-  try {
-    response = await base44Client.post("api/apps", {
-      timeout: false,
-      json: {
-        app_type: "imported_app",
-        name: options.appName,
-        imported_source_mode: options.sourceMode,
-        imported_repo_url: options.repoUrl,
-        ...options.newRepoName ? { imported_new_repo_name: options.newRepoName } : {},
-        ...options.branch ? { imported_branch: options.branch } : {},
-        ...options.prompt ? { initial_message: { content: options.prompt } } : {}
-      }
+async function ssoEnableAction({ isNonInteractive, runTask }, options) {
+  if (options.file && options.envFile) {
+    throw new InvalidInputError("--file and --env-file cannot be used together. Provide the client secret either inside --file or via --env-file.");
+  }
+  let merged = options;
+  if (options.file) {
+    const fileConfig = await loadSSOConfigFile(options.file);
+    merged = mergeFileWithFlags(fileConfig, options);
+  }
+  const provider = validateProvider(merged.provider);
+  if (!merged.clientId) {
+    throw new InvalidInputError("Missing --client-id.", {
+      hints: [
+        {
+          message: `Example: base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
+          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
+        }
+      ]
     });
-  } catch (error) {
-    throw await ApiError.fromHttpError(error, "importing repository");
   }
-  return parseOrThrow(CreatedAppSchema, await response.json(), "app");
-}
-async function startGithubReauth() {
-  const response = await base44Client.post("api/github/oauth/initiate?skip_installation=true");
-  return parseOrThrow(OAuthInitiateSchema, await response.json(), "github oauth initiate").authorization_url;
-}
-function isGithubUserTokenError(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  return /api\.github\.com/i.test(message) && /\b401\b|unauthorized/i.test(message);
-}
-async function getAppState(appId) {
-  let response;
-  try {
-    response = await base44Client.get(`api/apps/${appId}`, {
-      searchParams: { fields: "id,status" }
+  let clientSecret;
+  if (merged.envFile && !merged.clientSecret) {
+    const secrets = await parseEnvFile(resolve7(merged.envFile));
+    const value = secrets.sso_client_secret;
+    if (!value) {
+      throw new InvalidInputError(`Key "sso_client_secret" not found in ${merged.envFile}.`);
+    }
+    clientSecret = value;
+  } else {
+    clientSecret = await resolveSecret({
+      flagValue: merged.clientSecret,
+      fromStdin: merged.clientSecretStdin,
+      envVar: "sso_client_secret",
+      promptMessage: "Enter SSO client secret",
+      isNonInteractive,
+      name: "client secret",
+      hints: [
+        {
+          message: `Provide via flag:   base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
+          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
+        },
+        {
+          message: `Provide via stdin:  echo <secret> | base44 auth sso enable --provider ${provider} --client-id <id> --client-secret-stdin`
+        },
+        {
+          message: `Provide via env:    sso_client_secret=<secret> base44 auth sso enable --provider ${provider} --client-id <id>`
+        }
+      ]
     });
-  } catch (error) {
-    throw await ApiError.fromHttpError(error, "reading app status");
   }
-  return parseOrThrow(AppStateSchema, await response.json(), "app status");
-}
-async function sendTurn(content, branchId) {
-  let response;
+  const secretOptions = {
+    clientId: merged.clientId,
+    clientSecret,
+    scope: merged.scope,
+    discoveryUrl: merged.discoveryUrl,
+    tenantId: merged.tenantId,
+    oktaDomain: merged.oktaDomain,
+    authEndpoint: merged.authEndpoint,
+    tokenEndpoint: merged.tokenEndpoint,
+    userinfoEndpoint: merged.userinfoEndpoint,
+    jwksUri: merged.jwksUri,
+    ssoName: merged.ssoName
+  };
+  let secrets;
   try {
-    response = await getAppClient().post("chat/message", {
-      timeout: false,
-      searchParams: {
-        conversation_messages: "current_turn",
-        ...branchScope(branchId)
-      },
-      json: { content }
-    });
+    secrets = buildSSOSecrets(provider, secretOptions);
   } catch (error) {
-    throw await ApiError.fromHttpError(error, "sending message");
+    if (error instanceof MissingSSOFieldsError) {
+      const flagNames = error.missingKeys.map(secretKeyToFlag);
+      throw new InvalidInputError(`Missing required fields for ${error.provider}: ${flagNames.join(", ")}`, {
+        hints: [
+          {
+            message: `Example: ${exampleCommand(provider)}`,
+            command: exampleCommand(provider)
+          }
+        ]
+      });
+    }
+    throw error;
   }
-  return parseOrThrow(ChatTurnSchema, await response.json(), "chat turn");
+  const { project } = await readProjectConfig();
+  const configDir = dirname18(project.configPath);
+  const authDir = join24(configDir, project.authDir);
+  await runTask("Updating local auth config", async () => updateSSOConfig(authDir, provider, true));
+  await runTask("Saving SSO credentials", async () => pushSSOSecrets(secrets));
+  return {
+    outroMessage: `SSO configured with ${provider} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
+  };
 }
-async function stopTurn(branchId) {
-  try {
-    await getAppClient().post("chat/stop", {
-      searchParams: branchScope(branchId)
-    });
-  } catch (error) {
-    throw await ApiError.fromHttpError(error, "stopping the turn");
+function hasEnableOnlyOptions(options) {
+  return Boolean(options.provider || options.clientId || options.clientSecret || options.clientSecretStdin || options.envFile || options.file || options.scope || options.discoveryUrl || options.tenantId || options.oktaDomain || options.authEndpoint || options.tokenEndpoint || options.userinfoEndpoint || options.jwksUri || options.ssoName);
+}
+async function ssoDisableAction({ log, runTask }, options) {
+  if (hasEnableOnlyOptions(options)) {
+    throw new InvalidInputError("Configuration options cannot be used with disable. To disable SSO: base44 auth sso disable");
+  }
+  const { project } = await readProjectConfig();
+  const configDir = dirname18(project.configPath);
+  const authDir = join24(configDir, project.authDir);
+  const updated = await runTask("Updating local auth config", async () => updateSSOConfig(authDir, null, false));
+  await runTask("Removing SSO credentials", async () => deleteSSOSecrets());
+  if (!hasAnyLoginMethod(updated)) {
+    log.warn("Disabling SSO will leave no login methods enabled. Users will be locked out.");
   }
+  return {
+    outroMessage: "SSO disabled in local config and credentials removed. Run `base44 auth push` or `base44 deploy` to apply."
+  };
 }
-async function getFullConversation(limit, branchId) {
-  let response;
-  try {
-    response = await getAppClient().get("chat/full-conversation", {
-      timeout: 30000,
-      searchParams: { limit: String(limit), ...branchScope(branchId) }
-    });
-  } catch (error) {
-    throw await ApiError.fromHttpError(error, "reading the conversation");
+async function ssoAction(context, action, options) {
+  if (action === "disable") {
+    return ssoDisableAction(context, options);
   }
-  return parseOrThrow(FullConversationSchema, await response.json(), "conversation").messages;
+  return ssoEnableAction(context, options);
 }
-async function resolveActiveBranchId() {
-  const branches = await listBranches();
-  return branches.length === 1 ? branches[0].id : undefined;
+function getSSOCommand() {
+  return new Base44Command("sso").description("Configure SSO identity provider (google, microsoft, github, okta, custom). SSO and social login are mutually exclusive — enabling one disables the other in the local auth config.").addArgument(new Argument2("<action>", "enable or disable SSO").choices([
+    "enable",
+    "disable"
+  ])).addOption(new Option2("--provider <provider>", "SSO provider").choices(Object.values(KNOWN_SSO_PROVIDERS))).option("--client-id <id>", "OAuth client ID").option("--client-secret <secret>", "OAuth client secret").option("--client-secret-stdin", "Read client secret from stdin").option("--env-file <path>", "Read client secret from a .env file (key: sso_client_secret)").option("--file <path>", "JSON config file with all SSO settings").option("--scope <scope>", "OAuth scope (defaults per provider)").option("--discovery-url <url>", "OIDC discovery URL").option("--tenant-id <id>", "Microsoft tenant ID (required for microsoft)").option("--okta-domain <domain>", "Okta domain (required for okta)").option("--auth-endpoint <url>", "Authorization endpoint (required for custom)").option("--token-endpoint <url>", "Token endpoint (required for custom)").option("--userinfo-endpoint <url>", "Userinfo endpoint (required for custom)").option("--jwks-uri <url>", "JWKS URI (required for custom)").option("--sso-name <name>", "Provider display name (required for custom)").action(ssoAction);
 }
-async function getPreviewUrl() {
-  let response;
-  try {
-    response = await getAppClient().get("sandbox/preview-url", {
-      timeout: false
-    });
-  } catch (error) {
-    throw await ApiError.fromHttpError(error, "fetching preview URL");
-  }
-  const url = parseOrThrow(PreviewUrlSchema, await response.json(), "preview URL").preview_url;
-  return /^https?:\/\//.test(url) ? url : `https://${url}`;
+
+// src/cli/commands/auth/index.ts
+function getAuthCommand() {
+  return new Command2("auth").description("Manage app authentication settings").addCommand(getPasswordLoginCommand()).addCommand(getSocialLoginCommand()).addCommand(getSSOCommand()).addCommand(getAuthPullCommand()).addCommand(getAuthPushCommand());
 }
 
-// src/cli/commands/app/shared.ts
-var APP_NAME_RE = /^[A-Za-z0-9._-]+$/;
-var NAME_STOPWORDS = new Set("a an the and or of for with to in on that this its it my our your me".split(" "));
-var FALLBACK_WORDS = [
-  "swift-otter",
-  "sunny-comet",
-  "tidy-maple",
-  "brisk-panda"
-];
-function inventAppName(prompt) {
-  const suffix = Math.random().toString(36).slice(2, 5);
-  const words = (prompt ?? "").toLowerCase().match(/[a-z0-9]+/g)?.filter((w) => w.length > 2 && !NAME_STOPWORDS.has(w)).slice(0, 3) ?? [];
-  const core = words.length ? words.join("-") : FALLBACK_WORDS[Math.floor(Math.random() * FALLBACK_WORDS.length)];
-  return `base44-${core}-${suffix}`.slice(0, 60);
+// src/cli/commands/auth/login.ts
+function getLoginCommand() {
+  return new Base44Command("login", {
+    requireAuth: false,
+    requireAppContext: false
+  }).description("Authenticate with Base44").action(login);
 }
-function repoBasename(repoUrl) {
-  return repoUrl.replace(/\/+$/, "").replace(/\.git$/, "").split("/").pop() ?? "app";
+
+// src/cli/commands/auth/logout.ts
+async function logout(_ctx) {
+  await deleteAuth();
+  return { outroMessage: "Logged out successfully" };
 }
-async function createAndLinkApp(options) {
-  if (options.name && !APP_NAME_RE.test(options.name)) {
-    throw new InvalidInputError("The name becomes a directory — letters, digits, dots, dashes and underscores only.");
-  }
-  const name = options.name ?? (options.importRepo ? repoBasename(options.importRepo) : inventAppName(options.prompt));
-  const targetDir = join21(process.cwd(), name);
-  await mkdir3(targetDir, { recursive: true });
-  if (await appConfigExists(targetDir)) {
-    throw new InvalidInputError(`./${name} is already linked to a Base44 app. Pick another name.`);
+function getLogoutCommand() {
+  return new Base44Command("logout", {
+    requireAuth: false,
+    requireAppContext: false
+  }).description("Logout from current device").action(logout);
+}
+
+// src/cli/commands/auth/whoami.ts
+async function whoami(_ctx) {
+  const workspaceApiKey = getWorkspaceApiKeyFromEnv();
+  if (workspaceApiKey && isWorkspaceApiKey(workspaceApiKey)) {
+    return {
+      outroMessage: `Using workspace API key: ${theme.styles.bold(workspaceApiKey.slice(0, 10))}`
+    };
   }
-  const created = options.importRepo ? await createImportedApp({
-    appName: name,
-    repoUrl: options.importRepo,
-    sourceMode: options.mode ?? "direct",
-    newRepoName: options.repoName,
-    branch: options.fromBranch,
-    prompt: options.prompt
-  }) : await createApp({ appName: name, prompt: options.prompt });
-  await writeAppConfig(targetDir, created.id);
-  await mkdir3(join21(targetDir, "base44"), { recursive: true });
-  try {
-    await writeFile2(join21(targetDir, "base44", "config.jsonc"), `// Base44 project configuration.
-{
-  "name": ${JSON.stringify(name)}
+  const auth = await readAuth();
+  return { outroMessage: `Logged in as: ${theme.styles.bold(auth.email)}` };
 }
-`, { flag: "wx" });
-  } catch {}
-  setAppContext({ id: created.id, projectRoot: targetDir });
-  return {
-    id: created.id,
-    editorUrl: `${getBase44ApiUrl()}/apps/${created.id}/editor/preview`,
-    repoUrl: created.imported_repo_url ?? undefined,
-    dirName: name,
-    targetDir
-  };
+function getWhoamiCommand() {
+  return new Base44Command("whoami", { requireAppContext: false }).description("Display current authenticated user").action(whoami);
 }
-async function githubReauthLines(error) {
-  if (!isGithubUserTokenError(error))
-    return null;
-  const link = await startGithubReauth().catch(() => null);
-  return [
-    "Your GitHub authorization expired. Reconnect, then run this again:",
-    link ? terminalLink("Reconnect GitHub", link) : "Open Base44 → GitHub settings to reconnect your account."
+
+// src/cli/commands/branches/index.ts
+async function listBranchesAction({
+  log,
+  runTask,
+  jsonMode
+}) {
+  const remote = await runTask("Fetching branches", () => listBranches());
+  const branches = [
+    { name: "main", status: "active" },
+    ...remote.map((branch) => ({
+      name: branch.branch_name,
+      status: branch.status
+    }))
   ];
+  if (jsonMode)
+    return { stdout: `${JSON.stringify({ branches })}
+` };
+  for (const branch of branches)
+    log.message(`${branch.name} (${branch.status})`);
+  return { outroMessage: `${branches.length} branches` };
 }
-async function resolveBranchId(ctx) {
-  return ctx.branchId ?? await resolveActiveBranchId().catch(() => {
-    return;
-  });
+function getBranchesCommand() {
+  return new Command2("branches").description("Discover an app's branches").addCommand(new Base44Command("list").description("List main and active branch names for use with --branch").action(listBranchesAction));
 }
 
-// src/core/resources/apps/stream.ts
-function newStreamState() {
-  return { perMessage: new Map };
-}
-var TOOL_SETTLED = new Set(["success", "error", "stopped"]);
-function oneLine(value, max) {
-  const text = typeof value === "string" ? value : value == null ? "" : JSON.stringify(value);
-  const flat = text.replace(/\s+/g, " ").trim();
-  return flat.length > max ? `${flat.slice(0, max)}…` : flat;
+// src/core/model.ts
+var MODELS = [
+  {
+    name: "Automatic",
+    id: null,
+    note: "matched with the best model",
+    aliases: ["default", "auto"]
+  },
+  { name: "Opus 5", id: "claude_opus_5" },
+  { name: "Sonnet 5", id: "claude-sonnet-5" },
+  { name: "Fable 5", id: "claude_fable_5", note: "uses more credits" },
+  { name: "GPT-5.6 Sol", id: "gpt_5_6_sol" },
+  {
+    name: "Gemini 3.8 Flash",
+    id: "gemini_3_8_flash",
+    note: "fast responses for everyday tasks"
+  },
+  { name: "Base 1", id: "base1" }
+];
+var fold = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+function resolvePick(input) {
+  const key = fold(input);
+  const byExact = MODELS.find((m) => fold(m.name) === key || m.id && fold(m.id) === key || m.aliases?.some((a) => fold(a) === key));
+  if (byExact)
+    return byExact;
+  const byContains = MODELS.filter((m) => fold(m.name).includes(key) || m.id && fold(m.id).includes(key));
+  if (byContains.length === 1)
+    return byContains[0];
+  const names = MODELS.map((m) => m.name).join(", ");
+  throw new InvalidInputError(byContains.length > 1 ? `"${input}" is ambiguous — matches ${byContains.map((m) => m.name).join(", ")}.` : `Unknown model "${input}". Choose one of: ${names}.`);
 }
-var SALIENT_KEYS = ["command", "path", "file_path", "title"];
-function salvageKey(raw, keys) {
-  for (const key of keys) {
-    const match = raw.match(new RegExp(`"${key}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)"`));
-    if (match?.[1])
-      return match[1].replace(/\\(.)/g, "$1");
+async function getMe() {
+  try {
+    return await base44Client.get("api/auth/me").json();
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "reading your account");
   }
-  return;
 }
-function toolMeta(name, argumentsString) {
-  const raw = argumentsString ?? "";
-  let args = {};
+async function saveBuilderModel(userId, modelId) {
   try {
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      args = parsed;
+    await base44Client.post(`api/auth/${userId}/update-user`, {
+      json: { builder_model: modelId }
+    });
+  } catch (error) {
+    if (error instanceof HTTPError && error.response.status === 400) {
+      throw new InvalidInputError("This account can't pick a builder model yet — enable the PER_USER_BUILDER_MODEL_SELECTION flag for it in PostHog, or the model isn't available in this workspace.");
+    }
+    throw await ApiError.fromHttpError(error, "saving your model choice");
+  }
+}
+var displayName = (id) => MODELS.find((m) => m.id === id)?.name ?? id ?? "Automatic";
+
+// src/cli/commands/builder/model.ts
+async function modelAction({ log, jsonMode }, input) {
+  const me = await getMe();
+  const current = me.builder_model ?? null;
+  if (!input) {
+    if (jsonMode) {
+      return {
+        stdout: `${JSON.stringify({
+          current,
+          models: MODELS.map((m) => ({ name: m.name, id: m.id }))
+        })}
+`
+      };
+    }
+    for (const m of MODELS) {
+      const active = (m.id ?? null) === current;
+      const marker = active ? theme.styles.bold("●") : theme.styles.dim("○");
+      const note = m.note ? theme.styles.dim(`  (${m.note})`) : "";
+      log.message(`${marker} ${active ? theme.styles.bold(m.name) : m.name}${note}`);
     }
-  } catch {
     return {
-      label: oneLine(salvageKey(raw, ["summary"]) ?? "", 90),
-      summary: oneLine(salvageKey(raw, SALIENT_KEYS) ?? raw, 90)
+      outroMessage: `Current: ${theme.styles.bold(displayName(current))}. Set with \`base44 builder model <name>\`.`
     };
   }
-  const pick = (key) => typeof args[key] === "string" && args[key].trim() ? args[key] : undefined;
-  const salient = {
-    run_shell_command: pick("command"),
-    read_repo_file: pick("path") ?? pick("file_path"),
-    write_repo_file: pick("path") ?? pick("file_path"),
-    edit_repo_file: pick("path") ?? pick("file_path"),
-    create_pull_request: pick("title"),
-    reload_preview: ""
-  };
-  const summary = salient[name] ?? Object.entries(args).find(([key, v]) => key !== "summary" && typeof v === "string" && v.trim().length > 0)?.[1] ?? "";
+  const pick = resolvePick(input);
+  if ((pick.id ?? null) === current) {
+    return { outroMessage: `Already on ${theme.styles.bold(pick.name)}.` };
+  }
+  await saveBuilderModel(me.id, pick.id);
+  if (jsonMode)
+    return { stdout: `${JSON.stringify({ current: pick.id })}
+` };
   return {
-    label: oneLine(pick("summary") ?? "", 90),
-    summary: oneLine(summary, 90)
+    outroMessage: pick.id === null ? "Model reset — Base44 chooses per app again." : `Builder model set to ${theme.styles.bold(pick.name)} for every new turn.`
   };
 }
-function labelTense(label, tense) {
-  const parts = label.split(/\s*\|\s*/);
-  if (parts.length < 2)
-    return label;
-  return tense === "running" ? parts[0] : parts[1];
+function getModelCommand() {
+  const command = new Base44Command("model", { requireAppContext: false });
+  command.description("Pick the builder model for your turns (account-wide). No argument lists models and the current pick; `default` clears it").argument("[model]", 'Model name or id, e.g. "Opus 5" or default').action(modelAction);
+  return command;
 }
-function progressFor(state, id) {
-  let progress = state.perMessage.get(id);
-  if (!progress) {
-    progress = {
-      contentLength: 0,
-      reasoningLength: 0,
-      announcedTools: new Map,
-      settledTools: new Set,
-      waitingNotified: new Set
-    };
-    state.perMessage.set(id, progress);
-  }
-  return progress;
+
+// src/cli/commands/builder/shared.ts
+import { mkdir as mkdir3, writeFile as writeFile2 } from "node:fs/promises";
+import { basename as basename6, join as join25, relative as relative6, resolve as resolve8 } from "node:path";
+
+// src/cli/commands/code/render.ts
+var TOOL_ALIASES = {
+  run_shell_command: "bash",
+  read_repo_file: "read",
+  write_repo_file: "write",
+  edit_repo_file: "edit",
+  set_secrets: "secrets",
+  generate_development_secrets: "secrets",
+  create_pull_request: "pr",
+  merge_pull_request: "merge",
+  list_pr_threads: "pr threads",
+  reply_to_pr_thread: "pr reply",
+  comment_on_pr: "pr comment",
+  resolve_pr_thread: "pr resolve",
+  reload_preview: "reload",
+  preview_execute_code: "preview js",
+  preview_screenshot: "screenshot",
+  connect_github_account: "github"
+};
+var QUIET_OK_RESULTS = new Set(["read", "write", "edit", "reload"]);
+function toolAlias(name) {
+  return TOOL_ALIASES[name] ?? name;
 }
-function diffConversation(state, messages) {
-  const events = [];
-  for (const message of messages) {
-    if (message.role !== "assistant" || message.hidden)
-      continue;
-    const progress = progressFor(state, message.id);
-    const reasoning = message.reasoning?.content ?? "";
-    if (reasoning.length > progress.reasoningLength) {
-      const delta = reasoning.slice(progress.reasoningLength).trim();
-      if (delta)
-        events.push({ kind: "thinking", text: oneLine(delta, 300) });
-      progress.reasoningLength = reasoning.length;
-    }
-    if (typeof message.content === "string" && message.content.length > progress.contentLength) {
-      const delta = message.content.slice(progress.contentLength).trim();
-      if (delta)
-        events.push({ kind: "text", text: delta });
-      progress.contentLength = message.content.length;
-    }
-    for (const tool of message.tool_calls ?? []) {
-      if (!progress.announcedTools.has(tool.id)) {
-        progress.announcedTools.set(tool.id, toolMeta(tool.name, tool.arguments_string));
-        const meta = progress.announcedTools.get(tool.id);
-        events.push({
-          kind: "tool_start",
-          id: tool.id,
-          name: tool.name,
-          label: labelTense(meta.label, "running"),
-          summary: meta.summary
-        });
-      }
-      const status = tool.status ?? "running";
-      if (status === "waiting_for_user_input" && !progress.waitingNotified.has(tool.id)) {
-        progress.waitingNotified.add(tool.id);
-        const meta = progress.announcedTools.get(tool.id);
-        events.push({
-          kind: "waiting",
-          id: tool.id,
-          name: tool.name,
-          label: labelTense(meta.label, "running")
-        });
+var ESC_CHAR = String.fromCharCode(27);
+var BEL = String.fromCharCode(7);
+var OSC8_CLOSE = `${ESC_CHAR}]8;;${BEL}`;
+function terminalLink(label, url) {
+  return `${ESC_CHAR}]8;;${url}${BEL}${source_default.dim.underline(label)}${OSC8_CLOSE}`;
+}
+function linkifyUrls(text) {
+  let n = 0;
+  return text.replace(/https?:\/\/[^\s]+/g, (raw) => {
+    const trailing = raw.match(/[.,;:!?)\]}'"]+$/)?.[0] ?? "";
+    const url = trailing ? raw.slice(0, -trailing.length) : raw;
+    const id = `b44-${n++}`;
+    return `${ESC_CHAR}]8;id=${id};${url}${BEL}${url}${OSC8_CLOSE}${trailing}`;
+  });
+}
+function hardWrapAnsi(text, width) {
+  const ESC = new RegExp(`^(?:${ESC_CHAR}\\[[0-9;]*m|${ESC_CHAR}\\]8;[^${BEL}]*${BEL})`);
+  const RESET = `${ESC_CHAR}[0m`;
+  const out = [];
+  for (const logical of text.split(`
+`)) {
+    let line = "";
+    let visible = 0;
+    let active = [];
+    let link = "";
+    let i = 0;
+    while (i < logical.length) {
+      const esc = ESC.exec(logical.slice(i));
+      if (esc) {
+        const seq = esc[0];
+        line += seq;
+        if (seq === RESET)
+          active = [];
+        else if (seq.endsWith("m"))
+          active.push(seq);
+        else if (seq === OSC8_CLOSE)
+          link = "";
+        else
+          link = seq;
+        i += seq.length;
+        continue;
       }
-      if (TOOL_SETTLED.has(status) && !progress.settledTools.has(tool.id)) {
-        progress.settledTools.add(tool.id);
-        const meta = progress.announcedTools.get(tool.id);
-        events.push({
-          kind: "tool_end",
-          id: tool.id,
-          name: tool.name,
-          label: labelTense(meta.label, "done"),
-          summary: meta.summary,
-          ok: status === "success",
-          result: oneLine(tool.results, 110)
-        });
+      if (visible >= width) {
+        out.push(`${line}${link ? OSC8_CLOSE : ""}${RESET}`);
+        line = active.join("") + link;
+        visible = 0;
       }
+      line += logical[i];
+      visible++;
+      i++;
     }
+    out.push(line);
   }
-  return events;
+  return out;
 }
-function turnSettled(messages) {
-  return newestUserTurn(messages)?.settled ?? false;
+function formatDuration2(ms) {
+  const seconds = Math.round(ms / 1000);
+  if (seconds < 90)
+    return `${seconds}s`;
+  return `${Math.floor(seconds / 60)}m ${String(seconds % 60).padStart(2, "0")}s`;
 }
-function newestUserTurn(messages) {
-  for (let i = messages.length - 1;i >= 0; i--) {
-    const message = messages[i];
-    if (message.role === "user" && !message.hidden) {
-      const outcome = message.outcome;
-      const backendStatus = outcome && typeof outcome === "object" ? outcome.backend_status : undefined;
-      return {
-        id: message.id,
-        settled: outcome != null && backendStatus !== "pending",
-        backendStatus
-      };
+function eventLine(event, elapsedMs) {
+  switch (event.kind) {
+    case "thinking":
+      return source_default.dim(`✻ ${event.text}`);
+    case "text":
+      return linkifyUrls(event.text);
+    case "tool_start":
+      return null;
+    case "waiting": {
+      const what = event.label || toolAlias(event.name);
+      return source_default.yellow(`⏸ ${what} — needs your input (answer in the editor)`);
     }
-  }
-  return null;
-}
-var sleep3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-function makePoller(onEvent, options) {
-  const state = newStreamState();
-  return async (prime = false) => {
-    try {
-      const messages = await getFullConversation(30, options.branchId);
-      const events = diffConversation(state, messages);
-      if (!prime)
-        for (const event of events)
-          onEvent(event);
-      return messages;
-    } catch {
-      return [];
+    case "tool_end": {
+      const alias = toolAlias(event.name);
+      const mark = event.ok ? source_default.green("✓") : source_default.red("✗");
+      const title = source_default.bold(event.label || alias);
+      const took = elapsedMs != null && elapsedMs >= 3000 ? ` ${source_default.dim(`· ${formatDuration2(elapsedMs)}`)}` : "";
+      const inlineDetail = !event.label && event.summary ? ` ${source_default.dim(event.summary)}` : "";
+      const paramsLine = event.label && event.summary ? `
+  ${source_default.dim(`${alias}: ${event.summary}`)}` : "";
+      const head = `${mark} ${title}${inlineDetail}${took}${paramsLine}`;
+      if (event.ok && (QUIET_OK_RESULTS.has(alias) || !event.result)) {
+        return head;
+      }
+      const result = event.ok ? source_default.dim(linkifyUrls(event.result)) : source_default.red(linkifyUrls(event.result));
+      return `${head}${event.result ? `
+  ${result}` : ""}`;
     }
-  };
-}
-async function streamConversationDuring(start, onEvent, options = {}) {
-  const intervalMs = options.intervalMs ?? 1000;
-  const poll = makePoller(onEvent, options);
-  await poll(true);
-  const work = start();
-  let pending = true;
-  const settled = work.then(() => {
-    pending = false;
-  }, () => {
-    pending = false;
-  });
-  while (pending) {
-    await Promise.race([sleep3(intervalMs), settled]);
-    if (!pending)
-      break;
-    await poll();
   }
-  await poll();
-  return work;
 }
-async function streamConversationUntilSettled(onEvent, options = {}) {
-  const intervalMs = options.intervalMs ?? 1000;
-  const deadline = Date.now() + (options.timeoutMs ?? 20 * 60000);
-  const poll = makePoller(onEvent, options);
-  while (Date.now() < deadline) {
-    const messages = await poll();
-    if (messages.length > 0 && turnSettled(messages))
-      return "settled";
-    await sleep3(intervalMs);
-  }
-  return "timeout";
+var FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+var MUSINGS = [
+  "Shmoozing",
+  "Shmoogling",
+  "Percolating",
+  "Noodling",
+  "Marinating",
+  "Brewing",
+  "Simmering",
+  "Conjuring",
+  "Tinkering",
+  "Scheming",
+  "Pondering",
+  "Mulling",
+  "Whirring",
+  "Crunching",
+  "Weaving",
+  "Sketching",
+  "Hatching",
+  "Riffing",
+  "Cooking",
+  "Composting ideas",
+  "Rummaging",
+  "Vibing responsibly",
+  "Untangling",
+  "Squinting at the repo"
+];
+var MUSING_ROTATE_MS = 6000;
+function idleMusing(seed) {
+  return `${MUSINGS[(seed + Math.floor(Date.now() / MUSING_ROTATE_MS)) % MUSINGS.length]}…`;
 }
-
-// src/cli/commands/app/new.ts
-var POLL_TIMEOUT_MS = 20 * 60000;
-var MODES = ["direct", "fork", "copy"];
-async function newAction({ log, runTask, jsonMode }, prompt, options) {
-  if (options.mode && !MODES.includes(options.mode)) {
-    throw new InvalidInputError("--mode must be direct, fork, or copy.");
-  }
-  if ((options.mode || options.repoName || options.fromBranch) && !options.import) {
-    throw new InvalidInputError("--mode, --repo-name and --from-branch apply only with --import <repo>.");
-  }
-  if (!prompt && !options.import) {
-    throw new InvalidInputError('Describe the app ("<prompt>") or pass --import <repo>.');
-  }
-  let app;
-  try {
-    app = await runTask(options.import ? "Importing the repository" : "Creating your app", () => createAndLinkApp({
-      prompt,
-      name: options.name,
-      importRepo: options.import,
-      mode: options.mode,
-      repoName: options.repoName,
-      fromBranch: options.fromBranch
-    }));
-  } catch (error) {
-    for (const line of await githubReauthLines(error) ?? [])
-      log.message(line);
-    throw error;
-  }
-  if (!jsonMode) {
-    if (app.repoUrl)
-      log.message(source_default.dim(`repo    ${app.repoUrl}`));
-    log.message(source_default.dim(`editor  ${app.editorUrl}`));
-    log.message(source_default.dim(`linked  ./${app.dirName}`));
-  }
-  let finalState;
-  let previewUrl;
-  const startedAt = Date.now();
-  if (prompt) {
-    const branchId = await resolveActiveBranchId().catch(() => {
+function createTurnStream(interactive, write = (text) => process.stdout.write(text), options = {}) {
+  const running = new Map;
+  const footer = options.footer ?? [];
+  let frame = 0;
+  let stopped = false;
+  let drawnLines = 0;
+  const musingSeed = Math.floor(Math.random() * MUSINGS.length);
+  const statusLabel = () => {
+    if (running.size === 0) {
+      if (options.idleLabel)
+        return `${options.idleLabel}…`;
+      const index = (musingSeed + Math.floor(Date.now() / MUSING_ROTATE_MS)) % MUSINGS.length;
+      return `${MUSINGS[index]}…`;
+    }
+    const newest = [...running.values()].at(-1);
+    const elapsed = Math.round((Date.now() - newest.startedAt) / 1000);
+    const others = running.size > 1 ? ` (+${running.size - 1} more)` : "";
+    const what = newest.label || `${newest.alias}${newest.summary ? ` ${newest.summary}` : ""}`;
+    return `${what}${others} · ${elapsed}s`;
+  };
+  const clearBlock = () => {
+    if (!drawnLines)
       return;
-    });
-    const stream = createTurnStream(process.stdout.isTTY === true && !jsonMode, undefined, { idleLabel: "provisioning the sandbox and starting the build" });
-    try {
-      const settled = await streamConversationUntilSettled((event) => {
-        if (!jsonMode)
-          stream.onEvent(event);
-      }, { branchId, timeoutMs: POLL_TIMEOUT_MS });
-      finalState = settled === "timeout" ? "processing" : (await getAppState(app.id)).status?.state ?? "ready";
-      if (finalState === "ready") {
-        previewUrl = await getPreviewUrl().catch(() => {
-          return;
+    write("\r\x1B[2K");
+    for (let i = 1;i < drawnLines; i++)
+      write("\x1B[1A\r\x1B[2K");
+    drawnLines = 0;
+  };
+  const drawBlock = () => {
+    if (!interactive || stopped)
+      return;
+    const lines = [
+      ...footer.length ? ["", ...footer] : [],
+      source_default.dim(`${FRAMES[frame]} ${statusLabel()}`)
+    ];
+    write(lines.join(`
+`));
+    drawnLines = lines.length;
+  };
+  const tick = () => {
+    if (!interactive || stopped)
+      return;
+    frame = (frame + 1) % FRAMES.length;
+    clearBlock();
+    drawBlock();
+  };
+  const timer = interactive ? setInterval(tick, 120) : null;
+  if (timer)
+    timer.unref?.();
+  return {
+    onEvent(event) {
+      if (event.kind === "tool_start") {
+        running.set(event.id, {
+          alias: toolAlias(event.name),
+          label: event.label,
+          summary: event.summary,
+          startedAt: Date.now()
         });
+        if (interactive) {
+          clearBlock();
+          drawBlock();
+        }
+        return;
       }
-    } finally {
-      stream.stop();
+      let elapsedMs;
+      if (event.kind === "tool_end") {
+        const started = running.get(event.id)?.startedAt;
+        if (started != null)
+          elapsedMs = Date.now() - started;
+        running.delete(event.id);
+      }
+      const line = eventLine(event, elapsedMs);
+      if (line == null)
+        return;
+      if (interactive) {
+        clearBlock();
+        write(`${line}
+`);
+        drawBlock();
+      } else {
+        write(`${line}
+`);
+      }
+    },
+    stop() {
+      if (interactive) {
+        clearBlock();
+        if (footer.length)
+          write(`
+${footer.join(`
+`)}
+`);
+      }
+      stopped = true;
+      if (timer)
+        clearInterval(timer);
     }
+  };
+}
+
+// src/core/resources/apps/api.ts
+var CreatedAppSchema = object({
+  id: string2().min(1),
+  name: string2().nullish(),
+  imported_repo_url: string2().nullish()
+});
+var AppStateSchema = object({
+  id: string2(),
+  app_type: string2().nullish(),
+  is_managed_source_code: boolean2().nullish(),
+  imported_repo_url: string2().nullish(),
+  status: object({
+    state: string2().nullish(),
+    message: string2().nullish()
+  }).nullish()
+});
+var ChatTurnSchema = object({
+  queued: boolean2().optional(),
+  status: object({
+    state: string2().nullish(),
+    message: string2().nullish(),
+    error_source: string2().nullish()
+  }).nullish(),
+  conversation: object({
+    messages: array(object({
+      role: string2().nullish(),
+      content: unknown().nullish()
+    })).nullish()
+  }).nullish()
+});
+var PreviewUrlSchema = object({
+  preview_url: string2().min(1)
+});
+var ConversationMessageSchema = object({
+  id: string2(),
+  role: string2(),
+  hidden: boolean2().nullish(),
+  outcome: unknown().nullish(),
+  content: unknown().nullish(),
+  reasoning: object({ content: string2().nullish() }).nullish(),
+  tool_calls: array(object({
+    id: string2(),
+    name: string2(),
+    arguments_string: string2().nullish(),
+    status: string2().nullish(),
+    results: unknown().nullish()
+  })).nullish()
+});
+var FullConversationSchema = object({
+  messages: array(ConversationMessageSchema).default([])
+});
+var OAuthInitiateSchema = object({ authorization_url: string2().min(1) });
+function parseOrThrow(schema, payload, what) {
+  const result = schema.safeParse(payload);
+  if (!result.success) {
+    throw new SchemaValidationError(`Invalid ${what} response from server`, result.error);
   }
-  if (jsonMode) {
-    return {
-      stdout: `${JSON.stringify({
-        id: app.id,
-        repo_url: app.repoUrl ?? null,
-        editor_url: app.editorUrl,
-        preview_url: previewUrl ?? null,
-        status: finalState ?? "created"
-      })}
-`
-    };
-  }
-  if (previewUrl)
-    log.message(`preview ${previewUrl}`);
-  const cd = ` Next: cd ${app.dirName}`;
-  if (finalState === "error") {
-    return {
-      outroMessage: `The first build reported an error — open the editor for details.${cd}`
-    };
-  }
-  if (finalState === "processing") {
-    return {
-      outroMessage: `Still building — follow it with \`base44 app status\`.${cd}`
-    };
+  return result.data;
+}
+function branchScope(branchId) {
+  return branchId ? { branch_id: branchId } : {};
+}
+async function createApp(options) {
+  let response;
+  try {
+    response = await base44Client.post("api/apps", {
+      timeout: false,
+      json: {
+        ...options.appName ? { name: options.appName } : {},
+        ...options.organizationId ? { organization_id: options.organizationId } : {},
+        ...options.prompt ? { initial_message: { content: options.prompt } } : {}
+      }
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "creating app");
   }
-  return {
-    outroMessage: prompt ? `First build finished · ${formatDuration2(Date.now() - startedAt)}.${cd}` : `App created.${cd}`
-  };
+  return parseOrThrow(CreatedAppSchema, await response.json(), "app");
 }
-function getNewCommand() {
-  const command = new Base44Command("new", { requireAppContext: false });
-  command.description("Create an app and start building: from a prompt (the Base44 template), or over an existing GitHub repo with --import").argument("[prompt]", "What to build; the first agent turn starts immediately").option("--import <repo>", "Build over an existing GitHub repository instead of the template").option("--mode <mode>", "How to import: direct, fork, or copy (default: direct)").option("--name <name>", "Directory and app name (invented when omitted)").option("--repo-name <name>", "Name for the new GitHub repo when forking/copying").option("--from-branch <name>", "Import a specific branch of the repo").action(newAction);
-  return command;
+async function createImportedApp(options) {
+  let response;
+  try {
+    response = await base44Client.post("api/apps", {
+      timeout: false,
+      json: {
+        app_type: "imported_app",
+        name: options.appName,
+        imported_source_mode: options.sourceMode,
+        imported_repo_url: options.repoUrl,
+        ...options.newRepoName ? { imported_new_repo_name: options.newRepoName } : {},
+        ...options.branch ? { imported_branch: options.branch } : {},
+        ...options.prompt ? { initial_message: { content: options.prompt } } : {}
+      }
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "importing repository");
+  }
+  return parseOrThrow(CreatedAppSchema, await response.json(), "app");
 }
-
-// src/cli/commands/app/preview.ts
-async function previewAction(ctx) {
-  const url = await ctx.runTask("Resolving preview URL (boots the sandbox if needed)", () => getPreviewUrl());
-  if (ctx.jsonMode)
-    return { stdout: `${JSON.stringify({ preview_url: url })}
-` };
-  ctx.log.message(url);
-  return { outroMessage: "Preview is live." };
+async function startGithubReauth() {
+  const response = await base44Client.post("api/github/oauth/initiate?skip_installation=true");
+  return parseOrThrow(OAuthInitiateSchema, await response.json(), "github oauth initiate").authorization_url;
 }
-function getPreviewCommand() {
-  const command = new Base44Command("preview");
-  command.description("Print the app's live preview URL").action(previewAction);
-  return command;
+function isGithubUserTokenError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /api\.github\.com/i.test(message) && /\b401\b|unauthorized/i.test(message);
 }
-
-// src/cli/commands/app/send.ts
-function lastAssistantReply(turn) {
-  const messages = turn.conversation?.messages ?? [];
-  for (let i = messages.length - 1;i >= 0; i--) {
-    const { role, content } = messages[i];
-    if (role === "assistant" && typeof content === "string" && content.trim()) {
-      return content.trim();
-    }
+async function getAppState(appId) {
+  let response;
+  try {
+    response = await base44Client.get(`api/apps/${appId}`, {
+      searchParams: {
+        fields: "id,status,app_type,is_managed_source_code,imported_repo_url"
+      }
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "reading app status");
   }
-  return;
+  return parseOrThrow(AppStateSchema, await response.json(), "app status");
 }
-async function sendAction(ctx, message) {
-  const branchId = await resolveBranchId(ctx);
-  if (ctx.jsonMode) {
-    const turn = await ctx.runTask("Agent working (a turn can take minutes)", () => sendTurn(message, branchId));
-    if (turn.queued)
-      return { stdout: `${JSON.stringify({ queued: true })}
-` };
-    return {
-      stdout: `${JSON.stringify({
-        status: turn.status?.state ?? "ready",
-        error_source: turn.status?.error_source ?? null,
-        reply: lastAssistantReply(turn) ?? null
-      })}
-`
-    };
-  }
-  const stream = createTurnStream(process.stdout.isTTY === true);
-  let turn;
+async function sendTurn(content, branchId) {
+  let response;
   try {
-    turn = await streamConversationDuring(() => sendTurn(message, branchId), stream.onEvent, { branchId });
-  } finally {
-    stream.stop();
+    response = await getAppClient().post("chat/message", {
+      timeout: false,
+      searchParams: {
+        conversation_messages: "current_turn",
+        ...branchScope(branchId)
+      },
+      json: { content }
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "sending message");
   }
-  if (turn.queued) {
-    return {
-      outroMessage: "The agent is busy with an earlier message — yours was queued and runs next."
-    };
+  return parseOrThrow(ChatTurnSchema, await response.json(), "chat turn");
+}
+async function stopTurn(branchId) {
+  try {
+    await getAppClient().post("chat/stop", {
+      searchParams: branchScope(branchId)
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "stopping the turn");
   }
-  if (turn.status?.state === "error") {
-    return {
-      outroMessage: `Turn failed (${turn.status.error_source ?? "unknown"}) — see the editor for details.`
-    };
+}
+async function getFullConversation(limit, branchId) {
+  let response;
+  try {
+    response = await getAppClient().get("chat/full-conversation", {
+      timeout: 30000,
+      searchParams: { limit: String(limit), ...branchScope(branchId) }
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "reading the conversation");
   }
-  return { outroMessage: "Turn finished." };
+  return parseOrThrow(FullConversationSchema, await response.json(), "conversation").messages;
 }
-function getSendCommand() {
-  const command = new Base44Command("send", { supportsBranch: true });
-  command.description("Send the agent one message and stream the turn until it finishes").argument("<message>", "What you want the agent to do").action(sendAction);
-  return command;
+async function resolveActiveBranchId() {
+  const branches = await listBranches();
+  return branches.length === 1 ? branches[0].id : undefined;
 }
-
-// src/cli/commands/app/status.ts
-async function statusAction(ctx) {
-  const id = ctx.app?.id;
-  const app = await ctx.runTask("Reading app status", () => getAppState(id));
-  const state = app.status?.state ?? "ready";
-  if (ctx.jsonMode) {
-    return {
-      stdout: `${JSON.stringify({ id: app.id, state, message: app.status?.message ?? null })}
-`
-    };
+async function getPreviewUrl() {
+  let response;
+  try {
+    response = await getAppClient().get("sandbox/preview-url", {
+      timeout: false
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "fetching preview URL");
   }
-  ctx.log.message(`State:  ${state}`);
-  if (app.status?.message)
-    ctx.log.message(`Note:   ${app.status.message}`);
-  return { outroMessage: "Status read." };
-}
-function getStatusCommand() {
-  const command = new Base44Command("status");
-  command.description("Show whether the app is building, ready, or errored").action(statusAction);
-  return command;
+  const url = parseOrThrow(PreviewUrlSchema, await response.json(), "preview URL").preview_url;
+  return /^https?:\/\//.test(url) ? url : `https://${url}`;
 }
 
-// src/cli/commands/app/stop.ts
-async function stopAction(ctx) {
-  const branchId = await resolveBranchId(ctx);
-  await ctx.runTask("Stopping the running turn", () => stopTurn(branchId));
-  if (ctx.jsonMode)
-    return { stdout: `${JSON.stringify({ stopped: true })}
-` };
-  return { outroMessage: "Stopped." };
+// src/cli/commands/builder/shared.ts
+var APP_NAME_RE = /^[A-Za-z0-9._-]+$/;
+var NAME_STOPWORDS = new Set("a an the and or of for with to in on that this its it my our your me".split(" "));
+var FALLBACK_WORDS = [
+  "swift-otter",
+  "sunny-comet",
+  "tidy-maple",
+  "brisk-panda"
+];
+function inventAppName(prompt) {
+  const suffix = Math.random().toString(36).slice(2, 5);
+  const words = (prompt ?? "").toLowerCase().match(/[a-z0-9]+/g)?.filter((w) => w.length > 2 && !NAME_STOPWORDS.has(w)).slice(0, 3) ?? [];
+  const core = words.length ? words.join("-") : FALLBACK_WORDS[Math.floor(Math.random() * FALLBACK_WORDS.length)];
+  return `base44-${core}-${suffix}`.slice(0, 60);
+}
+function repoBasename(repoUrl) {
+  return repoUrl.replace(/\/+$/, "").replace(/\.git$/, "").split("/").pop() ?? "app";
+}
+async function createAndLinkApp(options) {
+  if (options.name && !APP_NAME_RE.test(options.name)) {
+    throw new InvalidInputError("The name becomes a directory — letters, digits, dots, dashes and underscores only.");
+  }
+  const cwd = process.cwd();
+  const fallbackName = () => options.importRepo ? repoBasename(options.importRepo) : inventAppName(options.prompt);
+  const chosenDir = options.path ? resolve8(cwd, options.path) : await isDirEmpty(cwd) ? cwd : undefined;
+  const dirBase = chosenDir ? basename6(chosenDir) : undefined;
+  const name = options.name ?? (dirBase && APP_NAME_RE.test(dirBase) ? dirBase : fallbackName());
+  const targetDir = chosenDir ?? join25(cwd, name);
+  const here = targetDir === cwd;
+  const dirName = here ? "." : relative6(cwd, targetDir) || name;
+  await mkdir3(targetDir, { recursive: true });
+  if (await appConfigExists(targetDir)) {
+    throw new InvalidInputError(here ? "This directory is already linked to a Base44 app. Run `base44 code` here to keep building it, or pass --path for a new one." : `./${dirName} is already linked to a Base44 app. Pick another name or --path.`);
+  }
+  const created = options.importRepo ? await createImportedApp({
+    appName: name,
+    repoUrl: options.importRepo,
+    sourceMode: options.mode ?? "direct",
+    newRepoName: options.repoName,
+    branch: options.fromBranch,
+    prompt: options.prompt
+  }) : await createApp({ appName: name, prompt: options.prompt });
+  await writeAppConfig(targetDir, created.id);
+  await mkdir3(join25(targetDir, "base44"), { recursive: true });
+  try {
+    await writeFile2(join25(targetDir, "base44", "config.jsonc"), `// Base44 project configuration.
+{
+  "name": ${JSON.stringify(name)}
+}
+`, { flag: "wx" });
+  } catch {}
+  setAppContext({ id: created.id, projectRoot: targetDir });
+  return {
+    id: created.id,
+    editorUrl: `${getBase44ApiUrl()}/apps/${created.id}/editor/preview`,
+    repoUrl: created.imported_repo_url ?? undefined,
+    dirName,
+    targetDir,
+    here
+  };
+}
+function repoLabel(url) {
+  return url.replace(/^https?:\/\//, "").replace(/\.git$/, "").replace(/\/$/, "");
+}
+function appTypeChip(state) {
+  switch (state.app_type ?? "user_app") {
+    case "imported_app":
+      return state.imported_repo_url ? repoLabel(state.imported_repo_url) : "repository app";
+    case "user_game":
+      return "game";
+    case "mobile_app":
+      return "mobile app";
+    case "slide":
+      return "slides";
+    case "user_agent":
+      return "superagent";
+    default:
+      return "web app";
+  }
 }
-function getStopCommand() {
-  const command = new Base44Command("stop", { supportsBranch: true });
-  command.description("Stop the agent's running turn").action(stopAction);
-  return command;
+async function assertBuilderApp(appId) {
+  const state = await getAppState(appId);
+  if (state.is_managed_source_code === false) {
+    throw new InvalidInputError("This project is code-first (base44 create): you own the source and the builder cannot work on it. Run `base44 builder new` for an agent-built app.");
+  }
+  if (state.app_type === "user_agent") {
+    throw new InvalidInputError("This is a Superagent, not an app the builder works on. Superagent has no CLI surface yet.");
+  }
+  return state;
 }
-
-// src/cli/commands/app/index.ts
-function getAppCommand() {
-  return new Command2("app").description("Build a Base44 app with the agent, non-interactively: create it, send turns, read status, get the preview").addCommand(getNewCommand()).addCommand(getSendCommand()).addCommand(getStatusCommand()).addCommand(getPreviewCommand()).addCommand(getStopCommand()).addCommand(getModelCommand());
+function nextStepsLines(app) {
+  const cd = app.here ? "" : `cd ${app.dirName} && `;
+  return [
+    "",
+    `${source_default.bold("Your app lives in")}  ${app.here ? "./  (this directory)" : `./${app.dirName}`}`,
+    source_default.dim(`  ${cd}base44 code        # keep building with the agent`),
+    source_default.dim(`  ${cd}base44 builder send "…"  # one non-interactive turn`),
+    source_default.dim(`  files live remotely — ${cd}base44 sandbox ls to look, base44 eject for a copy`)
+  ];
 }
-
-// src/cli/commands/auth/password-login.ts
-import { dirname as dirname15, join as join22 } from "node:path";
-async function passwordLoginAction({ log, runTask }, action) {
-  const shouldEnable = action === "enable";
-  const { project } = await readProjectConfig();
-  const configDir = dirname15(project.configPath);
-  const authDir = join22(configDir, project.authDir);
-  const updated = await runTask("Updating local auth config", async () => {
-    const current = await readAuthConfig(authDir) ?? DEFAULT_AUTH_CONFIG;
-    const merged = { ...current, enableUsernamePassword: shouldEnable };
-    await writeAuthConfig(authDir, merged);
-    return merged;
-  });
-  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
-    log.warn("Disabling password auth will leave no login methods enabled. Users will be locked out.");
-  }
-  const newStatus = shouldEnable ? "enabled" : "disabled";
-  return {
-    outroMessage: `Username & password authentication ${newStatus} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
-  };
+async function githubReauthLines(error) {
+  if (!isGithubUserTokenError(error))
+    return null;
+  const link = await startGithubReauth().catch(() => null);
+  return [
+    "Your GitHub authorization expired. Reconnect, then run this again:",
+    link ? terminalLink("Reconnect GitHub", link) : "Open Base44 → GitHub settings to reconnect your account."
+  ];
 }
-function getPasswordLoginCommand() {
-  return new Base44Command("password-login").description("Enable or disable username & password authentication").addArgument(new Argument2("<action>", "enable or disable password authentication").choices(["enable", "disable"])).action(passwordLoginAction);
+async function resolveBranchId(ctx) {
+  return ctx.branchId ?? await resolveActiveBranchId().catch(() => {
+    return;
+  });
 }
 
-// src/cli/commands/auth/pull.ts
-import { dirname as dirname16, join as join23 } from "node:path";
-async function pullAuthAction({
-  log,
-  runTask
-}) {
-  const { project } = await readProjectConfig();
-  const configDir = dirname16(project.configPath);
-  const authDir = join23(configDir, project.authDir);
-  const remoteConfig = await runTask("Fetching auth config from Base44", async () => {
-    return await pullAuthConfig();
-  }, {
-    successMessage: "Auth config fetched successfully",
-    errorMessage: "Failed to fetch auth config"
-  });
-  const { written } = await runTask("Syncing auth config file", async () => {
-    return await writeAuthConfig(authDir, remoteConfig);
-  }, {
-    successMessage: "Auth config file synced successfully",
-    errorMessage: "Failed to sync auth config file"
-  });
-  if (written) {
-    log.success("Auth config written to local file");
-  } else {
-    log.info("Auth config is already up to date");
-  }
-  return {
-    outroMessage: `Pulled auth config to ${authDir} (overwrites local file)`
-  };
+// src/core/resources/apps/stream.ts
+function newStreamState() {
+  return { perMessage: new Map };
 }
-function getAuthPullCommand() {
-  return new Base44Command("pull").description("Pull auth config from Base44 to local file").action(pullAuthAction);
+var TOOL_SETTLED = new Set(["success", "error", "stopped"]);
+function oneLine(value, max) {
+  const text = typeof value === "string" ? value : value == null ? "" : JSON.stringify(value);
+  const flat = text.replace(/\s+/g, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max)}…` : flat;
 }
-
-// src/cli/commands/auth/push.ts
-async function pushAuthAction({ isNonInteractive, log, runTask }, options) {
-  const { authConfig } = await readProjectConfig();
-  if (authConfig.length === 0) {
-    log.info("No local auth config found");
-    return {
-      outroMessage: "No auth config to push. Run `base44 auth pull` to fetch the remote config first."
-    };
-  }
-  if (!hasAnyLoginMethod(authConfig[0])) {
-    log.warn("This config has no login methods enabled. Pushing it will lock out all users.");
+var SALIENT_KEYS = ["command", "path", "file_path", "title"];
+function salvageKey(raw, keys) {
+  for (const key of keys) {
+    const match = raw.match(new RegExp(`"${key}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)"`));
+    if (match?.[1])
+      return match[1].replace(/\\(.)/g, "$1");
   }
-  if (!options.yes) {
-    if (isNonInteractive) {
-      throw new InvalidInputError("--yes is required in non-interactive mode");
-    }
-    const shouldPush = await Re({
-      message: "Push auth config to Base44?"
-    });
-    if (Ct(shouldPush) || !shouldPush) {
-      return { outroMessage: "Push cancelled" };
+  return;
+}
+function toolMeta(name, argumentsString) {
+  const raw = argumentsString ?? "";
+  let args = {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      args = parsed;
     }
+  } catch {
+    return {
+      label: oneLine(salvageKey(raw, ["summary"]) ?? "", 90),
+      summary: oneLine(salvageKey(raw, SALIENT_KEYS) ?? raw, 90)
+    };
   }
-  await runTask("Pushing auth config to Base44", async () => {
-    return await pushAuthConfig(authConfig[0] ?? null);
-  }, {
-    successMessage: "Auth config pushed successfully",
-    errorMessage: "Failed to push auth config"
-  });
+  const pick = (key) => typeof args[key] === "string" && args[key].trim() ? args[key] : undefined;
+  const salient = {
+    run_shell_command: pick("command"),
+    read_repo_file: pick("path") ?? pick("file_path"),
+    write_repo_file: pick("path") ?? pick("file_path"),
+    edit_repo_file: pick("path") ?? pick("file_path"),
+    create_pull_request: pick("title"),
+    reload_preview: ""
+  };
+  const summary = salient[name] ?? Object.entries(args).find(([key, v]) => key !== "summary" && typeof v === "string" && v.trim().length > 0)?.[1] ?? "";
   return {
-    outroMessage: "Auth config pushed to Base44"
+    label: oneLine(pick("summary") ?? "", 90),
+    summary: oneLine(summary, 90)
   };
 }
-function getAuthPushCommand() {
-  return new Base44Command("push").description("Push local auth config to Base44").option("-y, --yes", "Skip confirmation prompt").action(pushAuthAction);
+function labelTense(label, tense) {
+  const parts = label.split(/\s*\|\s*/);
+  if (parts.length < 2)
+    return label;
+  return tense === "running" ? parts[0] : parts[1];
 }
-
-// src/cli/commands/auth/social-login.ts
-import { dirname as dirname17, join as join24, resolve as resolve6 } from "node:path";
-var PROVIDER_LABELS = {
-  google: "Google",
-  microsoft: "Microsoft",
-  facebook: "Facebook",
-  apple: "Apple"
-};
-var VALID_PROVIDER_NAMES = Object.keys(SOCIAL_PROVIDERS);
-var PROVIDER_OAUTH_CLI = {
-  google: {
-    envVar: "google_oauth_client_secret",
-    promptMessage: "Enter Google OAuth client secret"
+function progressFor(state, id) {
+  let progress = state.perMessage.get(id);
+  if (!progress) {
+    progress = {
+      contentLength: 0,
+      reasoningLength: 0,
+      announcedTools: new Map,
+      settledTools: new Set,
+      waitingNotified: new Set
+    };
+    state.perMessage.set(id, progress);
   }
-};
-function hasSecretOptions(options) {
-  return Boolean(options.clientSecret || options.clientSecretStdin || options.envFile);
-}
-function hasCustomOAuthOptions(options) {
-  return Boolean(options.clientId || hasSecretOptions(options));
+  return progress;
 }
-async function socialLoginAction({ log, isNonInteractive, runTask }, provider, action, options) {
-  const shouldEnable = action === "enable";
-  const providerInfo = SOCIAL_PROVIDERS[provider];
-  const label = PROVIDER_LABELS[provider];
-  const hasOAuthOptions = hasCustomOAuthOptions(options);
-  if (hasOAuthOptions && !providerInfo.customOAuth) {
-    throw new InvalidInputError(`Custom OAuth options are only supported for providers with custom OAuth (e.g., google). Use: base44 auth social-login ${provider} ${action}`);
-  }
-  if (hasOAuthOptions && !shouldEnable) {
-    throw new InvalidInputError(`Custom OAuth options cannot be used with disable. To disable ${label} login: base44 auth social-login ${provider} disable`);
-  }
-  if (hasSecretOptions(options) && !options.clientId) {
-    throw new InvalidInputError(`--client-id is required when providing a client secret. Use: base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`);
-  }
-  const oauth = providerInfo.customOAuth;
-  const oauthCli = PROVIDER_OAUTH_CLI[provider];
-  const useCustomOAuth = shouldEnable && hasOAuthOptions && oauth != null;
-  let clientSecret;
-  if (useCustomOAuth && oauth && oauthCli && hasSecretOptions(options)) {
-    if (options.envFile) {
-      const secrets = await parseEnvFile(resolve6(options.envFile));
-      const value = secrets[oauthCli.envVar];
-      if (!value) {
-        throw new InvalidInputError(`Key "${oauthCli.envVar}" not found in ${options.envFile}.`);
+function diffConversation(state, messages) {
+  const events = [];
+  for (const message of messages) {
+    if (message.role !== "assistant" || message.hidden)
+      continue;
+    const progress = progressFor(state, message.id);
+    const reasoning = message.reasoning?.content ?? "";
+    if (reasoning.length > progress.reasoningLength) {
+      const delta = reasoning.slice(progress.reasoningLength).trim();
+      if (delta)
+        events.push({ kind: "thinking", text: oneLine(delta, 300) });
+      progress.reasoningLength = reasoning.length;
+    }
+    if (typeof message.content === "string" && message.content.length > progress.contentLength) {
+      const delta = message.content.slice(progress.contentLength).trim();
+      if (delta)
+        events.push({ kind: "text", text: delta });
+      progress.contentLength = message.content.length;
+    }
+    for (const tool of message.tool_calls ?? []) {
+      if (!progress.announcedTools.has(tool.id)) {
+        progress.announcedTools.set(tool.id, toolMeta(tool.name, tool.arguments_string));
+        const meta = progress.announcedTools.get(tool.id);
+        events.push({
+          kind: "tool_start",
+          id: tool.id,
+          name: tool.name,
+          label: labelTense(meta.label, "running"),
+          summary: meta.summary
+        });
+      }
+      const status = tool.status ?? "running";
+      if (status === "waiting_for_user_input" && !progress.waitingNotified.has(tool.id)) {
+        progress.waitingNotified.add(tool.id);
+        const meta = progress.announcedTools.get(tool.id);
+        events.push({
+          kind: "waiting",
+          id: tool.id,
+          name: tool.name,
+          label: labelTense(meta.label, "running")
+        });
+      }
+      if (TOOL_SETTLED.has(status) && !progress.settledTools.has(tool.id)) {
+        progress.settledTools.add(tool.id);
+        const meta = progress.announcedTools.get(tool.id);
+        events.push({
+          kind: "tool_end",
+          id: tool.id,
+          name: tool.name,
+          label: labelTense(meta.label, "done"),
+          summary: meta.summary,
+          ok: status === "success",
+          result: oneLine(tool.results, 110)
+        });
       }
-      clientSecret = value;
-    } else {
-      clientSecret = await resolveSecret({
-        flagValue: options.clientSecret,
-        fromStdin: options.clientSecretStdin,
-        envVar: oauthCli.envVar,
-        promptMessage: oauthCli.promptMessage,
-        isNonInteractive,
-        name: "client secret",
-        hints: [
-          {
-            message: `Provide via flag:   base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`,
-            command: `base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`
-          },
-          {
-            message: `Provide via stdin:  echo <secret> | base44 auth social-login ${provider} enable --client-id <id> --client-secret-stdin`
-          },
-          {
-            message: `Provide via env:    ${oauthCli.envVar}=<secret> base44 auth social-login ${provider} enable --client-id <id>`
-          }
-        ]
-      });
     }
   }
-  const { project } = await readProjectConfig();
-  const configDir = dirname17(project.configPath);
-  const authDir = join24(configDir, project.authDir);
-  const { config: updated } = await runTask("Updating local auth config", async () => updateSocialLoginConfig(authDir, provider, shouldEnable, useCustomOAuth && options.clientId ? { clientId: options.clientId } : undefined));
-  if (clientSecret) {
-    await runTask("Saving client secret", async () => pushCustomOAuthSecret(provider, clientSecret));
-  }
-  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
-    log.warn(`Disabling ${label} login will leave no login methods enabled. Users will be locked out.`);
-  }
-  const newStatus = shouldEnable ? "enabled" : "disabled";
-  const oauthNote = useCustomOAuth ? " with custom OAuth" : "";
-  let outroMessage = `${label} login ${newStatus}${oauthNote} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`;
-  if (useCustomOAuth && !clientSecret) {
-    outroMessage += `
-Remember to push the client secret separately: base44 secrets set --env-file <path>`;
-  }
-  return { outroMessage };
+  return events;
 }
-function getSocialLoginCommand() {
-  return new Base44Command("social-login").description("Enable or disable social login providers (google, microsoft, facebook, apple)").addArgument(new Argument2("<provider>", "social login provider").choices(VALID_PROVIDER_NAMES)).addArgument(new Argument2("<action>", "enable or disable the provider").choices([
-    "enable",
-    "disable"
-  ])).option("--client-id <id>", "custom OAuth client ID (Google only)").option("--client-secret <secret>", "custom OAuth client secret (Google only)").option("--client-secret-stdin", "read client secret from stdin (Google only)").option("--env-file <path>", "read client secret from a .env file (Google only)").action(socialLoginAction);
+function turnSettled(messages) {
+  return newestUserTurn(messages)?.settled ?? false;
 }
-
-// src/cli/commands/auth/sso.ts
-import { dirname as dirname18, join as join25, resolve as resolve7 } from "node:path";
-var SSOConfigFileSchema = object({
-  provider: _enum(Object.values(KNOWN_SSO_PROVIDERS)),
-  clientId: string2(),
-  clientSecret: string2(),
-  scope: string2().optional(),
-  discoveryUrl: string2().optional(),
-  tenantId: string2().optional(),
-  oktaDomain: string2().optional(),
-  authEndpoint: string2().optional(),
-  tokenEndpoint: string2().optional(),
-  userinfoEndpoint: string2().optional(),
-  jwksUri: string2().optional(),
-  ssoName: string2().optional()
-});
-async function loadSSOConfigFile(filePath) {
-  const resolved = resolve7(filePath);
-  const raw = await readJsonFile(resolved);
-  const result = SSOConfigFileSchema.safeParse(raw);
-  if (!result.success) {
-    throw new SchemaValidationError("Invalid SSO config file", result.error, filePath);
+function newestUserTurn(messages) {
+  for (let i = messages.length - 1;i >= 0; i--) {
+    const message = messages[i];
+    if (message.role === "user" && !message.hidden) {
+      const outcome = message.outcome;
+      const backendStatus = outcome && typeof outcome === "object" ? outcome.backend_status : undefined;
+      return {
+        id: message.id,
+        settled: outcome != null && backendStatus !== "pending",
+        backendStatus
+      };
+    }
   }
-  return result.data;
+  return null;
 }
-function mergeFileWithFlags(fileConfig, options) {
-  return {
-    provider: options.provider ?? fileConfig.provider,
-    clientId: options.clientId ?? fileConfig.clientId,
-    clientSecret: options.clientSecret ?? fileConfig.clientSecret,
-    clientSecretStdin: options.clientSecretStdin,
-    envFile: options.envFile,
-    scope: options.scope ?? fileConfig.scope,
-    discoveryUrl: options.discoveryUrl ?? fileConfig.discoveryUrl,
-    tenantId: options.tenantId ?? fileConfig.tenantId,
-    oktaDomain: options.oktaDomain ?? fileConfig.oktaDomain,
-    authEndpoint: options.authEndpoint ?? fileConfig.authEndpoint,
-    tokenEndpoint: options.tokenEndpoint ?? fileConfig.tokenEndpoint,
-    userinfoEndpoint: options.userinfoEndpoint ?? fileConfig.userinfoEndpoint,
-    jwksUri: options.jwksUri ?? fileConfig.jwksUri,
-    ssoName: options.ssoName ?? fileConfig.ssoName
+var sleep3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function makePoller(onEvent, options) {
+  const state = newStreamState();
+  return async (prime = false) => {
+    try {
+      const messages = await getFullConversation(30, options.branchId);
+      const events = diffConversation(state, messages);
+      if (!prime)
+        for (const event of events)
+          onEvent(event);
+      return messages;
+    } catch {
+      return [];
+    }
   };
 }
-var providerNames = Object.keys(KNOWN_SSO_PROVIDERS);
-var SECRET_KEY_TO_FLAG = {
-  ["sso_name" /* Name */]: "--sso-name",
-  ["sso_client_id" /* ClientId */]: "--client-id",
-  ["sso_client_secret" /* ClientSecret */]: "--client-secret",
-  ["sso_scope" /* Scope */]: "--scope",
-  ["sso_discovery_url" /* DiscoveryUrl */]: "--discovery-url",
-  ["sso_tenant_id" /* TenantId */]: "--tenant-id",
-  ["sso_auth_endpoint" /* AuthEndpoint */]: "--auth-endpoint",
-  ["sso_token_endpoint" /* TokenEndpoint */]: "--token-endpoint",
-  ["sso_userinfo_endpoint" /* UserinfoEndpoint */]: "--userinfo-endpoint",
-  ["sso_okta_domain" /* OktaDomain */]: "--okta-domain",
-  ["sso_jwks_uri" /* JwksUri */]: "--jwks-uri"
-};
-function secretKeyToFlag(key) {
-  return SECRET_KEY_TO_FLAG[key];
-}
-function exampleCommand(provider) {
-  let cmd = `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`;
-  if (provider === KNOWN_SSO_PROVIDERS.microsoft)
-    cmd += " --tenant-id <id>";
-  if (provider === KNOWN_SSO_PROVIDERS.okta)
-    cmd += " --okta-domain <domain>";
-  if (provider === KNOWN_SSO_PROVIDERS.custom)
-    cmd += " --sso-name <name> --auth-endpoint <url> --token-endpoint <url> --userinfo-endpoint <url> --jwks-uri <url>";
-  return cmd;
-}
-function validateProvider(provider) {
-  if (!provider) {
-    throw new InvalidInputError("Missing --provider.", {
-      hints: [
-        {
-          message: `Valid providers: ${providerNames.join(", ")}`,
-          command: "base44 auth sso enable --provider <provider> --client-id <id> --client-secret <secret>"
-        }
-      ]
-    });
+async function streamConversationDuring(start, onEvent, options = {}) {
+  const intervalMs = options.intervalMs ?? 1000;
+  const poll = makePoller(onEvent, options);
+  await poll(true);
+  const work = start();
+  let pending = true;
+  const settled = work.then(() => {
+    pending = false;
+  }, () => {
+    pending = false;
+  });
+  while (pending) {
+    await Promise.race([sleep3(intervalMs), settled]);
+    if (!pending)
+      break;
+    await poll();
   }
-  return provider;
+  await poll();
+  return work;
 }
-async function ssoEnableAction({ isNonInteractive, runTask }, options) {
-  if (options.file && options.envFile) {
-    throw new InvalidInputError("--file and --env-file cannot be used together. Provide the client secret either inside --file or via --env-file.");
+async function streamConversationUntilSettled(onEvent, options = {}) {
+  const intervalMs = options.intervalMs ?? 1000;
+  const deadline = Date.now() + (options.timeoutMs ?? 20 * 60000);
+  const poll = makePoller(onEvent, options);
+  while (Date.now() < deadline) {
+    const messages = await poll();
+    if (messages.length > 0 && turnSettled(messages))
+      return "settled";
+    await sleep3(intervalMs);
   }
-  let merged = options;
-  if (options.file) {
-    const fileConfig = await loadSSOConfigFile(options.file);
-    merged = mergeFileWithFlags(fileConfig, options);
+  return "timeout";
+}
+
+// src/cli/commands/builder/new.ts
+var POLL_TIMEOUT_MS = 20 * 60000;
+var MODES = ["direct", "fork", "copy"];
+async function newAction({ log, runTask, jsonMode }, prompt, options) {
+  if (options.mode && !MODES.includes(options.mode)) {
+    throw new InvalidInputError("--mode must be direct, fork, or copy.");
   }
-  const provider = validateProvider(merged.provider);
-  if (!merged.clientId) {
-    throw new InvalidInputError("Missing --client-id.", {
-      hints: [
-        {
-          message: `Example: base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
-          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
-        }
-      ]
-    });
+  if ((options.mode || options.repoName || options.fromBranch) && !options.import) {
+    throw new InvalidInputError("--mode, --repo-name and --from-branch apply only with --import <repo>.");
   }
-  let clientSecret;
-  if (merged.envFile && !merged.clientSecret) {
-    const secrets = await parseEnvFile(resolve7(merged.envFile));
-    const value = secrets.sso_client_secret;
-    if (!value) {
-      throw new InvalidInputError(`Key "sso_client_secret" not found in ${merged.envFile}.`);
-    }
-    clientSecret = value;
-  } else {
-    clientSecret = await resolveSecret({
-      flagValue: merged.clientSecret,
-      fromStdin: merged.clientSecretStdin,
-      envVar: "sso_client_secret",
-      promptMessage: "Enter SSO client secret",
-      isNonInteractive,
-      name: "client secret",
-      hints: [
-        {
-          message: `Provide via flag:   base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
-          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
-        },
-        {
-          message: `Provide via stdin:  echo <secret> | base44 auth sso enable --provider ${provider} --client-id <id> --client-secret-stdin`
-        },
-        {
-          message: `Provide via env:    sso_client_secret=<secret> base44 auth sso enable --provider ${provider} --client-id <id>`
-        }
-      ]
-    });
+  if (!prompt && !options.import) {
+    throw new InvalidInputError('Describe the app ("<prompt>") or pass --import <repo>.');
   }
-  const secretOptions = {
-    clientId: merged.clientId,
-    clientSecret,
-    scope: merged.scope,
-    discoveryUrl: merged.discoveryUrl,
-    tenantId: merged.tenantId,
-    oktaDomain: merged.oktaDomain,
-    authEndpoint: merged.authEndpoint,
-    tokenEndpoint: merged.tokenEndpoint,
-    userinfoEndpoint: merged.userinfoEndpoint,
-    jwksUri: merged.jwksUri,
-    ssoName: merged.ssoName
-  };
-  let secrets;
+  let app;
   try {
-    secrets = buildSSOSecrets(provider, secretOptions);
+    app = await runTask(options.import ? "Importing the repository" : "Creating your app", () => createAndLinkApp({
+      prompt,
+      name: options.name,
+      importRepo: options.import,
+      mode: options.mode,
+      repoName: options.repoName,
+      fromBranch: options.fromBranch,
+      path: options.path
+    }));
   } catch (error) {
-    if (error instanceof MissingSSOFieldsError) {
-      const flagNames = error.missingKeys.map(secretKeyToFlag);
-      throw new InvalidInputError(`Missing required fields for ${error.provider}: ${flagNames.join(", ")}`, {
-        hints: [
-          {
-            message: `Example: ${exampleCommand(provider)}`,
-            command: exampleCommand(provider)
-          }
-        ]
-      });
-    }
+    for (const line of await githubReauthLines(error) ?? [])
+      log.message(line);
     throw error;
   }
-  const { project } = await readProjectConfig();
-  const configDir = dirname18(project.configPath);
-  const authDir = join25(configDir, project.authDir);
-  await runTask("Updating local auth config", async () => updateSSOConfig(authDir, provider, true));
-  await runTask("Saving SSO credentials", async () => pushSSOSecrets(secrets));
-  return {
-    outroMessage: `SSO configured with ${provider} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
-  };
-}
-function hasEnableOnlyOptions(options) {
-  return Boolean(options.provider || options.clientId || options.clientSecret || options.clientSecretStdin || options.envFile || options.file || options.scope || options.discoveryUrl || options.tenantId || options.oktaDomain || options.authEndpoint || options.tokenEndpoint || options.userinfoEndpoint || options.jwksUri || options.ssoName);
-}
-async function ssoDisableAction({ log, runTask }, options) {
-  if (hasEnableOnlyOptions(options)) {
-    throw new InvalidInputError("Configuration options cannot be used with disable. To disable SSO: base44 auth sso disable");
+  if (!jsonMode) {
+    if (app.repoUrl)
+      log.message(source_default.dim(`repo    ${app.repoUrl}`));
+    log.message(source_default.dim(`editor  ${app.editorUrl}`));
+    log.message(source_default.dim(`linked  ${app.here ? "./  (this directory)" : `./${app.dirName}`}`));
   }
-  const { project } = await readProjectConfig();
-  const configDir = dirname18(project.configPath);
-  const authDir = join25(configDir, project.authDir);
-  const updated = await runTask("Updating local auth config", async () => updateSSOConfig(authDir, null, false));
-  await runTask("Removing SSO credentials", async () => deleteSSOSecrets());
-  if (!hasAnyLoginMethod(updated)) {
-    log.warn("Disabling SSO will leave no login methods enabled. Users will be locked out.");
+  let finalState;
+  let previewUrl;
+  const startedAt = Date.now();
+  if (prompt) {
+    const branchId = await resolveActiveBranchId().catch(() => {
+      return;
+    });
+    const stream = createTurnStream(process.stdout.isTTY === true && !jsonMode, undefined, { idleLabel: "provisioning the sandbox and starting the build" });
+    try {
+      const settled = await streamConversationUntilSettled((event) => {
+        if (!jsonMode)
+          stream.onEvent(event);
+      }, { branchId, timeoutMs: POLL_TIMEOUT_MS });
+      finalState = settled === "timeout" ? "processing" : (await getAppState(app.id)).status?.state ?? "ready";
+      if (finalState === "ready") {
+        previewUrl = await getPreviewUrl().catch(() => {
+          return;
+        });
+      }
+    } finally {
+      stream.stop();
+    }
+  }
+  if (jsonMode) {
+    return {
+      stdout: `${JSON.stringify({
+        id: app.id,
+        repo_url: app.repoUrl ?? null,
+        editor_url: app.editorUrl,
+        preview_url: previewUrl ?? null,
+        dir: app.dirName,
+        path: app.targetDir,
+        status: finalState ?? "created"
+      })}
+`
+    };
+  }
+  if (previewUrl)
+    log.message(`preview ${previewUrl}`);
+  for (const line of nextStepsLines(app))
+    log.message(line);
+  if (finalState === "error") {
+    return {
+      outroMessage: `The first build reported an error — open the editor for details.`
+    };
+  }
+  if (finalState === "processing") {
+    return {
+      outroMessage: `Still building — follow it with \`base44 builder status\`.`
+    };
   }
   return {
-    outroMessage: "SSO disabled in local config and credentials removed. Run `base44 auth push` or `base44 deploy` to apply."
+    outroMessage: prompt ? `First build finished · ${formatDuration2(Date.now() - startedAt)}.` : "App created."
   };
 }
-async function ssoAction(context, action, options) {
-  if (action === "disable") {
-    return ssoDisableAction(context, options);
-  }
-  return ssoEnableAction(context, options);
-}
-function getSSOCommand() {
-  return new Base44Command("sso").description("Configure SSO identity provider (google, microsoft, github, okta, custom). SSO and social login are mutually exclusive — enabling one disables the other in the local auth config.").addArgument(new Argument2("<action>", "enable or disable SSO").choices([
-    "enable",
-    "disable"
-  ])).addOption(new Option2("--provider <provider>", "SSO provider").choices(Object.values(KNOWN_SSO_PROVIDERS))).option("--client-id <id>", "OAuth client ID").option("--client-secret <secret>", "OAuth client secret").option("--client-secret-stdin", "Read client secret from stdin").option("--env-file <path>", "Read client secret from a .env file (key: sso_client_secret)").option("--file <path>", "JSON config file with all SSO settings").option("--scope <scope>", "OAuth scope (defaults per provider)").option("--discovery-url <url>", "OIDC discovery URL").option("--tenant-id <id>", "Microsoft tenant ID (required for microsoft)").option("--okta-domain <domain>", "Okta domain (required for okta)").option("--auth-endpoint <url>", "Authorization endpoint (required for custom)").option("--token-endpoint <url>", "Token endpoint (required for custom)").option("--userinfo-endpoint <url>", "Userinfo endpoint (required for custom)").option("--jwks-uri <url>", "JWKS URI (required for custom)").option("--sso-name <name>", "Provider display name (required for custom)").action(ssoAction);
-}
-
-// src/cli/commands/auth/index.ts
-function getAuthCommand() {
-  return new Command2("auth").description("Manage app authentication settings").addCommand(getPasswordLoginCommand()).addCommand(getSocialLoginCommand()).addCommand(getSSOCommand()).addCommand(getAuthPullCommand()).addCommand(getAuthPushCommand());
+function getNewCommand() {
+  const command = new Base44Command("new", { requireAppContext: false });
+  command.description("Create an app and start building: from a prompt (the Base44 template), or over an existing GitHub repo with --import").argument("[prompt]", "What to build; the first agent turn starts immediately").option("--import <repo>", "Build over an existing GitHub repository instead of the template").option("--mode <mode>", "How to import: direct, fork, or copy (default: direct)").option("--name <name>", "Directory and app name (invented when omitted)").option("--path <dir>", "Directory to link (default: the current directory when empty, else ./<name>)").option("--repo-name <name>", "Name for the new GitHub repo when forking/copying").option("--from-branch <name>", "Import a specific branch of the repo").action(newAction);
+  return command;
 }
 
-// src/cli/commands/auth/login.ts
-function getLoginCommand() {
-  return new Base44Command("login", {
-    requireAuth: false,
-    requireAppContext: false
-  }).description("Authenticate with Base44").action(login);
+// src/cli/commands/builder/send.ts
+function lastAssistantReply(turn) {
+  const messages = turn.conversation?.messages ?? [];
+  for (let i = messages.length - 1;i >= 0; i--) {
+    const { role, content } = messages[i];
+    if (role === "assistant" && typeof content === "string" && content.trim()) {
+      return content.trim();
+    }
+  }
+  return;
 }
-
-// src/cli/commands/auth/logout.ts
-async function logout(_ctx) {
-  await deleteAuth();
-  return { outroMessage: "Logged out successfully" };
+async function sendAction(ctx, message) {
+  if (ctx.app)
+    await assertBuilderApp(ctx.app.id);
+  const branchId = await resolveBranchId(ctx);
+  if (ctx.jsonMode) {
+    const turn = await ctx.runTask("Agent working (a turn can take minutes)", () => sendTurn(message, branchId));
+    if (turn.queued)
+      return { stdout: `${JSON.stringify({ queued: true })}
+` };
+    return {
+      stdout: `${JSON.stringify({
+        status: turn.status?.state ?? "ready",
+        error_source: turn.status?.error_source ?? null,
+        reply: lastAssistantReply(turn) ?? null
+      })}
+`
+    };
+  }
+  const stream = createTurnStream(process.stdout.isTTY === true);
+  let turn;
+  try {
+    turn = await streamConversationDuring(() => sendTurn(message, branchId), stream.onEvent, { branchId });
+  } finally {
+    stream.stop();
+  }
+  if (turn.queued) {
+    return {
+      outroMessage: "The agent is busy with an earlier message — yours was queued and runs next."
+    };
+  }
+  if (turn.status?.state === "error") {
+    return {
+      outroMessage: `Turn failed (${turn.status.error_source ?? "unknown"}) — see the editor for details.`
+    };
+  }
+  return { outroMessage: "Turn finished." };
 }
-function getLogoutCommand() {
-  return new Base44Command("logout", {
-    requireAuth: false,
-    requireAppContext: false
-  }).description("Logout from current device").action(logout);
+function getSendCommand() {
+  const command = new Base44Command("send", { supportsBranch: true });
+  command.description("Send the agent one message and stream the turn until it finishes").argument("<message>", "What you want the agent to do").action(sendAction);
+  return command;
 }
 
-// src/cli/commands/auth/whoami.ts
-async function whoami(_ctx) {
-  const workspaceApiKey = getWorkspaceApiKeyFromEnv();
-  if (workspaceApiKey && isWorkspaceApiKey(workspaceApiKey)) {
+// src/cli/commands/builder/status.ts
+async function statusAction(ctx) {
+  const id = ctx.app?.id;
+  const app = await ctx.runTask("Reading app status", () => getAppState(id));
+  const state = app.status?.state ?? "ready";
+  if (ctx.jsonMode) {
     return {
-      outroMessage: `Using workspace API key: ${theme.styles.bold(workspaceApiKey.slice(0, 10))}`
+      stdout: `${JSON.stringify({ id: app.id, state, message: app.status?.message ?? null })}
+`
     };
   }
-  const auth = await readAuth();
-  return { outroMessage: `Logged in as: ${theme.styles.bold(auth.email)}` };
+  ctx.log.message(`State:  ${state}`);
+  if (app.status?.message)
+    ctx.log.message(`Note:   ${app.status.message}`);
+  return { outroMessage: "Status read." };
 }
-function getWhoamiCommand() {
-  return new Base44Command("whoami", { requireAppContext: false }).description("Display current authenticated user").action(whoami);
+function getStatusCommand() {
+  const command = new Base44Command("status");
+  command.description("Show whether the app is building, ready, or errored").action(statusAction);
+  return command;
 }
 
-// src/cli/commands/branches/index.ts
-async function listBranchesAction({
-  log,
-  runTask,
-  jsonMode
-}) {
-  const remote = await runTask("Fetching branches", () => listBranches());
-  const branches = [
-    { name: "main", status: "active" },
-    ...remote.map((branch) => ({
-      name: branch.branch_name,
-      status: branch.status
-    }))
-  ];
-  if (jsonMode)
-    return { stdout: `${JSON.stringify({ branches })}
+// src/cli/commands/builder/stop.ts
+async function stopAction(ctx) {
+  const branchId = await resolveBranchId(ctx);
+  await ctx.runTask("Stopping the running turn", () => stopTurn(branchId));
+  if (ctx.jsonMode)
+    return { stdout: `${JSON.stringify({ stopped: true })}
 ` };
-  for (const branch of branches)
-    log.message(`${branch.name} (${branch.status})`);
-  return { outroMessage: `${branches.length} branches` };
+  return { outroMessage: "Stopped." };
 }
-function getBranchesCommand() {
-  return new Command2("branches").description("Discover an app's branches").addCommand(new Base44Command("list").description("List main and active branch names for use with --branch").action(listBranchesAction));
+function getStopCommand() {
+  const command = new Base44Command("stop", { supportsBranch: true });
+  command.description("Stop the agent's running turn").action(stopAction);
+  return command;
+}
+
+// src/cli/commands/builder/index.ts
+function getBuilderCommand() {
+  return new Command2("builder").description("Build an app with the Base44 builder agent, non-interactively: create it, send turns, read status, stop, pick the model").addCommand(getNewCommand()).addCommand(getSendCommand()).addCommand(getStatusCommand()).addCommand(getStopCommand()).addCommand(getModelCommand());
 }
 
 // ../../node_modules/ink/build/render.js
@@ -276578,19 +276629,21 @@ async function runGenesisSession(options) {
 
 // src/cli/commands/code/index.ts
 var BRAND_ORANGE2 = "#E86B3C";
-async function bootstrapApp(prompt, footer, emit, importRepo) {
+async function bootstrapApp(prompt, footer, emit, onCreated, importRepo, path) {
   let app;
   try {
-    app = await createAndLinkApp({ prompt, importRepo });
+    app = await createAndLinkApp({ prompt, importRepo, path });
   } catch (error) {
     for (const line of await githubReauthLines(error) ?? [])
       emit(line);
     throw error;
   }
+  onCreated(app);
+  footer.push(source_default.dim(`dir ${app.here ? "./" : `./${app.dirName}`}`));
   if (app.repoUrl)
     footer.push(terminalLink("repo", app.repoUrl));
   footer.push(terminalLink("editor", app.editorUrl));
-  emit(source_default.dim(`linked  ./${app.dirName}  (cd ${app.dirName} after the session)`));
+  emit(source_default.dim(app.here ? "linked  ./  (this directory)" : `linked  ./${app.dirName}  (cd ${app.dirName} after the session)`));
   const branchId = await resolveActiveBranchId().catch(() => {
     return;
   });
@@ -276614,46 +276667,64 @@ async function bootstrapApp(prompt, footer, emit, importRepo) {
     }
   };
 }
-async function codeAction(_ctx, options) {
+async function codeAction({ log }, options, appId) {
+  const orange = source_default.hex(BRAND_ORANGE2);
+  const chip = (label) => source_default.dim(`${orange("●")} ${label}`);
   if (process.stdout.isTTY !== true) {
     throw new InvalidInputError("base44 code is an interactive session and needs a terminal.");
   }
   let linked = false;
   try {
-    await initAppContext();
+    await initAppContext(appId ? { appId } : {});
     linked = true;
   } catch {}
   if (linked) {
-    if (options.import) {
-      throw new InvalidInputError("--import creates a new app; run it outside a linked project.");
+    if (options.import || options.path) {
+      throw new InvalidInputError("--import and --path create a new app; run them outside a linked project, without --app-id.");
     }
+    const { id, projectRoot } = getAppContext();
+    const state = await assertBuilderApp(id);
     const branchId = await resolveActiveBranchId().catch(() => {
       return;
     });
     await runInteractiveSession({
       branchId,
-      footer: [],
+      footer: [chip(appTypeChip(state))],
       primeFirstPoll: true,
       idleHint: "what should the agent do next?"
     });
-    return { outroMessage: "Done." };
+    if (projectRoot) {
+      log.message(source_default.dim(`app dir  ${projectRoot}`));
+      return {
+        outroMessage: "Session closed. Run `base44 code` here to resume."
+      };
+    }
+    return {
+      outroMessage: `Session closed. Resume with \`base44 code --app-id ${id}\`.`
+    };
   }
-  const orange = source_default.hex(BRAND_ORANGE2);
-  const footer = [
-    source_default.dim(`${orange("●")} ${options.import ? "import" : "builder"}`)
-  ];
+  let created;
+  const footer = [chip(options.import ? repoLabel(options.import) : "web app")];
   await runGenesisSession({
-    idleHint: options.import ? "describe what to build over the repo" : "describe the app you want to build",
+    idleHint: options.import ? "describe what to build over the repository" : "describe the app you want to build  ·  have one already? base44 code --app-id <id>, or base44 link",
     creatingLabel: options.import ? "importing the repository" : "creating your app",
-    modeLabel: options.import ? `Import — ${options.import}` : "Builder — Base44 template + agent",
+    modeLabel: options.import ? `Repository — ${repoLabel(options.import)}` : "Web app — Base44 template + builder agent",
     footer,
-    createApp: (prompt, emit) => bootstrapApp(prompt, footer, emit, options.import)
+    createApp: (prompt, emit) => bootstrapApp(prompt, footer, emit, (app) => {
+      created = app;
+    }, options.import, options.path)
   });
-  return { outroMessage: "Done." };
+  if (!created) {
+    return { outroMessage: "Session closed. No app was created." };
+  }
+  for (const line of nextStepsLines(created))
+    log.message(line);
+  log.message(source_default.dim(`  editor  ${created.editorUrl}`));
+  return { outroMessage: "Session closed." };
 }
 function getCodeCommand() {
   const command = new Base44Command("code", { requireAppContext: false });
-  command.description("Open Base44 Code: an interactive agent session — in an empty directory your first prompt creates the app (add --import <repo> to build over an existing repository)").option("--import <repo>", "Build over an existing GitHub repository instead of the Base44 template").action(codeAction);
+  command.description("Open Base44 Code, an interactive builder session. In a linked directory (or with --app-id <id>) it opens that app; anywhere else your first prompt creates one (--import <repo> to build over your own repository). Attach a directory to an existing app with base44 link.").option("--import <repo>", "Build over an existing GitHub repository instead of the Base44 template").option("--path <dir>", "Directory to link the new app to (default: the current directory when empty, else ./<name>)").action((ctx, options) => codeAction(ctx, options, command.optsWithGlobals().appId));
   return command;
 }
 
@@ -277451,10 +277522,10 @@ function getConnectorsListAvailableCommand() {
 }
 
 // src/cli/commands/connectors/pull.ts
-import { dirname as dirname19, join as join27, resolve as resolve8 } from "node:path";
+import { dirname as dirname19, join as join27, resolve as resolve9 } from "node:path";
 async function resolveConnectorsDir(options) {
   if (!getAppContext().projectRoot) {
-    return resolve8(options.dir ?? "connectors");
+    return resolve9(options.dir ?? "connectors");
   }
   const { project } = await readProjectConfig();
   return join27(dirname19(project.configPath), project.connectorsDir);
@@ -277498,10 +277569,10 @@ function getConnectorsPullCommand() {
 }
 
 // src/cli/commands/connectors/push.ts
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 async function readConnectorsToPush(options) {
   if (!getAppContext().projectRoot) {
-    return readAllConnectors(resolve9(options.dir ?? "connectors"));
+    return readAllConnectors(resolve10(options.dir ?? "connectors"));
   }
   const { connectors } = await readProjectConfig();
   return connectors;
@@ -277970,7 +278041,7 @@ function getBuildCommand() {
 }
 
 // src/cli/commands/project/create.ts
-import { basename as basename6, resolve as resolve10 } from "node:path";
+import { basename as basename7, resolve as resolve11 } from "node:path";
 var import_kebabCase2 = __toESM(require_kebabCase(), 1);
 
 // src/cli/commands/project/scaffold-shared.ts
@@ -278135,8 +278206,8 @@ async function createInteractive(options, ctx) {
     name: () => {
       return options.name ? Promise.resolve(options.name) : Ze({
         message: "What is the name of your project?",
-        placeholder: basename6(process.cwd()),
-        initialValue: basename6(process.cwd()),
+        placeholder: basename7(process.cwd()),
+        initialValue: basename7(process.cwd()),
         validate: (value) => {
           if (!value || value.trim().length === 0) {
             return "Every project deserves a name";
@@ -278166,7 +278237,7 @@ async function createInteractive(options, ctx) {
   }, ctx);
 }
 async function createNonInteractive(options, ctx) {
-  ctx.log.info(`Creating a new project at ${resolve10(options.path)}`);
+  ctx.log.info(`Creating a new project at ${resolve11(options.path)}`);
   const template = await getTemplateById(options.template ?? DEFAULT_TEMPLATE_ID);
   return await executeCreate({
     template,
@@ -278190,7 +278261,7 @@ async function executeCreate({
 }, ctx) {
   const { log, runTask } = ctx;
   const name = rawName.trim();
-  const resolvedPath = resolve10(projectPath);
+  const resolvedPath = resolve11(projectPath);
   const organizationId = await resolveWorkspaceId(ctx, flagWorkspaceId, isInteractive);
   const { projectId } = await runTask("Setting up your project...", async () => {
     return await createProjectFiles({
@@ -278831,7 +278902,7 @@ function getLogsCommand() {
 }
 
 // src/cli/commands/project/scaffold.ts
-import { basename as basename7, resolve as resolve11 } from "node:path";
+import { basename as basename8, resolve as resolve12 } from "node:path";
 function resolveAppId(options) {
   const appId = options.appId;
   if (!appId) {
@@ -278847,8 +278918,8 @@ function resolveAppId(options) {
 async function scaffoldAction(ctx, name, options, command) {
   const { log, runTask } = ctx;
   const appId = resolveAppId(command.optsWithGlobals());
-  const resolvedPath = resolve11("./");
-  const projectName = (name ?? basename7(resolvedPath)).trim();
+  const resolvedPath = resolve12("./");
+  const projectName = (name ?? basename8(resolvedPath)).trim();
   const template = await getTemplateById("backend-only");
   log.info(`Scaffolding project at ${resolvedPath}`);
   const { projectId } = await runTask("Setting up your project...", async () => {
@@ -279165,6 +279236,21 @@ function getSandboxListDirectoryCommand() {
   return new Base44Command("ls", { supportsBranch: true }).description("List directory entries in an app's remote sandbox").argument("[path]", "Directory relative to the app root (default: app root)").option("--recursive", "List nested entries").option("--max-depth <n>", "Max depth when recursive (1-10, default 3)").option("--include-hidden", "Include dotfiles").action(listDirectoryAction);
 }
 
+// src/cli/commands/sandbox/preview.ts
+async function previewAction(ctx) {
+  const url = await ctx.runTask("Resolving preview URL (boots the sandbox if needed)", () => getPreviewUrl());
+  if (ctx.jsonMode)
+    return { stdout: `${JSON.stringify({ preview_url: url })}
+` };
+  ctx.log.message(url);
+  return { outroMessage: "Preview is live." };
+}
+function getSandboxPreviewCommand() {
+  const command = new Base44Command("preview");
+  command.description("Print the app's live preview URL").action(previewAction);
+  return command;
+}
+
 // src/cli/commands/sandbox/read-file.ts
 async function readFileAction({ runTask, branchId }, paths, options) {
   const { id: appId } = getAppContext();
@@ -279218,7 +279304,7 @@ Examples:
 
 // src/cli/commands/sandbox/index.ts
 function getSandboxCommand() {
-  return new Command2("sandbox").description("Develop an app remotely via its server-side sandbox").addCommand(getSandboxListDirectoryCommand()).addCommand(getSandboxReadFileCommand()).addCommand(getSandboxWriteFileCommand()).addCommand(getSandboxEditFileCommand()).addCommand(getSandboxGrepCommand()).addCommand(getSandboxRunCommandCommand()).addCommand(getSandboxCheckpointCommand());
+  return new Command2("sandbox").description("Develop an app remotely via its server-side sandbox").addCommand(getSandboxListDirectoryCommand()).addCommand(getSandboxReadFileCommand()).addCommand(getSandboxWriteFileCommand()).addCommand(getSandboxEditFileCommand()).addCommand(getSandboxGrepCommand()).addCommand(getSandboxRunCommandCommand()).addCommand(getSandboxCheckpointCommand()).addCommand(getSandboxPreviewCommand());
 }
 
 // src/cli/commands/secrets/delete.ts
@@ -279264,7 +279350,7 @@ function getSecretsListCommand() {
 }
 
 // src/cli/commands/secrets/set.ts
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 function parseEntries(entries) {
   const secrets = {};
   for (const entry of entries) {
@@ -279295,7 +279381,7 @@ async function setSecretsAction({ log, runTask }, entries, options) {
   validateInput(entries, options);
   let secrets;
   if (options.envFile) {
-    secrets = await parseEnvFile(resolve12(options.envFile));
+    secrets = await parseEnvFile(resolve13(options.envFile));
     if (Object.keys(secrets).length === 0) {
       throw new InvalidInputError("The env file contains no valid KEY=VALUE entries.");
     }
@@ -279324,7 +279410,7 @@ function getSecretsCommand() {
 }
 
 // src/cli/commands/site/deploy.ts
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 async function deployAction2(ctx, options) {
   const { isNonInteractive } = ctx;
   if (isNonInteractive && !options.yes) {
@@ -279402,7 +279488,7 @@ async function deployTarball({ runTask }, project) {
 }
 function siteOutputDir(project) {
   const outputDirectory = project.site?.outputDirectory;
-  return outputDirectory ? resolve13(project.root, outputDirectory) : null;
+  return outputDirectory ? resolve14(project.root, outputDirectory) : null;
 }
 function getSiteDeployCommand() {
   const command = new Base44Command("deploy").description("Deploy built site files to Base44 hosting").option("-y, --yes", "Skip confirmation prompt").option("--build", "Build the site before deploying (skips the prompt)").option("--no-build", "Deploy without building (skips the prompt)");
@@ -281904,7 +281990,7 @@ function createCustomIntegrationRoutes(remoteProxy, logger) {
 
 // src/cli/dev/dev-server/watcher.ts
 import { EventEmitter as EventEmitter6 } from "node:events";
-import { relative as relative9 } from "node:path";
+import { relative as relative10 } from "node:path";
 
 // ../../node_modules/chokidar/index.js
 import { EventEmitter as EventEmitter5 } from "node:events";
@@ -283589,7 +283675,7 @@ class WatchBase44 extends EventEmitter6 {
       ignoreInitial: true
     });
     watcher.on("all", import_debounce4.default(async (_event, path) => {
-      this.emit("change", name, relative9(targetPath, path));
+      this.emit("change", name, relative10(targetPath, path));
     }, WATCH_DEBOUNCE_MS));
     watcher.on("error", (err) => {
       this.logger.error(`Watch handler failed for ${targetPath}`, err);
@@ -284099,7 +284185,7 @@ Examples:
 }
 
 // src/cli/commands/project/eject.ts
-import { resolve as resolve17 } from "node:path";
+import { resolve as resolve18 } from "node:path";
 var import_kebabCase3 = __toESM(require_kebabCase(), 1);
 async function eject(ctx, options, command) {
   const { log, runTask, isNonInteractive } = ctx;
@@ -284163,7 +284249,7 @@ async function eject(ctx, options, command) {
     Ne("Operation cancelled.");
     throw new CLIExitError(0);
   }
-  const resolvedPath = resolve17(selectedPath);
+  const resolvedPath = resolve18(selectedPath);
   await runTask("Downloading your project's code...", async (updateMessage) => {
     await createProjectFilesForExistingProject({
       projectId,
@@ -284245,7 +284331,7 @@ function createProgram(context) {
   program.addCommand(getSecretsCommand());
   program.addCommand(getSandboxCommand());
   program.addCommand(getBranchesCommand());
-  program.addCommand(getAppCommand());
+  program.addCommand(getBuilderCommand());
   program.addCommand(getCodeCommand());
   program.addCommand(getAuthCommand());
   program.addCommand(getSiteCommand());
@@ -288300,4 +288386,4 @@ export {
   runCLI
 };
 
-//# debugId=0D8DC4BF0CB9F93A64756E2164756E21
+//# debugId=DDB3983E5E326EC264756E2164756E21