@base44-preview/cli 0.1.15-pr.630.a207c26 → 0.1.15-pr.630.c53fe4d

package/dist/cli/index.js

@@ -52822,7 +52822,7 @@ function canBreakFn(doc) {
 function canBreak(doc) {
   return findInDoc(doc, canBreakFn, false);
 }
-function indent(contents) {
+function indent2(contents) {
   assertDoc(contents);
   return { type: DOC_TYPE_INDENT, contents };
 }
@@ -52845,7 +52845,7 @@ function addAlignmentToDoc(doc, size, tabWidth) {
   let aligned = doc;
   if (size > 0) {
     for (let level = 0;level < Math.floor(size / tabWidth); ++level) {
-      aligned = indent(aligned);
+      aligned = indent2(aligned);
     }
     aligned = align(size % tabWidth, aligned);
     aligned = align(Number.NEGATIVE_INFINITY, aligned);
@@ -53179,7 +53179,7 @@ function printDocToString(doc, options) {
   propagateBreaks(doc);
   while (commands.length > 0) {
     const {
-      indent: indent2,
+      indent: indent22,
       mode,
       doc: doc2
     } = commands.pop();
@@ -53199,7 +53199,7 @@ function printDocToString(doc, options) {
       case DOC_TYPE_ARRAY:
         for (let index = doc2.length - 1;index >= 0; index--) {
           commands.push({
-            indent: indent2,
+            indent: indent22,
             mode,
             doc: doc2[index]
           });
@@ -53213,14 +53213,14 @@ function printDocToString(doc, options) {
         break;
       case DOC_TYPE_INDENT:
         commands.push({
-          indent: makeIndent(indent2, options),
+          indent: makeIndent(indent22, options),
           mode,
           doc: doc2.contents
         });
         break;
       case DOC_TYPE_ALIGN:
         commands.push({
-          indent: makeAlign(indent2, doc2.n, options),
+          indent: makeAlign(indent22, doc2.n, options),
           mode,
           doc: doc2.contents
         });
@@ -53233,7 +53233,7 @@ function printDocToString(doc, options) {
           case MODE_FLAT:
             if (!shouldRemeasure) {
               commands.push({
-                indent: indent2,
+                indent: indent22,
                 mode: doc2.break ? MODE_BREAK : MODE_FLAT,
                 doc: doc2.contents
               });
@@ -53242,7 +53242,7 @@ function printDocToString(doc, options) {
           case MODE_BREAK: {
             shouldRemeasure = false;
             const next = {
-              indent: indent2,
+              indent: indent22,
               mode: MODE_FLAT,
               doc: doc2.contents
             };
@@ -53255,7 +53255,7 @@ function printDocToString(doc, options) {
                 const mostExpanded = method_at_default(0, doc2.expandedStates, -1);
                 if (doc2.break) {
                   commands.push({
-                    indent: indent2,
+                    indent: indent22,
                     mode: MODE_BREAK,
                     doc: mostExpanded
                   });
@@ -53264,7 +53264,7 @@ function printDocToString(doc, options) {
                   for (let index = 1;index < doc2.expandedStates.length + 1; index++) {
                     if (index >= doc2.expandedStates.length) {
                       commands.push({
-                        indent: indent2,
+                        indent: indent22,
                         mode: MODE_BREAK,
                         doc: mostExpanded
                       });
@@ -53272,7 +53272,7 @@ function printDocToString(doc, options) {
                     } else {
                       const state = doc2.expandedStates[index];
                       const cmd = {
-                        indent: indent2,
+                        indent: indent22,
                         mode: MODE_FLAT,
                         doc: state
                       };
@@ -53285,7 +53285,7 @@ function printDocToString(doc, options) {
                 }
               } else {
                 commands.push({
-                  indent: indent2,
+                  indent: indent22,
                   mode: MODE_BREAK,
                   doc: doc2.contents
                 });
@@ -53311,12 +53311,12 @@ function printDocToString(doc, options) {
         const content = parts[offset + 0];
         const whitespace = parts[offset + 1];
         const contentFlatCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_FLAT,
           doc: content
         };
         const contentBreakCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_BREAK,
           doc: content
         };
@@ -53330,12 +53330,12 @@ function printDocToString(doc, options) {
           break;
         }
         const whitespaceFlatCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_FLAT,
           doc: whitespace
         };
         const whitespaceBreakCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_BREAK,
           doc: whitespace
         };
@@ -53349,7 +53349,7 @@ function printDocToString(doc, options) {
         }
         const secondContent = parts[offset + 2];
         const remainingCommand = {
-          indent: indent2,
+          indent: indent22,
           mode,
           doc: {
             ...doc2,
@@ -53357,7 +53357,7 @@ function printDocToString(doc, options) {
           }
         };
         const firstAndSecondContentFlatCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_FLAT,
           doc: [content, whitespace, secondContent]
         };
@@ -53376,20 +53376,20 @@ function printDocToString(doc, options) {
       case DOC_TYPE_INDENT_IF_BREAK: {
         const groupMode = doc2.groupId ? groupModeMap[doc2.groupId] : mode;
         if (groupMode === MODE_BREAK) {
-          const breakContents = doc2.type === DOC_TYPE_IF_BREAK ? doc2.breakContents : doc2.negate ? doc2.contents : indent(doc2.contents);
+          const breakContents = doc2.type === DOC_TYPE_IF_BREAK ? doc2.breakContents : doc2.negate ? doc2.contents : indent2(doc2.contents);
           if (breakContents) {
             commands.push({
-              indent: indent2,
+              indent: indent22,
               mode,
               doc: breakContents
             });
           }
         }
         if (groupMode === MODE_FLAT) {
-          const flatContents = doc2.type === DOC_TYPE_IF_BREAK ? doc2.flatContents : doc2.negate ? indent(doc2.contents) : doc2.contents;
+          const flatContents = doc2.type === DOC_TYPE_IF_BREAK ? doc2.flatContents : doc2.negate ? indent2(doc2.contents) : doc2.contents;
           if (flatContents) {
             commands.push({
-              indent: indent2,
+              indent: indent22,
               mode,
               doc: flatContents
             });
@@ -53399,7 +53399,7 @@ function printDocToString(doc, options) {
       }
       case DOC_TYPE_LINE_SUFFIX:
         lineSuffix2.push({
-          indent: indent2,
+          indent: indent22,
           mode,
           doc: doc2.contents
         });
@@ -53407,7 +53407,7 @@ function printDocToString(doc, options) {
       case DOC_TYPE_LINE_SUFFIX_BOUNDARY:
         if (lineSuffix2.length > 0) {
           commands.push({
-            indent: indent2,
+            indent: indent22,
             mode,
             doc: hardlineWithoutBreakParent
           });
@@ -53428,7 +53428,7 @@ function printDocToString(doc, options) {
           case MODE_BREAK:
             if (lineSuffix2.length > 0) {
               commands.push({
-                indent: indent2,
+                indent: indent22,
                 mode,
                 doc: doc2
               }, ...lineSuffix2.reverse());
@@ -53438,23 +53438,23 @@ function printDocToString(doc, options) {
             if (doc2.literal) {
               output += newLine;
               position = 0;
-              if (indent2.root) {
-                if (indent2.root.value) {
-                  output += indent2.root.value;
+              if (indent22.root) {
+                if (indent22.root.value) {
+                  output += indent22.root.value;
                 }
-                position = indent2.root.length;
+                position = indent22.root.length;
               }
             } else {
               trim2();
-              output += newLine + indent2.value;
-              position = indent2.length;
+              output += newLine + indent22.value;
+              position = indent22.length;
             }
             break;
         }
         break;
       case DOC_TYPE_LABEL:
         commands.push({
-          indent: indent2,
+          indent: indent22,
           mode,
           doc: doc2.contents
         });
@@ -53616,7 +53616,7 @@ var init_doc = __esm(() => {
     breakParent,
     ifBreak,
     trim: trim2,
-    indent,
+    indent: indent2,
     indentIfBreak,
     align,
     addAlignmentToDoc,
@@ -140754,7 +140754,7 @@ import { pathToFileURL as pathToFileURL5 } from "url";
 import path122 from "path";
 import path142 from "path";
 import url22 from "url";
-function diffLines(oldStr, newStr, options8) {
+function diffLines2(oldStr, newStr, options8) {
   return lineDiff.diff(oldStr, newStr, options8);
 }
 function tokenize4(value, options8) {
@@ -140796,10 +140796,10 @@ function structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, ne
     throw new Error("newlineIsToken may not be used with patch-generation functions, only with diffing functions");
   }
   if (!optionsObj.callback) {
-    return diffLinesResultToPatch(diffLines(oldStr, newStr, optionsObj));
+    return diffLinesResultToPatch(diffLines2(oldStr, newStr, optionsObj));
   } else {
     const { callback } = optionsObj;
-    diffLines(oldStr, newStr, Object.assign(Object.assign({}, optionsObj), { callback: (diff) => {
+    diffLines2(oldStr, newStr, Object.assign(Object.assign({}, optionsObj), { callback: (diff) => {
       const patch = diffLinesResultToPatch(diff);
       callback(patch);
     } }));
@@ -146441,7 +146441,7 @@ var require2, __filename2, __dirname3, __create2, __defProp3, __getOwnPropDesc2,
     }
   }
 }, ast_path_default, is_object_default, skipWhitespace, skipSpaces, skipToLineEnd, skipEverythingButNewLine, isNewlineCharacter = (character) => character === `
-` || character === "\r" || character === "\u2028" || character === "\u2029", skip_newline_default, has_newline_default, is_non_empty_array_default, get_sorted_child_nodes_default, childNodesCache, returnFalse = () => false, isAllEmptyAndNoLineBreak = (text) => !/[\S\n\u2028\u2029]/u.test(text), is_previous_line_empty_default, breakParent2, hardline2, indent2, join32, line22, lineSuffix2, create_print_pre_check_function_default = () => noop_default2, core_options_evaluate_default, arrayToReversed, toReversed, method_to_reversed_default, import_n_readlines, get_interpreter_default, getFileBasename = (file) => {
+` || character === "\r" || character === "\u2028" || character === "\u2029", skip_newline_default, has_newline_default, is_non_empty_array_default, get_sorted_child_nodes_default, childNodesCache, returnFalse = () => false, isAllEmptyAndNoLineBreak = (text) => !/[\S\n\u2028\u2029]/u.test(text), is_previous_line_empty_default, breakParent2, hardline2, indent3, join32, line22, lineSuffix2, create_print_pre_check_function_default = () => noop_default2, core_options_evaluate_default, arrayToReversed, toReversed, method_to_reversed_default, import_n_readlines, get_interpreter_default, getFileBasename = (file) => {
   try {
     return path112.basename(toPath4(file));
   } catch {
@@ -156469,7 +156469,7 @@ ${codeblock}`, options8);
   ({
     breakParent: breakParent2,
     hardline: hardline2,
-    indent: indent2,
+    indent: indent3,
     join: join32,
     line: line22,
     lineSuffix: lineSuffix2
@@ -269450,6 +269450,467 @@ function getAgentsCommand() {
   return new Command2("agents").description("Manage project agents").addCommand(getAgentsPushCommand()).addCommand(getAgentsPullCommand());
 }
 
+// src/cli/commands/auth/password-login.ts
+import { dirname as dirname15, join as join21 } from "node:path";
+async function passwordLoginAction({ log, runTask }, action) {
+  const shouldEnable = action === "enable";
+  const { project } = await readProjectConfig();
+  const configDir = dirname15(project.configPath);
+  const authDir = join21(configDir, project.authDir);
+  const updated = await runTask("Updating local auth config", async () => {
+    const current = await readAuthConfig(authDir) ?? DEFAULT_AUTH_CONFIG;
+    const merged = { ...current, enableUsernamePassword: shouldEnable };
+    await writeAuthConfig(authDir, merged);
+    return merged;
+  });
+  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
+    log.warn("Disabling password auth will leave no login methods enabled. Users will be locked out.");
+  }
+  const newStatus = shouldEnable ? "enabled" : "disabled";
+  return {
+    outroMessage: `Username & password authentication ${newStatus} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
+  };
+}
+function getPasswordLoginCommand() {
+  return new Base44Command("password-login").description("Enable or disable username & password authentication").addArgument(new Argument2("<action>", "enable or disable password authentication").choices(["enable", "disable"])).action(passwordLoginAction);
+}
+
+// src/cli/commands/auth/pull.ts
+import { dirname as dirname16, join as join22 } from "node:path";
+async function pullAuthAction({
+  log,
+  runTask
+}) {
+  const { project } = await readProjectConfig();
+  const configDir = dirname16(project.configPath);
+  const authDir = join22(configDir, project.authDir);
+  const remoteConfig = await runTask("Fetching auth config from Base44", async () => {
+    return await pullAuthConfig();
+  }, {
+    successMessage: "Auth config fetched successfully",
+    errorMessage: "Failed to fetch auth config"
+  });
+  const { written } = await runTask("Syncing auth config file", async () => {
+    return await writeAuthConfig(authDir, remoteConfig);
+  }, {
+    successMessage: "Auth config file synced successfully",
+    errorMessage: "Failed to sync auth config file"
+  });
+  if (written) {
+    log.success("Auth config written to local file");
+  } else {
+    log.info("Auth config is already up to date");
+  }
+  return {
+    outroMessage: `Pulled auth config to ${authDir} (overwrites local file)`
+  };
+}
+function getAuthPullCommand() {
+  return new Base44Command("pull").description("Pull auth config from Base44 to local file").action(pullAuthAction);
+}
+
+// src/cli/commands/auth/push.ts
+async function pushAuthAction({ isNonInteractive, log, runTask }, options) {
+  const { authConfig } = await readProjectConfig();
+  if (authConfig.length === 0) {
+    log.info("No local auth config found");
+    return {
+      outroMessage: "No auth config to push. Run `base44 auth pull` to fetch the remote config first."
+    };
+  }
+  if (!hasAnyLoginMethod(authConfig[0])) {
+    log.warn("This config has no login methods enabled. Pushing it will lock out all users.");
+  }
+  if (!options.yes) {
+    if (isNonInteractive) {
+      throw new InvalidInputError("--yes is required in non-interactive mode");
+    }
+    const shouldPush = await Re({
+      message: "Push auth config to Base44?"
+    });
+    if (Ct(shouldPush) || !shouldPush) {
+      return { outroMessage: "Push cancelled" };
+    }
+  }
+  await runTask("Pushing auth config to Base44", async () => {
+    return await pushAuthConfig(authConfig[0] ?? null);
+  }, {
+    successMessage: "Auth config pushed successfully",
+    errorMessage: "Failed to push auth config"
+  });
+  return {
+    outroMessage: "Auth config pushed to Base44"
+  };
+}
+function getAuthPushCommand() {
+  return new Base44Command("push").description("Push local auth config to Base44").option("-y, --yes", "Skip confirmation prompt").action(pushAuthAction);
+}
+
+// src/cli/commands/auth/social-login.ts
+import { dirname as dirname17, join as join23, resolve as resolve6 } from "node:path";
+var PROVIDER_LABELS = {
+  google: "Google",
+  microsoft: "Microsoft",
+  facebook: "Facebook",
+  apple: "Apple"
+};
+var VALID_PROVIDER_NAMES = Object.keys(SOCIAL_PROVIDERS);
+var PROVIDER_OAUTH_CLI = {
+  google: {
+    envVar: "google_oauth_client_secret",
+    promptMessage: "Enter Google OAuth client secret"
+  }
+};
+function hasSecretOptions(options) {
+  return Boolean(options.clientSecret || options.clientSecretStdin || options.envFile);
+}
+function hasCustomOAuthOptions(options) {
+  return Boolean(options.clientId || hasSecretOptions(options));
+}
+async function socialLoginAction({ log, isNonInteractive, runTask }, provider, action, options) {
+  const shouldEnable = action === "enable";
+  const providerInfo = SOCIAL_PROVIDERS[provider];
+  const label = PROVIDER_LABELS[provider];
+  const hasOAuthOptions = hasCustomOAuthOptions(options);
+  if (hasOAuthOptions && !providerInfo.customOAuth) {
+    throw new InvalidInputError(`Custom OAuth options are only supported for providers with custom OAuth (e.g., google). Use: base44 auth social-login ${provider} ${action}`);
+  }
+  if (hasOAuthOptions && !shouldEnable) {
+    throw new InvalidInputError(`Custom OAuth options cannot be used with disable. To disable ${label} login: base44 auth social-login ${provider} disable`);
+  }
+  if (hasSecretOptions(options) && !options.clientId) {
+    throw new InvalidInputError(`--client-id is required when providing a client secret. Use: base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`);
+  }
+  const oauth = providerInfo.customOAuth;
+  const oauthCli = PROVIDER_OAUTH_CLI[provider];
+  const useCustomOAuth = shouldEnable && hasOAuthOptions && oauth != null;
+  let clientSecret;
+  if (useCustomOAuth && oauth && oauthCli && hasSecretOptions(options)) {
+    if (options.envFile) {
+      const secrets = await parseEnvFile(resolve6(options.envFile));
+      const value = secrets[oauthCli.envVar];
+      if (!value) {
+        throw new InvalidInputError(`Key "${oauthCli.envVar}" not found in ${options.envFile}.`);
+      }
+      clientSecret = value;
+    } else {
+      clientSecret = await resolveSecret({
+        flagValue: options.clientSecret,
+        fromStdin: options.clientSecretStdin,
+        envVar: oauthCli.envVar,
+        promptMessage: oauthCli.promptMessage,
+        isNonInteractive,
+        name: "client secret",
+        hints: [
+          {
+            message: `Provide via flag:   base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`,
+            command: `base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`
+          },
+          {
+            message: `Provide via stdin:  echo <secret> | base44 auth social-login ${provider} enable --client-id <id> --client-secret-stdin`
+          },
+          {
+            message: `Provide via env:    ${oauthCli.envVar}=<secret> base44 auth social-login ${provider} enable --client-id <id>`
+          }
+        ]
+      });
+    }
+  }
+  const { project } = await readProjectConfig();
+  const configDir = dirname17(project.configPath);
+  const authDir = join23(configDir, project.authDir);
+  const { config: updated } = await runTask("Updating local auth config", async () => updateSocialLoginConfig(authDir, provider, shouldEnable, useCustomOAuth && options.clientId ? { clientId: options.clientId } : undefined));
+  if (clientSecret) {
+    await runTask("Saving client secret", async () => pushCustomOAuthSecret(provider, clientSecret));
+  }
+  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
+    log.warn(`Disabling ${label} login will leave no login methods enabled. Users will be locked out.`);
+  }
+  const newStatus = shouldEnable ? "enabled" : "disabled";
+  const oauthNote = useCustomOAuth ? " with custom OAuth" : "";
+  let outroMessage = `${label} login ${newStatus}${oauthNote} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`;
+  if (useCustomOAuth && !clientSecret) {
+    outroMessage += `
+Remember to push the client secret separately: base44 secrets set --env-file <path>`;
+  }
+  return { outroMessage };
+}
+function getSocialLoginCommand() {
+  return new Base44Command("social-login").description("Enable or disable social login providers (google, microsoft, facebook, apple)").addArgument(new Argument2("<provider>", "social login provider").choices(VALID_PROVIDER_NAMES)).addArgument(new Argument2("<action>", "enable or disable the provider").choices([
+    "enable",
+    "disable"
+  ])).option("--client-id <id>", "custom OAuth client ID (Google only)").option("--client-secret <secret>", "custom OAuth client secret (Google only)").option("--client-secret-stdin", "read client secret from stdin (Google only)").option("--env-file <path>", "read client secret from a .env file (Google only)").action(socialLoginAction);
+}
+
+// src/cli/commands/auth/sso.ts
+import { dirname as dirname18, join as join24, resolve as resolve7 } from "node:path";
+var SSOConfigFileSchema = object({
+  provider: _enum(Object.values(KNOWN_SSO_PROVIDERS)),
+  clientId: string2(),
+  clientSecret: string2(),
+  scope: string2().optional(),
+  discoveryUrl: string2().optional(),
+  tenantId: string2().optional(),
+  oktaDomain: string2().optional(),
+  authEndpoint: string2().optional(),
+  tokenEndpoint: string2().optional(),
+  userinfoEndpoint: string2().optional(),
+  jwksUri: string2().optional(),
+  ssoName: string2().optional()
+});
+async function loadSSOConfigFile(filePath) {
+  const resolved = resolve7(filePath);
+  const raw = await readJsonFile(resolved);
+  const result = SSOConfigFileSchema.safeParse(raw);
+  if (!result.success) {
+    throw new SchemaValidationError("Invalid SSO config file", result.error, filePath);
+  }
+  return result.data;
+}
+function mergeFileWithFlags(fileConfig, options) {
+  return {
+    provider: options.provider ?? fileConfig.provider,
+    clientId: options.clientId ?? fileConfig.clientId,
+    clientSecret: options.clientSecret ?? fileConfig.clientSecret,
+    clientSecretStdin: options.clientSecretStdin,
+    envFile: options.envFile,
+    scope: options.scope ?? fileConfig.scope,
+    discoveryUrl: options.discoveryUrl ?? fileConfig.discoveryUrl,
+    tenantId: options.tenantId ?? fileConfig.tenantId,
+    oktaDomain: options.oktaDomain ?? fileConfig.oktaDomain,
+    authEndpoint: options.authEndpoint ?? fileConfig.authEndpoint,
+    tokenEndpoint: options.tokenEndpoint ?? fileConfig.tokenEndpoint,
+    userinfoEndpoint: options.userinfoEndpoint ?? fileConfig.userinfoEndpoint,
+    jwksUri: options.jwksUri ?? fileConfig.jwksUri,
+    ssoName: options.ssoName ?? fileConfig.ssoName
+  };
+}
+var providerNames = Object.keys(KNOWN_SSO_PROVIDERS);
+var SECRET_KEY_TO_FLAG = {
+  ["sso_name" /* Name */]: "--sso-name",
+  ["sso_client_id" /* ClientId */]: "--client-id",
+  ["sso_client_secret" /* ClientSecret */]: "--client-secret",
+  ["sso_scope" /* Scope */]: "--scope",
+  ["sso_discovery_url" /* DiscoveryUrl */]: "--discovery-url",
+  ["sso_tenant_id" /* TenantId */]: "--tenant-id",
+  ["sso_auth_endpoint" /* AuthEndpoint */]: "--auth-endpoint",
+  ["sso_token_endpoint" /* TokenEndpoint */]: "--token-endpoint",
+  ["sso_userinfo_endpoint" /* UserinfoEndpoint */]: "--userinfo-endpoint",
+  ["sso_okta_domain" /* OktaDomain */]: "--okta-domain",
+  ["sso_jwks_uri" /* JwksUri */]: "--jwks-uri"
+};
+function secretKeyToFlag(key) {
+  return SECRET_KEY_TO_FLAG[key];
+}
+function exampleCommand(provider) {
+  let cmd = `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`;
+  if (provider === KNOWN_SSO_PROVIDERS.microsoft)
+    cmd += " --tenant-id <id>";
+  if (provider === KNOWN_SSO_PROVIDERS.okta)
+    cmd += " --okta-domain <domain>";
+  if (provider === KNOWN_SSO_PROVIDERS.custom)
+    cmd += " --sso-name <name> --auth-endpoint <url> --token-endpoint <url> --userinfo-endpoint <url> --jwks-uri <url>";
+  return cmd;
+}
+function validateProvider(provider) {
+  if (!provider) {
+    throw new InvalidInputError("Missing --provider.", {
+      hints: [
+        {
+          message: `Valid providers: ${providerNames.join(", ")}`,
+          command: "base44 auth sso enable --provider <provider> --client-id <id> --client-secret <secret>"
+        }
+      ]
+    });
+  }
+  return provider;
+}
+async function ssoEnableAction({ isNonInteractive, runTask }, options) {
+  if (options.file && options.envFile) {
+    throw new InvalidInputError("--file and --env-file cannot be used together. Provide the client secret either inside --file or via --env-file.");
+  }
+  let merged = options;
+  if (options.file) {
+    const fileConfig = await loadSSOConfigFile(options.file);
+    merged = mergeFileWithFlags(fileConfig, options);
+  }
+  const provider = validateProvider(merged.provider);
+  if (!merged.clientId) {
+    throw new InvalidInputError("Missing --client-id.", {
+      hints: [
+        {
+          message: `Example: base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
+          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
+        }
+      ]
+    });
+  }
+  let clientSecret;
+  if (merged.envFile && !merged.clientSecret) {
+    const secrets = await parseEnvFile(resolve7(merged.envFile));
+    const value = secrets.sso_client_secret;
+    if (!value) {
+      throw new InvalidInputError(`Key "sso_client_secret" not found in ${merged.envFile}.`);
+    }
+    clientSecret = value;
+  } else {
+    clientSecret = await resolveSecret({
+      flagValue: merged.clientSecret,
+      fromStdin: merged.clientSecretStdin,
+      envVar: "sso_client_secret",
+      promptMessage: "Enter SSO client secret",
+      isNonInteractive,
+      name: "client secret",
+      hints: [
+        {
+          message: `Provide via flag:   base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
+          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
+        },
+        {
+          message: `Provide via stdin:  echo <secret> | base44 auth sso enable --provider ${provider} --client-id <id> --client-secret-stdin`
+        },
+        {
+          message: `Provide via env:    sso_client_secret=<secret> base44 auth sso enable --provider ${provider} --client-id <id>`
+        }
+      ]
+    });
+  }
+  const secretOptions = {
+    clientId: merged.clientId,
+    clientSecret,
+    scope: merged.scope,
+    discoveryUrl: merged.discoveryUrl,
+    tenantId: merged.tenantId,
+    oktaDomain: merged.oktaDomain,
+    authEndpoint: merged.authEndpoint,
+    tokenEndpoint: merged.tokenEndpoint,
+    userinfoEndpoint: merged.userinfoEndpoint,
+    jwksUri: merged.jwksUri,
+    ssoName: merged.ssoName
+  };
+  let secrets;
+  try {
+    secrets = buildSSOSecrets(provider, secretOptions);
+  } catch (error) {
+    if (error instanceof MissingSSOFieldsError) {
+      const flagNames = error.missingKeys.map(secretKeyToFlag);
+      throw new InvalidInputError(`Missing required fields for ${error.provider}: ${flagNames.join(", ")}`, {
+        hints: [
+          {
+            message: `Example: ${exampleCommand(provider)}`,
+            command: exampleCommand(provider)
+          }
+        ]
+      });
+    }
+    throw error;
+  }
+  const { project } = await readProjectConfig();
+  const configDir = dirname18(project.configPath);
+  const authDir = join24(configDir, project.authDir);
+  await runTask("Updating local auth config", async () => updateSSOConfig(authDir, provider, true));
+  await runTask("Saving SSO credentials", async () => pushSSOSecrets(secrets));
+  return {
+    outroMessage: `SSO configured with ${provider} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
+  };
+}
+function hasEnableOnlyOptions(options) {
+  return Boolean(options.provider || options.clientId || options.clientSecret || options.clientSecretStdin || options.envFile || options.file || options.scope || options.discoveryUrl || options.tenantId || options.oktaDomain || options.authEndpoint || options.tokenEndpoint || options.userinfoEndpoint || options.jwksUri || options.ssoName);
+}
+async function ssoDisableAction({ log, runTask }, options) {
+  if (hasEnableOnlyOptions(options)) {
+    throw new InvalidInputError("Configuration options cannot be used with disable. To disable SSO: base44 auth sso disable");
+  }
+  const { project } = await readProjectConfig();
+  const configDir = dirname18(project.configPath);
+  const authDir = join24(configDir, project.authDir);
+  const updated = await runTask("Updating local auth config", async () => updateSSOConfig(authDir, null, false));
+  await runTask("Removing SSO credentials", async () => deleteSSOSecrets());
+  if (!hasAnyLoginMethod(updated)) {
+    log.warn("Disabling SSO will leave no login methods enabled. Users will be locked out.");
+  }
+  return {
+    outroMessage: "SSO disabled in local config and credentials removed. Run `base44 auth push` or `base44 deploy` to apply."
+  };
+}
+async function ssoAction(context, action, options) {
+  if (action === "disable") {
+    return ssoDisableAction(context, options);
+  }
+  return ssoEnableAction(context, options);
+}
+function getSSOCommand() {
+  return new Base44Command("sso").description("Configure SSO identity provider (google, microsoft, github, okta, custom). SSO and social login are mutually exclusive — enabling one disables the other in the local auth config.").addArgument(new Argument2("<action>", "enable or disable SSO").choices([
+    "enable",
+    "disable"
+  ])).addOption(new Option2("--provider <provider>", "SSO provider").choices(Object.values(KNOWN_SSO_PROVIDERS))).option("--client-id <id>", "OAuth client ID").option("--client-secret <secret>", "OAuth client secret").option("--client-secret-stdin", "Read client secret from stdin").option("--env-file <path>", "Read client secret from a .env file (key: sso_client_secret)").option("--file <path>", "JSON config file with all SSO settings").option("--scope <scope>", "OAuth scope (defaults per provider)").option("--discovery-url <url>", "OIDC discovery URL").option("--tenant-id <id>", "Microsoft tenant ID (required for microsoft)").option("--okta-domain <domain>", "Okta domain (required for okta)").option("--auth-endpoint <url>", "Authorization endpoint (required for custom)").option("--token-endpoint <url>", "Token endpoint (required for custom)").option("--userinfo-endpoint <url>", "Userinfo endpoint (required for custom)").option("--jwks-uri <url>", "JWKS URI (required for custom)").option("--sso-name <name>", "Provider display name (required for custom)").action(ssoAction);
+}
+
+// src/cli/commands/auth/index.ts
+function getAuthCommand() {
+  return new Command2("auth").description("Manage app authentication settings").addCommand(getPasswordLoginCommand()).addCommand(getSocialLoginCommand()).addCommand(getSSOCommand()).addCommand(getAuthPullCommand()).addCommand(getAuthPushCommand());
+}
+
+// src/cli/commands/auth/login.ts
+function getLoginCommand() {
+  return new Base44Command("login", {
+    requireAuth: false,
+    requireAppContext: false
+  }).description("Authenticate with Base44").action(login);
+}
+
+// src/cli/commands/auth/logout.ts
+async function logout(_ctx) {
+  await deleteAuth();
+  return { outroMessage: "Logged out successfully" };
+}
+function getLogoutCommand() {
+  return new Base44Command("logout", {
+    requireAuth: false,
+    requireAppContext: false
+  }).description("Logout from current device").action(logout);
+}
+
+// src/cli/commands/auth/whoami.ts
+async function whoami(_ctx) {
+  const workspaceApiKey = getWorkspaceApiKeyFromEnv();
+  if (workspaceApiKey && isWorkspaceApiKey(workspaceApiKey)) {
+    return {
+      outroMessage: `Using workspace API key: ${theme.styles.bold(workspaceApiKey.slice(0, 10))}`
+    };
+  }
+  const auth = await readAuth();
+  return { outroMessage: `Logged in as: ${theme.styles.bold(auth.email)}` };
+}
+function getWhoamiCommand() {
+  return new Base44Command("whoami", { requireAppContext: false }).description("Display current authenticated user").action(whoami);
+}
+
+// src/cli/commands/branches/index.ts
+async function listBranchesAction({
+  log,
+  runTask,
+  jsonMode
+}) {
+  const remote = await runTask("Fetching branches", () => listBranches());
+  const branches = [
+    { name: "main", status: "active" },
+    ...remote.map((branch) => ({
+      name: branch.branch_name,
+      status: branch.status
+    }))
+  ];
+  if (jsonMode)
+    return { stdout: `${JSON.stringify({ branches })}
+` };
+  for (const branch of branches)
+    log.message(`${branch.name} (${branch.status})`);
+  return { outroMessage: `${branches.length} branches` };
+}
+function getBranchesCommand() {
+  return new Command2("branches").description("Discover an app's branches").addCommand(new Base44Command("list").description("List main and active branch names for use with --branch").action(listBranchesAction));
+}
+
 // src/core/model.ts
 var MODELS = [
   {
@@ -269502,7 +269963,7 @@ async function saveBuilderModel(userId, modelId) {
 }
 var displayName = (id) => MODELS.find((m) => m.id === id)?.name ?? id ?? "Automatic";
 
-// src/cli/commands/app/model.ts
+// src/cli/commands/builder/model.ts
 async function modelAction({ log, jsonMode }, input) {
   const me = await getMe();
   const current = me.builder_model ?? null;
@@ -269523,7 +269984,7 @@ async function modelAction({ log, jsonMode }, input) {
       log.message(`${marker} ${active ? theme.styles.bold(m.name) : m.name}${note}`);
     }
     return {
-      outroMessage: `Current: ${theme.styles.bold(displayName(current))}. Set with \`base44 app model <name>\`.`
+      outroMessage: `Current: ${theme.styles.bold(displayName(current))}. Set with \`base44 builder model <name>\`.`
     };
   }
   const pick = resolvePick(input);
@@ -269544,9 +270005,9 @@ function getModelCommand() {
   return command;
 }
 
-// src/cli/commands/app/shared.ts
+// src/cli/commands/builder/shared.ts
 import { mkdir as mkdir3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename6, join as join21, relative as relative6, resolve as resolve6 } from "node:path";
+import { basename as basename6, join as join25, relative as relative6, resolve as resolve8 } from "node:path";
 
 // src/cli/commands/code/render.ts
 var TOOL_ALIASES = {
@@ -269554,6 +270015,10 @@ var TOOL_ALIASES = {
   read_repo_file: "read",
   write_repo_file: "write",
   edit_repo_file: "edit",
+  read_file: "read",
+  write_file: "write",
+  find_replace: "edit",
+  delete_file: "delete",
   set_secrets: "secrets",
   generate_development_secrets: "secrets",
   create_pull_request: "pr",
@@ -269567,7 +270032,37 @@ var TOOL_ALIASES = {
   preview_screenshot: "screenshot",
   connect_github_account: "github"
 };
-var QUIET_OK_RESULTS = new Set(["read", "write", "edit", "reload"]);
+var QUIET_OK_RESULTS = new Set(["read", "write", "edit", "reload", "delete"]);
+var RESULT_LINE_MAX = 110;
+var DIFF_LINES_MAX = 12;
+var ERROR_LINES_MAX = 8;
+function renderEntry(entry, options = {}) {
+  return typeof entry === "string" ? entry : eventLine(entry.event, entry.elapsedMs, options) ?? "";
+}
+function fold2(lines, max, options) {
+  if (options.verbose || lines.length <= max)
+    return lines;
+  const hint = options.foldHint ? ` (${options.foldHint})` : "";
+  return [
+    ...lines.slice(0, max),
+    source_default.dim(`… +${lines.length - max} lines${hint}`)
+  ];
+}
+var str = (v) => typeof v === "string" ? v : undefined;
+function diffLines(args) {
+  const find = str(args.find);
+  const replace = str(args.replace);
+  if (find == null && replace == null)
+    return null;
+  return [
+    ...(find ?? "").split(`
+`).map((l) => source_default.red(`- ${l}`)),
+    ...(replace ?? "").split(`
+`).map((l) => source_default.green(`+ ${l}`))
+  ];
+}
+var indent = (lines) => lines.map((l) => `  ${l}`).join(`
+`);
 function toolAlias(name) {
   return TOOL_ALIASES[name] ?? name;
 }
@@ -269632,7 +270127,7 @@ function formatDuration2(ms) {
     return `${seconds}s`;
   return `${Math.floor(seconds / 60)}m ${String(seconds % 60).padStart(2, "0")}s`;
 }
-function eventLine(event, elapsedMs) {
+function eventLine(event, elapsedMs, options = {}) {
   switch (event.kind) {
     case "thinking":
       return source_default.dim(`✻ ${event.text}`);
@@ -269653,12 +270148,40 @@ function eventLine(event, elapsedMs) {
       const paramsLine = event.label && event.summary ? `
   ${source_default.dim(`${alias}: ${event.summary}`)}` : "";
       const head = `${mark} ${title}${inlineDetail}${took}${paramsLine}`;
+      const args = event.args ?? null;
+      if (event.ok && alias === "edit" && args) {
+        const diff = diffLines(args);
+        if (diff)
+          return `${head}
+${indent(fold2(diff, DIFF_LINES_MAX, options))}`;
+      }
+      if (event.ok && alias === "write" && args && str(args.content) != null) {
+        const lines = str(args.content).split(`
+`);
+        const count = source_default.dim(`+${lines.length} lines`);
+        if (!options.verbose)
+          return `${head} ${count}`;
+        return `${head} ${count}
+${indent(lines.map((l) => source_default.dim(l)))}`;
+      }
       if (event.ok && (QUIET_OK_RESULTS.has(alias) || !event.result)) {
         return head;
       }
-      const result = event.ok ? source_default.dim(linkifyUrls(event.result)) : source_default.red(linkifyUrls(event.result));
-      return `${head}${event.result ? `
-  ${result}` : ""}`;
+      const paint = event.ok ? source_default.dim : source_default.red;
+      const lines = event.result.split(`
+`).map((l) => l.trimEnd()).filter((l, i, all) => l.length > 0 || i > 0 && i < all.length - 1);
+      if (event.ok && !options.verbose) {
+        const first = lines[0] ?? "";
+        const cut = first.length > RESULT_LINE_MAX ? `${first.slice(0, RESULT_LINE_MAX)}…` : first;
+        const more = lines.length - 1;
+        const hint = options.foldHint ? ` (${options.foldHint})` : "";
+        const tail = more > 0 ? source_default.dim(` … +${more} lines${hint}`) : "";
+        return `${head}
+  ${paint(linkifyUrls(cut))}${tail}`;
+      }
+      const shown = fold2(lines.map((l) => paint(linkifyUrls(l))), event.ok ? Number.POSITIVE_INFINITY : ERROR_LINES_MAX, options);
+      return `${head}
+${indent(shown)}`;
     }
   }
 }
@@ -269764,7 +270287,10 @@ function createTurnStream(interactive, write = (text) => process.stdout.write(te
           elapsedMs = Date.now() - started;
         running.delete(event.id);
       }
-      const line = eventLine(event, elapsedMs);
+      const line = eventLine(event, elapsedMs, {
+        verbose: options.verbose,
+        foldHint: "--verbose shows everything"
+      });
       if (line == null)
         return;
       if (interactive) {
@@ -269801,6 +270327,9 @@ var CreatedAppSchema = object({
 });
 var AppStateSchema = object({
   id: string2(),
+  app_type: string2().nullish(),
+  is_managed_source_code: boolean2().nullish(),
+  imported_repo_url: string2().nullish(),
   status: object({
     state: string2().nullish(),
     message: string2().nullish()
@@ -269900,7 +270429,9 @@ async function getAppState(appId) {
   let response;
   try {
     response = await base44Client.get(`api/apps/${appId}`, {
-      searchParams: { fields: "id,status" }
+      searchParams: {
+        fields: "id,status,app_type,is_managed_source_code,imported_repo_url"
+      }
     });
   } catch (error) {
     throw await ApiError.fromHttpError(error, "reading app status");
@@ -269961,7 +270492,7 @@ async function getPreviewUrl() {
   return /^https?:\/\//.test(url) ? url : `https://${url}`;
 }
 
-// src/cli/commands/app/shared.ts
+// src/cli/commands/builder/shared.ts
 var APP_NAME_RE = /^[A-Za-z0-9._-]+$/;
 var NAME_STOPWORDS = new Set("a an the and or of for with to in on that this its it my our your me".split(" "));
 var FALLBACK_WORDS = [
@@ -269985,10 +270516,10 @@ async function createAndLinkApp(options) {
   }
   const cwd = process.cwd();
   const fallbackName = () => options.importRepo ? repoBasename(options.importRepo) : inventAppName(options.prompt);
-  const chosenDir = options.path ? resolve6(cwd, options.path) : await isDirEmpty(cwd) ? cwd : undefined;
+  const chosenDir = options.path ? resolve8(cwd, options.path) : await isDirEmpty(cwd) ? cwd : undefined;
   const dirBase = chosenDir ? basename6(chosenDir) : undefined;
   const name = options.name ?? (dirBase && APP_NAME_RE.test(dirBase) ? dirBase : fallbackName());
-  const targetDir = chosenDir ?? join21(cwd, name);
+  const targetDir = chosenDir ?? join25(cwd, name);
   const here = targetDir === cwd;
   const dirName = here ? "." : relative6(cwd, targetDir) || name;
   await mkdir3(targetDir, { recursive: true });
@@ -270004,9 +270535,9 @@ async function createAndLinkApp(options) {
     prompt: options.prompt
   }) : await createApp({ appName: name, prompt: options.prompt });
   await writeAppConfig(targetDir, created.id);
-  await mkdir3(join21(targetDir, "base44"), { recursive: true });
+  await mkdir3(join25(targetDir, "base44"), { recursive: true });
   try {
-    await writeFile2(join21(targetDir, "base44", "config.jsonc"), `// Base44 project configuration.
+    await writeFile2(join25(targetDir, "base44", "config.jsonc"), `// Base44 project configuration.
 {
   "name": ${JSON.stringify(name)}
 }
@@ -270022,13 +270553,42 @@ async function createAndLinkApp(options) {
     here
   };
 }
+function repoLabel(url) {
+  return url.replace(/^https?:\/\//, "").replace(/\.git$/, "").replace(/\/$/, "");
+}
+function appTypeChip(state) {
+  switch (state.app_type ?? "user_app") {
+    case "imported_app":
+      return state.imported_repo_url ? repoLabel(state.imported_repo_url) : "repository app";
+    case "user_game":
+      return "game";
+    case "mobile_app":
+      return "mobile app";
+    case "slide":
+      return "slides";
+    case "user_agent":
+      return "superagent";
+    default:
+      return "web app";
+  }
+}
+async function assertBuilderApp(appId) {
+  const state = await getAppState(appId);
+  if (state.is_managed_source_code === false) {
+    throw new InvalidInputError("This project is code-first (base44 create): you own the source and the builder cannot work on it. Run `base44 builder new` for an agent-built app.");
+  }
+  if (state.app_type === "user_agent") {
+    throw new InvalidInputError("This is a Superagent, not an app the builder works on. Superagent has no CLI surface yet.");
+  }
+  return state;
+}
 function nextStepsLines(app) {
   const cd = app.here ? "" : `cd ${app.dirName} && `;
   return [
     "",
     `${source_default.bold("Your app lives in")}  ${app.here ? "./  (this directory)" : `./${app.dirName}`}`,
     source_default.dim(`  ${cd}base44 code        # keep building with the agent`),
-    source_default.dim(`  ${cd}base44 app send "…"  # one non-interactive turn`),
+    source_default.dim(`  ${cd}base44 builder send "…"  # one non-interactive turn`),
     source_default.dim(`  files live remotely — ${cd}base44 sandbox ls to look, base44 eject for a copy`)
   ];
 }
@@ -270052,12 +270612,27 @@ function newStreamState() {
   return { perMessage: new Map };
 }
 var TOOL_SETTLED = new Set(["success", "error", "stopped"]);
+function fullText(value) {
+  if (typeof value === "string")
+    return value.trimEnd();
+  if (value == null)
+    return "";
+  return JSON.stringify(value);
+}
+function toolArgs(argumentsString) {
+  try {
+    const parsed = JSON.parse(argumentsString ?? "");
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
 function oneLine(value, max) {
   const text = typeof value === "string" ? value : value == null ? "" : JSON.stringify(value);
   const flat = text.replace(/\s+/g, " ").trim();
   return flat.length > max ? `${flat.slice(0, max)}…` : flat;
 }
-var SALIENT_KEYS = ["command", "path", "file_path", "title"];
+var SALIENT_KEYS = ["command", "path", "file_path", "title", "find"];
 function salvageKey(raw, keys) {
   for (const key of keys) {
     const match = raw.match(new RegExp(`"${key}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)"`));
@@ -270086,6 +270661,10 @@ function toolMeta(name, argumentsString) {
     read_repo_file: pick("path") ?? pick("file_path"),
     write_repo_file: pick("path") ?? pick("file_path"),
     edit_repo_file: pick("path") ?? pick("file_path"),
+    read_file: pick("file_path") ?? pick("path"),
+    write_file: pick("file_path") ?? pick("path"),
+    find_replace: pick("file_path") ?? pick("path"),
+    delete_file: pick("file_path") ?? pick("path"),
     create_pull_request: pick("title"),
     reload_preview: ""
   };
@@ -270136,7 +270715,10 @@ function diffConversation(state, messages) {
     }
     for (const tool of message.tool_calls ?? []) {
       if (!progress.announcedTools.has(tool.id)) {
-        progress.announcedTools.set(tool.id, toolMeta(tool.name, tool.arguments_string));
+        progress.announcedTools.set(tool.id, {
+          ...toolMeta(tool.name, tool.arguments_string),
+          args: toolArgs(tool.arguments_string)
+        });
         const meta = progress.announcedTools.get(tool.id);
         events.push({
           kind: "tool_start",
@@ -270167,7 +270749,8 @@ function diffConversation(state, messages) {
           label: labelTense(meta.label, "done"),
           summary: meta.summary,
           ok: status === "success",
-          result: oneLine(tool.results, 110)
+          result: fullText(tool.results),
+          args: meta.args
         });
       }
     }
@@ -270241,7 +270824,82 @@ async function streamConversationUntilSettled(onEvent, options = {}) {
   return "timeout";
 }
 
-// src/cli/commands/app/new.ts
+// src/cli/commands/builder/send.ts
+function lastAssistantReply(turn) {
+  const messages = turn.conversation?.messages ?? [];
+  for (let i = messages.length - 1;i >= 0; i--) {
+    const { role, content } = messages[i];
+    if (role === "assistant" && typeof content === "string" && content.trim()) {
+      return content.trim();
+    }
+  }
+  return;
+}
+function ndjsonWriter() {
+  return (record) => process.stdout.write(`${JSON.stringify(record)}
+`);
+}
+async function sendAction(ctx, message, options) {
+  if (options.streamJson && ctx.jsonMode) {
+    throw new InvalidInputError("--stream-json and --json are exclusive.");
+  }
+  if (ctx.app)
+    await assertBuilderApp(ctx.app.id);
+  const branchId = await resolveBranchId(ctx);
+  if (options.streamJson) {
+    const write = ndjsonWriter();
+    const turn = await streamConversationDuring(() => sendTurn(message, branchId), ({ kind, ...event }) => write({ type: kind, ...event }), { branchId });
+    write({
+      type: "result",
+      queued: turn.queued === true,
+      status: turn.status?.state ?? "ready",
+      error_source: turn.status?.error_source ?? null,
+      reply: lastAssistantReply(turn) ?? null
+    });
+    return {};
+  }
+  if (ctx.jsonMode) {
+    const turn = await ctx.runTask("Agent working (a turn can take minutes)", () => sendTurn(message, branchId));
+    if (turn.queued)
+      return { stdout: `${JSON.stringify({ queued: true })}
+` };
+    return {
+      stdout: `${JSON.stringify({
+        status: turn.status?.state ?? "ready",
+        error_source: turn.status?.error_source ?? null,
+        reply: lastAssistantReply(turn) ?? null
+      })}
+`
+    };
+  }
+  const stream = createTurnStream(process.stdout.isTTY === true, undefined, {
+    verbose: options.verbose
+  });
+  let turn;
+  try {
+    turn = await streamConversationDuring(() => sendTurn(message, branchId), stream.onEvent, { branchId });
+  } finally {
+    stream.stop();
+  }
+  if (turn.queued) {
+    return {
+      outroMessage: "The agent is busy with an earlier message — yours was queued and runs next."
+    };
+  }
+  if (turn.status?.state === "error") {
+    return {
+      outroMessage: `Turn failed (${turn.status.error_source ?? "unknown"}) — see the editor for details.`
+    };
+  }
+  return { outroMessage: "Turn finished." };
+}
+function getSendCommand() {
+  const command = new Base44Command("send", { supportsBranch: true });
+  command.description("Send the agent one message and stream the turn until it finishes").argument("<message>", "What you want the agent to do").option("--verbose", "Show every tool result in full (no folding)").option("--stream-json", "Emit each stream event as a JSON line as it happens, then a final result line").action(sendAction);
+  return command;
+}
+
+// src/cli/commands/builder/new.ts
 var POLL_TIMEOUT_MS = 20 * 60000;
 var MODES = ["direct", "fork", "copy"];
 async function newAction({ log, runTask, jsonMode }, prompt, options) {
@@ -270254,6 +270912,10 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
   if (!prompt && !options.import) {
     throw new InvalidInputError('Describe the app ("<prompt>") or pass --import <repo>.');
   }
+  if (options.streamJson && jsonMode) {
+    throw new InvalidInputError("--stream-json and --json are exclusive.");
+  }
+  const ndjson = options.streamJson ? ndjsonWriter() : null;
   let app;
   try {
     app = await runTask(options.import ? "Importing the repository" : "Creating your app", () => createAndLinkApp({
@@ -270270,7 +270932,16 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
       log.message(line);
     throw error;
   }
-  if (!jsonMode) {
+  if (ndjson) {
+    ndjson({
+      type: "created",
+      id: app.id,
+      repo_url: app.repoUrl ?? null,
+      editor_url: app.editorUrl,
+      dir: app.dirName,
+      path: app.targetDir
+    });
+  } else if (!jsonMode) {
     if (app.repoUrl)
       log.message(source_default.dim(`repo    ${app.repoUrl}`));
     log.message(source_default.dim(`editor  ${app.editorUrl}`));
@@ -270283,10 +270954,16 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
     const branchId = await resolveActiveBranchId().catch(() => {
       return;
     });
-    const stream = createTurnStream(process.stdout.isTTY === true && !jsonMode, undefined, { idleLabel: "provisioning the sandbox and starting the build" });
+    const stream = createTurnStream(process.stdout.isTTY === true && !jsonMode && !ndjson, undefined, {
+      idleLabel: "provisioning the sandbox and starting the build",
+      verbose: options.verbose
+    });
     try {
       const settled = await streamConversationUntilSettled((event) => {
-        if (!jsonMode)
+        if (ndjson) {
+          const { kind, ...rest } = event;
+          ndjson({ type: kind, ...rest });
+        } else if (!jsonMode)
           stream.onEvent(event);
       }, { branchId, timeoutMs: POLL_TIMEOUT_MS });
       finalState = settled === "timeout" ? "processing" : (await getAppState(app.id)).status?.state ?? "ready";
@@ -270299,6 +270976,15 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
       stream.stop();
     }
   }
+  if (ndjson) {
+    ndjson({
+      type: "result",
+      id: app.id,
+      preview_url: previewUrl ?? null,
+      status: finalState ?? "created"
+    });
+    return {};
+  }
   if (jsonMode) {
     return {
       stdout: `${JSON.stringify({
@@ -270324,7 +271010,7 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
   }
   if (finalState === "processing") {
     return {
-      outroMessage: `Still building — follow it with \`base44 app status\`.`
+      outroMessage: `Still building — follow it with \`base44 builder status\`.`
     };
   }
   return {
@@ -270333,78 +271019,11 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
 }
 function getNewCommand() {
   const command = new Base44Command("new", { requireAppContext: false });
-  command.description("Create an app and start building: from a prompt (the Base44 template), or over an existing GitHub repo with --import").argument("[prompt]", "What to build; the first agent turn starts immediately").option("--import <repo>", "Build over an existing GitHub repository instead of the template").option("--mode <mode>", "How to import: direct, fork, or copy (default: direct)").option("--name <name>", "Directory and app name (invented when omitted)").option("--path <dir>", "Directory to link (default: the current directory when empty, else ./<name>)").option("--repo-name <name>", "Name for the new GitHub repo when forking/copying").option("--from-branch <name>", "Import a specific branch of the repo").action(newAction);
-  return command;
-}
-
-// src/cli/commands/app/preview.ts
-async function previewAction(ctx) {
-  const url = await ctx.runTask("Resolving preview URL (boots the sandbox if needed)", () => getPreviewUrl());
-  if (ctx.jsonMode)
-    return { stdout: `${JSON.stringify({ preview_url: url })}
-` };
-  ctx.log.message(url);
-  return { outroMessage: "Preview is live." };
-}
-function getPreviewCommand() {
-  const command = new Base44Command("preview");
-  command.description("Print the app's live preview URL").action(previewAction);
-  return command;
-}
-
-// src/cli/commands/app/send.ts
-function lastAssistantReply(turn) {
-  const messages = turn.conversation?.messages ?? [];
-  for (let i = messages.length - 1;i >= 0; i--) {
-    const { role, content } = messages[i];
-    if (role === "assistant" && typeof content === "string" && content.trim()) {
-      return content.trim();
-    }
-  }
-  return;
-}
-async function sendAction(ctx, message) {
-  const branchId = await resolveBranchId(ctx);
-  if (ctx.jsonMode) {
-    const turn = await ctx.runTask("Agent working (a turn can take minutes)", () => sendTurn(message, branchId));
-    if (turn.queued)
-      return { stdout: `${JSON.stringify({ queued: true })}
-` };
-    return {
-      stdout: `${JSON.stringify({
-        status: turn.status?.state ?? "ready",
-        error_source: turn.status?.error_source ?? null,
-        reply: lastAssistantReply(turn) ?? null
-      })}
-`
-    };
-  }
-  const stream = createTurnStream(process.stdout.isTTY === true);
-  let turn;
-  try {
-    turn = await streamConversationDuring(() => sendTurn(message, branchId), stream.onEvent, { branchId });
-  } finally {
-    stream.stop();
-  }
-  if (turn.queued) {
-    return {
-      outroMessage: "The agent is busy with an earlier message — yours was queued and runs next."
-    };
-  }
-  if (turn.status?.state === "error") {
-    return {
-      outroMessage: `Turn failed (${turn.status.error_source ?? "unknown"}) — see the editor for details.`
-    };
-  }
-  return { outroMessage: "Turn finished." };
-}
-function getSendCommand() {
-  const command = new Base44Command("send", { supportsBranch: true });
-  command.description("Send the agent one message and stream the turn until it finishes").argument("<message>", "What you want the agent to do").action(sendAction);
+  command.description("Create an app and start building: from a prompt (the Base44 template), or over an existing GitHub repo with --import").argument("[prompt]", "What to build; the first agent turn starts immediately").option("--import <repo>", "Build over an existing GitHub repository instead of the template").option("--mode <mode>", "How to import: direct, fork, or copy (default: direct)").option("--name <name>", "Directory and app name (invented when omitted)").option("--path <dir>", "Directory to link (default: the current directory when empty, else ./<name>)").option("--repo-name <name>", "Name for the new GitHub repo when forking/copying").option("--from-branch <name>", "Import a specific branch of the repo").option("--verbose", "Show every tool result in full (no folding)").option("--stream-json", "Emit each stream event as a JSON line as it happens, then a final result line").action(newAction);
   return command;
 }
 
-// src/cli/commands/app/status.ts
+// src/cli/commands/builder/status.ts
 async function statusAction(ctx) {
   const id = ctx.app?.id;
   const app = await ctx.runTask("Reading app status", () => getAppState(id));
@@ -270426,7 +271045,7 @@ function getStatusCommand() {
   return command;
 }
 
-// src/cli/commands/app/stop.ts
+// src/cli/commands/builder/stop.ts
 async function stopAction(ctx) {
   const branchId = await resolveBranchId(ctx);
   await ctx.runTask("Stopping the running turn", () => stopTurn(branchId));
@@ -270441,470 +271060,9 @@ function getStopCommand() {
   return command;
 }
 
-// src/cli/commands/app/index.ts
-function getAppCommand() {
-  return new Command2("app").description("Build a Base44 app with the agent, non-interactively: create it, send turns, read status, get the preview").addCommand(getNewCommand()).addCommand(getSendCommand()).addCommand(getStatusCommand()).addCommand(getPreviewCommand()).addCommand(getStopCommand()).addCommand(getModelCommand());
-}
-
-// src/cli/commands/auth/password-login.ts
-import { dirname as dirname15, join as join22 } from "node:path";
-async function passwordLoginAction({ log, runTask }, action) {
-  const shouldEnable = action === "enable";
-  const { project } = await readProjectConfig();
-  const configDir = dirname15(project.configPath);
-  const authDir = join22(configDir, project.authDir);
-  const updated = await runTask("Updating local auth config", async () => {
-    const current = await readAuthConfig(authDir) ?? DEFAULT_AUTH_CONFIG;
-    const merged = { ...current, enableUsernamePassword: shouldEnable };
-    await writeAuthConfig(authDir, merged);
-    return merged;
-  });
-  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
-    log.warn("Disabling password auth will leave no login methods enabled. Users will be locked out.");
-  }
-  const newStatus = shouldEnable ? "enabled" : "disabled";
-  return {
-    outroMessage: `Username & password authentication ${newStatus} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
-  };
-}
-function getPasswordLoginCommand() {
-  return new Base44Command("password-login").description("Enable or disable username & password authentication").addArgument(new Argument2("<action>", "enable or disable password authentication").choices(["enable", "disable"])).action(passwordLoginAction);
-}
-
-// src/cli/commands/auth/pull.ts
-import { dirname as dirname16, join as join23 } from "node:path";
-async function pullAuthAction({
-  log,
-  runTask
-}) {
-  const { project } = await readProjectConfig();
-  const configDir = dirname16(project.configPath);
-  const authDir = join23(configDir, project.authDir);
-  const remoteConfig = await runTask("Fetching auth config from Base44", async () => {
-    return await pullAuthConfig();
-  }, {
-    successMessage: "Auth config fetched successfully",
-    errorMessage: "Failed to fetch auth config"
-  });
-  const { written } = await runTask("Syncing auth config file", async () => {
-    return await writeAuthConfig(authDir, remoteConfig);
-  }, {
-    successMessage: "Auth config file synced successfully",
-    errorMessage: "Failed to sync auth config file"
-  });
-  if (written) {
-    log.success("Auth config written to local file");
-  } else {
-    log.info("Auth config is already up to date");
-  }
-  return {
-    outroMessage: `Pulled auth config to ${authDir} (overwrites local file)`
-  };
-}
-function getAuthPullCommand() {
-  return new Base44Command("pull").description("Pull auth config from Base44 to local file").action(pullAuthAction);
-}
-
-// src/cli/commands/auth/push.ts
-async function pushAuthAction({ isNonInteractive, log, runTask }, options) {
-  const { authConfig } = await readProjectConfig();
-  if (authConfig.length === 0) {
-    log.info("No local auth config found");
-    return {
-      outroMessage: "No auth config to push. Run `base44 auth pull` to fetch the remote config first."
-    };
-  }
-  if (!hasAnyLoginMethod(authConfig[0])) {
-    log.warn("This config has no login methods enabled. Pushing it will lock out all users.");
-  }
-  if (!options.yes) {
-    if (isNonInteractive) {
-      throw new InvalidInputError("--yes is required in non-interactive mode");
-    }
-    const shouldPush = await Re({
-      message: "Push auth config to Base44?"
-    });
-    if (Ct(shouldPush) || !shouldPush) {
-      return { outroMessage: "Push cancelled" };
-    }
-  }
-  await runTask("Pushing auth config to Base44", async () => {
-    return await pushAuthConfig(authConfig[0] ?? null);
-  }, {
-    successMessage: "Auth config pushed successfully",
-    errorMessage: "Failed to push auth config"
-  });
-  return {
-    outroMessage: "Auth config pushed to Base44"
-  };
-}
-function getAuthPushCommand() {
-  return new Base44Command("push").description("Push local auth config to Base44").option("-y, --yes", "Skip confirmation prompt").action(pushAuthAction);
-}
-
-// src/cli/commands/auth/social-login.ts
-import { dirname as dirname17, join as join24, resolve as resolve7 } from "node:path";
-var PROVIDER_LABELS = {
-  google: "Google",
-  microsoft: "Microsoft",
-  facebook: "Facebook",
-  apple: "Apple"
-};
-var VALID_PROVIDER_NAMES = Object.keys(SOCIAL_PROVIDERS);
-var PROVIDER_OAUTH_CLI = {
-  google: {
-    envVar: "google_oauth_client_secret",
-    promptMessage: "Enter Google OAuth client secret"
-  }
-};
-function hasSecretOptions(options) {
-  return Boolean(options.clientSecret || options.clientSecretStdin || options.envFile);
-}
-function hasCustomOAuthOptions(options) {
-  return Boolean(options.clientId || hasSecretOptions(options));
-}
-async function socialLoginAction({ log, isNonInteractive, runTask }, provider, action, options) {
-  const shouldEnable = action === "enable";
-  const providerInfo = SOCIAL_PROVIDERS[provider];
-  const label = PROVIDER_LABELS[provider];
-  const hasOAuthOptions = hasCustomOAuthOptions(options);
-  if (hasOAuthOptions && !providerInfo.customOAuth) {
-    throw new InvalidInputError(`Custom OAuth options are only supported for providers with custom OAuth (e.g., google). Use: base44 auth social-login ${provider} ${action}`);
-  }
-  if (hasOAuthOptions && !shouldEnable) {
-    throw new InvalidInputError(`Custom OAuth options cannot be used with disable. To disable ${label} login: base44 auth social-login ${provider} disable`);
-  }
-  if (hasSecretOptions(options) && !options.clientId) {
-    throw new InvalidInputError(`--client-id is required when providing a client secret. Use: base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`);
-  }
-  const oauth = providerInfo.customOAuth;
-  const oauthCli = PROVIDER_OAUTH_CLI[provider];
-  const useCustomOAuth = shouldEnable && hasOAuthOptions && oauth != null;
-  let clientSecret;
-  if (useCustomOAuth && oauth && oauthCli && hasSecretOptions(options)) {
-    if (options.envFile) {
-      const secrets = await parseEnvFile(resolve7(options.envFile));
-      const value = secrets[oauthCli.envVar];
-      if (!value) {
-        throw new InvalidInputError(`Key "${oauthCli.envVar}" not found in ${options.envFile}.`);
-      }
-      clientSecret = value;
-    } else {
-      clientSecret = await resolveSecret({
-        flagValue: options.clientSecret,
-        fromStdin: options.clientSecretStdin,
-        envVar: oauthCli.envVar,
-        promptMessage: oauthCli.promptMessage,
-        isNonInteractive,
-        name: "client secret",
-        hints: [
-          {
-            message: `Provide via flag:   base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`,
-            command: `base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`
-          },
-          {
-            message: `Provide via stdin:  echo <secret> | base44 auth social-login ${provider} enable --client-id <id> --client-secret-stdin`
-          },
-          {
-            message: `Provide via env:    ${oauthCli.envVar}=<secret> base44 auth social-login ${provider} enable --client-id <id>`
-          }
-        ]
-      });
-    }
-  }
-  const { project } = await readProjectConfig();
-  const configDir = dirname17(project.configPath);
-  const authDir = join24(configDir, project.authDir);
-  const { config: updated } = await runTask("Updating local auth config", async () => updateSocialLoginConfig(authDir, provider, shouldEnable, useCustomOAuth && options.clientId ? { clientId: options.clientId } : undefined));
-  if (clientSecret) {
-    await runTask("Saving client secret", async () => pushCustomOAuthSecret(provider, clientSecret));
-  }
-  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
-    log.warn(`Disabling ${label} login will leave no login methods enabled. Users will be locked out.`);
-  }
-  const newStatus = shouldEnable ? "enabled" : "disabled";
-  const oauthNote = useCustomOAuth ? " with custom OAuth" : "";
-  let outroMessage = `${label} login ${newStatus}${oauthNote} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`;
-  if (useCustomOAuth && !clientSecret) {
-    outroMessage += `
-Remember to push the client secret separately: base44 secrets set --env-file <path>`;
-  }
-  return { outroMessage };
-}
-function getSocialLoginCommand() {
-  return new Base44Command("social-login").description("Enable or disable social login providers (google, microsoft, facebook, apple)").addArgument(new Argument2("<provider>", "social login provider").choices(VALID_PROVIDER_NAMES)).addArgument(new Argument2("<action>", "enable or disable the provider").choices([
-    "enable",
-    "disable"
-  ])).option("--client-id <id>", "custom OAuth client ID (Google only)").option("--client-secret <secret>", "custom OAuth client secret (Google only)").option("--client-secret-stdin", "read client secret from stdin (Google only)").option("--env-file <path>", "read client secret from a .env file (Google only)").action(socialLoginAction);
-}
-
-// src/cli/commands/auth/sso.ts
-import { dirname as dirname18, join as join25, resolve as resolve8 } from "node:path";
-var SSOConfigFileSchema = object({
-  provider: _enum(Object.values(KNOWN_SSO_PROVIDERS)),
-  clientId: string2(),
-  clientSecret: string2(),
-  scope: string2().optional(),
-  discoveryUrl: string2().optional(),
-  tenantId: string2().optional(),
-  oktaDomain: string2().optional(),
-  authEndpoint: string2().optional(),
-  tokenEndpoint: string2().optional(),
-  userinfoEndpoint: string2().optional(),
-  jwksUri: string2().optional(),
-  ssoName: string2().optional()
-});
-async function loadSSOConfigFile(filePath) {
-  const resolved = resolve8(filePath);
-  const raw = await readJsonFile(resolved);
-  const result = SSOConfigFileSchema.safeParse(raw);
-  if (!result.success) {
-    throw new SchemaValidationError("Invalid SSO config file", result.error, filePath);
-  }
-  return result.data;
-}
-function mergeFileWithFlags(fileConfig, options) {
-  return {
-    provider: options.provider ?? fileConfig.provider,
-    clientId: options.clientId ?? fileConfig.clientId,
-    clientSecret: options.clientSecret ?? fileConfig.clientSecret,
-    clientSecretStdin: options.clientSecretStdin,
-    envFile: options.envFile,
-    scope: options.scope ?? fileConfig.scope,
-    discoveryUrl: options.discoveryUrl ?? fileConfig.discoveryUrl,
-    tenantId: options.tenantId ?? fileConfig.tenantId,
-    oktaDomain: options.oktaDomain ?? fileConfig.oktaDomain,
-    authEndpoint: options.authEndpoint ?? fileConfig.authEndpoint,
-    tokenEndpoint: options.tokenEndpoint ?? fileConfig.tokenEndpoint,
-    userinfoEndpoint: options.userinfoEndpoint ?? fileConfig.userinfoEndpoint,
-    jwksUri: options.jwksUri ?? fileConfig.jwksUri,
-    ssoName: options.ssoName ?? fileConfig.ssoName
-  };
-}
-var providerNames = Object.keys(KNOWN_SSO_PROVIDERS);
-var SECRET_KEY_TO_FLAG = {
-  ["sso_name" /* Name */]: "--sso-name",
-  ["sso_client_id" /* ClientId */]: "--client-id",
-  ["sso_client_secret" /* ClientSecret */]: "--client-secret",
-  ["sso_scope" /* Scope */]: "--scope",
-  ["sso_discovery_url" /* DiscoveryUrl */]: "--discovery-url",
-  ["sso_tenant_id" /* TenantId */]: "--tenant-id",
-  ["sso_auth_endpoint" /* AuthEndpoint */]: "--auth-endpoint",
-  ["sso_token_endpoint" /* TokenEndpoint */]: "--token-endpoint",
-  ["sso_userinfo_endpoint" /* UserinfoEndpoint */]: "--userinfo-endpoint",
-  ["sso_okta_domain" /* OktaDomain */]: "--okta-domain",
-  ["sso_jwks_uri" /* JwksUri */]: "--jwks-uri"
-};
-function secretKeyToFlag(key) {
-  return SECRET_KEY_TO_FLAG[key];
-}
-function exampleCommand(provider) {
-  let cmd = `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`;
-  if (provider === KNOWN_SSO_PROVIDERS.microsoft)
-    cmd += " --tenant-id <id>";
-  if (provider === KNOWN_SSO_PROVIDERS.okta)
-    cmd += " --okta-domain <domain>";
-  if (provider === KNOWN_SSO_PROVIDERS.custom)
-    cmd += " --sso-name <name> --auth-endpoint <url> --token-endpoint <url> --userinfo-endpoint <url> --jwks-uri <url>";
-  return cmd;
-}
-function validateProvider(provider) {
-  if (!provider) {
-    throw new InvalidInputError("Missing --provider.", {
-      hints: [
-        {
-          message: `Valid providers: ${providerNames.join(", ")}`,
-          command: "base44 auth sso enable --provider <provider> --client-id <id> --client-secret <secret>"
-        }
-      ]
-    });
-  }
-  return provider;
-}
-async function ssoEnableAction({ isNonInteractive, runTask }, options) {
-  if (options.file && options.envFile) {
-    throw new InvalidInputError("--file and --env-file cannot be used together. Provide the client secret either inside --file or via --env-file.");
-  }
-  let merged = options;
-  if (options.file) {
-    const fileConfig = await loadSSOConfigFile(options.file);
-    merged = mergeFileWithFlags(fileConfig, options);
-  }
-  const provider = validateProvider(merged.provider);
-  if (!merged.clientId) {
-    throw new InvalidInputError("Missing --client-id.", {
-      hints: [
-        {
-          message: `Example: base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
-          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
-        }
-      ]
-    });
-  }
-  let clientSecret;
-  if (merged.envFile && !merged.clientSecret) {
-    const secrets = await parseEnvFile(resolve8(merged.envFile));
-    const value = secrets.sso_client_secret;
-    if (!value) {
-      throw new InvalidInputError(`Key "sso_client_secret" not found in ${merged.envFile}.`);
-    }
-    clientSecret = value;
-  } else {
-    clientSecret = await resolveSecret({
-      flagValue: merged.clientSecret,
-      fromStdin: merged.clientSecretStdin,
-      envVar: "sso_client_secret",
-      promptMessage: "Enter SSO client secret",
-      isNonInteractive,
-      name: "client secret",
-      hints: [
-        {
-          message: `Provide via flag:   base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
-          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
-        },
-        {
-          message: `Provide via stdin:  echo <secret> | base44 auth sso enable --provider ${provider} --client-id <id> --client-secret-stdin`
-        },
-        {
-          message: `Provide via env:    sso_client_secret=<secret> base44 auth sso enable --provider ${provider} --client-id <id>`
-        }
-      ]
-    });
-  }
-  const secretOptions = {
-    clientId: merged.clientId,
-    clientSecret,
-    scope: merged.scope,
-    discoveryUrl: merged.discoveryUrl,
-    tenantId: merged.tenantId,
-    oktaDomain: merged.oktaDomain,
-    authEndpoint: merged.authEndpoint,
-    tokenEndpoint: merged.tokenEndpoint,
-    userinfoEndpoint: merged.userinfoEndpoint,
-    jwksUri: merged.jwksUri,
-    ssoName: merged.ssoName
-  };
-  let secrets;
-  try {
-    secrets = buildSSOSecrets(provider, secretOptions);
-  } catch (error) {
-    if (error instanceof MissingSSOFieldsError) {
-      const flagNames = error.missingKeys.map(secretKeyToFlag);
-      throw new InvalidInputError(`Missing required fields for ${error.provider}: ${flagNames.join(", ")}`, {
-        hints: [
-          {
-            message: `Example: ${exampleCommand(provider)}`,
-            command: exampleCommand(provider)
-          }
-        ]
-      });
-    }
-    throw error;
-  }
-  const { project } = await readProjectConfig();
-  const configDir = dirname18(project.configPath);
-  const authDir = join25(configDir, project.authDir);
-  await runTask("Updating local auth config", async () => updateSSOConfig(authDir, provider, true));
-  await runTask("Saving SSO credentials", async () => pushSSOSecrets(secrets));
-  return {
-    outroMessage: `SSO configured with ${provider} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
-  };
-}
-function hasEnableOnlyOptions(options) {
-  return Boolean(options.provider || options.clientId || options.clientSecret || options.clientSecretStdin || options.envFile || options.file || options.scope || options.discoveryUrl || options.tenantId || options.oktaDomain || options.authEndpoint || options.tokenEndpoint || options.userinfoEndpoint || options.jwksUri || options.ssoName);
-}
-async function ssoDisableAction({ log, runTask }, options) {
-  if (hasEnableOnlyOptions(options)) {
-    throw new InvalidInputError("Configuration options cannot be used with disable. To disable SSO: base44 auth sso disable");
-  }
-  const { project } = await readProjectConfig();
-  const configDir = dirname18(project.configPath);
-  const authDir = join25(configDir, project.authDir);
-  const updated = await runTask("Updating local auth config", async () => updateSSOConfig(authDir, null, false));
-  await runTask("Removing SSO credentials", async () => deleteSSOSecrets());
-  if (!hasAnyLoginMethod(updated)) {
-    log.warn("Disabling SSO will leave no login methods enabled. Users will be locked out.");
-  }
-  return {
-    outroMessage: "SSO disabled in local config and credentials removed. Run `base44 auth push` or `base44 deploy` to apply."
-  };
-}
-async function ssoAction(context, action, options) {
-  if (action === "disable") {
-    return ssoDisableAction(context, options);
-  }
-  return ssoEnableAction(context, options);
-}
-function getSSOCommand() {
-  return new Base44Command("sso").description("Configure SSO identity provider (google, microsoft, github, okta, custom). SSO and social login are mutually exclusive — enabling one disables the other in the local auth config.").addArgument(new Argument2("<action>", "enable or disable SSO").choices([
-    "enable",
-    "disable"
-  ])).addOption(new Option2("--provider <provider>", "SSO provider").choices(Object.values(KNOWN_SSO_PROVIDERS))).option("--client-id <id>", "OAuth client ID").option("--client-secret <secret>", "OAuth client secret").option("--client-secret-stdin", "Read client secret from stdin").option("--env-file <path>", "Read client secret from a .env file (key: sso_client_secret)").option("--file <path>", "JSON config file with all SSO settings").option("--scope <scope>", "OAuth scope (defaults per provider)").option("--discovery-url <url>", "OIDC discovery URL").option("--tenant-id <id>", "Microsoft tenant ID (required for microsoft)").option("--okta-domain <domain>", "Okta domain (required for okta)").option("--auth-endpoint <url>", "Authorization endpoint (required for custom)").option("--token-endpoint <url>", "Token endpoint (required for custom)").option("--userinfo-endpoint <url>", "Userinfo endpoint (required for custom)").option("--jwks-uri <url>", "JWKS URI (required for custom)").option("--sso-name <name>", "Provider display name (required for custom)").action(ssoAction);
-}
-
-// src/cli/commands/auth/index.ts
-function getAuthCommand() {
-  return new Command2("auth").description("Manage app authentication settings").addCommand(getPasswordLoginCommand()).addCommand(getSocialLoginCommand()).addCommand(getSSOCommand()).addCommand(getAuthPullCommand()).addCommand(getAuthPushCommand());
-}
-
-// src/cli/commands/auth/login.ts
-function getLoginCommand() {
-  return new Base44Command("login", {
-    requireAuth: false,
-    requireAppContext: false
-  }).description("Authenticate with Base44").action(login);
-}
-
-// src/cli/commands/auth/logout.ts
-async function logout(_ctx) {
-  await deleteAuth();
-  return { outroMessage: "Logged out successfully" };
-}
-function getLogoutCommand() {
-  return new Base44Command("logout", {
-    requireAuth: false,
-    requireAppContext: false
-  }).description("Logout from current device").action(logout);
-}
-
-// src/cli/commands/auth/whoami.ts
-async function whoami(_ctx) {
-  const workspaceApiKey = getWorkspaceApiKeyFromEnv();
-  if (workspaceApiKey && isWorkspaceApiKey(workspaceApiKey)) {
-    return {
-      outroMessage: `Using workspace API key: ${theme.styles.bold(workspaceApiKey.slice(0, 10))}`
-    };
-  }
-  const auth = await readAuth();
-  return { outroMessage: `Logged in as: ${theme.styles.bold(auth.email)}` };
-}
-function getWhoamiCommand() {
-  return new Base44Command("whoami", { requireAppContext: false }).description("Display current authenticated user").action(whoami);
-}
-
-// src/cli/commands/branches/index.ts
-async function listBranchesAction({
-  log,
-  runTask,
-  jsonMode
-}) {
-  const remote = await runTask("Fetching branches", () => listBranches());
-  const branches = [
-    { name: "main", status: "active" },
-    ...remote.map((branch) => ({
-      name: branch.branch_name,
-      status: branch.status
-    }))
-  ];
-  if (jsonMode)
-    return { stdout: `${JSON.stringify({ branches })}
-` };
-  for (const branch of branches)
-    log.message(`${branch.name} (${branch.status})`);
-  return { outroMessage: `${branches.length} branches` };
-}
-function getBranchesCommand() {
-  return new Command2("branches").description("Discover an app's branches").addCommand(new Base44Command("list").description("List main and active branch names for use with --branch").action(listBranchesAction));
+// src/cli/commands/builder/index.ts
+function getBuilderCommand() {
+  return new Command2("builder").description("Build an app with the Base44 builder agent, non-interactively: create it, send turns, read status, stop, pick the model").addCommand(getNewCommand()).addCommand(getSendCommand()).addCommand(getStatusCommand()).addCommand(getStopCommand()).addCommand(getModelCommand());
 }
 
 // ../../node_modules/ink/build/render.js
@@ -275870,6 +276028,119 @@ var build_default = TextInput;
 // src/cli/commands/code/session.tsx
 var import_react23 = __toESM(require_react(), 1);
 
+// src/cli/commands/code/logo.ts
+var ROWS = 6;
+var ASPECT = 0.44;
+var SAMPLES = 4;
+var FILL = 0.6;
+var GAP_ROW = 3.5 + 0.5;
+var GAP_HEIGHT_ROWS = 0.8;
+var LOGO_COLS = Math.max(2, Math.floor(ROWS / ASPECT + 0.5));
+var OCTANT = {
+  rx: 2,
+  ry: 4,
+  table: Array.from("   \uD83E\uDF82\uD833\uDD00▘\uD833\uDD01\uD833\uDD02\uD833\uDD03\uD833\uDD04▝\uD833\uDD05\uD833\uDD06\uD833\uDD07\uD833\uDD08▀\uD833\uDD09\uD833\uDD0A\uD833\uDD0B\uD833\uDD0C\uD833\uDD00\uD833\uDD0D\uD833\uDD0E\uD833\uDD0F\uD833\uDD10\uD833\uDD11\uD833\uDD12\uD833\uDD13\uD833\uDD14\uD833\uDD15\uD833\uDD16\uD833\uDD17\uD833\uDD18\uD833\uDD19\uD833\uDD1A\uD833\uDD1B\uD833\uDD1C\uD833\uDD1D\uD833\uDD1E\uD833\uDD1F\uD833\uDD03\uD833\uDD20\uD833\uDD21\uD833\uDD22\uD833\uDD23\uD833\uDD24\uD833\uDD25\uD833\uDD26\uD833\uDD27\uD833\uDD28\uD833\uDD29\uD833\uDD2A\uD833\uDD2B\uD833\uDD2C\uD833\uDD2D\uD833\uDD2E\uD833\uDD2F\uD833\uDD30\uD833\uDD31\uD833\uDD32\uD833\uDD33\uD833\uDD34\uD833\uDD35\uD83E\uDF85 \uD833\uDD36\uD833\uDD37\uD833\uDD38\uD833\uDD39\uD833\uDD3A\uD833\uDD3B\uD833\uDD3C\uD833\uDD3D\uD833\uDD3E\uD833\uDD3F\uD833\uDD40\uD833\uDD41\uD833\uDD42\uD833\uDD43\uD833\uDD44▖\uD833\uDD45\uD833\uDD46\uD833\uDD47\uD833\uDD48▌\uD833\uDD49\uD833\uDD4A\uD833\uDD4B\uD833\uDD4C▞\uD833\uDD4D\uD833\uDD4E\uD833\uDD4F\uD833\uDD50▛\uD833\uDD51\uD833\uDD52\uD833\uDD53\uD833\uDD54\uD833\uDD55\uD833\uDD56\uD833\uDD57\uD833\uDD58\uD833\uDD59\uD833\uDD5A\uD833\uDD5B\uD833\uDD5C\uD833\uDD5D\uD833\uDD5E\uD833\uDD5F\uD833\uDD60\uD833\uDD61\uD833\uDD62\uD833\uDD63\uD833\uDD64\uD833\uDD65\uD833\uDD66\uD833\uDD67\uD833\uDD68\uD833\uDD69\uD833\uDD6A\uD833\uDD6B\uD833\uDD6C\uD833\uDD6D\uD833\uDD6E\uD833\uDD6F\uD833\uDD70 \uD833\uDD71\uD833\uDD72\uD833\uDD73\uD833\uDD74\uD833\uDD75\uD833\uDD76\uD833\uDD77\uD833\uDD78\uD833\uDD79\uD833\uDD7A\uD833\uDD7B\uD833\uDD7C\uD833\uDD7D\uD833\uDD7E\uD833\uDD7F\uD833\uDD80\uD833\uDD81\uD833\uDD82\uD833\uDD83\uD833\uDD84\uD833\uDD85\uD833\uDD86\uD833\uDD87\uD833\uDD88\uD833\uDD89\uD833\uDD8A\uD833\uDD8B\uD833\uDD8C\uD833\uDD8D\uD833\uDD8E\uD833\uDD8F▗\uD833\uDD90\uD833\uDD91\uD833\uDD92\uD833\uDD93▚\uD833\uDD94\uD833\uDD95\uD833\uDD96\uD833\uDD97▐\uD833\uDD98\uD833\uDD99\uD833\uDD9A\uD833\uDD9B▜\uD833\uDD9C\uD833\uDD9D\uD833\uDD9E\uD833\uDD9F\uD833\uDDA0\uD833\uDDA1\uD833\uDDA2\uD833\uDDA3\uD833\uDDA4\uD833\uDDA5\uD833\uDDA6\uD833\uDDA7\uD833\uDDA8\uD833\uDDA9\uD833\uDDAA\uD833\uDDAB▂\uD833\uDDAC\uD833\uDDAD\uD833\uDDAE\uD833\uDDAF\uD833\uDDB0\uD833\uDDB1\uD833\uDDB2\uD833\uDDB3\uD833\uDDB4\uD833\uDDB5\uD833\uDDB6\uD833\uDDB7\uD833\uDDB8\uD833\uDDB9\uD833\uDDBA\uD833\uDDBB\uD833\uDDBC\uD833\uDDBD\uD833\uDDBE\uD833\uDDBF\uD833\uDDC0\uD833\uDDC1\uD833\uDDC2\uD833\uDDC3\uD833\uDDC4\uD833\uDDC5\uD833\uDDC6\uD833\uDDC7\uD833\uDDC8\uD833\uDDC9\uD833\uDDCA\uD833\uDDCB\uD833\uDDCC\uD833\uDDCD\uD833\uDDCE\uD833\uDDCF\uD833\uDDD0\uD833\uDDD1\uD833\uDDD2\uD833\uDDD3\uD833\uDDD4\uD833\uDDD5\uD833\uDDD6\uD833\uDDD7\uD833\uDDD8\uD833\uDDD9\uD833\uDDDA▄\uD833\uDDDB\uD833\uDDDC\uD833\uDDDD\uD833\uDDDE▙\uD833\uDDDF\uD833\uDDE0\uD833\uDDE1\uD833\uDDE2▟\uD833\uDDE3▆\uD833\uDDE4\uD833\uDDE5█")
+};
+var QUAD = {
+  rx: 2,
+  ry: 2,
+  table: Array.from(" ▘▝▀▖▌▞▛▗▚▐▜▄▙▟█")
+};
+function detectTier(env = process.env) {
+  const term = env.TERM ?? "";
+  const prog = env.TERM_PROGRAM ?? "";
+  if (prog === "ghostty" || term.includes("ghostty"))
+    return "octant";
+  if (env.KITTY_WINDOW_ID || term.includes("kitty"))
+    return "octant";
+  if (env.WEZTERM_PANE || env.WEZTERM_EXECUTABLE)
+    return "octant";
+  if (term.startsWith("foot") || prog === "contour")
+    return "octant";
+  return "quad";
+}
+function coverageGrid(rows, cols, aspect, pixelH) {
+  const worldH = rows * pixelH;
+  const worldW = cols * aspect;
+  const radius = Math.min(worldH, worldW) / 2;
+  const cx = worldW / 2;
+  const cy = worldH / 2;
+  const step = 1 / SAMPLES;
+  const grid = [];
+  for (let py = 0;py < rows; py++) {
+    const y0 = py * pixelH;
+    const y1 = y0 + pixelH;
+    const dyLo = y0 <= cy && cy <= y1 ? 0 : Math.min(Math.abs(y0 - cy), Math.abs(y1 - cy));
+    const dyHi = Math.max(Math.abs(y0 - cy), Math.abs(y1 - cy));
+    const line = [];
+    for (let px = 0;px < cols; px++) {
+      const x0 = px * aspect;
+      const x1 = x0 + aspect;
+      const dxLo = x0 <= cx && cx <= x1 ? 0 : Math.min(Math.abs(x0 - cx), Math.abs(x1 - cx));
+      const dxHi = Math.max(Math.abs(x0 - cx), Math.abs(x1 - cx));
+      if (Math.hypot(dxLo, dyLo) >= radius) {
+        line.push(0);
+        continue;
+      }
+      if (Math.hypot(dxHi, dyHi) <= radius) {
+        line.push(1);
+        continue;
+      }
+      let hits = 0;
+      for (let j = 0;j < SAMPLES; j++) {
+        const dy = y0 + (j + 0.5) * step * pixelH - cy;
+        for (let i = 0;i < SAMPLES; i++) {
+          const dx = x0 + (i + 0.5) * step * aspect - cx;
+          if (Math.hypot(dx, dy) <= radius)
+            hits++;
+        }
+      }
+      line.push(hits / (SAMPLES * SAMPLES));
+    }
+    grid.push(line);
+  }
+  return grid;
+}
+function carveGap(grid, ry) {
+  const n = grid.length;
+  const thick = Math.max(1, Math.round(GAP_HEIGHT_ROWS * ry));
+  const centre = GAP_ROW >= 0 ? GAP_ROW * ry : n + GAP_ROW * ry;
+  const start = Math.max(0, Math.min(n - thick, centre - thick / 2));
+  for (let i = Math.trunc(start);i < Math.trunc(start + thick); i++) {
+    grid[i].fill(0);
+  }
+}
+function logoRows(color, tier = detectTier()) {
+  const { rx, ry, table } = tier === "octant" ? OCTANT : QUAD;
+  const grid = coverageGrid(ROWS * ry, LOGO_COLS * rx, ASPECT / rx, 1 / ry);
+  carveGap(grid, ry);
+  const fg = color ? source_default.hex(color) : (s) => s;
+  const bg = color ? source_default.bgHex(color) : (s) => s;
+  const full = (1 << rx * ry) - 1;
+  const out = [];
+  for (let r = 0;r < ROWS; r++) {
+    let row = "";
+    for (let c = 0;c < LOGO_COLS; c++) {
+      let mask = 0;
+      for (let sr = 0;sr < ry; sr++) {
+        for (let sc = 0;sc < rx; sc++) {
+          if (grid[r * ry + sr][c * rx + sc] >= FILL)
+            mask |= 1 << sr * rx + sc;
+        }
+      }
+      const glyph = table[mask];
+      if (glyph === " ")
+        row += " ";
+      else if (mask === full && color)
+        row += bg(" ");
+      else
+        row += fg(glyph);
+    }
+    out.push(row);
+  }
+  return out;
+}
+
 // src/cli/commands/code/paste.ts
 import { PassThrough as PassThrough3 } from "node:stream";
 var START = "\x1B[200~";
@@ -276013,14 +276284,17 @@ function createSessionEngine(options) {
             });
             continue;
           }
-          let elapsedMs;
           if (event.kind === "tool_end") {
             const started = running.get(event.id)?.startedAt;
-            if (started != null)
-              elapsedMs = Date.now() - started;
             running.delete(event.id);
+            lastEventAt = Date.now();
+            options.onLine({
+              event,
+              elapsedMs: started != null ? Date.now() - started : undefined
+            });
+            continue;
           }
-          const line = eventLine(event, elapsedMs);
+          const line = eventLine(event);
           if (line != null) {
             lastEventAt = Date.now();
             options.onLine(line);
@@ -276170,6 +276444,7 @@ function statusText(status, musingSeed) {
 function SessionView({ engine, footer, subscribe }) {
   const { exit } = use_app_default();
   const [items, setItems] = import_react23.useState([]);
+  const [verbose, setVerbose] = import_react23.useState(false);
   const [input, setInput] = import_react23.useState("");
   const [scroll, setScroll] = import_react23.useState(0);
   const [, tick] = import_react23.useReducer((x) => x + 1, 0);
@@ -276178,10 +276453,8 @@ function SessionView({ engine, footer, subscribe }) {
   const [pickerIndex, setPickerIndex] = import_react23.useState(null);
   const maxScrollRef = import_react23.useRef(0);
   const meIdRef = import_react23.useRef(null);
-  const emit = (line) => setItems((h) => [...h, `${line}
-`]);
-  import_react23.useEffect(() => subscribe((line) => setItems((h) => [...h, `${line}
-`])), [subscribe]);
+  const emit = (entry) => setItems((h) => [...h, entry]);
+  import_react23.useEffect(() => subscribe((entry) => setItems((h) => [...h, entry])), [subscribe]);
   import_react23.useEffect(() => {
     const timer = setInterval(tick, 120);
     return () => clearInterval(timer);
@@ -276249,6 +276522,10 @@ function SessionView({ engine, footer, subscribe }) {
       exit();
       return;
     }
+    if (key.ctrl && char === "o") {
+      setVerbose((v) => !v);
+      return;
+    }
     if (key.upArrow) {
       setScroll((s) => Math.min(s + 3, maxScrollRef.current));
       return;
@@ -276274,14 +276551,15 @@ function SessionView({ engine, footer, subscribe }) {
   });
   const columns = process.stdout.columns || 80;
   const rows = process.stdout.rows || 24;
-  const width = Math.min(columns, 100);
+  const width = columns;
   const innerWidth = Math.max(10, width - 4);
   const inputRows = Math.max(1, Math.ceil((input.length + 3) / innerWidth));
   const pickerOpen = pickerIndex !== null;
   const inputBlockHeight = pickerOpen ? MODELS.length + 3 : inputRows + 2;
   const widgetHeight = inputBlockHeight + 3 + (footer.length ? 1 : 0);
   const viewHeight = Math.max(3, rows - widgetHeight - 1);
-  const lines = items.flatMap((item) => hardWrapAnsi(item, columns));
+  const lines = items.flatMap((item) => hardWrapAnsi(`${renderEntry(item, { verbose, foldHint: "Ctrl+O to expand" })}
+`, columns));
   const maxScroll = Math.max(0, lines.length - viewHeight);
   maxScrollRef.current = maxScroll;
   const clamped = Math.min(scroll, maxScroll);
@@ -276364,48 +276642,16 @@ function SessionView({ engine, footer, subscribe }) {
       /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
         dimColor: true,
         wrap: "truncate-end",
-        children: pickerOpen ? "  ↑↓ to move · Enter to select · Esc to cancel" : engine.turnRunning() ? "  Esc to stop · type to queue · scroll to read · Ctrl+C to exit" : "  Enter to send · /model to switch model · Esc for live · Ctrl+C to exit"
+        children: pickerOpen ? "  ↑↓ to move · Enter to select · Esc to cancel" : engine.turnRunning() ? "  Esc to stop · type to queue · scroll to read · Ctrl+O to expand · Ctrl+C to exit" : "  Enter to send · /model to switch model · Esc for live · Ctrl+O to expand · Ctrl+C to exit"
       }, undefined, false, undefined, this)
     ]
   }, undefined, true, undefined, this);
 }
-var LOGO_ROWS = 6;
-var LOGO_GAP_SUBROW = 8;
-var QUAD = " ▘▝▀▖▌▞▛▗▚▐▜▄▙▟█";
-function buildLogoRows() {
-  const sy = 2 * LOGO_ROWS;
-  const sx = 2 * sy;
-  const cx = (sx - 1) / 2;
-  const cy = (sy - 1) / 2;
-  const rad = sy / 2 - 0.5;
-  const on = (px, py) => {
-    if (py === LOGO_GAP_SUBROW)
-      return false;
-    const dx = (px - cx) * 0.5;
-    const dy = py - cy;
-    return dx * dx + dy * dy <= rad * rad;
-  };
-  const rows = [];
-  for (let ty = 0;ty < sy; ty += 2) {
-    let row = "";
-    for (let tx = 0;tx < sx; tx += 2) {
-      const bits = (on(tx, ty) ? 1 : 0) | (on(tx + 1, ty) ? 2 : 0) | (on(tx, ty + 1) ? 4 : 0) | (on(tx + 1, ty + 1) ? 8 : 0);
-      row += QUAD[bits];
-    }
-    rows.push(row.trim());
-  }
-  return rows.map((row) => row.trim());
-}
 function renderHeader(who, mode) {
   const orange = source_default.hex(BRAND_ORANGE);
   const cwd = process.cwd().replace(process.env.HOME ?? "", "~");
-  const logo = buildLogoRows();
-  const logoW = Math.max(...logo.map((r) => r.length));
-  const center = (s) => {
-    const total = Math.max(0, logoW - s.length);
-    const left = Math.floor(total / 2);
-    return " ".repeat(left) + s + " ".repeat(total - left);
-  };
+  const logo = logoRows(BRAND_ORANGE);
+  const logoW = LOGO_COLS;
   const text = [
     `${orange.bold("Base44 Code")} ${source_default.dim(`v${package_default.version}`)}`,
     source_default.bold(who ? `Welcome back, ${who}!` : "Welcome!"),
@@ -276417,7 +276663,7 @@ function renderHeader(who, mode) {
   const textTop = Math.max(0, Math.floor((logo.length - text.length) / 2));
   const out = [];
   for (let i = 0;i < height; i++) {
-    const left = i < logo.length ? orange(center(logo[i])) : " ".repeat(logoW);
+    const left = i < logo.length ? logo[i] : " ".repeat(logoW);
     const right = text[i - textTop] ?? "";
     out.push(`  ${left}   ${right}`.trimEnd());
   }
@@ -276646,42 +276892,48 @@ async function bootstrapApp(prompt, footer, emit, onCreated, importRepo, path) {
     }
   };
 }
-async function codeAction({ log }, options) {
+async function codeAction({ log }, options, appId) {
+  const orange = source_default.hex(BRAND_ORANGE2);
+  const chip = (label) => source_default.dim(`${orange("●")} ${label}`);
   if (process.stdout.isTTY !== true) {
     throw new InvalidInputError("base44 code is an interactive session and needs a terminal.");
   }
   let linked = false;
   try {
-    await initAppContext();
+    await initAppContext(appId ? { appId } : {});
     linked = true;
   } catch {}
   if (linked) {
     if (options.import || options.path) {
-      throw new InvalidInputError("--import and --path create a new app; run them outside a linked project.");
+      throw new InvalidInputError("--import and --path create a new app; run them outside a linked project, without --app-id.");
     }
+    const { id, projectRoot } = getAppContext();
+    const state = await assertBuilderApp(id);
     const branchId = await resolveActiveBranchId().catch(() => {
       return;
     });
     await runInteractiveSession({
       branchId,
-      footer: [],
+      footer: [chip(appTypeChip(state))],
       primeFirstPoll: true,
       idleHint: "what should the agent do next?"
     });
-    log.message(source_default.dim(`app dir  ${getAppContext().projectRoot}`));
+    if (projectRoot) {
+      log.message(source_default.dim(`app dir  ${projectRoot}`));
+      return {
+        outroMessage: "Session closed. Run `base44 code` here to resume."
+      };
+    }
     return {
-      outroMessage: "Session closed. Run `base44 code` here to resume."
+      outroMessage: `Session closed. Resume with \`base44 code --app-id ${id}\`.`
     };
   }
   let created;
-  const orange = source_default.hex(BRAND_ORANGE2);
-  const footer = [
-    source_default.dim(`${orange("●")} ${options.import ? "import" : "builder"}`)
-  ];
+  const footer = [chip(options.import ? repoLabel(options.import) : "web app")];
   await runGenesisSession({
-    idleHint: options.import ? "describe what to build over the repo" : "describe the app you want to build",
+    idleHint: options.import ? "describe what to build over the repository" : "describe the app you want to build  ·  have one already? base44 code --app-id <id>, or base44 link",
     creatingLabel: options.import ? "importing the repository" : "creating your app",
-    modeLabel: options.import ? `Import — ${options.import}` : "Builder — Base44 template + agent",
+    modeLabel: options.import ? `Repository — ${repoLabel(options.import)}` : "Web app — Base44 template + builder agent",
     footer,
     createApp: (prompt, emit) => bootstrapApp(prompt, footer, emit, (app) => {
       created = app;
@@ -276697,7 +276949,7 @@ async function codeAction({ log }, options) {
 }
 function getCodeCommand() {
   const command = new Base44Command("code", { requireAppContext: false });
-  command.description("Open Base44 Code: an interactive agent session — in an empty directory your first prompt creates the app (add --import <repo> to build over an existing repository)").option("--import <repo>", "Build over an existing GitHub repository instead of the Base44 template").option("--path <dir>", "Directory to link the new app to (default: the current directory when empty, else ./<name>)").action(codeAction);
+  command.description("Open Base44 Code, an interactive builder session. In a linked directory (or with --app-id <id>) it opens that app; anywhere else your first prompt creates one (--import <repo> to build over your own repository). Attach a directory to an existing app with base44 link.").option("--import <repo>", "Build over an existing GitHub repository instead of the Base44 template").option("--path <dir>", "Directory to link the new app to (default: the current directory when empty, else ./<name>)").action((ctx, options) => codeAction(ctx, options, command.optsWithGlobals().appId));
   return command;
 }
 
@@ -279209,6 +279461,21 @@ function getSandboxListDirectoryCommand() {
   return new Base44Command("ls", { supportsBranch: true }).description("List directory entries in an app's remote sandbox").argument("[path]", "Directory relative to the app root (default: app root)").option("--recursive", "List nested entries").option("--max-depth <n>", "Max depth when recursive (1-10, default 3)").option("--include-hidden", "Include dotfiles").action(listDirectoryAction);
 }
 
+// src/cli/commands/sandbox/preview.ts
+async function previewAction(ctx) {
+  const url = await ctx.runTask("Resolving preview URL (boots the sandbox if needed)", () => getPreviewUrl());
+  if (ctx.jsonMode)
+    return { stdout: `${JSON.stringify({ preview_url: url })}
+` };
+  ctx.log.message(url);
+  return { outroMessage: "Preview is live." };
+}
+function getSandboxPreviewCommand() {
+  const command = new Base44Command("preview");
+  command.description("Print the app's live preview URL").action(previewAction);
+  return command;
+}
+
 // src/cli/commands/sandbox/read-file.ts
 async function readFileAction({ runTask, branchId }, paths, options) {
   const { id: appId } = getAppContext();
@@ -279262,7 +279529,7 @@ Examples:
 
 // src/cli/commands/sandbox/index.ts
 function getSandboxCommand() {
-  return new Command2("sandbox").description("Develop an app remotely via its server-side sandbox").addCommand(getSandboxListDirectoryCommand()).addCommand(getSandboxReadFileCommand()).addCommand(getSandboxWriteFileCommand()).addCommand(getSandboxEditFileCommand()).addCommand(getSandboxGrepCommand()).addCommand(getSandboxRunCommandCommand()).addCommand(getSandboxCheckpointCommand());
+  return new Command2("sandbox").description("Develop an app remotely via its server-side sandbox").addCommand(getSandboxListDirectoryCommand()).addCommand(getSandboxReadFileCommand()).addCommand(getSandboxWriteFileCommand()).addCommand(getSandboxEditFileCommand()).addCommand(getSandboxGrepCommand()).addCommand(getSandboxRunCommandCommand()).addCommand(getSandboxCheckpointCommand()).addCommand(getSandboxPreviewCommand());
 }
 
 // src/cli/commands/secrets/delete.ts
@@ -284289,7 +284556,7 @@ function createProgram(context) {
   program.addCommand(getSecretsCommand());
   program.addCommand(getSandboxCommand());
   program.addCommand(getBranchesCommand());
-  program.addCommand(getAppCommand());
+  program.addCommand(getBuilderCommand());
   program.addCommand(getCodeCommand());
   program.addCommand(getAuthCommand());
   program.addCommand(getSiteCommand());
@@ -288344,4 +288611,4 @@ export {
   runCLI
 };
 
-//# debugId=B1E2B3DFB2501EB964756E2164756E21
+//# debugId=0D34292BC79AD42A64756E2164756E21