@base44-preview/cli 0.1.15-pr.630.ab1ebad → 0.1.15-pr.630.b3bc283

package/dist/cli/index.js

@@ -49330,9 +49330,9 @@ var require_websocket_server = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/ws/wrapper.mjs
-var import_stream5, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket, import_websocket_server, wrapper_default;
+var import_stream6, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket, import_websocket_server, wrapper_default;
 var init_wrapper = __esm(() => {
-  import_stream5 = __toESM(require_stream5(), 1);
+  import_stream6 = __toESM(require_stream5(), 1);
   import_extension = __toESM(require_extension(), 1);
   import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
   import_receiver = __toESM(require_receiver(), 1);
@@ -142409,7 +142409,7 @@ function parse42(toml, { maxDepth = 1000, integersAsBigInt } = {}) {
   }
   return res;
 }
-async function readFile5(file) {
+async function readFile6(file) {
   if (isUrlString(file)) {
     file = new URL(file);
   }
@@ -156203,7 +156203,7 @@ ${codeblock}`, options8);
     "\\": "\\"
   };
   KEY_PART_RE = /^[a-zA-Z0-9-_]+[ \t]*$/;
-  read_file_default = readFile5;
+  read_file_default = readFile6;
   loadConfigFromPackageJson = process.versions.bun ? async function loadConfigFromBunPackageJson(file) {
     const { prettier } = await readBunPackageJson(file);
     return prettier;
@@ -268401,6 +268401,10 @@ async function captureRequestBody(request, options) {
   if (request.body == null) {
     return;
   }
+  if (options.context.__redactBody) {
+    options.context.__requestBody = "[redacted]";
+    return;
+  }
   try {
     const cloned = request.clone();
     const text = await cloned.text();
@@ -269956,7 +269960,7 @@ async function saveBuilderModel(userId, modelId) {
     });
   } catch (error) {
     if (error instanceof HTTPError && error.response.status === 400) {
-      throw new InvalidInputError("This account can't pick a builder model yet — enable the PER_USER_BUILDER_MODEL_SELECTION flag for it in PostHog, or the model isn't available in this workspace.");
+      throw new InvalidInputError("This account can't pick a builder model yet, or the model isn't available in this workspace. Ask your workspace admin to enable model selection.");
     }
     throw await ApiError.fromHttpError(error, "saving your model choice");
   }
@@ -270006,7 +270010,7 @@ function getModelCommand() {
 }
 
 // src/cli/commands/builder/shared.ts
-import { mkdir as mkdir3, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
 import { basename as basename6, join as join25, relative as relative6, resolve as resolve8 } from "node:path";
 
 // src/cli/commands/code/render.ts
@@ -270155,7 +270159,7 @@ function eventLine(event, elapsedMs, options = {}) {
       return null;
     case "waiting": {
       const what = event.label || toolAlias(event.name);
-      return source_default.yellow(`⏸ ${what} — needs your input (answer in the editor)`);
+      return source_default.yellow(`⏸ ${what} — needs your input (${options.waitingHint ?? "answer in the editor"})`);
     }
     case "tool_end": {
       const alias = toolAlias(event.name);
@@ -270204,6 +270208,14 @@ ${indent(shown)}`;
   }
 }
 var FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+var SHIMMER = ["·", "✢", "✳", "✶", "✻", "✽"];
+var SHIMMER_STEP_MS = 120;
+function shimmer(now = Date.now()) {
+  const period = SHIMMER.length * 2 - 2;
+  const step = Math.floor(now / SHIMMER_STEP_MS) % period;
+  const index = step < SHIMMER.length ? step : period - step;
+  return SHIMMER[index];
+}
 var MUSINGS = [
   "Shmoozing",
   "Shmoogling",
@@ -270267,7 +270279,7 @@ function createTurnStream(interactive, write = (text) => process.stdout.write(te
       return;
     const lines = [
       ...footer.length ? ["", ...footer] : [],
-      source_default.dim(`${FRAMES[frame]} ${statusLabel()}`)
+      running.size === 0 ? `${source_default.magenta(shimmer())} ${source_default.dim(statusLabel())}` : source_default.dim(`${FRAMES[frame]} ${statusLabel()}`)
     ];
     write(lines.join(`
 `));
@@ -270386,7 +270398,8 @@ var ConversationMessageSchema = object({
     name: string2(),
     arguments_string: string2().nullish(),
     status: string2().nullish(),
-    results: unknown().nullish()
+    results: unknown().nullish(),
+    waiting_on: object({ kind: string2().nullish() }).nullish()
   })).nullish()
 });
 var FullConversationSchema = object({
@@ -270408,6 +270421,7 @@ async function createWixLaunchedApp(options) {
   try {
     response = await base44Client.post("api/wix/create-app", {
       timeout: false,
+      context: { __redactBody: true },
       json: {
         prompt: options.prompt,
         signed_instance: options.signedInstance,
@@ -270477,6 +270491,25 @@ async function getAppState(appId) {
   }
   return parseOrThrow(AppStateSchema, await response.json(), "app status");
 }
+async function answerToolCall(options, branchId) {
+  let response;
+  try {
+    response = await getAppClient().post("chat/submit-tool-call-input", {
+      timeout: false,
+      context: { __redactBody: true },
+      searchParams: branchScope(branchId),
+      json: {
+        tool_call_id: options.toolCallId,
+        action: options.action,
+        extra_user_input: options.input ?? {},
+        ...options.messageId ? { message_id: options.messageId } : {}
+      }
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "answering the agent");
+  }
+  return parseOrThrow(ChatTurnSchema, await response.json(), "chat turn");
+}
 async function sendTurn(content, branchId) {
   let response;
   try {
@@ -270531,6 +270564,234 @@ async function getPreviewUrl() {
   return /^https?:\/\//.test(url) ? url : `https://${url}`;
 }
 
+// src/core/resources/apps/pending.ts
+var CHOICE_TOOLS = new Set([
+  "ask_clarifying_questions",
+  "ask_plan_questions"
+]);
+var SECRET_TOOLS = new Set(["set_secrets"]);
+var LIST_CHOICE_TOOLS = {
+  select_payment_provider: {
+    key: "providers",
+    question: "Which payment provider?",
+    answer: "provider"
+  }
+};
+var PERMISSION_TOOLS = new Set(["request_agent_tool_permissions"]);
+var CREDENTIALS_TOOLS = new Set(["register_workspace_connector"]);
+var BROWSER_TOOLS = new Set([
+  "connect_github_account",
+  "request_oauth_authorization",
+  "configure_psp_credentials",
+  "plaid_connect"
+]);
+var str2 = (v) => typeof v === "string" && v.trim() ? v.trim() : undefined;
+function parseArgs(raw) {
+  try {
+    const parsed = JSON.parse(raw ?? "");
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function questionsFrom(args) {
+  const raw = Array.isArray(args.questions) ? args.questions : [];
+  return raw.flatMap((q) => {
+    if (!q || typeof q !== "object")
+      return [];
+    const item = q;
+    const question = str2(item.question);
+    if (!question)
+      return [];
+    const options = (Array.isArray(item.options) ? item.options : []).flatMap((o) => {
+      const opt = o;
+      const label = str2(opt?.label);
+      return label ? [{ label, description: str2(opt.description) }] : [];
+    });
+    return [
+      {
+        question,
+        description: str2(item.description),
+        options,
+        multiSelect: item.multi_select === true
+      }
+    ];
+  });
+}
+function secretsFrom(args) {
+  const raw = Array.isArray(args.secrets_schema) ? args.secrets_schema : [];
+  return raw.flatMap((s) => {
+    const item = s;
+    const name = str2(item?.secretName) ?? str2(item?.name);
+    return name ? [{ name, description: str2(item.description) }] : [];
+  });
+}
+function permissionKey(row) {
+  switch (row.type) {
+    case "entity":
+      return row.entity_name ? `entity:${row.entity_name}` : null;
+    case "backend_function":
+      return row.function_name ? `backend_function:${row.function_name}` : null;
+    case "app_user_connector":
+      return row.connector_id ? `app_user_connector:${row.connector_id}` : null;
+    default:
+      return null;
+  }
+}
+function permissionsFrom(args) {
+  const raw = Array.isArray(args.requested_permissions) ? args.requested_permissions : [];
+  return raw.flatMap((r) => {
+    const row = r;
+    const key = permissionKey(row);
+    if (!key)
+      return [];
+    const ops = Array.isArray(row.allowed_operations) ? ` (${row.allowed_operations.join(", ")})` : "";
+    const target = str2(row.entity_name) ?? str2(row.function_name) ?? str2(row.connector_name) ?? key;
+    return [
+      { key, label: `${row.type}: ${target}${ops}`, reason: str2(row.reason) }
+    ];
+  });
+}
+function guardFrom(results) {
+  const value = typeof results === "string" ? (() => {
+    try {
+      return JSON.parse(results);
+    } catch {
+      return null;
+    }
+  })() : results;
+  if (!value || typeof value !== "object")
+    return null;
+  const g = value;
+  if (!str2(g.guard))
+    return null;
+  return { title: `${g.guard}: needs your approval`, detail: str2(g.reason) };
+}
+function humanize(tool) {
+  return tool.replace(/_/g, " ");
+}
+function pendingInputs(messages) {
+  const out = [];
+  for (const message of messages) {
+    for (const call of message.tool_calls ?? []) {
+      if (call.status !== "waiting_for_user_input")
+        continue;
+      const args = parseArgs(call.arguments_string);
+      const base = {
+        toolCallId: call.id,
+        messageId: message.id,
+        tool: call.name
+      };
+      const summary = str2(args.summary);
+      if (CHOICE_TOOLS.has(call.name)) {
+        out.push({
+          ...base,
+          kind: "choice",
+          title: summary ?? "The agent has a few questions",
+          questions: questionsFrom(args)
+        });
+      } else if (SECRET_TOOLS.has(call.name)) {
+        out.push({
+          ...base,
+          kind: "secrets",
+          title: summary ?? "The agent needs secrets",
+          secrets: secretsFrom(args)
+        });
+      } else if (PERMISSION_TOOLS.has(call.name)) {
+        out.push({
+          ...base,
+          kind: "permissions",
+          title: summary ?? "Grant the app's agent these permissions?",
+          detail: str2(args.reason),
+          permissions: permissionsFrom(args)
+        });
+      } else if (LIST_CHOICE_TOOLS[call.name]) {
+        const spec = LIST_CHOICE_TOOLS[call.name];
+        const raw = Array.isArray(args[spec.key]) ? args[spec.key] : [];
+        const options = raw.flatMap((o) => {
+          const label = typeof o === "string" ? o : str2(o?.label);
+          return label ? [{ label }] : [];
+        });
+        out.push({
+          ...base,
+          kind: "choice",
+          title: summary ?? spec.question,
+          detail: str2(args.reason),
+          questions: [{ question: spec.question, options, multiSelect: false }],
+          answerKey: spec.answer
+        });
+      } else if (CREDENTIALS_TOOLS.has(call.name)) {
+        const integration = str2(args.integration_type) ?? "connector";
+        out.push({
+          ...base,
+          kind: "credentials",
+          title: summary ?? `Register ${integration} credentials for this workspace`,
+          detail: str2(args.description),
+          credentials: {
+            integrationType: integration,
+            suggestedName: str2(args.name),
+            scopes: Array.isArray(args.scopes) ? args.scopes.filter((x) => typeof x === "string") : []
+          }
+        });
+      } else if (BROWSER_TOOLS.has(call.name)) {
+        const integration = str2(args.integration_type);
+        out.push({
+          ...base,
+          kind: "browser",
+          title: summary ?? (call.name === "connect_github_account" ? "Connect your GitHub account" : integration ? `Authorize ${integration}` : humanize(call.name)),
+          detail: str2(args.reason),
+          browser: call.name === "connect_github_account" ? { flow: "github" } : {
+            flow: "connector",
+            integrationType: integration,
+            connectorId: str2(args.connector_id),
+            scopes: Array.isArray(args.scopes) ? args.scopes.filter((x) => typeof x === "string") : undefined,
+            forceReconnect: args.force_reconnect === true
+          }
+        });
+      } else if (call.waiting_on?.kind === "choice" || call.waiting_on?.kind === "input") {
+        out.push({
+          ...base,
+          kind: "unknown",
+          title: summary ?? humanize(call.name),
+          detail: str2(args.reason)
+        });
+      } else {
+        const guard = guardFrom(call.results);
+        const integration = str2(args.integration_type);
+        out.push({
+          ...base,
+          kind: "approval",
+          title: guard?.title ?? (integration ? `Enable ${integration}?` : summary ?? `${humanize(call.name)}?`),
+          detail: guard?.detail ?? (integration ? summary : undefined)
+        });
+      }
+    }
+  }
+  return out;
+}
+function choiceAnswers(questions, selections, answerKey) {
+  if (answerKey) {
+    const first = selections[0];
+    return { [answerKey]: first?.labels[0] ?? first?.customText ?? "" };
+  }
+  const answers = questions.flatMap((q, index) => {
+    const sel = selections[index];
+    if (!sel || sel.labels.length === 0 && !sel.customText)
+      return [];
+    const answer = { question_index: index };
+    if (q.multiSelect) {
+      if (sel.labels.length)
+        answer.selected_labels = sel.labels;
+    } else if (sel.labels[0]) {
+      answer.selected_label = sel.labels[0];
+    }
+    if (sel.customText)
+      answer.custom_text = sel.customText;
+    return [answer];
+  });
+  return { answers };
+}
+
 // src/cli/commands/builder/shared.ts
 var APP_NAME_RE = /^[A-Za-z0-9._-]+$/;
 var NAME_STOPWORDS = new Set("a an the and or of for with to in on that this its it my our your me".split(" "));
@@ -270549,32 +270810,12 @@ function inventAppName(prompt) {
 function repoBasename(repoUrl) {
   return repoUrl.replace(/\/+$/, "").replace(/\.git$/, "").split("/").pop() ?? "app";
 }
-function parseWixLaunchUrl(raw) {
-  let url;
-  try {
-    url = new URL(raw.trim());
-  } catch {
-    throw new InvalidInputError("--wix-launch expects the full launch URL.");
-  }
-  const fragment = new URLSearchParams(url.hash.replace(/^#/, ""));
-  const signedInstance = fragment.get("wix-signed-instance")?.trim();
-  if (!signedInstance) {
-    throw new InvalidInputError("The launch URL has no #wix-signed-instance — copy the whole URL the funnel printed.");
-  }
-  const prompt = url.searchParams.get("prompt")?.trim();
-  const wixClientId = fragment.get("wix-client-id")?.trim();
-  return {
-    ...prompt ? { prompt } : {},
-    signedInstance,
-    ...wixClientId ? { wixClientId } : {}
-  };
-}
 async function createAndLinkApp(options) {
   if (options.name && !APP_NAME_RE.test(options.name)) {
     throw new InvalidInputError("The name becomes a directory — letters, digits, dots, dashes and underscores only.");
   }
   const cwd = process.cwd();
-  const fallbackName = () => options.importRepo ? repoBasename(options.importRepo) : inventAppName(options.prompt ?? options.wixLaunch?.prompt);
+  const fallbackName = () => options.importRepo ? repoBasename(options.importRepo) : inventAppName(options.prompt);
   const chosenDir = options.path ? resolve8(cwd, options.path) : await isDirEmpty(cwd) ? cwd : undefined;
   const dirBase = chosenDir ? basename6(chosenDir) : undefined;
   const name = options.name ?? (dirBase && APP_NAME_RE.test(dirBase) ? dirBase : fallbackName());
@@ -270586,10 +270827,10 @@ async function createAndLinkApp(options) {
     throw new InvalidInputError(here ? "This directory is already linked to a Base44 app. Run `base44 code` here to keep building it, or pass --path for a new one." : `./${dirName} is already linked to a Base44 app. Pick another name or --path.`);
   }
   let clientCreationId;
-  const created = options.wixLaunch ? await createWixLaunchedApp({
-    prompt: options.prompt ?? options.wixLaunch.prompt ?? "",
-    signedInstance: options.wixLaunch.signedInstance,
-    wixClientId: options.wixLaunch.wixClientId
+  const created = options.wixInstance ? await createWixLaunchedApp({
+    prompt: options.prompt ?? "",
+    signedInstance: options.wixInstance.signedInstance,
+    wixClientId: options.wixInstance.wixClientId
   }).then((c) => {
     clientCreationId = c.client_creation_id;
     return c;
@@ -270650,6 +270891,147 @@ async function assertBuilderApp(appId) {
   }
   return state;
 }
+function pendingSummary(pending) {
+  return pending.map((p) => ({
+    id: p.toolCallId,
+    kind: p.kind,
+    tool: p.tool,
+    title: p.title,
+    ...p.detail ? { detail: p.detail } : {},
+    ...p.questions ? { questions: p.questions } : {},
+    ...p.answerKey ? { answer_key: p.answerKey } : {},
+    ...p.secrets ? { secrets: p.secrets.map((x) => x.name) } : {},
+    ...p.permissions ? { permissions: p.permissions } : {},
+    ...p.browser ? { browser: p.browser } : {}
+  }));
+}
+function hasAnswer(f) {
+  return Boolean(f.approve || f.reject || f.skip || f.choose?.length || f.other || f.grant || f.secret?.length || f.input || f.connectorName);
+}
+async function secretValue(spec, readStdin) {
+  const eq = spec.indexOf("=");
+  if (eq <= 0) {
+    throw new InvalidInputError(`--secret expects NAME=env:VAR, NAME=file:PATH or NAME=- (got "${spec}").`);
+  }
+  const name = spec.slice(0, eq);
+  const source = spec.slice(eq + 1);
+  if (source === "-")
+    return [name, (await readStdin()).trim()];
+  if (source.startsWith("env:")) {
+    const v = process.env[source.slice(4)];
+    if (!v) {
+      throw new InvalidInputError(`--secret ${name}: environment variable ${source.slice(4)} is empty.`);
+    }
+    return [name, v];
+  }
+  if (source.startsWith("file:")) {
+    return [name, (await readFile4(source.slice(5), "utf8")).trim()];
+  }
+  throw new InvalidInputError(`--secret ${name}: pass the value as env:VAR, file:PATH or - (stdin), never as plain text.`);
+}
+async function buildAnswer(pending, f, readStdin) {
+  if (f.reject)
+    return { action: "rejected", input: {} };
+  if (f.input) {
+    try {
+      return {
+        action: "approved",
+        input: JSON.parse(f.input)
+      };
+    } catch {
+      throw new InvalidInputError("--input must be a JSON object.");
+    }
+  }
+  switch (pending.kind) {
+    case "choice": {
+      if (f.skip)
+        return { action: "approved", input: { answers: [] } };
+      const questions = pending.questions ?? [];
+      if (!f.choose?.length && !f.other) {
+        throw new InvalidInputError("This is a question: answer with --choose <label> per question (comma-separate for multi-select), --other <text>, or --skip.");
+      }
+      const selections = questions.map((q, i) => {
+        const raw = f.choose?.[i];
+        const labels = raw ? raw.split(",").map((x) => x.trim()).filter(Boolean) : [];
+        for (const l of labels) {
+          if (!q.options.some((o) => o.label === l)) {
+            throw new InvalidInputError(`"${l}" is not an option for "${q.question}". Options: ${q.options.map((o) => o.label).join(", ")}.`);
+          }
+        }
+        return {
+          labels,
+          ...i === questions.length - 1 && f.other ? { customText: f.other } : {}
+        };
+      });
+      return {
+        action: "approved",
+        input: choiceAnswers(questions, selections, pending.answerKey)
+      };
+    }
+    case "permissions": {
+      if (!f.approve && !f.grant) {
+        throw new InvalidInputError("This asks for permissions: --grant key1,key2 (or --approve for all, --reject).");
+      }
+      const all = (pending.permissions ?? []).map((p) => p.key);
+      const keys = f.grant ? f.grant.split(",").map((x) => x.trim()).filter(Boolean) : all;
+      for (const k of keys) {
+        if (!all.includes(k)) {
+          throw new InvalidInputError(`Unknown permission key "${k}". Keys: ${all.join(", ")}.`);
+        }
+      }
+      return { action: "approved", input: { approved_permission_keys: keys } };
+    }
+    case "secrets": {
+      const names = (pending.secrets ?? []).map((x) => x.name);
+      if (!f.secret?.length) {
+        throw new InvalidInputError(`This asks for secrets: --secret NAME=env:VAR for each of ${names.join(", ")}.`);
+      }
+      const values = {};
+      for (const spec of f.secret) {
+        const [name, value] = await secretValue(spec, readStdin);
+        if (!names.includes(name)) {
+          throw new InvalidInputError(`"${name}" is not one of the requested secrets: ${names.join(", ")}.`);
+        }
+        values[name] = value;
+      }
+      const missing = names.filter((n) => !(n in values));
+      if (missing.length) {
+        throw new InvalidInputError(`Missing --secret for: ${missing.join(", ")}.`);
+      }
+      return { action: "approved", input: { secrets: values } };
+    }
+    case "credentials": {
+      const name = f.connectorName ?? pending.credentials?.suggestedName;
+      if (!name) {
+        throw new InvalidInputError("This registers a workspace connector: --connector-name <name> [--client-id <id> --client-secret env:VAR] (omit both to use Base44's credentials).");
+      }
+      const scopes = pending.credentials?.scopes ?? [];
+      if (!f.clientId && !f.clientSecret) {
+        return {
+          action: "approved",
+          input: { name, credential_source: "base44", scopes }
+        };
+      }
+      if (!f.clientId || !f.clientSecret) {
+        throw new InvalidInputError("Own credentials need both --client-id and --client-secret.");
+      }
+      const [, secret] = await secretValue(`client_secret=${f.clientSecret}`, readStdin);
+      return {
+        action: "approved",
+        input: { name, client_id: f.clientId, client_secret: secret, scopes }
+      };
+    }
+    case "browser":
+      throw new InvalidInputError("This step needs a browser: finish the authorization in the editor (or run `base44 code`, which opens the link and waits), then answer with --approve.");
+    case "unknown":
+      throw new InvalidInputError("This question needs the editor — answer it there, or --reject.");
+    default:
+      if (!f.approve) {
+        throw new InvalidInputError("This is an approval: --approve or --reject.");
+      }
+      return { action: "approved", input: {} };
+  }
+}
 function nextStepsLines(app) {
   const cd = app.here ? "" : `cd ${app.dirName} && `;
   return [
@@ -270804,7 +271186,8 @@ function diffConversation(state, messages) {
           kind: "waiting",
           id: tool.id,
           name: tool.name,
-          label: labelTense(meta.label, "running")
+          label: labelTense(meta.label, "running"),
+          pending: pendingInputs([message]).find((p) => p.toolCallId === tool.id)
         });
       }
       if (TOOL_SETTLED.has(status) && !progress.settledTools.has(tool.id)) {
@@ -270892,6 +271275,228 @@ async function streamConversationUntilSettled(onEvent, options = {}) {
   return "timeout";
 }
 
+// src/cli/commands/code/session-engine.ts
+var POLL_MS = 1000;
+function isConnectionDrop(error) {
+  const status = error instanceof ApiError ? error.statusCode : undefined;
+  if (status === 502 || status === 503 || status === 504)
+    return true;
+  if (status != null)
+    return false;
+  const text = [
+    error instanceof Error ? error.message : String(error),
+    error instanceof Error ? String(error.cause ?? "") : ""
+  ].join(" ");
+  return /timeout|gateway|fetch failed|ECONNRESET|ECONNREFUSED|socket hang up|network|aborted|UND_ERR/i.test(text);
+}
+function createSessionEngine(options) {
+  const running = new Map;
+  const diffState = newStreamState();
+  let stopped = false;
+  let polling = false;
+  let pollStartedAt = 0;
+  let timer = null;
+  let sendsInFlight = 0;
+  let activeTurnId = null;
+  let turnStartedAt = null;
+  let pendingSubmitAt = null;
+  let lastTurnMs = null;
+  let lastTurnOk = true;
+  let settledCount = 0;
+  let awaitingTurn = options.awaitingTurnLabel ?? null;
+  const awaitingSince = Date.now();
+  let lastEventAt = Date.now();
+  let pending = [];
+  const answered = new Set;
+  const answer = (p, action, input = {}) => {
+    answered.add(p.toolCallId);
+    pending = pending.filter((x) => x.toolCallId !== p.toolCallId);
+    const verb = action === "rejected" ? source_default.red("✗ rejected") : Object.keys(input).length ? source_default.green("→ answered") : source_default.green("✓ approved");
+    options.onLine(`${verb} ${source_default.dim("—")} ${p.title}`);
+    pendingSubmitAt = Date.now();
+    sendsInFlight++;
+    answerToolCall({ toolCallId: p.toolCallId, messageId: p.messageId, action, input }, options.branchId).catch((error) => {
+      if (isConnectionDrop(error) && (turnStartedAt != null || pendingSubmitAt == null)) {
+        return;
+      }
+      answered.delete(p.toolCallId);
+      pendingSubmitAt = null;
+      options.onLine(source_default.red(`✗ answer failed: ${error instanceof Error ? error.message : String(error)}`));
+    }).finally(() => {
+      sendsInFlight--;
+    });
+  };
+  const submit = (raw) => {
+    const typed = raw.trim();
+    if (!typed)
+      return;
+    const text = typed;
+    options.onLine(`${source_default.cyan("❯")} ${source_default.bold(typed)}`);
+    pendingSubmitAt = Date.now();
+    const submitTurnId = activeTurnId;
+    sendsInFlight++;
+    sendTurn(text, options.branchId).then((turn) => {
+      if (turn.queued) {
+        options.onLine(source_default.dim("· queued — runs after the current turn"));
+      }
+    }).catch((error) => {
+      const delivered = activeTurnId !== submitTurnId || turnStartedAt != null || pendingSubmitAt == null;
+      if (isConnectionDrop(error) && delivered)
+        return;
+      pendingSubmitAt = null;
+      const message = error instanceof Error ? error.message : String(error);
+      options.onLine(source_default.red(`✗ send failed: ${message}`));
+    }).finally(() => {
+      sendsInFlight--;
+    });
+  };
+  const poll = async (prime) => {
+    const STUCK_POLL_MS = 45000;
+    if (polling && Date.now() - pollStartedAt < STUCK_POLL_MS)
+      return;
+    polling = true;
+    pollStartedAt = Date.now();
+    try {
+      let messages;
+      try {
+        messages = await getFullConversation(30, options.branchId);
+      } catch {
+        return;
+      }
+      const events = diffConversation(diffState, messages);
+      const waiting = pendingInputs(messages);
+      for (const id of answered) {
+        if (!waiting.some((w) => w.toolCallId === id))
+          answered.delete(id);
+      }
+      pending = waiting.filter((w) => !answered.has(w.toolCallId));
+      if (!prime) {
+        for (const event of events) {
+          if (event.kind === "tool_start") {
+            const startedAt = Date.now();
+            running.set(event.id, {
+              alias: toolAlias(event.name),
+              label: event.label,
+              summary: event.summary,
+              startedAt
+            });
+            options.onLine({ running: event, startedAt });
+            continue;
+          }
+          if (event.kind === "tool_end") {
+            const started = running.get(event.id)?.startedAt;
+            running.delete(event.id);
+            lastEventAt = Date.now();
+            options.onLine({
+              event,
+              elapsedMs: started != null ? Date.now() - started : undefined
+            });
+            continue;
+          }
+          if (event.kind === "waiting" && answered.has(event.id))
+            continue;
+          const line = eventLine(event, undefined, {
+            waitingHint: "answer in the card below"
+          });
+          if (line != null) {
+            lastEventAt = Date.now();
+            options.onLine(line);
+          }
+        }
+      }
+      const turn = newestUserTurn(messages);
+      if (!turn)
+        return;
+      const kickoffDetection = awaitingTurn != null && activeTurnId === null;
+      awaitingTurn = null;
+      if (turn.id !== activeTurnId) {
+        activeTurnId = turn.id;
+        if (!turn.settled) {
+          turnStartedAt = pendingSubmitAt ?? (kickoffDetection ? awaitingSince : Date.now());
+          pendingSubmitAt = null;
+          running.clear();
+        } else if (prime) {
+          turnStartedAt = null;
+        }
+      }
+      if (turn.settled && turnStartedAt != null && turn.id === activeTurnId) {
+        const durationMs = Date.now() - turnStartedAt;
+        turnStartedAt = null;
+        running.clear();
+        lastTurnMs = durationMs;
+        const ok = !turn.backendStatus?.startsWith("error");
+        lastTurnOk = ok;
+        options.onLine(ok ? source_default.dim(`— turn finished · ${formatDuration2(durationMs)}`) : source_default.red(turn.backendStatus === "error_paywall" ? `— the workspace is out of credits; nothing ran · ${formatDuration2(durationMs)}` : `— turn failed (${turn.backendStatus ?? "unknown"}) · ${formatDuration2(durationMs)}`));
+        const info = {
+          turnIndex: settledCount++,
+          ok,
+          backendStatus: turn.backendStatus,
+          durationMs
+        };
+        try {
+          await options.onTurnSettled?.(info);
+        } catch {}
+      }
+    } finally {
+      polling = false;
+    }
+  };
+  return {
+    async start(primeFirstPoll) {
+      await poll(primeFirstPoll);
+      timer = setInterval(() => {
+        if (!stopped)
+          poll(false);
+      }, POLL_MS);
+      timer.unref?.();
+    },
+    stop() {
+      stopped = true;
+      if (timer)
+        clearInterval(timer);
+    },
+    stopTurn() {
+      if (turnStartedAt == null && sendsInFlight === 0 && pendingSubmitAt == null)
+        return;
+      options.onLine(source_default.dim("· stopping…"));
+      stopTurn(options.branchId).catch((error) => {
+        options.onLine(source_default.red(`  stop failed: ${error instanceof Error ? error.message : String(error)}`));
+      });
+    },
+    submit,
+    answer,
+    status() {
+      let phase = "idle";
+      if (awaitingTurn != null)
+        phase = "awaiting";
+      else if (turnStartedAt != null)
+        phase = "running";
+      else if (sendsInFlight > 0 || pendingSubmitAt != null)
+        phase = "sending";
+      let runningTool = null;
+      if (running.size > 0) {
+        const newest = [...running.values()].at(-1);
+        runningTool = { ...newest, others: running.size - 1 };
+      }
+      return {
+        phase,
+        awaitingLabel: awaitingTurn ?? undefined,
+        idleHint: options.idleHint,
+        quietForMs: Date.now() - lastEventAt,
+        awaitingSince,
+        turnStartedAt,
+        runningTool,
+        lastTurnMs,
+        lastTurnOk,
+        pending
+      };
+    },
+    turnRunning() {
+      return turnStartedAt != null;
+    }
+  };
+}
+
 // src/cli/commands/builder/send.ts
 function lastAssistantReply(turn) {
   const messages = turn.conversation?.messages ?? [];
@@ -270907,70 +271512,183 @@ function ndjsonWriter() {
   return (record) => process.stdout.write(`${JSON.stringify(record)}
 `);
 }
+async function readStdin2() {
+  const chunks = [];
+  for await (const chunk of process.stdin)
+    chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function turnResult(turn, pending) {
+  if (turn.queued)
+    return { queued: true };
+  const base = {
+    status: pending.length ? "waiting" : turn.status?.state ?? "ready",
+    error_source: turn.status?.error_source ?? null,
+    reply: lastAssistantReply(turn) ?? null
+  };
+  return pending.length ? { ...base, pending: pendingSummary(pending) } : base;
+}
+async function applyPolicy(pending, options, branchId, onEvent) {
+  let current = pending;
+  for (let round = 0;round < 10 && current.length; round++) {
+    const target = current.find((p) => options.autoApprove && (p.kind === "approval" || p.kind === "permissions") || options.skipQuestions && p.kind === "choice");
+    if (!target)
+      break;
+    const input = target.kind === "permissions" ? {
+      approved_permission_keys: (target.permissions ?? []).map((p) => p.key)
+    } : target.kind === "choice" ? { answers: [] } : {};
+    await streamConversationDuring(() => answerToolCall({
+      toolCallId: target.toolCallId,
+      messageId: target.messageId,
+      action: "approved",
+      input
+    }, branchId), onEvent, { branchId });
+    current = pendingInputs(await getFullConversation(30, branchId));
+  }
+  return current;
+}
 async function sendAction(ctx, message, options) {
   if (options.streamJson && ctx.jsonMode) {
     throw new InvalidInputError("--stream-json and --json are exclusive.");
   }
+  const answering = hasAnswer(options);
+  if (answering && message) {
+    throw new InvalidInputError("Either send a message or answer the pending question (--approve / --choose / …), not both.");
+  }
+  if (!answering && !message) {
+    throw new InvalidInputError('Send a message ("<message>") or answer what the agent asked (--approve, --reject, --choose, --grant, --secret, --skip, --input).');
+  }
   if (ctx.app)
     await assertBuilderApp(ctx.app.id);
   const branchId = await resolveBranchId(ctx);
+  const pendingBefore = pendingInputs(await getFullConversation(30, branchId).catch(() => []));
+  let start;
+  if (answering) {
+    if (pendingBefore.length === 0) {
+      throw new InvalidInputError("Nothing is waiting for an answer — send a message instead.");
+    }
+    const target = options.id ? pendingBefore.find((p) => p.toolCallId === options.id) : pendingBefore.length === 1 ? pendingBefore[0] : undefined;
+    if (!target) {
+      throw new InvalidInputError(options.id ? `No pending call with id ${options.id}. Pending: ${pendingBefore.map((p) => p.toolCallId).join(", ")}.` : `Several calls are waiting — pick one with --id: ${pendingBefore.map((p) => `${p.toolCallId} (${p.kind}: ${p.title})`).join("; ")}.`);
+    }
+    const answer = await buildAnswer(target, options, readStdin2);
+    start = () => answerToolCall({
+      toolCallId: target.toolCallId,
+      messageId: target.messageId,
+      action: answer.action,
+      input: answer.input
+    }, branchId);
+  } else {
+    if (pendingBefore.length) {
+      const record = {
+        status: "waiting",
+        pending: pendingSummary(pendingBefore)
+      };
+      if (options.streamJson) {
+        ndjsonWriter()({ type: "result", ...record });
+        return {};
+      }
+      if (ctx.jsonMode)
+        return { stdout: `${JSON.stringify(record)}
+` };
+      throw new InvalidInputError(`The agent is waiting on you before it can take a message: ${pendingBefore.map((p) => `${p.title} (${p.kind})`).join("; ")}. Answer with --approve / --choose / --grant / --secret, or --reject.`);
+    }
+    const text = message;
+    start = () => sendTurn(text, branchId);
+  }
+  const startOrRecover = async () => {
+    try {
+      return await start();
+    } catch (error) {
+      if (!isConnectionDrop(error))
+        throw error;
+      const settled = await streamConversationUntilSettled(() => {
+        return;
+      }, {
+        branchId,
+        timeoutMs: 20 * 60000
+      });
+      const state = await getAppState(ctx.app?.id);
+      return {
+        status: {
+          state: settled === "timeout" ? "processing" : state.status?.state ?? "ready",
+          error_source: state.status?.error_source ?? null
+        },
+        conversation: {
+          messages: (await getFullConversation(5, branchId).catch(() => [])).filter((m) => !m.hidden).map((m) => ({ role: m.role, content: m.content }))
+        }
+      };
+    }
+  };
+  const finish = async (turn, onEvent) => {
+    let pending = turn.queued ? [] : pendingInputs(await getFullConversation(30, branchId).catch(() => []));
+    if (pending.length && (options.autoApprove || options.skipQuestions)) {
+      pending = await applyPolicy(pending, options, branchId, onEvent);
+    }
+    return turnResult(turn, pending);
+  };
   if (options.streamJson) {
     const write = ndjsonWriter();
-    const turn = await streamConversationDuring(() => sendTurn(message, branchId), ({ kind, ...event }) => write({ type: kind, ...event }), { branchId });
-    write({
-      type: "result",
-      queued: turn.queued === true,
-      status: turn.status?.state ?? "ready",
-      error_source: turn.status?.error_source ?? null,
-      reply: lastAssistantReply(turn) ?? null
+    const onEvent = ({ kind, ...event }) => write({ type: kind, ...event });
+    const turn = await streamConversationDuring(startOrRecover, onEvent, {
+      branchId
     });
+    const result = await finish(turn, onEvent);
+    write({ type: "result", queued: result.queued === true, ...result });
     return {};
   }
   if (ctx.jsonMode) {
-    const turn = await ctx.runTask("Agent working (a turn can take minutes)", () => sendTurn(message, branchId));
-    if (turn.queued)
-      return { stdout: `${JSON.stringify({ queued: true })}
-` };
+    const turn = await ctx.runTask("Agent working (a turn can take minutes)", startOrRecover);
     return {
-      stdout: `${JSON.stringify({
-        status: turn.status?.state ?? "ready",
-        error_source: turn.status?.error_source ?? null,
-        reply: lastAssistantReply(turn) ?? null
-      })}
+      stdout: `${JSON.stringify(await finish(turn, () => {
+        return;
+      }))}
 `
     };
   }
   const stream = createTurnStream(process.stdout.isTTY === true, undefined, {
     verbose: options.verbose
   });
-  let turn;
+  let result;
   try {
-    turn = await streamConversationDuring(() => sendTurn(message, branchId), stream.onEvent, { branchId });
+    const turn = await streamConversationDuring(startOrRecover, stream.onEvent, {
+      branchId
+    });
+    result = await finish(turn, stream.onEvent);
   } finally {
     stream.stop();
   }
-  if (turn.queued) {
+  if (result.queued === true) {
     return {
       outroMessage: "The agent is busy with an earlier message — yours was queued and runs next."
     };
   }
-  if (turn.status?.state === "error") {
+  if (result.status === "waiting") {
+    for (const p of result.pending) {
+      ctx.log.message(`  ⏸ ${p.title} (${p.kind})`);
+    }
     return {
-      outroMessage: `Turn failed (${turn.status.error_source ?? "unknown"}) — see the editor for details.`
+      outroMessage: "The agent is waiting on you. Answer with `base44 builder send --approve` (or --choose, --grant, --secret, --reject), or open `base44 code`."
+    };
+  }
+  if (result.status === "error") {
+    return {
+      outroMessage: result.error_source === "paywall" ? "The workspace is out of credits — nothing ran." : `Turn failed (${result.error_source ?? "unknown"}) — see the editor for details.`
     };
   }
   return { outroMessage: "Turn finished." };
 }
+var collect = (v, acc = []) => [...acc, v];
 function getSendCommand() {
   const command = new Base44Command("send", { supportsBranch: true });
-  command.description("Send the agent one message and stream the turn until it finishes").argument("<message>", "What you want the agent to do").option("--verbose", "Show every tool result in full (no folding)").option("--stream-json", "Emit each stream event as a JSON line as it happens, then a final result line").action(sendAction);
+  command.description('Send the agent one message and stream the turn until it finishes — or answer what it asked (--approve, --choose, …). A result with status "waiting" lists what the agent needs; the next send answers it.').argument("[message]", "What you want the agent to do").option("--approve", "Approve the pending call (permissions: grant all)").option("--reject", "Reject the pending call").option("--skip", "Skip the pending questions; the agent decides").option("--choose <label>", "Answer a question by option label; repeat per question, comma-separate for multi-select", collect).option("--other <text>", "Free-text answer for the last question").option("--grant <keys>", "Permission keys to grant, comma-separated").option("--secret <NAME=source>", "A requested secret from env:VAR, file:PATH or - (stdin); repeat per secret", collect).option("--connector-name <name>", "Register a workspace connector under this name (Base44's credentials unless --client-id/--client-secret are given)").option("--client-id <id>", "Your own OAuth app's client id").option("--client-secret <source>", "Your own OAuth app's client secret from env:VAR, file:PATH or - (stdin)").option("--input <json>", "Raw extra_user_input for the pending call").option("--id <tool-call-id>", "Which pending call to answer when several wait").option("--auto-approve", "Policy: approve approval-kind pauses (never secrets or browser steps)").option("--skip-questions", "Policy: skip clarifying questions; the agent decides").option("--verbose", "Show every tool result in full (no folding)").option("--stream-json", "Emit each stream event as a JSON line as it happens, then a final result line").action(sendAction);
   return command;
 }
 
 // src/cli/commands/builder/new.ts
 var POLL_TIMEOUT_MS = 20 * 60000;
 var MODES = ["direct", "fork", "copy"];
-async function readStdin2() {
+async function readStdin3() {
   const chunks = [];
   for await (const chunk of process.stdin)
     chunks.push(chunk);
@@ -270983,15 +271701,22 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
   if ((options.mode || options.repoName || options.fromBranch) && !options.import) {
     throw new InvalidInputError("--mode, --repo-name and --from-branch apply only with --import <repo>.");
   }
-  if (options.wixLaunch && options.import) {
-    throw new InvalidInputError("--wix-launch and --import are exclusive.");
+  if (options.wixInstance && options.import) {
+    throw new InvalidInputError("--wix-instance and --import are exclusive.");
+  }
+  if (options.wixClientId && !options.wixInstance) {
+    throw new InvalidInputError("--wix-client-id applies only with --wix-instance.");
+  }
+  const signedInstance = options.wixInstance ? (options.wixInstance === "-" ? await readStdin3() : options.wixInstance).trim() : undefined;
+  if (options.wixInstance && !signedInstance) {
+    throw new InvalidInputError("--wix-instance is empty.");
   }
-  const wixLaunch = options.wixLaunch ? parseWixLaunchUrl(options.wixLaunch === "-" ? await readStdin2() : options.wixLaunch) : undefined;
-  if (wixLaunch && !prompt && !wixLaunch.prompt) {
-    throw new InvalidInputError("The launch URL has no ?prompt= — pass the prompt as the argument.");
+  const wixInstance = signedInstance ? { signedInstance, wixClientId: options.wixClientId?.trim() || undefined } : undefined;
+  if (wixInstance && !prompt) {
+    throw new InvalidInputError("--wix-instance needs the prompt argument: what the agent should build.");
   }
-  if (!prompt && !options.import && !wixLaunch) {
-    throw new InvalidInputError('Describe the app ("<prompt>") or pass --import <repo> / --wix-launch <url>.');
+  if (!prompt && !options.import) {
+    throw new InvalidInputError('Describe the app ("<prompt>") or pass --import <repo>.');
   }
   if (options.streamJson && jsonMode) {
     throw new InvalidInputError("--stream-json and --json are exclusive.");
@@ -271007,7 +271732,7 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
       repoName: options.repoName,
       fromBranch: options.fromBranch,
       path: options.path,
-      wixLaunch
+      wixInstance
     }));
   } catch (error) {
     for (const line of await githubReauthLines(error) ?? [])
@@ -271035,6 +271760,7 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
   }
   let finalState;
   let previewUrl;
+  let pending = [];
   const startedAt = Date.now();
   if (prompt) {
     const branchId = await resolveActiveBranchId().catch(() => {
@@ -271053,6 +271779,20 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
           stream.onEvent(event);
       }, { branchId, timeoutMs: POLL_TIMEOUT_MS });
       finalState = settled === "timeout" ? "processing" : (await getAppState(app.id)).status?.state ?? "ready";
+      if (settled === "settled") {
+        pending = pendingInputs(await getFullConversation(30, branchId).catch(() => []));
+        if (pending.length && (options.autoApprove || options.skipQuestions)) {
+          pending = await applyPolicy(pending, options, branchId, (event) => {
+            if (ndjson) {
+              const { kind, ...rest } = event;
+              ndjson({ type: kind, ...rest });
+            } else if (!jsonMode)
+              stream.onEvent(event);
+          });
+        }
+        if (pending.length)
+          finalState = "waiting";
+      }
       if (finalState === "ready") {
         previewUrl = await getPreviewUrl().catch(() => {
           return;
@@ -271067,7 +271807,8 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
       type: "result",
       id: app.id,
       preview_url: previewUrl ?? null,
-      status: finalState ?? "created"
+      status: finalState ?? "created",
+      ...pending.length ? { pending: pendingSummary(pending) } : {}
     });
     return {};
   }
@@ -271081,6 +271822,7 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
         dir: app.dirName,
         path: app.targetDir,
         status: finalState ?? "created",
+        ...pending.length ? { pending: pendingSummary(pending) } : {},
         ...app.clientCreationId ? { client_creation_id: app.clientCreationId } : {}
       })}
 `
@@ -271090,6 +271832,13 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
     log.message(`preview ${previewUrl}`);
   for (const line of nextStepsLines(app))
     log.message(line);
+  if (finalState === "waiting") {
+    for (const p of pending)
+      log.message(`  ⏸ ${p.title} (${p.kind})`);
+    return {
+      outroMessage: "The agent is waiting on you. Answer with `base44 builder send --approve` (or --choose, --grant, --secret), or open `base44 code`."
+    };
+  }
   if (finalState === "error") {
     return {
       outroMessage: `The first build reported an error — open the editor for details.`
@@ -271106,29 +271855,43 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
 }
 function getNewCommand() {
   const command = new Base44Command("new", { requireAppContext: false });
-  command.description("Create an app and start building: from a prompt (the Base44 template), or over an existing GitHub repo with --import").argument("[prompt]", "What to build; the first agent turn starts immediately").option("--import <repo>", "Build over an existing GitHub repository instead of the template").option("--mode <mode>", "How to import: direct, fork, or copy (default: direct)").option("--name <name>", "Directory and app name (invented when omitted)").option("--path <dir>", "Directory to link (default: the current directory when empty, else ./<name>)").option("--repo-name <name>", "Name for the new GitHub repo when forking/copying").option("--from-branch <name>", "Import a specific branch of the repo").addOption(new Option2("--wix-launch <url>", `Create through a Wix launch URL (the funnel's ?prompt= and #wix-signed-instance); "-" reads it from stdin. A prompt argument is what the agent runs instead of the URL's`).env("BASE44_WIX_LAUNCH_URL")).option("--verbose", "Show every tool result in full (no folding)").option("--stream-json", "Emit each stream event as a JSON line as it happens, then a final result line").action(newAction);
+  command.description("Create an app and start building: from a prompt (the Base44 template), or over an existing GitHub repo with --import").argument("[prompt]", "What to build; the first agent turn starts immediately").option("--import <repo>", "Build over an existing GitHub repository instead of the template").option("--mode <mode>", "How to import: direct, fork, or copy (default: direct)").option("--name <name>", "Directory and app name (invented when omitted)").option("--path <dir>", "Directory to link (default: the current directory when empty, else ./<name>)").option("--repo-name <name>", "Name for the new GitHub repo when forking/copying").option("--from-branch <name>", "Import a specific branch of the repo").addOption(new Option2("--wix-instance <token>", 'Create through the Wix route with this signed instance (the Wix connector is connected before the first turn); "-" reads the token from stdin').env("BASE44_WIX_INSTANCE")).option("--wix-client-id <id>", "The companion OAuth app's client id, when the Wix launch has one").option("--auto-approve", "Policy: approve approval-kind pauses in the first build (never secrets or browser steps)").option("--skip-questions", "Policy: skip clarifying questions; the agent decides").option("--verbose", "Show every tool result in full (no folding)").option("--stream-json", "Emit each stream event as a JSON line as it happens, then a final result line").action(newAction);
   return command;
 }
 
 // src/cli/commands/builder/status.ts
 async function statusAction(ctx) {
   const id = ctx.app?.id;
-  const app = await ctx.runTask("Reading app status", () => getAppState(id));
-  const state = app.status?.state ?? "ready";
+  const branchId = await resolveBranchId(ctx);
+  const [app, messages] = await ctx.runTask("Reading app status", () => Promise.all([
+    getAppState(id),
+    getFullConversation(30, branchId).catch(() => [])
+  ]));
+  const pending = pendingInputs(messages);
+  const state = pending.length ? "waiting" : app.status?.state ?? "ready";
   if (ctx.jsonMode) {
     return {
-      stdout: `${JSON.stringify({ id: app.id, state, message: app.status?.message ?? null })}
+      stdout: `${JSON.stringify({
+        id: app.id,
+        state,
+        message: app.status?.message ?? null,
+        ...pending.length ? { pending: pendingSummary(pending) } : {}
+      })}
 `
     };
   }
   ctx.log.message(`State:  ${state}`);
   if (app.status?.message)
     ctx.log.message(`Note:   ${app.status.message}`);
-  return { outroMessage: "Status read." };
+  for (const p of pending)
+    ctx.log.message(`  ⏸ ${p.title} (${p.kind})`);
+  return {
+    outroMessage: pending.length ? "The agent is waiting on you — `base44 builder send --approve` (or --choose, --grant, --secret) answers it." : "Status read."
+  };
 }
 function getStatusCommand() {
-  const command = new Base44Command("status");
-  command.description("Show whether the app is building, ready, or errored").action(statusAction);
+  const command = new Base44Command("status", { supportsBranch: true });
+  command.description("Show whether the app is building, ready, errored — or waiting on you, and for what").action(statusAction);
   return command;
 }
 
@@ -276112,6 +276875,612 @@ function TextInput({ value: originalValue, placeholder = "", focus = true, mask,
 }
 var build_default = TextInput;
 
+// ../../node_modules/open/index.js
+import process30 from "node:process";
+import path16 from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+import childProcess3 from "node:child_process";
+import fs20, { constants as fsConstants2 } from "node:fs/promises";
+
+// ../../node_modules/wsl-utils/index.js
+import { promisify as promisify6 } from "node:util";
+import childProcess2 from "node:child_process";
+import fs19, { constants as fsConstants } from "node:fs/promises";
+
+// ../../node_modules/is-wsl/index.js
+import process24 from "node:process";
+import os4 from "node:os";
+import fs18 from "node:fs";
+
+// ../../node_modules/is-inside-container/index.js
+import fs17 from "node:fs";
+
+// ../../node_modules/is-docker/index.js
+import fs16 from "node:fs";
+var isDockerCached;
+function hasDockerEnv() {
+  try {
+    fs16.statSync("/.dockerenv");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hasDockerCGroup() {
+  try {
+    return fs16.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+  } catch {
+    return false;
+  }
+}
+function isDocker() {
+  if (isDockerCached === undefined) {
+    isDockerCached = hasDockerEnv() || hasDockerCGroup();
+  }
+  return isDockerCached;
+}
+
+// ../../node_modules/is-inside-container/index.js
+var cachedResult;
+var hasContainerEnv = () => {
+  try {
+    fs17.statSync("/run/.containerenv");
+    return true;
+  } catch {
+    return false;
+  }
+};
+function isInsideContainer() {
+  if (cachedResult === undefined) {
+    cachedResult = hasContainerEnv() || isDocker();
+  }
+  return cachedResult;
+}
+
+// ../../node_modules/is-wsl/index.js
+var isWsl = () => {
+  if (process24.platform !== "linux") {
+    return false;
+  }
+  if (os4.release().toLowerCase().includes("microsoft")) {
+    if (isInsideContainer()) {
+      return false;
+    }
+    return true;
+  }
+  try {
+    return fs18.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
+  } catch {
+    return false;
+  }
+};
+var is_wsl_default = process24.env.__IS_WSL_TEST__ ? isWsl : isWsl();
+
+// ../../node_modules/powershell-utils/index.js
+import process25 from "node:process";
+import { Buffer as Buffer7 } from "node:buffer";
+import { promisify as promisify5 } from "node:util";
+import childProcess from "node:child_process";
+var execFile = promisify5(childProcess.execFile);
+var powerShellPath = () => `${process25.env.SYSTEMROOT || process25.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+var executePowerShell = async (command, options = {}) => {
+  const {
+    powerShellPath: psPath,
+    ...execFileOptions
+  } = options;
+  const encodedCommand = executePowerShell.encodeCommand(command);
+  return execFile(psPath ?? powerShellPath(), [
+    ...executePowerShell.argumentsPrefix,
+    encodedCommand
+  ], {
+    encoding: "utf8",
+    ...execFileOptions
+  });
+};
+executePowerShell.argumentsPrefix = [
+  "-NoProfile",
+  "-NonInteractive",
+  "-ExecutionPolicy",
+  "Bypass",
+  "-EncodedCommand"
+];
+executePowerShell.encodeCommand = (command) => Buffer7.from(command, "utf16le").toString("base64");
+executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
+
+// ../../node_modules/wsl-utils/utilities.js
+function parseMountPointFromConfig(content) {
+  for (const line of content.split(`
+`)) {
+    if (/^\s*#/.test(line)) {
+      continue;
+    }
+    const match = /^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(line);
+    if (!match) {
+      continue;
+    }
+    return match.groups.mountPoint.trim().replaceAll(/^["']|["']$/g, "");
+  }
+}
+
+// ../../node_modules/wsl-utils/index.js
+var execFile2 = promisify6(childProcess2.execFile);
+var wslDrivesMountPoint = (() => {
+  const defaultMountPoint = "/mnt/";
+  let mountPoint;
+  return async function() {
+    if (mountPoint) {
+      return mountPoint;
+    }
+    const configFilePath = "/etc/wsl.conf";
+    let isConfigFileExists = false;
+    try {
+      await fs19.access(configFilePath, fsConstants.F_OK);
+      isConfigFileExists = true;
+    } catch {}
+    if (!isConfigFileExists) {
+      return defaultMountPoint;
+    }
+    const configContent = await fs19.readFile(configFilePath, { encoding: "utf8" });
+    const parsedMountPoint = parseMountPointFromConfig(configContent);
+    if (parsedMountPoint === undefined) {
+      return defaultMountPoint;
+    }
+    mountPoint = parsedMountPoint;
+    mountPoint = mountPoint.endsWith("/") ? mountPoint : `${mountPoint}/`;
+    return mountPoint;
+  };
+})();
+var powerShellPathFromWsl = async () => {
+  const mountPoint = await wslDrivesMountPoint();
+  return `${mountPoint}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`;
+};
+var powerShellPath2 = is_wsl_default ? powerShellPathFromWsl : powerShellPath;
+var canAccessPowerShellPromise;
+var canAccessPowerShell = async () => {
+  canAccessPowerShellPromise ??= (async () => {
+    try {
+      const psPath = await powerShellPath2();
+      await fs19.access(psPath, fsConstants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  })();
+  return canAccessPowerShellPromise;
+};
+var wslDefaultBrowser = async () => {
+  const psPath = await powerShellPath2();
+  const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
+  const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
+  return stdout.trim();
+};
+var convertWslPathToWindows = async (path) => {
+  if (/^[a-z]+:\/\//i.test(path)) {
+    return path;
+  }
+  try {
+    const { stdout } = await execFile2("wslpath", ["-aw", path], { encoding: "utf8" });
+    return stdout.trim();
+  } catch {
+    return path;
+  }
+};
+
+// ../../node_modules/define-lazy-prop/index.js
+function defineLazyProperty(object, propertyName, valueGetter) {
+  const define2 = (value) => Object.defineProperty(object, propertyName, { value, enumerable: true, writable: true });
+  Object.defineProperty(object, propertyName, {
+    configurable: true,
+    enumerable: true,
+    get() {
+      const result = valueGetter();
+      define2(result);
+      return result;
+    },
+    set(value) {
+      define2(value);
+    }
+  });
+  return object;
+}
+
+// ../../node_modules/default-browser/index.js
+import { promisify as promisify10 } from "node:util";
+import process28 from "node:process";
+import { execFile as execFile6 } from "node:child_process";
+
+// ../../node_modules/default-browser-id/index.js
+import { promisify as promisify7 } from "node:util";
+import process26 from "node:process";
+import { execFile as execFile3 } from "node:child_process";
+var execFileAsync = promisify7(execFile3);
+async function defaultBrowserId() {
+  if (process26.platform !== "darwin") {
+    throw new Error("macOS only");
+  }
+  const { stdout } = await execFileAsync("defaults", ["read", "com.apple.LaunchServices/com.apple.launchservices.secure", "LSHandlers"]);
+  const match = /LSHandlerRoleAll = "(?!-)(?<id>[^"]+?)";\s+?LSHandlerURLScheme = (?:http|https);/.exec(stdout);
+  const browserId = match?.groups.id ?? "com.apple.Safari";
+  if (browserId === "com.apple.safari") {
+    return "com.apple.Safari";
+  }
+  return browserId;
+}
+
+// ../../node_modules/run-applescript/index.js
+import process27 from "node:process";
+import { promisify as promisify8 } from "node:util";
+import { execFile as execFile4, execFileSync } from "node:child_process";
+var execFileAsync2 = promisify8(execFile4);
+async function runAppleScript(script, { humanReadableOutput = true, signal } = {}) {
+  if (process27.platform !== "darwin") {
+    throw new Error("macOS only");
+  }
+  const outputArguments = humanReadableOutput ? [] : ["-ss"];
+  const execOptions = {};
+  if (signal) {
+    execOptions.signal = signal;
+  }
+  const { stdout } = await execFileAsync2("osascript", ["-e", script, outputArguments], execOptions);
+  return stdout.trim();
+}
+
+// ../../node_modules/bundle-name/index.js
+async function bundleName(bundleId) {
+  return runAppleScript(`tell application "Finder" to set app_path to application file id "${bundleId}" as string
+tell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`);
+}
+
+// ../../node_modules/default-browser/windows.js
+import { promisify as promisify9 } from "node:util";
+import { execFile as execFile5 } from "node:child_process";
+var execFileAsync3 = promisify9(execFile5);
+var windowsBrowserProgIds = {
+  MSEdgeHTM: { name: "Edge", id: "com.microsoft.edge" },
+  MSEdgeBHTML: { name: "Edge Beta", id: "com.microsoft.edge.beta" },
+  MSEdgeDHTML: { name: "Edge Dev", id: "com.microsoft.edge.dev" },
+  AppXq0fevzme2pys62n3e0fbqa7peapykr8v: { name: "Edge", id: "com.microsoft.edge.old" },
+  ChromeHTML: { name: "Chrome", id: "com.google.chrome" },
+  ChromeBHTML: { name: "Chrome Beta", id: "com.google.chrome.beta" },
+  ChromeDHTML: { name: "Chrome Dev", id: "com.google.chrome.dev" },
+  ChromiumHTM: { name: "Chromium", id: "org.chromium.Chromium" },
+  BraveHTML: { name: "Brave", id: "com.brave.Browser" },
+  BraveBHTML: { name: "Brave Beta", id: "com.brave.Browser.beta" },
+  BraveDHTML: { name: "Brave Dev", id: "com.brave.Browser.dev" },
+  BraveSSHTM: { name: "Brave Nightly", id: "com.brave.Browser.nightly" },
+  FirefoxURL: { name: "Firefox", id: "org.mozilla.firefox" },
+  OperaStable: { name: "Opera", id: "com.operasoftware.Opera" },
+  VivaldiHTM: { name: "Vivaldi", id: "com.vivaldi.Vivaldi" },
+  "IE.HTTP": { name: "Internet Explorer", id: "com.microsoft.ie" }
+};
+var _windowsBrowserProgIdMap = new Map(Object.entries(windowsBrowserProgIds));
+
+class UnknownBrowserError extends Error {
+}
+async function defaultBrowser(_execFileAsync = execFileAsync3) {
+  const { stdout } = await _execFileAsync("reg", [
+    "QUERY",
+    " HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
+    "/v",
+    "ProgId"
+  ]);
+  const match = /ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(stdout);
+  if (!match) {
+    throw new UnknownBrowserError(`Cannot find Windows browser in stdout: ${JSON.stringify(stdout)}`);
+  }
+  const { id } = match.groups;
+  const dotIndex = id.lastIndexOf(".");
+  const hyphenIndex = id.lastIndexOf("-");
+  const baseIdByDot = dotIndex === -1 ? undefined : id.slice(0, dotIndex);
+  const baseIdByHyphen = hyphenIndex === -1 ? undefined : id.slice(0, hyphenIndex);
+  return windowsBrowserProgIds[id] ?? windowsBrowserProgIds[baseIdByDot] ?? windowsBrowserProgIds[baseIdByHyphen] ?? { name: id, id };
+}
+
+// ../../node_modules/default-browser/index.js
+var execFileAsync4 = promisify10(execFile6);
+var titleize = (string) => string.toLowerCase().replaceAll(/(?:^|\s|-)\S/g, (x) => x.toUpperCase());
+async function defaultBrowser2() {
+  if (process28.platform === "darwin") {
+    const id = await defaultBrowserId();
+    const name = await bundleName(id);
+    return { name, id };
+  }
+  if (process28.platform === "linux") {
+    const { stdout } = await execFileAsync4("xdg-mime", ["query", "default", "x-scheme-handler/http"]);
+    const id = stdout.trim();
+    const name = titleize(id.replace(/.desktop$/, "").replace("-", " "));
+    return { name, id };
+  }
+  if (process28.platform === "win32") {
+    return defaultBrowser();
+  }
+  throw new Error("Only macOS, Linux, and Windows are supported");
+}
+
+// ../../node_modules/is-in-ssh/index.js
+import process29 from "node:process";
+var isInSsh = Boolean(process29.env.SSH_CONNECTION || process29.env.SSH_CLIENT || process29.env.SSH_TTY);
+var is_in_ssh_default = isInSsh;
+
+// ../../node_modules/open/index.js
+var fallbackAttemptSymbol = Symbol("fallbackAttempt");
+var __dirname2 = import.meta.url ? path16.dirname(fileURLToPath4(import.meta.url)) : "";
+var localXdgOpenPath = path16.join(__dirname2, "xdg-open");
+var { platform: platform7, arch } = process30;
+var tryEachApp = async (apps, opener) => {
+  if (apps.length === 0) {
+    return;
+  }
+  const errors = [];
+  for (const app of apps) {
+    try {
+      return await opener(app);
+    } catch (error) {
+      errors.push(error);
+    }
+  }
+  throw new AggregateError(errors, "Failed to open in all supported apps");
+};
+var baseOpen = async (options) => {
+  options = {
+    wait: false,
+    background: false,
+    newInstance: false,
+    allowNonzeroExitCode: false,
+    ...options
+  };
+  const isFallbackAttempt = options[fallbackAttemptSymbol] === true;
+  delete options[fallbackAttemptSymbol];
+  if (Array.isArray(options.app)) {
+    return tryEachApp(options.app, (singleApp) => baseOpen({
+      ...options,
+      app: singleApp,
+      [fallbackAttemptSymbol]: true
+    }));
+  }
+  let { name: app, arguments: appArguments = [] } = options.app ?? {};
+  appArguments = [...appArguments];
+  if (Array.isArray(app)) {
+    return tryEachApp(app, (appName) => baseOpen({
+      ...options,
+      app: {
+        name: appName,
+        arguments: appArguments
+      },
+      [fallbackAttemptSymbol]: true
+    }));
+  }
+  if (app === "browser" || app === "browserPrivate") {
+    const ids = {
+      "com.google.chrome": "chrome",
+      "google-chrome.desktop": "chrome",
+      "com.brave.browser": "brave",
+      "org.mozilla.firefox": "firefox",
+      "firefox.desktop": "firefox",
+      "com.microsoft.msedge": "edge",
+      "com.microsoft.edge": "edge",
+      "com.microsoft.edgemac": "edge",
+      "microsoft-edge.desktop": "edge",
+      "com.apple.safari": "safari"
+    };
+    const flags = {
+      chrome: "--incognito",
+      brave: "--incognito",
+      firefox: "--private-window",
+      edge: "--inPrivate"
+    };
+    let browser;
+    if (is_wsl_default) {
+      const progId = await wslDefaultBrowser();
+      const browserInfo = _windowsBrowserProgIdMap.get(progId);
+      browser = browserInfo ?? {};
+    } else {
+      browser = await defaultBrowser2();
+    }
+    if (browser.id in ids) {
+      const browserName = ids[browser.id.toLowerCase()];
+      if (app === "browserPrivate") {
+        if (browserName === "safari") {
+          throw new Error("Safari doesn't support opening in private mode via command line");
+        }
+        appArguments.push(flags[browserName]);
+      }
+      return baseOpen({
+        ...options,
+        app: {
+          name: apps[browserName],
+          arguments: appArguments
+        }
+      });
+    }
+    throw new Error(`${browser.name} is not supported as a default browser`);
+  }
+  let command;
+  const cliArguments = [];
+  const childProcessOptions = {};
+  let shouldUseWindowsInWsl = false;
+  if (is_wsl_default && !isInsideContainer() && !is_in_ssh_default && !app) {
+    shouldUseWindowsInWsl = await canAccessPowerShell();
+  }
+  if (platform7 === "darwin") {
+    command = "open";
+    if (options.wait) {
+      cliArguments.push("--wait-apps");
+    }
+    if (options.background) {
+      cliArguments.push("--background");
+    }
+    if (options.newInstance) {
+      cliArguments.push("--new");
+    }
+    if (app) {
+      cliArguments.push("-a", app);
+    }
+  } else if (platform7 === "win32" || shouldUseWindowsInWsl) {
+    command = await powerShellPath2();
+    cliArguments.push(...executePowerShell.argumentsPrefix);
+    if (!is_wsl_default) {
+      childProcessOptions.windowsVerbatimArguments = true;
+    }
+    if (is_wsl_default && options.target) {
+      options.target = await convertWslPathToWindows(options.target);
+    }
+    const encodedArguments = ["$ProgressPreference = 'SilentlyContinue';", "Start"];
+    if (options.wait) {
+      encodedArguments.push("-Wait");
+    }
+    if (app) {
+      encodedArguments.push(executePowerShell.escapeArgument(app));
+      if (options.target) {
+        appArguments.push(options.target);
+      }
+    } else if (options.target) {
+      encodedArguments.push(executePowerShell.escapeArgument(options.target));
+    }
+    if (appArguments.length > 0) {
+      appArguments = appArguments.map((argument) => executePowerShell.escapeArgument(argument));
+      encodedArguments.push("-ArgumentList", appArguments.join(","));
+    }
+    options.target = executePowerShell.encodeCommand(encodedArguments.join(" "));
+    if (!options.wait) {
+      childProcessOptions.stdio = "ignore";
+    }
+  } else {
+    if (app) {
+      command = app;
+    } else {
+      const isBundled = !__dirname2 || __dirname2 === "/";
+      let exeLocalXdgOpen = false;
+      try {
+        await fs20.access(localXdgOpenPath, fsConstants2.X_OK);
+        exeLocalXdgOpen = true;
+      } catch {}
+      const useSystemXdgOpen = process30.versions.electron ?? (platform7 === "android" || isBundled || !exeLocalXdgOpen);
+      command = useSystemXdgOpen ? "xdg-open" : localXdgOpenPath;
+    }
+    if (appArguments.length > 0) {
+      cliArguments.push(...appArguments);
+    }
+    if (!options.wait) {
+      childProcessOptions.stdio = "ignore";
+      childProcessOptions.detached = true;
+    }
+  }
+  if (platform7 === "darwin" && appArguments.length > 0) {
+    cliArguments.push("--args", ...appArguments);
+  }
+  if (options.target) {
+    cliArguments.push(options.target);
+  }
+  const subprocess = childProcess3.spawn(command, cliArguments, childProcessOptions);
+  if (options.wait) {
+    return new Promise((resolve, reject) => {
+      subprocess.once("error", reject);
+      subprocess.once("close", (exitCode) => {
+        if (!options.allowNonzeroExitCode && exitCode !== 0) {
+          reject(new Error(`Exited with code ${exitCode}`));
+          return;
+        }
+        resolve(subprocess);
+      });
+    });
+  }
+  if (isFallbackAttempt) {
+    return new Promise((resolve, reject) => {
+      subprocess.once("error", reject);
+      subprocess.once("spawn", () => {
+        subprocess.once("close", (exitCode) => {
+          subprocess.off("error", reject);
+          if (exitCode !== 0) {
+            reject(new Error(`Exited with code ${exitCode}`));
+            return;
+          }
+          subprocess.unref();
+          resolve(subprocess);
+        });
+      });
+    });
+  }
+  subprocess.unref();
+  return new Promise((resolve, reject) => {
+    subprocess.once("error", reject);
+    subprocess.once("spawn", () => {
+      subprocess.off("error", reject);
+      resolve(subprocess);
+    });
+  });
+};
+var open = (target, options) => {
+  if (typeof target !== "string") {
+    throw new TypeError("Expected a `target`");
+  }
+  return baseOpen({
+    ...options,
+    target
+  });
+};
+function detectArchBinary(binary) {
+  if (typeof binary === "string" || Array.isArray(binary)) {
+    return binary;
+  }
+  const { [arch]: archBinary } = binary;
+  if (!archBinary) {
+    throw new Error(`${arch} is not supported`);
+  }
+  return archBinary;
+}
+function detectPlatformBinary({ [platform7]: platformBinary }, { wsl } = {}) {
+  if (wsl && is_wsl_default) {
+    return detectArchBinary(wsl);
+  }
+  if (!platformBinary) {
+    throw new Error(`${platform7} is not supported`);
+  }
+  return detectArchBinary(platformBinary);
+}
+var apps = {
+  browser: "browser",
+  browserPrivate: "browserPrivate"
+};
+defineLazyProperty(apps, "chrome", () => detectPlatformBinary({
+  darwin: "google chrome",
+  win32: "chrome",
+  linux: ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser"]
+}, {
+  wsl: {
+    ia32: "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",
+    x64: ["/mnt/c/Program Files/Google/Chrome/Application/chrome.exe", "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"]
+  }
+}));
+defineLazyProperty(apps, "brave", () => detectPlatformBinary({
+  darwin: "brave browser",
+  win32: "brave",
+  linux: ["brave-browser", "brave"]
+}, {
+  wsl: {
+    ia32: "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe",
+    x64: ["/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe", "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe"]
+  }
+}));
+defineLazyProperty(apps, "firefox", () => detectPlatformBinary({
+  darwin: "firefox",
+  win32: String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,
+  linux: "firefox"
+}, {
+  wsl: "/mnt/c/Program Files/Mozilla Firefox/firefox.exe"
+}));
+defineLazyProperty(apps, "edge", () => detectPlatformBinary({
+  darwin: "microsoft edge",
+  win32: "msedge",
+  linux: ["microsoft-edge", "microsoft-edge-dev"]
+}, {
+  wsl: "/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"
+}));
+defineLazyProperty(apps, "safari", () => detectPlatformBinary({
+  darwin: "Safari"
+}));
+var open_default = open;
+
 // src/cli/commands/code/session.tsx
 var import_react23 = __toESM(require_react(), 1);
 
@@ -276301,185 +277670,413 @@ function createPasteFriendlyStdin(real) {
   return proxy;
 }
 
-// src/cli/commands/code/session-engine.ts
-var POLL_MS = 1000;
-function createSessionEngine(options) {
-  const running = new Map;
-  const diffState = newStreamState();
-  let stopped = false;
-  let polling = false;
-  let pollStartedAt = 0;
-  let timer = null;
-  let sendsInFlight = 0;
-  let activeTurnId = null;
-  let turnStartedAt = null;
-  let pendingSubmitAt = null;
-  let lastTurnMs = null;
-  let lastTurnOk = true;
-  let settledCount = 0;
-  let awaitingTurn = options.awaitingTurnLabel ?? null;
-  const awaitingSince = Date.now();
-  let lastEventAt = Date.now();
-  const submit = (raw) => {
-    const typed = raw.trim();
-    if (!typed)
-      return;
-    const text = typed;
-    options.onLine(`${source_default.cyan("❯")} ${source_default.bold(typed)}`);
-    pendingSubmitAt = Date.now();
-    const submitTurnId = activeTurnId;
-    sendsInFlight++;
-    sendTurn(text, options.branchId).then((turn) => {
-      if (turn.queued) {
-        options.onLine(source_default.dim("· queued — runs after the current turn"));
-      }
-    }).catch((error) => {
-      const delivered = activeTurnId !== submitTurnId || turnStartedAt != null || pendingSubmitAt == null;
-      const status = error instanceof ApiError ? error.statusCode : undefined;
-      const edgeDrop = status === 502 || status === 503 || status === 504 || /timeout|gateway/i.test(error instanceof Error ? error.message : "");
-      if (edgeDrop && delivered)
-        return;
-      pendingSubmitAt = null;
-      const message = error instanceof Error ? error.message : String(error);
-      options.onLine(source_default.red(`✗ send failed: ${message}`));
-    }).finally(() => {
-      sendsInFlight--;
-    });
-  };
-  const poll = async (prime) => {
-    const STUCK_POLL_MS = 45000;
-    if (polling && Date.now() - pollStartedAt < STUCK_POLL_MS)
-      return;
-    polling = true;
-    pollStartedAt = Date.now();
-    try {
-      let messages;
-      try {
-        messages = await getFullConversation(30, options.branchId);
-      } catch {
-        return;
-      }
-      const events = diffConversation(diffState, messages);
-      if (!prime) {
-        for (const event of events) {
-          if (event.kind === "tool_start") {
-            const startedAt = Date.now();
-            running.set(event.id, {
-              alias: toolAlias(event.name),
-              label: event.label,
-              summary: event.summary,
-              startedAt
-            });
-            options.onLine({ running: event, startedAt });
-            continue;
-          }
-          if (event.kind === "tool_end") {
-            const started = running.get(event.id)?.startedAt;
-            running.delete(event.id);
-            lastEventAt = Date.now();
-            options.onLine({
-              event,
-              elapsedMs: started != null ? Date.now() - started : undefined
-            });
-            continue;
-          }
-          const line = eventLine(event);
-          if (line != null) {
-            lastEventAt = Date.now();
-            options.onLine(line);
-          }
+// src/cli/commands/code/pending-card.ts
+function openCard(pending) {
+  return {
+    pending,
+    step: 0,
+    cursor: 0,
+    selections: (pending.questions ?? []).map(() => ({ labels: [] })),
+    granted: new Set((pending.permissions ?? []).map((p) => p.key)),
+    typing: pending.kind === "secrets" ? "secret" : pending.kind === "credentials" ? "cred-name" : null,
+    ...pending.kind === "credentials" ? { cred: { name: pending.credentials?.suggestedName } } : {},
+    secretValues: {},
+    ...pending.kind === "browser" ? { browser: { status: "idle" } } : {}
+  };
+}
+var done = (action, input = {}) => ({ state: null, submit: { action, input } });
+var later = { state: null, dismissed: true };
+function choiceRows(state) {
+  return (state.pending.questions?.[state.step]?.options.length ?? 0) + 1;
+}
+function advanceChoice(state) {
+  const questions = state.pending.questions ?? [];
+  if (state.step + 1 < questions.length) {
+    return {
+      state: { ...state, step: state.step + 1, cursor: 0, typing: null }
+    };
+  }
+  return done("approved", choiceAnswers(questions, state.selections, state.pending.answerKey));
+}
+function choiceKey(state, key) {
+  const question = state.pending.questions?.[state.step];
+  if (!question)
+    return done("approved", { answers: [] });
+  const rows = choiceRows(state);
+  const custom = state.cursor === rows - 1;
+  const sel = state.selections[state.step] ?? { labels: [] };
+  const setSel = (next) => {
+    const selections = [...state.selections];
+    selections[state.step] = next;
+    return { ...state, selections };
+  };
+  switch (key) {
+    case "up":
+      return { state: { ...state, cursor: (state.cursor - 1 + rows) % rows } };
+    case "down":
+      return { state: { ...state, cursor: (state.cursor + 1) % rows } };
+    case "space": {
+      if (custom)
+        return { state: { ...state, typing: "custom" } };
+      const label = question.options[state.cursor].label;
+      const labels = question.multiSelect ? sel.labels.includes(label) ? sel.labels.filter((l) => l !== label) : [...sel.labels, label] : [label];
+      return { state: setSel({ ...sel, labels }) };
+    }
+    case "enter": {
+      if (custom)
+        return { state: { ...state, typing: "custom" } };
+      if (question.multiSelect) {
+        if (sel.labels.length === 0 && !sel.customText)
+          return { state };
+        return advanceChoice(state);
+      }
+      const label = question.options[state.cursor].label;
+      return advanceChoice(setSel({ labels: [label] }));
+    }
+    case "s":
+      return done("approved", { answers: [] });
+    case "escape":
+      return later;
+    default:
+      return { state };
+  }
+}
+function permissionsKey(state, key) {
+  const rows = state.pending.permissions ?? [];
+  switch (key) {
+    case "up":
+      return {
+        state: {
+          ...state,
+          cursor: (state.cursor - 1 + rows.length) % rows.length
         }
-      }
-      const turn = newestUserTurn(messages);
-      if (!turn)
-        return;
-      const kickoffDetection = awaitingTurn != null && activeTurnId === null;
-      awaitingTurn = null;
-      if (turn.id !== activeTurnId) {
-        activeTurnId = turn.id;
-        if (!turn.settled) {
-          turnStartedAt = pendingSubmitAt ?? (kickoffDetection ? awaitingSince : Date.now());
-          pendingSubmitAt = null;
-          running.clear();
-        } else if (prime) {
-          turnStartedAt = null;
+      };
+    case "down":
+      return { state: { ...state, cursor: (state.cursor + 1) % rows.length } };
+    case "space": {
+      const k = rows[state.cursor]?.key;
+      if (!k)
+        return { state };
+      const granted = new Set(state.granted);
+      if (granted.has(k))
+        granted.delete(k);
+      else
+        granted.add(k);
+      return { state: { ...state, granted } };
+    }
+    case "enter":
+    case "y":
+      return done("approved", {
+        approved_permission_keys: rows.map((r) => r.key).filter((k) => state.granted.has(k))
+      });
+    case "n":
+      return done("rejected");
+    case "escape":
+      return later;
+    default:
+      return { state };
+  }
+}
+function cardKey(state, key) {
+  if (state.typing) {
+    if (key === "escape") {
+      return state.typing === "secret" || state.typing === "cred-secret" ? later : state.typing === "custom" ? { state: { ...state, typing: null } } : later;
+    }
+    return { state };
+  }
+  switch (state.pending.kind) {
+    case "choice":
+      return choiceKey(state, key);
+    case "permissions":
+      return permissionsKey(state, key);
+    case "browser": {
+      const status = state.browser?.status ?? "idle";
+      if (key === "n")
+        return done("rejected");
+      if (key === "escape")
+        return later;
+      if (key === "y" || key === "enter") {
+        if (status === "active") {
+          return done("approved", state.browser?.connectionId ? { connection_id: state.browser.connectionId } : {});
+        }
+        if (status !== "waiting") {
+          return {
+            state: {
+              ...state,
+              browser: { ...state.browser, status: "waiting" }
+            },
+            startBrowser: true
+          };
         }
       }
-      if (turn.settled && turnStartedAt != null && turn.id === activeTurnId) {
-        const durationMs = Date.now() - turnStartedAt;
-        turnStartedAt = null;
-        running.clear();
-        lastTurnMs = durationMs;
-        const ok = !turn.backendStatus?.startsWith("error");
-        lastTurnOk = ok;
-        options.onLine(ok ? source_default.dim(`— turn finished · ${formatDuration2(durationMs)}`) : source_default.red(`— turn failed (${turn.backendStatus ?? "unknown"}) · ${formatDuration2(durationMs)}`));
-        const info = {
-          turnIndex: settledCount++,
-          ok,
-          backendStatus: turn.backendStatus,
-          durationMs
+      return { state };
+    }
+    case "credentials": {
+      if (key === "n")
+        return done("rejected");
+      if (key === "escape")
+        return later;
+      if (key === "y") {
+        return {
+          state: {
+            ...state,
+            cred: { ...state.cred, source: "own" },
+            typing: "cred-id"
+          }
         };
-        try {
-          await options.onTurnSettled?.(info);
-        } catch {}
       }
-    } finally {
-      polling = false;
+      if (key === "b") {
+        return done("approved", {
+          name: state.cred?.name ?? "",
+          credential_source: "base44",
+          scopes: state.pending.credentials?.scopes ?? []
+        });
+      }
+      return { state };
     }
-  };
+    case "unknown":
+      if (key === "n")
+        return done("rejected");
+      if (key === "escape")
+        return later;
+      return { state };
+    default:
+      if (key === "y" || key === "enter")
+        return done("approved");
+      if (key === "n")
+        return done("rejected");
+      if (key === "escape")
+        return later;
+      return { state };
+  }
+}
+function browserUpdate(state, update) {
   return {
-    async start(primeFirstPoll) {
-      await poll(primeFirstPoll);
-      timer = setInterval(() => {
-        if (!stopped)
-          poll(false);
-      }, POLL_MS);
-      timer.unref?.();
-    },
-    stop() {
-      stopped = true;
-      if (timer)
-        clearInterval(timer);
-    },
-    stopTurn() {
-      if (turnStartedAt == null && sendsInFlight === 0 && pendingSubmitAt == null)
-        return;
-      options.onLine(source_default.dim("· stopping…"));
-      stopTurn(options.branchId).catch((error) => {
-        options.onLine(source_default.red(`  stop failed: ${error instanceof Error ? error.message : String(error)}`));
+    ...state,
+    browser: {
+      url: update.url ?? state.browser?.url,
+      connectionId: update.connectionId ?? state.browser?.connectionId,
+      status: update.status
+    }
+  };
+}
+function cardText(state, text) {
+  const value = text.trim();
+  if (state.typing === "custom") {
+    if (!value)
+      return { state: { ...state, typing: null } };
+    const selections = [...state.selections];
+    const current = selections[state.step] ?? { labels: [] };
+    selections[state.step] = { ...current, customText: value };
+    return advanceChoice({ ...state, selections, typing: null });
+  }
+  if (state.typing === "cred-name") {
+    const name = value || state.cred?.name || "";
+    if (!name)
+      return { state };
+    return { state: { ...state, cred: { ...state.cred, name }, typing: null } };
+  }
+  if (state.typing === "cred-id") {
+    if (!value)
+      return { state };
+    return {
+      state: {
+        ...state,
+        cred: { ...state.cred, clientId: value },
+        typing: "cred-secret"
+      }
+    };
+  }
+  if (state.typing === "cred-secret") {
+    if (!value)
+      return { state };
+    const scopes = state.pending.credentials?.scopes ?? [];
+    return done("approved", {
+      name: state.cred?.name ?? "",
+      client_id: state.cred?.clientId ?? "",
+      client_secret: value,
+      scopes
+    });
+  }
+  if (state.typing === "secret") {
+    const fields = state.pending.secrets ?? [];
+    const field = fields[state.step];
+    if (!field || !value)
+      return { state };
+    const secretValues = { ...state.secretValues, [field.name]: value };
+    if (state.step + 1 < fields.length) {
+      return { state: { ...state, secretValues, step: state.step + 1 } };
+    }
+    return done("approved", { secrets: secretValues });
+  }
+  return { state };
+}
+function cardLines(state) {
+  const p = state.pending;
+  const head = [source_default.bold(`⏸ ${p.title}`)];
+  if (p.detail)
+    head.push(source_default.dim(`  ${p.detail}`));
+  switch (p.kind) {
+    case "choice": {
+      const q = p.questions?.[state.step];
+      if (!q)
+        return [...head, source_default.dim("  (no questions) · Enter to continue")];
+      const total = p.questions?.length ?? 1;
+      const sel = state.selections[state.step] ?? { labels: [] };
+      const rows = q.options.map((o, i) => {
+        const on = sel.labels.includes(o.label);
+        const mark = q.multiSelect ? on ? "☑" : "☐" : on ? "●" : "○";
+        const text = `${state.cursor === i ? "▸" : " "} ${mark} ${o.label}${o.description ? source_default.dim(`  — ${o.description}`) : ""}`;
+        return state.cursor === i ? source_default.cyan(text) : text;
       });
-    },
-    submit,
-    status() {
-      let phase = "idle";
-      if (awaitingTurn != null)
-        phase = "awaiting";
-      else if (turnStartedAt != null)
-        phase = "running";
-      else if (sendsInFlight > 0 || pendingSubmitAt != null)
-        phase = "sending";
-      let runningTool = null;
-      if (running.size > 0) {
-        const newest = [...running.values()].at(-1);
-        runningTool = { ...newest, others: running.size - 1 };
+      const customRow = `${state.cursor === q.options.length ? "▸" : " "} ✎ something else${sel.customText ? source_default.dim(`  — ${sel.customText}`) : ""}`;
+      rows.push(state.cursor === q.options.length ? source_default.cyan(customRow) : customRow);
+      return [
+        ...head,
+        `  ${source_default.bold(q.question)} ${source_default.dim(`(${state.step + 1}/${total})`)}`,
+        ...q.description ? [source_default.dim(`  ${q.description}`)] : [],
+        ...rows.map((r) => `  ${r}`),
+        source_default.dim(q.multiSelect ? "  ↑↓ move · space toggle · Enter next · s skip all · Esc later" : "  ↑↓ move · Enter choose · s skip all · Esc later")
+      ];
+    }
+    case "permissions": {
+      const rows = (p.permissions ?? []).map((r, i) => {
+        const text = `${state.cursor === i ? "▸" : " "} ${state.granted.has(r.key) ? "☑" : "☐"} ${r.label}${r.reason ? source_default.dim(`  — ${r.reason}`) : ""}`;
+        return `  ${state.cursor === i ? source_default.cyan(text) : text}`;
+      });
+      return [
+        ...head,
+        ...rows,
+        source_default.dim("  space toggle · Enter grant ticked · n reject all · Esc later")
+      ];
+    }
+    case "secrets": {
+      const fields = p.secrets ?? [];
+      const rows = fields.map((f, i) => {
+        const filled = f.name in state.secretValues;
+        const mark = filled ? source_default.green("✓") : i === state.step ? "▸" : "○";
+        return `  ${mark} ${f.name}${f.description ? source_default.dim(`  — ${f.description}`) : ""}`;
+      });
+      return [
+        ...head,
+        ...rows,
+        source_default.dim("  type the value below (hidden) · Enter next · Esc later")
+      ];
+    }
+    case "browser": {
+      const b = state.browser ?? { status: "idle" };
+      const link = b.url ? [`  ${source_default.cyan(b.url)}`] : [];
+      switch (b.status) {
+        case "waiting":
+          return [
+            ...head,
+            source_default.dim("  opened in your browser — or use the link:"),
+            ...link,
+            source_default.dim("  waiting for the authorization to complete… · n reject · Esc later")
+          ];
+        case "active":
+          return [
+            ...head,
+            source_default.green("  ✓ connected"),
+            source_default.dim("  y continue · n reject")
+          ];
+        case "failed":
+          return [
+            ...head,
+            source_default.red("  ✗ authorization failed"),
+            source_default.dim("  y try again · n reject · Esc later")
+          ];
+        case "timeout":
+          return [
+            ...head,
+            source_default.yellow("  ⏱ no response yet"),
+            ...link,
+            source_default.dim("  y try again · n reject · Esc later")
+          ];
+        default:
+          return [
+            ...head,
+            source_default.dim("  y open the authorization link · n reject · Esc later")
+          ];
       }
-      return {
-        phase,
-        awaitingLabel: awaitingTurn ?? undefined,
-        idleHint: options.idleHint,
-        quietForMs: Date.now() - lastEventAt,
-        awaitingSince,
-        turnStartedAt,
-        runningTool,
-        lastTurnMs,
-        lastTurnOk
-      };
-    },
-    turnRunning() {
-      return turnStartedAt != null;
     }
+    case "credentials": {
+      const c = state.cred ?? {};
+      const scopes = state.pending.credentials?.scopes ?? [];
+      return [
+        ...head,
+        `  ${c.name ? source_default.green("✓") : "▸"} name${c.name ? source_default.dim(`  — ${c.name}`) : ""}`,
+        `  ${c.source ? source_default.green("✓") : c.name ? "▸" : "○"} credentials${c.source === "own" ? source_default.dim("  — your own OAuth app") : c.source === "base44" ? source_default.dim("  — Base44's") : ""}`,
+        ...c.source === "own" ? [
+          `  ${c.clientId ? source_default.green("✓") : "▸"} client id${c.clientId ? source_default.dim(`  — ${c.clientId}`) : ""}`,
+          `  ${"▸"} client secret ${source_default.dim("(hidden)")}`
+        ] : [],
+        ...scopes.length ? [source_default.dim(`  scopes: ${scopes.join(", ")}`)] : [],
+        source_default.dim(!c.name ? "  type the connector name below · Enter · Esc later" : !c.source ? "  b use Base44's credentials · y enter your own client id + secret · n reject · Esc later" : "  type the value below · Enter next · Esc cancel")
+      ];
+    }
+    case "unknown":
+      return [
+        ...head,
+        source_default.yellow("  this question needs the editor — answer it there and the session continues"),
+        source_default.dim("  n reject · Esc later")
+      ];
+    default:
+      return [...head, source_default.dim("  y approve · n reject · Esc later")];
+  }
+}
+
+// src/core/resources/apps/connections.ts
+var InitiateSchema = object({
+  redirect_url: string2().nullish(),
+  connection_id: string2().nullish(),
+  integration_type: string2().nullish()
+});
+async function startConnectorOAuth(options) {
+  let response;
+  try {
+    response = await getAppClient().post("external-auth/initiate", {
+      json: {
+        integration_type: options.integrationType,
+        scopes: options.scopes ?? null,
+        connector_id: options.connectorId ?? null,
+        force_reconnect: options.forceReconnect === true
+      }
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "starting connector authorization");
+  }
+  const parsed = InitiateSchema.parse(await response.json());
+  if (!parsed.redirect_url || !parsed.connection_id) {
+    throw new ApiError("The connector did not return an authorization link.");
+  }
+  return {
+    url: parsed.redirect_url,
+    connectionId: parsed.connection_id,
+    integrationType: parsed.integration_type ?? options.integrationType
   };
 }
+async function waitForConnectorOAuth(started, options = {}) {
+  const deadline = Date.now() + (options.timeoutMs ?? 10 * 60000);
+  const interval = options.intervalMs ?? 3000;
+  while (Date.now() < deadline && !options.signal?.aborted) {
+    const status = await getOAuthStatus(started.integrationType, started.connectionId).catch(() => null);
+    if (status?.status === "ACTIVE" || status?.status === "FAILED") {
+      return status.status;
+    }
+    await new Promise((r) => setTimeout(r, interval));
+  }
+  return "PENDING";
+}
+var GithubStatusSchema = object({ connected: boolean2() });
+async function githubConnected() {
+  try {
+    const response = await base44Client.get("api/github/oauth/status");
+    return GithubStatusSchema.parse(await response.json()).connected;
+  } catch {
+    return false;
+  }
+}
 
 // src/cli/commands/code/session.tsx
 var jsx_dev_runtime = __toESM(require_jsx_dev_runtime(), 1);
@@ -276523,7 +278120,7 @@ function statusText(status, musingSeed) {
     case "running": {
       const turnFor = formatDuration2(Date.now() - (status.turnStartedAt ?? Date.now()));
       const quiet = status.quietForMs > 60000 ? " · a long private step — details render in the editor" : "";
-      return `${source_default.magenta("✻")} ${source_default.dim(`${idleMusing(musingSeed)} (${turnFor})${quiet}`)}`;
+      return `${source_default.magenta(shimmer())} ${source_default.dim(`${idleMusing(musingSeed)} (${turnFor})${quiet}`)}`;
     }
     case "sending":
       return source_default.dim(`${frame} sending…`);
@@ -276544,6 +278141,8 @@ function SessionView({ engine, footer, subscribe }) {
   const [musingSeed] = import_react23.useState(() => Math.floor(Math.random() * 97));
   const [currentModel, setCurrentModel] = import_react23.useState(null);
   const [pickerIndex, setPickerIndex] = import_react23.useState(null);
+  const [card, setCard] = import_react23.useState(null);
+  const dismissedRef = import_react23.useRef(new Set);
   const maxScrollRef = import_react23.useRef(0);
   const meIdRef = import_react23.useRef(null);
   const emit = (entry) => setItems((h) => withEntry(h, entry));
@@ -276589,6 +278188,84 @@ function SessionView({ engine, footer, subscribe }) {
       emit(source_default.red(`  /model: ${error instanceof Error ? error.message : String(error)}`));
     }
   };
+  const browserRunRef = import_react23.useRef(null);
+  const runBrowserStep = async (state) => {
+    browserRunRef.current?.abort();
+    const run = new AbortController;
+    browserRunRef.current = run;
+    const step = state.pending.browser;
+    try {
+      let url;
+      let connectionId;
+      let wait;
+      if (step?.flow === "github") {
+        url = await startGithubReauth();
+        wait = async () => {
+          const deadline = Date.now() + 10 * 60000;
+          while (Date.now() < deadline && !run.signal.aborted) {
+            if (await githubConnected())
+              return "ACTIVE";
+            await new Promise((r) => setTimeout(r, 3000));
+          }
+          return "PENDING";
+        };
+      } else {
+        const started = await startConnectorOAuth({
+          integrationType: step?.integrationType ?? "",
+          scopes: step?.scopes,
+          connectorId: step?.connectorId,
+          forceReconnect: step?.forceReconnect
+        });
+        url = started.url;
+        connectionId = started.connectionId;
+        wait = () => waitForConnectorOAuth(started, { signal: run.signal });
+      }
+      setCard((c) => c ? browserUpdate(c, { url, connectionId, status: "waiting" }) : c);
+      emit(source_default.dim(`  authorization link: ${url}`));
+      await open_default(url).catch(() => {
+        return;
+      });
+      const outcome = await wait();
+      if (run.signal.aborted)
+        return;
+      setCard((c) => c ? browserUpdate(c, {
+        status: outcome === "ACTIVE" ? "active" : outcome === "FAILED" ? "failed" : "timeout"
+      }) : c);
+    } catch (error) {
+      if (run.signal.aborted)
+        return;
+      emit(source_default.red(`  authorization failed to start: ${error instanceof Error ? error.message : String(error)}`));
+      setCard((c) => c ? browserUpdate(c, { status: "failed" }) : c);
+    }
+  };
+  const applyCard = (outcome) => {
+    if (outcome.submit && card) {
+      browserRunRef.current?.abort();
+      engine.answer(card.pending, outcome.submit.action, outcome.submit.input);
+    }
+    if (outcome.dismissed && card) {
+      browserRunRef.current?.abort();
+      dismissedRef.current.add(card.pending.toolCallId);
+    }
+    setCard(outcome.state);
+    if (outcome.startBrowser && outcome.state) {
+      runBrowserStep(outcome.state);
+    }
+  };
+  const pending = engine.status().pending;
+  import_react23.useEffect(() => {
+    if (card) {
+      if (!pending.some((p) => p.toolCallId === card.pending.toolCallId)) {
+        setCard(null);
+      }
+      return;
+    }
+    if (pickerIndex !== null)
+      return;
+    const next = pending.find((p) => !dismissedRef.current.has(p.toolCallId));
+    if (next)
+      setCard(openCard(next));
+  }, [pending, card, pickerIndex]);
   use_input_default((char, key) => {
     if (pickerIndex !== null) {
       if (key.upArrow)
@@ -276604,6 +278281,23 @@ function SessionView({ engine, footer, subscribe }) {
       }
       return;
     }
+    if (key.tab && !card) {
+      const next = pending.find((p) => dismissedRef.current.has(p.toolCallId));
+      if (next) {
+        dismissedRef.current.delete(next.toolCallId);
+        setCard(openCard(next));
+      }
+      return;
+    }
+    if (card) {
+      const mapped = key.upArrow ? "up" : key.downArrow ? "down" : key.return ? "enter" : key.escape ? "escape" : char === " " ? "space" : char === "y" || char === "n" || char === "s" || char === "b" ? char : null;
+      if (card.typing && mapped !== "escape")
+        return;
+      if (mapped)
+        applyCard(cardKey(card, mapped));
+      if (mapped || !card.typing)
+        return;
+    }
     if (key.ctrl && char === "c") {
       if (input)
         setInput("");
@@ -276648,8 +278342,12 @@ function SessionView({ engine, footer, subscribe }) {
   const innerWidth = Math.max(10, width - 4);
   const inputRows = Math.max(1, Math.ceil((input.length + 3) / innerWidth));
   const pickerOpen = pickerIndex !== null;
-  const inputBlockHeight = pickerOpen ? MODELS.length + 3 : inputRows + 2;
-  const widgetHeight = inputBlockHeight + 3 + (footer.length ? 1 : 0);
+  const cardOpen = card !== null && !card.typing;
+  const cardRows = card ? cardLines(card).length : 0;
+  const inputBlockHeight = pickerOpen ? MODELS.length + 3 : cardOpen ? cardRows + 2 : inputRows + 2 + (card?.typing ? 1 : 0);
+  const footerText = footer.length ? `  ${footer.join(source_default.dim("  ·  "))}` : "";
+  const footerRows = footer.length ? hardWrapAnsi(footerText, Math.max(10, columns)).length : 0;
+  const widgetHeight = inputBlockHeight + 3 + footerRows;
   const viewHeight = Math.max(3, rows - widgetHeight - 1);
   const lines = items.flatMap((item) => hardWrapAnsi(`${renderEntry(item, { verbose, foldHint: "Ctrl+O to expand" })}
 `, columns));
@@ -276699,35 +278397,91 @@ function SessionView({ engine, footer, subscribe }) {
             }, m.name, false, undefined, this);
           })
         ]
-      }, undefined, true, undefined, this) : /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Box_default, {
+      }, undefined, true, undefined, this) : cardOpen && card ? /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Box_default, {
+        flexDirection: "column",
         borderStyle: "round",
-        borderColor: "gray",
+        borderColor: "yellow",
+        paddingX: 1,
+        width,
+        children: cardLines(card).map((line, i) => /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+          wrap: "truncate-end",
+          children: line
+        }, i, false, undefined, this))
+      }, undefined, false, undefined, this) : /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Box_default, {
+        flexDirection: "column",
+        borderStyle: "round",
+        borderColor: card?.typing ? "yellow" : "gray",
         paddingX: 1,
         width,
         children: [
-          /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
-            color: "cyan",
-            children: "❯ "
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsx_dev_runtime.jsxDEV(build_default, {
-            value: input,
-            onChange: setInput,
-            onSubmit: (value) => {
-              const trimmed = value.trim();
-              if (trimmed === "/model" || trimmed.startsWith("/model ")) {
-                runModelSlash(trimmed.slice("/model".length).trim());
-              } else if (trimmed) {
-                engine.submit(value);
-              }
-              setInput("");
-            }
-          }, undefined, false, undefined, this)
+          card?.typing === "secret" && /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+            wrap: "truncate-end",
+            children: [
+              source_default.bold(card.pending.secrets?.[card.step]?.name ?? "secret"),
+              source_default.dim("  — value is hidden · Enter to save · Esc to cancel")
+            ]
+          }, undefined, true, undefined, this),
+          card?.typing === "cred-name" && /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+            wrap: "truncate-end",
+            children: [
+              source_default.bold("connector name"),
+              source_default.dim(card.cred?.name ? `  — Enter keeps "${card.cred.name}" · Esc later` : "  — Enter to save · Esc later")
+            ]
+          }, undefined, true, undefined, this),
+          card?.typing === "cred-id" && /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+            wrap: "truncate-end",
+            children: [
+              source_default.bold("client id"),
+              source_default.dim("  — Enter to save · Esc cancel")
+            ]
+          }, undefined, true, undefined, this),
+          card?.typing === "cred-secret" && /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+            wrap: "truncate-end",
+            children: [
+              source_default.bold("client secret"),
+              source_default.dim("  — value is hidden · Enter to register · Esc cancel")
+            ]
+          }, undefined, true, undefined, this),
+          card?.typing === "custom" && /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+            wrap: "truncate-end",
+            children: [
+              source_default.bold(card.pending.questions?.[card.step]?.question ?? ""),
+              source_default.dim("  — your own answer · Enter to save · Esc to go back")
+            ]
+          }, undefined, true, undefined, this),
+          /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Box_default, {
+            children: [
+              /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+                color: "cyan",
+                children: "❯ "
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsx_dev_runtime.jsxDEV(build_default, {
+                value: input,
+                onChange: setInput,
+                mask: card?.typing === "secret" || card?.typing === "cred-secret" ? "•" : undefined,
+                onSubmit: (value) => {
+                  if (card?.typing) {
+                    applyCard(cardText(card, value));
+                    setInput("");
+                    return;
+                  }
+                  const trimmed = value.trim();
+                  if (trimmed === "/model" || trimmed.startsWith("/model ")) {
+                    runModelSlash(trimmed.slice("/model".length).trim());
+                  } else if (trimmed) {
+                    engine.submit(value);
+                  }
+                  setInput("");
+                }
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this)
         ]
       }, undefined, true, undefined, this),
-      footer.length > 0 && /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+      footer.length > 0 && hardWrapAnsi(footerText, Math.max(10, columns)).map((row, i) => /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
         wrap: "truncate-end",
-        children: `  ${footer.join(source_default.dim("  ·  "))}`
-      }, undefined, false, undefined, this),
+        children: row
+      }, i, false, undefined, this)),
       /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
         wrap: "truncate-end",
         children: `  ${source_default.dim("model")} ${source_default.hex(BRAND_ORANGE)(displayName(currentModel))}`
@@ -276735,7 +278489,7 @@ function SessionView({ engine, footer, subscribe }) {
       /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
         dimColor: true,
         wrap: "truncate-end",
-        children: pickerOpen ? "  ↑↓ to move · Enter to select · Esc to cancel" : engine.turnRunning() ? "  Esc to stop · type to queue · scroll to read · Ctrl+O to expand · Ctrl+C to exit" : "  Enter to send · /model to switch model · Esc for live · Ctrl+O to expand · Ctrl+C to exit"
+        children: pickerOpen ? "  ↑↓ to move · Enter to select · Esc to cancel" : cardOpen ? "  the agent is waiting on you · answer above, or Esc for later" : pending.length > 0 && !card ? `  ⏸ ${pending[0].title} — Tab to answer · Ctrl+C to exit` : engine.turnRunning() ? "  Esc to stop · type to queue · scroll to read · Ctrl+O to expand · Ctrl+C to exit" : "  Enter to send · /model to switch model · Esc for live · Ctrl+O to expand · Ctrl+C to exit"
       }, undefined, false, undefined, this)
     ]
   }, undefined, true, undefined, this);
@@ -276860,6 +278614,7 @@ async function runGenesisSession(options) {
     runningTool: null,
     lastTurnMs: null,
     lastTurnOk: true,
+    pending: [],
     quietForMs: 0
   };
   const genesis = {
@@ -276915,6 +278670,9 @@ async function runGenesisSession(options) {
       }
       return IDLE_STATUS;
     },
+    answer(p, action, input) {
+      inner?.answer(p, action, input);
+    },
     turnRunning() {
       return inner?.turnRunning() ?? creating;
     }
@@ -276947,10 +278705,10 @@ async function runGenesisSession(options) {
 
 // src/cli/commands/code/index.ts
 var BRAND_ORANGE2 = "#E86B3C";
-async function bootstrapApp(prompt, footer, emit, onCreated, importRepo, path, wixLaunch) {
+async function bootstrapApp(prompt, footer, emit, onCreated, importRepo, path, wixInstance) {
   let app;
   try {
-    app = await createAndLinkApp({ prompt, importRepo, path, wixLaunch });
+    app = await createAndLinkApp({ prompt, importRepo, path, wixInstance });
   } catch (error) {
     for (const line of await githubReauthLines(error) ?? [])
       emit(line);
@@ -276997,8 +278755,8 @@ async function codeAction({ log }, options, appId) {
     linked = true;
   } catch {}
   if (linked) {
-    if (options.import || options.path || options.wixLaunch) {
-      throw new InvalidInputError("--import, --path and --wix-launch create a new app; run them outside a linked project, without --app-id.");
+    if (options.import || options.path || options.wixInstance) {
+      throw new InvalidInputError("--import, --path and --wix-instance create a new app; run them outside a linked project, without --app-id.");
     }
     const { id, projectRoot } = getAppContext();
     const state = await assertBuilderApp(id);
@@ -277021,22 +278779,25 @@ async function codeAction({ log }, options, appId) {
       outroMessage: `Session closed. Resume with \`base44 code --app-id ${id}\`.`
     };
   }
-  if (options.wixLaunch && options.import) {
-    throw new InvalidInputError("--wix-launch and --import are exclusive.");
+  if (options.wixInstance && options.import) {
+    throw new InvalidInputError("--wix-instance and --import are exclusive.");
   }
-  const wixLaunch = options.wixLaunch ? parseWixLaunchUrl(options.wixLaunch) : undefined;
+  const wixInstance = options.wixInstance?.trim() ? {
+    signedInstance: options.wixInstance.trim(),
+    wixClientId: options.wixClientId?.trim() || undefined
+  } : undefined;
   let created;
   const footer = [
-    chip(options.import ? repoLabel(options.import) : wixLaunch ? "web app · wix" : "web app")
+    chip(options.import ? repoLabel(options.import) : wixInstance ? "web app · wix" : "web app")
   ];
   await runGenesisSession({
     idleHint: options.import ? "describe what to build over the repository" : "describe the app you want to build  ·  have one already? base44 code --app-id <id>, or base44 link",
     creatingLabel: options.import ? "importing the repository" : "creating your app",
-    modeLabel: options.import ? `Repository — ${repoLabel(options.import)}` : wixLaunch ? "Web app — Wix launch (connector connected first)" : "Web app — Base44 template + builder agent",
+    modeLabel: options.import ? `Repository — ${repoLabel(options.import)}` : wixInstance ? "Web app — Wix launch (connector connected first)" : "Web app — Base44 template + builder agent",
     footer,
     createApp: (prompt, emit) => bootstrapApp(prompt, footer, emit, (app) => {
       created = app;
-    }, options.import, options.path, wixLaunch)
+    }, options.import, options.path, wixInstance)
   });
   if (!created) {
     return { outroMessage: "Session closed. No app was created." };
@@ -277048,616 +278809,10 @@ async function codeAction({ log }, options, appId) {
 }
 function getCodeCommand() {
   const command = new Base44Command("code", { requireAppContext: false });
-  command.description("Open Base44 Code, an interactive builder session. In a linked directory (or with --app-id <id>) it opens that app; anywhere else your first prompt creates one (--import <repo> to build over your own repository). Attach a directory to an existing app with base44 link.").option("--import <repo>", "Build over an existing GitHub repository instead of the Base44 template").option("--path <dir>", "Directory to link the new app to (default: the current directory when empty, else ./<name>)").option("--wix-launch <url>", "Create the new app through a Wix launch URL (your first prompt is what the agent runs)").action((ctx, options) => codeAction(ctx, options, command.optsWithGlobals().appId));
+  command.description("Open Base44 Code, an interactive builder session. In a linked directory (or with --app-id <id>) it opens that app; anywhere else your first prompt creates one (--import <repo> to build over your own repository). Attach a directory to an existing app with base44 link.").option("--import <repo>", "Build over an existing GitHub repository instead of the Base44 template").option("--path <dir>", "Directory to link the new app to (default: the current directory when empty, else ./<name>)").option("--wix-instance <token>", "Create the new app through the Wix route with this signed instance (your first prompt is what the agent runs)").option("--wix-client-id <id>", "The companion OAuth app's client id").action((ctx, options) => codeAction(ctx, options, command.optsWithGlobals().appId));
   return command;
 }
 
-// ../../node_modules/open/index.js
-import process30 from "node:process";
-import path16 from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-import childProcess3 from "node:child_process";
-import fs20, { constants as fsConstants2 } from "node:fs/promises";
-
-// ../../node_modules/wsl-utils/index.js
-import { promisify as promisify6 } from "node:util";
-import childProcess2 from "node:child_process";
-import fs19, { constants as fsConstants } from "node:fs/promises";
-
-// ../../node_modules/is-wsl/index.js
-import process24 from "node:process";
-import os4 from "node:os";
-import fs18 from "node:fs";
-
-// ../../node_modules/is-inside-container/index.js
-import fs17 from "node:fs";
-
-// ../../node_modules/is-docker/index.js
-import fs16 from "node:fs";
-var isDockerCached;
-function hasDockerEnv() {
-  try {
-    fs16.statSync("/.dockerenv");
-    return true;
-  } catch {
-    return false;
-  }
-}
-function hasDockerCGroup() {
-  try {
-    return fs16.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
-  } catch {
-    return false;
-  }
-}
-function isDocker() {
-  if (isDockerCached === undefined) {
-    isDockerCached = hasDockerEnv() || hasDockerCGroup();
-  }
-  return isDockerCached;
-}
-
-// ../../node_modules/is-inside-container/index.js
-var cachedResult;
-var hasContainerEnv = () => {
-  try {
-    fs17.statSync("/run/.containerenv");
-    return true;
-  } catch {
-    return false;
-  }
-};
-function isInsideContainer() {
-  if (cachedResult === undefined) {
-    cachedResult = hasContainerEnv() || isDocker();
-  }
-  return cachedResult;
-}
-
-// ../../node_modules/is-wsl/index.js
-var isWsl = () => {
-  if (process24.platform !== "linux") {
-    return false;
-  }
-  if (os4.release().toLowerCase().includes("microsoft")) {
-    if (isInsideContainer()) {
-      return false;
-    }
-    return true;
-  }
-  try {
-    return fs18.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
-  } catch {
-    return false;
-  }
-};
-var is_wsl_default = process24.env.__IS_WSL_TEST__ ? isWsl : isWsl();
-
-// ../../node_modules/powershell-utils/index.js
-import process25 from "node:process";
-import { Buffer as Buffer7 } from "node:buffer";
-import { promisify as promisify5 } from "node:util";
-import childProcess from "node:child_process";
-var execFile = promisify5(childProcess.execFile);
-var powerShellPath = () => `${process25.env.SYSTEMROOT || process25.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
-var executePowerShell = async (command, options = {}) => {
-  const {
-    powerShellPath: psPath,
-    ...execFileOptions
-  } = options;
-  const encodedCommand = executePowerShell.encodeCommand(command);
-  return execFile(psPath ?? powerShellPath(), [
-    ...executePowerShell.argumentsPrefix,
-    encodedCommand
-  ], {
-    encoding: "utf8",
-    ...execFileOptions
-  });
-};
-executePowerShell.argumentsPrefix = [
-  "-NoProfile",
-  "-NonInteractive",
-  "-ExecutionPolicy",
-  "Bypass",
-  "-EncodedCommand"
-];
-executePowerShell.encodeCommand = (command) => Buffer7.from(command, "utf16le").toString("base64");
-executePowerShell.escapeArgument = (value) => `'${String(value).replaceAll("'", "''")}'`;
-
-// ../../node_modules/wsl-utils/utilities.js
-function parseMountPointFromConfig(content) {
-  for (const line of content.split(`
-`)) {
-    if (/^\s*#/.test(line)) {
-      continue;
-    }
-    const match = /^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(line);
-    if (!match) {
-      continue;
-    }
-    return match.groups.mountPoint.trim().replaceAll(/^["']|["']$/g, "");
-  }
-}
-
-// ../../node_modules/wsl-utils/index.js
-var execFile2 = promisify6(childProcess2.execFile);
-var wslDrivesMountPoint = (() => {
-  const defaultMountPoint = "/mnt/";
-  let mountPoint;
-  return async function() {
-    if (mountPoint) {
-      return mountPoint;
-    }
-    const configFilePath = "/etc/wsl.conf";
-    let isConfigFileExists = false;
-    try {
-      await fs19.access(configFilePath, fsConstants.F_OK);
-      isConfigFileExists = true;
-    } catch {}
-    if (!isConfigFileExists) {
-      return defaultMountPoint;
-    }
-    const configContent = await fs19.readFile(configFilePath, { encoding: "utf8" });
-    const parsedMountPoint = parseMountPointFromConfig(configContent);
-    if (parsedMountPoint === undefined) {
-      return defaultMountPoint;
-    }
-    mountPoint = parsedMountPoint;
-    mountPoint = mountPoint.endsWith("/") ? mountPoint : `${mountPoint}/`;
-    return mountPoint;
-  };
-})();
-var powerShellPathFromWsl = async () => {
-  const mountPoint = await wslDrivesMountPoint();
-  return `${mountPoint}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`;
-};
-var powerShellPath2 = is_wsl_default ? powerShellPathFromWsl : powerShellPath;
-var canAccessPowerShellPromise;
-var canAccessPowerShell = async () => {
-  canAccessPowerShellPromise ??= (async () => {
-    try {
-      const psPath = await powerShellPath2();
-      await fs19.access(psPath, fsConstants.X_OK);
-      return true;
-    } catch {
-      return false;
-    }
-  })();
-  return canAccessPowerShellPromise;
-};
-var wslDefaultBrowser = async () => {
-  const psPath = await powerShellPath2();
-  const command = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
-  const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
-  return stdout.trim();
-};
-var convertWslPathToWindows = async (path) => {
-  if (/^[a-z]+:\/\//i.test(path)) {
-    return path;
-  }
-  try {
-    const { stdout } = await execFile2("wslpath", ["-aw", path], { encoding: "utf8" });
-    return stdout.trim();
-  } catch {
-    return path;
-  }
-};
-
-// ../../node_modules/define-lazy-prop/index.js
-function defineLazyProperty(object, propertyName, valueGetter) {
-  const define2 = (value) => Object.defineProperty(object, propertyName, { value, enumerable: true, writable: true });
-  Object.defineProperty(object, propertyName, {
-    configurable: true,
-    enumerable: true,
-    get() {
-      const result = valueGetter();
-      define2(result);
-      return result;
-    },
-    set(value) {
-      define2(value);
-    }
-  });
-  return object;
-}
-
-// ../../node_modules/default-browser/index.js
-import { promisify as promisify10 } from "node:util";
-import process28 from "node:process";
-import { execFile as execFile6 } from "node:child_process";
-
-// ../../node_modules/default-browser-id/index.js
-import { promisify as promisify7 } from "node:util";
-import process26 from "node:process";
-import { execFile as execFile3 } from "node:child_process";
-var execFileAsync = promisify7(execFile3);
-async function defaultBrowserId() {
-  if (process26.platform !== "darwin") {
-    throw new Error("macOS only");
-  }
-  const { stdout } = await execFileAsync("defaults", ["read", "com.apple.LaunchServices/com.apple.launchservices.secure", "LSHandlers"]);
-  const match = /LSHandlerRoleAll = "(?!-)(?<id>[^"]+?)";\s+?LSHandlerURLScheme = (?:http|https);/.exec(stdout);
-  const browserId = match?.groups.id ?? "com.apple.Safari";
-  if (browserId === "com.apple.safari") {
-    return "com.apple.Safari";
-  }
-  return browserId;
-}
-
-// ../../node_modules/run-applescript/index.js
-import process27 from "node:process";
-import { promisify as promisify8 } from "node:util";
-import { execFile as execFile4, execFileSync } from "node:child_process";
-var execFileAsync2 = promisify8(execFile4);
-async function runAppleScript(script, { humanReadableOutput = true, signal } = {}) {
-  if (process27.platform !== "darwin") {
-    throw new Error("macOS only");
-  }
-  const outputArguments = humanReadableOutput ? [] : ["-ss"];
-  const execOptions = {};
-  if (signal) {
-    execOptions.signal = signal;
-  }
-  const { stdout } = await execFileAsync2("osascript", ["-e", script, outputArguments], execOptions);
-  return stdout.trim();
-}
-
-// ../../node_modules/bundle-name/index.js
-async function bundleName(bundleId) {
-  return runAppleScript(`tell application "Finder" to set app_path to application file id "${bundleId}" as string
-tell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`);
-}
-
-// ../../node_modules/default-browser/windows.js
-import { promisify as promisify9 } from "node:util";
-import { execFile as execFile5 } from "node:child_process";
-var execFileAsync3 = promisify9(execFile5);
-var windowsBrowserProgIds = {
-  MSEdgeHTM: { name: "Edge", id: "com.microsoft.edge" },
-  MSEdgeBHTML: { name: "Edge Beta", id: "com.microsoft.edge.beta" },
-  MSEdgeDHTML: { name: "Edge Dev", id: "com.microsoft.edge.dev" },
-  AppXq0fevzme2pys62n3e0fbqa7peapykr8v: { name: "Edge", id: "com.microsoft.edge.old" },
-  ChromeHTML: { name: "Chrome", id: "com.google.chrome" },
-  ChromeBHTML: { name: "Chrome Beta", id: "com.google.chrome.beta" },
-  ChromeDHTML: { name: "Chrome Dev", id: "com.google.chrome.dev" },
-  ChromiumHTM: { name: "Chromium", id: "org.chromium.Chromium" },
-  BraveHTML: { name: "Brave", id: "com.brave.Browser" },
-  BraveBHTML: { name: "Brave Beta", id: "com.brave.Browser.beta" },
-  BraveDHTML: { name: "Brave Dev", id: "com.brave.Browser.dev" },
-  BraveSSHTM: { name: "Brave Nightly", id: "com.brave.Browser.nightly" },
-  FirefoxURL: { name: "Firefox", id: "org.mozilla.firefox" },
-  OperaStable: { name: "Opera", id: "com.operasoftware.Opera" },
-  VivaldiHTM: { name: "Vivaldi", id: "com.vivaldi.Vivaldi" },
-  "IE.HTTP": { name: "Internet Explorer", id: "com.microsoft.ie" }
-};
-var _windowsBrowserProgIdMap = new Map(Object.entries(windowsBrowserProgIds));
-
-class UnknownBrowserError extends Error {
-}
-async function defaultBrowser(_execFileAsync = execFileAsync3) {
-  const { stdout } = await _execFileAsync("reg", [
-    "QUERY",
-    " HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
-    "/v",
-    "ProgId"
-  ]);
-  const match = /ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(stdout);
-  if (!match) {
-    throw new UnknownBrowserError(`Cannot find Windows browser in stdout: ${JSON.stringify(stdout)}`);
-  }
-  const { id } = match.groups;
-  const dotIndex = id.lastIndexOf(".");
-  const hyphenIndex = id.lastIndexOf("-");
-  const baseIdByDot = dotIndex === -1 ? undefined : id.slice(0, dotIndex);
-  const baseIdByHyphen = hyphenIndex === -1 ? undefined : id.slice(0, hyphenIndex);
-  return windowsBrowserProgIds[id] ?? windowsBrowserProgIds[baseIdByDot] ?? windowsBrowserProgIds[baseIdByHyphen] ?? { name: id, id };
-}
-
-// ../../node_modules/default-browser/index.js
-var execFileAsync4 = promisify10(execFile6);
-var titleize = (string) => string.toLowerCase().replaceAll(/(?:^|\s|-)\S/g, (x) => x.toUpperCase());
-async function defaultBrowser2() {
-  if (process28.platform === "darwin") {
-    const id = await defaultBrowserId();
-    const name = await bundleName(id);
-    return { name, id };
-  }
-  if (process28.platform === "linux") {
-    const { stdout } = await execFileAsync4("xdg-mime", ["query", "default", "x-scheme-handler/http"]);
-    const id = stdout.trim();
-    const name = titleize(id.replace(/.desktop$/, "").replace("-", " "));
-    return { name, id };
-  }
-  if (process28.platform === "win32") {
-    return defaultBrowser();
-  }
-  throw new Error("Only macOS, Linux, and Windows are supported");
-}
-
-// ../../node_modules/is-in-ssh/index.js
-import process29 from "node:process";
-var isInSsh = Boolean(process29.env.SSH_CONNECTION || process29.env.SSH_CLIENT || process29.env.SSH_TTY);
-var is_in_ssh_default = isInSsh;
-
-// ../../node_modules/open/index.js
-var fallbackAttemptSymbol = Symbol("fallbackAttempt");
-var __dirname2 = import.meta.url ? path16.dirname(fileURLToPath4(import.meta.url)) : "";
-var localXdgOpenPath = path16.join(__dirname2, "xdg-open");
-var { platform: platform7, arch } = process30;
-var tryEachApp = async (apps, opener) => {
-  if (apps.length === 0) {
-    return;
-  }
-  const errors = [];
-  for (const app of apps) {
-    try {
-      return await opener(app);
-    } catch (error) {
-      errors.push(error);
-    }
-  }
-  throw new AggregateError(errors, "Failed to open in all supported apps");
-};
-var baseOpen = async (options) => {
-  options = {
-    wait: false,
-    background: false,
-    newInstance: false,
-    allowNonzeroExitCode: false,
-    ...options
-  };
-  const isFallbackAttempt = options[fallbackAttemptSymbol] === true;
-  delete options[fallbackAttemptSymbol];
-  if (Array.isArray(options.app)) {
-    return tryEachApp(options.app, (singleApp) => baseOpen({
-      ...options,
-      app: singleApp,
-      [fallbackAttemptSymbol]: true
-    }));
-  }
-  let { name: app, arguments: appArguments = [] } = options.app ?? {};
-  appArguments = [...appArguments];
-  if (Array.isArray(app)) {
-    return tryEachApp(app, (appName) => baseOpen({
-      ...options,
-      app: {
-        name: appName,
-        arguments: appArguments
-      },
-      [fallbackAttemptSymbol]: true
-    }));
-  }
-  if (app === "browser" || app === "browserPrivate") {
-    const ids = {
-      "com.google.chrome": "chrome",
-      "google-chrome.desktop": "chrome",
-      "com.brave.browser": "brave",
-      "org.mozilla.firefox": "firefox",
-      "firefox.desktop": "firefox",
-      "com.microsoft.msedge": "edge",
-      "com.microsoft.edge": "edge",
-      "com.microsoft.edgemac": "edge",
-      "microsoft-edge.desktop": "edge",
-      "com.apple.safari": "safari"
-    };
-    const flags = {
-      chrome: "--incognito",
-      brave: "--incognito",
-      firefox: "--private-window",
-      edge: "--inPrivate"
-    };
-    let browser;
-    if (is_wsl_default) {
-      const progId = await wslDefaultBrowser();
-      const browserInfo = _windowsBrowserProgIdMap.get(progId);
-      browser = browserInfo ?? {};
-    } else {
-      browser = await defaultBrowser2();
-    }
-    if (browser.id in ids) {
-      const browserName = ids[browser.id.toLowerCase()];
-      if (app === "browserPrivate") {
-        if (browserName === "safari") {
-          throw new Error("Safari doesn't support opening in private mode via command line");
-        }
-        appArguments.push(flags[browserName]);
-      }
-      return baseOpen({
-        ...options,
-        app: {
-          name: apps[browserName],
-          arguments: appArguments
-        }
-      });
-    }
-    throw new Error(`${browser.name} is not supported as a default browser`);
-  }
-  let command;
-  const cliArguments = [];
-  const childProcessOptions = {};
-  let shouldUseWindowsInWsl = false;
-  if (is_wsl_default && !isInsideContainer() && !is_in_ssh_default && !app) {
-    shouldUseWindowsInWsl = await canAccessPowerShell();
-  }
-  if (platform7 === "darwin") {
-    command = "open";
-    if (options.wait) {
-      cliArguments.push("--wait-apps");
-    }
-    if (options.background) {
-      cliArguments.push("--background");
-    }
-    if (options.newInstance) {
-      cliArguments.push("--new");
-    }
-    if (app) {
-      cliArguments.push("-a", app);
-    }
-  } else if (platform7 === "win32" || shouldUseWindowsInWsl) {
-    command = await powerShellPath2();
-    cliArguments.push(...executePowerShell.argumentsPrefix);
-    if (!is_wsl_default) {
-      childProcessOptions.windowsVerbatimArguments = true;
-    }
-    if (is_wsl_default && options.target) {
-      options.target = await convertWslPathToWindows(options.target);
-    }
-    const encodedArguments = ["$ProgressPreference = 'SilentlyContinue';", "Start"];
-    if (options.wait) {
-      encodedArguments.push("-Wait");
-    }
-    if (app) {
-      encodedArguments.push(executePowerShell.escapeArgument(app));
-      if (options.target) {
-        appArguments.push(options.target);
-      }
-    } else if (options.target) {
-      encodedArguments.push(executePowerShell.escapeArgument(options.target));
-    }
-    if (appArguments.length > 0) {
-      appArguments = appArguments.map((argument) => executePowerShell.escapeArgument(argument));
-      encodedArguments.push("-ArgumentList", appArguments.join(","));
-    }
-    options.target = executePowerShell.encodeCommand(encodedArguments.join(" "));
-    if (!options.wait) {
-      childProcessOptions.stdio = "ignore";
-    }
-  } else {
-    if (app) {
-      command = app;
-    } else {
-      const isBundled = !__dirname2 || __dirname2 === "/";
-      let exeLocalXdgOpen = false;
-      try {
-        await fs20.access(localXdgOpenPath, fsConstants2.X_OK);
-        exeLocalXdgOpen = true;
-      } catch {}
-      const useSystemXdgOpen = process30.versions.electron ?? (platform7 === "android" || isBundled || !exeLocalXdgOpen);
-      command = useSystemXdgOpen ? "xdg-open" : localXdgOpenPath;
-    }
-    if (appArguments.length > 0) {
-      cliArguments.push(...appArguments);
-    }
-    if (!options.wait) {
-      childProcessOptions.stdio = "ignore";
-      childProcessOptions.detached = true;
-    }
-  }
-  if (platform7 === "darwin" && appArguments.length > 0) {
-    cliArguments.push("--args", ...appArguments);
-  }
-  if (options.target) {
-    cliArguments.push(options.target);
-  }
-  const subprocess = childProcess3.spawn(command, cliArguments, childProcessOptions);
-  if (options.wait) {
-    return new Promise((resolve, reject) => {
-      subprocess.once("error", reject);
-      subprocess.once("close", (exitCode) => {
-        if (!options.allowNonzeroExitCode && exitCode !== 0) {
-          reject(new Error(`Exited with code ${exitCode}`));
-          return;
-        }
-        resolve(subprocess);
-      });
-    });
-  }
-  if (isFallbackAttempt) {
-    return new Promise((resolve, reject) => {
-      subprocess.once("error", reject);
-      subprocess.once("spawn", () => {
-        subprocess.once("close", (exitCode) => {
-          subprocess.off("error", reject);
-          if (exitCode !== 0) {
-            reject(new Error(`Exited with code ${exitCode}`));
-            return;
-          }
-          subprocess.unref();
-          resolve(subprocess);
-        });
-      });
-    });
-  }
-  subprocess.unref();
-  return new Promise((resolve, reject) => {
-    subprocess.once("error", reject);
-    subprocess.once("spawn", () => {
-      subprocess.off("error", reject);
-      resolve(subprocess);
-    });
-  });
-};
-var open = (target, options) => {
-  if (typeof target !== "string") {
-    throw new TypeError("Expected a `target`");
-  }
-  return baseOpen({
-    ...options,
-    target
-  });
-};
-function detectArchBinary(binary) {
-  if (typeof binary === "string" || Array.isArray(binary)) {
-    return binary;
-  }
-  const { [arch]: archBinary } = binary;
-  if (!archBinary) {
-    throw new Error(`${arch} is not supported`);
-  }
-  return archBinary;
-}
-function detectPlatformBinary({ [platform7]: platformBinary }, { wsl } = {}) {
-  if (wsl && is_wsl_default) {
-    return detectArchBinary(wsl);
-  }
-  if (!platformBinary) {
-    throw new Error(`${platform7} is not supported`);
-  }
-  return detectArchBinary(platformBinary);
-}
-var apps = {
-  browser: "browser",
-  browserPrivate: "browserPrivate"
-};
-defineLazyProperty(apps, "chrome", () => detectPlatformBinary({
-  darwin: "google chrome",
-  win32: "chrome",
-  linux: ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser"]
-}, {
-  wsl: {
-    ia32: "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",
-    x64: ["/mnt/c/Program Files/Google/Chrome/Application/chrome.exe", "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"]
-  }
-}));
-defineLazyProperty(apps, "brave", () => detectPlatformBinary({
-  darwin: "brave browser",
-  win32: "brave",
-  linux: ["brave-browser", "brave"]
-}, {
-  wsl: {
-    ia32: "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe",
-    x64: ["/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe", "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe"]
-  }
-}));
-defineLazyProperty(apps, "firefox", () => detectPlatformBinary({
-  darwin: "firefox",
-  win32: String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,
-  linux: "firefox"
-}, {
-  wsl: "/mnt/c/Program Files/Mozilla Firefox/firefox.exe"
-}));
-defineLazyProperty(apps, "edge", () => detectPlatformBinary({
-  darwin: "microsoft edge",
-  win32: "msedge",
-  linux: ["microsoft-edge", "microsoft-edge-dev"]
-}, {
-  wsl: "/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"
-}));
-defineLazyProperty(apps, "safari", () => detectPlatformBinary({
-  darwin: "Safari"
-}));
-var open_default = open;
-
 // src/cli/commands/connectors/oauth-prompt.ts
 var POLL_INTERVAL_MS = 2000;
 var POLL_TIMEOUT_MS2 = 2 * 60 * 1000;
@@ -279425,7 +280580,7 @@ async function callTool(appId, tool, payload, schema, context, timeout = 60000)
 function listDirectory(appId, params) {
   return callTool(appId, "list_directory", { ...params }, ListDirectoryResponseSchema, "listing directory");
 }
-function readFile4(appId, params) {
+function readFile5(appId, params) {
   return callTool(appId, "read_file", { ...params }, ReadFileResponseSchema, "reading file");
 }
 function writeFile3(appId, params) {
@@ -279580,7 +280735,7 @@ async function readFileAction({ runTask, branchId }, paths, options) {
   const { id: appId } = getAppContext();
   const offset = parsePositiveInt(options.offset, "--offset");
   const limit = parsePositiveInt(options.limit, "--limit");
-  const result = await runTask("Reading file", () => readFile4(appId, { paths, offset, limit, branch_id: branchId }));
+  const result = await runTask("Reading file", () => readFile5(appId, { paths, offset, limit, branch_id: branchId }));
   return { outroMessage: "Read file", stdout: toJsonStdout(result) };
 }
 function getSandboxReadFileCommand() {
@@ -284431,7 +285586,7 @@ async function runScript(options) {
   }
 }
 // src/cli/commands/exec.ts
-function readStdin3() {
+function readStdin4() {
   return new Promise((resolve, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
@@ -284475,7 +285630,7 @@ async function execAction({ app, isNonInteractive }, options) {
   if (!isNonInteractive) {
     throw noInputError;
   }
-  const code = await readStdin3();
+  const code = await readStdin4();
   if (!code.trim()) {
     throw noInputError;
   }
@@ -288656,6 +289811,13 @@ function getFullCommandName(command) {
   }
   return parts.join(" ");
 }
+var SENSITIVE_OPTION = /secret|token|password|launch|instance|key$/i;
+function redactSensitiveOptions(options) {
+  return Object.fromEntries(Object.entries(options).map(([k, v]) => [
+    k,
+    SENSITIVE_OPTION.test(k) && v != null && v !== false ? "[redacted]" : v
+  ]));
+}
 function addCommandInfoToErrorReporter(program, errorReporter) {
   program.hook("preAction", (_, actionCommand) => {
     const fullCommandName = getFullCommandName(actionCommand);
@@ -288663,7 +289825,7 @@ function addCommandInfoToErrorReporter(program, errorReporter) {
       command: {
         name: fullCommandName,
         args: actionCommand.args,
-        options: actionCommand.opts()
+        options: redactSensitiveOptions(actionCommand.opts())
       }
     });
   });
@@ -288710,4 +289872,4 @@ export {
   runCLI
 };
 
-//# debugId=9A8433398282BCF064756E2164756E21
+//# debugId=C63258896EE6B31064756E2164756E21