@base44-preview/cli 0.1.15-pr.630.ca4815b → 0.1.15-pr.630.e926db5

package/dist/cli/index.js

@@ -52822,7 +52822,7 @@ function canBreakFn(doc) {
 function canBreak(doc) {
   return findInDoc(doc, canBreakFn, false);
 }
-function indent(contents) {
+function indent2(contents) {
   assertDoc(contents);
   return { type: DOC_TYPE_INDENT, contents };
 }
@@ -52845,7 +52845,7 @@ function addAlignmentToDoc(doc, size, tabWidth) {
   let aligned = doc;
   if (size > 0) {
     for (let level = 0;level < Math.floor(size / tabWidth); ++level) {
-      aligned = indent(aligned);
+      aligned = indent2(aligned);
     }
     aligned = align(size % tabWidth, aligned);
     aligned = align(Number.NEGATIVE_INFINITY, aligned);
@@ -53179,7 +53179,7 @@ function printDocToString(doc, options) {
   propagateBreaks(doc);
   while (commands.length > 0) {
     const {
-      indent: indent2,
+      indent: indent22,
       mode,
       doc: doc2
     } = commands.pop();
@@ -53199,7 +53199,7 @@ function printDocToString(doc, options) {
       case DOC_TYPE_ARRAY:
         for (let index = doc2.length - 1;index >= 0; index--) {
           commands.push({
-            indent: indent2,
+            indent: indent22,
             mode,
             doc: doc2[index]
           });
@@ -53213,14 +53213,14 @@ function printDocToString(doc, options) {
         break;
       case DOC_TYPE_INDENT:
         commands.push({
-          indent: makeIndent(indent2, options),
+          indent: makeIndent(indent22, options),
           mode,
           doc: doc2.contents
         });
         break;
       case DOC_TYPE_ALIGN:
         commands.push({
-          indent: makeAlign(indent2, doc2.n, options),
+          indent: makeAlign(indent22, doc2.n, options),
           mode,
           doc: doc2.contents
         });
@@ -53233,7 +53233,7 @@ function printDocToString(doc, options) {
           case MODE_FLAT:
             if (!shouldRemeasure) {
               commands.push({
-                indent: indent2,
+                indent: indent22,
                 mode: doc2.break ? MODE_BREAK : MODE_FLAT,
                 doc: doc2.contents
               });
@@ -53242,7 +53242,7 @@ function printDocToString(doc, options) {
           case MODE_BREAK: {
             shouldRemeasure = false;
             const next = {
-              indent: indent2,
+              indent: indent22,
               mode: MODE_FLAT,
               doc: doc2.contents
             };
@@ -53255,7 +53255,7 @@ function printDocToString(doc, options) {
                 const mostExpanded = method_at_default(0, doc2.expandedStates, -1);
                 if (doc2.break) {
                   commands.push({
-                    indent: indent2,
+                    indent: indent22,
                     mode: MODE_BREAK,
                     doc: mostExpanded
                   });
@@ -53264,7 +53264,7 @@ function printDocToString(doc, options) {
                   for (let index = 1;index < doc2.expandedStates.length + 1; index++) {
                     if (index >= doc2.expandedStates.length) {
                       commands.push({
-                        indent: indent2,
+                        indent: indent22,
                         mode: MODE_BREAK,
                         doc: mostExpanded
                       });
@@ -53272,7 +53272,7 @@ function printDocToString(doc, options) {
                     } else {
                       const state = doc2.expandedStates[index];
                       const cmd = {
-                        indent: indent2,
+                        indent: indent22,
                         mode: MODE_FLAT,
                         doc: state
                       };
@@ -53285,7 +53285,7 @@ function printDocToString(doc, options) {
                 }
               } else {
                 commands.push({
-                  indent: indent2,
+                  indent: indent22,
                   mode: MODE_BREAK,
                   doc: doc2.contents
                 });
@@ -53311,12 +53311,12 @@ function printDocToString(doc, options) {
         const content = parts[offset + 0];
         const whitespace = parts[offset + 1];
         const contentFlatCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_FLAT,
           doc: content
         };
         const contentBreakCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_BREAK,
           doc: content
         };
@@ -53330,12 +53330,12 @@ function printDocToString(doc, options) {
           break;
         }
         const whitespaceFlatCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_FLAT,
           doc: whitespace
         };
         const whitespaceBreakCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_BREAK,
           doc: whitespace
         };
@@ -53349,7 +53349,7 @@ function printDocToString(doc, options) {
         }
         const secondContent = parts[offset + 2];
         const remainingCommand = {
-          indent: indent2,
+          indent: indent22,
           mode,
           doc: {
             ...doc2,
@@ -53357,7 +53357,7 @@ function printDocToString(doc, options) {
           }
         };
         const firstAndSecondContentFlatCommand = {
-          indent: indent2,
+          indent: indent22,
           mode: MODE_FLAT,
           doc: [content, whitespace, secondContent]
         };
@@ -53376,20 +53376,20 @@ function printDocToString(doc, options) {
       case DOC_TYPE_INDENT_IF_BREAK: {
         const groupMode = doc2.groupId ? groupModeMap[doc2.groupId] : mode;
         if (groupMode === MODE_BREAK) {
-          const breakContents = doc2.type === DOC_TYPE_IF_BREAK ? doc2.breakContents : doc2.negate ? doc2.contents : indent(doc2.contents);
+          const breakContents = doc2.type === DOC_TYPE_IF_BREAK ? doc2.breakContents : doc2.negate ? doc2.contents : indent2(doc2.contents);
           if (breakContents) {
             commands.push({
-              indent: indent2,
+              indent: indent22,
               mode,
               doc: breakContents
             });
           }
         }
         if (groupMode === MODE_FLAT) {
-          const flatContents = doc2.type === DOC_TYPE_IF_BREAK ? doc2.flatContents : doc2.negate ? indent(doc2.contents) : doc2.contents;
+          const flatContents = doc2.type === DOC_TYPE_IF_BREAK ? doc2.flatContents : doc2.negate ? indent2(doc2.contents) : doc2.contents;
           if (flatContents) {
             commands.push({
-              indent: indent2,
+              indent: indent22,
               mode,
               doc: flatContents
             });
@@ -53399,7 +53399,7 @@ function printDocToString(doc, options) {
       }
       case DOC_TYPE_LINE_SUFFIX:
         lineSuffix2.push({
-          indent: indent2,
+          indent: indent22,
           mode,
           doc: doc2.contents
         });
@@ -53407,7 +53407,7 @@ function printDocToString(doc, options) {
       case DOC_TYPE_LINE_SUFFIX_BOUNDARY:
         if (lineSuffix2.length > 0) {
           commands.push({
-            indent: indent2,
+            indent: indent22,
             mode,
             doc: hardlineWithoutBreakParent
           });
@@ -53428,7 +53428,7 @@ function printDocToString(doc, options) {
           case MODE_BREAK:
             if (lineSuffix2.length > 0) {
               commands.push({
-                indent: indent2,
+                indent: indent22,
                 mode,
                 doc: doc2
               }, ...lineSuffix2.reverse());
@@ -53438,23 +53438,23 @@ function printDocToString(doc, options) {
             if (doc2.literal) {
               output += newLine;
               position = 0;
-              if (indent2.root) {
-                if (indent2.root.value) {
-                  output += indent2.root.value;
+              if (indent22.root) {
+                if (indent22.root.value) {
+                  output += indent22.root.value;
                 }
-                position = indent2.root.length;
+                position = indent22.root.length;
               }
             } else {
               trim2();
-              output += newLine + indent2.value;
-              position = indent2.length;
+              output += newLine + indent22.value;
+              position = indent22.length;
             }
             break;
         }
         break;
       case DOC_TYPE_LABEL:
         commands.push({
-          indent: indent2,
+          indent: indent22,
           mode,
           doc: doc2.contents
         });
@@ -53616,7 +53616,7 @@ var init_doc = __esm(() => {
     breakParent,
     ifBreak,
     trim: trim2,
-    indent,
+    indent: indent2,
     indentIfBreak,
     align,
     addAlignmentToDoc,
@@ -140754,7 +140754,7 @@ import { pathToFileURL as pathToFileURL5 } from "url";
 import path122 from "path";
 import path142 from "path";
 import url22 from "url";
-function diffLines(oldStr, newStr, options8) {
+function diffLines2(oldStr, newStr, options8) {
   return lineDiff.diff(oldStr, newStr, options8);
 }
 function tokenize4(value, options8) {
@@ -140796,10 +140796,10 @@ function structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, ne
     throw new Error("newlineIsToken may not be used with patch-generation functions, only with diffing functions");
   }
   if (!optionsObj.callback) {
-    return diffLinesResultToPatch(diffLines(oldStr, newStr, optionsObj));
+    return diffLinesResultToPatch(diffLines2(oldStr, newStr, optionsObj));
   } else {
     const { callback } = optionsObj;
-    diffLines(oldStr, newStr, Object.assign(Object.assign({}, optionsObj), { callback: (diff) => {
+    diffLines2(oldStr, newStr, Object.assign(Object.assign({}, optionsObj), { callback: (diff) => {
       const patch = diffLinesResultToPatch(diff);
       callback(patch);
     } }));
@@ -146441,7 +146441,7 @@ var require2, __filename2, __dirname3, __create2, __defProp3, __getOwnPropDesc2,
     }
   }
 }, ast_path_default, is_object_default, skipWhitespace, skipSpaces, skipToLineEnd, skipEverythingButNewLine, isNewlineCharacter = (character) => character === `
-` || character === "\r" || character === "\u2028" || character === "\u2029", skip_newline_default, has_newline_default, is_non_empty_array_default, get_sorted_child_nodes_default, childNodesCache, returnFalse = () => false, isAllEmptyAndNoLineBreak = (text) => !/[\S\n\u2028\u2029]/u.test(text), is_previous_line_empty_default, breakParent2, hardline2, indent2, join32, line22, lineSuffix2, create_print_pre_check_function_default = () => noop_default2, core_options_evaluate_default, arrayToReversed, toReversed, method_to_reversed_default, import_n_readlines, get_interpreter_default, getFileBasename = (file) => {
+` || character === "\r" || character === "\u2028" || character === "\u2029", skip_newline_default, has_newline_default, is_non_empty_array_default, get_sorted_child_nodes_default, childNodesCache, returnFalse = () => false, isAllEmptyAndNoLineBreak = (text) => !/[\S\n\u2028\u2029]/u.test(text), is_previous_line_empty_default, breakParent2, hardline2, indent3, join32, line22, lineSuffix2, create_print_pre_check_function_default = () => noop_default2, core_options_evaluate_default, arrayToReversed, toReversed, method_to_reversed_default, import_n_readlines, get_interpreter_default, getFileBasename = (file) => {
   try {
     return path112.basename(toPath4(file));
   } catch {
@@ -156469,7 +156469,7 @@ ${codeblock}`, options8);
   ({
     breakParent: breakParent2,
     hardline: hardline2,
-    indent: indent2,
+    indent: indent3,
     join: join32,
     line: line22,
     lineSuffix: lineSuffix2
@@ -268401,6 +268401,10 @@ async function captureRequestBody(request, options) {
   if (request.body == null) {
     return;
   }
+  if (options.context.__redactBody) {
+    options.context.__requestBody = "[redacted]";
+    return;
+  }
   try {
     const cloned = request.clone();
     const text = await cloned.text();
@@ -269450,20 +269454,490 @@ function getAgentsCommand() {
   return new Command2("agents").description("Manage project agents").addCommand(getAgentsPushCommand()).addCommand(getAgentsPullCommand());
 }
 
+// src/cli/commands/auth/password-login.ts
+import { dirname as dirname15, join as join21 } from "node:path";
+async function passwordLoginAction({ log, runTask }, action) {
+  const shouldEnable = action === "enable";
+  const { project } = await readProjectConfig();
+  const configDir = dirname15(project.configPath);
+  const authDir = join21(configDir, project.authDir);
+  const updated = await runTask("Updating local auth config", async () => {
+    const current = await readAuthConfig(authDir) ?? DEFAULT_AUTH_CONFIG;
+    const merged = { ...current, enableUsernamePassword: shouldEnable };
+    await writeAuthConfig(authDir, merged);
+    return merged;
+  });
+  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
+    log.warn("Disabling password auth will leave no login methods enabled. Users will be locked out.");
+  }
+  const newStatus = shouldEnable ? "enabled" : "disabled";
+  return {
+    outroMessage: `Username & password authentication ${newStatus} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
+  };
+}
+function getPasswordLoginCommand() {
+  return new Base44Command("password-login").description("Enable or disable username & password authentication").addArgument(new Argument2("<action>", "enable or disable password authentication").choices(["enable", "disable"])).action(passwordLoginAction);
+}
+
+// src/cli/commands/auth/pull.ts
+import { dirname as dirname16, join as join22 } from "node:path";
+async function pullAuthAction({
+  log,
+  runTask
+}) {
+  const { project } = await readProjectConfig();
+  const configDir = dirname16(project.configPath);
+  const authDir = join22(configDir, project.authDir);
+  const remoteConfig = await runTask("Fetching auth config from Base44", async () => {
+    return await pullAuthConfig();
+  }, {
+    successMessage: "Auth config fetched successfully",
+    errorMessage: "Failed to fetch auth config"
+  });
+  const { written } = await runTask("Syncing auth config file", async () => {
+    return await writeAuthConfig(authDir, remoteConfig);
+  }, {
+    successMessage: "Auth config file synced successfully",
+    errorMessage: "Failed to sync auth config file"
+  });
+  if (written) {
+    log.success("Auth config written to local file");
+  } else {
+    log.info("Auth config is already up to date");
+  }
+  return {
+    outroMessage: `Pulled auth config to ${authDir} (overwrites local file)`
+  };
+}
+function getAuthPullCommand() {
+  return new Base44Command("pull").description("Pull auth config from Base44 to local file").action(pullAuthAction);
+}
+
+// src/cli/commands/auth/push.ts
+async function pushAuthAction({ isNonInteractive, log, runTask }, options) {
+  const { authConfig } = await readProjectConfig();
+  if (authConfig.length === 0) {
+    log.info("No local auth config found");
+    return {
+      outroMessage: "No auth config to push. Run `base44 auth pull` to fetch the remote config first."
+    };
+  }
+  if (!hasAnyLoginMethod(authConfig[0])) {
+    log.warn("This config has no login methods enabled. Pushing it will lock out all users.");
+  }
+  if (!options.yes) {
+    if (isNonInteractive) {
+      throw new InvalidInputError("--yes is required in non-interactive mode");
+    }
+    const shouldPush = await Re({
+      message: "Push auth config to Base44?"
+    });
+    if (Ct(shouldPush) || !shouldPush) {
+      return { outroMessage: "Push cancelled" };
+    }
+  }
+  await runTask("Pushing auth config to Base44", async () => {
+    return await pushAuthConfig(authConfig[0] ?? null);
+  }, {
+    successMessage: "Auth config pushed successfully",
+    errorMessage: "Failed to push auth config"
+  });
+  return {
+    outroMessage: "Auth config pushed to Base44"
+  };
+}
+function getAuthPushCommand() {
+  return new Base44Command("push").description("Push local auth config to Base44").option("-y, --yes", "Skip confirmation prompt").action(pushAuthAction);
+}
+
+// src/cli/commands/auth/social-login.ts
+import { dirname as dirname17, join as join23, resolve as resolve6 } from "node:path";
+var PROVIDER_LABELS = {
+  google: "Google",
+  microsoft: "Microsoft",
+  facebook: "Facebook",
+  apple: "Apple"
+};
+var VALID_PROVIDER_NAMES = Object.keys(SOCIAL_PROVIDERS);
+var PROVIDER_OAUTH_CLI = {
+  google: {
+    envVar: "google_oauth_client_secret",
+    promptMessage: "Enter Google OAuth client secret"
+  }
+};
+function hasSecretOptions(options) {
+  return Boolean(options.clientSecret || options.clientSecretStdin || options.envFile);
+}
+function hasCustomOAuthOptions(options) {
+  return Boolean(options.clientId || hasSecretOptions(options));
+}
+async function socialLoginAction({ log, isNonInteractive, runTask }, provider, action, options) {
+  const shouldEnable = action === "enable";
+  const providerInfo = SOCIAL_PROVIDERS[provider];
+  const label = PROVIDER_LABELS[provider];
+  const hasOAuthOptions = hasCustomOAuthOptions(options);
+  if (hasOAuthOptions && !providerInfo.customOAuth) {
+    throw new InvalidInputError(`Custom OAuth options are only supported for providers with custom OAuth (e.g., google). Use: base44 auth social-login ${provider} ${action}`);
+  }
+  if (hasOAuthOptions && !shouldEnable) {
+    throw new InvalidInputError(`Custom OAuth options cannot be used with disable. To disable ${label} login: base44 auth social-login ${provider} disable`);
+  }
+  if (hasSecretOptions(options) && !options.clientId) {
+    throw new InvalidInputError(`--client-id is required when providing a client secret. Use: base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`);
+  }
+  const oauth = providerInfo.customOAuth;
+  const oauthCli = PROVIDER_OAUTH_CLI[provider];
+  const useCustomOAuth = shouldEnable && hasOAuthOptions && oauth != null;
+  let clientSecret;
+  if (useCustomOAuth && oauth && oauthCli && hasSecretOptions(options)) {
+    if (options.envFile) {
+      const secrets = await parseEnvFile(resolve6(options.envFile));
+      const value = secrets[oauthCli.envVar];
+      if (!value) {
+        throw new InvalidInputError(`Key "${oauthCli.envVar}" not found in ${options.envFile}.`);
+      }
+      clientSecret = value;
+    } else {
+      clientSecret = await resolveSecret({
+        flagValue: options.clientSecret,
+        fromStdin: options.clientSecretStdin,
+        envVar: oauthCli.envVar,
+        promptMessage: oauthCli.promptMessage,
+        isNonInteractive,
+        name: "client secret",
+        hints: [
+          {
+            message: `Provide via flag:   base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`,
+            command: `base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`
+          },
+          {
+            message: `Provide via stdin:  echo <secret> | base44 auth social-login ${provider} enable --client-id <id> --client-secret-stdin`
+          },
+          {
+            message: `Provide via env:    ${oauthCli.envVar}=<secret> base44 auth social-login ${provider} enable --client-id <id>`
+          }
+        ]
+      });
+    }
+  }
+  const { project } = await readProjectConfig();
+  const configDir = dirname17(project.configPath);
+  const authDir = join23(configDir, project.authDir);
+  const { config: updated } = await runTask("Updating local auth config", async () => updateSocialLoginConfig(authDir, provider, shouldEnable, useCustomOAuth && options.clientId ? { clientId: options.clientId } : undefined));
+  if (clientSecret) {
+    await runTask("Saving client secret", async () => pushCustomOAuthSecret(provider, clientSecret));
+  }
+  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
+    log.warn(`Disabling ${label} login will leave no login methods enabled. Users will be locked out.`);
+  }
+  const newStatus = shouldEnable ? "enabled" : "disabled";
+  const oauthNote = useCustomOAuth ? " with custom OAuth" : "";
+  let outroMessage = `${label} login ${newStatus}${oauthNote} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`;
+  if (useCustomOAuth && !clientSecret) {
+    outroMessage += `
+Remember to push the client secret separately: base44 secrets set --env-file <path>`;
+  }
+  return { outroMessage };
+}
+function getSocialLoginCommand() {
+  return new Base44Command("social-login").description("Enable or disable social login providers (google, microsoft, facebook, apple)").addArgument(new Argument2("<provider>", "social login provider").choices(VALID_PROVIDER_NAMES)).addArgument(new Argument2("<action>", "enable or disable the provider").choices([
+    "enable",
+    "disable"
+  ])).option("--client-id <id>", "custom OAuth client ID (Google only)").option("--client-secret <secret>", "custom OAuth client secret (Google only)").option("--client-secret-stdin", "read client secret from stdin (Google only)").option("--env-file <path>", "read client secret from a .env file (Google only)").action(socialLoginAction);
+}
+
+// src/cli/commands/auth/sso.ts
+import { dirname as dirname18, join as join24, resolve as resolve7 } from "node:path";
+var SSOConfigFileSchema = object({
+  provider: _enum(Object.values(KNOWN_SSO_PROVIDERS)),
+  clientId: string2(),
+  clientSecret: string2(),
+  scope: string2().optional(),
+  discoveryUrl: string2().optional(),
+  tenantId: string2().optional(),
+  oktaDomain: string2().optional(),
+  authEndpoint: string2().optional(),
+  tokenEndpoint: string2().optional(),
+  userinfoEndpoint: string2().optional(),
+  jwksUri: string2().optional(),
+  ssoName: string2().optional()
+});
+async function loadSSOConfigFile(filePath) {
+  const resolved = resolve7(filePath);
+  const raw = await readJsonFile(resolved);
+  const result = SSOConfigFileSchema.safeParse(raw);
+  if (!result.success) {
+    throw new SchemaValidationError("Invalid SSO config file", result.error, filePath);
+  }
+  return result.data;
+}
+function mergeFileWithFlags(fileConfig, options) {
+  return {
+    provider: options.provider ?? fileConfig.provider,
+    clientId: options.clientId ?? fileConfig.clientId,
+    clientSecret: options.clientSecret ?? fileConfig.clientSecret,
+    clientSecretStdin: options.clientSecretStdin,
+    envFile: options.envFile,
+    scope: options.scope ?? fileConfig.scope,
+    discoveryUrl: options.discoveryUrl ?? fileConfig.discoveryUrl,
+    tenantId: options.tenantId ?? fileConfig.tenantId,
+    oktaDomain: options.oktaDomain ?? fileConfig.oktaDomain,
+    authEndpoint: options.authEndpoint ?? fileConfig.authEndpoint,
+    tokenEndpoint: options.tokenEndpoint ?? fileConfig.tokenEndpoint,
+    userinfoEndpoint: options.userinfoEndpoint ?? fileConfig.userinfoEndpoint,
+    jwksUri: options.jwksUri ?? fileConfig.jwksUri,
+    ssoName: options.ssoName ?? fileConfig.ssoName
+  };
+}
+var providerNames = Object.keys(KNOWN_SSO_PROVIDERS);
+var SECRET_KEY_TO_FLAG = {
+  ["sso_name" /* Name */]: "--sso-name",
+  ["sso_client_id" /* ClientId */]: "--client-id",
+  ["sso_client_secret" /* ClientSecret */]: "--client-secret",
+  ["sso_scope" /* Scope */]: "--scope",
+  ["sso_discovery_url" /* DiscoveryUrl */]: "--discovery-url",
+  ["sso_tenant_id" /* TenantId */]: "--tenant-id",
+  ["sso_auth_endpoint" /* AuthEndpoint */]: "--auth-endpoint",
+  ["sso_token_endpoint" /* TokenEndpoint */]: "--token-endpoint",
+  ["sso_userinfo_endpoint" /* UserinfoEndpoint */]: "--userinfo-endpoint",
+  ["sso_okta_domain" /* OktaDomain */]: "--okta-domain",
+  ["sso_jwks_uri" /* JwksUri */]: "--jwks-uri"
+};
+function secretKeyToFlag(key) {
+  return SECRET_KEY_TO_FLAG[key];
+}
+function exampleCommand(provider) {
+  let cmd = `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`;
+  if (provider === KNOWN_SSO_PROVIDERS.microsoft)
+    cmd += " --tenant-id <id>";
+  if (provider === KNOWN_SSO_PROVIDERS.okta)
+    cmd += " --okta-domain <domain>";
+  if (provider === KNOWN_SSO_PROVIDERS.custom)
+    cmd += " --sso-name <name> --auth-endpoint <url> --token-endpoint <url> --userinfo-endpoint <url> --jwks-uri <url>";
+  return cmd;
+}
+function validateProvider(provider) {
+  if (!provider) {
+    throw new InvalidInputError("Missing --provider.", {
+      hints: [
+        {
+          message: `Valid providers: ${providerNames.join(", ")}`,
+          command: "base44 auth sso enable --provider <provider> --client-id <id> --client-secret <secret>"
+        }
+      ]
+    });
+  }
+  return provider;
+}
+async function ssoEnableAction({ isNonInteractive, runTask }, options) {
+  if (options.file && options.envFile) {
+    throw new InvalidInputError("--file and --env-file cannot be used together. Provide the client secret either inside --file or via --env-file.");
+  }
+  let merged = options;
+  if (options.file) {
+    const fileConfig = await loadSSOConfigFile(options.file);
+    merged = mergeFileWithFlags(fileConfig, options);
+  }
+  const provider = validateProvider(merged.provider);
+  if (!merged.clientId) {
+    throw new InvalidInputError("Missing --client-id.", {
+      hints: [
+        {
+          message: `Example: base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
+          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
+        }
+      ]
+    });
+  }
+  let clientSecret;
+  if (merged.envFile && !merged.clientSecret) {
+    const secrets = await parseEnvFile(resolve7(merged.envFile));
+    const value = secrets.sso_client_secret;
+    if (!value) {
+      throw new InvalidInputError(`Key "sso_client_secret" not found in ${merged.envFile}.`);
+    }
+    clientSecret = value;
+  } else {
+    clientSecret = await resolveSecret({
+      flagValue: merged.clientSecret,
+      fromStdin: merged.clientSecretStdin,
+      envVar: "sso_client_secret",
+      promptMessage: "Enter SSO client secret",
+      isNonInteractive,
+      name: "client secret",
+      hints: [
+        {
+          message: `Provide via flag:   base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
+          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
+        },
+        {
+          message: `Provide via stdin:  echo <secret> | base44 auth sso enable --provider ${provider} --client-id <id> --client-secret-stdin`
+        },
+        {
+          message: `Provide via env:    sso_client_secret=<secret> base44 auth sso enable --provider ${provider} --client-id <id>`
+        }
+      ]
+    });
+  }
+  const secretOptions = {
+    clientId: merged.clientId,
+    clientSecret,
+    scope: merged.scope,
+    discoveryUrl: merged.discoveryUrl,
+    tenantId: merged.tenantId,
+    oktaDomain: merged.oktaDomain,
+    authEndpoint: merged.authEndpoint,
+    tokenEndpoint: merged.tokenEndpoint,
+    userinfoEndpoint: merged.userinfoEndpoint,
+    jwksUri: merged.jwksUri,
+    ssoName: merged.ssoName
+  };
+  let secrets;
+  try {
+    secrets = buildSSOSecrets(provider, secretOptions);
+  } catch (error) {
+    if (error instanceof MissingSSOFieldsError) {
+      const flagNames = error.missingKeys.map(secretKeyToFlag);
+      throw new InvalidInputError(`Missing required fields for ${error.provider}: ${flagNames.join(", ")}`, {
+        hints: [
+          {
+            message: `Example: ${exampleCommand(provider)}`,
+            command: exampleCommand(provider)
+          }
+        ]
+      });
+    }
+    throw error;
+  }
+  const { project } = await readProjectConfig();
+  const configDir = dirname18(project.configPath);
+  const authDir = join24(configDir, project.authDir);
+  await runTask("Updating local auth config", async () => updateSSOConfig(authDir, provider, true));
+  await runTask("Saving SSO credentials", async () => pushSSOSecrets(secrets));
+  return {
+    outroMessage: `SSO configured with ${provider} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
+  };
+}
+function hasEnableOnlyOptions(options) {
+  return Boolean(options.provider || options.clientId || options.clientSecret || options.clientSecretStdin || options.envFile || options.file || options.scope || options.discoveryUrl || options.tenantId || options.oktaDomain || options.authEndpoint || options.tokenEndpoint || options.userinfoEndpoint || options.jwksUri || options.ssoName);
+}
+async function ssoDisableAction({ log, runTask }, options) {
+  if (hasEnableOnlyOptions(options)) {
+    throw new InvalidInputError("Configuration options cannot be used with disable. To disable SSO: base44 auth sso disable");
+  }
+  const { project } = await readProjectConfig();
+  const configDir = dirname18(project.configPath);
+  const authDir = join24(configDir, project.authDir);
+  const updated = await runTask("Updating local auth config", async () => updateSSOConfig(authDir, null, false));
+  await runTask("Removing SSO credentials", async () => deleteSSOSecrets());
+  if (!hasAnyLoginMethod(updated)) {
+    log.warn("Disabling SSO will leave no login methods enabled. Users will be locked out.");
+  }
+  return {
+    outroMessage: "SSO disabled in local config and credentials removed. Run `base44 auth push` or `base44 deploy` to apply."
+  };
+}
+async function ssoAction(context, action, options) {
+  if (action === "disable") {
+    return ssoDisableAction(context, options);
+  }
+  return ssoEnableAction(context, options);
+}
+function getSSOCommand() {
+  return new Base44Command("sso").description("Configure SSO identity provider (google, microsoft, github, okta, custom). SSO and social login are mutually exclusive — enabling one disables the other in the local auth config.").addArgument(new Argument2("<action>", "enable or disable SSO").choices([
+    "enable",
+    "disable"
+  ])).addOption(new Option2("--provider <provider>", "SSO provider").choices(Object.values(KNOWN_SSO_PROVIDERS))).option("--client-id <id>", "OAuth client ID").option("--client-secret <secret>", "OAuth client secret").option("--client-secret-stdin", "Read client secret from stdin").option("--env-file <path>", "Read client secret from a .env file (key: sso_client_secret)").option("--file <path>", "JSON config file with all SSO settings").option("--scope <scope>", "OAuth scope (defaults per provider)").option("--discovery-url <url>", "OIDC discovery URL").option("--tenant-id <id>", "Microsoft tenant ID (required for microsoft)").option("--okta-domain <domain>", "Okta domain (required for okta)").option("--auth-endpoint <url>", "Authorization endpoint (required for custom)").option("--token-endpoint <url>", "Token endpoint (required for custom)").option("--userinfo-endpoint <url>", "Userinfo endpoint (required for custom)").option("--jwks-uri <url>", "JWKS URI (required for custom)").option("--sso-name <name>", "Provider display name (required for custom)").action(ssoAction);
+}
+
+// src/cli/commands/auth/index.ts
+function getAuthCommand() {
+  return new Command2("auth").description("Manage app authentication settings").addCommand(getPasswordLoginCommand()).addCommand(getSocialLoginCommand()).addCommand(getSSOCommand()).addCommand(getAuthPullCommand()).addCommand(getAuthPushCommand());
+}
+
+// src/cli/commands/auth/login.ts
+function getLoginCommand() {
+  return new Base44Command("login", {
+    requireAuth: false,
+    requireAppContext: false
+  }).description("Authenticate with Base44").action(login);
+}
+
+// src/cli/commands/auth/logout.ts
+async function logout(_ctx) {
+  await deleteAuth();
+  return { outroMessage: "Logged out successfully" };
+}
+function getLogoutCommand() {
+  return new Base44Command("logout", {
+    requireAuth: false,
+    requireAppContext: false
+  }).description("Logout from current device").action(logout);
+}
+
+// src/cli/commands/auth/whoami.ts
+async function whoami(_ctx) {
+  const workspaceApiKey = getWorkspaceApiKeyFromEnv();
+  if (workspaceApiKey && isWorkspaceApiKey(workspaceApiKey)) {
+    return {
+      outroMessage: `Using workspace API key: ${theme.styles.bold(workspaceApiKey.slice(0, 10))}`
+    };
+  }
+  const auth = await readAuth();
+  return { outroMessage: `Logged in as: ${theme.styles.bold(auth.email)}` };
+}
+function getWhoamiCommand() {
+  return new Base44Command("whoami", { requireAppContext: false }).description("Display current authenticated user").action(whoami);
+}
+
+// src/cli/commands/branches/index.ts
+async function listBranchesAction({
+  log,
+  runTask,
+  jsonMode
+}) {
+  const remote = await runTask("Fetching branches", () => listBranches());
+  const branches = [
+    { name: "main", status: "active" },
+    ...remote.map((branch) => ({
+      name: branch.branch_name,
+      status: branch.status
+    }))
+  ];
+  if (jsonMode)
+    return { stdout: `${JSON.stringify({ branches })}
+` };
+  for (const branch of branches)
+    log.message(`${branch.name} (${branch.status})`);
+  return { outroMessage: `${branches.length} branches` };
+}
+function getBranchesCommand() {
+  return new Command2("branches").description("Discover an app's branches").addCommand(new Base44Command("list").description("List main and active branch names for use with --branch").action(listBranchesAction));
+}
+
 // src/core/model.ts
 var MODELS = [
-  { name: "default", id: null, note: "let Base44 choose" },
+  {
+    name: "Automatic",
+    id: null,
+    note: "matched with the best model",
+    aliases: ["default", "auto"]
+  },
   { name: "Opus 5", id: "claude_opus_5" },
   { name: "Sonnet 5", id: "claude-sonnet-5" },
   { name: "Fable 5", id: "claude_fable_5", note: "uses more credits" },
   { name: "GPT-5.6 Sol", id: "gpt_5_6_sol" },
-  { name: "Gemini 3.8 Flash", id: "gemini_3_8_flash", note: "fast" },
+  {
+    name: "Gemini 3.8 Flash",
+    id: "gemini_3_8_flash",
+    note: "fast responses for everyday tasks"
+  },
   { name: "Base 1", id: "base1" }
 ];
 var fold = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
 function resolvePick(input) {
   const key = fold(input);
-  const byExact = MODELS.find((m) => fold(m.name) === key || m.id && fold(m.id) === key);
+  const byExact = MODELS.find((m) => fold(m.name) === key || m.id && fold(m.id) === key || m.aliases?.some((a) => fold(a) === key));
   if (byExact)
     return byExact;
   const byContains = MODELS.filter((m) => fold(m.name).includes(key) || m.id && fold(m.id).includes(key));
@@ -269486,14 +269960,14 @@ async function saveBuilderModel(userId, modelId) {
     });
   } catch (error) {
     if (error instanceof HTTPError && error.response.status === 400) {
-      throw new InvalidInputError("This account can't pick a builder model yet — enable the PER_USER_BUILDER_MODEL_SELECTION flag for it in PostHog, or the model isn't available in this workspace.");
+      throw new InvalidInputError("This account can't pick a builder model yet, or the model isn't available in this workspace. Ask your workspace admin to enable model selection.");
     }
     throw await ApiError.fromHttpError(error, "saving your model choice");
   }
 }
-var displayName = (id) => MODELS.find((m) => m.id === id)?.name ?? id ?? "default";
+var displayName = (id) => MODELS.find((m) => m.id === id)?.name ?? id ?? "Automatic";
 
-// src/cli/commands/app/model.ts
+// src/cli/commands/builder/model.ts
 async function modelAction({ log, jsonMode }, input) {
   const me = await getMe();
   const current = me.builder_model ?? null;
@@ -269514,7 +269988,7 @@ async function modelAction({ log, jsonMode }, input) {
       log.message(`${marker} ${active ? theme.styles.bold(m.name) : m.name}${note}`);
     }
     return {
-      outroMessage: `Current: ${theme.styles.bold(displayName(current))}. Set with \`base44 app model <name>\`.`
+      outroMessage: `Current: ${theme.styles.bold(displayName(current))}. Set with \`base44 builder model <name>\`.`
     };
   }
   const pick = resolvePick(input);
@@ -269535,9 +270009,9 @@ function getModelCommand() {
   return command;
 }
 
-// src/cli/commands/app/shared.ts
+// src/cli/commands/builder/shared.ts
 import { mkdir as mkdir3, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { basename as basename6, join as join25, relative as relative6, resolve as resolve8 } from "node:path";
 
 // src/cli/commands/code/render.ts
 var TOOL_ALIASES = {
@@ -269545,6 +270019,10 @@ var TOOL_ALIASES = {
   read_repo_file: "read",
   write_repo_file: "write",
   edit_repo_file: "edit",
+  read_file: "read",
+  write_file: "write",
+  find_replace: "edit",
+  delete_file: "delete",
   set_secrets: "secrets",
   generate_development_secrets: "secrets",
   create_pull_request: "pr",
@@ -269558,7 +270036,55 @@ var TOOL_ALIASES = {
   preview_screenshot: "screenshot",
   connect_github_account: "github"
 };
-var QUIET_OK_RESULTS = new Set(["read", "write", "edit", "reload"]);
+var QUIET_OK_RESULTS = new Set(["read", "write", "edit", "reload", "delete"]);
+var RESULT_LINE_MAX = 110;
+var DIFF_LINES_MAX = 12;
+var ERROR_LINES_MAX = 8;
+function renderEntry(entry, options = {}) {
+  if (typeof entry === "string")
+    return entry;
+  if ("running" in entry)
+    return runningLine(entry.running, entry.startedAt);
+  return eventLine(entry.event, entry.elapsedMs, options) ?? "";
+}
+var RUNNING_DOT = "#E86B3C";
+var PULSE_MS = 500;
+function runningLine(event, startedAt, now = Date.now()) {
+  const lit = Math.floor(now / PULSE_MS) % 2 === 0;
+  const dot = lit ? source_default.hex(RUNNING_DOT)("●") : source_default.dim("●");
+  const alias = toolAlias(event.name);
+  const title = source_default.bold(event.label || alias);
+  const inline = !event.label && event.summary ? ` ${source_default.dim(event.summary)}` : "";
+  const seconds = Math.round((now - startedAt) / 1000);
+  const took = seconds >= 3 ? ` ${source_default.dim(`· ${seconds}s`)}` : "";
+  const detail = event.label && event.summary ? `
+  ${source_default.dim(`└ ${alias}: ${event.summary}`)}` : "";
+  return `${dot} ${title}${inline}${took}${detail}`;
+}
+function fold2(lines, max, options) {
+  if (options.verbose || lines.length <= max)
+    return lines;
+  const hint = options.foldHint ? ` (${options.foldHint})` : "";
+  return [
+    ...lines.slice(0, max),
+    source_default.dim(`… +${lines.length - max} lines${hint}`)
+  ];
+}
+var str = (v) => typeof v === "string" ? v : undefined;
+function diffLines(args) {
+  const find = str(args.find);
+  const replace = str(args.replace);
+  if (find == null && replace == null)
+    return null;
+  return [
+    ...(find ?? "").split(`
+`).map((l) => source_default.red(`- ${l}`)),
+    ...(replace ?? "").split(`
+`).map((l) => source_default.green(`+ ${l}`))
+  ];
+}
+var indent = (lines) => lines.map((l) => `  ${l}`).join(`
+`);
 function toolAlias(name) {
   return TOOL_ALIASES[name] ?? name;
 }
@@ -269623,7 +270149,7 @@ function formatDuration2(ms) {
     return `${seconds}s`;
   return `${Math.floor(seconds / 60)}m ${String(seconds % 60).padStart(2, "0")}s`;
 }
-function eventLine(event, elapsedMs) {
+function eventLine(event, elapsedMs, options = {}) {
   switch (event.kind) {
     case "thinking":
       return source_default.dim(`✻ ${event.text}`);
@@ -269633,7 +270159,7 @@ function eventLine(event, elapsedMs) {
       return null;
     case "waiting": {
       const what = event.label || toolAlias(event.name);
-      return source_default.yellow(`⏸ ${what} — needs your input (answer in the editor)`);
+      return source_default.yellow(`⏸ ${what} — needs your input (${options.waitingHint ?? "answer in the editor"})`);
     }
     case "tool_end": {
       const alias = toolAlias(event.name);
@@ -269644,16 +270170,52 @@ function eventLine(event, elapsedMs) {
       const paramsLine = event.label && event.summary ? `
   ${source_default.dim(`${alias}: ${event.summary}`)}` : "";
       const head = `${mark} ${title}${inlineDetail}${took}${paramsLine}`;
+      const args = event.args ?? null;
+      if (event.ok && alias === "edit" && args) {
+        const diff = diffLines(args);
+        if (diff)
+          return `${head}
+${indent(fold2(diff, DIFF_LINES_MAX, options))}`;
+      }
+      if (event.ok && alias === "write" && args && str(args.content) != null) {
+        const lines = str(args.content).split(`
+`);
+        const count = source_default.dim(`+${lines.length} lines`);
+        if (!options.verbose)
+          return `${head} ${count}`;
+        return `${head} ${count}
+${indent(lines.map((l) => source_default.dim(l)))}`;
+      }
       if (event.ok && (QUIET_OK_RESULTS.has(alias) || !event.result)) {
         return head;
       }
-      const result = event.ok ? source_default.dim(linkifyUrls(event.result)) : source_default.red(linkifyUrls(event.result));
-      return `${head}${event.result ? `
-  ${result}` : ""}`;
+      const paint = event.ok ? source_default.dim : source_default.red;
+      const lines = event.result.split(`
+`).map((l) => l.trimEnd()).filter((l, i, all) => l.length > 0 || i > 0 && i < all.length - 1);
+      if (event.ok && !options.verbose) {
+        const first = lines[0] ?? "";
+        const cut = first.length > RESULT_LINE_MAX ? `${first.slice(0, RESULT_LINE_MAX)}…` : first;
+        const more = lines.length - 1;
+        const hint = options.foldHint ? ` (${options.foldHint})` : "";
+        const tail = more > 0 ? source_default.dim(` … +${more} lines${hint}`) : "";
+        return `${head}
+  ${paint(linkifyUrls(cut))}${tail}`;
+      }
+      const shown = fold2(lines.map((l) => paint(linkifyUrls(l))), event.ok ? Number.POSITIVE_INFINITY : ERROR_LINES_MAX, options);
+      return `${head}
+${indent(shown)}`;
     }
   }
 }
 var FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+var SHIMMER = ["·", "✢", "✳", "✶", "✻", "✽"];
+var SHIMMER_STEP_MS = 120;
+function shimmer(now = Date.now()) {
+  const period = SHIMMER.length * 2 - 2;
+  const step = Math.floor(now / SHIMMER_STEP_MS) % period;
+  const index = step < SHIMMER.length ? step : period - step;
+  return SHIMMER[index];
+}
 var MUSINGS = [
   "Shmoozing",
   "Shmoogling",
@@ -269717,7 +270279,7 @@ function createTurnStream(interactive, write = (text) => process.stdout.write(te
       return;
     const lines = [
       ...footer.length ? ["", ...footer] : [],
-      source_default.dim(`${FRAMES[frame]} ${statusLabel()}`)
+      running.size === 0 ? `${source_default.magenta(shimmer())} ${source_default.dim(statusLabel())}` : source_default.dim(`${FRAMES[frame]} ${statusLabel()}`)
     ];
     write(lines.join(`
 `));
@@ -269755,7 +270317,10 @@ function createTurnStream(interactive, write = (text) => process.stdout.write(te
           elapsedMs = Date.now() - started;
         running.delete(event.id);
       }
-      const line = eventLine(event, elapsedMs);
+      const line = eventLine(event, elapsedMs, {
+        verbose: options.verbose,
+        foldHint: "--verbose shows everything"
+      });
       if (line == null)
         return;
       if (interactive) {
@@ -269790,8 +270355,15 @@ var CreatedAppSchema = object({
   name: string2().nullish(),
   imported_repo_url: string2().nullish()
 });
+var WixCreatedAppSchema = object({
+  app_id: string2().min(1),
+  client_creation_id: string2().min(1)
+});
 var AppStateSchema = object({
   id: string2(),
+  app_type: string2().nullish(),
+  is_managed_source_code: boolean2().nullish(),
+  imported_repo_url: string2().nullish(),
   status: object({
     state: string2().nullish(),
     message: string2().nullish()
@@ -269826,7 +270398,8 @@ var ConversationMessageSchema = object({
     name: string2(),
     arguments_string: string2().nullish(),
     status: string2().nullish(),
-    results: unknown().nullish()
+    results: unknown().nullish(),
+    waiting_on: object({ kind: string2().nullish() }).nullish()
   })).nullish()
 });
 var FullConversationSchema = object({
@@ -269843,6 +270416,24 @@ function parseOrThrow(schema, payload, what) {
 function branchScope(branchId) {
   return branchId ? { branch_id: branchId } : {};
 }
+async function createWixLaunchedApp(options) {
+  let response;
+  try {
+    response = await base44Client.post("api/wix/create-app", {
+      timeout: false,
+      context: { __redactBody: true },
+      json: {
+        prompt: options.prompt,
+        signed_instance: options.signedInstance,
+        ...options.wixClientId ? { wix_client_id: options.wixClientId } : {}
+      }
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "creating app via Wix launch");
+  }
+  const created = parseOrThrow(WixCreatedAppSchema, await response.json(), "app");
+  return { id: created.app_id, client_creation_id: created.client_creation_id };
+}
 async function createApp(options) {
   let response;
   try {
@@ -269891,13 +270482,34 @@ async function getAppState(appId) {
   let response;
   try {
     response = await base44Client.get(`api/apps/${appId}`, {
-      searchParams: { fields: "id,status" }
+      searchParams: {
+        fields: "id,status,app_type,is_managed_source_code,imported_repo_url"
+      }
     });
   } catch (error) {
     throw await ApiError.fromHttpError(error, "reading app status");
   }
   return parseOrThrow(AppStateSchema, await response.json(), "app status");
 }
+async function answerToolCall(options, branchId) {
+  let response;
+  try {
+    response = await getAppClient().post("chat/submit-tool-call-input", {
+      timeout: false,
+      context: { __redactBody: true },
+      searchParams: branchScope(branchId),
+      json: {
+        tool_call_id: options.toolCallId,
+        action: options.action,
+        extra_user_input: options.input ?? {},
+        ...options.messageId ? { message_id: options.messageId } : {}
+      }
+    });
+  } catch (error) {
+    throw await ApiError.fromHttpError(error, "answering the agent");
+  }
+  return parseOrThrow(ChatTurnSchema, await response.json(), "chat turn");
+}
 async function sendTurn(content, branchId) {
   let response;
   try {
@@ -269952,7 +270564,7 @@ async function getPreviewUrl() {
   return /^https?:\/\//.test(url) ? url : `https://${url}`;
 }
 
-// src/cli/commands/app/shared.ts
+// src/cli/commands/builder/shared.ts
 var APP_NAME_RE = /^[A-Za-z0-9._-]+$/;
 var NAME_STOPWORDS = new Set("a an the and or of for with to in on that this its it my our your me".split(" "));
 var FALLBACK_WORDS = [
@@ -269974,13 +270586,27 @@ async function createAndLinkApp(options) {
   if (options.name && !APP_NAME_RE.test(options.name)) {
     throw new InvalidInputError("The name becomes a directory — letters, digits, dots, dashes and underscores only.");
   }
-  const name = options.name ?? (options.importRepo ? repoBasename(options.importRepo) : inventAppName(options.prompt));
-  const targetDir = join21(process.cwd(), name);
+  const cwd = process.cwd();
+  const fallbackName = () => options.importRepo ? repoBasename(options.importRepo) : inventAppName(options.prompt);
+  const chosenDir = options.path ? resolve8(cwd, options.path) : await isDirEmpty(cwd) ? cwd : undefined;
+  const dirBase = chosenDir ? basename6(chosenDir) : undefined;
+  const name = options.name ?? (dirBase && APP_NAME_RE.test(dirBase) ? dirBase : fallbackName());
+  const targetDir = chosenDir ?? join25(cwd, name);
+  const here = targetDir === cwd;
+  const dirName = here ? "." : relative6(cwd, targetDir) || name;
   await mkdir3(targetDir, { recursive: true });
   if (await appConfigExists(targetDir)) {
-    throw new InvalidInputError(`./${name} is already linked to a Base44 app. Pick another name.`);
-  }
-  const created = options.importRepo ? await createImportedApp({
+    throw new InvalidInputError(here ? "This directory is already linked to a Base44 app. Run `base44 code` here to keep building it, or pass --path for a new one." : `./${dirName} is already linked to a Base44 app. Pick another name or --path.`);
+  }
+  let clientCreationId;
+  const created = options.wixInstance ? await createWixLaunchedApp({
+    prompt: options.prompt ?? "",
+    signedInstance: options.wixInstance.signedInstance,
+    wixClientId: options.wixInstance.wixClientId
+  }).then((c) => {
+    clientCreationId = c.client_creation_id;
+    return c;
+  }) : options.importRepo ? await createImportedApp({
     appName: name,
     repoUrl: options.importRepo,
     sourceMode: options.mode ?? "direct",
@@ -269989,9 +270615,9 @@ async function createAndLinkApp(options) {
     prompt: options.prompt
   }) : await createApp({ appName: name, prompt: options.prompt });
   await writeAppConfig(targetDir, created.id);
-  await mkdir3(join21(targetDir, "base44"), { recursive: true });
+  await mkdir3(join25(targetDir, "base44"), { recursive: true });
   try {
-    await writeFile2(join21(targetDir, "base44", "config.jsonc"), `// Base44 project configuration.
+    await writeFile2(join25(targetDir, "base44", "config.jsonc"), `// Base44 project configuration.
 {
   "name": ${JSON.stringify(name)}
 }
@@ -270002,16 +270628,49 @@ async function createAndLinkApp(options) {
     id: created.id,
     editorUrl: `${getBase44ApiUrl()}/apps/${created.id}/editor/preview`,
     repoUrl: created.imported_repo_url ?? undefined,
-    dirName: name,
-    targetDir
-  };
+    dirName,
+    targetDir,
+    here,
+    ...clientCreationId ? { clientCreationId } : {}
+  };
+}
+function repoLabel(url) {
+  return url.replace(/^https?:\/\//, "").replace(/\.git$/, "").replace(/\/$/, "");
+}
+function appTypeChip(state) {
+  switch (state.app_type ?? "user_app") {
+    case "imported_app":
+      return state.imported_repo_url ? repoLabel(state.imported_repo_url) : "repository app";
+    case "user_game":
+      return "game";
+    case "mobile_app":
+      return "mobile app";
+    case "slide":
+      return "slides";
+    case "user_agent":
+      return "superagent";
+    default:
+      return "web app";
+  }
+}
+async function assertBuilderApp(appId) {
+  const state = await getAppState(appId);
+  if (state.is_managed_source_code === false) {
+    throw new InvalidInputError("This project is code-first (base44 create): you own the source and the builder cannot work on it. Run `base44 builder new` for an agent-built app.");
+  }
+  if (state.app_type === "user_agent") {
+    throw new InvalidInputError("This is a Superagent, not an app the builder works on. Superagent has no CLI surface yet.");
+  }
+  return state;
 }
 function nextStepsLines(app) {
+  const cd = app.here ? "" : `cd ${app.dirName} && `;
   return [
     "",
-    `${source_default.bold("Your app lives in")}  ./${app.dirName}`,
-    source_default.dim(`  cd ${app.dirName} && base44 code        # keep building with the agent`),
-    source_default.dim(`  cd ${app.dirName} && base44 app send "…"  # one non-interactive turn`)
+    `${source_default.bold("Your app lives in")}  ${app.here ? "./  (this directory)" : `./${app.dirName}`}`,
+    source_default.dim(`  ${cd}base44 code        # keep building with the agent`),
+    source_default.dim(`  ${cd}base44 builder send "…"  # one non-interactive turn`),
+    source_default.dim(`  files live remotely — ${cd}base44 sandbox ls to look, base44 eject for a copy`)
   ];
 }
 async function githubReauthLines(error) {
@@ -270034,12 +270693,27 @@ function newStreamState() {
   return { perMessage: new Map };
 }
 var TOOL_SETTLED = new Set(["success", "error", "stopped"]);
+function fullText(value) {
+  if (typeof value === "string")
+    return value.trimEnd();
+  if (value == null)
+    return "";
+  return JSON.stringify(value);
+}
+function toolArgs(argumentsString) {
+  try {
+    const parsed = JSON.parse(argumentsString ?? "");
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
 function oneLine(value, max) {
   const text = typeof value === "string" ? value : value == null ? "" : JSON.stringify(value);
   const flat = text.replace(/\s+/g, " ").trim();
   return flat.length > max ? `${flat.slice(0, max)}…` : flat;
 }
-var SALIENT_KEYS = ["command", "path", "file_path", "title"];
+var SALIENT_KEYS = ["command", "path", "file_path", "title", "find"];
 function salvageKey(raw, keys) {
   for (const key of keys) {
     const match = raw.match(new RegExp(`"${key}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)"`));
@@ -270068,6 +270742,10 @@ function toolMeta(name, argumentsString) {
     read_repo_file: pick("path") ?? pick("file_path"),
     write_repo_file: pick("path") ?? pick("file_path"),
     edit_repo_file: pick("path") ?? pick("file_path"),
+    read_file: pick("file_path") ?? pick("path"),
+    write_file: pick("file_path") ?? pick("path"),
+    find_replace: pick("file_path") ?? pick("path"),
+    delete_file: pick("file_path") ?? pick("path"),
     create_pull_request: pick("title"),
     reload_preview: ""
   };
@@ -270118,7 +270796,10 @@ function diffConversation(state, messages) {
     }
     for (const tool of message.tool_calls ?? []) {
       if (!progress.announcedTools.has(tool.id)) {
-        progress.announcedTools.set(tool.id, toolMeta(tool.name, tool.arguments_string));
+        progress.announcedTools.set(tool.id, {
+          ...toolMeta(tool.name, tool.arguments_string),
+          args: toolArgs(tool.arguments_string)
+        });
         const meta = progress.announcedTools.get(tool.id);
         events.push({
           kind: "tool_start",
@@ -270149,7 +270830,8 @@ function diffConversation(state, messages) {
           label: labelTense(meta.label, "done"),
           summary: meta.summary,
           ok: status === "success",
-          result: oneLine(tool.results, 110)
+          result: fullText(tool.results),
+          args: meta.args
         });
       }
     }
@@ -270223,9 +270905,90 @@ async function streamConversationUntilSettled(onEvent, options = {}) {
   return "timeout";
 }
 
-// src/cli/commands/app/new.ts
+// src/cli/commands/builder/send.ts
+function lastAssistantReply(turn) {
+  const messages = turn.conversation?.messages ?? [];
+  for (let i = messages.length - 1;i >= 0; i--) {
+    const { role, content } = messages[i];
+    if (role === "assistant" && typeof content === "string" && content.trim()) {
+      return content.trim();
+    }
+  }
+  return;
+}
+function ndjsonWriter() {
+  return (record) => process.stdout.write(`${JSON.stringify(record)}
+`);
+}
+async function sendAction(ctx, message, options) {
+  if (options.streamJson && ctx.jsonMode) {
+    throw new InvalidInputError("--stream-json and --json are exclusive.");
+  }
+  if (ctx.app)
+    await assertBuilderApp(ctx.app.id);
+  const branchId = await resolveBranchId(ctx);
+  if (options.streamJson) {
+    const write = ndjsonWriter();
+    const turn = await streamConversationDuring(() => sendTurn(message, branchId), ({ kind, ...event }) => write({ type: kind, ...event }), { branchId });
+    write({
+      type: "result",
+      queued: turn.queued === true,
+      status: turn.status?.state ?? "ready",
+      error_source: turn.status?.error_source ?? null,
+      reply: lastAssistantReply(turn) ?? null
+    });
+    return {};
+  }
+  if (ctx.jsonMode) {
+    const turn = await ctx.runTask("Agent working (a turn can take minutes)", () => sendTurn(message, branchId));
+    if (turn.queued)
+      return { stdout: `${JSON.stringify({ queued: true })}
+` };
+    return {
+      stdout: `${JSON.stringify({
+        status: turn.status?.state ?? "ready",
+        error_source: turn.status?.error_source ?? null,
+        reply: lastAssistantReply(turn) ?? null
+      })}
+`
+    };
+  }
+  const stream = createTurnStream(process.stdout.isTTY === true, undefined, {
+    verbose: options.verbose
+  });
+  let turn;
+  try {
+    turn = await streamConversationDuring(() => sendTurn(message, branchId), stream.onEvent, { branchId });
+  } finally {
+    stream.stop();
+  }
+  if (turn.queued) {
+    return {
+      outroMessage: "The agent is busy with an earlier message — yours was queued and runs next."
+    };
+  }
+  if (turn.status?.state === "error") {
+    return {
+      outroMessage: `Turn failed (${turn.status.error_source ?? "unknown"}) — see the editor for details.`
+    };
+  }
+  return { outroMessage: "Turn finished." };
+}
+function getSendCommand() {
+  const command = new Base44Command("send", { supportsBranch: true });
+  command.description("Send the agent one message and stream the turn until it finishes").argument("<message>", "What you want the agent to do").option("--verbose", "Show every tool result in full (no folding)").option("--stream-json", "Emit each stream event as a JSON line as it happens, then a final result line").action(sendAction);
+  return command;
+}
+
+// src/cli/commands/builder/new.ts
 var POLL_TIMEOUT_MS = 20 * 60000;
 var MODES = ["direct", "fork", "copy"];
+async function readStdin2() {
+  const chunks = [];
+  for await (const chunk of process.stdin)
+    chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
 async function newAction({ log, runTask, jsonMode }, prompt, options) {
   if (options.mode && !MODES.includes(options.mode)) {
     throw new InvalidInputError("--mode must be direct, fork, or copy.");
@@ -270233,9 +270996,27 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
   if ((options.mode || options.repoName || options.fromBranch) && !options.import) {
     throw new InvalidInputError("--mode, --repo-name and --from-branch apply only with --import <repo>.");
   }
+  if (options.wixInstance && options.import) {
+    throw new InvalidInputError("--wix-instance and --import are exclusive.");
+  }
+  if (options.wixClientId && !options.wixInstance) {
+    throw new InvalidInputError("--wix-client-id applies only with --wix-instance.");
+  }
+  const signedInstance = options.wixInstance ? (options.wixInstance === "-" ? await readStdin2() : options.wixInstance).trim() : undefined;
+  if (options.wixInstance && !signedInstance) {
+    throw new InvalidInputError("--wix-instance is empty.");
+  }
+  const wixInstance = signedInstance ? { signedInstance, wixClientId: options.wixClientId?.trim() || undefined } : undefined;
+  if (wixInstance && !prompt) {
+    throw new InvalidInputError("--wix-instance needs the prompt argument: what the agent should build.");
+  }
   if (!prompt && !options.import) {
     throw new InvalidInputError('Describe the app ("<prompt>") or pass --import <repo>.');
   }
+  if (options.streamJson && jsonMode) {
+    throw new InvalidInputError("--stream-json and --json are exclusive.");
+  }
+  const ndjson = options.streamJson ? ndjsonWriter() : null;
   let app;
   try {
     app = await runTask(options.import ? "Importing the repository" : "Creating your app", () => createAndLinkApp({
@@ -270244,18 +271025,33 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
       importRepo: options.import,
       mode: options.mode,
       repoName: options.repoName,
-      fromBranch: options.fromBranch
+      fromBranch: options.fromBranch,
+      path: options.path,
+      wixInstance
     }));
   } catch (error) {
     for (const line of await githubReauthLines(error) ?? [])
       log.message(line);
     throw error;
   }
-  if (!jsonMode) {
+  if (ndjson) {
+    ndjson({
+      type: "created",
+      id: app.id,
+      repo_url: app.repoUrl ?? null,
+      editor_url: app.editorUrl,
+      dir: app.dirName,
+      path: app.targetDir,
+      ...app.clientCreationId ? { client_creation_id: app.clientCreationId } : {}
+    });
+  } else if (!jsonMode) {
     if (app.repoUrl)
       log.message(source_default.dim(`repo    ${app.repoUrl}`));
+    if (app.clientCreationId) {
+      log.message(source_default.dim("wix     launched — connector connected before the first turn"));
+    }
     log.message(source_default.dim(`editor  ${app.editorUrl}`));
-    log.message(source_default.dim(`linked  ./${app.dirName}`));
+    log.message(source_default.dim(`linked  ${app.here ? "./  (this directory)" : `./${app.dirName}`}`));
   }
   let finalState;
   let previewUrl;
@@ -270264,10 +271060,16 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
     const branchId = await resolveActiveBranchId().catch(() => {
       return;
     });
-    const stream = createTurnStream(process.stdout.isTTY === true && !jsonMode, undefined, { idleLabel: "provisioning the sandbox and starting the build" });
+    const stream = createTurnStream(process.stdout.isTTY === true && !jsonMode && !ndjson, undefined, {
+      idleLabel: "provisioning the sandbox and starting the build",
+      verbose: options.verbose
+    });
     try {
       const settled = await streamConversationUntilSettled((event) => {
-        if (!jsonMode)
+        if (ndjson) {
+          const { kind, ...rest } = event;
+          ndjson({ type: kind, ...rest });
+        } else if (!jsonMode)
           stream.onEvent(event);
       }, { branchId, timeoutMs: POLL_TIMEOUT_MS });
       finalState = settled === "timeout" ? "processing" : (await getAppState(app.id)).status?.state ?? "ready";
@@ -270280,6 +271082,15 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
       stream.stop();
     }
   }
+  if (ndjson) {
+    ndjson({
+      type: "result",
+      id: app.id,
+      preview_url: previewUrl ?? null,
+      status: finalState ?? "created"
+    });
+    return {};
+  }
   if (jsonMode) {
     return {
       stdout: `${JSON.stringify({
@@ -270289,7 +271100,8 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
         preview_url: previewUrl ?? null,
         dir: app.dirName,
         path: app.targetDir,
-        status: finalState ?? "created"
+        status: finalState ?? "created",
+        ...app.clientCreationId ? { client_creation_id: app.clientCreationId } : {}
       })}
 `
     };
@@ -270305,7 +271117,7 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
   }
   if (finalState === "processing") {
     return {
-      outroMessage: `Still building — follow it with \`base44 app status\`.`
+      outroMessage: `Still building — follow it with \`base44 builder status\`.`
     };
   }
   return {
@@ -270314,78 +271126,11 @@ async function newAction({ log, runTask, jsonMode }, prompt, options) {
 }
 function getNewCommand() {
   const command = new Base44Command("new", { requireAppContext: false });
-  command.description("Create an app and start building: from a prompt (the Base44 template), or over an existing GitHub repo with --import").argument("[prompt]", "What to build; the first agent turn starts immediately").option("--import <repo>", "Build over an existing GitHub repository instead of the template").option("--mode <mode>", "How to import: direct, fork, or copy (default: direct)").option("--name <name>", "Directory and app name (invented when omitted)").option("--repo-name <name>", "Name for the new GitHub repo when forking/copying").option("--from-branch <name>", "Import a specific branch of the repo").action(newAction);
-  return command;
-}
-
-// src/cli/commands/app/preview.ts
-async function previewAction(ctx) {
-  const url = await ctx.runTask("Resolving preview URL (boots the sandbox if needed)", () => getPreviewUrl());
-  if (ctx.jsonMode)
-    return { stdout: `${JSON.stringify({ preview_url: url })}
-` };
-  ctx.log.message(url);
-  return { outroMessage: "Preview is live." };
-}
-function getPreviewCommand() {
-  const command = new Base44Command("preview");
-  command.description("Print the app's live preview URL").action(previewAction);
-  return command;
-}
-
-// src/cli/commands/app/send.ts
-function lastAssistantReply(turn) {
-  const messages = turn.conversation?.messages ?? [];
-  for (let i = messages.length - 1;i >= 0; i--) {
-    const { role, content } = messages[i];
-    if (role === "assistant" && typeof content === "string" && content.trim()) {
-      return content.trim();
-    }
-  }
-  return;
-}
-async function sendAction(ctx, message) {
-  const branchId = await resolveBranchId(ctx);
-  if (ctx.jsonMode) {
-    const turn = await ctx.runTask("Agent working (a turn can take minutes)", () => sendTurn(message, branchId));
-    if (turn.queued)
-      return { stdout: `${JSON.stringify({ queued: true })}
-` };
-    return {
-      stdout: `${JSON.stringify({
-        status: turn.status?.state ?? "ready",
-        error_source: turn.status?.error_source ?? null,
-        reply: lastAssistantReply(turn) ?? null
-      })}
-`
-    };
-  }
-  const stream = createTurnStream(process.stdout.isTTY === true);
-  let turn;
-  try {
-    turn = await streamConversationDuring(() => sendTurn(message, branchId), stream.onEvent, { branchId });
-  } finally {
-    stream.stop();
-  }
-  if (turn.queued) {
-    return {
-      outroMessage: "The agent is busy with an earlier message — yours was queued and runs next."
-    };
-  }
-  if (turn.status?.state === "error") {
-    return {
-      outroMessage: `Turn failed (${turn.status.error_source ?? "unknown"}) — see the editor for details.`
-    };
-  }
-  return { outroMessage: "Turn finished." };
-}
-function getSendCommand() {
-  const command = new Base44Command("send", { supportsBranch: true });
-  command.description("Send the agent one message and stream the turn until it finishes").argument("<message>", "What you want the agent to do").action(sendAction);
+  command.description("Create an app and start building: from a prompt (the Base44 template), or over an existing GitHub repo with --import").argument("[prompt]", "What to build; the first agent turn starts immediately").option("--import <repo>", "Build over an existing GitHub repository instead of the template").option("--mode <mode>", "How to import: direct, fork, or copy (default: direct)").option("--name <name>", "Directory and app name (invented when omitted)").option("--path <dir>", "Directory to link (default: the current directory when empty, else ./<name>)").option("--repo-name <name>", "Name for the new GitHub repo when forking/copying").option("--from-branch <name>", "Import a specific branch of the repo").addOption(new Option2("--wix-instance <token>", 'Create through the Wix route with this signed instance (the Wix connector is connected before the first turn); "-" reads the token from stdin').env("BASE44_WIX_INSTANCE")).option("--wix-client-id <id>", "The companion OAuth app's client id, when the Wix launch has one").option("--verbose", "Show every tool result in full (no folding)").option("--stream-json", "Emit each stream event as a JSON line as it happens, then a final result line").action(newAction);
   return command;
 }
 
-// src/cli/commands/app/status.ts
+// src/cli/commands/builder/status.ts
 async function statusAction(ctx) {
   const id = ctx.app?.id;
   const app = await ctx.runTask("Reading app status", () => getAppState(id));
@@ -270407,7 +271152,7 @@ function getStatusCommand() {
   return command;
 }
 
-// src/cli/commands/app/stop.ts
+// src/cli/commands/builder/stop.ts
 async function stopAction(ctx) {
   const branchId = await resolveBranchId(ctx);
   await ctx.runTask("Stopping the running turn", () => stopTurn(branchId));
@@ -270422,470 +271167,9 @@ function getStopCommand() {
   return command;
 }
 
-// src/cli/commands/app/index.ts
-function getAppCommand() {
-  return new Command2("app").description("Build a Base44 app with the agent, non-interactively: create it, send turns, read status, get the preview").addCommand(getNewCommand()).addCommand(getSendCommand()).addCommand(getStatusCommand()).addCommand(getPreviewCommand()).addCommand(getStopCommand()).addCommand(getModelCommand());
-}
-
-// src/cli/commands/auth/password-login.ts
-import { dirname as dirname15, join as join22 } from "node:path";
-async function passwordLoginAction({ log, runTask }, action) {
-  const shouldEnable = action === "enable";
-  const { project } = await readProjectConfig();
-  const configDir = dirname15(project.configPath);
-  const authDir = join22(configDir, project.authDir);
-  const updated = await runTask("Updating local auth config", async () => {
-    const current = await readAuthConfig(authDir) ?? DEFAULT_AUTH_CONFIG;
-    const merged = { ...current, enableUsernamePassword: shouldEnable };
-    await writeAuthConfig(authDir, merged);
-    return merged;
-  });
-  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
-    log.warn("Disabling password auth will leave no login methods enabled. Users will be locked out.");
-  }
-  const newStatus = shouldEnable ? "enabled" : "disabled";
-  return {
-    outroMessage: `Username & password authentication ${newStatus} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
-  };
-}
-function getPasswordLoginCommand() {
-  return new Base44Command("password-login").description("Enable or disable username & password authentication").addArgument(new Argument2("<action>", "enable or disable password authentication").choices(["enable", "disable"])).action(passwordLoginAction);
-}
-
-// src/cli/commands/auth/pull.ts
-import { dirname as dirname16, join as join23 } from "node:path";
-async function pullAuthAction({
-  log,
-  runTask
-}) {
-  const { project } = await readProjectConfig();
-  const configDir = dirname16(project.configPath);
-  const authDir = join23(configDir, project.authDir);
-  const remoteConfig = await runTask("Fetching auth config from Base44", async () => {
-    return await pullAuthConfig();
-  }, {
-    successMessage: "Auth config fetched successfully",
-    errorMessage: "Failed to fetch auth config"
-  });
-  const { written } = await runTask("Syncing auth config file", async () => {
-    return await writeAuthConfig(authDir, remoteConfig);
-  }, {
-    successMessage: "Auth config file synced successfully",
-    errorMessage: "Failed to sync auth config file"
-  });
-  if (written) {
-    log.success("Auth config written to local file");
-  } else {
-    log.info("Auth config is already up to date");
-  }
-  return {
-    outroMessage: `Pulled auth config to ${authDir} (overwrites local file)`
-  };
-}
-function getAuthPullCommand() {
-  return new Base44Command("pull").description("Pull auth config from Base44 to local file").action(pullAuthAction);
-}
-
-// src/cli/commands/auth/push.ts
-async function pushAuthAction({ isNonInteractive, log, runTask }, options) {
-  const { authConfig } = await readProjectConfig();
-  if (authConfig.length === 0) {
-    log.info("No local auth config found");
-    return {
-      outroMessage: "No auth config to push. Run `base44 auth pull` to fetch the remote config first."
-    };
-  }
-  if (!hasAnyLoginMethod(authConfig[0])) {
-    log.warn("This config has no login methods enabled. Pushing it will lock out all users.");
-  }
-  if (!options.yes) {
-    if (isNonInteractive) {
-      throw new InvalidInputError("--yes is required in non-interactive mode");
-    }
-    const shouldPush = await Re({
-      message: "Push auth config to Base44?"
-    });
-    if (Ct(shouldPush) || !shouldPush) {
-      return { outroMessage: "Push cancelled" };
-    }
-  }
-  await runTask("Pushing auth config to Base44", async () => {
-    return await pushAuthConfig(authConfig[0] ?? null);
-  }, {
-    successMessage: "Auth config pushed successfully",
-    errorMessage: "Failed to push auth config"
-  });
-  return {
-    outroMessage: "Auth config pushed to Base44"
-  };
-}
-function getAuthPushCommand() {
-  return new Base44Command("push").description("Push local auth config to Base44").option("-y, --yes", "Skip confirmation prompt").action(pushAuthAction);
-}
-
-// src/cli/commands/auth/social-login.ts
-import { dirname as dirname17, join as join24, resolve as resolve6 } from "node:path";
-var PROVIDER_LABELS = {
-  google: "Google",
-  microsoft: "Microsoft",
-  facebook: "Facebook",
-  apple: "Apple"
-};
-var VALID_PROVIDER_NAMES = Object.keys(SOCIAL_PROVIDERS);
-var PROVIDER_OAUTH_CLI = {
-  google: {
-    envVar: "google_oauth_client_secret",
-    promptMessage: "Enter Google OAuth client secret"
-  }
-};
-function hasSecretOptions(options) {
-  return Boolean(options.clientSecret || options.clientSecretStdin || options.envFile);
-}
-function hasCustomOAuthOptions(options) {
-  return Boolean(options.clientId || hasSecretOptions(options));
-}
-async function socialLoginAction({ log, isNonInteractive, runTask }, provider, action, options) {
-  const shouldEnable = action === "enable";
-  const providerInfo = SOCIAL_PROVIDERS[provider];
-  const label = PROVIDER_LABELS[provider];
-  const hasOAuthOptions = hasCustomOAuthOptions(options);
-  if (hasOAuthOptions && !providerInfo.customOAuth) {
-    throw new InvalidInputError(`Custom OAuth options are only supported for providers with custom OAuth (e.g., google). Use: base44 auth social-login ${provider} ${action}`);
-  }
-  if (hasOAuthOptions && !shouldEnable) {
-    throw new InvalidInputError(`Custom OAuth options cannot be used with disable. To disable ${label} login: base44 auth social-login ${provider} disable`);
-  }
-  if (hasSecretOptions(options) && !options.clientId) {
-    throw new InvalidInputError(`--client-id is required when providing a client secret. Use: base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`);
-  }
-  const oauth = providerInfo.customOAuth;
-  const oauthCli = PROVIDER_OAUTH_CLI[provider];
-  const useCustomOAuth = shouldEnable && hasOAuthOptions && oauth != null;
-  let clientSecret;
-  if (useCustomOAuth && oauth && oauthCli && hasSecretOptions(options)) {
-    if (options.envFile) {
-      const secrets = await parseEnvFile(resolve6(options.envFile));
-      const value = secrets[oauthCli.envVar];
-      if (!value) {
-        throw new InvalidInputError(`Key "${oauthCli.envVar}" not found in ${options.envFile}.`);
-      }
-      clientSecret = value;
-    } else {
-      clientSecret = await resolveSecret({
-        flagValue: options.clientSecret,
-        fromStdin: options.clientSecretStdin,
-        envVar: oauthCli.envVar,
-        promptMessage: oauthCli.promptMessage,
-        isNonInteractive,
-        name: "client secret",
-        hints: [
-          {
-            message: `Provide via flag:   base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`,
-            command: `base44 auth social-login ${provider} enable --client-id <id> --client-secret <secret>`
-          },
-          {
-            message: `Provide via stdin:  echo <secret> | base44 auth social-login ${provider} enable --client-id <id> --client-secret-stdin`
-          },
-          {
-            message: `Provide via env:    ${oauthCli.envVar}=<secret> base44 auth social-login ${provider} enable --client-id <id>`
-          }
-        ]
-      });
-    }
-  }
-  const { project } = await readProjectConfig();
-  const configDir = dirname17(project.configPath);
-  const authDir = join24(configDir, project.authDir);
-  const { config: updated } = await runTask("Updating local auth config", async () => updateSocialLoginConfig(authDir, provider, shouldEnable, useCustomOAuth && options.clientId ? { clientId: options.clientId } : undefined));
-  if (clientSecret) {
-    await runTask("Saving client secret", async () => pushCustomOAuthSecret(provider, clientSecret));
-  }
-  if (!shouldEnable && !hasAnyLoginMethod(updated)) {
-    log.warn(`Disabling ${label} login will leave no login methods enabled. Users will be locked out.`);
-  }
-  const newStatus = shouldEnable ? "enabled" : "disabled";
-  const oauthNote = useCustomOAuth ? " with custom OAuth" : "";
-  let outroMessage = `${label} login ${newStatus}${oauthNote} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`;
-  if (useCustomOAuth && !clientSecret) {
-    outroMessage += `
-Remember to push the client secret separately: base44 secrets set --env-file <path>`;
-  }
-  return { outroMessage };
-}
-function getSocialLoginCommand() {
-  return new Base44Command("social-login").description("Enable or disable social login providers (google, microsoft, facebook, apple)").addArgument(new Argument2("<provider>", "social login provider").choices(VALID_PROVIDER_NAMES)).addArgument(new Argument2("<action>", "enable or disable the provider").choices([
-    "enable",
-    "disable"
-  ])).option("--client-id <id>", "custom OAuth client ID (Google only)").option("--client-secret <secret>", "custom OAuth client secret (Google only)").option("--client-secret-stdin", "read client secret from stdin (Google only)").option("--env-file <path>", "read client secret from a .env file (Google only)").action(socialLoginAction);
-}
-
-// src/cli/commands/auth/sso.ts
-import { dirname as dirname18, join as join25, resolve as resolve7 } from "node:path";
-var SSOConfigFileSchema = object({
-  provider: _enum(Object.values(KNOWN_SSO_PROVIDERS)),
-  clientId: string2(),
-  clientSecret: string2(),
-  scope: string2().optional(),
-  discoveryUrl: string2().optional(),
-  tenantId: string2().optional(),
-  oktaDomain: string2().optional(),
-  authEndpoint: string2().optional(),
-  tokenEndpoint: string2().optional(),
-  userinfoEndpoint: string2().optional(),
-  jwksUri: string2().optional(),
-  ssoName: string2().optional()
-});
-async function loadSSOConfigFile(filePath) {
-  const resolved = resolve7(filePath);
-  const raw = await readJsonFile(resolved);
-  const result = SSOConfigFileSchema.safeParse(raw);
-  if (!result.success) {
-    throw new SchemaValidationError("Invalid SSO config file", result.error, filePath);
-  }
-  return result.data;
-}
-function mergeFileWithFlags(fileConfig, options) {
-  return {
-    provider: options.provider ?? fileConfig.provider,
-    clientId: options.clientId ?? fileConfig.clientId,
-    clientSecret: options.clientSecret ?? fileConfig.clientSecret,
-    clientSecretStdin: options.clientSecretStdin,
-    envFile: options.envFile,
-    scope: options.scope ?? fileConfig.scope,
-    discoveryUrl: options.discoveryUrl ?? fileConfig.discoveryUrl,
-    tenantId: options.tenantId ?? fileConfig.tenantId,
-    oktaDomain: options.oktaDomain ?? fileConfig.oktaDomain,
-    authEndpoint: options.authEndpoint ?? fileConfig.authEndpoint,
-    tokenEndpoint: options.tokenEndpoint ?? fileConfig.tokenEndpoint,
-    userinfoEndpoint: options.userinfoEndpoint ?? fileConfig.userinfoEndpoint,
-    jwksUri: options.jwksUri ?? fileConfig.jwksUri,
-    ssoName: options.ssoName ?? fileConfig.ssoName
-  };
-}
-var providerNames = Object.keys(KNOWN_SSO_PROVIDERS);
-var SECRET_KEY_TO_FLAG = {
-  ["sso_name" /* Name */]: "--sso-name",
-  ["sso_client_id" /* ClientId */]: "--client-id",
-  ["sso_client_secret" /* ClientSecret */]: "--client-secret",
-  ["sso_scope" /* Scope */]: "--scope",
-  ["sso_discovery_url" /* DiscoveryUrl */]: "--discovery-url",
-  ["sso_tenant_id" /* TenantId */]: "--tenant-id",
-  ["sso_auth_endpoint" /* AuthEndpoint */]: "--auth-endpoint",
-  ["sso_token_endpoint" /* TokenEndpoint */]: "--token-endpoint",
-  ["sso_userinfo_endpoint" /* UserinfoEndpoint */]: "--userinfo-endpoint",
-  ["sso_okta_domain" /* OktaDomain */]: "--okta-domain",
-  ["sso_jwks_uri" /* JwksUri */]: "--jwks-uri"
-};
-function secretKeyToFlag(key) {
-  return SECRET_KEY_TO_FLAG[key];
-}
-function exampleCommand(provider) {
-  let cmd = `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`;
-  if (provider === KNOWN_SSO_PROVIDERS.microsoft)
-    cmd += " --tenant-id <id>";
-  if (provider === KNOWN_SSO_PROVIDERS.okta)
-    cmd += " --okta-domain <domain>";
-  if (provider === KNOWN_SSO_PROVIDERS.custom)
-    cmd += " --sso-name <name> --auth-endpoint <url> --token-endpoint <url> --userinfo-endpoint <url> --jwks-uri <url>";
-  return cmd;
-}
-function validateProvider(provider) {
-  if (!provider) {
-    throw new InvalidInputError("Missing --provider.", {
-      hints: [
-        {
-          message: `Valid providers: ${providerNames.join(", ")}`,
-          command: "base44 auth sso enable --provider <provider> --client-id <id> --client-secret <secret>"
-        }
-      ]
-    });
-  }
-  return provider;
-}
-async function ssoEnableAction({ isNonInteractive, runTask }, options) {
-  if (options.file && options.envFile) {
-    throw new InvalidInputError("--file and --env-file cannot be used together. Provide the client secret either inside --file or via --env-file.");
-  }
-  let merged = options;
-  if (options.file) {
-    const fileConfig = await loadSSOConfigFile(options.file);
-    merged = mergeFileWithFlags(fileConfig, options);
-  }
-  const provider = validateProvider(merged.provider);
-  if (!merged.clientId) {
-    throw new InvalidInputError("Missing --client-id.", {
-      hints: [
-        {
-          message: `Example: base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
-          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
-        }
-      ]
-    });
-  }
-  let clientSecret;
-  if (merged.envFile && !merged.clientSecret) {
-    const secrets = await parseEnvFile(resolve7(merged.envFile));
-    const value = secrets.sso_client_secret;
-    if (!value) {
-      throw new InvalidInputError(`Key "sso_client_secret" not found in ${merged.envFile}.`);
-    }
-    clientSecret = value;
-  } else {
-    clientSecret = await resolveSecret({
-      flagValue: merged.clientSecret,
-      fromStdin: merged.clientSecretStdin,
-      envVar: "sso_client_secret",
-      promptMessage: "Enter SSO client secret",
-      isNonInteractive,
-      name: "client secret",
-      hints: [
-        {
-          message: `Provide via flag:   base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`,
-          command: `base44 auth sso enable --provider ${provider} --client-id <id> --client-secret <secret>`
-        },
-        {
-          message: `Provide via stdin:  echo <secret> | base44 auth sso enable --provider ${provider} --client-id <id> --client-secret-stdin`
-        },
-        {
-          message: `Provide via env:    sso_client_secret=<secret> base44 auth sso enable --provider ${provider} --client-id <id>`
-        }
-      ]
-    });
-  }
-  const secretOptions = {
-    clientId: merged.clientId,
-    clientSecret,
-    scope: merged.scope,
-    discoveryUrl: merged.discoveryUrl,
-    tenantId: merged.tenantId,
-    oktaDomain: merged.oktaDomain,
-    authEndpoint: merged.authEndpoint,
-    tokenEndpoint: merged.tokenEndpoint,
-    userinfoEndpoint: merged.userinfoEndpoint,
-    jwksUri: merged.jwksUri,
-    ssoName: merged.ssoName
-  };
-  let secrets;
-  try {
-    secrets = buildSSOSecrets(provider, secretOptions);
-  } catch (error) {
-    if (error instanceof MissingSSOFieldsError) {
-      const flagNames = error.missingKeys.map(secretKeyToFlag);
-      throw new InvalidInputError(`Missing required fields for ${error.provider}: ${flagNames.join(", ")}`, {
-        hints: [
-          {
-            message: `Example: ${exampleCommand(provider)}`,
-            command: exampleCommand(provider)
-          }
-        ]
-      });
-    }
-    throw error;
-  }
-  const { project } = await readProjectConfig();
-  const configDir = dirname18(project.configPath);
-  const authDir = join25(configDir, project.authDir);
-  await runTask("Updating local auth config", async () => updateSSOConfig(authDir, provider, true));
-  await runTask("Saving SSO credentials", async () => pushSSOSecrets(secrets));
-  return {
-    outroMessage: `SSO configured with ${provider} in local config. Run \`base44 auth push\` or \`base44 deploy\` to apply.`
-  };
-}
-function hasEnableOnlyOptions(options) {
-  return Boolean(options.provider || options.clientId || options.clientSecret || options.clientSecretStdin || options.envFile || options.file || options.scope || options.discoveryUrl || options.tenantId || options.oktaDomain || options.authEndpoint || options.tokenEndpoint || options.userinfoEndpoint || options.jwksUri || options.ssoName);
-}
-async function ssoDisableAction({ log, runTask }, options) {
-  if (hasEnableOnlyOptions(options)) {
-    throw new InvalidInputError("Configuration options cannot be used with disable. To disable SSO: base44 auth sso disable");
-  }
-  const { project } = await readProjectConfig();
-  const configDir = dirname18(project.configPath);
-  const authDir = join25(configDir, project.authDir);
-  const updated = await runTask("Updating local auth config", async () => updateSSOConfig(authDir, null, false));
-  await runTask("Removing SSO credentials", async () => deleteSSOSecrets());
-  if (!hasAnyLoginMethod(updated)) {
-    log.warn("Disabling SSO will leave no login methods enabled. Users will be locked out.");
-  }
-  return {
-    outroMessage: "SSO disabled in local config and credentials removed. Run `base44 auth push` or `base44 deploy` to apply."
-  };
-}
-async function ssoAction(context, action, options) {
-  if (action === "disable") {
-    return ssoDisableAction(context, options);
-  }
-  return ssoEnableAction(context, options);
-}
-function getSSOCommand() {
-  return new Base44Command("sso").description("Configure SSO identity provider (google, microsoft, github, okta, custom). SSO and social login are mutually exclusive — enabling one disables the other in the local auth config.").addArgument(new Argument2("<action>", "enable or disable SSO").choices([
-    "enable",
-    "disable"
-  ])).addOption(new Option2("--provider <provider>", "SSO provider").choices(Object.values(KNOWN_SSO_PROVIDERS))).option("--client-id <id>", "OAuth client ID").option("--client-secret <secret>", "OAuth client secret").option("--client-secret-stdin", "Read client secret from stdin").option("--env-file <path>", "Read client secret from a .env file (key: sso_client_secret)").option("--file <path>", "JSON config file with all SSO settings").option("--scope <scope>", "OAuth scope (defaults per provider)").option("--discovery-url <url>", "OIDC discovery URL").option("--tenant-id <id>", "Microsoft tenant ID (required for microsoft)").option("--okta-domain <domain>", "Okta domain (required for okta)").option("--auth-endpoint <url>", "Authorization endpoint (required for custom)").option("--token-endpoint <url>", "Token endpoint (required for custom)").option("--userinfo-endpoint <url>", "Userinfo endpoint (required for custom)").option("--jwks-uri <url>", "JWKS URI (required for custom)").option("--sso-name <name>", "Provider display name (required for custom)").action(ssoAction);
-}
-
-// src/cli/commands/auth/index.ts
-function getAuthCommand() {
-  return new Command2("auth").description("Manage app authentication settings").addCommand(getPasswordLoginCommand()).addCommand(getSocialLoginCommand()).addCommand(getSSOCommand()).addCommand(getAuthPullCommand()).addCommand(getAuthPushCommand());
-}
-
-// src/cli/commands/auth/login.ts
-function getLoginCommand() {
-  return new Base44Command("login", {
-    requireAuth: false,
-    requireAppContext: false
-  }).description("Authenticate with Base44").action(login);
-}
-
-// src/cli/commands/auth/logout.ts
-async function logout(_ctx) {
-  await deleteAuth();
-  return { outroMessage: "Logged out successfully" };
-}
-function getLogoutCommand() {
-  return new Base44Command("logout", {
-    requireAuth: false,
-    requireAppContext: false
-  }).description("Logout from current device").action(logout);
-}
-
-// src/cli/commands/auth/whoami.ts
-async function whoami(_ctx) {
-  const workspaceApiKey = getWorkspaceApiKeyFromEnv();
-  if (workspaceApiKey && isWorkspaceApiKey(workspaceApiKey)) {
-    return {
-      outroMessage: `Using workspace API key: ${theme.styles.bold(workspaceApiKey.slice(0, 10))}`
-    };
-  }
-  const auth = await readAuth();
-  return { outroMessage: `Logged in as: ${theme.styles.bold(auth.email)}` };
-}
-function getWhoamiCommand() {
-  return new Base44Command("whoami", { requireAppContext: false }).description("Display current authenticated user").action(whoami);
-}
-
-// src/cli/commands/branches/index.ts
-async function listBranchesAction({
-  log,
-  runTask,
-  jsonMode
-}) {
-  const remote = await runTask("Fetching branches", () => listBranches());
-  const branches = [
-    { name: "main", status: "active" },
-    ...remote.map((branch) => ({
-      name: branch.branch_name,
-      status: branch.status
-    }))
-  ];
-  if (jsonMode)
-    return { stdout: `${JSON.stringify({ branches })}
-` };
-  for (const branch of branches)
-    log.message(`${branch.name} (${branch.status})`);
-  return { outroMessage: `${branches.length} branches` };
-}
-function getBranchesCommand() {
-  return new Command2("branches").description("Discover an app's branches").addCommand(new Base44Command("list").description("List main and active branch names for use with --branch").action(listBranchesAction));
+// src/cli/commands/builder/index.ts
+function getBuilderCommand() {
+  return new Command2("builder").description("Build an app with the Base44 builder agent, non-interactively: create it, send turns, read status, stop, pick the model").addCommand(getNewCommand()).addCommand(getSendCommand()).addCommand(getStatusCommand()).addCommand(getStopCommand()).addCommand(getModelCommand());
 }
 
 // ../../node_modules/ink/build/render.js
@@ -275851,6 +276135,119 @@ var build_default = TextInput;
 // src/cli/commands/code/session.tsx
 var import_react23 = __toESM(require_react(), 1);
 
+// src/cli/commands/code/logo.ts
+var ROWS = 6;
+var ASPECT = 0.44;
+var SAMPLES = 4;
+var FILL = 0.6;
+var GAP_ROW = 3.5 + 0.5;
+var GAP_HEIGHT_ROWS = 0.8;
+var LOGO_COLS = Math.max(2, Math.floor(ROWS / ASPECT + 0.5));
+var OCTANT = {
+  rx: 2,
+  ry: 4,
+  table: Array.from("   \uD83E\uDF82\uD833\uDD00▘\uD833\uDD01\uD833\uDD02\uD833\uDD03\uD833\uDD04▝\uD833\uDD05\uD833\uDD06\uD833\uDD07\uD833\uDD08▀\uD833\uDD09\uD833\uDD0A\uD833\uDD0B\uD833\uDD0C\uD833\uDD00\uD833\uDD0D\uD833\uDD0E\uD833\uDD0F\uD833\uDD10\uD833\uDD11\uD833\uDD12\uD833\uDD13\uD833\uDD14\uD833\uDD15\uD833\uDD16\uD833\uDD17\uD833\uDD18\uD833\uDD19\uD833\uDD1A\uD833\uDD1B\uD833\uDD1C\uD833\uDD1D\uD833\uDD1E\uD833\uDD1F\uD833\uDD03\uD833\uDD20\uD833\uDD21\uD833\uDD22\uD833\uDD23\uD833\uDD24\uD833\uDD25\uD833\uDD26\uD833\uDD27\uD833\uDD28\uD833\uDD29\uD833\uDD2A\uD833\uDD2B\uD833\uDD2C\uD833\uDD2D\uD833\uDD2E\uD833\uDD2F\uD833\uDD30\uD833\uDD31\uD833\uDD32\uD833\uDD33\uD833\uDD34\uD833\uDD35\uD83E\uDF85 \uD833\uDD36\uD833\uDD37\uD833\uDD38\uD833\uDD39\uD833\uDD3A\uD833\uDD3B\uD833\uDD3C\uD833\uDD3D\uD833\uDD3E\uD833\uDD3F\uD833\uDD40\uD833\uDD41\uD833\uDD42\uD833\uDD43\uD833\uDD44▖\uD833\uDD45\uD833\uDD46\uD833\uDD47\uD833\uDD48▌\uD833\uDD49\uD833\uDD4A\uD833\uDD4B\uD833\uDD4C▞\uD833\uDD4D\uD833\uDD4E\uD833\uDD4F\uD833\uDD50▛\uD833\uDD51\uD833\uDD52\uD833\uDD53\uD833\uDD54\uD833\uDD55\uD833\uDD56\uD833\uDD57\uD833\uDD58\uD833\uDD59\uD833\uDD5A\uD833\uDD5B\uD833\uDD5C\uD833\uDD5D\uD833\uDD5E\uD833\uDD5F\uD833\uDD60\uD833\uDD61\uD833\uDD62\uD833\uDD63\uD833\uDD64\uD833\uDD65\uD833\uDD66\uD833\uDD67\uD833\uDD68\uD833\uDD69\uD833\uDD6A\uD833\uDD6B\uD833\uDD6C\uD833\uDD6D\uD833\uDD6E\uD833\uDD6F\uD833\uDD70 \uD833\uDD71\uD833\uDD72\uD833\uDD73\uD833\uDD74\uD833\uDD75\uD833\uDD76\uD833\uDD77\uD833\uDD78\uD833\uDD79\uD833\uDD7A\uD833\uDD7B\uD833\uDD7C\uD833\uDD7D\uD833\uDD7E\uD833\uDD7F\uD833\uDD80\uD833\uDD81\uD833\uDD82\uD833\uDD83\uD833\uDD84\uD833\uDD85\uD833\uDD86\uD833\uDD87\uD833\uDD88\uD833\uDD89\uD833\uDD8A\uD833\uDD8B\uD833\uDD8C\uD833\uDD8D\uD833\uDD8E\uD833\uDD8F▗\uD833\uDD90\uD833\uDD91\uD833\uDD92\uD833\uDD93▚\uD833\uDD94\uD833\uDD95\uD833\uDD96\uD833\uDD97▐\uD833\uDD98\uD833\uDD99\uD833\uDD9A\uD833\uDD9B▜\uD833\uDD9C\uD833\uDD9D\uD833\uDD9E\uD833\uDD9F\uD833\uDDA0\uD833\uDDA1\uD833\uDDA2\uD833\uDDA3\uD833\uDDA4\uD833\uDDA5\uD833\uDDA6\uD833\uDDA7\uD833\uDDA8\uD833\uDDA9\uD833\uDDAA\uD833\uDDAB▂\uD833\uDDAC\uD833\uDDAD\uD833\uDDAE\uD833\uDDAF\uD833\uDDB0\uD833\uDDB1\uD833\uDDB2\uD833\uDDB3\uD833\uDDB4\uD833\uDDB5\uD833\uDDB6\uD833\uDDB7\uD833\uDDB8\uD833\uDDB9\uD833\uDDBA\uD833\uDDBB\uD833\uDDBC\uD833\uDDBD\uD833\uDDBE\uD833\uDDBF\uD833\uDDC0\uD833\uDDC1\uD833\uDDC2\uD833\uDDC3\uD833\uDDC4\uD833\uDDC5\uD833\uDDC6\uD833\uDDC7\uD833\uDDC8\uD833\uDDC9\uD833\uDDCA\uD833\uDDCB\uD833\uDDCC\uD833\uDDCD\uD833\uDDCE\uD833\uDDCF\uD833\uDDD0\uD833\uDDD1\uD833\uDDD2\uD833\uDDD3\uD833\uDDD4\uD833\uDDD5\uD833\uDDD6\uD833\uDDD7\uD833\uDDD8\uD833\uDDD9\uD833\uDDDA▄\uD833\uDDDB\uD833\uDDDC\uD833\uDDDD\uD833\uDDDE▙\uD833\uDDDF\uD833\uDDE0\uD833\uDDE1\uD833\uDDE2▟\uD833\uDDE3▆\uD833\uDDE4\uD833\uDDE5█")
+};
+var QUAD = {
+  rx: 2,
+  ry: 2,
+  table: Array.from(" ▘▝▀▖▌▞▛▗▚▐▜▄▙▟█")
+};
+function detectTier(env = process.env) {
+  const term = env.TERM ?? "";
+  const prog = env.TERM_PROGRAM ?? "";
+  if (prog === "ghostty" || term.includes("ghostty"))
+    return "octant";
+  if (env.KITTY_WINDOW_ID || term.includes("kitty"))
+    return "octant";
+  if (env.WEZTERM_PANE || env.WEZTERM_EXECUTABLE)
+    return "octant";
+  if (term.startsWith("foot") || prog === "contour")
+    return "octant";
+  return "quad";
+}
+function coverageGrid(rows, cols, aspect, pixelH) {
+  const worldH = rows * pixelH;
+  const worldW = cols * aspect;
+  const radius = Math.min(worldH, worldW) / 2;
+  const cx = worldW / 2;
+  const cy = worldH / 2;
+  const step = 1 / SAMPLES;
+  const grid = [];
+  for (let py = 0;py < rows; py++) {
+    const y0 = py * pixelH;
+    const y1 = y0 + pixelH;
+    const dyLo = y0 <= cy && cy <= y1 ? 0 : Math.min(Math.abs(y0 - cy), Math.abs(y1 - cy));
+    const dyHi = Math.max(Math.abs(y0 - cy), Math.abs(y1 - cy));
+    const line = [];
+    for (let px = 0;px < cols; px++) {
+      const x0 = px * aspect;
+      const x1 = x0 + aspect;
+      const dxLo = x0 <= cx && cx <= x1 ? 0 : Math.min(Math.abs(x0 - cx), Math.abs(x1 - cx));
+      const dxHi = Math.max(Math.abs(x0 - cx), Math.abs(x1 - cx));
+      if (Math.hypot(dxLo, dyLo) >= radius) {
+        line.push(0);
+        continue;
+      }
+      if (Math.hypot(dxHi, dyHi) <= radius) {
+        line.push(1);
+        continue;
+      }
+      let hits = 0;
+      for (let j = 0;j < SAMPLES; j++) {
+        const dy = y0 + (j + 0.5) * step * pixelH - cy;
+        for (let i = 0;i < SAMPLES; i++) {
+          const dx = x0 + (i + 0.5) * step * aspect - cx;
+          if (Math.hypot(dx, dy) <= radius)
+            hits++;
+        }
+      }
+      line.push(hits / (SAMPLES * SAMPLES));
+    }
+    grid.push(line);
+  }
+  return grid;
+}
+function carveGap(grid, ry) {
+  const n = grid.length;
+  const thick = Math.max(1, Math.round(GAP_HEIGHT_ROWS * ry));
+  const centre = GAP_ROW >= 0 ? GAP_ROW * ry : n + GAP_ROW * ry;
+  const start = Math.max(0, Math.min(n - thick, centre - thick / 2));
+  for (let i = Math.trunc(start);i < Math.trunc(start + thick); i++) {
+    grid[i].fill(0);
+  }
+}
+function logoRows(color, tier = detectTier()) {
+  const { rx, ry, table } = tier === "octant" ? OCTANT : QUAD;
+  const grid = coverageGrid(ROWS * ry, LOGO_COLS * rx, ASPECT / rx, 1 / ry);
+  carveGap(grid, ry);
+  const fg = color ? source_default.hex(color) : (s) => s;
+  const bg = color ? source_default.bgHex(color) : (s) => s;
+  const full = (1 << rx * ry) - 1;
+  const out = [];
+  for (let r = 0;r < ROWS; r++) {
+    let row = "";
+    for (let c = 0;c < LOGO_COLS; c++) {
+      let mask = 0;
+      for (let sr = 0;sr < ry; sr++) {
+        for (let sc = 0;sc < rx; sc++) {
+          if (grid[r * ry + sr][c * rx + sc] >= FILL)
+            mask |= 1 << sr * rx + sc;
+        }
+      }
+      const glyph = table[mask];
+      if (glyph === " ")
+        row += " ";
+      else if (mask === full && color)
+        row += bg(" ");
+      else
+        row += fg(glyph);
+    }
+    out.push(row);
+  }
+  return out;
+}
+
 // src/cli/commands/code/paste.ts
 import { PassThrough as PassThrough3 } from "node:stream";
 var START = "\x1B[200~";
@@ -275924,6 +276321,393 @@ function createPasteFriendlyStdin(real) {
   return proxy;
 }
 
+// src/core/resources/apps/pending.ts
+var CHOICE_TOOLS = new Set([
+  "ask_clarifying_questions",
+  "ask_plan_questions"
+]);
+var SECRET_TOOLS = new Set(["set_secrets"]);
+var PERMISSION_TOOLS = new Set(["request_agent_tool_permissions"]);
+var BROWSER_TOOLS = new Set([
+  "connect_github_account",
+  "request_oauth_authorization",
+  "register_workspace_connector",
+  "configure_psp_credentials",
+  "plaid_connect"
+]);
+var str2 = (v) => typeof v === "string" && v.trim() ? v.trim() : undefined;
+function parseArgs(raw) {
+  try {
+    const parsed = JSON.parse(raw ?? "");
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function questionsFrom(args) {
+  const raw = Array.isArray(args.questions) ? args.questions : [];
+  return raw.flatMap((q) => {
+    if (!q || typeof q !== "object")
+      return [];
+    const item = q;
+    const question = str2(item.question);
+    if (!question)
+      return [];
+    const options = (Array.isArray(item.options) ? item.options : []).flatMap((o) => {
+      const opt = o;
+      const label = str2(opt?.label);
+      return label ? [{ label, description: str2(opt.description) }] : [];
+    });
+    return [
+      {
+        question,
+        description: str2(item.description),
+        options,
+        multiSelect: item.multi_select === true
+      }
+    ];
+  });
+}
+function secretsFrom(args) {
+  const raw = Array.isArray(args.secrets_schema) ? args.secrets_schema : [];
+  return raw.flatMap((s) => {
+    const item = s;
+    const name = str2(item?.secretName) ?? str2(item?.name);
+    return name ? [{ name, description: str2(item.description) }] : [];
+  });
+}
+function permissionKey(row) {
+  switch (row.type) {
+    case "entity":
+      return row.entity_name ? `entity:${row.entity_name}` : null;
+    case "backend_function":
+      return row.function_name ? `backend_function:${row.function_name}` : null;
+    case "app_user_connector":
+      return row.connector_id ? `app_user_connector:${row.connector_id}` : null;
+    default:
+      return null;
+  }
+}
+function permissionsFrom(args) {
+  const raw = Array.isArray(args.requested_permissions) ? args.requested_permissions : [];
+  return raw.flatMap((r) => {
+    const row = r;
+    const key = permissionKey(row);
+    if (!key)
+      return [];
+    const ops = Array.isArray(row.allowed_operations) ? ` (${row.allowed_operations.join(", ")})` : "";
+    const target = str2(row.entity_name) ?? str2(row.function_name) ?? str2(row.connector_name) ?? key;
+    return [
+      { key, label: `${row.type}: ${target}${ops}`, reason: str2(row.reason) }
+    ];
+  });
+}
+function guardFrom(results) {
+  const value = typeof results === "string" ? (() => {
+    try {
+      return JSON.parse(results);
+    } catch {
+      return null;
+    }
+  })() : results;
+  if (!value || typeof value !== "object")
+    return null;
+  const g = value;
+  if (!str2(g.guard))
+    return null;
+  return { title: `${g.guard}: needs your approval`, detail: str2(g.reason) };
+}
+function humanize(tool) {
+  return tool.replace(/_/g, " ");
+}
+function pendingInputs(messages) {
+  const out = [];
+  for (const message of messages) {
+    for (const call of message.tool_calls ?? []) {
+      if (call.status !== "waiting_for_user_input")
+        continue;
+      const args = parseArgs(call.arguments_string);
+      const base = {
+        toolCallId: call.id,
+        messageId: message.id,
+        tool: call.name
+      };
+      const summary = str2(args.summary);
+      if (CHOICE_TOOLS.has(call.name)) {
+        out.push({
+          ...base,
+          kind: "choice",
+          title: summary ?? "The agent has a few questions",
+          questions: questionsFrom(args)
+        });
+      } else if (SECRET_TOOLS.has(call.name)) {
+        out.push({
+          ...base,
+          kind: "secrets",
+          title: summary ?? "The agent needs secrets",
+          secrets: secretsFrom(args)
+        });
+      } else if (PERMISSION_TOOLS.has(call.name)) {
+        out.push({
+          ...base,
+          kind: "permissions",
+          title: summary ?? "Grant the app's agent these permissions?",
+          detail: str2(args.reason),
+          permissions: permissionsFrom(args)
+        });
+      } else if (BROWSER_TOOLS.has(call.name)) {
+        out.push({
+          ...base,
+          kind: "browser",
+          title: summary ?? humanize(call.name),
+          detail: str2(args.reason)
+        });
+      } else {
+        const guard = guardFrom(call.results);
+        const integration = str2(args.integration_type);
+        out.push({
+          ...base,
+          kind: "approval",
+          title: guard?.title ?? (integration ? `Enable ${integration}?` : summary ?? `${humanize(call.name)}?`),
+          detail: guard?.detail ?? (integration ? summary : undefined)
+        });
+      }
+    }
+  }
+  return out;
+}
+function choiceAnswers(questions, selections) {
+  const answers = questions.flatMap((q, index) => {
+    const sel = selections[index];
+    if (!sel || sel.labels.length === 0 && !sel.customText)
+      return [];
+    const answer = { question_index: index };
+    if (q.multiSelect) {
+      if (sel.labels.length)
+        answer.selected_labels = sel.labels;
+    } else if (sel.labels[0]) {
+      answer.selected_label = sel.labels[0];
+    }
+    if (sel.customText)
+      answer.custom_text = sel.customText;
+    return [answer];
+  });
+  return { answers };
+}
+
+// src/cli/commands/code/pending-card.ts
+function openCard(pending) {
+  return {
+    pending,
+    step: 0,
+    cursor: 0,
+    selections: (pending.questions ?? []).map(() => ({ labels: [] })),
+    granted: new Set((pending.permissions ?? []).map((p) => p.key)),
+    typing: pending.kind === "secrets" ? "secret" : null,
+    secretValues: {}
+  };
+}
+var done = (action, input = {}) => ({ state: null, submit: { action, input } });
+var later = { state: null, dismissed: true };
+function choiceRows(state) {
+  return (state.pending.questions?.[state.step]?.options.length ?? 0) + 1;
+}
+function advanceChoice(state) {
+  const questions = state.pending.questions ?? [];
+  if (state.step + 1 < questions.length) {
+    return {
+      state: { ...state, step: state.step + 1, cursor: 0, typing: null }
+    };
+  }
+  return done("approved", choiceAnswers(questions, state.selections));
+}
+function choiceKey(state, key) {
+  const question = state.pending.questions?.[state.step];
+  if (!question)
+    return done("approved", { answers: [] });
+  const rows = choiceRows(state);
+  const custom = state.cursor === rows - 1;
+  const sel = state.selections[state.step] ?? { labels: [] };
+  const setSel = (next) => {
+    const selections = [...state.selections];
+    selections[state.step] = next;
+    return { ...state, selections };
+  };
+  switch (key) {
+    case "up":
+      return { state: { ...state, cursor: (state.cursor - 1 + rows) % rows } };
+    case "down":
+      return { state: { ...state, cursor: (state.cursor + 1) % rows } };
+    case "space": {
+      if (custom)
+        return { state: { ...state, typing: "custom" } };
+      const label = question.options[state.cursor].label;
+      const labels = question.multiSelect ? sel.labels.includes(label) ? sel.labels.filter((l) => l !== label) : [...sel.labels, label] : [label];
+      return { state: setSel({ ...sel, labels }) };
+    }
+    case "enter": {
+      if (custom)
+        return { state: { ...state, typing: "custom" } };
+      if (question.multiSelect) {
+        if (sel.labels.length === 0 && !sel.customText)
+          return { state };
+        return advanceChoice(state);
+      }
+      const label = question.options[state.cursor].label;
+      return advanceChoice(setSel({ labels: [label] }));
+    }
+    case "s":
+      return done("approved", { answers: [] });
+    case "escape":
+      return later;
+    default:
+      return { state };
+  }
+}
+function permissionsKey(state, key) {
+  const rows = state.pending.permissions ?? [];
+  switch (key) {
+    case "up":
+      return {
+        state: {
+          ...state,
+          cursor: (state.cursor - 1 + rows.length) % rows.length
+        }
+      };
+    case "down":
+      return { state: { ...state, cursor: (state.cursor + 1) % rows.length } };
+    case "space": {
+      const k = rows[state.cursor]?.key;
+      if (!k)
+        return { state };
+      const granted = new Set(state.granted);
+      if (granted.has(k))
+        granted.delete(k);
+      else
+        granted.add(k);
+      return { state: { ...state, granted } };
+    }
+    case "enter":
+    case "y":
+      return done("approved", {
+        approved_permission_keys: rows.map((r) => r.key).filter((k) => state.granted.has(k))
+      });
+    case "n":
+      return done("rejected");
+    case "escape":
+      return later;
+    default:
+      return { state };
+  }
+}
+function cardKey(state, key) {
+  if (state.typing) {
+    if (key === "escape") {
+      return state.typing === "secret" ? later : { state: { ...state, typing: null } };
+    }
+    return { state };
+  }
+  switch (state.pending.kind) {
+    case "choice":
+      return choiceKey(state, key);
+    case "permissions":
+      return permissionsKey(state, key);
+    default:
+      if (key === "y" || key === "enter")
+        return done("approved");
+      if (key === "n")
+        return done("rejected");
+      if (key === "escape")
+        return later;
+      return { state };
+  }
+}
+function cardText(state, text) {
+  const value = text.trim();
+  if (state.typing === "custom") {
+    if (!value)
+      return { state: { ...state, typing: null } };
+    const selections = [...state.selections];
+    const current = selections[state.step] ?? { labels: [] };
+    selections[state.step] = { ...current, customText: value };
+    return advanceChoice({ ...state, selections, typing: null });
+  }
+  if (state.typing === "secret") {
+    const fields = state.pending.secrets ?? [];
+    const field = fields[state.step];
+    if (!field || !value)
+      return { state };
+    const secretValues = { ...state.secretValues, [field.name]: value };
+    if (state.step + 1 < fields.length) {
+      return { state: { ...state, secretValues, step: state.step + 1 } };
+    }
+    return done("approved", { secrets: secretValues });
+  }
+  return { state };
+}
+function cardLines(state) {
+  const p = state.pending;
+  const head = [source_default.bold(`⏸ ${p.title}`)];
+  if (p.detail)
+    head.push(source_default.dim(`  ${p.detail}`));
+  switch (p.kind) {
+    case "choice": {
+      const q = p.questions?.[state.step];
+      if (!q)
+        return [...head, source_default.dim("  (no questions) · Enter to continue")];
+      const total = p.questions?.length ?? 1;
+      const sel = state.selections[state.step] ?? { labels: [] };
+      const rows = q.options.map((o, i) => {
+        const on = sel.labels.includes(o.label);
+        const mark = q.multiSelect ? on ? "☑" : "☐" : on ? "●" : "○";
+        const text = `${state.cursor === i ? "▸" : " "} ${mark} ${o.label}${o.description ? source_default.dim(`  — ${o.description}`) : ""}`;
+        return state.cursor === i ? source_default.cyan(text) : text;
+      });
+      const customRow = `${state.cursor === q.options.length ? "▸" : " "} ✎ something else${sel.customText ? source_default.dim(`  — ${sel.customText}`) : ""}`;
+      rows.push(state.cursor === q.options.length ? source_default.cyan(customRow) : customRow);
+      return [
+        ...head,
+        `  ${source_default.bold(q.question)} ${source_default.dim(`(${state.step + 1}/${total})`)}`,
+        ...q.description ? [source_default.dim(`  ${q.description}`)] : [],
+        ...rows.map((r) => `  ${r}`),
+        source_default.dim(q.multiSelect ? "  ↑↓ move · space toggle · Enter next · s skip all · Esc later" : "  ↑↓ move · Enter choose · s skip all · Esc later")
+      ];
+    }
+    case "permissions": {
+      const rows = (p.permissions ?? []).map((r, i) => {
+        const text = `${state.cursor === i ? "▸" : " "} ${state.granted.has(r.key) ? "☑" : "☐"} ${r.label}${r.reason ? source_default.dim(`  — ${r.reason}`) : ""}`;
+        return `  ${state.cursor === i ? source_default.cyan(text) : text}`;
+      });
+      return [
+        ...head,
+        ...rows,
+        source_default.dim("  space toggle · Enter grant ticked · n reject all · Esc later")
+      ];
+    }
+    case "secrets": {
+      const fields = p.secrets ?? [];
+      const rows = fields.map((f, i) => {
+        const filled = f.name in state.secretValues;
+        const mark = filled ? source_default.green("✓") : i === state.step ? "▸" : "○";
+        return `  ${mark} ${f.name}${f.description ? source_default.dim(`  — ${f.description}`) : ""}`;
+      });
+      return [
+        ...head,
+        ...rows,
+        source_default.dim("  type the value below (hidden) · Enter next · Esc later")
+      ];
+    }
+    case "browser":
+      return [
+        ...head,
+        source_default.dim("  finish this step in the editor (footer link), then press y"),
+        source_default.dim("  y continue · n reject · Esc later")
+      ];
+    default:
+      return [...head, source_default.dim("  y approve · n reject · Esc later")];
+  }
+}
+
 // src/cli/commands/code/session-engine.ts
 var POLL_MS = 1000;
 function createSessionEngine(options) {
@@ -275943,6 +276727,28 @@ function createSessionEngine(options) {
   let awaitingTurn = options.awaitingTurnLabel ?? null;
   const awaitingSince = Date.now();
   let lastEventAt = Date.now();
+  let pending = [];
+  const answered = new Set;
+  const answer = (p, action, input = {}) => {
+    answered.add(p.toolCallId);
+    pending = pending.filter((x) => x.toolCallId !== p.toolCallId);
+    const verb = action === "rejected" ? source_default.red("✗ rejected") : Object.keys(input).length ? source_default.green("→ answered") : source_default.green("✓ approved");
+    options.onLine(`${verb} ${source_default.dim("—")} ${p.title}`);
+    pendingSubmitAt = Date.now();
+    sendsInFlight++;
+    answerToolCall({ toolCallId: p.toolCallId, messageId: p.messageId, action, input }, options.branchId).catch((error) => {
+      const status = error instanceof ApiError ? error.statusCode : undefined;
+      const edgeDrop = status === 502 || status === 503 || status === 504 || /timeout|gateway/i.test(error instanceof Error ? error.message : "");
+      if (edgeDrop && (turnStartedAt != null || pendingSubmitAt == null)) {
+        return;
+      }
+      answered.delete(p.toolCallId);
+      pendingSubmitAt = null;
+      options.onLine(source_default.red(`✗ answer failed: ${error instanceof Error ? error.message : String(error)}`));
+    }).finally(() => {
+      sendsInFlight--;
+    });
+  };
   const submit = (raw) => {
     const typed = raw.trim();
     if (!typed)
@@ -275983,25 +276789,38 @@ function createSessionEngine(options) {
         return;
       }
       const events = diffConversation(diffState, messages);
+      const waiting = pendingInputs(messages);
+      for (const id of answered) {
+        if (!waiting.some((w) => w.toolCallId === id))
+          answered.delete(id);
+      }
+      pending = waiting.filter((w) => !answered.has(w.toolCallId));
       if (!prime) {
         for (const event of events) {
           if (event.kind === "tool_start") {
+            const startedAt = Date.now();
             running.set(event.id, {
               alias: toolAlias(event.name),
               label: event.label,
               summary: event.summary,
-              startedAt: Date.now()
+              startedAt
             });
+            options.onLine({ running: event, startedAt });
             continue;
           }
-          let elapsedMs;
           if (event.kind === "tool_end") {
             const started = running.get(event.id)?.startedAt;
-            if (started != null)
-              elapsedMs = Date.now() - started;
             running.delete(event.id);
+            lastEventAt = Date.now();
+            options.onLine({
+              event,
+              elapsedMs: started != null ? Date.now() - started : undefined
+            });
+            continue;
           }
-          const line = eventLine(event, elapsedMs);
+          const line = eventLine(event, undefined, {
+            waitingHint: "answer in the card below"
+          });
           if (line != null) {
             lastEventAt = Date.now();
             options.onLine(line);
@@ -276068,6 +276887,7 @@ function createSessionEngine(options) {
       });
     },
     submit,
+    answer,
     status() {
       let phase = "idle";
       if (awaitingTurn != null)
@@ -276090,7 +276910,8 @@ function createSessionEngine(options) {
         turnStartedAt,
         runningTool,
         lastTurnMs,
-        lastTurnOk
+        lastTurnOk,
+        pending
       };
     },
     turnRunning() {
@@ -276122,6 +276943,17 @@ function exitAltScreen() {
   altScreenActive = false;
   process.stdout.write("\x1B[?1007l\x1B[?1049l");
 }
+function withEntry(items, entry) {
+  if (typeof entry !== "string" && "event" in entry) {
+    const i = items.findIndex((e) => typeof e !== "string" && ("running" in e) && e.running.id === entry.event.id);
+    if (i >= 0) {
+      const next = [...items];
+      next[i] = entry;
+      return next;
+    }
+  }
+  return [...items, entry];
+}
 function statusText(status, musingSeed) {
   const frame = FRAMES2[Math.floor(Date.now() / 120) % FRAMES2.length];
   switch (status.phase) {
@@ -276129,15 +276961,8 @@ function statusText(status, musingSeed) {
       return source_default.dim(`${frame} ${status.awaitingLabel} (${formatDuration2(Date.now() - status.awaitingSince)})`);
     case "running": {
       const turnFor = formatDuration2(Date.now() - (status.turnStartedAt ?? Date.now()));
-      const tool = status.runningTool;
-      if (tool) {
-        const toolFor = Math.round((Date.now() - tool.startedAt) / 1000);
-        const others = tool.others > 0 ? ` (+${tool.others})` : "";
-        const what = tool.label || `${tool.alias}${tool.summary ? ` ${tool.summary}` : ""}`;
-        return source_default.dim(`${frame} ${what}${others} · ${toolFor}s (turn ${turnFor})`);
-      }
       const quiet = status.quietForMs > 60000 ? " · a long private step — details render in the editor" : "";
-      return `${source_default.magenta("✻")} ${source_default.dim(`${idleMusing(musingSeed)} (${turnFor})${quiet}`)}`;
+      return `${source_default.magenta(shimmer())} ${source_default.dim(`${idleMusing(musingSeed)} (${turnFor})${quiet}`)}`;
     }
     case "sending":
       return source_default.dim(`${frame} sending…`);
@@ -276151,18 +276976,19 @@ function statusText(status, musingSeed) {
 function SessionView({ engine, footer, subscribe }) {
   const { exit } = use_app_default();
   const [items, setItems] = import_react23.useState([]);
+  const [verbose, setVerbose] = import_react23.useState(false);
   const [input, setInput] = import_react23.useState("");
   const [scroll, setScroll] = import_react23.useState(0);
   const [, tick] = import_react23.useReducer((x) => x + 1, 0);
   const [musingSeed] = import_react23.useState(() => Math.floor(Math.random() * 97));
   const [currentModel, setCurrentModel] = import_react23.useState(null);
   const [pickerIndex, setPickerIndex] = import_react23.useState(null);
+  const [card, setCard] = import_react23.useState(null);
+  const dismissedRef = import_react23.useRef(new Set);
   const maxScrollRef = import_react23.useRef(0);
   const meIdRef = import_react23.useRef(null);
-  const emit = (line) => setItems((h) => [...h, `${line}
-`]);
-  import_react23.useEffect(() => subscribe((line) => setItems((h) => [...h, `${line}
-`])), [subscribe]);
+  const emit = (entry) => setItems((h) => withEntry(h, entry));
+  import_react23.useEffect(() => subscribe((entry) => setItems((h) => withEntry(h, entry))), [subscribe]);
   import_react23.useEffect(() => {
     const timer = setInterval(tick, 120);
     return () => clearInterval(timer);
@@ -276204,6 +277030,29 @@ function SessionView({ engine, footer, subscribe }) {
       emit(source_default.red(`  /model: ${error instanceof Error ? error.message : String(error)}`));
     }
   };
+  const applyCard = (outcome) => {
+    if (outcome.submit && card) {
+      engine.answer(card.pending, outcome.submit.action, outcome.submit.input);
+    }
+    if (outcome.dismissed && card) {
+      dismissedRef.current.add(card.pending.toolCallId);
+    }
+    setCard(outcome.state);
+  };
+  const pending = engine.status().pending;
+  import_react23.useEffect(() => {
+    if (card) {
+      if (!pending.some((p) => p.toolCallId === card.pending.toolCallId)) {
+        setCard(null);
+      }
+      return;
+    }
+    if (pickerIndex !== null)
+      return;
+    const next = pending.find((p) => !dismissedRef.current.has(p.toolCallId));
+    if (next)
+      setCard(openCard(next));
+  }, [pending, card, pickerIndex]);
   use_input_default((char, key) => {
     if (pickerIndex !== null) {
       if (key.upArrow)
@@ -276219,6 +277068,23 @@ function SessionView({ engine, footer, subscribe }) {
       }
       return;
     }
+    if (key.tab && !card) {
+      const next = pending.find((p) => dismissedRef.current.has(p.toolCallId));
+      if (next) {
+        dismissedRef.current.delete(next.toolCallId);
+        setCard(openCard(next));
+      }
+      return;
+    }
+    if (card) {
+      const mapped = key.upArrow ? "up" : key.downArrow ? "down" : key.return ? "enter" : key.escape ? "escape" : char === " " ? "space" : char === "y" || char === "n" || char === "s" ? char : null;
+      if (card.typing && mapped !== "escape")
+        return;
+      if (mapped)
+        applyCard(cardKey(card, mapped));
+      if (mapped || !card.typing)
+        return;
+    }
     if (key.ctrl && char === "c") {
       if (input)
         setInput("");
@@ -276230,6 +277096,10 @@ function SessionView({ engine, footer, subscribe }) {
       exit();
       return;
     }
+    if (key.ctrl && char === "o") {
+      setVerbose((v) => !v);
+      return;
+    }
     if (key.upArrow) {
       setScroll((s) => Math.min(s + 3, maxScrollRef.current));
       return;
@@ -276255,14 +277125,17 @@ function SessionView({ engine, footer, subscribe }) {
   });
   const columns = process.stdout.columns || 80;
   const rows = process.stdout.rows || 24;
-  const width = Math.min(columns, 100);
+  const width = columns;
   const innerWidth = Math.max(10, width - 4);
   const inputRows = Math.max(1, Math.ceil((input.length + 3) / innerWidth));
   const pickerOpen = pickerIndex !== null;
-  const inputBlockHeight = pickerOpen ? MODELS.length + 3 : inputRows + 2;
+  const cardOpen = card !== null && !card.typing;
+  const cardRows = card ? cardLines(card).length : 0;
+  const inputBlockHeight = pickerOpen ? MODELS.length + 3 : cardOpen ? cardRows + 2 : inputRows + 2 + (card?.typing ? 1 : 0);
   const widgetHeight = inputBlockHeight + 3 + (footer.length ? 1 : 0);
   const viewHeight = Math.max(3, rows - widgetHeight - 1);
-  const lines = items.flatMap((item) => hardWrapAnsi(item, columns));
+  const lines = items.flatMap((item) => hardWrapAnsi(`${renderEntry(item, { verbose, foldHint: "Ctrl+O to expand" })}
+`, columns));
   const maxScroll = Math.max(0, lines.length - viewHeight);
   maxScrollRef.current = maxScroll;
   const clamped = Math.min(scroll, maxScroll);
@@ -276309,29 +277182,64 @@ function SessionView({ engine, footer, subscribe }) {
             }, m.name, false, undefined, this);
           })
         ]
-      }, undefined, true, undefined, this) : /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Box_default, {
+      }, undefined, true, undefined, this) : cardOpen && card ? /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Box_default, {
+        flexDirection: "column",
+        borderStyle: "round",
+        borderColor: "yellow",
+        paddingX: 1,
+        width,
+        children: cardLines(card).map((line, i) => /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+          wrap: "truncate-end",
+          children: line
+        }, i, false, undefined, this))
+      }, undefined, false, undefined, this) : /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Box_default, {
+        flexDirection: "column",
         borderStyle: "round",
-        borderColor: "gray",
+        borderColor: card?.typing ? "yellow" : "gray",
         paddingX: 1,
         width,
         children: [
-          /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
-            color: "cyan",
-            children: "❯ "
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsx_dev_runtime.jsxDEV(build_default, {
-            value: input,
-            onChange: setInput,
-            onSubmit: (value) => {
-              const trimmed = value.trim();
-              if (trimmed === "/model" || trimmed.startsWith("/model ")) {
-                runModelSlash(trimmed.slice("/model".length).trim());
-              } else if (trimmed) {
-                engine.submit(value);
-              }
-              setInput("");
-            }
-          }, undefined, false, undefined, this)
+          card?.typing === "secret" && /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+            wrap: "truncate-end",
+            children: [
+              source_default.bold(card.pending.secrets?.[card.step]?.name ?? "secret"),
+              source_default.dim("  — value is hidden · Enter to save · Esc to cancel")
+            ]
+          }, undefined, true, undefined, this),
+          card?.typing === "custom" && /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+            wrap: "truncate-end",
+            children: [
+              source_default.bold(card.pending.questions?.[card.step]?.question ?? ""),
+              source_default.dim("  — your own answer · Enter to save · Esc to go back")
+            ]
+          }, undefined, true, undefined, this),
+          /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Box_default, {
+            children: [
+              /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
+                color: "cyan",
+                children: "❯ "
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsx_dev_runtime.jsxDEV(build_default, {
+                value: input,
+                onChange: setInput,
+                mask: card?.typing === "secret" ? "•" : undefined,
+                onSubmit: (value) => {
+                  if (card?.typing) {
+                    applyCard(cardText(card, value));
+                    setInput("");
+                    return;
+                  }
+                  const trimmed = value.trim();
+                  if (trimmed === "/model" || trimmed.startsWith("/model ")) {
+                    runModelSlash(trimmed.slice("/model".length).trim());
+                  } else if (trimmed) {
+                    engine.submit(value);
+                  }
+                  setInput("");
+                }
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this)
         ]
       }, undefined, true, undefined, this),
       footer.length > 0 && /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
@@ -276345,48 +277253,16 @@ function SessionView({ engine, footer, subscribe }) {
       /* @__PURE__ */ jsx_dev_runtime.jsxDEV(Text, {
         dimColor: true,
         wrap: "truncate-end",
-        children: pickerOpen ? "  ↑↓ to move · Enter to select · Esc to cancel" : engine.turnRunning() ? "  Esc to stop · type to queue · scroll to read · Ctrl+C to exit" : "  Enter to send · /model to switch model · Esc for live · Ctrl+C to exit"
+        children: pickerOpen ? "  ↑↓ to move · Enter to select · Esc to cancel" : cardOpen ? "  the agent is waiting on you · answer above, or Esc for later" : pending.length > 0 && !card ? `  ⏸ ${pending[0].title} — Tab to answer · Ctrl+C to exit` : engine.turnRunning() ? "  Esc to stop · type to queue · scroll to read · Ctrl+O to expand · Ctrl+C to exit" : "  Enter to send · /model to switch model · Esc for live · Ctrl+O to expand · Ctrl+C to exit"
       }, undefined, false, undefined, this)
     ]
   }, undefined, true, undefined, this);
 }
-var LOGO_ROWS = 6;
-var LOGO_GAP_SUBROW = 8;
-var QUAD = " ▘▝▀▖▌▞▛▗▚▐▜▄▙▟█";
-function buildLogoRows() {
-  const sy = 2 * LOGO_ROWS;
-  const sx = 2 * sy;
-  const cx = (sx - 1) / 2;
-  const cy = (sy - 1) / 2;
-  const rad = sy / 2 - 0.5;
-  const on = (px, py) => {
-    if (py === LOGO_GAP_SUBROW)
-      return false;
-    const dx = (px - cx) * 0.5;
-    const dy = py - cy;
-    return dx * dx + dy * dy <= rad * rad;
-  };
-  const rows = [];
-  for (let ty = 0;ty < sy; ty += 2) {
-    let row = "";
-    for (let tx = 0;tx < sx; tx += 2) {
-      const bits = (on(tx, ty) ? 1 : 0) | (on(tx + 1, ty) ? 2 : 0) | (on(tx, ty + 1) ? 4 : 0) | (on(tx + 1, ty + 1) ? 8 : 0);
-      row += QUAD[bits];
-    }
-    rows.push(row.trim());
-  }
-  return rows.map((row) => row.trim());
-}
 function renderHeader(who, mode) {
   const orange = source_default.hex(BRAND_ORANGE);
   const cwd = process.cwd().replace(process.env.HOME ?? "", "~");
-  const logo = buildLogoRows();
-  const logoW = Math.max(...logo.map((r) => r.length));
-  const center = (s) => {
-    const total = Math.max(0, logoW - s.length);
-    const left = Math.floor(total / 2);
-    return " ".repeat(left) + s + " ".repeat(total - left);
-  };
+  const logo = logoRows(BRAND_ORANGE);
+  const logoW = LOGO_COLS;
   const text = [
     `${orange.bold("Base44 Code")} ${source_default.dim(`v${package_default.version}`)}`,
     source_default.bold(who ? `Welcome back, ${who}!` : "Welcome!"),
@@ -276398,7 +277274,7 @@ function renderHeader(who, mode) {
   const textTop = Math.max(0, Math.floor((logo.length - text.length) / 2));
   const out = [];
   for (let i = 0;i < height; i++) {
-    const left = i < logo.length ? orange(center(logo[i])) : " ".repeat(logoW);
+    const left = i < logo.length ? logo[i] : " ".repeat(logoW);
     const right = text[i - textTop] ?? "";
     out.push(`  ${left}   ${right}`.trimEnd());
   }
@@ -276502,6 +277378,7 @@ async function runGenesisSession(options) {
     runningTool: null,
     lastTurnMs: null,
     lastTurnOk: true,
+    pending: [],
     quietForMs: 0
   };
   const genesis = {
@@ -276557,6 +277434,9 @@ async function runGenesisSession(options) {
       }
       return IDLE_STATUS;
     },
+    answer(p, action, input) {
+      inner?.answer(p, action, input);
+    },
     turnRunning() {
       return inner?.turnRunning() ?? creating;
     }
@@ -276589,21 +277469,21 @@ async function runGenesisSession(options) {
 
 // src/cli/commands/code/index.ts
 var BRAND_ORANGE2 = "#E86B3C";
-async function bootstrapApp(prompt, footer, emit, onCreated, importRepo) {
+async function bootstrapApp(prompt, footer, emit, onCreated, importRepo, path, wixInstance) {
   let app;
   try {
-    app = await createAndLinkApp({ prompt, importRepo });
+    app = await createAndLinkApp({ prompt, importRepo, path, wixInstance });
   } catch (error) {
     for (const line of await githubReauthLines(error) ?? [])
       emit(line);
     throw error;
   }
   onCreated(app);
-  footer.push(source_default.dim(`dir ./${app.dirName}`));
+  footer.push(source_default.dim(`dir ${app.here ? "./" : `./${app.dirName}`}`));
   if (app.repoUrl)
     footer.push(terminalLink("repo", app.repoUrl));
   footer.push(terminalLink("editor", app.editorUrl));
-  emit(source_default.dim(`linked  ./${app.dirName}  (cd ${app.dirName} after the session)`));
+  emit(source_default.dim(app.here ? "linked  ./  (this directory)" : `linked  ./${app.dirName}  (cd ${app.dirName} after the session)`));
   const branchId = await resolveActiveBranchId().catch(() => {
     return;
   });
@@ -276627,46 +277507,61 @@ async function bootstrapApp(prompt, footer, emit, onCreated, importRepo) {
     }
   };
 }
-async function codeAction({ log }, options) {
+async function codeAction({ log }, options, appId) {
+  const orange = source_default.hex(BRAND_ORANGE2);
+  const chip = (label) => source_default.dim(`${orange("●")} ${label}`);
   if (process.stdout.isTTY !== true) {
     throw new InvalidInputError("base44 code is an interactive session and needs a terminal.");
   }
   let linked = false;
   try {
-    await initAppContext();
+    await initAppContext(appId ? { appId } : {});
     linked = true;
   } catch {}
   if (linked) {
-    if (options.import) {
-      throw new InvalidInputError("--import creates a new app; run it outside a linked project.");
+    if (options.import || options.path || options.wixInstance) {
+      throw new InvalidInputError("--import, --path and --wix-instance create a new app; run them outside a linked project, without --app-id.");
     }
+    const { id, projectRoot } = getAppContext();
+    const state = await assertBuilderApp(id);
     const branchId = await resolveActiveBranchId().catch(() => {
       return;
     });
     await runInteractiveSession({
       branchId,
-      footer: [],
+      footer: [chip(appTypeChip(state))],
       primeFirstPoll: true,
       idleHint: "what should the agent do next?"
     });
-    log.message(source_default.dim(`app dir  ${getAppContext().projectRoot}`));
+    if (projectRoot) {
+      log.message(source_default.dim(`app dir  ${projectRoot}`));
+      return {
+        outroMessage: "Session closed. Run `base44 code` here to resume."
+      };
+    }
     return {
-      outroMessage: "Session closed. Run `base44 code` here to resume."
+      outroMessage: `Session closed. Resume with \`base44 code --app-id ${id}\`.`
     };
   }
+  if (options.wixInstance && options.import) {
+    throw new InvalidInputError("--wix-instance and --import are exclusive.");
+  }
+  const wixInstance = options.wixInstance?.trim() ? {
+    signedInstance: options.wixInstance.trim(),
+    wixClientId: options.wixClientId?.trim() || undefined
+  } : undefined;
   let created;
-  const orange = source_default.hex(BRAND_ORANGE2);
   const footer = [
-    source_default.dim(`${orange("●")} ${options.import ? "import" : "builder"}`)
+    chip(options.import ? repoLabel(options.import) : wixInstance ? "web app · wix" : "web app")
   ];
   await runGenesisSession({
-    idleHint: options.import ? "describe what to build over the repo" : "describe the app you want to build",
+    idleHint: options.import ? "describe what to build over the repository" : "describe the app you want to build  ·  have one already? base44 code --app-id <id>, or base44 link",
     creatingLabel: options.import ? "importing the repository" : "creating your app",
-    modeLabel: options.import ? `Import — ${options.import}` : "Builder — Base44 template + agent",
+    modeLabel: options.import ? `Repository — ${repoLabel(options.import)}` : wixInstance ? "Web app — Wix launch (connector connected first)" : "Web app — Base44 template + builder agent",
     footer,
     createApp: (prompt, emit) => bootstrapApp(prompt, footer, emit, (app) => {
       created = app;
-    }, options.import)
+    }, options.import, options.path, wixInstance)
   });
   if (!created) {
     return { outroMessage: "Session closed. No app was created." };
@@ -276678,7 +277573,7 @@ async function codeAction({ log }, options) {
 }
 function getCodeCommand() {
   const command = new Base44Command("code", { requireAppContext: false });
-  command.description("Open Base44 Code: an interactive agent session — in an empty directory your first prompt creates the app (add --import <repo> to build over an existing repository)").option("--import <repo>", "Build over an existing GitHub repository instead of the Base44 template").action(codeAction);
+  command.description("Open Base44 Code, an interactive builder session. In a linked directory (or with --app-id <id>) it opens that app; anywhere else your first prompt creates one (--import <repo> to build over your own repository). Attach a directory to an existing app with base44 link.").option("--import <repo>", "Build over an existing GitHub repository instead of the Base44 template").option("--path <dir>", "Directory to link the new app to (default: the current directory when empty, else ./<name>)").option("--wix-instance <token>", "Create the new app through the Wix route with this signed instance (your first prompt is what the agent runs)").option("--wix-client-id <id>", "The companion OAuth app's client id").action((ctx, options) => codeAction(ctx, options, command.optsWithGlobals().appId));
   return command;
 }
 
@@ -277476,10 +278371,10 @@ function getConnectorsListAvailableCommand() {
 }
 
 // src/cli/commands/connectors/pull.ts
-import { dirname as dirname19, join as join27, resolve as resolve8 } from "node:path";
+import { dirname as dirname19, join as join27, resolve as resolve9 } from "node:path";
 async function resolveConnectorsDir(options) {
   if (!getAppContext().projectRoot) {
-    return resolve8(options.dir ?? "connectors");
+    return resolve9(options.dir ?? "connectors");
   }
   const { project } = await readProjectConfig();
   return join27(dirname19(project.configPath), project.connectorsDir);
@@ -277523,10 +278418,10 @@ function getConnectorsPullCommand() {
 }
 
 // src/cli/commands/connectors/push.ts
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 async function readConnectorsToPush(options) {
   if (!getAppContext().projectRoot) {
-    return readAllConnectors(resolve9(options.dir ?? "connectors"));
+    return readAllConnectors(resolve10(options.dir ?? "connectors"));
   }
   const { connectors } = await readProjectConfig();
   return connectors;
@@ -277995,7 +278890,7 @@ function getBuildCommand() {
 }
 
 // src/cli/commands/project/create.ts
-import { basename as basename6, resolve as resolve10 } from "node:path";
+import { basename as basename7, resolve as resolve11 } from "node:path";
 var import_kebabCase2 = __toESM(require_kebabCase(), 1);
 
 // src/cli/commands/project/scaffold-shared.ts
@@ -278160,8 +279055,8 @@ async function createInteractive(options, ctx) {
     name: () => {
       return options.name ? Promise.resolve(options.name) : Ze({
         message: "What is the name of your project?",
-        placeholder: basename6(process.cwd()),
-        initialValue: basename6(process.cwd()),
+        placeholder: basename7(process.cwd()),
+        initialValue: basename7(process.cwd()),
         validate: (value) => {
           if (!value || value.trim().length === 0) {
             return "Every project deserves a name";
@@ -278191,7 +279086,7 @@ async function createInteractive(options, ctx) {
   }, ctx);
 }
 async function createNonInteractive(options, ctx) {
-  ctx.log.info(`Creating a new project at ${resolve10(options.path)}`);
+  ctx.log.info(`Creating a new project at ${resolve11(options.path)}`);
   const template = await getTemplateById(options.template ?? DEFAULT_TEMPLATE_ID);
   return await executeCreate({
     template,
@@ -278215,7 +279110,7 @@ async function executeCreate({
 }, ctx) {
   const { log, runTask } = ctx;
   const name = rawName.trim();
-  const resolvedPath = resolve10(projectPath);
+  const resolvedPath = resolve11(projectPath);
   const organizationId = await resolveWorkspaceId(ctx, flagWorkspaceId, isInteractive);
   const { projectId } = await runTask("Setting up your project...", async () => {
     return await createProjectFiles({
@@ -278856,7 +279751,7 @@ function getLogsCommand() {
 }
 
 // src/cli/commands/project/scaffold.ts
-import { basename as basename7, resolve as resolve11 } from "node:path";
+import { basename as basename8, resolve as resolve12 } from "node:path";
 function resolveAppId(options) {
   const appId = options.appId;
   if (!appId) {
@@ -278872,8 +279767,8 @@ function resolveAppId(options) {
 async function scaffoldAction(ctx, name, options, command) {
   const { log, runTask } = ctx;
   const appId = resolveAppId(command.optsWithGlobals());
-  const resolvedPath = resolve11("./");
-  const projectName = (name ?? basename7(resolvedPath)).trim();
+  const resolvedPath = resolve12("./");
+  const projectName = (name ?? basename8(resolvedPath)).trim();
   const template = await getTemplateById("backend-only");
   log.info(`Scaffolding project at ${resolvedPath}`);
   const { projectId } = await runTask("Setting up your project...", async () => {
@@ -279190,6 +280085,21 @@ function getSandboxListDirectoryCommand() {
   return new Base44Command("ls", { supportsBranch: true }).description("List directory entries in an app's remote sandbox").argument("[path]", "Directory relative to the app root (default: app root)").option("--recursive", "List nested entries").option("--max-depth <n>", "Max depth when recursive (1-10, default 3)").option("--include-hidden", "Include dotfiles").action(listDirectoryAction);
 }
 
+// src/cli/commands/sandbox/preview.ts
+async function previewAction(ctx) {
+  const url = await ctx.runTask("Resolving preview URL (boots the sandbox if needed)", () => getPreviewUrl());
+  if (ctx.jsonMode)
+    return { stdout: `${JSON.stringify({ preview_url: url })}
+` };
+  ctx.log.message(url);
+  return { outroMessage: "Preview is live." };
+}
+function getSandboxPreviewCommand() {
+  const command = new Base44Command("preview");
+  command.description("Print the app's live preview URL").action(previewAction);
+  return command;
+}
+
 // src/cli/commands/sandbox/read-file.ts
 async function readFileAction({ runTask, branchId }, paths, options) {
   const { id: appId } = getAppContext();
@@ -279243,7 +280153,7 @@ Examples:
 
 // src/cli/commands/sandbox/index.ts
 function getSandboxCommand() {
-  return new Command2("sandbox").description("Develop an app remotely via its server-side sandbox").addCommand(getSandboxListDirectoryCommand()).addCommand(getSandboxReadFileCommand()).addCommand(getSandboxWriteFileCommand()).addCommand(getSandboxEditFileCommand()).addCommand(getSandboxGrepCommand()).addCommand(getSandboxRunCommandCommand()).addCommand(getSandboxCheckpointCommand());
+  return new Command2("sandbox").description("Develop an app remotely via its server-side sandbox").addCommand(getSandboxListDirectoryCommand()).addCommand(getSandboxReadFileCommand()).addCommand(getSandboxWriteFileCommand()).addCommand(getSandboxEditFileCommand()).addCommand(getSandboxGrepCommand()).addCommand(getSandboxRunCommandCommand()).addCommand(getSandboxCheckpointCommand()).addCommand(getSandboxPreviewCommand());
 }
 
 // src/cli/commands/secrets/delete.ts
@@ -279289,7 +280199,7 @@ function getSecretsListCommand() {
 }
 
 // src/cli/commands/secrets/set.ts
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 function parseEntries(entries) {
   const secrets = {};
   for (const entry of entries) {
@@ -279320,7 +280230,7 @@ async function setSecretsAction({ log, runTask }, entries, options) {
   validateInput(entries, options);
   let secrets;
   if (options.envFile) {
-    secrets = await parseEnvFile(resolve12(options.envFile));
+    secrets = await parseEnvFile(resolve13(options.envFile));
     if (Object.keys(secrets).length === 0) {
       throw new InvalidInputError("The env file contains no valid KEY=VALUE entries.");
     }
@@ -279349,7 +280259,7 @@ function getSecretsCommand() {
 }
 
 // src/cli/commands/site/deploy.ts
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 async function deployAction2(ctx, options) {
   const { isNonInteractive } = ctx;
   if (isNonInteractive && !options.yes) {
@@ -279427,7 +280337,7 @@ async function deployTarball({ runTask }, project) {
 }
 function siteOutputDir(project) {
   const outputDirectory = project.site?.outputDirectory;
-  return outputDirectory ? resolve13(project.root, outputDirectory) : null;
+  return outputDirectory ? resolve14(project.root, outputDirectory) : null;
 }
 function getSiteDeployCommand() {
   const command = new Base44Command("deploy").description("Deploy built site files to Base44 hosting").option("-y, --yes", "Skip confirmation prompt").option("--build", "Build the site before deploying (skips the prompt)").option("--no-build", "Deploy without building (skips the prompt)");
@@ -281929,7 +282839,7 @@ function createCustomIntegrationRoutes(remoteProxy, logger) {
 
 // src/cli/dev/dev-server/watcher.ts
 import { EventEmitter as EventEmitter6 } from "node:events";
-import { relative as relative9 } from "node:path";
+import { relative as relative10 } from "node:path";
 
 // ../../node_modules/chokidar/index.js
 import { EventEmitter as EventEmitter5 } from "node:events";
@@ -283614,7 +284524,7 @@ class WatchBase44 extends EventEmitter6 {
       ignoreInitial: true
     });
     watcher.on("all", import_debounce4.default(async (_event, path) => {
-      this.emit("change", name, relative9(targetPath, path));
+      this.emit("change", name, relative10(targetPath, path));
     }, WATCH_DEBOUNCE_MS));
     watcher.on("error", (err) => {
       this.logger.error(`Watch handler failed for ${targetPath}`, err);
@@ -284046,7 +284956,7 @@ async function runScript(options) {
   }
 }
 // src/cli/commands/exec.ts
-function readStdin2() {
+function readStdin3() {
   return new Promise((resolve, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
@@ -284090,7 +285000,7 @@ async function execAction({ app, isNonInteractive }, options) {
   if (!isNonInteractive) {
     throw noInputError;
   }
-  const code = await readStdin2();
+  const code = await readStdin3();
   if (!code.trim()) {
     throw noInputError;
   }
@@ -284124,7 +285034,7 @@ Examples:
 }
 
 // src/cli/commands/project/eject.ts
-import { resolve as resolve17 } from "node:path";
+import { resolve as resolve18 } from "node:path";
 var import_kebabCase3 = __toESM(require_kebabCase(), 1);
 async function eject(ctx, options, command) {
   const { log, runTask, isNonInteractive } = ctx;
@@ -284188,7 +285098,7 @@ async function eject(ctx, options, command) {
     Ne("Operation cancelled.");
     throw new CLIExitError(0);
   }
-  const resolvedPath = resolve17(selectedPath);
+  const resolvedPath = resolve18(selectedPath);
   await runTask("Downloading your project's code...", async (updateMessage) => {
     await createProjectFilesForExistingProject({
       projectId,
@@ -284270,7 +285180,7 @@ function createProgram(context) {
   program.addCommand(getSecretsCommand());
   program.addCommand(getSandboxCommand());
   program.addCommand(getBranchesCommand());
-  program.addCommand(getAppCommand());
+  program.addCommand(getBuilderCommand());
   program.addCommand(getCodeCommand());
   program.addCommand(getAuthCommand());
   program.addCommand(getSiteCommand());
@@ -288271,6 +289181,13 @@ function getFullCommandName(command) {
   }
   return parts.join(" ");
 }
+var SENSITIVE_OPTION = /secret|token|password|launch|instance|key$/i;
+function redactSensitiveOptions(options) {
+  return Object.fromEntries(Object.entries(options).map(([k, v]) => [
+    k,
+    SENSITIVE_OPTION.test(k) && v != null && v !== false ? "[redacted]" : v
+  ]));
+}
 function addCommandInfoToErrorReporter(program, errorReporter) {
   program.hook("preAction", (_, actionCommand) => {
     const fullCommandName = getFullCommandName(actionCommand);
@@ -288278,7 +289195,7 @@ function addCommandInfoToErrorReporter(program, errorReporter) {
       command: {
         name: fullCommandName,
         args: actionCommand.args,
-        options: actionCommand.opts()
+        options: redactSensitiveOptions(actionCommand.opts())
       }
     });
   });
@@ -288325,4 +289242,4 @@ export {
   runCLI
 };
 
-//# debugId=3E91D87E1D11D84464756E2164756E21
+//# debugId=F9AF4FAF927903AE64756E2164756E21