@braid-cloud/cli 0.1.10 → 0.1.12

package/dist/index.js

@@ -55,28 +55,28 @@ __export(config_exports, {
   setApiKeyAsync: () => setApiKeyAsync
 });
 import { existsSync } from "fs";
-import { mkdir, readFile, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join, parse } from "path";
-import process2 from "process";
-import { Data, Effect, pipe } from "effect";
+import { mkdir as mkdir2, readFile, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2, parse } from "path";
+import process3 from "process";
+import { Data as Data2, Effect as Effect3, pipe as pipe3 } from "effect";
 var CONFIG_DIR, CONFIG_FILE, PROJECT_CONFIG_FILENAME, USER_CONFIG_FILENAME, ConfigReadError, ConfigWriteError, findConfigFile, findProjectConfigFile, findUserConfigFile, loadProjectConfig, loadUserConfig, resolveUserConfigWritePath, resolveProjectConfigWritePath, saveUserConfig, saveProjectConfig, isValidServerUrl, resolveServerUrlFromConfig, applyConfigSource, applyEnvOverrides, createDefaultMergedConfig, loadMergedConfig, loadConfig, saveConfig, getApiKey, setApiKey, getServerUrl, clearApiKey, loadConfigAsync, loadProjectConfigAsync, loadUserConfigAsync, loadMergedConfigAsync, findProjectConfigFileAsync, findUserConfigFileAsync, saveConfigAsync, saveUserConfigAsync, saveProjectConfigAsync, getApiKeyAsync, setApiKeyAsync, getServerUrlAsync, clearApiKeyAsync;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
     init_esm_shims();
-    CONFIG_DIR = join(homedir(), ".config", "braid");
-    CONFIG_FILE = join(CONFIG_DIR, "config.json");
+    CONFIG_DIR = join2(homedir2(), ".config", "braid");
+    CONFIG_FILE = join2(CONFIG_DIR, "config.json");
     PROJECT_CONFIG_FILENAME = "braid.json";
     USER_CONFIG_FILENAME = "braid.user.json";
-    ConfigReadError = class extends Data.TaggedError("ConfigReadError") {
+    ConfigReadError = class extends Data2.TaggedError("ConfigReadError") {
     };
-    ConfigWriteError = class extends Data.TaggedError("ConfigWriteError") {
+    ConfigWriteError = class extends Data2.TaggedError("ConfigWriteError") {
     };
-    findConfigFile = (filename, startDir = process2.cwd()) => {
+    findConfigFile = (filename, startDir = process3.cwd()) => {
       let currentDir = startDir;
       while (true) {
-        const configPath = join(currentDir, filename);
+        const configPath = join2(currentDir, filename);
         if (existsSync(configPath)) {
           return configPath;
         }
@@ -87,9 +87,9 @@ var init_config = __esm({
         currentDir = parsed.dir;
       }
     };
-    findProjectConfigFile = (startDir = process2.cwd()) => findConfigFile(PROJECT_CONFIG_FILENAME, startDir);
-    findUserConfigFile = (startDir = process2.cwd()) => findConfigFile(USER_CONFIG_FILENAME, startDir);
-    loadProjectConfig = () => Effect.tryPromise({
+    findProjectConfigFile = (startDir = process3.cwd()) => findConfigFile(PROJECT_CONFIG_FILENAME, startDir);
+    findUserConfigFile = (startDir = process3.cwd()) => findConfigFile(USER_CONFIG_FILENAME, startDir);
+    loadProjectConfig = () => Effect3.tryPromise({
       try: async () => {
         const configPath = await findProjectConfigFile();
         if (!configPath) {
@@ -99,8 +99,8 @@ var init_config = __esm({
         return JSON.parse(content);
       },
       catch: () => void 0
-    }).pipe(Effect.orElseSucceed(() => void 0));
-    loadUserConfig = () => Effect.tryPromise({
+    }).pipe(Effect3.orElseSucceed(() => void 0));
+    loadUserConfig = () => Effect3.tryPromise({
       try: async () => {
         const configPath = await findUserConfigFile();
         if (!configPath) {
@@ -110,16 +110,16 @@ var init_config = __esm({
         return JSON.parse(content);
       },
       catch: () => void 0
-    }).pipe(Effect.orElseSucceed(() => void 0));
-    resolveUserConfigWritePath = (startDir = process2.cwd()) => findUserConfigFile(startDir) ?? join(startDir, USER_CONFIG_FILENAME);
-    resolveProjectConfigWritePath = (startDir = process2.cwd()) => findProjectConfigFile(startDir) ?? join(startDir, PROJECT_CONFIG_FILENAME);
-    saveUserConfig = (config, startDir = process2.cwd()) => {
+    }).pipe(Effect3.orElseSucceed(() => void 0));
+    resolveUserConfigWritePath = (startDir = process3.cwd()) => findUserConfigFile(startDir) ?? join2(startDir, USER_CONFIG_FILENAME);
+    resolveProjectConfigWritePath = (startDir = process3.cwd()) => findProjectConfigFile(startDir) ?? join2(startDir, PROJECT_CONFIG_FILENAME);
+    saveUserConfig = (config, startDir = process3.cwd()) => {
       const targetPath = resolveUserConfigWritePath(startDir);
-      return pipe(
-        Effect.tryPromise({
+      return pipe3(
+        Effect3.tryPromise({
           try: async () => {
-            await mkdir(dirname(targetPath), { recursive: true, mode: 448 });
-            await writeFile(targetPath, JSON.stringify(config, null, 2), {
+            await mkdir2(dirname2(targetPath), { recursive: true, mode: 448 });
+            await writeFile2(targetPath, JSON.stringify(config, null, 2), {
               encoding: "utf-8",
               mode: 384
             });
@@ -129,13 +129,13 @@ var init_config = __esm({
         })
       );
     };
-    saveProjectConfig = (config, startDir = process2.cwd()) => {
+    saveProjectConfig = (config, startDir = process3.cwd()) => {
       const targetPath = resolveProjectConfigWritePath(startDir);
-      return pipe(
-        Effect.tryPromise({
+      return pipe3(
+        Effect3.tryPromise({
           try: async () => {
-            await mkdir(dirname(targetPath), { recursive: true, mode: 448 });
-            await writeFile(targetPath, JSON.stringify(config, null, 2), {
+            await mkdir2(dirname2(targetPath), { recursive: true, mode: 448 });
+            await writeFile2(targetPath, JSON.stringify(config, null, 2), {
               encoding: "utf-8",
               mode: 384
             });
@@ -206,10 +206,10 @@ var init_config = __esm({
       }
     };
     applyEnvOverrides = (merged) => {
-      if (process2.env.BRAID_API_KEY) {
-        merged.token = process2.env.BRAID_API_KEY;
+      if (process3.env.BRAID_API_KEY) {
+        merged.token = process3.env.BRAID_API_KEY;
       }
-      const envServerUrl = process2.env.BRAID_SKILLS_SERVER_URL ?? process2.env.BRAID_SERVER_URL;
+      const envServerUrl = process3.env.BRAID_SKILLS_SERVER_URL ?? process3.env.BRAID_SERVER_URL;
       if (envServerUrl && isValidServerUrl(envServerUrl)) {
         merged.serverUrl = envServerUrl;
       }
@@ -219,15 +219,15 @@ var init_config = __esm({
       includeUserGlobal: true,
       includeOrgGlobal: true
     });
-    loadMergedConfig = () => pipe(
-      Effect.all({
+    loadMergedConfig = () => pipe3(
+      Effect3.all({
         projectConfig: loadProjectConfig(),
         userConfig: loadUserConfig(),
         globalConfig: loadConfig().pipe(
-          Effect.orElseSucceed(() => ({}))
+          Effect3.orElseSucceed(() => ({}))
         )
       }),
-      Effect.map(({ projectConfig, userConfig, globalConfig }) => {
+      Effect3.map(({ projectConfig, userConfig, globalConfig }) => {
         const merged = createDefaultMergedConfig();
         applyConfigSource(merged, projectConfig);
         applyConfigSource(merged, userConfig);
@@ -238,24 +238,24 @@ var init_config = __esm({
         return merged;
       })
     );
-    loadConfig = () => pipe(
-      Effect.tryPromise({
+    loadConfig = () => pipe3(
+      Effect3.tryPromise({
         try: () => readFile(CONFIG_FILE, "utf-8"),
         catch: (e) => new ConfigReadError({ path: CONFIG_FILE, cause: e })
       }),
-      Effect.flatMap(
-        (content) => Effect.try({
+      Effect3.flatMap(
+        (content) => Effect3.try({
           try: () => JSON.parse(content),
           catch: () => ({})
         })
       ),
-      Effect.orElseSucceed(() => ({}))
+      Effect3.orElseSucceed(() => ({}))
     );
-    saveConfig = (config) => pipe(
-      Effect.tryPromise({
+    saveConfig = (config) => pipe3(
+      Effect3.tryPromise({
         try: async () => {
-          await mkdir(dirname(CONFIG_FILE), { recursive: true, mode: 448 });
-          await writeFile(CONFIG_FILE, JSON.stringify(config, null, 2), {
+          await mkdir2(dirname2(CONFIG_FILE), { recursive: true, mode: 448 });
+          await writeFile2(CONFIG_FILE, JSON.stringify(config, null, 2), {
             encoding: "utf-8",
             mode: 384
           });
@@ -263,33 +263,33 @@ var init_config = __esm({
         catch: (e) => new ConfigWriteError({ path: CONFIG_FILE, cause: e })
       })
     );
-    getApiKey = () => pipe(
-      Effect.succeed(process2.env.BRAID_API_KEY),
-      Effect.flatMap(
-        (envKey) => envKey ? Effect.succeed(envKey) : pipe(
+    getApiKey = () => pipe3(
+      Effect3.succeed(process3.env.BRAID_API_KEY),
+      Effect3.flatMap(
+        (envKey) => envKey ? Effect3.succeed(envKey) : pipe3(
           loadUserConfig(),
-          Effect.flatMap(
-            (userConfig) => userConfig?.token ? Effect.succeed(userConfig.token) : pipe(
+          Effect3.flatMap(
+            (userConfig) => userConfig?.token ? Effect3.succeed(userConfig.token) : pipe3(
               loadConfig(),
-              Effect.map((config) => config.apiKey)
+              Effect3.map((config) => config.apiKey)
             )
           )
         )
       )
     );
-    setApiKey = (apiKey) => pipe(
+    setApiKey = (apiKey) => pipe3(
       loadConfig(),
-      Effect.flatMap((config) => saveConfig({ ...config, apiKey }))
+      Effect3.flatMap((config) => saveConfig({ ...config, apiKey }))
     );
-    getServerUrl = () => pipe(
-      Effect.succeed(process2.env.BRAID_SERVER_URL),
-      Effect.flatMap(
-        (envUrl) => envUrl ? Effect.succeed(envUrl) : pipe(
+    getServerUrl = () => pipe3(
+      Effect3.succeed(process3.env.BRAID_SERVER_URL),
+      Effect3.flatMap(
+        (envUrl) => envUrl ? Effect3.succeed(envUrl) : pipe3(
           loadUserConfig(),
-          Effect.flatMap(
-            (userConfig) => userConfig?.serverUrl ? Effect.succeed(userConfig.serverUrl) : pipe(
+          Effect3.flatMap(
+            (userConfig) => userConfig?.serverUrl ? Effect3.succeed(userConfig.serverUrl) : pipe3(
               loadConfig(),
-              Effect.map(
+              Effect3.map(
                 (config) => config.serverUrl ?? "https://braid.cloud"
               )
             )
@@ -297,55 +297,74 @@ var init_config = __esm({
         )
       )
     );
-    clearApiKey = () => pipe(
+    clearApiKey = () => pipe3(
       loadConfig(),
-      Effect.flatMap((config) => {
+      Effect3.flatMap((config) => {
         const { apiKey: _, ...rest } = config;
         return saveConfig(rest);
       })
     );
-    loadConfigAsync = () => Effect.runPromise(loadConfig());
-    loadProjectConfigAsync = () => Effect.runPromise(loadProjectConfig());
-    loadUserConfigAsync = () => Effect.runPromise(loadUserConfig());
-    loadMergedConfigAsync = () => Effect.runPromise(loadMergedConfig());
+    loadConfigAsync = () => Effect3.runPromise(loadConfig());
+    loadProjectConfigAsync = () => Effect3.runPromise(loadProjectConfig());
+    loadUserConfigAsync = () => Effect3.runPromise(loadUserConfig());
+    loadMergedConfigAsync = () => Effect3.runPromise(loadMergedConfig());
     findProjectConfigFileAsync = (startDir) => findProjectConfigFile(startDir);
     findUserConfigFileAsync = (startDir) => findUserConfigFile(startDir);
-    saveConfigAsync = (config) => Effect.runPromise(saveConfig(config));
-    saveUserConfigAsync = (config, startDir) => Effect.runPromise(saveUserConfig(config, startDir));
-    saveProjectConfigAsync = (config, startDir) => Effect.runPromise(saveProjectConfig(config, startDir));
-    getApiKeyAsync = () => Effect.runPromise(getApiKey());
-    setApiKeyAsync = (apiKey) => Effect.runPromise(setApiKey(apiKey));
-    getServerUrlAsync = () => Effect.runPromise(getServerUrl());
-    clearApiKeyAsync = () => Effect.runPromise(clearApiKey());
+    saveConfigAsync = (config) => Effect3.runPromise(saveConfig(config));
+    saveUserConfigAsync = (config, startDir) => Effect3.runPromise(saveUserConfig(config, startDir));
+    saveProjectConfigAsync = (config, startDir) => Effect3.runPromise(saveProjectConfig(config, startDir));
+    getApiKeyAsync = () => Effect3.runPromise(getApiKey());
+    setApiKeyAsync = (apiKey) => Effect3.runPromise(setApiKey(apiKey));
+    getServerUrlAsync = () => Effect3.runPromise(getServerUrl());
+    clearApiKeyAsync = () => Effect3.runPromise(clearApiKey());
   }
 });
 
 // src/lib/api.ts
-import { Data as Data2, Effect as Effect2, pipe as pipe2 } from "effect";
-var TRAILING_SLASH_REGEX, ApiError, AuthenticationError, NetworkError, resolveApiKey, resolveServerUrl, parseResponse, buildApiUrl, buildExportUrl, executeApiRequest, parseScopeOptionsResponse, fetchScopeOptions, buildRuleOptionsUrl, fetchRuleOptions, fetchSkills, runLifecycleCommand, DEFAULT_PUBLIC_SERVER_URL, NotFoundError, RateLimitedError, handlePublicApiResponse, fetchPublicMetadata, fetchPublicExport, fetchPublicMetadataAsync, fetchPublicExportAsync, validateApiKey, fetchSkillsAsync, validateApiKeyAsync, fetchScopeOptionsAsync, fetchRuleOptionsAsync, runLifecycleCommandAsync;
+import { Data as Data3, Effect as Effect4, pipe as pipe4 } from "effect";
+var TRAILING_SLASH_REGEX, ALLOW_UNTRUSTED_SERVER_ENV, isTruthy, isLocalHost, isTrustedApiServerUrl, ApiError, AuthenticationError, NetworkError, resolveApiKey, resolveServerUrl, parseResponse, buildApiUrl, buildExportUrl, executeApiRequest, parseScopeOptionsResponse, fetchScopeOptions, buildRuleOptionsUrl, fetchRuleOptions, fetchSkills, runLifecycleCommand, DEFAULT_PUBLIC_SERVER_URL, NotFoundError, RateLimitedError, handlePublicApiResponse, fetchPublicMetadata, fetchPublicExport, fetchPublicMetadataAsync, fetchPublicExportAsync, validateApiKey, fetchSkillsAsync, validateApiKeyAsync, fetchScopeOptionsAsync, fetchRuleOptionsAsync, runLifecycleCommandAsync;
 var init_api = __esm({
   "src/lib/api.ts"() {
     "use strict";
     init_esm_shims();
     init_config();
     TRAILING_SLASH_REGEX = /\/$/;
-    ApiError = class extends Data2.TaggedError("ApiError") {
+    ALLOW_UNTRUSTED_SERVER_ENV = "BRAID_ALLOW_UNTRUSTED_SERVER_URL";
+    isTruthy = (value) => value === "1" || value === "true" || value === "yes";
+    isLocalHost = (hostname2) => hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1";
+    isTrustedApiServerUrl = (serverUrl) => {
+      try {
+        const parsed = new URL(serverUrl);
+        const hostname2 = parsed.hostname;
+        const isBraidHost = hostname2 === "braid.cloud" || hostname2.endsWith(".braid.cloud");
+        if (parsed.protocol === "https:" && isBraidHost) {
+          return true;
+        }
+        if (parsed.protocol === "http:" && isLocalHost(hostname2)) {
+          return true;
+        }
+        return false;
+      } catch {
+        return false;
+      }
+    };
+    ApiError = class extends Data3.TaggedError("ApiError") {
     };
-    AuthenticationError = class extends Data2.TaggedError("AuthenticationError") {
+    AuthenticationError = class extends Data3.TaggedError("AuthenticationError") {
     };
-    NetworkError = class extends Data2.TaggedError("NetworkError") {
+    NetworkError = class extends Data3.TaggedError("NetworkError") {
     };
     resolveApiKey = (optionsApiKey) => {
       if (optionsApiKey) {
-        return Effect2.succeed(optionsApiKey);
+        return Effect4.succeed(optionsApiKey);
       }
-      return pipe2(
-        Effect2.tryPromise({
+      return pipe4(
+        Effect4.tryPromise({
           try: () => getApiKeyAsync(),
           catch: () => new NetworkError({ message: "Failed to read config" })
         }),
-        Effect2.flatMap(
-          (key) => key ? Effect2.succeed(key) : Effect2.fail(
+        Effect4.flatMap(
+          (key) => key ? Effect4.succeed(key) : Effect4.fail(
             new AuthenticationError({
               message: 'No API key configured. Run "braid auth" to authenticate.'
             })
@@ -355,24 +374,43 @@ var init_api = __esm({
     };
     resolveServerUrl = (optionsServerUrl) => {
       if (optionsServerUrl) {
-        return Effect2.succeed(optionsServerUrl);
+        if (!(isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(optionsServerUrl))) {
+          return Effect4.fail(
+            new NetworkError({
+              message: `Untrusted server URL '${optionsServerUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
+            })
+          );
+        }
+        return Effect4.succeed(optionsServerUrl);
       }
-      return Effect2.tryPromise({
-        try: () => getServerUrlAsync(),
-        catch: () => new NetworkError({ message: "Failed to read config" })
-      });
+      return pipe4(
+        Effect4.tryPromise({
+          try: () => getServerUrlAsync(),
+          catch: () => new NetworkError({ message: "Failed to read config" })
+        }),
+        Effect4.flatMap((serverUrl) => {
+          if (isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(serverUrl)) {
+            return Effect4.succeed(serverUrl);
+          }
+          return Effect4.fail(
+            new NetworkError({
+              message: `Untrusted server URL '${serverUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
+            })
+          );
+        })
+      );
     };
     parseResponse = (response, json) => {
       if (!response.ok) {
         const errorResponse = json;
         if (response.status === 401) {
-          return Effect2.fail(
+          return Effect4.fail(
             new AuthenticationError({
               message: errorResponse.error || "Invalid or expired API key. Run 'braid auth' to re-authenticate."
             })
           );
         }
-        return Effect2.fail(
+        return Effect4.fail(
           new ApiError({
             message: errorResponse.error || "API request failed",
             code: errorResponse.code || "UNKNOWN_ERROR",
@@ -380,7 +418,7 @@ var init_api = __esm({
           })
         );
       }
-      return Effect2.succeed(json);
+      return Effect4.succeed(json);
     };
     buildApiUrl = (serverUrl, path2) => {
       const baseUrl = serverUrl.replace(TRAILING_SLASH_REGEX, "");
@@ -420,8 +458,8 @@ var init_api = __esm({
       }
       return url;
     };
-    executeApiRequest = (url, apiKey, serverUrl) => pipe2(
-      Effect2.tryPromise({
+    executeApiRequest = (url, apiKey, serverUrl) => pipe4(
+      Effect4.tryPromise({
         try: () => fetch(url.toString(), {
           method: "GET",
           headers: {
@@ -434,13 +472,13 @@ var init_api = __esm({
           cause: e
         })
       }),
-      Effect2.flatMap(
-        (response) => pipe2(
-          Effect2.tryPromise({
+      Effect4.flatMap(
+        (response) => pipe4(
+          Effect4.tryPromise({
             try: () => response.json(),
             catch: () => new NetworkError({ message: "Failed to parse API response" })
           }),
-          Effect2.flatMap((json) => parseResponse(response, json))
+          Effect4.flatMap((json) => parseResponse(response, json))
         )
       )
     );
@@ -448,13 +486,13 @@ var init_api = __esm({
       if (!response.ok) {
         const errorResponse = json;
         if (response.status === 401) {
-          return Effect2.fail(
+          return Effect4.fail(
             new AuthenticationError({
               message: errorResponse.error || "Invalid or expired API key. Run 'braid auth' to re-authenticate."
             })
           );
         }
-        return Effect2.fail(
+        return Effect4.fail(
           new ApiError({
             message: errorResponse.error || "API request failed",
             code: errorResponse.code || "UNKNOWN_ERROR",
@@ -462,17 +500,17 @@ var init_api = __esm({
           })
         );
       }
-      return Effect2.succeed(json);
+      return Effect4.succeed(json);
     };
-    fetchScopeOptions = (options = {}) => pipe2(
-      Effect2.all({
+    fetchScopeOptions = (options = {}) => pipe4(
+      Effect4.all({
         apiKey: resolveApiKey(options.apiKey),
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
-      Effect2.flatMap(({ apiKey, serverUrl }) => {
+      Effect4.flatMap(({ apiKey, serverUrl }) => {
         const url = buildApiUrl(serverUrl, "/api/skills/scope-options");
-        return pipe2(
-          Effect2.tryPromise({
+        return pipe4(
+          Effect4.tryPromise({
             try: () => fetch(url.toString(), {
               method: "GET",
               headers: {
@@ -485,13 +523,13 @@ var init_api = __esm({
               cause: e
             })
           }),
-          Effect2.flatMap(
-            (response) => pipe2(
-              Effect2.tryPromise({
+          Effect4.flatMap(
+            (response) => pipe4(
+              Effect4.tryPromise({
                 try: () => response.json(),
                 catch: () => new NetworkError({ message: "Failed to parse API response" })
               }),
-              Effect2.flatMap((json) => parseScopeOptionsResponse(response, json))
+              Effect4.flatMap((json) => parseScopeOptionsResponse(response, json))
             )
           )
         );
@@ -522,14 +560,14 @@ var init_api = __esm({
       }
       return url;
     };
-    fetchRuleOptions = (options = {}) => pipe2(
-      Effect2.all({
+    fetchRuleOptions = (options = {}) => pipe4(
+      Effect4.all({
         apiKey: resolveApiKey(options.apiKey),
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
-      Effect2.flatMap(
-        ({ apiKey, serverUrl }) => pipe2(
-          Effect2.tryPromise({
+      Effect4.flatMap(
+        ({ apiKey, serverUrl }) => pipe4(
+          Effect4.tryPromise({
             try: () => fetch(buildRuleOptionsUrl(serverUrl, options).toString(), {
               method: "GET",
               headers: {
@@ -542,17 +580,17 @@ var init_api = __esm({
               cause: e
             })
           }),
-          Effect2.flatMap(
-            (response) => pipe2(
-              Effect2.tryPromise({
+          Effect4.flatMap(
+            (response) => pipe4(
+              Effect4.tryPromise({
                 try: () => response.json(),
                 catch: () => new NetworkError({ message: "Failed to parse API response" })
               }),
-              Effect2.flatMap((json) => {
+              Effect4.flatMap((json) => {
                 if (!response.ok) {
                   return parseResponse(response, json).pipe(
-                    Effect2.flatMap(
-                      () => Effect2.fail(
+                    Effect4.flatMap(
+                      () => Effect4.fail(
                         new ApiError({
                           message: "API request failed",
                           code: "UNKNOWN_ERROR",
@@ -562,30 +600,30 @@ var init_api = __esm({
                     )
                   );
                 }
-                return Effect2.succeed(json);
+                return Effect4.succeed(json);
               })
             )
           )
         )
       )
     );
-    fetchSkills = (options) => pipe2(
-      Effect2.all({
+    fetchSkills = (options) => pipe4(
+      Effect4.all({
         apiKey: resolveApiKey(options.apiKey),
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
-      Effect2.flatMap(({ apiKey, serverUrl }) => {
+      Effect4.flatMap(({ apiKey, serverUrl }) => {
         const url = buildExportUrl(serverUrl, options);
         return executeApiRequest(url, apiKey, serverUrl);
       })
     );
-    runLifecycleCommand = (request, options = {}) => pipe2(
-      Effect2.all({
+    runLifecycleCommand = (request, options = {}) => pipe4(
+      Effect4.all({
         apiKey: resolveApiKey(options.apiKey),
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
-      Effect2.flatMap(
-        ({ apiKey, serverUrl }) => Effect2.tryPromise({
+      Effect4.flatMap(
+        ({ apiKey, serverUrl }) => Effect4.tryPromise({
           try: async () => {
             const response = await fetch(
               buildApiUrl(serverUrl, "/api/lifecycle").toString(),
@@ -627,23 +665,23 @@ var init_api = __esm({
       )
     );
     DEFAULT_PUBLIC_SERVER_URL = "https://braid.cloud";
-    NotFoundError = class extends Data2.TaggedError("NotFoundError") {
+    NotFoundError = class extends Data3.TaggedError("NotFoundError") {
     };
-    RateLimitedError = class extends Data2.TaggedError("RateLimitedError") {
+    RateLimitedError = class extends Data3.TaggedError("RateLimitedError") {
     };
     handlePublicApiResponse = (response, json) => {
       if (response.ok) {
-        return Effect2.succeed(json);
+        return Effect4.succeed(json);
       }
       if (response.status === 404) {
-        return Effect2.fail(
+        return Effect4.fail(
           new NotFoundError({ message: "Public content not found" })
         );
       }
       if (response.status === 429) {
         const retryAfter = response.headers.get("Retry-After");
         const retryMs = retryAfter ? Number(retryAfter) * 1e3 : null;
-        return Effect2.fail(
+        return Effect4.fail(
           new RateLimitedError({
             message: "Rate limited. Please try again later.",
             ...retryMs !== null ? { retryAfterMs: retryMs } : {}
@@ -651,7 +689,7 @@ var init_api = __esm({
         );
       }
       const errorResponse = json;
-      return Effect2.fail(
+      return Effect4.fail(
         new ApiError({
           message: errorResponse.error || "API request failed",
           code: errorResponse.code || "UNKNOWN_ERROR",
@@ -665,21 +703,21 @@ var init_api = __esm({
         ""
       );
       const url = `${baseUrl}/api/public/@${handle}/${slug}`;
-      return pipe2(
-        Effect2.tryPromise({
+      return pipe4(
+        Effect4.tryPromise({
           try: () => fetch(url, { method: "GET" }),
           catch: (e) => new NetworkError({
             message: `Failed to connect to ${baseUrl}`,
             cause: e
           })
         }),
-        Effect2.flatMap(
-          (response) => pipe2(
-            Effect2.tryPromise({
+        Effect4.flatMap(
+          (response) => pipe4(
+            Effect4.tryPromise({
               try: () => response.json(),
               catch: () => new NetworkError({ message: "Failed to parse API response" })
             }),
-            Effect2.flatMap(
+            Effect4.flatMap(
               (json) => handlePublicApiResponse(response, json)
             )
           )
@@ -695,60 +733,73 @@ var init_api = __esm({
       if (ruleIds && ruleIds.length > 0) {
         url.searchParams.set("ruleIds", ruleIds.join(","));
       }
-      return pipe2(
-        Effect2.tryPromise({
+      return pipe4(
+        Effect4.tryPromise({
           try: () => fetch(url.toString(), { method: "GET" }),
           catch: (e) => new NetworkError({
             message: `Failed to connect to ${baseUrl}`,
             cause: e
           })
         }),
-        Effect2.flatMap(
-          (response) => pipe2(
-            Effect2.tryPromise({
+        Effect4.flatMap(
+          (response) => pipe4(
+            Effect4.tryPromise({
               try: () => response.json(),
               catch: () => new NetworkError({ message: "Failed to parse API response" })
             }),
-            Effect2.flatMap(
+            Effect4.flatMap(
               (json) => handlePublicApiResponse(response, json)
             )
           )
         )
       );
     };
-    fetchPublicMetadataAsync = (handle, slug, serverUrl) => Effect2.runPromise(fetchPublicMetadata(handle, slug, serverUrl));
-    fetchPublicExportAsync = (handle, slug, ruleIds, serverUrl) => Effect2.runPromise(fetchPublicExport(handle, slug, ruleIds, serverUrl));
-    validateApiKey = (apiKey, serverUrl) => pipe2(
-      Effect2.tryPromise({
-        try: async () => {
+    fetchPublicMetadataAsync = (handle, slug, serverUrl) => Effect4.runPromise(fetchPublicMetadata(handle, slug, serverUrl));
+    fetchPublicExportAsync = (handle, slug, ruleIds, serverUrl) => Effect4.runPromise(fetchPublicExport(handle, slug, ruleIds, serverUrl));
+    validateApiKey = (apiKey, serverUrl) => pipe4(
+      Effect4.try({
+        try: () => {
           const baseUrl = serverUrl ?? "https://braid.cloud";
-          const url = buildApiUrl(baseUrl, "/api/skills/export");
-          url.searchParams.set("profile", "default");
-          const response = await fetch(url.toString(), {
-            method: "GET",
-            headers: {
-              Authorization: `Bearer ${apiKey}`,
-              "Content-Type": "application/json"
-            }
-          });
-          return response.status !== 401;
+          if (!(isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(baseUrl))) {
+            throw new NetworkError({
+              message: `Untrusted server URL '${baseUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
+            });
+          }
+          return baseUrl;
         },
-        catch: (e) => new NetworkError({
-          message: `Failed to connect to ${serverUrl ?? "https://braid.cloud"}`,
-          cause: e
+        catch: (e) => e instanceof NetworkError ? e : new NetworkError({ message: "Invalid server URL" })
+      }),
+      Effect4.flatMap(
+        (baseUrl) => Effect4.tryPromise({
+          try: async () => {
+            const url = buildApiUrl(baseUrl, "/api/skills/export");
+            url.searchParams.set("profile", "default");
+            const response = await fetch(url.toString(), {
+              method: "GET",
+              headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json"
+              }
+            });
+            return response.status !== 401;
+          },
+          catch: (e) => new NetworkError({
+            message: `Failed to connect to ${baseUrl}`,
+            cause: e
+          })
         })
-      })
+      )
     );
-    fetchSkillsAsync = (options) => Effect2.runPromise(fetchSkills(options));
-    validateApiKeyAsync = (apiKey, serverUrl) => Effect2.runPromise(validateApiKey(apiKey, serverUrl));
-    fetchScopeOptionsAsync = (options = {}) => Effect2.runPromise(fetchScopeOptions(options));
-    fetchRuleOptionsAsync = (options = {}) => Effect2.runPromise(fetchRuleOptions(options));
-    runLifecycleCommandAsync = (request, options = {}) => Effect2.runPromise(runLifecycleCommand(request, options));
+    fetchSkillsAsync = (options) => Effect4.runPromise(fetchSkills(options));
+    validateApiKeyAsync = (apiKey, serverUrl) => Effect4.runPromise(validateApiKey(apiKey, serverUrl));
+    fetchScopeOptionsAsync = (options = {}) => Effect4.runPromise(fetchScopeOptions(options));
+    fetchRuleOptionsAsync = (options = {}) => Effect4.runPromise(fetchRuleOptions(options));
+    runLifecycleCommandAsync = (request, options = {}) => Effect4.runPromise(runLifecycleCommand(request, options));
   }
 });
 
 // src/lib/tui.ts
-import process3 from "process";
+import process4 from "process";
 import {
   cancel as clackCancel,
   confirm as clackConfirm,
@@ -773,19 +824,19 @@ function spinner() {
   return {
     start: (message) => {
       if (message) {
-        process3.stdout.write(`${message}
+        process4.stdout.write(`${message}
 `);
       }
     },
     stop: (message) => {
       if (message) {
-        process3.stdout.write(`${message}
+        process4.stdout.write(`${message}
 `);
       }
     },
     message: (message) => {
       if (message) {
-        process3.stdout.write(`${message}
+        process4.stdout.write(`${message}
 `);
       }
     }
@@ -795,7 +846,7 @@ function intro(message) {
   if (isTTY) {
     clackIntro(message);
   } else {
-    process3.stdout.write(`
+    process4.stdout.write(`
 ${message}
 `);
   }
@@ -804,7 +855,7 @@ function outro(message) {
   if (isTTY) {
     clackOutro(message);
   } else {
-    process3.stdout.write(`${message}
+    process4.stdout.write(`${message}
 
 `);
   }
@@ -814,7 +865,7 @@ var init_tui = __esm({
   "src/lib/tui.ts"() {
     "use strict";
     init_esm_shims();
-    isTTY = Boolean(process3.stdout.isTTY);
+    isTTY = Boolean(process4.stdout.isTTY);
     cancel = clackCancel;
     confirm = clackConfirm;
     isCancel = clackIsCancel;
@@ -925,10 +976,10 @@ var scope_exports = {};
 __export(scope_exports, {
   scopeCommand: () => scopeCommand
 });
-import process4 from "process";
+import process5 from "process";
 function exitCancelled(message) {
   cancel(message);
-  process4.exit(0);
+  process5.exit(0);
 }
 async function selectTargetFile(options) {
   if (options.file) {
@@ -1276,7 +1327,7 @@ async function scopeCommand(options) {
   } catch (error) {
     loadSpinner.stop("Failed to load scope options");
     log.error(error instanceof Error ? error.message : String(error));
-    process4.exit(1);
+    process5.exit(1);
   }
 }
 var init_scope = __esm({
@@ -1296,303 +1347,256 @@ init_esm_shims();
 import { createRequire } from "module";
 import { Command } from "commander";
 
-// src/commands/auth.ts
+// src/commands/agents.ts
 init_esm_shims();
-init_api();
-init_config();
-init_tui();
-import process5 from "process";
-async function configureDefaultScopeAsync(serverUrl) {
-  const shouldConfigureScope = await confirm({
-    message: "Configure organization and scope defaults now?",
-    initialValue: true
-  });
-  if (isCancel(shouldConfigureScope) || !shouldConfigureScope) {
-    return;
-  }
-  const { scopeCommand: scopeCommand2 } = await Promise.resolve().then(() => (init_scope(), scope_exports));
-  const config = await loadMergedConfigAsync();
-  await scopeCommand2({
-    file: "user",
-    server: serverUrl,
-    ...config.token ? { apiKey: config.token } : {}
-  });
-}
-async function authCommand(options) {
-  intro("braid auth");
-  const config = await loadMergedConfigAsync();
-  if (config.token) {
-    const shouldReplace = await confirm({
-      message: "An API key is already configured. Replace it?",
-      initialValue: false
-    });
-    if (isCancel(shouldReplace) || !shouldReplace) {
-      outro("Auth cancelled.");
-      return;
-    }
+
+// src/lib/agent-writer.ts
+init_esm_shims();
+import { mkdir, writeFile } from "fs/promises";
+import { dirname, resolve, sep } from "path";
+import { Data, Effect, pipe } from "effect";
+
+// src/lib/agent-adapters.ts
+init_esm_shims();
+var NATIVE_AGENT_IDS = /* @__PURE__ */ new Set(["claude-code", "opencode"]);
+var MAPPED_AGENT_IDS = /* @__PURE__ */ new Set([
+  "cursor",
+  "windsurf",
+  "cline",
+  "roo",
+  "codex"
+]);
+var resolveProfile = (agent) => {
+  if (NATIVE_AGENT_IDS.has(agent.id)) {
+    return {
+      tier: "native",
+      supportsGlobalInstall: Boolean(agent.agentsGlobalPath),
+      supportsProjectInstall: Boolean(agent.agentsProjectPath),
+      notes: "Native subagent/frontmatter format supported."
+    };
   }
-  const apiKey = options.token ? options.token : await password({
-    message: "Enter your braid API key:",
-    validate: (value) => {
-      if (!value) {
-        return "API key is required";
-      }
-      if (!value.startsWith("br_")) {
-        return "API key should start with 'br_'";
-      }
-      return void 0;
-    }
-  });
-  if (isCancel(apiKey)) {
-    cancel("Auth cancelled.");
-    process5.exit(0);
+  if (MAPPED_AGENT_IDS.has(agent.id)) {
+    return {
+      tier: "mapped",
+      supportsGlobalInstall: Boolean(agent.globalPath),
+      supportsProjectInstall: Boolean(agent.projectPath),
+      notes: "No native agent file format confirmed; install as compatibility artifacts."
+    };
   }
-  const authSpinner = spinner();
-  let authSpinnerActive = true;
-  const stopAuthSpinner = (message) => {
-    if (!authSpinnerActive) {
-      return;
-    }
-    authSpinner.stop(message);
-    authSpinnerActive = false;
+  return {
+    tier: "compat",
+    supportsGlobalInstall: Boolean(agent.globalPath),
+    supportsProjectInstall: Boolean(agent.projectPath),
+    notes: "Install compatibility output only, with capability warning surfaced to user."
   };
-  authSpinner.start("Validating API key...");
-  try {
-    const serverUrl = options.server ?? "https://braid.cloud";
-    const isValid = await validateApiKeyAsync(apiKey, serverUrl);
-    if (!isValid) {
-      stopAuthSpinner("Invalid API key");
-      log.error(
-        "The API key could not be validated. Please check your key and try again."
-      );
-      process5.exit(1);
-    }
-    await setApiKeyAsync(apiKey);
-    const existingUserConfig = await loadUserConfigAsync();
-    if (existingUserConfig?.token) {
-      await saveUserConfigAsync({ ...existingUserConfig, token: apiKey });
+};
+
+// src/lib/agent-writer.ts
+var AgentWriteError = class extends Data.TaggedError("AgentWriteError") {
+};
+var isObjectRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var slugify = (value) => value.toLowerCase().replace(/[^a-z0-9\s-]/g, "").replace(/\s+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+var escapeYaml = (value) => value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+var toYamlLines = (key, value, indent = 0) => {
+  const prefix = " ".repeat(indent);
+  const nestedPrefix = " ".repeat(indent + 2);
+  if (typeof value === "string") {
+    return [`${prefix}${key}: "${escapeYaml(value)}"`];
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return [`${prefix}${key}: ${value}`];
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      return [`${prefix}${key}: []`];
     }
-    stopAuthSpinner("API key validated and saved");
-    if (options.scope !== false) {
-      await configureDefaultScopeAsync(serverUrl);
+    return [
+      `${prefix}${key}:`,
+      ...value.map((item) => {
+        if (typeof item === "string" || typeof item === "number" || typeof item === "boolean") {
+          return `${nestedPrefix}- ${typeof item === "string" ? `"${escapeYaml(item)}"` : item}`;
+        }
+        if (isObjectRecord(item)) {
+          const nested = Object.entries(item).flatMap(
+            ([nestedKey, nestedValue]) => toYamlLines(nestedKey, nestedValue, indent + 4)
+          );
+          return `${nestedPrefix}-
+${nested.join("\n")}`;
+        }
+        return `${nestedPrefix}- null`;
+      })
+    ];
+  }
+  if (isObjectRecord(value)) {
+    const entries = Object.entries(value);
+    if (entries.length === 0) {
+      return [`${prefix}${key}: {}`];
     }
-    log.success(`Config saved to ${CONFIG_FILE}`);
-    outro(
-      "You're authenticated! Run 'braid install --profile <name>' to install skills."
-    );
-  } catch (error) {
-    stopAuthSpinner("Validation failed");
-    const message = error instanceof Error ? error.message : String(error);
-    log.error(`Failed to validate API key: ${message}`);
-    process5.exit(1);
+    return [
+      `${prefix}${key}:`,
+      ...entries.flatMap(
+        ([nestedKey, nestedValue]) => toYamlLines(nestedKey, nestedValue, indent + 2)
+      )
+    ];
   }
-}
-async function displayTokenSource(masked) {
-  if (process5.env.BRAID_API_KEY) {
-    log.info(`Authenticated with key: ${masked}`);
-    log.info("Source: BRAID_API_KEY environment variable");
-    return;
+  return [];
+};
+var buildClaudeMarkdown = (spec) => {
+  const lines = ["---"];
+  lines.push(...toYamlLines("name", spec.name));
+  lines.push(...toYamlLines("description", spec.description));
+  if (spec.model) {
+    lines.push(...toYamlLines("model", spec.model));
   }
-  const userConfigPath = await findUserConfigFileAsync();
-  log.info(`Authenticated with key: ${masked}`);
-  log.info(`Source: ${userConfigPath ?? CONFIG_FILE}`);
-}
-async function displayProjectConfig() {
-  const projectConfigPath = await findProjectConfigFileAsync();
-  if (projectConfigPath) {
-    log.info(`Project config: ${projectConfigPath}`);
+  if (spec.tools !== void 0) {
+    lines.push(...toYamlLines("tools", spec.tools));
   }
-}
-function displayResolvedSettings(config) {
-  const hasOrgProjects = config.orgProjects && config.orgProjects.length > 0;
-  const hasPersonalProjects = config.personalProjects && config.personalProjects.length > 0;
-  if (!(config.profile || hasOrgProjects || hasPersonalProjects)) {
-    return;
+  if (spec.permission !== void 0) {
+    lines.push(...toYamlLines("permissionMode", spec.permission));
   }
-  log.info("");
-  if (config.profile) {
-    log.info(`Default profile: ${config.profile}`);
+  if (spec.steps !== void 0) {
+    lines.push(...toYamlLines("maxTurns", spec.steps));
   }
-  if (hasOrgProjects) {
-    log.info(`Org projects: ${config.orgProjects?.join(", ")}`);
+  if (spec.temperature !== void 0) {
+    lines.push(...toYamlLines("temperature", spec.temperature));
   }
-  if (hasPersonalProjects) {
-    log.info(`Personal projects: ${config.personalProjects?.join(", ")}`);
+  if (spec.linkedSkillNames && spec.linkedSkillNames.length > 0) {
+    lines.push(...toYamlLines("skills", spec.linkedSkillNames));
   }
-  if (config.serverUrl !== "https://braid.cloud") {
-    log.info(`Server: ${config.serverUrl}`);
+  if (spec.additional) {
+    for (const [key, value] of Object.entries(spec.additional)) {
+      lines.push(...toYamlLines(key, value));
+    }
   }
-}
-async function authStatusCommand() {
-  const config = await loadMergedConfigAsync();
-  if (!config.token) {
-    log.warn("Not authenticated. Run 'braid auth' to configure your API key.");
-    log.info(
-      `Or create a ${USER_CONFIG_FILENAME} file with: { "token": "br_xxx" }`
-    );
-    return;
+  lines.push("---", "", spec.prompt.trim(), "");
+  return lines.join("\n");
+};
+var buildOpenCodeMarkdown = (spec) => {
+  const lines = ["---"];
+  lines.push(...toYamlLines("description", spec.description));
+  if (spec.mode) {
+    lines.push(...toYamlLines("mode", spec.mode));
   }
-  const masked = `${config.token.slice(0, 7)}...${config.token.slice(-4)}`;
-  await displayTokenSource(masked);
-  await displayProjectConfig();
-  displayResolvedSettings(config);
-}
-async function authLogoutCommand() {
-  const { clearApiKeyAsync: clearApiKeyAsync2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  await clearApiKeyAsync2();
-  log.success("Logged out. API key removed from config.");
-}
-
-// src/commands/discover.ts
-init_esm_shims();
-init_api();
-init_config();
-init_tui();
-import process6 from "process";
-var parseCsv = (input) => {
-  if (!input) {
-    return void 0;
+  if (spec.model) {
+    lines.push(...toYamlLines("model", spec.model));
   }
-  const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
-  return values.length > 0 ? values : void 0;
-};
-var writeJson = (value) => {
-  process6.stdout.write(`${JSON.stringify(value, null, 2)}
-`);
-};
-var exitWithError = (error) => {
-  const message = error instanceof Error ? error.message : String(error);
-  log.error(message);
-  process6.exit(1);
-};
-var applyCommonOptions = (base, options) => ({
-  ...base,
-  ...options.server ? { serverUrl: options.server } : {},
-  ...options.apiKey ? { apiKey: options.apiKey } : {}
-});
-var applyOptionalString = (target, key, value) => {
-  if (value) {
-    target[key] = value;
+  if (spec.tools !== void 0) {
+    lines.push(...toYamlLines("tools", spec.tools));
   }
-};
-var applyOptionalArray = (target, key, value) => {
-  if (value && value.length > 0) {
-    target[key] = value;
+  if (spec.permission !== void 0) {
+    lines.push(...toYamlLines("permission", spec.permission));
+  }
+  if (spec.steps !== void 0) {
+    lines.push(...toYamlLines("steps", spec.steps));
   }
+  if (spec.temperature !== void 0) {
+    lines.push(...toYamlLines("temperature", spec.temperature));
+  }
+  if (spec.topP !== void 0) {
+    lines.push(...toYamlLines("top_p", spec.topP));
+  }
+  if (spec.hidden !== void 0) {
+    lines.push(...toYamlLines("hidden", spec.hidden));
+  }
+  if (spec.color) {
+    lines.push(...toYamlLines("color", spec.color));
+  }
+  if (spec.additional) {
+    for (const [key, value] of Object.entries(spec.additional)) {
+      lines.push(...toYamlLines(key, value));
+    }
+  }
+  lines.push("---", "", spec.prompt.trim(), "");
+  return lines.join("\n");
 };
-var applyOptionalBoolean = (target, key, value) => {
-  if (value !== void 0) {
-    target[key] = value;
+var buildCompatMarkdown = (spec, source) => [
+  "# Compatibility Agent",
+  "",
+  `Source: ${source}`,
+  `Name: ${spec.name}`,
+  "",
+  spec.prompt.trim(),
+  ""
+].join("\n");
+var assertWithinBase = (basePath, filename) => {
+  const resolvedBase = resolve(basePath);
+  const resolvedPath = resolve(basePath, filename);
+  if (resolvedPath !== resolvedBase && !resolvedPath.startsWith(`${resolvedBase}${sep}`)) {
+    throw new Error(`Path traversal detected: ${filename}`);
   }
+  return resolvedPath;
 };
-async function projectsListCommand(options) {
-  try {
-    const result = await fetchScopeOptionsAsync(
-      applyCommonOptions({}, options)
-    );
-    if (options.json) {
-      writeJson(result);
-      return;
+var writeSingleAgent = (installPath, platform2, spec) => Effect.tryPromise({
+  try: async () => {
+    const profile = resolveProfile(platform2);
+    const fileStem = slugify(spec.name) || "agent";
+    const filename = `${fileStem}.md`;
+    const fullPath = assertWithinBase(installPath, filename);
+    await mkdir(dirname(fullPath), { recursive: true });
+    const warnings = [];
+    let content;
+    if (platform2.id === "claude-code") {
+      if (spec.mode === "primary") {
+        warnings.push(
+          "Claude adapter does not support primary mode; using subagent semantics."
+        );
+      }
+      content = buildClaudeMarkdown(spec);
+    } else if (platform2.id === "opencode") {
+      content = buildOpenCodeMarkdown(spec);
+    } else {
+      warnings.push(
+        `Platform ${platform2.id} uses ${profile.tier} adapter with compatibility output.`
+      );
+      content = buildCompatMarkdown(spec, platform2.name);
     }
-    log.info("Personal projects:");
-    if (result.personalProjects.length === 0) {
-      log.info("  (none)");
-    }
-    for (const project of result.personalProjects) {
-      log.info(`  ${project.id}  ${project.name}`);
-    }
-    for (const orgProjects of result.orgProjects) {
-      log.info(`
-Organization: ${orgProjects.orgName} (${orgProjects.orgId})`);
-      if (orgProjects.projects.length === 0) {
-        log.info("  (none)");
-        continue;
-      }
-      for (const project of orgProjects.projects) {
-        log.info(`  ${project.id}  ${project.name}`);
-      }
-    }
-  } catch (error) {
-    exitWithError(error);
-  }
-}
-var buildRulesRequest = async (options) => {
-  const config = await loadMergedConfigAsync();
-  const orgProjects = parseCsv(options.orgProjects) ?? config.orgProjects;
-  const personalProjects = parseCsv(options.personalProjects) ?? config.personalProjects;
-  const request = applyCommonOptions({}, options);
-  applyOptionalString(request, "orgId", options.orgId ?? config.org);
-  applyOptionalArray(request, "orgProjects", orgProjects);
-  applyOptionalArray(request, "personalProjects", personalProjects);
-  applyOptionalBoolean(request, "includeUserGlobal", options.includeUserGlobal);
-  applyOptionalBoolean(request, "includeOrgGlobal", options.includeOrgGlobal);
-  return request;
-};
-async function rulesListCommand(options) {
-  try {
-    const result = await fetchRuleOptionsAsync(
-      await buildRulesRequest(options)
-    );
-    if (options.json) {
-      writeJson(result);
-      return;
-    }
-    if (result.rules.length === 0) {
-      log.info("No rules found.");
-      return;
-    }
-    for (const rule of result.rules) {
-      log.info(`${rule.id}  ${rule.title}`);
-    }
-  } catch (error) {
-    exitWithError(error);
-  }
-}
-var buildSkillsRequest = async (options) => {
-  const config = await loadMergedConfigAsync();
-  const orgProjects = parseCsv(options.orgProjects) ?? config.orgProjects;
-  const personalProjects = parseCsv(options.personalProjects) ?? config.personalProjects;
-  const request = applyCommonOptions({}, options);
-  applyOptionalString(request, "profile", options.profile ?? config.profile);
-  applyOptionalArray(request, "orgProjects", orgProjects);
-  applyOptionalArray(request, "personalProjects", personalProjects);
-  applyOptionalBoolean(request, "includeUserGlobal", options.includeUserGlobal);
-  applyOptionalBoolean(request, "includeOrgGlobal", options.includeOrgGlobal);
-  return request;
-};
-async function skillsListCommand(options) {
-  try {
-    const result = await fetchSkillsAsync(await buildSkillsRequest(options));
-    if (options.json) {
-      writeJson(result);
-      return;
-    }
-    if (result.skills.length === 0) {
-      log.info("No skills found.");
-      return;
-    }
-    for (const skill of result.skills) {
-      log.info(`${skill.name}`);
-    }
-  } catch (error) {
-    exitWithError(error);
-  }
-}
-
-// src/commands/install.ts
-init_esm_shims();
+    await writeFile(fullPath, content, "utf-8");
+    return { written: fullPath, warnings };
+  },
+  catch: (cause) => new AgentWriteError({ path: installPath, operation: "write", cause })
+});
+var writeAgentsForPlatform = (platform2, specs, installPath) => pipe(
+  Effect.forEach(
+    specs,
+    (spec) => pipe(
+      writeSingleAgent(installPath, platform2, spec),
+      Effect.map((result) => ({
+        success: true,
+        written: result.written,
+        warnings: result.warnings
+      })),
+      Effect.catchAll(
+        (error) => Effect.succeed({
+          success: false,
+          error: error.cause instanceof Error ? error.cause.message : String(error.cause),
+          specName: spec.name
+        })
+      )
+    ),
+    { concurrency: "unbounded" }
+  ),
+  Effect.map((results) => {
+    const written = results.filter((r) => r.success).map((r) => r.written).sort();
+    const warnings = results.filter((r) => r.success).flatMap((r) => r.warnings);
+    const errors = results.filter(
+      (r) => !r.success
+    ).map((r) => ({ agent: r.specName, error: r.error }));
+    return { written, warnings, errors };
+  })
+);
+var writeAgentsForPlatformAsync = (platform2, specs, installPath) => Effect.runPromise(writeAgentsForPlatform(platform2, specs, installPath));
 
 // src/lib/agents.ts
 init_esm_shims();
 import { access, constants } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-import process7 from "process";
-import { Effect as Effect3, pipe as pipe3 } from "effect";
-var home = homedir2();
+import { homedir } from "os";
+import { join } from "path";
+import process2 from "process";
+import { Effect as Effect2, pipe as pipe2 } from "effect";
+var home = homedir();
 var vscodeExtSettingsPath = (extensionId, filename) => {
-  if (process7.platform === "darwin") {
-    return join2(
+  if (process2.platform === "darwin") {
+    return join(
       home,
       "Library",
       "Application Support",
@@ -1604,9 +1608,9 @@ var vscodeExtSettingsPath = (extensionId, filename) => {
       filename
     );
   }
-  if (process7.platform === "win32") {
-    const appData = process7.env.APPDATA ?? join2(home, "AppData", "Roaming");
-    return join2(
+  if (process2.platform === "win32") {
+    const appData = process2.env.APPDATA ?? join(home, "AppData", "Roaming");
+    return join(
       appData,
       "Code",
       "User",
@@ -1616,7 +1620,7 @@ var vscodeExtSettingsPath = (extensionId, filename) => {
       filename
     );
   }
-  return join2(
+  return join(
     home,
     ".config",
     "Code",
@@ -1628,8 +1632,8 @@ var vscodeExtSettingsPath = (extensionId, filename) => {
   );
 };
 var claudeDesktopConfigPath = () => {
-  if (process7.platform === "darwin") {
-    return join2(
+  if (process2.platform === "darwin") {
+    return join(
       home,
       "Library",
       "Application Support",
@@ -1637,46 +1641,48 @@ var claudeDesktopConfigPath = () => {
       "claude_desktop_config.json"
     );
   }
-  if (process7.platform === "win32") {
-    const appData = process7.env.APPDATA ?? join2(home, "AppData", "Roaming");
-    return join2(appData, "Claude", "claude_desktop_config.json");
+  if (process2.platform === "win32") {
+    const appData = process2.env.APPDATA ?? join(home, "AppData", "Roaming");
+    return join(appData, "Claude", "claude_desktop_config.json");
   }
-  return join2(home, ".config", "Claude", "claude_desktop_config.json");
+  return join(home, ".config", "Claude", "claude_desktop_config.json");
 };
 var AGENTS = [
   {
     id: "amp",
     name: "Amp",
     projectPath: ".agents/skills",
-    globalPath: join2(home, ".config", "agents", "skills"),
+    globalPath: join(home, ".config", "agents", "skills"),
     mcpProjectConfigPath: ".amp/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".amp", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".amp", "mcp.json")
   },
   {
     id: "kimi-cli",
     name: "Kimi Code CLI",
     projectPath: ".agents/skills",
-    globalPath: join2(home, ".config", "agents", "skills"),
+    globalPath: join(home, ".config", "agents", "skills"),
     mcpProjectConfigPath: ".agents/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".config", "agents", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".config", "agents", "mcp.json")
   },
   {
     id: "antigravity",
     name: "Antigravity",
     projectPath: ".agent/skills",
-    globalPath: join2(home, ".gemini", "antigravity", "global_skills"),
+    globalPath: join(home, ".gemini", "antigravity", "global_skills"),
     mcpProjectConfigPath: ".agent/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".gemini", "antigravity", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".gemini", "antigravity", "mcp.json")
   },
   {
     id: "claude-code",
     name: "Claude Code",
     projectPath: ".claude/skills",
-    globalPath: join2(home, ".claude", "skills"),
+    globalPath: join(home, ".claude", "skills"),
+    agentsProjectPath: ".claude/agents",
+    agentsGlobalPath: join(home, ".claude", "agents"),
     projectMarkerPath: ".claude",
-    globalMarkerPath: join2(home, ".claude"),
+    globalMarkerPath: join(home, ".claude"),
     rulesProjectPath: ".claude/rules",
-    rulesGlobalPath: join2(home, ".claude", "rules"),
+    rulesGlobalPath: join(home, ".claude", "rules"),
     ruleFormat: "markdown-dir",
     mcpProjectConfigPath: ".mcp.json",
     mcpEntryStyle: "typed-stdio"
@@ -1692,15 +1698,15 @@ var AGENTS = [
     id: "moltbot",
     name: "Moltbot",
     projectPath: "skills",
-    globalPath: join2(home, ".moltbot", "skills"),
+    globalPath: join(home, ".moltbot", "skills"),
     mcpProjectConfigPath: "mcp.json",
-    mcpGlobalConfigPath: join2(home, ".moltbot", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".moltbot", "mcp.json")
   },
   {
     id: "cline",
     name: "Cline",
     projectPath: ".cline/skills",
-    globalPath: join2(home, ".cline", "skills"),
+    globalPath: join(home, ".cline", "skills"),
     rulesProjectPath: ".clinerules",
     ruleFormat: "append-single",
     mcpGlobalConfigPath: vscodeExtSettingsPath(
@@ -1713,73 +1719,73 @@ var AGENTS = [
     id: "codebuddy",
     name: "CodeBuddy",
     projectPath: ".codebuddy/skills",
-    globalPath: join2(home, ".codebuddy", "skills"),
+    globalPath: join(home, ".codebuddy", "skills"),
     mcpProjectConfigPath: ".codebuddy/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".codebuddy", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".codebuddy", "mcp.json")
   },
   {
     id: "codex",
     name: "Codex",
     projectPath: ".codex/skills",
-    globalPath: join2(home, ".codex", "skills"),
+    globalPath: join(home, ".codex", "skills"),
     mcpProjectConfigPath: ".codex/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".codex", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".codex", "mcp.json")
   },
   {
     id: "command-code",
     name: "Command Code",
     projectPath: ".commandcode/skills",
-    globalPath: join2(home, ".commandcode", "skills"),
+    globalPath: join(home, ".commandcode", "skills"),
     mcpProjectConfigPath: ".commandcode/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".commandcode", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".commandcode", "mcp.json")
   },
   {
     id: "continue",
     name: "Continue",
     projectPath: ".continue/skills",
-    globalPath: join2(home, ".continue", "skills"),
+    globalPath: join(home, ".continue", "skills"),
     mcpProjectConfigPath: ".continue/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".continue", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".continue", "mcp.json")
   },
   {
     id: "crush",
     name: "Crush",
     projectPath: ".crush/skills",
-    globalPath: join2(home, ".config", "crush", "skills"),
+    globalPath: join(home, ".config", "crush", "skills"),
     mcpProjectConfigPath: ".crush/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".config", "crush", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".config", "crush", "mcp.json")
   },
   {
     id: "cursor",
     name: "Cursor",
     projectPath: ".cursor/skills",
-    globalPath: join2(home, ".cursor", "skills"),
+    globalPath: join(home, ".cursor", "skills"),
     rulesProjectPath: ".cursor/rules",
     ruleFormat: "mdc",
     mcpProjectConfigPath: ".cursor/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".cursor", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".cursor", "mcp.json")
   },
   {
     id: "droid",
     name: "Droid",
     projectPath: ".factory/skills",
-    globalPath: join2(home, ".factory", "skills"),
+    globalPath: join(home, ".factory", "skills"),
     mcpProjectConfigPath: ".factory/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".factory", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".factory", "mcp.json")
   },
   {
     id: "gemini-cli",
     name: "Gemini CLI",
     projectPath: ".gemini/skills",
-    globalPath: join2(home, ".gemini", "skills"),
+    globalPath: join(home, ".gemini", "skills"),
     mcpProjectConfigPath: ".gemini/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".gemini", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".gemini", "mcp.json")
   },
   {
     id: "github-copilot",
     name: "GitHub Copilot",
     projectPath: ".github/skills",
-    globalPath: join2(home, ".copilot", "skills"),
+    globalPath: join(home, ".copilot", "skills"),
     rulesProjectPath: ".github/copilot-instructions.md",
     ruleFormat: "append-single",
     mcpProjectConfigPath: ".vscode/mcp.json",
@@ -1790,22 +1796,22 @@ var AGENTS = [
     id: "goose",
     name: "Goose",
     projectPath: ".goose/skills",
-    globalPath: join2(home, ".config", "goose", "skills"),
-    mcpGlobalConfigPath: join2(home, ".config", "goose", "mcp.json")
+    globalPath: join(home, ".config", "goose", "skills"),
+    mcpGlobalConfigPath: join(home, ".config", "goose", "mcp.json")
   },
   {
     id: "junie",
     name: "Junie",
     projectPath: ".junie/skills",
-    globalPath: join2(home, ".junie", "skills"),
+    globalPath: join(home, ".junie", "skills"),
     mcpProjectConfigPath: ".junie/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".junie", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".junie", "mcp.json")
   },
   {
     id: "kilo",
     name: "Kilo Code",
     projectPath: ".kilocode/skills",
-    globalPath: join2(home, ".kilocode", "skills"),
+    globalPath: join(home, ".kilocode", "skills"),
     mcpGlobalConfigPath: vscodeExtSettingsPath(
       "kilocode.kilo-code",
       "mcp_settings.json"
@@ -1816,81 +1822,83 @@ var AGENTS = [
     id: "kiro-cli",
     name: "Kiro CLI",
     projectPath: ".kiro/skills",
-    globalPath: join2(home, ".kiro", "skills"),
+    globalPath: join(home, ".kiro", "skills"),
     mcpProjectConfigPath: ".kiro/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".kiro", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".kiro", "mcp.json")
   },
   {
     id: "kode",
     name: "Kode",
     projectPath: ".kode/skills",
-    globalPath: join2(home, ".kode", "skills"),
+    globalPath: join(home, ".kode", "skills"),
     mcpProjectConfigPath: ".kode/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".kode", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".kode", "mcp.json")
   },
   {
     id: "mcpjam",
     name: "MCPJam",
     projectPath: ".mcpjam/skills",
-    globalPath: join2(home, ".mcpjam", "skills"),
+    globalPath: join(home, ".mcpjam", "skills"),
     mcpProjectConfigPath: ".mcpjam/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".mcpjam", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".mcpjam", "mcp.json")
   },
   {
     id: "mux",
     name: "Mux",
     projectPath: ".mux/skills",
-    globalPath: join2(home, ".mux", "skills"),
+    globalPath: join(home, ".mux", "skills"),
     mcpProjectConfigPath: ".mux/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".mux", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".mux", "mcp.json")
   },
   {
     id: "opencode",
     name: "OpenCode",
     projectPath: ".opencode/skills",
-    globalPath: join2(home, ".config", "opencode", "skills"),
+    globalPath: join(home, ".config", "opencode", "skills"),
+    agentsProjectPath: ".opencode/agents",
+    agentsGlobalPath: join(home, ".config", "opencode", "agents"),
     mcpProjectConfigPath: ".opencode/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".config", "opencode", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".config", "opencode", "mcp.json")
   },
   {
     id: "openhands",
     name: "OpenHands",
     projectPath: ".openhands/skills",
-    globalPath: join2(home, ".openhands", "skills"),
+    globalPath: join(home, ".openhands", "skills"),
     mcpProjectConfigPath: ".openhands/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".openhands", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".openhands", "mcp.json")
   },
   {
     id: "pi",
     name: "Pi",
     projectPath: ".pi/skills",
-    globalPath: join2(home, ".pi", "agent", "skills"),
+    globalPath: join(home, ".pi", "agent", "skills"),
     mcpProjectConfigPath: ".pi/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".pi", "agent", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".pi", "agent", "mcp.json")
   },
   {
     id: "qoder",
     name: "Qoder",
     projectPath: ".qoder/skills",
-    globalPath: join2(home, ".qoder", "skills"),
+    globalPath: join(home, ".qoder", "skills"),
     mcpProjectConfigPath: ".qoder/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".qoder", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".qoder", "mcp.json")
   },
   {
     id: "qwen-code",
     name: "Qwen Code",
     projectPath: ".qwen/skills",
-    globalPath: join2(home, ".qwen", "skills"),
+    globalPath: join(home, ".qwen", "skills"),
     mcpProjectConfigPath: ".qwen/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".qwen", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".qwen", "mcp.json")
   },
   {
     id: "roo",
     name: "Roo Code",
     projectPath: ".roo/skills",
-    globalPath: join2(home, ".roo", "skills"),
+    globalPath: join(home, ".roo", "skills"),
     rulesProjectPath: ".roo/rules",
-    rulesGlobalPath: join2(home, ".roo", "rules"),
+    rulesGlobalPath: join(home, ".roo", "rules"),
     ruleFormat: "markdown-dir",
     mcpGlobalConfigPath: vscodeExtSettingsPath(
       "rooveterinaryinc.roo-cline",
@@ -1902,42 +1910,42 @@ var AGENTS = [
     id: "trae",
     name: "Trae",
     projectPath: ".trae/skills",
-    globalPath: join2(home, ".trae", "skills"),
+    globalPath: join(home, ".trae", "skills"),
     mcpProjectConfigPath: ".trae/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".trae", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".trae", "mcp.json")
   },
   {
     id: "windsurf",
     name: "Windsurf",
     projectPath: ".windsurf/skills",
-    globalPath: join2(home, ".codeium", "windsurf", "skills"),
+    globalPath: join(home, ".codeium", "windsurf", "skills"),
     rulesProjectPath: ".windsurfrules",
     ruleFormat: "append-single",
-    mcpGlobalConfigPath: join2(home, ".codeium", "windsurf", "mcp_config.json")
+    mcpGlobalConfigPath: join(home, ".codeium", "windsurf", "mcp_config.json")
   },
   {
     id: "zencoder",
     name: "Zencoder",
     projectPath: ".zencoder/skills",
-    globalPath: join2(home, ".zencoder", "skills"),
+    globalPath: join(home, ".zencoder", "skills"),
     mcpProjectConfigPath: ".zencoder/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".zencoder", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".zencoder", "mcp.json")
   },
   {
     id: "neovate",
     name: "Neovate",
     projectPath: ".neovate/skills",
-    globalPath: join2(home, ".neovate", "skills"),
+    globalPath: join(home, ".neovate", "skills"),
     mcpProjectConfigPath: ".neovate/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".neovate", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".neovate", "mcp.json")
   },
   {
     id: "pochi",
     name: "Pochi",
     projectPath: ".pochi/skills",
-    globalPath: join2(home, ".pochi", "skills"),
+    globalPath: join(home, ".pochi", "skills"),
     mcpProjectConfigPath: ".pochi/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".pochi", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".pochi", "mcp.json")
   },
   {
     id: "zed",
@@ -1945,38 +1953,38 @@ var AGENTS = [
     projectPath: "",
     globalPath: "",
     projectMarkerPath: ".zed",
-    globalMarkerPath: join2(home, ".config", "zed"),
+    globalMarkerPath: join(home, ".config", "zed"),
     rulesProjectPath: ".zed/rules",
-    rulesGlobalPath: join2(home, ".config", "zed", "rules"),
+    rulesGlobalPath: join(home, ".config", "zed", "rules"),
     ruleFormat: "markdown-dir",
-    mcpGlobalConfigPath: join2(home, ".config", "zed", "settings.json"),
+    mcpGlobalConfigPath: join(home, ".config", "zed", "settings.json"),
     mcpRootKey: "context_servers",
     mcpEntryStyle: "zed"
   }
 ];
-var directoryExists = (path2) => pipe3(
-  Effect3.tryPromise({
+var directoryExists = (path2) => pipe2(
+  Effect2.tryPromise({
     try: () => access(path2, constants.F_OK),
     catch: () => false
   }),
-  Effect3.map(() => true),
-  Effect3.orElseSucceed(() => false)
+  Effect2.map(() => true),
+  Effect2.orElseSucceed(() => false)
 );
 var detectAgents = (projectRoot) => {
-  const cwd = projectRoot ?? process7.cwd();
-  return pipe3(
-    Effect3.forEach(
+  const cwd = projectRoot ?? process2.cwd();
+  return pipe2(
+    Effect2.forEach(
       AGENTS,
-      (agent) => pipe3(
-        Effect3.all({
-          hasProjectConfig: agent.projectPath ? directoryExists(join2(cwd, agent.projectPath)) : Effect3.succeed(false),
-          hasGlobalConfig: agent.globalPath ? directoryExists(agent.globalPath) : Effect3.succeed(false),
-          hasProjectMarker: agent.projectMarkerPath ? directoryExists(join2(cwd, agent.projectMarkerPath)) : Effect3.succeed(false),
-          hasGlobalMarker: agent.globalMarkerPath ? directoryExists(agent.globalMarkerPath) : Effect3.succeed(false),
-          hasRulesProjectConfig: agent.rulesProjectPath ? directoryExists(join2(cwd, agent.rulesProjectPath)) : Effect3.succeed(false),
-          hasRulesGlobalConfig: agent.rulesGlobalPath ? directoryExists(agent.rulesGlobalPath) : Effect3.succeed(false)
+      (agent) => pipe2(
+        Effect2.all({
+          hasProjectConfig: agent.projectPath ? directoryExists(join(cwd, agent.projectPath)) : Effect2.succeed(false),
+          hasGlobalConfig: agent.globalPath ? directoryExists(agent.globalPath) : Effect2.succeed(false),
+          hasProjectMarker: agent.projectMarkerPath ? directoryExists(join(cwd, agent.projectMarkerPath)) : Effect2.succeed(false),
+          hasGlobalMarker: agent.globalMarkerPath ? directoryExists(agent.globalMarkerPath) : Effect2.succeed(false),
+          hasRulesProjectConfig: agent.rulesProjectPath ? directoryExists(join(cwd, agent.rulesProjectPath)) : Effect2.succeed(false),
+          hasRulesGlobalConfig: agent.rulesGlobalPath ? directoryExists(agent.rulesGlobalPath) : Effect2.succeed(false)
         }),
-        Effect3.map(
+        Effect2.map(
           ({
             hasProjectConfig,
             hasGlobalConfig,
@@ -1993,14 +2001,14 @@ var detectAgents = (projectRoot) => {
       ),
       { concurrency: "unbounded" }
     ),
-    Effect3.map(
-      (agents) => agents.filter((a) => a.hasProjectConfig || a.hasGlobalConfig)
+    Effect2.map(
+      (agents2) => agents2.filter((a) => a.hasProjectConfig || a.hasGlobalConfig)
     )
   );
 };
 var getAgentById = (id) => AGENTS.find((a) => a.id === id);
-var detectAgentsAsync = (projectRoot) => Effect3.runPromise(detectAgents(projectRoot));
-var directoryExistsAsync = (path2) => Effect3.runPromise(directoryExists(path2));
+var detectAgentsAsync = (projectRoot) => Effect2.runPromise(detectAgents(projectRoot));
+var directoryExistsAsync = (path2) => Effect2.runPromise(directoryExists(path2));
 var resolveInstallPath = (agent, options) => {
   if (options.global) {
     return agent.globalPath || void 0;
@@ -2008,8 +2016,18 @@ var resolveInstallPath = (agent, options) => {
   if (!agent.projectPath) {
     return void 0;
   }
-  const cwd = options.projectRoot ?? process7.cwd();
-  return join2(cwd, agent.projectPath);
+  const cwd = options.projectRoot ?? process2.cwd();
+  return join(cwd, agent.projectPath);
+};
+var resolveAgentsInstallPath = (agent, options) => {
+  if (options.global) {
+    return agent.agentsGlobalPath;
+  }
+  if (!agent.agentsProjectPath) {
+    return void 0;
+  }
+  const cwd = options.projectRoot ?? process2.cwd();
+  return join(cwd, agent.agentsProjectPath);
 };
 var resolveRulesInstallPath = (agent, options) => {
   if (options.global) {
@@ -2018,85 +2036,920 @@ var resolveRulesInstallPath = (agent, options) => {
   if (!agent.rulesProjectPath) {
     return void 0;
   }
-  const cwd = options.projectRoot ?? process7.cwd();
-  return join2(cwd, agent.rulesProjectPath);
+  const cwd = options.projectRoot ?? process2.cwd();
+  return join(cwd, agent.rulesProjectPath);
 };
 var hasMcpConfig = (agent) => Boolean(agent.mcpProjectConfigPath) || Boolean(agent.mcpGlobalConfigPath);
+var MCP_PACKAGE_SPEC = "@braid-cloud/mcp@0.1.11";
 var resolveMcpConfigPath = (agent, options) => {
   if (options.global) {
     return agent.mcpGlobalConfigPath;
   }
   if (agent.mcpProjectConfigPath) {
-    const cwd = options.projectRoot ?? process7.cwd();
-    return join2(cwd, agent.mcpProjectConfigPath);
+    const cwd = options.projectRoot ?? process2.cwd();
+    return join(cwd, agent.mcpProjectConfigPath);
+  }
+  return agent.mcpGlobalConfigPath;
+};
+var buildMcpEntry = (style, env) => {
+  const command = "npx";
+  const args = ["-y", MCP_PACKAGE_SPEC];
+  const envObj = Object.keys(env).length > 0 ? env : void 0;
+  switch (style) {
+    case "standard":
+      return envObj ? { command, args, env: envObj } : { command, args };
+    case "typed-stdio":
+      return envObj ? { type: "stdio", command, args, env: envObj } : { type: "stdio", command, args };
+    case "zed":
+      return envObj ? { command: { path: command, args, env: envObj } } : { command: { path: command, args } };
+    case "cline":
+      return envObj ? { command, args, env: envObj, disabled: false } : { command, args, disabled: false };
+    default:
+      return envObj ? { command, args, env: envObj } : { command, args };
+  }
+};
+var detectMcpAgents = (projectRoot) => Effect2.runPromise(
+  pipe2(
+    detectAgents(projectRoot),
+    Effect2.map((detected) => detected.filter(hasMcpConfig))
+  )
+);
+
+// src/commands/agents.ts
+init_api();
+init_tui();
+var parseCsv = (input) => {
+  if (!input) {
+    return void 0;
+  }
+  const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  return values.length > 0 ? values : void 0;
+};
+var writeJson = (value) => {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var fail = (message) => {
+  throw new Error(message);
+};
+var exitWithError = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process.exit(1);
+};
+var run = (command, args, options) => {
+  const apiOptions = {
+    ...options.server ? { serverUrl: options.server } : {},
+    ...options.apiKey ? { apiKey: options.apiKey } : {}
+  };
+  return runLifecycleCommandAsync(
+    {
+      domain: "agents",
+      command,
+      args
+    },
+    apiOptions
+  );
+};
+var getAgentCandidate = (value) => {
+  if (typeof value === "object" && value !== null && "agent" in value) {
+    return value.agent;
+  }
+  return value;
+};
+var getMode = (mode) => {
+  if (mode === "primary" || mode === "subagent" || mode === "all") {
+    return mode;
+  }
+  return void 0;
+};
+var getRawSkills = (agent) => {
+  if (Array.isArray(agent.skillNames)) {
+    return agent.skillNames;
+  }
+  if (Array.isArray(agent.skills)) {
+    return agent.skills;
+  }
+  return void 0;
+};
+var normalizeSpec = (value) => {
+  const candidate = getAgentCandidate(value);
+  if (typeof candidate !== "object" || candidate === null) {
+    throw new Error("Invalid agent payload from API");
+  }
+  const agent = candidate;
+  const name = typeof agent.name === "string" ? agent.name : void 0;
+  const description = typeof agent.description === "string" ? agent.description : void 0;
+  const promptFromPrompt = typeof agent.prompt === "string" ? agent.prompt : void 0;
+  const promptFromContent = typeof agent.content === "string" ? agent.content : void 0;
+  const prompt = promptFromPrompt ?? promptFromContent;
+  if (!(name && description && prompt)) {
+    throw new Error(
+      "Agent payload missing required fields: name, description, prompt"
+    );
+  }
+  const result = {
+    name,
+    description,
+    prompt
+  };
+  const mode = getMode(agent.mode);
+  if (mode) {
+    result.mode = mode;
+  }
+  if (typeof agent.model === "string") {
+    result.model = agent.model;
+  }
+  const rawSkills = getRawSkills(agent);
+  if (rawSkills) {
+    result.linkedSkillNames = rawSkills.filter(
+      (item) => typeof item === "string"
+    );
+  }
+  return result;
+};
+var resolveInstallTargets = async (options) => {
+  if (options.agents) {
+    const ids = parseCsv(options.agents) ?? [];
+    const selected = ids.map((id) => getAgentById(id)).filter(
+      (agent) => agent !== void 0
+    );
+    if (selected.length === 0) {
+      fail("No valid target agents selected");
+    }
+    return selected;
+  }
+  const detected = await detectAgentsAsync();
+  const filtered = detected.filter(
+    (agent) => options.global ? agent.hasGlobalConfig : agent.hasProjectConfig
+  );
+  if (filtered.length === 0) {
+    fail(
+      "No supported local agent installations detected. Use --agents to select targets."
+    );
+  }
+  return filtered;
+};
+async function agentsListCommand(options) {
+  try {
+    const result = await run("list", {}, options);
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents list completed");
+    writeJson(result);
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsGetCommand(options) {
+  try {
+    const id = options.id ?? fail("agents get requires --id");
+    const result = await run("get", { id }, options);
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents get completed");
+    writeJson(result);
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsCreateCommand(options) {
+  try {
+    const name = options.name ?? fail("agents create requires --name");
+    const description = options.description ?? fail("agents create requires --description");
+    const prompt = options.prompt ?? fail("agents create requires --prompt");
+    const result = await run(
+      "create",
+      {
+        name,
+        description,
+        prompt,
+        scope: options.scope,
+        projectId: options.projectId,
+        model: options.model,
+        mode: options.mode,
+        skills: parseCsv(options.skills)
+      },
+      options
+    );
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents create completed");
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsUpdateCommand(options) {
+  try {
+    const id = options.id ?? fail("agents update requires --id");
+    const result = await run(
+      "update",
+      {
+        id,
+        name: options.name,
+        description: options.description,
+        prompt: options.prompt,
+        model: options.model,
+        mode: options.mode,
+        skills: parseCsv(options.skills)
+      },
+      options
+    );
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents update completed");
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsRemoveCommand(options) {
+  try {
+    const id = options.id ?? fail("agents remove requires --id");
+    if (!options.yes) {
+      fail("agents remove requires --yes");
+    }
+    const result = await run("remove", { id, yes: true }, options);
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents remove completed");
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsInstallCommand(options) {
+  try {
+    const id = options.id ?? fail("agents install requires --id");
+    const payload = await run("get", { id }, options);
+    const spec = normalizeSpec(payload);
+    const targets = await resolveInstallTargets(options);
+    const summary = [];
+    for (const target of targets) {
+      const installPath = resolveAgentsInstallPath(target, { global: options.global === true }) ?? resolveInstallPath(target, { global: options.global === true });
+      if (!installPath) {
+        summary.push({
+          platform: target.id,
+          written: 0,
+          warnings: ["No install path available for this platform"],
+          errors: []
+        });
+        continue;
+      }
+      const result = await writeAgentsForPlatformAsync(
+        target,
+        [spec],
+        installPath
+      );
+      summary.push({
+        platform: target.id,
+        installPath,
+        written: result.written.length,
+        warnings: result.warnings,
+        errors: result.errors
+      });
+    }
+    if (options.json) {
+      writeJson(summary);
+      return;
+    }
+    for (const item of summary) {
+      log.info(
+        `${item.platform}: ${item.written} file(s) written${item.installPath ? ` to ${item.installPath}` : ""}`
+      );
+      for (const warning of item.warnings) {
+        log.warn(`  warning: ${warning}`);
+      }
+      for (const error of item.errors) {
+        log.error(`  error (${error.agent}): ${error.error}`);
+      }
+    }
+    log.success("agents install completed");
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+
+// src/commands/auth.ts
+init_esm_shims();
+init_api();
+init_config();
+import process6 from "process";
+
+// src/lib/device-auth.ts
+init_esm_shims();
+import { execFile } from "child_process";
+import { hostname, platform } from "os";
+var TRAILING_SLASHES = /\/+$/;
+var DeviceAuthTimeoutError = class extends Error {
+  constructor() {
+    super("Device authorization timed out");
+    this.name = "DeviceAuthTimeoutError";
+  }
+};
+var DeviceAuthDeniedError = class extends Error {
+  constructor() {
+    super("Device authorization was denied");
+    this.name = "DeviceAuthDeniedError";
+  }
+};
+var DeviceAuthExpiredError = class extends Error {
+  constructor() {
+    super("Device authorization code has expired");
+    this.name = "DeviceAuthExpiredError";
+  }
+};
+var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+async function fetchAuthConfig(serverUrl) {
+  const url = `${serverUrl.replace(TRAILING_SLASHES, "")}/api/cli/auth-config`;
+  const response = await fetch(url);
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `Failed to fetch auth config (${response.status}): ${body}`
+    );
+  }
+  return response.json();
+}
+async function initiateDeviceAuth(convexSiteUrl, deviceInfo) {
+  const url = `${convexSiteUrl.replace(TRAILING_SLASHES, "")}/api/cli/device/authorize`;
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(deviceInfo)
+  });
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `Failed to initiate device authorization (${response.status}): ${body}`
+    );
+  }
+  return response.json();
+}
+async function pollForSession(convexSiteUrl, deviceCode, interval, expiresIn, timeoutSeconds) {
+  const tokenUrl = `${convexSiteUrl.replace(TRAILING_SLASHES, "")}/api/cli/device/token`;
+  const deadline = Date.now() + Math.min(expiresIn, timeoutSeconds) * 1e3;
+  let currentInterval = interval;
+  while (Date.now() < deadline) {
+    await sleep(currentInterval * 1e3);
+    const response = await fetch(tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    if (response.ok) {
+      const result = await response.json();
+      return {
+        sessionToken: result.session_token,
+        expiresAt: result.expires_at,
+        user: result.user
+      };
+    }
+    let errorCode;
+    try {
+      const errorBody = await response.json();
+      errorCode = errorBody.error;
+    } catch {
+      throw new Error(`Device auth polling error: HTTP ${response.status}`);
+    }
+    if (errorCode === "authorization_pending") {
+      continue;
+    }
+    if (errorCode === "slow_down") {
+      currentInterval += 5;
+      continue;
+    }
+    if (errorCode === "expired_token") {
+      throw new DeviceAuthExpiredError();
+    }
+    if (errorCode === "access_denied") {
+      throw new DeviceAuthDeniedError();
+    }
+    throw new Error(
+      `Device auth polling error: ${errorCode ?? `HTTP ${response.status}`}`
+    );
+  }
+  throw new DeviceAuthTimeoutError();
+}
+async function fetchSessionInfo(convexSiteUrl, sessionToken) {
+  const url = `${convexSiteUrl.replace(TRAILING_SLASHES, "")}/api/cli/sessions/me`;
+  const response = await fetch(url, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${sessionToken}`
+    }
+  });
+  if (response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `Failed to fetch session info (${response.status}): ${body}`
+    );
+  }
+  return response.json();
+}
+async function revokeSession(convexSiteUrl, sessionToken) {
+  const url = `${convexSiteUrl.replace(TRAILING_SLASHES, "")}/api/cli/sessions/me`;
+  const response = await fetch(url, {
+    method: "DELETE",
+    headers: {
+      Authorization: `Bearer ${sessionToken}`
+    }
+  });
+  if (response.status === 404) {
+    return false;
+  }
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(`Failed to revoke session (${response.status}): ${body}`);
+  }
+  return true;
+}
+var noop = () => {
+};
+function openBrowser(url) {
+  const currentPlatform = platform();
+  if (currentPlatform === "darwin") {
+    execFile("open", [url], noop);
+  } else if (currentPlatform === "win32") {
+    execFile("cmd", ["/c", "start", "", url], noop);
+  } else {
+    execFile("xdg-open", [url], noop);
+  }
+}
+function getDeviceInfo() {
+  return {
+    deviceName: hostname(),
+    deviceOs: platform(),
+    deviceHostname: hostname()
+  };
+}
+
+// src/commands/auth.ts
+init_tui();
+var SESSION_TOKEN_PREFIX = "brs_";
+var TRAILING_SLASHES2 = /\/+$/;
+var DEFAULT_TIMEOUT_SECONDS = 300;
+async function configureDefaultScopeAsync(serverUrl) {
+  const shouldConfigureScope = await confirm({
+    message: "Configure organization and scope defaults now?",
+    initialValue: true
+  });
+  if (isCancel(shouldConfigureScope) || !shouldConfigureScope) {
+    return;
+  }
+  const { scopeCommand: scopeCommand2 } = await Promise.resolve().then(() => (init_scope(), scope_exports));
+  const config = await loadMergedConfigAsync();
+  await scopeCommand2({
+    file: "user",
+    server: serverUrl,
+    ...config.token ? { apiKey: config.token } : {}
+  });
+}
+async function manualTokenFlow(apiKey, serverUrl, options) {
+  const authSpinner = spinner();
+  let authSpinnerActive = true;
+  const stopAuthSpinner = (message) => {
+    if (!authSpinnerActive) {
+      return;
+    }
+    authSpinner.stop(message);
+    authSpinnerActive = false;
+  };
+  authSpinner.start("Validating API key...");
+  try {
+    const isValid = await validateApiKeyAsync(apiKey, serverUrl);
+    if (!isValid) {
+      stopAuthSpinner("Invalid API key");
+      log.error(
+        "The API key could not be validated. Please check your key and try again."
+      );
+      process6.exit(1);
+    }
+    await setApiKeyAsync(apiKey);
+    const existingUserConfig = await loadUserConfigAsync();
+    if (existingUserConfig?.token) {
+      await saveUserConfigAsync({ ...existingUserConfig, token: apiKey });
+    }
+    stopAuthSpinner("API key validated and saved");
+    if (options.scope !== false) {
+      await configureDefaultScopeAsync(serverUrl);
+    }
+    log.success(`Config saved to ${CONFIG_FILE}`);
+    outro(
+      "You're authenticated! Run 'braid install' to use your saved scope (or pass '--profile <name>' to override)."
+    );
+  } catch (error) {
+    stopAuthSpinner("Validation failed");
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Failed to validate API key: ${message}`);
+    process6.exit(1);
+  }
+}
+function handlePollingError(error) {
+  if (error instanceof DeviceAuthTimeoutError) {
+    log.error("The device authorization timed out. Please try again.");
+  } else if (error instanceof DeviceAuthExpiredError) {
+    log.error("The device code has expired. Please try again.");
+  } else if (error instanceof DeviceAuthDeniedError) {
+    log.error("The authorization request was denied.");
+  } else {
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Authentication failed: ${message}`);
+  }
+  process6.exit(1);
+}
+async function deviceFlow(serverUrl, timeoutSeconds, options) {
+  const configSpinner = spinner();
+  configSpinner.start("Fetching auth configuration...");
+  let authConfig;
+  try {
+    authConfig = await fetchAuthConfig(serverUrl);
+    configSpinner.stop("Auth configuration loaded");
+  } catch (error) {
+    configSpinner.stop("Failed to fetch auth configuration");
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Could not connect to server: ${message}`);
+    process6.exit(1);
+  }
+  const deviceSpinner = spinner();
+  deviceSpinner.start("Initiating device authorization...");
+  let deviceAuth;
+  try {
+    deviceAuth = await initiateDeviceAuth(
+      authConfig.convexSiteUrl,
+      getDeviceInfo()
+    );
+    deviceSpinner.stop("Device authorization initiated");
+  } catch (error) {
+    deviceSpinner.stop("Failed to initiate device authorization");
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Device authorization failed: ${message}`);
+    process6.exit(1);
+  }
+  const verificationUrl = `${serverUrl.replace(TRAILING_SLASHES2, "")}/cli/authorize?user_code=${deviceAuth.user_code}`;
+  log.info("");
+  log.info("  To authenticate, visit:");
+  log.info(`  ${verificationUrl}`);
+  log.info("");
+  log.info(`  Your code: ${deviceAuth.user_code}`);
+  log.info("");
+  openBrowser(verificationUrl);
+  const expiresMinutes = Math.ceil(
+    Math.min(deviceAuth.expires_in, timeoutSeconds) / 60
+  );
+  const pollSpinner = spinner();
+  pollSpinner.start(
+    `Waiting for authentication... (expires in ${expiresMinutes} minutes)`
+  );
+  let session;
+  try {
+    session = await pollForSession(
+      authConfig.convexSiteUrl,
+      deviceAuth.device_code,
+      deviceAuth.interval,
+      deviceAuth.expires_in,
+      timeoutSeconds
+    );
+    pollSpinner.stop(`Authenticated as ${session.user.email}`);
+  } catch (error) {
+    pollSpinner.stop("Authentication failed");
+    handlePollingError(error);
+  }
+  await setApiKeyAsync(session.sessionToken);
+  if (options.scope !== false) {
+    await configureDefaultScopeAsync(authConfig.convexSiteUrl);
+  }
+  log.success(`Session saved to ${CONFIG_FILE}`);
+  outro(
+    "You're authenticated! Run 'braid install' to use your saved scope (or pass '--profile <name>' to override)."
+  );
+}
+async function authCommand(options) {
+  intro("braid auth");
+  const serverUrl = options.server ?? "https://braid.cloud";
+  const config = await loadMergedConfigAsync();
+  if (config.token) {
+    const shouldReplace = await confirm({
+      message: "An API key is already configured. Replace it?",
+      initialValue: false
+    });
+    if (isCancel(shouldReplace) || !shouldReplace) {
+      outro("Auth cancelled.");
+      return;
+    }
+  }
+  if (options.token) {
+    await manualTokenFlow(options.token, serverUrl, options);
+    return;
+  }
+  const timeoutSeconds = options.timeout ? Number.parseInt(options.timeout, 10) : DEFAULT_TIMEOUT_SECONDS;
+  if (Number.isNaN(timeoutSeconds) || timeoutSeconds <= 0) {
+    log.error("Invalid timeout value. Must be a positive number of seconds.");
+    process6.exit(1);
+  }
+  await deviceFlow(serverUrl, timeoutSeconds, options);
+}
+async function displayTokenSource(masked) {
+  if (process6.env.BRAID_API_KEY) {
+    log.info(`Authenticated with key: ${masked}`);
+    log.info("Source: BRAID_API_KEY environment variable");
+    return;
+  }
+  const userConfigPath = await findUserConfigFileAsync();
+  log.info(`Authenticated with key: ${masked}`);
+  log.info(`Source: ${userConfigPath ?? CONFIG_FILE}`);
+}
+async function displayProjectConfig() {
+  const projectConfigPath = await findProjectConfigFileAsync();
+  if (projectConfigPath) {
+    log.info(`Project config: ${projectConfigPath}`);
+  }
+}
+function displayResolvedSettings(config) {
+  const hasOrgProjects = config.orgProjects && config.orgProjects.length > 0;
+  const hasPersonalProjects = config.personalProjects && config.personalProjects.length > 0;
+  if (!(config.profile || hasOrgProjects || hasPersonalProjects)) {
+    return;
+  }
+  log.info("");
+  if (config.profile) {
+    log.info(`Default profile: ${config.profile}`);
+  }
+  if (hasOrgProjects) {
+    log.info(`Org projects: ${config.orgProjects?.join(", ")}`);
+  }
+  if (hasPersonalProjects) {
+    log.info(`Personal projects: ${config.personalProjects?.join(", ")}`);
+  }
+  if (config.serverUrl !== "https://braid.cloud") {
+    log.info(`Server: ${config.serverUrl}`);
+  }
+}
+async function displaySessionInfo(token) {
+  const serverUrl = await getServerUrlAsync();
+  try {
+    const authConfig = await fetchAuthConfig(serverUrl);
+    const info = await fetchSessionInfo(authConfig.convexSiteUrl, token);
+    if (!info) {
+      log.warn(
+        "Session is expired or revoked. Run 'braid auth' to re-authenticate."
+      );
+      return;
+    }
+    log.info(
+      `Authenticated as: ${info.email}${info.name ? ` (${info.name})` : ""}`
+    );
+    log.info("Session type: CLI session");
+    if (info.deviceName || info.deviceHostname) {
+      log.info(
+        `Device: ${info.deviceName ?? info.deviceHostname ?? "unknown"}`
+      );
+    }
+    const expiresDate = new Date(info.expiresAt);
+    const daysRemaining = Math.ceil(
+      (info.expiresAt - Date.now()) / (24 * 60 * 60 * 1e3)
+    );
+    log.info(
+      `Expires: ${expiresDate.toLocaleDateString()} (${daysRemaining} days)`
+    );
+    if (info.lastActiveAt) {
+      log.info(`Last active: ${new Date(info.lastActiveAt).toLocaleString()}`);
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    log.warn(`Could not fetch session details: ${message}`);
+    const masked = `${token.slice(0, 7)}...${token.slice(-4)}`;
+    log.info(`Session token: ${masked}`);
+  }
+}
+async function authStatusCommand() {
+  const config = await loadMergedConfigAsync();
+  if (!config.token) {
+    log.warn("Not authenticated. Run 'braid auth' to configure your API key.");
+    log.info(
+      `Or create a ${USER_CONFIG_FILENAME} file with: { "token": "br_xxx" }`
+    );
+    return;
+  }
+  if (config.token.startsWith(SESSION_TOKEN_PREFIX)) {
+    await displaySessionInfo(config.token);
+    await displayProjectConfig();
+    displayResolvedSettings(config);
+    return;
+  }
+  const masked = `${config.token.slice(0, 7)}...${config.token.slice(-4)}`;
+  await displayTokenSource(masked);
+  await displayProjectConfig();
+  displayResolvedSettings(config);
+}
+async function revokeSessionIfActive(token) {
+  const serverUrl = await getServerUrlAsync();
+  try {
+    const authConfig = await fetchAuthConfig(serverUrl);
+    await revokeSession(authConfig.convexSiteUrl, token);
+  } catch {
+    return;
+  }
+}
+async function authLogoutCommand() {
+  const config = await loadMergedConfigAsync();
+  const { clearApiKeyAsync: clearApiKeyAsync2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  if (config.token?.startsWith(SESSION_TOKEN_PREFIX)) {
+    await revokeSessionIfActive(config.token);
+  }
+  await clearApiKeyAsync2();
+  log.success("Logged out. API key removed from config.");
+}
+
+// src/commands/discover.ts
+init_esm_shims();
+init_api();
+init_config();
+init_tui();
+import process7 from "process";
+var parseCsv2 = (input) => {
+  if (!input) {
+    return void 0;
+  }
+  const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  return values.length > 0 ? values : void 0;
+};
+var writeJson2 = (value) => {
+  process7.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var exitWithError2 = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process7.exit(1);
+};
+var applyCommonOptions = (base, options) => ({
+  ...base,
+  ...options.server ? { serverUrl: options.server } : {},
+  ...options.apiKey ? { apiKey: options.apiKey } : {}
+});
+var applyOptionalString = (target, key, value) => {
+  if (value) {
+    target[key] = value;
+  }
+};
+var applyOptionalArray = (target, key, value) => {
+  if (value && value.length > 0) {
+    target[key] = value;
+  }
+};
+var applyOptionalBoolean = (target, key, value) => {
+  if (value !== void 0) {
+    target[key] = value;
+  }
+};
+async function projectsListCommand(options) {
+  try {
+    const result = await fetchScopeOptionsAsync(
+      applyCommonOptions({}, options)
+    );
+    if (options.json) {
+      writeJson2(result);
+      return;
+    }
+    log.info("Personal projects:");
+    if (result.personalProjects.length === 0) {
+      log.info("  (none)");
+    }
+    for (const project of result.personalProjects) {
+      log.info(`  ${project.id}  ${project.name}`);
+    }
+    for (const orgProjects of result.orgProjects) {
+      log.info(`
+Organization: ${orgProjects.orgName} (${orgProjects.orgId})`);
+      if (orgProjects.projects.length === 0) {
+        log.info("  (none)");
+        continue;
+      }
+      for (const project of orgProjects.projects) {
+        log.info(`  ${project.id}  ${project.name}`);
+      }
+    }
+  } catch (error) {
+    exitWithError2(error);
+  }
+}
+var buildRulesRequest = async (options) => {
+  const config = await loadMergedConfigAsync();
+  const orgProjects = parseCsv2(options.orgProjects) ?? config.orgProjects;
+  const personalProjects = parseCsv2(options.personalProjects) ?? config.personalProjects;
+  const request = applyCommonOptions({}, options);
+  applyOptionalString(request, "orgId", options.orgId ?? config.org);
+  applyOptionalArray(request, "orgProjects", orgProjects);
+  applyOptionalArray(request, "personalProjects", personalProjects);
+  applyOptionalBoolean(request, "includeUserGlobal", options.includeUserGlobal);
+  applyOptionalBoolean(request, "includeOrgGlobal", options.includeOrgGlobal);
+  return request;
+};
+async function rulesListCommand(options) {
+  try {
+    const result = await fetchRuleOptionsAsync(
+      await buildRulesRequest(options)
+    );
+    if (options.json) {
+      writeJson2(result);
+      return;
+    }
+    if (result.rules.length === 0) {
+      log.info("No rules found.");
+      return;
+    }
+    for (const rule of result.rules) {
+      log.info(`${rule.id}  ${rule.title}`);
+    }
+  } catch (error) {
+    exitWithError2(error);
   }
-  return agent.mcpGlobalConfigPath;
+}
+var buildSkillsRequest = async (options) => {
+  const config = await loadMergedConfigAsync();
+  const orgProjects = parseCsv2(options.orgProjects) ?? config.orgProjects;
+  const personalProjects = parseCsv2(options.personalProjects) ?? config.personalProjects;
+  const request = applyCommonOptions({}, options);
+  applyOptionalString(request, "profile", options.profile ?? config.profile);
+  applyOptionalArray(request, "orgProjects", orgProjects);
+  applyOptionalArray(request, "personalProjects", personalProjects);
+  applyOptionalBoolean(request, "includeUserGlobal", options.includeUserGlobal);
+  applyOptionalBoolean(request, "includeOrgGlobal", options.includeOrgGlobal);
+  return request;
 };
-var buildMcpEntry = (style, env) => {
-  const command = "npx";
-  const args = ["-y", "@braid-cloud/mcp"];
-  const envObj = Object.keys(env).length > 0 ? env : void 0;
-  switch (style) {
-    case "standard":
-      return envObj ? { command, args, env: envObj } : { command, args };
-    case "typed-stdio":
-      return envObj ? { type: "stdio", command, args, env: envObj } : { type: "stdio", command, args };
-    case "zed":
-      return envObj ? { command: { path: command, args, env: envObj } } : { command: { path: command, args } };
-    case "cline":
-      return envObj ? { command, args, env: envObj, disabled: false } : { command, args, disabled: false };
-    default:
-      return envObj ? { command, args, env: envObj } : { command, args };
+async function skillsListCommand(options) {
+  try {
+    const result = await fetchSkillsAsync(await buildSkillsRequest(options));
+    if (options.json) {
+      writeJson2(result);
+      return;
+    }
+    if (result.skills.length === 0) {
+      log.info("No skills found.");
+      return;
+    }
+    for (const skill of result.skills) {
+      log.info(`${skill.name}`);
+    }
+  } catch (error) {
+    exitWithError2(error);
   }
-};
-var detectMcpAgents = (projectRoot) => Effect3.runPromise(
-  pipe3(
-    detectAgents(projectRoot),
-    Effect3.map((detected) => detected.filter(hasMcpConfig))
-  )
-);
+}
 
 // src/commands/install.ts
+init_esm_shims();
 init_api();
 init_config();
 
 // src/lib/metadata.ts
 init_esm_shims();
-import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile3 } from "fs/promises";
 import { join as join3 } from "path";
-import { Data as Data3, Effect as Effect4, pipe as pipe4 } from "effect";
+import { Data as Data4, Effect as Effect5, pipe as pipe5 } from "effect";
 var METADATA_FILENAME = ".braidskills-metadata.json";
-var MetadataReadError = class extends Data3.TaggedError("MetadataReadError") {
+var MetadataReadError = class extends Data4.TaggedError("MetadataReadError") {
 };
-var MetadataWriteError = class extends Data3.TaggedError("MetadataWriteError") {
+var MetadataWriteError = class extends Data4.TaggedError("MetadataWriteError") {
 };
 var getMetadataPath = (skillsDir) => join3(skillsDir, METADATA_FILENAME);
 var readMetadata = (skillsDir) => {
   const metadataPath = getMetadataPath(skillsDir);
-  return pipe4(
-    Effect4.tryPromise({
+  return pipe5(
+    Effect5.tryPromise({
       try: () => readFile2(metadataPath, "utf-8"),
       catch: (e) => new MetadataReadError({ path: metadataPath, cause: e })
     }),
-    Effect4.flatMap(
-      (content) => Effect4.try({
+    Effect5.flatMap(
+      (content) => Effect5.try({
         try: () => JSON.parse(content),
         catch: () => ({ skills: [] })
       })
     ),
-    Effect4.orElseSucceed(() => ({ skills: [] }))
+    Effect5.orElseSucceed(() => ({ skills: [] }))
   );
 };
 var writeMetadata = (skillsDir, metadata) => {
   const metadataPath = getMetadataPath(skillsDir);
-  return Effect4.tryPromise({
-    try: () => writeFile2(metadataPath, JSON.stringify(metadata, null, 2), "utf-8"),
+  return Effect5.tryPromise({
+    try: () => writeFile3(metadataPath, JSON.stringify(metadata, null, 2), "utf-8"),
     catch: (e) => new MetadataWriteError({ path: metadataPath, cause: e })
   });
 };
-var updateMetadata = (skillsDir, newSkills) => pipe4(
+var updateMetadata = (skillsDir, newSkills) => pipe5(
   readMetadata(skillsDir),
-  Effect4.map((existing) => {
+  Effect5.map((existing) => {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const updatedSkills = [...existing.skills];
     for (const skill of newSkills) {
@@ -2118,43 +2971,43 @@ var updateMetadata = (skillsDir, newSkills) => pipe4(
     }
     return { skills: updatedSkills };
   }),
-  Effect4.flatMap((metadata) => writeMetadata(skillsDir, metadata))
+  Effect5.flatMap((metadata) => writeMetadata(skillsDir, metadata))
 );
-var removeFromMetadata = (skillsDir, skillName) => pipe4(
+var removeFromMetadata = (skillsDir, skillName) => pipe5(
   readMetadata(skillsDir),
-  Effect4.map((metadata) => ({
+  Effect5.map((metadata) => ({
     skills: metadata.skills.filter((s) => s.name !== skillName)
   })),
-  Effect4.flatMap((metadata) => writeMetadata(skillsDir, metadata))
+  Effect5.flatMap((metadata) => writeMetadata(skillsDir, metadata))
 );
-var readMetadataAsync = (skillsDir) => Effect4.runPromise(readMetadata(skillsDir));
-var updateMetadataAsync = (skillsDir, newSkills) => Effect4.runPromise(updateMetadata(skillsDir, newSkills));
-var removeFromMetadataAsync = (skillsDir, skillName) => Effect4.runPromise(removeFromMetadata(skillsDir, skillName));
+var readMetadataAsync = (skillsDir) => Effect5.runPromise(readMetadata(skillsDir));
+var updateMetadataAsync = (skillsDir, newSkills) => Effect5.runPromise(updateMetadata(skillsDir, newSkills));
+var removeFromMetadataAsync = (skillsDir, skillName) => Effect5.runPromise(removeFromMetadata(skillsDir, skillName));
 
 // src/lib/rule-writer.ts
 init_esm_shims();
-import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname2, resolve, sep } from "path";
-import { Data as Data4, Effect as Effect5, pipe as pipe5 } from "effect";
-var RuleWriteError = class extends Data4.TaggedError("RuleWriteError") {
+import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname3, resolve as resolve2, sep as sep2 } from "path";
+import { Data as Data5, Effect as Effect6, pipe as pipe6 } from "effect";
+var RuleWriteError = class extends Data5.TaggedError("RuleWriteError") {
 };
-var createDirectory = (dir) => Effect5.tryPromise({
-  try: () => mkdir2(dir, { recursive: true }),
+var createDirectory = (dir) => Effect6.tryPromise({
+  try: () => mkdir3(dir, { recursive: true }),
   catch: (e) => new RuleWriteError({ path: dir, operation: "mkdir", cause: e })
 });
-var writeTextFile = (fullPath, content) => Effect5.tryPromise({
-  try: () => writeFile3(fullPath, content, "utf-8"),
+var writeTextFile = (fullPath, content) => Effect6.tryPromise({
+  try: () => writeFile4(fullPath, content, "utf-8"),
   catch: (e) => new RuleWriteError({ path: fullPath, operation: "write", cause: e })
 });
-var readTextFile = (fullPath) => Effect5.tryPromise({
+var readTextFile = (fullPath) => Effect6.tryPromise({
   try: () => readFile3(fullPath, "utf-8"),
   catch: (e) => new RuleWriteError({ path: fullPath, operation: "read", cause: e })
 });
 var assertRulePathWithinBase = (basePath, ruleName) => {
-  const resolvedBase = resolve(basePath);
-  const resolvedFull = resolve(basePath, ruleName);
-  if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep)) {
-    return Effect5.fail(
+  const resolvedBase = resolve2(basePath);
+  const resolvedFull = resolve2(basePath, ruleName);
+  if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep2)) {
+    return Effect6.fail(
       new RuleWriteError({
         path: ruleName,
         operation: "write",
@@ -2164,7 +3017,7 @@ var assertRulePathWithinBase = (basePath, ruleName) => {
       })
     );
   }
-  return Effect5.succeed(resolvedFull);
+  return Effect6.succeed(resolvedFull);
 };
 var BRAID_SECTION_START = "<!-- braid:rules:start -->";
 var BRAID_SECTION_END = "<!-- braid:rules:end -->";
@@ -2197,30 +3050,30 @@ function buildAppendContent(rules2) {
   lines.push(BRAID_SECTION_END);
   return lines.join("\n");
 }
-var writeMdcRules = (basePath, rules2) => pipe5(
+var writeMdcRules = (basePath, rules2) => pipe6(
   createDirectory(basePath),
-  Effect5.flatMap(
-    () => Effect5.forEach(
+  Effect6.flatMap(
+    () => Effect6.forEach(
       rules2,
-      (rule) => pipe5(
+      (rule) => pipe6(
         assertRulePathWithinBase(basePath, `${rule.name}.mdc`),
-        Effect5.flatMap(
+        Effect6.flatMap(
           (filePath) => writeTextFile(filePath, buildMdcContent(rule))
         )
       ),
       { concurrency: "unbounded" }
     )
   ),
-  Effect5.asVoid
+  Effect6.asVoid
 );
-var writeMarkdownDirRules = (basePath, rules2) => pipe5(
+var writeMarkdownDirRules = (basePath, rules2) => pipe6(
   createDirectory(basePath),
-  Effect5.flatMap(
-    () => Effect5.forEach(
+  Effect6.flatMap(
+    () => Effect6.forEach(
       rules2,
-      (rule) => pipe5(
+      (rule) => pipe6(
         assertRulePathWithinBase(basePath, `${rule.name}.md`),
-        Effect5.flatMap(
+        Effect6.flatMap(
           (filePath) => writeTextFile(filePath, `# ${rule.title}
 
 ${rule.content}`)
@@ -2229,17 +3082,17 @@ ${rule.content}`)
       { concurrency: "unbounded" }
     )
   ),
-  Effect5.asVoid
+  Effect6.asVoid
 );
-var writeAppendSingleRules = (filePath, rules2) => pipe5(
-  createDirectory(dirname2(filePath)),
-  Effect5.flatMap(
-    () => pipe5(
+var writeAppendSingleRules = (filePath, rules2) => pipe6(
+  createDirectory(dirname3(filePath)),
+  Effect6.flatMap(
+    () => pipe6(
       readTextFile(filePath),
-      Effect5.orElseSucceed(() => "")
+      Effect6.orElseSucceed(() => "")
     )
   ),
-  Effect5.flatMap((existing) => {
+  Effect6.flatMap((existing) => {
     const braidContent = buildAppendContent(rules2);
     const startIdx = existing.indexOf(BRAID_SECTION_START);
     const endIdx = existing.indexOf(BRAID_SECTION_END);
@@ -2263,21 +3116,21 @@ var writeRulesForFormat = (basePath, rules2, format) => {
     case "append-single":
       return writeAppendSingleRules(basePath, rules2);
     default:
-      return Effect5.void;
+      return Effect6.void;
   }
 };
 var writeRulesForAgent = (agent, rules2, rulesPath) => {
   if (!agent.ruleFormat || rules2.length === 0) {
-    return Effect5.succeed({ written: 0, errors: [] });
+    return Effect6.succeed({ written: 0, errors: [] });
   }
-  return pipe5(
+  return pipe6(
     writeRulesForFormat(rulesPath, rules2, agent.ruleFormat),
-    Effect5.map(() => ({
+    Effect6.map(() => ({
       written: rules2.length,
       errors: []
     })),
-    Effect5.catchAll(
-      (error) => Effect5.succeed({
+    Effect6.catchAll(
+      (error) => Effect6.succeed({
         written: 0,
         errors: [
           {
@@ -2289,36 +3142,36 @@ var writeRulesForAgent = (agent, rules2, rulesPath) => {
     )
   );
 };
-var writeRulesForAgentAsync = (agent, rules2, rulesPath) => Effect5.runPromise(writeRulesForAgent(agent, rules2, rulesPath));
+var writeRulesForAgentAsync = (agent, rules2, rulesPath) => Effect6.runPromise(writeRulesForAgent(agent, rules2, rulesPath));
 
 // src/lib/skill-writer.ts
 init_esm_shims();
-import { chmod, mkdir as mkdir3, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname3, resolve as resolve2, sep as sep2 } from "path";
-import { Data as Data5, Effect as Effect6, pipe as pipe6 } from "effect";
-var WriteError = class extends Data5.TaggedError("WriteError") {
+import { chmod, mkdir as mkdir4, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname4, resolve as resolve3, sep as sep3 } from "path";
+import { Data as Data6, Effect as Effect7, pipe as pipe7 } from "effect";
+var WriteError = class extends Data6.TaggedError("WriteError") {
 };
-var createDirectory2 = (dir, fullPath) => Effect6.tryPromise({
-  try: () => mkdir3(dir, { recursive: true }),
+var createDirectory2 = (dir, fullPath) => Effect7.tryPromise({
+  try: () => mkdir4(dir, { recursive: true }),
   catch: (e) => new WriteError({ path: fullPath, operation: "mkdir", cause: e })
 });
-var writeTextFile2 = (fullPath, content) => Effect6.tryPromise({
-  try: () => writeFile4(fullPath, content, "utf-8"),
+var writeTextFile2 = (fullPath, content) => Effect7.tryPromise({
+  try: () => writeFile5(fullPath, content, "utf-8"),
   catch: (e) => new WriteError({ path: fullPath, operation: "write", cause: e })
 });
-var writeBinaryFile = (fullPath, content) => Effect6.tryPromise({
-  try: () => writeFile4(fullPath, content),
+var writeBinaryFile = (fullPath, content) => Effect7.tryPromise({
+  try: () => writeFile5(fullPath, content),
   catch: (e) => new WriteError({ path: fullPath, operation: "write", cause: e })
 });
-var makeExecutable = (fullPath) => Effect6.tryPromise({
+var makeExecutable = (fullPath) => Effect7.tryPromise({
   try: () => chmod(fullPath, 493),
   catch: (e) => new WriteError({ path: fullPath, operation: "chmod", cause: e })
 });
-var assertWithinBase = (basePath, untrustedPath) => {
-  const resolvedBase = resolve2(basePath);
-  const resolvedFull = resolve2(basePath, untrustedPath);
-  if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep2)) {
-    return Effect6.fail(
+var assertWithinBase2 = (basePath, untrustedPath) => {
+  const resolvedBase = resolve3(basePath);
+  const resolvedFull = resolve3(basePath, untrustedPath);
+  if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep3)) {
+    return Effect7.fail(
       new WriteError({
         path: untrustedPath,
         operation: "write",
@@ -2328,7 +3181,7 @@ var assertWithinBase = (basePath, untrustedPath) => {
       })
     );
   }
-  return Effect6.succeed(resolvedFull);
+  return Effect7.succeed(resolvedFull);
 };
 var COMPATIBILITY_REGEX = /^compatibility:\s*.+$/m;
 var rewriteCompatibility = (content, agentId) => {
@@ -2371,41 +3224,41 @@ var isScriptFile = (path2) => {
   return inScriptsDir && scriptExtensions.some((ext) => lowerPath.endsWith(ext));
 };
 var writeFileContent = (fullPath, file, agentId) => isBinaryFile(file.path) ? writeBinaryFile(fullPath, decodeFileContentBinary(file)) : writeTextFile2(fullPath, decodeFileContent(file, agentId));
-var setExecutableIfScript = (fullPath, filePath) => isScriptFile(filePath) ? makeExecutable(fullPath) : Effect6.void;
-var writeSkillFile = (basePath, file, agentId) => pipe6(
-  assertWithinBase(basePath, file.path),
-  Effect6.flatMap((fullPath) => {
-    const dir = dirname3(fullPath);
-    return pipe6(
+var setExecutableIfScript = (fullPath, file, agentId) => isScriptFile(file.path) && decodeFileContent(file, agentId).startsWith("#!") ? makeExecutable(fullPath) : Effect7.void;
+var writeSkillFile = (basePath, file, agentId) => pipe7(
+  assertWithinBase2(basePath, file.path),
+  Effect7.flatMap((fullPath) => {
+    const dir = dirname4(fullPath);
+    return pipe7(
       createDirectory2(dir, fullPath),
-      Effect6.flatMap(() => writeFileContent(fullPath, file, agentId)),
-      Effect6.flatMap(() => setExecutableIfScript(fullPath, file.path))
+      Effect7.flatMap(() => writeFileContent(fullPath, file, agentId)),
+      Effect7.flatMap(() => setExecutableIfScript(fullPath, file, agentId))
     );
   })
 );
-var writeSkill = (basePath, skill, agentId) => pipe6(
-  assertWithinBase(basePath, skill.name),
-  Effect6.flatMap(
-    (skillDir) => pipe6(
-      Effect6.forEach(
+var writeSkill = (basePath, skill, agentId) => pipe7(
+  assertWithinBase2(basePath, skill.name),
+  Effect7.flatMap(
+    (skillDir) => pipe7(
+      Effect7.forEach(
         skill.files,
         (file) => writeSkillFile(skillDir, file, agentId),
         {
           concurrency: "unbounded"
         }
       ),
-      Effect6.map(() => void 0)
+      Effect7.map(() => void 0)
     )
   )
 );
-var writeSkills = (basePath, skills2, agentId) => pipe6(
-  Effect6.forEach(
+var writeSkills = (basePath, skills2, agentId) => pipe7(
+  Effect7.forEach(
     skills2,
-    (skill) => pipe6(
+    (skill) => pipe7(
       writeSkill(basePath, skill, agentId),
-      Effect6.map(() => ({ success: true, skill: skill.name })),
-      Effect6.catchAll(
-        (error) => Effect6.succeed({
+      Effect7.map(() => ({ success: true, skill: skill.name })),
+      Effect7.catchAll(
+        (error) => Effect7.succeed({
           success: false,
           skill: skill.name,
           error: error.cause instanceof Error ? error.cause.message : String(error.cause)
@@ -2414,14 +3267,14 @@ var writeSkills = (basePath, skills2, agentId) => pipe6(
     ),
     { concurrency: "unbounded" }
   ),
-  Effect6.map((results) => ({
+  Effect7.map((results) => ({
     written: results.filter((r) => r.success).map((r) => r.skill),
     errors: results.filter(
       (r) => !r.success
     ).map((r) => ({ skill: r.skill, error: r.error }))
   }))
 );
-var writeSkillsAsync = (basePath, skills2, agentId) => Effect6.runPromise(writeSkills(basePath, skills2, agentId));
+var writeSkillsAsync = (basePath, skills2, agentId) => Effect7.runPromise(writeSkills(basePath, skills2, agentId));
 
 // src/commands/install.ts
 init_tui();
@@ -2982,31 +3835,34 @@ init_config();
 
 // src/lib/mcp-config.ts
 init_esm_shims();
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname4 } from "path";
-import { Data as Data6, Effect as Effect7, pipe as pipe7 } from "effect";
-var McpConfigReadError = class extends Data6.TaggedError("McpConfigReadError") {
+import { mkdir as mkdir5, readFile as readFile4, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname5 } from "path";
+import { Data as Data7, Effect as Effect8, pipe as pipe8 } from "effect";
+var McpConfigReadError = class extends Data7.TaggedError("McpConfigReadError") {
 };
-var McpConfigWriteError = class extends Data6.TaggedError("McpConfigWriteError") {
+var McpConfigWriteError = class extends Data7.TaggedError("McpConfigWriteError") {
 };
-var readMcpConfig = (path2) => pipe7(
-  Effect7.tryPromise({
+var readMcpConfig = (path2) => pipe8(
+  Effect8.tryPromise({
     try: () => readFile4(path2, "utf-8"),
     catch: (e) => new McpConfigReadError({ path: path2, cause: e })
   }),
-  Effect7.flatMap(
-    (content) => Effect7.try({
+  Effect8.flatMap(
+    (content) => Effect8.try({
       try: () => JSON.parse(content),
       catch: () => ({})
     })
   ),
-  Effect7.orElseSucceed(() => ({}))
+  Effect8.orElseSucceed(() => ({}))
 );
-var writeMcpConfig = (path2, config) => Effect7.tryPromise({
+var writeMcpConfig = (path2, config) => Effect8.tryPromise({
   try: async () => {
-    await mkdir4(dirname4(path2), { recursive: true });
-    await writeFile5(path2, `${JSON.stringify(config, null, 2)}
-`, "utf-8");
+    await mkdir5(dirname5(path2), { recursive: true, mode: 448 });
+    await writeFile6(path2, `${JSON.stringify(config, null, 2)}
+`, {
+      encoding: "utf-8",
+      mode: 384
+    });
   },
   catch: (e) => new McpConfigWriteError({ path: path2, cause: e })
 });
@@ -3032,8 +3888,8 @@ var hasbraidEntry = (config, rootKey, entryName) => {
   const servers = config[rootKey];
   return servers !== void 0 && entryName in servers;
 };
-var readMcpConfigAsync = (path2) => Effect7.runPromise(readMcpConfig(path2));
-var writeMcpConfigAsync = (path2, config) => Effect7.runPromise(writeMcpConfig(path2, config));
+var readMcpConfigAsync = (path2) => Effect8.runPromise(readMcpConfig(path2));
+var writeMcpConfigAsync = (path2, config) => Effect8.runPromise(writeMcpConfig(path2, config));
 
 // src/commands/mcp.ts
 init_tui();
@@ -3346,16 +4202,16 @@ init_esm_shims();
 init_api();
 init_tui();
 import process9 from "process";
-var writeJson2 = (value) => {
+var writeJson3 = (value) => {
   process9.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 };
-var exitWithError2 = (error) => {
+var exitWithError3 = (error) => {
   const message = error instanceof Error ? error.message : String(error);
   log.error(message);
   process9.exit(1);
 };
-var fail = (message) => {
+var fail2 = (message) => {
   throw new Error(message);
 };
 var parseContext = (contextJson) => {
@@ -3364,7 +4220,7 @@ var parseContext = (contextJson) => {
   }
   return JSON.parse(contextJson);
 };
-var run = async (command, args, options) => {
+var run2 = async (command, args, options) => {
   const apiOptions = {
     ...options.server ? { serverUrl: options.server } : {},
     ...options.apiKey ? { apiKey: options.apiKey } : {}
@@ -3378,44 +4234,44 @@ var run = async (command, args, options) => {
     apiOptions
   );
   if (options.json) {
-    writeJson2(result);
+    writeJson3(result);
     return;
   }
   log.success(`profiles ${command} completed`);
 };
 async function profilesListCommand(options) {
   try {
-    await run("list", {}, options);
+    await run2("list", {}, options);
   } catch (error) {
-    exitWithError2(error);
+    exitWithError3(error);
   }
 }
 async function profilesGetCommand(options) {
   try {
     if (!(options.id || options.name)) {
-      fail("profiles get requires --id or --name");
+      fail2("profiles get requires --id or --name");
     }
-    await run("get", { id: options.id, name: options.name }, options);
+    await run2("get", { id: options.id, name: options.name }, options);
   } catch (error) {
-    exitWithError2(error);
+    exitWithError3(error);
   }
 }
 async function profilesCreateCommand(options) {
   try {
-    const name = options.name ?? fail("profiles create requires --name");
-    await run(
+    const name = options.name ?? fail2("profiles create requires --name");
+    await run2(
       "create",
       { name, context: parseContext(options.contextJson) },
       options
     );
   } catch (error) {
-    exitWithError2(error);
+    exitWithError3(error);
   }
 }
 async function profilesUpdateCommand(options) {
   try {
-    const id = options.id ?? fail("profiles update requires --id");
-    await run(
+    const id = options.id ?? fail2("profiles update requires --id");
+    await run2(
       "update",
       {
         id,
@@ -3425,26 +4281,26 @@ async function profilesUpdateCommand(options) {
       options
     );
   } catch (error) {
-    exitWithError2(error);
+    exitWithError3(error);
   }
 }
 async function profilesRemoveCommand(options) {
   try {
-    const id = options.id ?? fail("profiles remove requires --id");
+    const id = options.id ?? fail2("profiles remove requires --id");
     if (!options.yes) {
-      fail("profiles remove requires --yes");
+      fail2("profiles remove requires --yes");
     }
-    await run("remove", { id, yes: true }, options);
+    await run2("remove", { id, yes: true }, options);
   } catch (error) {
-    exitWithError2(error);
+    exitWithError3(error);
   }
 }
 async function profilesSetDefaultCommand(options) {
   try {
-    const id = options.id ?? fail("profiles set-default requires --id");
-    await run("set-default", { id }, options);
+    const id = options.id ?? fail2("profiles set-default requires --id");
+    await run2("set-default", { id }, options);
   } catch (error) {
-    exitWithError2(error);
+    exitWithError3(error);
   }
 }
 
@@ -3453,14 +4309,14 @@ init_esm_shims();
 init_api();
 init_tui();
 import process10 from "process";
-var writeJson3 = (value) => {
+var writeJson4 = (value) => {
   process10.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 };
-var fail2 = (message) => {
+var fail3 = (message) => {
   throw new Error(message);
 };
-var run2 = async (command, args, options) => {
+var run3 = async (command, args, options) => {
   const apiOptions = {
     ...options.server ? { serverUrl: options.server } : {},
     ...options.apiKey ? { apiKey: options.apiKey } : {}
@@ -3474,40 +4330,40 @@ var run2 = async (command, args, options) => {
     apiOptions
   );
   if (options.json) {
-    writeJson3(result);
+    writeJson4(result);
     return;
   }
   log.success(`projects ${command} completed`);
 };
-var exitWithError3 = (error) => {
+var exitWithError4 = (error) => {
   const message = error instanceof Error ? error.message : String(error);
   log.error(message);
   process10.exit(1);
 };
 async function projectsGetCommand(options) {
   try {
-    const id = options.id ?? fail2("projects get requires --id");
-    await run2("get", { id }, options);
+    const id = options.id ?? fail3("projects get requires --id");
+    await run3("get", { id }, options);
   } catch (error) {
-    exitWithError3(error);
+    exitWithError4(error);
   }
 }
 async function projectsCreateCommand(options) {
   try {
-    const name = options.name ?? fail2("projects create requires --name");
-    await run2(
+    const name = options.name ?? fail3("projects create requires --name");
+    await run3(
       "create",
       { name, description: options.description, orgId: options.orgId },
       options
     );
   } catch (error) {
-    exitWithError3(error);
+    exitWithError4(error);
   }
 }
 async function projectsUpdateCommand(options) {
   try {
-    const id = options.id ?? fail2("projects update requires --id");
-    await run2(
+    const id = options.id ?? fail3("projects update requires --id");
+    await run3(
       "update",
       {
         id,
@@ -3517,18 +4373,18 @@ async function projectsUpdateCommand(options) {
       options
     );
   } catch (error) {
-    exitWithError3(error);
+    exitWithError4(error);
   }
 }
 async function projectsRemoveCommand(options) {
   try {
-    const id = options.id ?? fail2("projects remove requires --id");
+    const id = options.id ?? fail3("projects remove requires --id");
     if (!options.yes) {
-      fail2("projects remove requires --yes");
+      fail3("projects remove requires --yes");
     }
-    await run2("remove", { id, yes: true }, options);
+    await run3("remove", { id, yes: true }, options);
   } catch (error) {
-    exitWithError3(error);
+    exitWithError4(error);
   }
 }
 
@@ -3537,26 +4393,26 @@ init_esm_shims();
 init_api();
 init_tui();
 import process11 from "process";
-var writeJson4 = (value) => {
+var writeJson5 = (value) => {
   process11.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 };
-var parseCsv2 = (input) => {
+var parseCsv3 = (input) => {
   if (!input) {
     return void 0;
   }
   const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
   return values.length > 0 ? values : void 0;
 };
-var exitWithError4 = (error) => {
+var exitWithError5 = (error) => {
   const message = error instanceof Error ? error.message : String(error);
   log.error(message);
   process11.exit(1);
 };
-var fail3 = (message) => {
+var fail4 = (message) => {
   throw new Error(message);
 };
-var run3 = async (command, args, options) => {
+var run4 = async (command, args, options) => {
   const apiOptions = {
     ...options.server ? { serverUrl: options.server } : {},
     ...options.apiKey ? { apiKey: options.apiKey } : {}
@@ -3570,76 +4426,76 @@ var run3 = async (command, args, options) => {
     apiOptions
   );
   if (options.json) {
-    writeJson4(result);
+    writeJson5(result);
     return;
   }
   log.success(`references ${command} completed`);
 };
 async function referencesListCommand(options) {
   try {
-    const ruleId = options.ruleId ?? fail3("references list requires --rule-id");
-    await run3("list", { ruleId }, options);
+    const ruleId = options.ruleId ?? fail4("references list requires --rule-id");
+    await run4("list", { ruleId }, options);
   } catch (error) {
-    exitWithError4(error);
+    exitWithError5(error);
   }
 }
 async function referencesGetCommand(options) {
   try {
-    const id = options.id ?? fail3("references get requires --id");
-    await run3("get", { id }, options);
+    const id = options.id ?? fail4("references get requires --id");
+    await run4("get", { id }, options);
   } catch (error) {
-    exitWithError4(error);
+    exitWithError5(error);
   }
 }
 async function referencesCreateCommand(options) {
   try {
-    const ruleId = options.ruleId ?? fail3("references create requires --rule-id");
-    const file = options.file ?? fail3("references create requires --file");
-    await run3("create", { ruleId, file }, options);
+    const ruleId = options.ruleId ?? fail4("references create requires --rule-id");
+    const file = options.file ?? fail4("references create requires --file");
+    await run4("create", { ruleId, file }, options);
   } catch (error) {
-    exitWithError4(error);
+    exitWithError5(error);
   }
 }
 async function referencesUpdateCommand(options) {
   try {
-    const id = options.id ?? fail3("references update requires --id");
-    await run3(
+    const id = options.id ?? fail4("references update requires --id");
+    await run4(
       "update",
       { id, label: options.label, replaceFile: options.replaceFile },
       options
     );
   } catch (error) {
-    exitWithError4(error);
+    exitWithError5(error);
   }
 }
 async function referencesRemoveCommand(options) {
   try {
-    const id = options.id ?? fail3("references remove requires --id");
+    const id = options.id ?? fail4("references remove requires --id");
     if (!options.yes) {
-      fail3("references remove requires --yes");
+      fail4("references remove requires --yes");
     }
-    await run3("remove", { id, yes: true }, options);
+    await run4("remove", { id, yes: true }, options);
   } catch (error) {
-    exitWithError4(error);
+    exitWithError5(error);
   }
 }
 async function referencesReorderCommand(options) {
   try {
-    const ruleId = options.ruleId ?? fail3("references reorder requires --rule-id");
-    const orderedIds = parseCsv2(options.orderedIds);
+    const ruleId = options.ruleId ?? fail4("references reorder requires --rule-id");
+    const orderedIds = parseCsv3(options.orderedIds);
     if (!orderedIds || orderedIds.length === 0) {
-      fail3("references reorder requires --ordered-ids");
+      fail4("references reorder requires --ordered-ids");
     }
-    await run3("reorder", { ruleId, orderedIds }, options);
+    await run4("reorder", { ruleId, orderedIds }, options);
   } catch (error) {
-    exitWithError4(error);
+    exitWithError5(error);
   }
 }
 
 // src/commands/remove.ts
 init_esm_shims();
 import { rm } from "fs/promises";
-import { join as join4, resolve as resolve3 } from "path";
+import { join as join4, resolve as resolve4 } from "path";
 import process12 from "process";
 init_tui();
 async function collectInstalledSkills(detectedAgents, options) {
@@ -3712,8 +4568,8 @@ async function confirmRemoval(selectedCount, options) {
 async function removeSkill(skill, removeSpinner) {
   removeSpinner.start(`Removing ${skill.name} from ${skill.agentName}...`);
   try {
-    const resolvedSkillPath = resolve3(skill.skillPath);
-    const resolvedInstallPath = resolve3(skill.installPath);
+    const resolvedSkillPath = resolve4(skill.skillPath);
+    const resolvedInstallPath = resolve4(skill.installPath);
     if (!resolvedSkillPath.startsWith(`${resolvedInstallPath}/`)) {
       removeSpinner.stop(`Unsafe path for ${skill.name}`);
       log.warn("  Skill path escapes install directory, skipping.");
@@ -3779,26 +4635,26 @@ init_esm_shims();
 init_api();
 init_tui();
 import process13 from "process";
-var parseCsv3 = (input) => {
+var parseCsv4 = (input) => {
   if (!input) {
     return void 0;
   }
   const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
   return values.length > 0 ? values : void 0;
 };
-var writeJson5 = (value) => {
+var writeJson6 = (value) => {
   process13.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 };
-var exitWithError5 = (error) => {
+var exitWithError6 = (error) => {
   const message = error instanceof Error ? error.message : String(error);
   log.error(message);
   process13.exit(1);
 };
-var fail4 = (message) => {
+var fail5 = (message) => {
   throw new Error(message);
 };
-var run4 = async (command, args, options) => {
+var run5 = async (command, args, options) => {
   const apiOptions = {
     ...options.server ? { serverUrl: options.server } : {},
     ...options.apiKey ? { apiKey: options.apiKey } : {}
@@ -3812,161 +4668,161 @@ var run4 = async (command, args, options) => {
     apiOptions
   );
   if (options.json) {
-    writeJson5(result);
+    writeJson6(result);
     return;
   }
   log.success(`rules ${command} completed`);
 };
 async function rulesGetCommand(options) {
   try {
-    const id = options.id ?? fail4("rules get requires --id");
-    await run4("get", { id }, options);
+    const id = options.id ?? fail5("rules get requires --id");
+    await run5("get", { id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesCreateCommand(options) {
   try {
-    const title = options.title ?? fail4("rules create requires --title");
-    const content = options.content ?? fail4("rules create requires --content");
-    await run4(
+    const title = options.title ?? fail5("rules create requires --title");
+    const content = options.content ?? fail5("rules create requires --content");
+    await run5(
       "create",
       {
         title,
         content,
         projectId: options.projectId,
-        tags: parseCsv3(options.tags),
+        tags: parseCsv4(options.tags),
         priority: options.priority
       },
       options
     );
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesUpdateCommand(options) {
   try {
-    const id = options.id ?? fail4("rules update requires --id");
-    await run4(
+    const id = options.id ?? fail5("rules update requires --id");
+    await run5(
       "update",
       {
         id,
         title: options.title,
         content: options.content,
-        tags: parseCsv3(options.tags),
+        tags: parseCsv4(options.tags),
         priority: options.priority
       },
       options
     );
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesRemoveCommand(options) {
   try {
-    const id = options.id ?? fail4("rules remove requires --id");
+    const id = options.id ?? fail5("rules remove requires --id");
     if (!options.yes) {
-      fail4("rules remove requires --yes");
+      fail5("rules remove requires --yes");
     }
-    await run4("remove", { id, yes: true }, options);
+    await run5("remove", { id, yes: true }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesEnableCommand(options) {
   try {
-    const id = options.id ?? fail4("rules enable requires --id");
-    await run4("enable", { id }, options);
+    const id = options.id ?? fail5("rules enable requires --id");
+    await run5("enable", { id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesDisableCommand(options) {
   try {
-    const id = options.id ?? fail4("rules disable requires --id");
-    await run4("disable", { id }, options);
+    const id = options.id ?? fail5("rules disable requires --id");
+    await run5("disable", { id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesMoveCommand(options) {
   try {
-    const id = options.id ?? fail4("rules move requires --id");
-    const projectId = options.projectId ?? fail4("rules move requires --project-id");
-    await run4("move", { id, projectId }, options);
+    const id = options.id ?? fail5("rules move requires --id");
+    const projectId = options.projectId ?? fail5("rules move requires --project-id");
+    await run5("move", { id, projectId }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesDuplicateCommand(options) {
   try {
-    const id = options.id ?? fail4("rules duplicate requires --id");
-    await run4(
+    const id = options.id ?? fail5("rules duplicate requires --id");
+    await run5(
       "duplicate",
       { id, targetProjectId: options.targetProjectId },
       options
     );
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesForkCommand(options) {
   try {
-    const id = options.id ?? fail4("rules fork requires --id");
-    await run4(
+    const id = options.id ?? fail5("rules fork requires --id");
+    await run5(
       "fork",
       { id, targetProjectId: options.targetProjectId },
       options
     );
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesSyncStatusCommand(options) {
   try {
-    await run4("sync-status", { id: options.id }, options);
+    await run5("sync-status", { id: options.id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesSyncHistoryCommand(options) {
   try {
-    const id = options.id ?? fail4("rules sync-history requires --id");
-    await run4("sync-history", { id }, options);
+    const id = options.id ?? fail5("rules sync-history requires --id");
+    await run5("sync-history", { id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesSyncEnableCommand(options) {
   try {
-    const id = options.id ?? fail4("rules sync-enable requires --id");
-    await run4("sync-enable", { id }, options);
+    const id = options.id ?? fail5("rules sync-enable requires --id");
+    await run5("sync-enable", { id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesSyncDisableCommand(options) {
   try {
-    const id = options.id ?? fail4("rules sync-disable requires --id");
-    await run4("sync-disable", { id }, options);
+    const id = options.id ?? fail5("rules sync-disable requires --id");
+    await run5("sync-disable", { id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesSyncCheckCommand(options) {
   try {
-    const id = options.id ?? fail4("rules sync-check requires --id");
-    await run4("sync-check", { id }, options);
+    const id = options.id ?? fail5("rules sync-check requires --id");
+    await run5("sync-check", { id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 async function rulesSyncNowCommand(options) {
   try {
-    const id = options.id ?? fail4("rules sync-now requires --id");
-    await run4("sync-now", { id }, options);
+    const id = options.id ?? fail5("rules sync-now requires --id");
+    await run5("sync-now", { id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitWithError6(error);
   }
 }
 
@@ -3983,11 +4839,11 @@ import {
   outro as outro2,
   spinner as spinner3
 } from "@clack/prompts";
-import { Data as Data7, Effect as Effect8, pipe as pipe8 } from "effect";
+import { Data as Data8, Effect as Effect9, pipe as pipe9 } from "effect";
 init_api();
-var UpdateError = class extends Data7.TaggedError("UpdateError") {
+var UpdateError = class extends Data8.TaggedError("UpdateError") {
 };
-var UserCancelledError = class extends Data7.TaggedError("UserCancelledError") {
+var UserCancelledError = class extends Data8.TaggedError("UserCancelledError") {
 };
 async function resolveValidInstallPath(agent, options) {
   const installPath = resolveInstallPath(agent, {
@@ -3999,7 +4855,7 @@ async function resolveValidInstallPath(agent, options) {
   const exists = await directoryExistsAsync(installPath);
   return exists ? installPath : null;
 }
-var collectSourcesFromAgent = (agent, options, sourcesToUpdate) => Effect8.tryPromise({
+var collectSourcesFromAgent = (agent, options, sourcesToUpdate) => Effect9.tryPromise({
   try: async () => {
     const installPath = await resolveValidInstallPath(agent, options);
     if (!installPath) {
@@ -4030,10 +4886,10 @@ var collectSourcesFromAgent = (agent, options, sourcesToUpdate) => Effect8.tryPr
   },
   catch: () => new UpdateError({ message: "Failed to collect sources" })
 });
-var collectSources = (detectedAgents, options) => pipe8(
-  Effect8.succeed(/* @__PURE__ */ new Map()),
-  Effect8.tap(
-    (sourcesToUpdate) => Effect8.forEach(
+var collectSources = (detectedAgents, options) => pipe9(
+  Effect9.succeed(/* @__PURE__ */ new Map()),
+  Effect9.tap(
+    (sourcesToUpdate) => Effect9.forEach(
       detectedAgents,
       (agent) => collectSourcesFromAgent(agent, options, sourcesToUpdate),
       { concurrency: 1 }
@@ -4042,9 +4898,9 @@ var collectSources = (detectedAgents, options) => pipe8(
 );
 var selectSources = (sourcesToUpdate, options) => {
   if (options.yes) {
-    return Effect8.succeed(sourcesToUpdate);
+    return Effect9.succeed(sourcesToUpdate);
   }
-  return Effect8.tryPromise({
+  return Effect9.tryPromise({
     try: async () => {
       const sources = Array.from(sourcesToUpdate.entries()).map(
         ([key, source]) => ({
@@ -4095,7 +4951,7 @@ var buildFetchOptionsForSource = (source, options) => {
   }
   return fetchOptions;
 };
-var updateAgentSkills = (agentId, agentName, installPath, response, serverUrl, updateSpinner) => Effect8.tryPromise({
+var updateAgentSkills = (agentId, agentName, installPath, response, serverUrl, updateSpinner) => Effect9.tryPromise({
   try: async () => {
     updateSpinner.start(`Updating ${agentName}...`);
     const result = await writeSkillsAsync(
@@ -4133,15 +4989,15 @@ var updateSource = (source, options, updateSpinner) => {
   const serverUrl = options.server ?? source.serverUrl;
   const fetchOptions = buildFetchOptionsForSource(source, options);
   if (fetchOptions === null) {
-    return Effect8.fail(
+    return Effect9.fail(
       new UpdateError({
         message: "Skills installed with legacy metadata format. Please reinstall using 'braid install --profile <name>' or 'braid install --projects <names>'.",
         source: sourceDesc
       })
     );
   }
-  return pipe8(
-    Effect8.tryPromise({
+  return pipe9(
+    Effect9.tryPromise({
       try: async () => {
         updateSpinner.start(`Fetching latest skills from ${sourceDesc}...`);
         const response = await fetchSkillsAsync(fetchOptions);
@@ -4155,9 +5011,9 @@ var updateSource = (source, options, updateSpinner) => {
         source: sourceDesc
       })
     }),
-    Effect8.flatMap(
-      (response) => pipe8(
-        Effect8.forEach(
+    Effect9.flatMap(
+      (response) => pipe9(
+        Effect9.forEach(
           source.agents,
           ({ agentId, agentName, installPath }) => updateAgentSkills(
             agentId,
@@ -4169,7 +5025,7 @@ var updateSource = (source, options, updateSpinner) => {
           ),
           { concurrency: 1 }
         ),
-        Effect8.map((results) => ({
+        Effect9.map((results) => ({
           updated: results.reduce((sum, r) => sum + r.updated, 0),
           errors: results.reduce((sum, r) => sum + r.errors, 0)
         }))
@@ -4177,22 +5033,22 @@ var updateSource = (source, options, updateSpinner) => {
     )
   );
 };
-var updateAllSources = (sources, options, updateSpinner) => pipe8(
-  Effect8.forEach(
+var updateAllSources = (sources, options, updateSpinner) => pipe9(
+  Effect9.forEach(
     Array.from(sources.values()),
-    (source) => pipe8(
+    (source) => pipe9(
       updateSource(source, options, updateSpinner),
-      Effect8.catchAll((error) => {
+      Effect9.catchAll((error) => {
         updateSpinner.stop(
           `Failed to update from ${getSourceDesc(source)}`
         );
         log3.error(`  ${error.message}`);
-        return Effect8.succeed({ updated: 0, errors: 1 });
+        return Effect9.succeed({ updated: 0, errors: 1 });
       })
     ),
     { concurrency: 1 }
   ),
-  Effect8.map((results) => ({
+  Effect9.map((results) => ({
     totalUpdated: results.reduce((sum, r) => sum + r.updated, 0),
     totalErrors: results.reduce((sum, r) => sum + r.errors, 0)
   }))
@@ -4231,28 +5087,28 @@ var handleProgramExit = (result, updateSpinner) => {
 async function updateCommand(options) {
   const updateSpinner = spinner3();
   updateSpinner.start("Scanning for installed skills...");
-  const program2 = pipe8(
-    Effect8.tryPromise({
+  const program2 = pipe9(
+    Effect9.tryPromise({
       try: () => detectAgentsAsync(),
       catch: () => new UpdateError({ message: "Failed to detect agents" })
     }),
-    Effect8.filterOrFail(
-      (agents) => agents.length > 0,
+    Effect9.filterOrFail(
+      (agents2) => agents2.length > 0,
       () => new UpdateError({ message: "No AI coding agents detected." })
     ),
-    Effect8.flatMap((detectedAgents) => collectSources(detectedAgents, options)),
-    Effect8.tap((sources) => {
+    Effect9.flatMap((detectedAgents) => collectSources(detectedAgents, options)),
+    Effect9.tap((sources) => {
       updateSpinner.stop(`Found ${sources.size} source(s) to update`);
     }),
-    Effect8.filterOrFail(
+    Effect9.filterOrFail(
       (sources) => sources.size > 0,
       () => new UpdateError({ message: "No skills installed via braid." })
     ),
-    Effect8.flatMap((sources) => selectSources(sources, options)),
-    Effect8.flatMap(
+    Effect9.flatMap((sources) => selectSources(sources, options)),
+    Effect9.flatMap(
       (selectedSources) => updateAllSources(selectedSources, options, updateSpinner)
     ),
-    Effect8.tap(({ totalUpdated, totalErrors }) => {
+    Effect9.tap(({ totalUpdated, totalErrors }) => {
       if (totalErrors > 0) {
         outro2(`Updated ${totalUpdated} skills with ${totalErrors} errors.`);
       } else {
@@ -4260,10 +5116,136 @@ async function updateCommand(options) {
       }
     })
   );
-  const result = await Effect8.runPromiseExit(program2);
+  const result = await Effect9.runPromiseExit(program2);
   handleProgramExit(result, updateSpinner);
 }
 
+// src/commands/workflows.ts
+init_esm_shims();
+init_api();
+init_tui();
+import process14 from "process";
+var writeJson7 = (value) => {
+  process14.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var fail6 = (message) => {
+  throw new Error(message);
+};
+var parseMetadata = (metadata) => {
+  if (!metadata) {
+    return void 0;
+  }
+  try {
+    return JSON.parse(metadata);
+  } catch {
+    throw new Error("metadata must be valid JSON");
+  }
+};
+var run6 = async (command, args, options) => {
+  const apiOptions = {
+    ...options.server ? { serverUrl: options.server } : {},
+    ...options.apiKey ? { apiKey: options.apiKey } : {}
+  };
+  const result = await runLifecycleCommandAsync(
+    {
+      domain: "workflows",
+      command,
+      args
+    },
+    apiOptions
+  );
+  if (options.json) {
+    writeJson7(result);
+    return;
+  }
+  log.success(`workflows ${command} completed`);
+};
+var exitWithError7 = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process14.exit(1);
+};
+async function workflowsListCommand(options) {
+  try {
+    await run6("list", { projectId: options.projectId }, options);
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsStartCommand(options) {
+  try {
+    const sessionId = options.sessionId ?? fail6("workflows start requires --session-id");
+    const flowId = options.flowId ?? fail6("workflows start requires --flow-id");
+    await run6(
+      "start",
+      {
+        sessionId,
+        flowId,
+        currentNodeId: options.currentNodeId,
+        currentStepLabel: options.currentStepLabel,
+        metadata: parseMetadata(options.metadata)
+      },
+      options
+    );
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsProgressCommand(options) {
+  try {
+    const executionId = options.executionId ?? fail6("workflows progress requires --execution-id");
+    await run6(
+      "progress",
+      {
+        executionId,
+        currentNodeId: options.currentNodeId,
+        currentStepLabel: options.currentStepLabel,
+        metadata: parseMetadata(options.metadata)
+      },
+      options
+    );
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsActiveCommand(options) {
+  try {
+    const sessionId = options.sessionId ?? fail6("workflows active requires --session-id");
+    await run6("active", { sessionId }, options);
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsCompleteCommand(options) {
+  try {
+    const executionId = options.executionId ?? fail6("workflows complete requires --execution-id");
+    await run6("complete", { executionId }, options);
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsFailCommand(options) {
+  try {
+    const executionId = options.executionId ?? fail6("workflows fail requires --execution-id");
+    await run6(
+      "fail",
+      { executionId, errorMessage: options.errorMessage },
+      options
+    );
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsCancelCommand(options) {
+  try {
+    const executionId = options.executionId ?? fail6("workflows cancel requires --execution-id");
+    await run6("cancel", { executionId }, options);
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var { version: PACKAGE_VERSION } = require2("../package.json");
@@ -4272,7 +5254,13 @@ program.name("braid").description(
   "Install braid prompts as agent skills to your local development environment"
 ).version(PACKAGE_VERSION);
 var auth = program.command("auth").description("Configure API key for braid authentication");
-auth.command("login", { isDefault: true }).description("Configure API key").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--token <token>", "API key for non-interactive login").option("--no-scope", "Skip scope setup after login").action(authCommand);
+auth.command("login", { isDefault: true }).description("Authenticate with braid via browser login or API key").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option(
+  "--token <token>",
+  "API key for non-interactive login (skips device flow)"
+).option(
+  "--timeout <seconds>",
+  "Device flow timeout in seconds (default: 300)"
+).option("--no-scope", "Skip scope setup after login").action(authCommand);
 auth.command("status").description("Show current authentication status").action(authStatusCommand);
 auth.command("logout").description("Remove stored API key").action(authLogoutCommand);
 program.command("install").alias("add").description(
@@ -4353,6 +5341,24 @@ profiles.command("create").description("Create profile").requiredOption("--name
 profiles.command("update").description("Update profile").requiredOption("--id <id>", "Profile ID").option("--name <name>", "Profile name").option("--context-json <json>", "Context JSON").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(profilesUpdateCommand);
 profiles.command("remove").description("Remove profile").requiredOption("--id <id>", "Profile ID").option("-y, --yes", "Confirm destructive action").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(profilesRemoveCommand);
 profiles.command("set-default").description("Set default profile").requiredOption("--id <id>", "Profile ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(profilesSetDefaultCommand);
+var agents = program.command("agents").description("Manage agent artifacts");
+var workflows = program.command("workflows").description("Manage local workflow execution lifecycle");
+workflows.command("list").description("List control flows available for execution").option("--project-id <id>", "Project ID filter").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsListCommand);
+workflows.command("start").description("Start a workflow execution for a CLI session").requiredOption("--session-id <id>", "CLI session ID").requiredOption("--flow-id <id>", "Control flow ID").option("--current-node-id <id>", "Current node ID").option("--current-step-label <label>", "Current step label").option("--metadata <json>", "JSON metadata payload").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsStartCommand);
+workflows.command("progress").description("Update workflow execution progress").requiredOption("--execution-id <id>", "Workflow execution ID").option("--current-node-id <id>", "Current node ID").option("--current-step-label <label>", "Current step label").option("--metadata <json>", "JSON metadata payload").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsProgressCommand);
+workflows.command("active").description("Get active workflow execution for a CLI session").requiredOption("--session-id <id>", "CLI session ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsActiveCommand);
+workflows.command("complete").description("Mark a workflow execution complete").requiredOption("--execution-id <id>", "Workflow execution ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsCompleteCommand);
+workflows.command("fail").description("Mark a workflow execution failed").requiredOption("--execution-id <id>", "Workflow execution ID").option("--error-message <message>", "Failure message").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsFailCommand);
+workflows.command("cancel").description("Cancel a workflow execution").requiredOption("--execution-id <id>", "Workflow execution ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsCancelCommand);
+agents.command("list").description("List saved agents").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsListCommand);
+agents.command("get").description("Get an agent by id").requiredOption("--id <id>", "Agent ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsGetCommand);
+agents.command("create").description("Create an agent").requiredOption("--name <name>", "Agent name").requiredOption("--description <description>", "Agent description").requiredOption("--prompt <prompt>", "Agent system prompt").option("--scope <scope>", "Scope: global or project").option("--project-id <id>", "Project ID for project-scoped agent").option("--mode <mode>", "Mode: primary, subagent, all").option("--model <model>", "Model override").option("--skills <list>", "Comma-separated skill names").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsCreateCommand);
+agents.command("update").description("Update an agent").requiredOption("--id <id>", "Agent ID").option("--name <name>", "Agent name").option("--description <description>", "Agent description").option("--prompt <prompt>", "Agent system prompt").option("--mode <mode>", "Mode: primary, subagent, all").option("--model <model>", "Model override").option("--skills <list>", "Comma-separated skill names").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsUpdateCommand);
+agents.command("remove").description("Remove an agent").requiredOption("--id <id>", "Agent ID").option("-y, --yes", "Confirm destructive action").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsRemoveCommand);
+agents.command("install").description("Install a saved agent to local coding tools").requiredOption("--id <id>", "Agent ID").option(
+  "-a, --agents <list>",
+  "Comma-separated list of target coding tools (eg. claude-code,opencode)"
+).option("-g, --global", "Install to global agent directories").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsInstallCommand);
 var references = program.command("references").description("Manage rule references");
 references.command("list").description("List references for a rule").requiredOption("--rule-id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(referencesListCommand);
 references.command("get").description("Get a reference by id").requiredOption("--id <id>", "Reference ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(referencesGetCommand);