@braid-cloud/cli 0.1.9 → 0.1.12

package/dist/index.js

@@ -55,28 +55,28 @@ __export(config_exports, {
   setApiKeyAsync: () => setApiKeyAsync
 });
 import { existsSync } from "fs";
-import { mkdir, readFile, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join, parse } from "path";
-import process2 from "process";
-import { Data, Effect, pipe } from "effect";
+import { mkdir as mkdir2, readFile, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2, parse } from "path";
+import process3 from "process";
+import { Data as Data2, Effect as Effect3, pipe as pipe3 } from "effect";
 var CONFIG_DIR, CONFIG_FILE, PROJECT_CONFIG_FILENAME, USER_CONFIG_FILENAME, ConfigReadError, ConfigWriteError, findConfigFile, findProjectConfigFile, findUserConfigFile, loadProjectConfig, loadUserConfig, resolveUserConfigWritePath, resolveProjectConfigWritePath, saveUserConfig, saveProjectConfig, isValidServerUrl, resolveServerUrlFromConfig, applyConfigSource, applyEnvOverrides, createDefaultMergedConfig, loadMergedConfig, loadConfig, saveConfig, getApiKey, setApiKey, getServerUrl, clearApiKey, loadConfigAsync, loadProjectConfigAsync, loadUserConfigAsync, loadMergedConfigAsync, findProjectConfigFileAsync, findUserConfigFileAsync, saveConfigAsync, saveUserConfigAsync, saveProjectConfigAsync, getApiKeyAsync, setApiKeyAsync, getServerUrlAsync, clearApiKeyAsync;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
     init_esm_shims();
-    CONFIG_DIR = join(homedir(), ".config", "braid");
-    CONFIG_FILE = join(CONFIG_DIR, "config.json");
+    CONFIG_DIR = join2(homedir2(), ".config", "braid");
+    CONFIG_FILE = join2(CONFIG_DIR, "config.json");
     PROJECT_CONFIG_FILENAME = "braid.json";
     USER_CONFIG_FILENAME = "braid.user.json";
-    ConfigReadError = class extends Data.TaggedError("ConfigReadError") {
+    ConfigReadError = class extends Data2.TaggedError("ConfigReadError") {
     };
-    ConfigWriteError = class extends Data.TaggedError("ConfigWriteError") {
+    ConfigWriteError = class extends Data2.TaggedError("ConfigWriteError") {
     };
-    findConfigFile = (filename, startDir = process2.cwd()) => {
+    findConfigFile = (filename, startDir = process3.cwd()) => {
       let currentDir = startDir;
       while (true) {
-        const configPath = join(currentDir, filename);
+        const configPath = join2(currentDir, filename);
         if (existsSync(configPath)) {
           return configPath;
         }
@@ -87,9 +87,9 @@ var init_config = __esm({
         currentDir = parsed.dir;
       }
     };
-    findProjectConfigFile = (startDir = process2.cwd()) => findConfigFile(PROJECT_CONFIG_FILENAME, startDir);
-    findUserConfigFile = (startDir = process2.cwd()) => findConfigFile(USER_CONFIG_FILENAME, startDir);
-    loadProjectConfig = () => Effect.tryPromise({
+    findProjectConfigFile = (startDir = process3.cwd()) => findConfigFile(PROJECT_CONFIG_FILENAME, startDir);
+    findUserConfigFile = (startDir = process3.cwd()) => findConfigFile(USER_CONFIG_FILENAME, startDir);
+    loadProjectConfig = () => Effect3.tryPromise({
       try: async () => {
         const configPath = await findProjectConfigFile();
         if (!configPath) {
@@ -99,8 +99,8 @@ var init_config = __esm({
         return JSON.parse(content);
       },
       catch: () => void 0
-    }).pipe(Effect.orElseSucceed(() => void 0));
-    loadUserConfig = () => Effect.tryPromise({
+    }).pipe(Effect3.orElseSucceed(() => void 0));
+    loadUserConfig = () => Effect3.tryPromise({
       try: async () => {
         const configPath = await findUserConfigFile();
         if (!configPath) {
@@ -110,16 +110,16 @@ var init_config = __esm({
         return JSON.parse(content);
       },
       catch: () => void 0
-    }).pipe(Effect.orElseSucceed(() => void 0));
-    resolveUserConfigWritePath = (startDir = process2.cwd()) => findUserConfigFile(startDir) ?? join(startDir, USER_CONFIG_FILENAME);
-    resolveProjectConfigWritePath = (startDir = process2.cwd()) => findProjectConfigFile(startDir) ?? join(startDir, PROJECT_CONFIG_FILENAME);
-    saveUserConfig = (config, startDir = process2.cwd()) => {
+    }).pipe(Effect3.orElseSucceed(() => void 0));
+    resolveUserConfigWritePath = (startDir = process3.cwd()) => findUserConfigFile(startDir) ?? join2(startDir, USER_CONFIG_FILENAME);
+    resolveProjectConfigWritePath = (startDir = process3.cwd()) => findProjectConfigFile(startDir) ?? join2(startDir, PROJECT_CONFIG_FILENAME);
+    saveUserConfig = (config, startDir = process3.cwd()) => {
       const targetPath = resolveUserConfigWritePath(startDir);
-      return pipe(
-        Effect.tryPromise({
+      return pipe3(
+        Effect3.tryPromise({
           try: async () => {
-            await mkdir(dirname(targetPath), { recursive: true, mode: 448 });
-            await writeFile(targetPath, JSON.stringify(config, null, 2), {
+            await mkdir2(dirname2(targetPath), { recursive: true, mode: 448 });
+            await writeFile2(targetPath, JSON.stringify(config, null, 2), {
               encoding: "utf-8",
               mode: 384
             });
@@ -129,13 +129,13 @@ var init_config = __esm({
         })
       );
     };
-    saveProjectConfig = (config, startDir = process2.cwd()) => {
+    saveProjectConfig = (config, startDir = process3.cwd()) => {
       const targetPath = resolveProjectConfigWritePath(startDir);
-      return pipe(
-        Effect.tryPromise({
+      return pipe3(
+        Effect3.tryPromise({
           try: async () => {
-            await mkdir(dirname(targetPath), { recursive: true, mode: 448 });
-            await writeFile(targetPath, JSON.stringify(config, null, 2), {
+            await mkdir2(dirname2(targetPath), { recursive: true, mode: 448 });
+            await writeFile2(targetPath, JSON.stringify(config, null, 2), {
               encoding: "utf-8",
               mode: 384
             });
@@ -206,10 +206,10 @@ var init_config = __esm({
       }
     };
     applyEnvOverrides = (merged) => {
-      if (process2.env.BRAID_API_KEY) {
-        merged.token = process2.env.BRAID_API_KEY;
+      if (process3.env.BRAID_API_KEY) {
+        merged.token = process3.env.BRAID_API_KEY;
       }
-      const envServerUrl = process2.env.BRAID_SKILLS_SERVER_URL ?? process2.env.BRAID_SERVER_URL;
+      const envServerUrl = process3.env.BRAID_SKILLS_SERVER_URL ?? process3.env.BRAID_SERVER_URL;
       if (envServerUrl && isValidServerUrl(envServerUrl)) {
         merged.serverUrl = envServerUrl;
       }
@@ -219,15 +219,15 @@ var init_config = __esm({
       includeUserGlobal: true,
       includeOrgGlobal: true
     });
-    loadMergedConfig = () => pipe(
-      Effect.all({
+    loadMergedConfig = () => pipe3(
+      Effect3.all({
         projectConfig: loadProjectConfig(),
         userConfig: loadUserConfig(),
         globalConfig: loadConfig().pipe(
-          Effect.orElseSucceed(() => ({}))
+          Effect3.orElseSucceed(() => ({}))
         )
       }),
-      Effect.map(({ projectConfig, userConfig, globalConfig }) => {
+      Effect3.map(({ projectConfig, userConfig, globalConfig }) => {
         const merged = createDefaultMergedConfig();
         applyConfigSource(merged, projectConfig);
         applyConfigSource(merged, userConfig);
@@ -238,24 +238,24 @@ var init_config = __esm({
         return merged;
       })
     );
-    loadConfig = () => pipe(
-      Effect.tryPromise({
+    loadConfig = () => pipe3(
+      Effect3.tryPromise({
         try: () => readFile(CONFIG_FILE, "utf-8"),
         catch: (e) => new ConfigReadError({ path: CONFIG_FILE, cause: e })
       }),
-      Effect.flatMap(
-        (content) => Effect.try({
+      Effect3.flatMap(
+        (content) => Effect3.try({
           try: () => JSON.parse(content),
           catch: () => ({})
         })
       ),
-      Effect.orElseSucceed(() => ({}))
+      Effect3.orElseSucceed(() => ({}))
     );
-    saveConfig = (config) => pipe(
-      Effect.tryPromise({
+    saveConfig = (config) => pipe3(
+      Effect3.tryPromise({
         try: async () => {
-          await mkdir(dirname(CONFIG_FILE), { recursive: true, mode: 448 });
-          await writeFile(CONFIG_FILE, JSON.stringify(config, null, 2), {
+          await mkdir2(dirname2(CONFIG_FILE), { recursive: true, mode: 448 });
+          await writeFile2(CONFIG_FILE, JSON.stringify(config, null, 2), {
             encoding: "utf-8",
             mode: 384
           });
@@ -263,33 +263,33 @@ var init_config = __esm({
         catch: (e) => new ConfigWriteError({ path: CONFIG_FILE, cause: e })
       })
     );
-    getApiKey = () => pipe(
-      Effect.succeed(process2.env.BRAID_API_KEY),
-      Effect.flatMap(
-        (envKey) => envKey ? Effect.succeed(envKey) : pipe(
+    getApiKey = () => pipe3(
+      Effect3.succeed(process3.env.BRAID_API_KEY),
+      Effect3.flatMap(
+        (envKey) => envKey ? Effect3.succeed(envKey) : pipe3(
           loadUserConfig(),
-          Effect.flatMap(
-            (userConfig) => userConfig?.token ? Effect.succeed(userConfig.token) : pipe(
+          Effect3.flatMap(
+            (userConfig) => userConfig?.token ? Effect3.succeed(userConfig.token) : pipe3(
               loadConfig(),
-              Effect.map((config) => config.apiKey)
+              Effect3.map((config) => config.apiKey)
             )
           )
         )
       )
     );
-    setApiKey = (apiKey) => pipe(
+    setApiKey = (apiKey) => pipe3(
       loadConfig(),
-      Effect.flatMap((config) => saveConfig({ ...config, apiKey }))
+      Effect3.flatMap((config) => saveConfig({ ...config, apiKey }))
     );
-    getServerUrl = () => pipe(
-      Effect.succeed(process2.env.BRAID_SERVER_URL),
-      Effect.flatMap(
-        (envUrl) => envUrl ? Effect.succeed(envUrl) : pipe(
+    getServerUrl = () => pipe3(
+      Effect3.succeed(process3.env.BRAID_SERVER_URL),
+      Effect3.flatMap(
+        (envUrl) => envUrl ? Effect3.succeed(envUrl) : pipe3(
           loadUserConfig(),
-          Effect.flatMap(
-            (userConfig) => userConfig?.serverUrl ? Effect.succeed(userConfig.serverUrl) : pipe(
+          Effect3.flatMap(
+            (userConfig) => userConfig?.serverUrl ? Effect3.succeed(userConfig.serverUrl) : pipe3(
               loadConfig(),
-              Effect.map(
+              Effect3.map(
                 (config) => config.serverUrl ?? "https://braid.cloud"
               )
             )
@@ -297,55 +297,74 @@ var init_config = __esm({
         )
       )
     );
-    clearApiKey = () => pipe(
+    clearApiKey = () => pipe3(
       loadConfig(),
-      Effect.flatMap((config) => {
+      Effect3.flatMap((config) => {
         const { apiKey: _, ...rest } = config;
         return saveConfig(rest);
       })
     );
-    loadConfigAsync = () => Effect.runPromise(loadConfig());
-    loadProjectConfigAsync = () => Effect.runPromise(loadProjectConfig());
-    loadUserConfigAsync = () => Effect.runPromise(loadUserConfig());
-    loadMergedConfigAsync = () => Effect.runPromise(loadMergedConfig());
+    loadConfigAsync = () => Effect3.runPromise(loadConfig());
+    loadProjectConfigAsync = () => Effect3.runPromise(loadProjectConfig());
+    loadUserConfigAsync = () => Effect3.runPromise(loadUserConfig());
+    loadMergedConfigAsync = () => Effect3.runPromise(loadMergedConfig());
     findProjectConfigFileAsync = (startDir) => findProjectConfigFile(startDir);
     findUserConfigFileAsync = (startDir) => findUserConfigFile(startDir);
-    saveConfigAsync = (config) => Effect.runPromise(saveConfig(config));
-    saveUserConfigAsync = (config, startDir) => Effect.runPromise(saveUserConfig(config, startDir));
-    saveProjectConfigAsync = (config, startDir) => Effect.runPromise(saveProjectConfig(config, startDir));
-    getApiKeyAsync = () => Effect.runPromise(getApiKey());
-    setApiKeyAsync = (apiKey) => Effect.runPromise(setApiKey(apiKey));
-    getServerUrlAsync = () => Effect.runPromise(getServerUrl());
-    clearApiKeyAsync = () => Effect.runPromise(clearApiKey());
+    saveConfigAsync = (config) => Effect3.runPromise(saveConfig(config));
+    saveUserConfigAsync = (config, startDir) => Effect3.runPromise(saveUserConfig(config, startDir));
+    saveProjectConfigAsync = (config, startDir) => Effect3.runPromise(saveProjectConfig(config, startDir));
+    getApiKeyAsync = () => Effect3.runPromise(getApiKey());
+    setApiKeyAsync = (apiKey) => Effect3.runPromise(setApiKey(apiKey));
+    getServerUrlAsync = () => Effect3.runPromise(getServerUrl());
+    clearApiKeyAsync = () => Effect3.runPromise(clearApiKey());
   }
 });
 
 // src/lib/api.ts
-import { Data as Data2, Effect as Effect2, pipe as pipe2 } from "effect";
-var TRAILING_SLASH_REGEX, ApiError, AuthenticationError, NetworkError, resolveApiKey, resolveServerUrl, parseResponse, buildApiUrl, buildExportUrl, executeApiRequest, parseScopeOptionsResponse, fetchScopeOptions, buildRuleOptionsUrl, fetchRuleOptions, fetchSkills, validateApiKey, fetchSkillsAsync, validateApiKeyAsync, fetchScopeOptionsAsync, fetchRuleOptionsAsync;
+import { Data as Data3, Effect as Effect4, pipe as pipe4 } from "effect";
+var TRAILING_SLASH_REGEX, ALLOW_UNTRUSTED_SERVER_ENV, isTruthy, isLocalHost, isTrustedApiServerUrl, ApiError, AuthenticationError, NetworkError, resolveApiKey, resolveServerUrl, parseResponse, buildApiUrl, buildExportUrl, executeApiRequest, parseScopeOptionsResponse, fetchScopeOptions, buildRuleOptionsUrl, fetchRuleOptions, fetchSkills, runLifecycleCommand, DEFAULT_PUBLIC_SERVER_URL, NotFoundError, RateLimitedError, handlePublicApiResponse, fetchPublicMetadata, fetchPublicExport, fetchPublicMetadataAsync, fetchPublicExportAsync, validateApiKey, fetchSkillsAsync, validateApiKeyAsync, fetchScopeOptionsAsync, fetchRuleOptionsAsync, runLifecycleCommandAsync;
 var init_api = __esm({
   "src/lib/api.ts"() {
     "use strict";
     init_esm_shims();
     init_config();
     TRAILING_SLASH_REGEX = /\/$/;
-    ApiError = class extends Data2.TaggedError("ApiError") {
+    ALLOW_UNTRUSTED_SERVER_ENV = "BRAID_ALLOW_UNTRUSTED_SERVER_URL";
+    isTruthy = (value) => value === "1" || value === "true" || value === "yes";
+    isLocalHost = (hostname2) => hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1";
+    isTrustedApiServerUrl = (serverUrl) => {
+      try {
+        const parsed = new URL(serverUrl);
+        const hostname2 = parsed.hostname;
+        const isBraidHost = hostname2 === "braid.cloud" || hostname2.endsWith(".braid.cloud");
+        if (parsed.protocol === "https:" && isBraidHost) {
+          return true;
+        }
+        if (parsed.protocol === "http:" && isLocalHost(hostname2)) {
+          return true;
+        }
+        return false;
+      } catch {
+        return false;
+      }
+    };
+    ApiError = class extends Data3.TaggedError("ApiError") {
     };
-    AuthenticationError = class extends Data2.TaggedError("AuthenticationError") {
+    AuthenticationError = class extends Data3.TaggedError("AuthenticationError") {
     };
-    NetworkError = class extends Data2.TaggedError("NetworkError") {
+    NetworkError = class extends Data3.TaggedError("NetworkError") {
     };
     resolveApiKey = (optionsApiKey) => {
       if (optionsApiKey) {
-        return Effect2.succeed(optionsApiKey);
+        return Effect4.succeed(optionsApiKey);
       }
-      return pipe2(
-        Effect2.tryPromise({
+      return pipe4(
+        Effect4.tryPromise({
           try: () => getApiKeyAsync(),
           catch: () => new NetworkError({ message: "Failed to read config" })
         }),
-        Effect2.flatMap(
-          (key) => key ? Effect2.succeed(key) : Effect2.fail(
+        Effect4.flatMap(
+          (key) => key ? Effect4.succeed(key) : Effect4.fail(
             new AuthenticationError({
               message: 'No API key configured. Run "braid auth" to authenticate.'
             })
@@ -355,24 +374,43 @@ var init_api = __esm({
     };
     resolveServerUrl = (optionsServerUrl) => {
       if (optionsServerUrl) {
-        return Effect2.succeed(optionsServerUrl);
+        if (!(isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(optionsServerUrl))) {
+          return Effect4.fail(
+            new NetworkError({
+              message: `Untrusted server URL '${optionsServerUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
+            })
+          );
+        }
+        return Effect4.succeed(optionsServerUrl);
       }
-      return Effect2.tryPromise({
-        try: () => getServerUrlAsync(),
-        catch: () => new NetworkError({ message: "Failed to read config" })
-      });
+      return pipe4(
+        Effect4.tryPromise({
+          try: () => getServerUrlAsync(),
+          catch: () => new NetworkError({ message: "Failed to read config" })
+        }),
+        Effect4.flatMap((serverUrl) => {
+          if (isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(serverUrl)) {
+            return Effect4.succeed(serverUrl);
+          }
+          return Effect4.fail(
+            new NetworkError({
+              message: `Untrusted server URL '${serverUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
+            })
+          );
+        })
+      );
     };
     parseResponse = (response, json) => {
       if (!response.ok) {
         const errorResponse = json;
         if (response.status === 401) {
-          return Effect2.fail(
+          return Effect4.fail(
             new AuthenticationError({
               message: errorResponse.error || "Invalid or expired API key. Run 'braid auth' to re-authenticate."
             })
           );
         }
-        return Effect2.fail(
+        return Effect4.fail(
           new ApiError({
             message: errorResponse.error || "API request failed",
             code: errorResponse.code || "UNKNOWN_ERROR",
@@ -380,7 +418,7 @@ var init_api = __esm({
           })
         );
       }
-      return Effect2.succeed(json);
+      return Effect4.succeed(json);
     };
     buildApiUrl = (serverUrl, path2) => {
       const baseUrl = serverUrl.replace(TRAILING_SLASH_REGEX, "");
@@ -420,8 +458,8 @@ var init_api = __esm({
       }
       return url;
     };
-    executeApiRequest = (url, apiKey, serverUrl) => pipe2(
-      Effect2.tryPromise({
+    executeApiRequest = (url, apiKey, serverUrl) => pipe4(
+      Effect4.tryPromise({
         try: () => fetch(url.toString(), {
           method: "GET",
           headers: {
@@ -434,13 +472,13 @@ var init_api = __esm({
           cause: e
         })
       }),
-      Effect2.flatMap(
-        (response) => pipe2(
-          Effect2.tryPromise({
+      Effect4.flatMap(
+        (response) => pipe4(
+          Effect4.tryPromise({
             try: () => response.json(),
             catch: () => new NetworkError({ message: "Failed to parse API response" })
           }),
-          Effect2.flatMap((json) => parseResponse(response, json))
+          Effect4.flatMap((json) => parseResponse(response, json))
         )
       )
     );
@@ -448,13 +486,13 @@ var init_api = __esm({
       if (!response.ok) {
         const errorResponse = json;
         if (response.status === 401) {
-          return Effect2.fail(
+          return Effect4.fail(
             new AuthenticationError({
               message: errorResponse.error || "Invalid or expired API key. Run 'braid auth' to re-authenticate."
             })
           );
         }
-        return Effect2.fail(
+        return Effect4.fail(
           new ApiError({
             message: errorResponse.error || "API request failed",
             code: errorResponse.code || "UNKNOWN_ERROR",
@@ -462,17 +500,17 @@ var init_api = __esm({
           })
         );
       }
-      return Effect2.succeed(json);
+      return Effect4.succeed(json);
     };
-    fetchScopeOptions = (options = {}) => pipe2(
-      Effect2.all({
+    fetchScopeOptions = (options = {}) => pipe4(
+      Effect4.all({
         apiKey: resolveApiKey(options.apiKey),
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
-      Effect2.flatMap(({ apiKey, serverUrl }) => {
+      Effect4.flatMap(({ apiKey, serverUrl }) => {
         const url = buildApiUrl(serverUrl, "/api/skills/scope-options");
-        return pipe2(
-          Effect2.tryPromise({
+        return pipe4(
+          Effect4.tryPromise({
             try: () => fetch(url.toString(), {
               method: "GET",
               headers: {
@@ -485,13 +523,13 @@ var init_api = __esm({
               cause: e
             })
           }),
-          Effect2.flatMap(
-            (response) => pipe2(
-              Effect2.tryPromise({
+          Effect4.flatMap(
+            (response) => pipe4(
+              Effect4.tryPromise({
                 try: () => response.json(),
                 catch: () => new NetworkError({ message: "Failed to parse API response" })
               }),
-              Effect2.flatMap((json) => parseScopeOptionsResponse(response, json))
+              Effect4.flatMap((json) => parseScopeOptionsResponse(response, json))
             )
           )
         );
@@ -522,14 +560,14 @@ var init_api = __esm({
       }
       return url;
     };
-    fetchRuleOptions = (options = {}) => pipe2(
-      Effect2.all({
+    fetchRuleOptions = (options = {}) => pipe4(
+      Effect4.all({
         apiKey: resolveApiKey(options.apiKey),
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
-      Effect2.flatMap(
-        ({ apiKey, serverUrl }) => pipe2(
-          Effect2.tryPromise({
+      Effect4.flatMap(
+        ({ apiKey, serverUrl }) => pipe4(
+          Effect4.tryPromise({
             try: () => fetch(buildRuleOptionsUrl(serverUrl, options).toString(), {
               method: "GET",
               headers: {
@@ -542,17 +580,17 @@ var init_api = __esm({
               cause: e
             })
           }),
-          Effect2.flatMap(
-            (response) => pipe2(
-              Effect2.tryPromise({
+          Effect4.flatMap(
+            (response) => pipe4(
+              Effect4.tryPromise({
                 try: () => response.json(),
                 catch: () => new NetworkError({ message: "Failed to parse API response" })
               }),
-              Effect2.flatMap((json) => {
+              Effect4.flatMap((json) => {
                 if (!response.ok) {
                   return parseResponse(response, json).pipe(
-                    Effect2.flatMap(
-                      () => Effect2.fail(
+                    Effect4.flatMap(
+                      () => Effect4.fail(
                         new ApiError({
                           message: "API request failed",
                           code: "UNKNOWN_ERROR",
@@ -562,53 +600,206 @@ var init_api = __esm({
                     )
                   );
                 }
-                return Effect2.succeed(json);
+                return Effect4.succeed(json);
               })
             )
           )
         )
       )
     );
-    fetchSkills = (options) => pipe2(
-      Effect2.all({
+    fetchSkills = (options) => pipe4(
+      Effect4.all({
         apiKey: resolveApiKey(options.apiKey),
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
-      Effect2.flatMap(({ apiKey, serverUrl }) => {
+      Effect4.flatMap(({ apiKey, serverUrl }) => {
         const url = buildExportUrl(serverUrl, options);
         return executeApiRequest(url, apiKey, serverUrl);
       })
     );
-    validateApiKey = (apiKey, serverUrl) => pipe2(
-      Effect2.tryPromise({
-        try: async () => {
-          const baseUrl = serverUrl ?? "https://braid.cloud";
-          const url = buildApiUrl(baseUrl, "/api/skills/export");
-          url.searchParams.set("profile", "default");
-          const response = await fetch(url.toString(), {
-            method: "GET",
-            headers: {
-              Authorization: `Bearer ${apiKey}`,
-              "Content-Type": "application/json"
+    runLifecycleCommand = (request, options = {}) => pipe4(
+      Effect4.all({
+        apiKey: resolveApiKey(options.apiKey),
+        serverUrl: resolveServerUrl(options.serverUrl)
+      }),
+      Effect4.flatMap(
+        ({ apiKey, serverUrl }) => Effect4.tryPromise({
+          try: async () => {
+            const response = await fetch(
+              buildApiUrl(serverUrl, "/api/lifecycle").toString(),
+              {
+                method: "POST",
+                headers: {
+                  Authorization: `Bearer ${apiKey}`,
+                  "Content-Type": "application/json"
+                },
+                body: JSON.stringify(request)
+              }
+            );
+            const json = await response.json();
+            if (!response.ok) {
+              const errorResponse = json;
+              if (response.status === 401) {
+                throw new AuthenticationError({
+                  message: errorResponse.error || "Invalid or expired API key. Run 'braid auth' to re-authenticate."
+                });
+              }
+              throw new ApiError({
+                message: errorResponse.error || "API request failed",
+                code: errorResponse.code || "UNKNOWN_ERROR",
+                status: response.status
+              });
             }
-          });
-          return response.status !== 401;
+            return json;
+          },
+          catch: (error) => {
+            if (error instanceof ApiError || error instanceof AuthenticationError || error instanceof NetworkError) {
+              return error;
+            }
+            return new NetworkError({
+              message: `Failed to connect to ${serverUrl}`,
+              cause: error
+            });
+          }
+        })
+      )
+    );
+    DEFAULT_PUBLIC_SERVER_URL = "https://braid.cloud";
+    NotFoundError = class extends Data3.TaggedError("NotFoundError") {
+    };
+    RateLimitedError = class extends Data3.TaggedError("RateLimitedError") {
+    };
+    handlePublicApiResponse = (response, json) => {
+      if (response.ok) {
+        return Effect4.succeed(json);
+      }
+      if (response.status === 404) {
+        return Effect4.fail(
+          new NotFoundError({ message: "Public content not found" })
+        );
+      }
+      if (response.status === 429) {
+        const retryAfter = response.headers.get("Retry-After");
+        const retryMs = retryAfter ? Number(retryAfter) * 1e3 : null;
+        return Effect4.fail(
+          new RateLimitedError({
+            message: "Rate limited. Please try again later.",
+            ...retryMs !== null ? { retryAfterMs: retryMs } : {}
+          })
+        );
+      }
+      const errorResponse = json;
+      return Effect4.fail(
+        new ApiError({
+          message: errorResponse.error || "API request failed",
+          code: errorResponse.code || "UNKNOWN_ERROR",
+          status: response.status
+        })
+      );
+    };
+    fetchPublicMetadata = (handle, slug, serverUrl) => {
+      const baseUrl = (serverUrl ?? DEFAULT_PUBLIC_SERVER_URL).replace(
+        TRAILING_SLASH_REGEX,
+        ""
+      );
+      const url = `${baseUrl}/api/public/@${handle}/${slug}`;
+      return pipe4(
+        Effect4.tryPromise({
+          try: () => fetch(url, { method: "GET" }),
+          catch: (e) => new NetworkError({
+            message: `Failed to connect to ${baseUrl}`,
+            cause: e
+          })
+        }),
+        Effect4.flatMap(
+          (response) => pipe4(
+            Effect4.tryPromise({
+              try: () => response.json(),
+              catch: () => new NetworkError({ message: "Failed to parse API response" })
+            }),
+            Effect4.flatMap(
+              (json) => handlePublicApiResponse(response, json)
+            )
+          )
+        )
+      );
+    };
+    fetchPublicExport = (handle, slug, ruleIds, serverUrl) => {
+      const baseUrl = (serverUrl ?? DEFAULT_PUBLIC_SERVER_URL).replace(
+        TRAILING_SLASH_REGEX,
+        ""
+      );
+      const url = new URL(`${baseUrl}/api/public/@${handle}/${slug}/export`);
+      if (ruleIds && ruleIds.length > 0) {
+        url.searchParams.set("ruleIds", ruleIds.join(","));
+      }
+      return pipe4(
+        Effect4.tryPromise({
+          try: () => fetch(url.toString(), { method: "GET" }),
+          catch: (e) => new NetworkError({
+            message: `Failed to connect to ${baseUrl}`,
+            cause: e
+          })
+        }),
+        Effect4.flatMap(
+          (response) => pipe4(
+            Effect4.tryPromise({
+              try: () => response.json(),
+              catch: () => new NetworkError({ message: "Failed to parse API response" })
+            }),
+            Effect4.flatMap(
+              (json) => handlePublicApiResponse(response, json)
+            )
+          )
+        )
+      );
+    };
+    fetchPublicMetadataAsync = (handle, slug, serverUrl) => Effect4.runPromise(fetchPublicMetadata(handle, slug, serverUrl));
+    fetchPublicExportAsync = (handle, slug, ruleIds, serverUrl) => Effect4.runPromise(fetchPublicExport(handle, slug, ruleIds, serverUrl));
+    validateApiKey = (apiKey, serverUrl) => pipe4(
+      Effect4.try({
+        try: () => {
+          const baseUrl = serverUrl ?? "https://braid.cloud";
+          if (!(isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(baseUrl))) {
+            throw new NetworkError({
+              message: `Untrusted server URL '${baseUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
+            });
+          }
+          return baseUrl;
         },
-        catch: (e) => new NetworkError({
-          message: `Failed to connect to ${serverUrl ?? "https://braid.cloud"}`,
-          cause: e
+        catch: (e) => e instanceof NetworkError ? e : new NetworkError({ message: "Invalid server URL" })
+      }),
+      Effect4.flatMap(
+        (baseUrl) => Effect4.tryPromise({
+          try: async () => {
+            const url = buildApiUrl(baseUrl, "/api/skills/export");
+            url.searchParams.set("profile", "default");
+            const response = await fetch(url.toString(), {
+              method: "GET",
+              headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json"
+              }
+            });
+            return response.status !== 401;
+          },
+          catch: (e) => new NetworkError({
+            message: `Failed to connect to ${baseUrl}`,
+            cause: e
+          })
         })
-      })
+      )
     );
-    fetchSkillsAsync = (options) => Effect2.runPromise(fetchSkills(options));
-    validateApiKeyAsync = (apiKey, serverUrl) => Effect2.runPromise(validateApiKey(apiKey, serverUrl));
-    fetchScopeOptionsAsync = (options = {}) => Effect2.runPromise(fetchScopeOptions(options));
-    fetchRuleOptionsAsync = (options = {}) => Effect2.runPromise(fetchRuleOptions(options));
+    fetchSkillsAsync = (options) => Effect4.runPromise(fetchSkills(options));
+    validateApiKeyAsync = (apiKey, serverUrl) => Effect4.runPromise(validateApiKey(apiKey, serverUrl));
+    fetchScopeOptionsAsync = (options = {}) => Effect4.runPromise(fetchScopeOptions(options));
+    fetchRuleOptionsAsync = (options = {}) => Effect4.runPromise(fetchRuleOptions(options));
+    runLifecycleCommandAsync = (request, options = {}) => Effect4.runPromise(runLifecycleCommand(request, options));
   }
 });
 
 // src/lib/tui.ts
-import process3 from "process";
+import process4 from "process";
 import {
   cancel as clackCancel,
   confirm as clackConfirm,
@@ -633,19 +824,19 @@ function spinner() {
   return {
     start: (message) => {
       if (message) {
-        process3.stdout.write(`${message}
+        process4.stdout.write(`${message}
 `);
       }
     },
     stop: (message) => {
       if (message) {
-        process3.stdout.write(`${message}
+        process4.stdout.write(`${message}
 `);
       }
     },
     message: (message) => {
       if (message) {
-        process3.stdout.write(`${message}
+        process4.stdout.write(`${message}
 `);
       }
     }
@@ -655,7 +846,7 @@ function intro(message) {
   if (isTTY) {
     clackIntro(message);
   } else {
-    process3.stdout.write(`
+    process4.stdout.write(`
 ${message}
 `);
   }
@@ -664,7 +855,7 @@ function outro(message) {
   if (isTTY) {
     clackOutro(message);
   } else {
-    process3.stdout.write(`${message}
+    process4.stdout.write(`${message}
 
 `);
   }
@@ -674,7 +865,7 @@ var init_tui = __esm({
   "src/lib/tui.ts"() {
     "use strict";
     init_esm_shims();
-    isTTY = Boolean(process3.stdout.isTTY);
+    isTTY = Boolean(process4.stdout.isTTY);
     cancel = clackCancel;
     confirm = clackConfirm;
     isCancel = clackIsCancel;
@@ -785,10 +976,10 @@ var scope_exports = {};
 __export(scope_exports, {
   scopeCommand: () => scopeCommand
 });
-import process4 from "process";
+import process5 from "process";
 function exitCancelled(message) {
   cancel(message);
-  process4.exit(0);
+  process5.exit(0);
 }
 async function selectTargetFile(options) {
   if (options.file) {
@@ -922,10 +1113,10 @@ async function selectProjects(organizationContext, scopeOptions) {
   }
   return selected.length > 0 ? selected : void 0;
 }
-async function pickRuleIds(message, rules) {
+async function pickRuleIds(message, rules2) {
   const selected = await multiselect({
     message,
-    options: rules.map((rule) => ({
+    options: rules2.map((rule) => ({
       value: rule.id,
       label: rule.title,
       hint: rule.id
@@ -1136,7 +1327,7 @@ async function scopeCommand(options) {
   } catch (error) {
     loadSpinner.stop("Failed to load scope options");
     log.error(error instanceof Error ? error.message : String(error));
-    process4.exit(1);
+    process5.exit(1);
   }
 }
 var init_scope = __esm({
@@ -1156,169 +1347,260 @@ init_esm_shims();
 import { createRequire } from "module";
 import { Command } from "commander";
 
-// src/commands/auth.ts
+// src/commands/agents.ts
 init_esm_shims();
-init_api();
-init_config();
-init_tui();
-import process5 from "process";
-async function configureDefaultScopeAsync(serverUrl) {
-  const shouldConfigureScope = await confirm({
-    message: "Configure organization and scope defaults now?",
-    initialValue: true
-  });
-  if (isCancel(shouldConfigureScope) || !shouldConfigureScope) {
-    return;
+
+// src/lib/agent-writer.ts
+init_esm_shims();
+import { mkdir, writeFile } from "fs/promises";
+import { dirname, resolve, sep } from "path";
+import { Data, Effect, pipe } from "effect";
+
+// src/lib/agent-adapters.ts
+init_esm_shims();
+var NATIVE_AGENT_IDS = /* @__PURE__ */ new Set(["claude-code", "opencode"]);
+var MAPPED_AGENT_IDS = /* @__PURE__ */ new Set([
+  "cursor",
+  "windsurf",
+  "cline",
+  "roo",
+  "codex"
+]);
+var resolveProfile = (agent) => {
+  if (NATIVE_AGENT_IDS.has(agent.id)) {
+    return {
+      tier: "native",
+      supportsGlobalInstall: Boolean(agent.agentsGlobalPath),
+      supportsProjectInstall: Boolean(agent.agentsProjectPath),
+      notes: "Native subagent/frontmatter format supported."
+    };
   }
-  const { scopeCommand: scopeCommand2 } = await Promise.resolve().then(() => (init_scope(), scope_exports));
-  const config = await loadMergedConfigAsync();
-  await scopeCommand2({
-    file: "user",
-    server: serverUrl,
-    ...config.token ? { apiKey: config.token } : {}
-  });
-}
-async function authCommand(options) {
-  intro("braid auth");
-  const config = await loadMergedConfigAsync();
-  if (config.token) {
-    const shouldReplace = await confirm({
-      message: "An API key is already configured. Replace it?",
-      initialValue: false
-    });
-    if (isCancel(shouldReplace) || !shouldReplace) {
-      outro("Auth cancelled.");
-      return;
-    }
+  if (MAPPED_AGENT_IDS.has(agent.id)) {
+    return {
+      tier: "mapped",
+      supportsGlobalInstall: Boolean(agent.globalPath),
+      supportsProjectInstall: Boolean(agent.projectPath),
+      notes: "No native agent file format confirmed; install as compatibility artifacts."
+    };
   }
-  const apiKey = await password({
-    message: "Enter your braid API key:",
-    validate: (value) => {
-      if (!value) {
-        return "API key is required";
-      }
-      if (!value.startsWith("br_")) {
-        return "API key should start with 'br_'";
-      }
-      return void 0;
+  return {
+    tier: "compat",
+    supportsGlobalInstall: Boolean(agent.globalPath),
+    supportsProjectInstall: Boolean(agent.projectPath),
+    notes: "Install compatibility output only, with capability warning surfaced to user."
+  };
+};
+
+// src/lib/agent-writer.ts
+var AgentWriteError = class extends Data.TaggedError("AgentWriteError") {
+};
+var isObjectRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var slugify = (value) => value.toLowerCase().replace(/[^a-z0-9\s-]/g, "").replace(/\s+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+var escapeYaml = (value) => value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+var toYamlLines = (key, value, indent = 0) => {
+  const prefix = " ".repeat(indent);
+  const nestedPrefix = " ".repeat(indent + 2);
+  if (typeof value === "string") {
+    return [`${prefix}${key}: "${escapeYaml(value)}"`];
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return [`${prefix}${key}: ${value}`];
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      return [`${prefix}${key}: []`];
     }
-  });
-  if (isCancel(apiKey)) {
-    cancel("Auth cancelled.");
-    process5.exit(0);
+    return [
+      `${prefix}${key}:`,
+      ...value.map((item) => {
+        if (typeof item === "string" || typeof item === "number" || typeof item === "boolean") {
+          return `${nestedPrefix}- ${typeof item === "string" ? `"${escapeYaml(item)}"` : item}`;
+        }
+        if (isObjectRecord(item)) {
+          const nested = Object.entries(item).flatMap(
+            ([nestedKey, nestedValue]) => toYamlLines(nestedKey, nestedValue, indent + 4)
+          );
+          return `${nestedPrefix}-
+${nested.join("\n")}`;
+        }
+        return `${nestedPrefix}- null`;
+      })
+    ];
   }
-  const authSpinner = spinner();
-  let authSpinnerActive = true;
-  const stopAuthSpinner = (message) => {
-    if (!authSpinnerActive) {
-      return;
-    }
-    authSpinner.stop(message);
-    authSpinnerActive = false;
-  };
-  authSpinner.start("Validating API key...");
-  try {
-    const serverUrl = options.server ?? "https://braid.cloud";
-    const isValid = await validateApiKeyAsync(apiKey, serverUrl);
-    if (!isValid) {
-      stopAuthSpinner("Invalid API key");
-      log.error(
-        "The API key could not be validated. Please check your key and try again."
-      );
-      process5.exit(1);
+  if (isObjectRecord(value)) {
+    const entries = Object.entries(value);
+    if (entries.length === 0) {
+      return [`${prefix}${key}: {}`];
     }
-    await setApiKeyAsync(apiKey);
-    const existingUserConfig = await loadUserConfigAsync();
-    if (existingUserConfig?.token) {
-      await saveUserConfigAsync({ ...existingUserConfig, token: apiKey });
+    return [
+      `${prefix}${key}:`,
+      ...entries.flatMap(
+        ([nestedKey, nestedValue]) => toYamlLines(nestedKey, nestedValue, indent + 2)
+      )
+    ];
+  }
+  return [];
+};
+var buildClaudeMarkdown = (spec) => {
+  const lines = ["---"];
+  lines.push(...toYamlLines("name", spec.name));
+  lines.push(...toYamlLines("description", spec.description));
+  if (spec.model) {
+    lines.push(...toYamlLines("model", spec.model));
+  }
+  if (spec.tools !== void 0) {
+    lines.push(...toYamlLines("tools", spec.tools));
+  }
+  if (spec.permission !== void 0) {
+    lines.push(...toYamlLines("permissionMode", spec.permission));
+  }
+  if (spec.steps !== void 0) {
+    lines.push(...toYamlLines("maxTurns", spec.steps));
+  }
+  if (spec.temperature !== void 0) {
+    lines.push(...toYamlLines("temperature", spec.temperature));
+  }
+  if (spec.linkedSkillNames && spec.linkedSkillNames.length > 0) {
+    lines.push(...toYamlLines("skills", spec.linkedSkillNames));
+  }
+  if (spec.additional) {
+    for (const [key, value] of Object.entries(spec.additional)) {
+      lines.push(...toYamlLines(key, value));
     }
-    stopAuthSpinner("API key validated and saved");
-    await configureDefaultScopeAsync(serverUrl);
-    log.success(`Config saved to ${CONFIG_FILE}`);
-    outro(
-      "You're authenticated! Run 'braid install --profile <name>' to install skills."
-    );
-  } catch (error) {
-    stopAuthSpinner("Validation failed");
-    const message = error instanceof Error ? error.message : String(error);
-    log.error(`Failed to validate API key: ${message}`);
-    process5.exit(1);
   }
-}
-async function displayTokenSource(masked) {
-  if (process5.env.BRAID_API_KEY) {
-    log.info(`Authenticated with key: ${masked}`);
-    log.info("Source: BRAID_API_KEY environment variable");
-    return;
+  lines.push("---", "", spec.prompt.trim(), "");
+  return lines.join("\n");
+};
+var buildOpenCodeMarkdown = (spec) => {
+  const lines = ["---"];
+  lines.push(...toYamlLines("description", spec.description));
+  if (spec.mode) {
+    lines.push(...toYamlLines("mode", spec.mode));
   }
-  const userConfigPath = await findUserConfigFileAsync();
-  log.info(`Authenticated with key: ${masked}`);
-  log.info(`Source: ${userConfigPath ?? CONFIG_FILE}`);
-}
-async function displayProjectConfig() {
-  const projectConfigPath = await findProjectConfigFileAsync();
-  if (projectConfigPath) {
-    log.info(`Project config: ${projectConfigPath}`);
+  if (spec.model) {
+    lines.push(...toYamlLines("model", spec.model));
   }
-}
-function displayResolvedSettings(config) {
-  const hasOrgProjects = config.orgProjects && config.orgProjects.length > 0;
-  const hasPersonalProjects = config.personalProjects && config.personalProjects.length > 0;
-  if (!(config.profile || hasOrgProjects || hasPersonalProjects)) {
-    return;
+  if (spec.tools !== void 0) {
+    lines.push(...toYamlLines("tools", spec.tools));
   }
-  log.info("");
-  if (config.profile) {
-    log.info(`Default profile: ${config.profile}`);
+  if (spec.permission !== void 0) {
+    lines.push(...toYamlLines("permission", spec.permission));
   }
-  if (hasOrgProjects) {
-    log.info(`Org projects: ${config.orgProjects?.join(", ")}`);
+  if (spec.steps !== void 0) {
+    lines.push(...toYamlLines("steps", spec.steps));
   }
-  if (hasPersonalProjects) {
-    log.info(`Personal projects: ${config.personalProjects?.join(", ")}`);
+  if (spec.temperature !== void 0) {
+    lines.push(...toYamlLines("temperature", spec.temperature));
   }
-  if (config.serverUrl !== "https://braid.cloud") {
-    log.info(`Server: ${config.serverUrl}`);
+  if (spec.topP !== void 0) {
+    lines.push(...toYamlLines("top_p", spec.topP));
   }
-}
-async function authStatusCommand() {
-  const config = await loadMergedConfigAsync();
-  if (!config.token) {
-    log.warn("Not authenticated. Run 'braid auth' to configure your API key.");
-    log.info(
-      `Or create a ${USER_CONFIG_FILENAME} file with: { "token": "br_xxx" }`
-    );
-    return;
+  if (spec.hidden !== void 0) {
+    lines.push(...toYamlLines("hidden", spec.hidden));
   }
-  const masked = `${config.token.slice(0, 7)}...${config.token.slice(-4)}`;
-  await displayTokenSource(masked);
-  await displayProjectConfig();
-  displayResolvedSettings(config);
-}
-async function authLogoutCommand() {
-  const { clearApiKeyAsync: clearApiKeyAsync2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  await clearApiKeyAsync2();
-  log.success("Logged out. API key removed from config.");
-}
-
-// src/commands/install.ts
-init_esm_shims();
-
-// src/lib/agents.ts
-init_esm_shims();
-import { access, constants } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-import process6 from "process";
-import { Effect as Effect3, pipe as pipe3 } from "effect";
-var home = homedir2();
-var vscodeExtSettingsPath = (extensionId, filename) => {
-  if (process6.platform === "darwin") {
-    return join2(
-      home,
-      "Library",
-      "Application Support",
-      "Code",
+  if (spec.color) {
+    lines.push(...toYamlLines("color", spec.color));
+  }
+  if (spec.additional) {
+    for (const [key, value] of Object.entries(spec.additional)) {
+      lines.push(...toYamlLines(key, value));
+    }
+  }
+  lines.push("---", "", spec.prompt.trim(), "");
+  return lines.join("\n");
+};
+var buildCompatMarkdown = (spec, source) => [
+  "# Compatibility Agent",
+  "",
+  `Source: ${source}`,
+  `Name: ${spec.name}`,
+  "",
+  spec.prompt.trim(),
+  ""
+].join("\n");
+var assertWithinBase = (basePath, filename) => {
+  const resolvedBase = resolve(basePath);
+  const resolvedPath = resolve(basePath, filename);
+  if (resolvedPath !== resolvedBase && !resolvedPath.startsWith(`${resolvedBase}${sep}`)) {
+    throw new Error(`Path traversal detected: ${filename}`);
+  }
+  return resolvedPath;
+};
+var writeSingleAgent = (installPath, platform2, spec) => Effect.tryPromise({
+  try: async () => {
+    const profile = resolveProfile(platform2);
+    const fileStem = slugify(spec.name) || "agent";
+    const filename = `${fileStem}.md`;
+    const fullPath = assertWithinBase(installPath, filename);
+    await mkdir(dirname(fullPath), { recursive: true });
+    const warnings = [];
+    let content;
+    if (platform2.id === "claude-code") {
+      if (spec.mode === "primary") {
+        warnings.push(
+          "Claude adapter does not support primary mode; using subagent semantics."
+        );
+      }
+      content = buildClaudeMarkdown(spec);
+    } else if (platform2.id === "opencode") {
+      content = buildOpenCodeMarkdown(spec);
+    } else {
+      warnings.push(
+        `Platform ${platform2.id} uses ${profile.tier} adapter with compatibility output.`
+      );
+      content = buildCompatMarkdown(spec, platform2.name);
+    }
+    await writeFile(fullPath, content, "utf-8");
+    return { written: fullPath, warnings };
+  },
+  catch: (cause) => new AgentWriteError({ path: installPath, operation: "write", cause })
+});
+var writeAgentsForPlatform = (platform2, specs, installPath) => pipe(
+  Effect.forEach(
+    specs,
+    (spec) => pipe(
+      writeSingleAgent(installPath, platform2, spec),
+      Effect.map((result) => ({
+        success: true,
+        written: result.written,
+        warnings: result.warnings
+      })),
+      Effect.catchAll(
+        (error) => Effect.succeed({
+          success: false,
+          error: error.cause instanceof Error ? error.cause.message : String(error.cause),
+          specName: spec.name
+        })
+      )
+    ),
+    { concurrency: "unbounded" }
+  ),
+  Effect.map((results) => {
+    const written = results.filter((r) => r.success).map((r) => r.written).sort();
+    const warnings = results.filter((r) => r.success).flatMap((r) => r.warnings);
+    const errors = results.filter(
+      (r) => !r.success
+    ).map((r) => ({ agent: r.specName, error: r.error }));
+    return { written, warnings, errors };
+  })
+);
+var writeAgentsForPlatformAsync = (platform2, specs, installPath) => Effect.runPromise(writeAgentsForPlatform(platform2, specs, installPath));
+
+// src/lib/agents.ts
+init_esm_shims();
+import { access, constants } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+import process2 from "process";
+import { Effect as Effect2, pipe as pipe2 } from "effect";
+var home = homedir();
+var vscodeExtSettingsPath = (extensionId, filename) => {
+  if (process2.platform === "darwin") {
+    return join(
+      home,
+      "Library",
+      "Application Support",
+      "Code",
       "User",
       "globalStorage",
       extensionId,
@@ -1326,9 +1608,9 @@ var vscodeExtSettingsPath = (extensionId, filename) => {
       filename
     );
   }
-  if (process6.platform === "win32") {
-    const appData = process6.env.APPDATA ?? join2(home, "AppData", "Roaming");
-    return join2(
+  if (process2.platform === "win32") {
+    const appData = process2.env.APPDATA ?? join(home, "AppData", "Roaming");
+    return join(
       appData,
       "Code",
       "User",
@@ -1338,7 +1620,7 @@ var vscodeExtSettingsPath = (extensionId, filename) => {
       filename
     );
   }
-  return join2(
+  return join(
     home,
     ".config",
     "Code",
@@ -1350,8 +1632,8 @@ var vscodeExtSettingsPath = (extensionId, filename) => {
   );
 };
 var claudeDesktopConfigPath = () => {
-  if (process6.platform === "darwin") {
-    return join2(
+  if (process2.platform === "darwin") {
+    return join(
       home,
       "Library",
       "Application Support",
@@ -1359,46 +1641,48 @@ var claudeDesktopConfigPath = () => {
       "claude_desktop_config.json"
     );
   }
-  if (process6.platform === "win32") {
-    const appData = process6.env.APPDATA ?? join2(home, "AppData", "Roaming");
-    return join2(appData, "Claude", "claude_desktop_config.json");
+  if (process2.platform === "win32") {
+    const appData = process2.env.APPDATA ?? join(home, "AppData", "Roaming");
+    return join(appData, "Claude", "claude_desktop_config.json");
   }
-  return join2(home, ".config", "Claude", "claude_desktop_config.json");
+  return join(home, ".config", "Claude", "claude_desktop_config.json");
 };
 var AGENTS = [
   {
     id: "amp",
     name: "Amp",
     projectPath: ".agents/skills",
-    globalPath: join2(home, ".config", "agents", "skills"),
+    globalPath: join(home, ".config", "agents", "skills"),
     mcpProjectConfigPath: ".amp/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".amp", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".amp", "mcp.json")
   },
   {
     id: "kimi-cli",
     name: "Kimi Code CLI",
     projectPath: ".agents/skills",
-    globalPath: join2(home, ".config", "agents", "skills"),
+    globalPath: join(home, ".config", "agents", "skills"),
     mcpProjectConfigPath: ".agents/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".config", "agents", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".config", "agents", "mcp.json")
   },
   {
     id: "antigravity",
     name: "Antigravity",
     projectPath: ".agent/skills",
-    globalPath: join2(home, ".gemini", "antigravity", "global_skills"),
+    globalPath: join(home, ".gemini", "antigravity", "global_skills"),
     mcpProjectConfigPath: ".agent/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".gemini", "antigravity", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".gemini", "antigravity", "mcp.json")
   },
   {
     id: "claude-code",
     name: "Claude Code",
     projectPath: ".claude/skills",
-    globalPath: join2(home, ".claude", "skills"),
+    globalPath: join(home, ".claude", "skills"),
+    agentsProjectPath: ".claude/agents",
+    agentsGlobalPath: join(home, ".claude", "agents"),
     projectMarkerPath: ".claude",
-    globalMarkerPath: join2(home, ".claude"),
+    globalMarkerPath: join(home, ".claude"),
     rulesProjectPath: ".claude/rules",
-    rulesGlobalPath: join2(home, ".claude", "rules"),
+    rulesGlobalPath: join(home, ".claude", "rules"),
     ruleFormat: "markdown-dir",
     mcpProjectConfigPath: ".mcp.json",
     mcpEntryStyle: "typed-stdio"
@@ -1414,15 +1698,15 @@ var AGENTS = [
     id: "moltbot",
     name: "Moltbot",
     projectPath: "skills",
-    globalPath: join2(home, ".moltbot", "skills"),
+    globalPath: join(home, ".moltbot", "skills"),
     mcpProjectConfigPath: "mcp.json",
-    mcpGlobalConfigPath: join2(home, ".moltbot", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".moltbot", "mcp.json")
   },
   {
     id: "cline",
     name: "Cline",
     projectPath: ".cline/skills",
-    globalPath: join2(home, ".cline", "skills"),
+    globalPath: join(home, ".cline", "skills"),
     rulesProjectPath: ".clinerules",
     ruleFormat: "append-single",
     mcpGlobalConfigPath: vscodeExtSettingsPath(
@@ -1435,73 +1719,73 @@ var AGENTS = [
     id: "codebuddy",
     name: "CodeBuddy",
     projectPath: ".codebuddy/skills",
-    globalPath: join2(home, ".codebuddy", "skills"),
+    globalPath: join(home, ".codebuddy", "skills"),
     mcpProjectConfigPath: ".codebuddy/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".codebuddy", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".codebuddy", "mcp.json")
   },
   {
     id: "codex",
     name: "Codex",
     projectPath: ".codex/skills",
-    globalPath: join2(home, ".codex", "skills"),
+    globalPath: join(home, ".codex", "skills"),
     mcpProjectConfigPath: ".codex/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".codex", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".codex", "mcp.json")
   },
   {
     id: "command-code",
     name: "Command Code",
     projectPath: ".commandcode/skills",
-    globalPath: join2(home, ".commandcode", "skills"),
+    globalPath: join(home, ".commandcode", "skills"),
     mcpProjectConfigPath: ".commandcode/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".commandcode", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".commandcode", "mcp.json")
   },
   {
     id: "continue",
     name: "Continue",
     projectPath: ".continue/skills",
-    globalPath: join2(home, ".continue", "skills"),
+    globalPath: join(home, ".continue", "skills"),
     mcpProjectConfigPath: ".continue/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".continue", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".continue", "mcp.json")
   },
   {
     id: "crush",
     name: "Crush",
     projectPath: ".crush/skills",
-    globalPath: join2(home, ".config", "crush", "skills"),
+    globalPath: join(home, ".config", "crush", "skills"),
     mcpProjectConfigPath: ".crush/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".config", "crush", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".config", "crush", "mcp.json")
   },
   {
     id: "cursor",
     name: "Cursor",
     projectPath: ".cursor/skills",
-    globalPath: join2(home, ".cursor", "skills"),
+    globalPath: join(home, ".cursor", "skills"),
     rulesProjectPath: ".cursor/rules",
     ruleFormat: "mdc",
     mcpProjectConfigPath: ".cursor/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".cursor", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".cursor", "mcp.json")
   },
   {
     id: "droid",
     name: "Droid",
     projectPath: ".factory/skills",
-    globalPath: join2(home, ".factory", "skills"),
+    globalPath: join(home, ".factory", "skills"),
     mcpProjectConfigPath: ".factory/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".factory", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".factory", "mcp.json")
   },
   {
     id: "gemini-cli",
     name: "Gemini CLI",
     projectPath: ".gemini/skills",
-    globalPath: join2(home, ".gemini", "skills"),
+    globalPath: join(home, ".gemini", "skills"),
     mcpProjectConfigPath: ".gemini/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".gemini", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".gemini", "mcp.json")
   },
   {
     id: "github-copilot",
     name: "GitHub Copilot",
     projectPath: ".github/skills",
-    globalPath: join2(home, ".copilot", "skills"),
+    globalPath: join(home, ".copilot", "skills"),
     rulesProjectPath: ".github/copilot-instructions.md",
     ruleFormat: "append-single",
     mcpProjectConfigPath: ".vscode/mcp.json",
@@ -1512,22 +1796,22 @@ var AGENTS = [
     id: "goose",
     name: "Goose",
     projectPath: ".goose/skills",
-    globalPath: join2(home, ".config", "goose", "skills"),
-    mcpGlobalConfigPath: join2(home, ".config", "goose", "mcp.json")
+    globalPath: join(home, ".config", "goose", "skills"),
+    mcpGlobalConfigPath: join(home, ".config", "goose", "mcp.json")
   },
   {
     id: "junie",
     name: "Junie",
     projectPath: ".junie/skills",
-    globalPath: join2(home, ".junie", "skills"),
+    globalPath: join(home, ".junie", "skills"),
     mcpProjectConfigPath: ".junie/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".junie", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".junie", "mcp.json")
   },
   {
     id: "kilo",
     name: "Kilo Code",
     projectPath: ".kilocode/skills",
-    globalPath: join2(home, ".kilocode", "skills"),
+    globalPath: join(home, ".kilocode", "skills"),
     mcpGlobalConfigPath: vscodeExtSettingsPath(
       "kilocode.kilo-code",
       "mcp_settings.json"
@@ -1538,81 +1822,83 @@ var AGENTS = [
     id: "kiro-cli",
     name: "Kiro CLI",
     projectPath: ".kiro/skills",
-    globalPath: join2(home, ".kiro", "skills"),
+    globalPath: join(home, ".kiro", "skills"),
     mcpProjectConfigPath: ".kiro/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".kiro", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".kiro", "mcp.json")
   },
   {
     id: "kode",
     name: "Kode",
     projectPath: ".kode/skills",
-    globalPath: join2(home, ".kode", "skills"),
+    globalPath: join(home, ".kode", "skills"),
     mcpProjectConfigPath: ".kode/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".kode", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".kode", "mcp.json")
   },
   {
     id: "mcpjam",
     name: "MCPJam",
     projectPath: ".mcpjam/skills",
-    globalPath: join2(home, ".mcpjam", "skills"),
+    globalPath: join(home, ".mcpjam", "skills"),
     mcpProjectConfigPath: ".mcpjam/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".mcpjam", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".mcpjam", "mcp.json")
   },
   {
     id: "mux",
     name: "Mux",
     projectPath: ".mux/skills",
-    globalPath: join2(home, ".mux", "skills"),
+    globalPath: join(home, ".mux", "skills"),
     mcpProjectConfigPath: ".mux/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".mux", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".mux", "mcp.json")
   },
   {
     id: "opencode",
     name: "OpenCode",
     projectPath: ".opencode/skills",
-    globalPath: join2(home, ".config", "opencode", "skills"),
+    globalPath: join(home, ".config", "opencode", "skills"),
+    agentsProjectPath: ".opencode/agents",
+    agentsGlobalPath: join(home, ".config", "opencode", "agents"),
     mcpProjectConfigPath: ".opencode/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".config", "opencode", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".config", "opencode", "mcp.json")
   },
   {
     id: "openhands",
     name: "OpenHands",
     projectPath: ".openhands/skills",
-    globalPath: join2(home, ".openhands", "skills"),
+    globalPath: join(home, ".openhands", "skills"),
     mcpProjectConfigPath: ".openhands/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".openhands", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".openhands", "mcp.json")
   },
   {
     id: "pi",
     name: "Pi",
     projectPath: ".pi/skills",
-    globalPath: join2(home, ".pi", "agent", "skills"),
+    globalPath: join(home, ".pi", "agent", "skills"),
     mcpProjectConfigPath: ".pi/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".pi", "agent", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".pi", "agent", "mcp.json")
   },
   {
     id: "qoder",
     name: "Qoder",
     projectPath: ".qoder/skills",
-    globalPath: join2(home, ".qoder", "skills"),
+    globalPath: join(home, ".qoder", "skills"),
     mcpProjectConfigPath: ".qoder/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".qoder", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".qoder", "mcp.json")
   },
   {
     id: "qwen-code",
     name: "Qwen Code",
     projectPath: ".qwen/skills",
-    globalPath: join2(home, ".qwen", "skills"),
+    globalPath: join(home, ".qwen", "skills"),
     mcpProjectConfigPath: ".qwen/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".qwen", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".qwen", "mcp.json")
   },
   {
     id: "roo",
     name: "Roo Code",
     projectPath: ".roo/skills",
-    globalPath: join2(home, ".roo", "skills"),
+    globalPath: join(home, ".roo", "skills"),
     rulesProjectPath: ".roo/rules",
-    rulesGlobalPath: join2(home, ".roo", "rules"),
+    rulesGlobalPath: join(home, ".roo", "rules"),
     ruleFormat: "markdown-dir",
     mcpGlobalConfigPath: vscodeExtSettingsPath(
       "rooveterinaryinc.roo-cline",
@@ -1624,42 +1910,42 @@ var AGENTS = [
     id: "trae",
     name: "Trae",
     projectPath: ".trae/skills",
-    globalPath: join2(home, ".trae", "skills"),
+    globalPath: join(home, ".trae", "skills"),
     mcpProjectConfigPath: ".trae/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".trae", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".trae", "mcp.json")
   },
   {
     id: "windsurf",
     name: "Windsurf",
     projectPath: ".windsurf/skills",
-    globalPath: join2(home, ".codeium", "windsurf", "skills"),
+    globalPath: join(home, ".codeium", "windsurf", "skills"),
     rulesProjectPath: ".windsurfrules",
     ruleFormat: "append-single",
-    mcpGlobalConfigPath: join2(home, ".codeium", "windsurf", "mcp_config.json")
+    mcpGlobalConfigPath: join(home, ".codeium", "windsurf", "mcp_config.json")
   },
   {
     id: "zencoder",
     name: "Zencoder",
     projectPath: ".zencoder/skills",
-    globalPath: join2(home, ".zencoder", "skills"),
+    globalPath: join(home, ".zencoder", "skills"),
     mcpProjectConfigPath: ".zencoder/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".zencoder", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".zencoder", "mcp.json")
   },
   {
     id: "neovate",
     name: "Neovate",
     projectPath: ".neovate/skills",
-    globalPath: join2(home, ".neovate", "skills"),
+    globalPath: join(home, ".neovate", "skills"),
     mcpProjectConfigPath: ".neovate/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".neovate", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".neovate", "mcp.json")
   },
   {
     id: "pochi",
     name: "Pochi",
     projectPath: ".pochi/skills",
-    globalPath: join2(home, ".pochi", "skills"),
+    globalPath: join(home, ".pochi", "skills"),
     mcpProjectConfigPath: ".pochi/mcp.json",
-    mcpGlobalConfigPath: join2(home, ".pochi", "mcp.json")
+    mcpGlobalConfigPath: join(home, ".pochi", "mcp.json")
   },
   {
     id: "zed",
@@ -1667,38 +1953,38 @@ var AGENTS = [
     projectPath: "",
     globalPath: "",
     projectMarkerPath: ".zed",
-    globalMarkerPath: join2(home, ".config", "zed"),
+    globalMarkerPath: join(home, ".config", "zed"),
     rulesProjectPath: ".zed/rules",
-    rulesGlobalPath: join2(home, ".config", "zed", "rules"),
+    rulesGlobalPath: join(home, ".config", "zed", "rules"),
     ruleFormat: "markdown-dir",
-    mcpGlobalConfigPath: join2(home, ".config", "zed", "settings.json"),
+    mcpGlobalConfigPath: join(home, ".config", "zed", "settings.json"),
     mcpRootKey: "context_servers",
     mcpEntryStyle: "zed"
   }
 ];
-var directoryExists = (path2) => pipe3(
-  Effect3.tryPromise({
+var directoryExists = (path2) => pipe2(
+  Effect2.tryPromise({
     try: () => access(path2, constants.F_OK),
     catch: () => false
   }),
-  Effect3.map(() => true),
-  Effect3.orElseSucceed(() => false)
+  Effect2.map(() => true),
+  Effect2.orElseSucceed(() => false)
 );
 var detectAgents = (projectRoot) => {
-  const cwd = projectRoot ?? process6.cwd();
-  return pipe3(
-    Effect3.forEach(
+  const cwd = projectRoot ?? process2.cwd();
+  return pipe2(
+    Effect2.forEach(
       AGENTS,
-      (agent) => pipe3(
-        Effect3.all({
-          hasProjectConfig: agent.projectPath ? directoryExists(join2(cwd, agent.projectPath)) : Effect3.succeed(false),
-          hasGlobalConfig: agent.globalPath ? directoryExists(agent.globalPath) : Effect3.succeed(false),
-          hasProjectMarker: agent.projectMarkerPath ? directoryExists(join2(cwd, agent.projectMarkerPath)) : Effect3.succeed(false),
-          hasGlobalMarker: agent.globalMarkerPath ? directoryExists(agent.globalMarkerPath) : Effect3.succeed(false),
-          hasRulesProjectConfig: agent.rulesProjectPath ? directoryExists(join2(cwd, agent.rulesProjectPath)) : Effect3.succeed(false),
-          hasRulesGlobalConfig: agent.rulesGlobalPath ? directoryExists(agent.rulesGlobalPath) : Effect3.succeed(false)
+      (agent) => pipe2(
+        Effect2.all({
+          hasProjectConfig: agent.projectPath ? directoryExists(join(cwd, agent.projectPath)) : Effect2.succeed(false),
+          hasGlobalConfig: agent.globalPath ? directoryExists(agent.globalPath) : Effect2.succeed(false),
+          hasProjectMarker: agent.projectMarkerPath ? directoryExists(join(cwd, agent.projectMarkerPath)) : Effect2.succeed(false),
+          hasGlobalMarker: agent.globalMarkerPath ? directoryExists(agent.globalMarkerPath) : Effect2.succeed(false),
+          hasRulesProjectConfig: agent.rulesProjectPath ? directoryExists(join(cwd, agent.rulesProjectPath)) : Effect2.succeed(false),
+          hasRulesGlobalConfig: agent.rulesGlobalPath ? directoryExists(agent.rulesGlobalPath) : Effect2.succeed(false)
         }),
-        Effect3.map(
+        Effect2.map(
           ({
             hasProjectConfig,
             hasGlobalConfig,
@@ -1715,14 +2001,14 @@ var detectAgents = (projectRoot) => {
       ),
       { concurrency: "unbounded" }
     ),
-    Effect3.map(
-      (agents) => agents.filter((a) => a.hasProjectConfig || a.hasGlobalConfig)
+    Effect2.map(
+      (agents2) => agents2.filter((a) => a.hasProjectConfig || a.hasGlobalConfig)
     )
   );
 };
 var getAgentById = (id) => AGENTS.find((a) => a.id === id);
-var detectAgentsAsync = (projectRoot) => Effect3.runPromise(detectAgents(projectRoot));
-var directoryExistsAsync = (path2) => Effect3.runPromise(directoryExists(path2));
+var detectAgentsAsync = (projectRoot) => Effect2.runPromise(detectAgents(projectRoot));
+var directoryExistsAsync = (path2) => Effect2.runPromise(directoryExists(path2));
 var resolveInstallPath = (agent, options) => {
   if (options.global) {
     return agent.globalPath || void 0;
@@ -1730,8 +2016,18 @@ var resolveInstallPath = (agent, options) => {
   if (!agent.projectPath) {
     return void 0;
   }
-  const cwd = options.projectRoot ?? process6.cwd();
-  return join2(cwd, agent.projectPath);
+  const cwd = options.projectRoot ?? process2.cwd();
+  return join(cwd, agent.projectPath);
+};
+var resolveAgentsInstallPath = (agent, options) => {
+  if (options.global) {
+    return agent.agentsGlobalPath;
+  }
+  if (!agent.agentsProjectPath) {
+    return void 0;
+  }
+  const cwd = options.projectRoot ?? process2.cwd();
+  return join(cwd, agent.agentsProjectPath);
 };
 var resolveRulesInstallPath = (agent, options) => {
   if (options.global) {
@@ -1740,23 +2036,24 @@ var resolveRulesInstallPath = (agent, options) => {
   if (!agent.rulesProjectPath) {
     return void 0;
   }
-  const cwd = options.projectRoot ?? process6.cwd();
-  return join2(cwd, agent.rulesProjectPath);
+  const cwd = options.projectRoot ?? process2.cwd();
+  return join(cwd, agent.rulesProjectPath);
 };
 var hasMcpConfig = (agent) => Boolean(agent.mcpProjectConfigPath) || Boolean(agent.mcpGlobalConfigPath);
+var MCP_PACKAGE_SPEC = "@braid-cloud/mcp@0.1.11";
 var resolveMcpConfigPath = (agent, options) => {
   if (options.global) {
     return agent.mcpGlobalConfigPath;
   }
   if (agent.mcpProjectConfigPath) {
-    const cwd = options.projectRoot ?? process6.cwd();
-    return join2(cwd, agent.mcpProjectConfigPath);
+    const cwd = options.projectRoot ?? process2.cwd();
+    return join(cwd, agent.mcpProjectConfigPath);
   }
   return agent.mcpGlobalConfigPath;
 };
 var buildMcpEntry = (style, env) => {
   const command = "npx";
-  const args = ["-y", "@braid-cloud/mcp"];
+  const args = ["-y", MCP_PACKAGE_SPEC];
   const envObj = Object.keys(env).length > 0 ? env : void 0;
   switch (style) {
     case "standard":
@@ -1771,178 +2068,1012 @@ var buildMcpEntry = (style, env) => {
       return envObj ? { command, args, env: envObj } : { command, args };
   }
 };
-var detectMcpAgents = (projectRoot) => Effect3.runPromise(
-  pipe3(
+var detectMcpAgents = (projectRoot) => Effect2.runPromise(
+  pipe2(
     detectAgents(projectRoot),
-    Effect3.map((detected) => detected.filter(hasMcpConfig))
+    Effect2.map((detected) => detected.filter(hasMcpConfig))
   )
 );
 
-// src/commands/install.ts
+// src/commands/agents.ts
 init_api();
-init_config();
-
-// src/lib/metadata.ts
-init_esm_shims();
-import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { join as join3 } from "path";
-import { Data as Data3, Effect as Effect4, pipe as pipe4 } from "effect";
-var METADATA_FILENAME = ".braidskills-metadata.json";
-var MetadataReadError = class extends Data3.TaggedError("MetadataReadError") {
+init_tui();
+var parseCsv = (input) => {
+  if (!input) {
+    return void 0;
+  }
+  const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  return values.length > 0 ? values : void 0;
 };
-var MetadataWriteError = class extends Data3.TaggedError("MetadataWriteError") {
+var writeJson = (value) => {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
 };
-var getMetadataPath = (skillsDir) => join3(skillsDir, METADATA_FILENAME);
-var readMetadata = (skillsDir) => {
-  const metadataPath = getMetadataPath(skillsDir);
-  return pipe4(
-    Effect4.tryPromise({
-      try: () => readFile2(metadataPath, "utf-8"),
-      catch: (e) => new MetadataReadError({ path: metadataPath, cause: e })
-    }),
-    Effect4.flatMap(
-      (content) => Effect4.try({
-        try: () => JSON.parse(content),
-        catch: () => ({ skills: [] })
-      })
-    ),
-    Effect4.orElseSucceed(() => ({ skills: [] }))
+var fail = (message) => {
+  throw new Error(message);
+};
+var exitWithError = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process.exit(1);
+};
+var run = (command, args, options) => {
+  const apiOptions = {
+    ...options.server ? { serverUrl: options.server } : {},
+    ...options.apiKey ? { apiKey: options.apiKey } : {}
+  };
+  return runLifecycleCommandAsync(
+    {
+      domain: "agents",
+      command,
+      args
+    },
+    apiOptions
   );
 };
-var writeMetadata = (skillsDir, metadata) => {
-  const metadataPath = getMetadataPath(skillsDir);
-  return Effect4.tryPromise({
-    try: () => writeFile2(metadataPath, JSON.stringify(metadata, null, 2), "utf-8"),
-    catch: (e) => new MetadataWriteError({ path: metadataPath, cause: e })
-  });
+var getAgentCandidate = (value) => {
+  if (typeof value === "object" && value !== null && "agent" in value) {
+    return value.agent;
+  }
+  return value;
 };
-var updateMetadata = (skillsDir, newSkills) => pipe4(
-  readMetadata(skillsDir),
-  Effect4.map((existing) => {
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const updatedSkills = [...existing.skills];
-    for (const skill of newSkills) {
-      const existingIndex = updatedSkills.findIndex(
-        (s) => s.name === skill.name
+var getMode = (mode) => {
+  if (mode === "primary" || mode === "subagent" || mode === "all") {
+    return mode;
+  }
+  return void 0;
+};
+var getRawSkills = (agent) => {
+  if (Array.isArray(agent.skillNames)) {
+    return agent.skillNames;
+  }
+  if (Array.isArray(agent.skills)) {
+    return agent.skills;
+  }
+  return void 0;
+};
+var normalizeSpec = (value) => {
+  const candidate = getAgentCandidate(value);
+  if (typeof candidate !== "object" || candidate === null) {
+    throw new Error("Invalid agent payload from API");
+  }
+  const agent = candidate;
+  const name = typeof agent.name === "string" ? agent.name : void 0;
+  const description = typeof agent.description === "string" ? agent.description : void 0;
+  const promptFromPrompt = typeof agent.prompt === "string" ? agent.prompt : void 0;
+  const promptFromContent = typeof agent.content === "string" ? agent.content : void 0;
+  const prompt = promptFromPrompt ?? promptFromContent;
+  if (!(name && description && prompt)) {
+    throw new Error(
+      "Agent payload missing required fields: name, description, prompt"
+    );
+  }
+  const result = {
+    name,
+    description,
+    prompt
+  };
+  const mode = getMode(agent.mode);
+  if (mode) {
+    result.mode = mode;
+  }
+  if (typeof agent.model === "string") {
+    result.model = agent.model;
+  }
+  const rawSkills = getRawSkills(agent);
+  if (rawSkills) {
+    result.linkedSkillNames = rawSkills.filter(
+      (item) => typeof item === "string"
+    );
+  }
+  return result;
+};
+var resolveInstallTargets = async (options) => {
+  if (options.agents) {
+    const ids = parseCsv(options.agents) ?? [];
+    const selected = ids.map((id) => getAgentById(id)).filter(
+      (agent) => agent !== void 0
+    );
+    if (selected.length === 0) {
+      fail("No valid target agents selected");
+    }
+    return selected;
+  }
+  const detected = await detectAgentsAsync();
+  const filtered = detected.filter(
+    (agent) => options.global ? agent.hasGlobalConfig : agent.hasProjectConfig
+  );
+  if (filtered.length === 0) {
+    fail(
+      "No supported local agent installations detected. Use --agents to select targets."
+    );
+  }
+  return filtered;
+};
+async function agentsListCommand(options) {
+  try {
+    const result = await run("list", {}, options);
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents list completed");
+    writeJson(result);
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsGetCommand(options) {
+  try {
+    const id = options.id ?? fail("agents get requires --id");
+    const result = await run("get", { id }, options);
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents get completed");
+    writeJson(result);
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsCreateCommand(options) {
+  try {
+    const name = options.name ?? fail("agents create requires --name");
+    const description = options.description ?? fail("agents create requires --description");
+    const prompt = options.prompt ?? fail("agents create requires --prompt");
+    const result = await run(
+      "create",
+      {
+        name,
+        description,
+        prompt,
+        scope: options.scope,
+        projectId: options.projectId,
+        model: options.model,
+        mode: options.mode,
+        skills: parseCsv(options.skills)
+      },
+      options
+    );
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents create completed");
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsUpdateCommand(options) {
+  try {
+    const id = options.id ?? fail("agents update requires --id");
+    const result = await run(
+      "update",
+      {
+        id,
+        name: options.name,
+        description: options.description,
+        prompt: options.prompt,
+        model: options.model,
+        mode: options.mode,
+        skills: parseCsv(options.skills)
+      },
+      options
+    );
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents update completed");
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsRemoveCommand(options) {
+  try {
+    const id = options.id ?? fail("agents remove requires --id");
+    if (!options.yes) {
+      fail("agents remove requires --yes");
+    }
+    const result = await run("remove", { id, yes: true }, options);
+    if (options.json) {
+      writeJson(result);
+      return;
+    }
+    log.success("agents remove completed");
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function agentsInstallCommand(options) {
+  try {
+    const id = options.id ?? fail("agents install requires --id");
+    const payload = await run("get", { id }, options);
+    const spec = normalizeSpec(payload);
+    const targets = await resolveInstallTargets(options);
+    const summary = [];
+    for (const target of targets) {
+      const installPath = resolveAgentsInstallPath(target, { global: options.global === true }) ?? resolveInstallPath(target, { global: options.global === true });
+      if (!installPath) {
+        summary.push({
+          platform: target.id,
+          written: 0,
+          warnings: ["No install path available for this platform"],
+          errors: []
+        });
+        continue;
+      }
+      const result = await writeAgentsForPlatformAsync(
+        target,
+        [spec],
+        installPath
       );
-      const newEntry = {
-        name: skill.name,
-        source: skill.source,
-        version: skill.version,
-        installedAt: now,
-        serverUrl: skill.serverUrl
-      };
-      if (existingIndex >= 0) {
-        updatedSkills[existingIndex] = newEntry;
-      } else {
-        updatedSkills.push(newEntry);
+      summary.push({
+        platform: target.id,
+        installPath,
+        written: result.written.length,
+        warnings: result.warnings,
+        errors: result.errors
+      });
+    }
+    if (options.json) {
+      writeJson(summary);
+      return;
+    }
+    for (const item of summary) {
+      log.info(
+        `${item.platform}: ${item.written} file(s) written${item.installPath ? ` to ${item.installPath}` : ""}`
+      );
+      for (const warning of item.warnings) {
+        log.warn(`  warning: ${warning}`);
+      }
+      for (const error of item.errors) {
+        log.error(`  error (${error.agent}): ${error.error}`);
       }
     }
-    return { skills: updatedSkills };
-  }),
-  Effect4.flatMap((metadata) => writeMetadata(skillsDir, metadata))
-);
-var removeFromMetadata = (skillsDir, skillName) => pipe4(
-  readMetadata(skillsDir),
-  Effect4.map((metadata) => ({
-    skills: metadata.skills.filter((s) => s.name !== skillName)
-  })),
-  Effect4.flatMap((metadata) => writeMetadata(skillsDir, metadata))
-);
-var readMetadataAsync = (skillsDir) => Effect4.runPromise(readMetadata(skillsDir));
-var updateMetadataAsync = (skillsDir, newSkills) => Effect4.runPromise(updateMetadata(skillsDir, newSkills));
-var removeFromMetadataAsync = (skillsDir, skillName) => Effect4.runPromise(removeFromMetadata(skillsDir, skillName));
+    log.success("agents install completed");
+  } catch (error) {
+    exitWithError(error);
+  }
+}
 
-// src/lib/rule-writer.ts
+// src/commands/auth.ts
 init_esm_shims();
-import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname2, resolve, sep } from "path";
-import { Data as Data4, Effect as Effect5, pipe as pipe5 } from "effect";
-var RuleWriteError = class extends Data4.TaggedError("RuleWriteError") {
+init_api();
+init_config();
+import process6 from "process";
+
+// src/lib/device-auth.ts
+init_esm_shims();
+import { execFile } from "child_process";
+import { hostname, platform } from "os";
+var TRAILING_SLASHES = /\/+$/;
+var DeviceAuthTimeoutError = class extends Error {
+  constructor() {
+    super("Device authorization timed out");
+    this.name = "DeviceAuthTimeoutError";
+  }
 };
-var createDirectory = (dir) => Effect5.tryPromise({
-  try: () => mkdir2(dir, { recursive: true }),
-  catch: (e) => new RuleWriteError({ path: dir, operation: "mkdir", cause: e })
-});
-var writeTextFile = (fullPath, content) => Effect5.tryPromise({
-  try: () => writeFile3(fullPath, content, "utf-8"),
-  catch: (e) => new RuleWriteError({ path: fullPath, operation: "write", cause: e })
-});
-var readTextFile = (fullPath) => Effect5.tryPromise({
-  try: () => readFile3(fullPath, "utf-8"),
-  catch: (e) => new RuleWriteError({ path: fullPath, operation: "read", cause: e })
-});
-var assertRulePathWithinBase = (basePath, ruleName) => {
-  const resolvedBase = resolve(basePath);
-  const resolvedFull = resolve(basePath, ruleName);
-  if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep)) {
-    return Effect5.fail(
-      new RuleWriteError({
-        path: ruleName,
-        operation: "write",
-        cause: new Error(
-          `Path traversal detected: "${ruleName}" resolves outside base directory`
-        )
-      })
-    );
+var DeviceAuthDeniedError = class extends Error {
+  constructor() {
+    super("Device authorization was denied");
+    this.name = "DeviceAuthDeniedError";
   }
-  return Effect5.succeed(resolvedFull);
 };
-var BRAID_SECTION_START = "<!-- braid:rules:start -->";
-var BRAID_SECTION_END = "<!-- braid:rules:end -->";
-var YAML_SPECIAL_CHARS = /[\n\r:#{}[\],&*?|>!'"%@`]/;
-function escapeYamlValue(value) {
-  if (YAML_SPECIAL_CHARS.test(value) || value.startsWith(" ") || value.endsWith(" ")) {
-    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+var DeviceAuthExpiredError = class extends Error {
+  constructor() {
+    super("Device authorization code has expired");
+    this.name = "DeviceAuthExpiredError";
   }
-  return value;
+};
+var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+async function fetchAuthConfig(serverUrl) {
+  const url = `${serverUrl.replace(TRAILING_SLASHES, "")}/api/cli/auth-config`;
+  const response = await fetch(url);
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `Failed to fetch auth config (${response.status}): ${body}`
+    );
+  }
+  return response.json();
 }
-function buildMdcContent(rule) {
-  const lines = ["---"];
-  lines.push(`description: ${escapeYamlValue(rule.title)}`);
-  lines.push("alwaysApply: true");
-  lines.push("---");
-  lines.push("");
-  lines.push(`# ${rule.title}`);
-  lines.push("");
-  lines.push(rule.content);
-  return lines.join("\n");
+async function initiateDeviceAuth(convexSiteUrl, deviceInfo) {
+  const url = `${convexSiteUrl.replace(TRAILING_SLASHES, "")}/api/cli/device/authorize`;
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(deviceInfo)
+  });
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `Failed to initiate device authorization (${response.status}): ${body}`
+    );
+  }
+  return response.json();
 }
-function buildAppendContent(rules) {
-  const lines = [BRAID_SECTION_START, ""];
-  for (const rule of rules) {
-    lines.push(`## ${rule.title}`);
-    lines.push("");
-    lines.push(rule.content);
-    lines.push("");
+async function pollForSession(convexSiteUrl, deviceCode, interval, expiresIn, timeoutSeconds) {
+  const tokenUrl = `${convexSiteUrl.replace(TRAILING_SLASHES, "")}/api/cli/device/token`;
+  const deadline = Date.now() + Math.min(expiresIn, timeoutSeconds) * 1e3;
+  let currentInterval = interval;
+  while (Date.now() < deadline) {
+    await sleep(currentInterval * 1e3);
+    const response = await fetch(tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    if (response.ok) {
+      const result = await response.json();
+      return {
+        sessionToken: result.session_token,
+        expiresAt: result.expires_at,
+        user: result.user
+      };
+    }
+    let errorCode;
+    try {
+      const errorBody = await response.json();
+      errorCode = errorBody.error;
+    } catch {
+      throw new Error(`Device auth polling error: HTTP ${response.status}`);
+    }
+    if (errorCode === "authorization_pending") {
+      continue;
+    }
+    if (errorCode === "slow_down") {
+      currentInterval += 5;
+      continue;
+    }
+    if (errorCode === "expired_token") {
+      throw new DeviceAuthExpiredError();
+    }
+    if (errorCode === "access_denied") {
+      throw new DeviceAuthDeniedError();
+    }
+    throw new Error(
+      `Device auth polling error: ${errorCode ?? `HTTP ${response.status}`}`
+    );
   }
-  lines.push(BRAID_SECTION_END);
-  return lines.join("\n");
+  throw new DeviceAuthTimeoutError();
 }
-var writeMdcRules = (basePath, rules) => pipe5(
-  createDirectory(basePath),
-  Effect5.flatMap(
-    () => Effect5.forEach(
-      rules,
-      (rule) => pipe5(
-        assertRulePathWithinBase(basePath, `${rule.name}.mdc`),
-        Effect5.flatMap(
-          (filePath) => writeTextFile(filePath, buildMdcContent(rule))
-        )
-      ),
-      { concurrency: "unbounded" }
-    )
-  ),
-  Effect5.asVoid
+async function fetchSessionInfo(convexSiteUrl, sessionToken) {
+  const url = `${convexSiteUrl.replace(TRAILING_SLASHES, "")}/api/cli/sessions/me`;
+  const response = await fetch(url, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${sessionToken}`
+    }
+  });
+  if (response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `Failed to fetch session info (${response.status}): ${body}`
+    );
+  }
+  return response.json();
+}
+async function revokeSession(convexSiteUrl, sessionToken) {
+  const url = `${convexSiteUrl.replace(TRAILING_SLASHES, "")}/api/cli/sessions/me`;
+  const response = await fetch(url, {
+    method: "DELETE",
+    headers: {
+      Authorization: `Bearer ${sessionToken}`
+    }
+  });
+  if (response.status === 404) {
+    return false;
+  }
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(`Failed to revoke session (${response.status}): ${body}`);
+  }
+  return true;
+}
+var noop = () => {
+};
+function openBrowser(url) {
+  const currentPlatform = platform();
+  if (currentPlatform === "darwin") {
+    execFile("open", [url], noop);
+  } else if (currentPlatform === "win32") {
+    execFile("cmd", ["/c", "start", "", url], noop);
+  } else {
+    execFile("xdg-open", [url], noop);
+  }
+}
+function getDeviceInfo() {
+  return {
+    deviceName: hostname(),
+    deviceOs: platform(),
+    deviceHostname: hostname()
+  };
+}
+
+// src/commands/auth.ts
+init_tui();
+var SESSION_TOKEN_PREFIX = "brs_";
+var TRAILING_SLASHES2 = /\/+$/;
+var DEFAULT_TIMEOUT_SECONDS = 300;
+async function configureDefaultScopeAsync(serverUrl) {
+  const shouldConfigureScope = await confirm({
+    message: "Configure organization and scope defaults now?",
+    initialValue: true
+  });
+  if (isCancel(shouldConfigureScope) || !shouldConfigureScope) {
+    return;
+  }
+  const { scopeCommand: scopeCommand2 } = await Promise.resolve().then(() => (init_scope(), scope_exports));
+  const config = await loadMergedConfigAsync();
+  await scopeCommand2({
+    file: "user",
+    server: serverUrl,
+    ...config.token ? { apiKey: config.token } : {}
+  });
+}
+async function manualTokenFlow(apiKey, serverUrl, options) {
+  const authSpinner = spinner();
+  let authSpinnerActive = true;
+  const stopAuthSpinner = (message) => {
+    if (!authSpinnerActive) {
+      return;
+    }
+    authSpinner.stop(message);
+    authSpinnerActive = false;
+  };
+  authSpinner.start("Validating API key...");
+  try {
+    const isValid = await validateApiKeyAsync(apiKey, serverUrl);
+    if (!isValid) {
+      stopAuthSpinner("Invalid API key");
+      log.error(
+        "The API key could not be validated. Please check your key and try again."
+      );
+      process6.exit(1);
+    }
+    await setApiKeyAsync(apiKey);
+    const existingUserConfig = await loadUserConfigAsync();
+    if (existingUserConfig?.token) {
+      await saveUserConfigAsync({ ...existingUserConfig, token: apiKey });
+    }
+    stopAuthSpinner("API key validated and saved");
+    if (options.scope !== false) {
+      await configureDefaultScopeAsync(serverUrl);
+    }
+    log.success(`Config saved to ${CONFIG_FILE}`);
+    outro(
+      "You're authenticated! Run 'braid install' to use your saved scope (or pass '--profile <name>' to override)."
+    );
+  } catch (error) {
+    stopAuthSpinner("Validation failed");
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Failed to validate API key: ${message}`);
+    process6.exit(1);
+  }
+}
+function handlePollingError(error) {
+  if (error instanceof DeviceAuthTimeoutError) {
+    log.error("The device authorization timed out. Please try again.");
+  } else if (error instanceof DeviceAuthExpiredError) {
+    log.error("The device code has expired. Please try again.");
+  } else if (error instanceof DeviceAuthDeniedError) {
+    log.error("The authorization request was denied.");
+  } else {
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Authentication failed: ${message}`);
+  }
+  process6.exit(1);
+}
+async function deviceFlow(serverUrl, timeoutSeconds, options) {
+  const configSpinner = spinner();
+  configSpinner.start("Fetching auth configuration...");
+  let authConfig;
+  try {
+    authConfig = await fetchAuthConfig(serverUrl);
+    configSpinner.stop("Auth configuration loaded");
+  } catch (error) {
+    configSpinner.stop("Failed to fetch auth configuration");
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Could not connect to server: ${message}`);
+    process6.exit(1);
+  }
+  const deviceSpinner = spinner();
+  deviceSpinner.start("Initiating device authorization...");
+  let deviceAuth;
+  try {
+    deviceAuth = await initiateDeviceAuth(
+      authConfig.convexSiteUrl,
+      getDeviceInfo()
+    );
+    deviceSpinner.stop("Device authorization initiated");
+  } catch (error) {
+    deviceSpinner.stop("Failed to initiate device authorization");
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Device authorization failed: ${message}`);
+    process6.exit(1);
+  }
+  const verificationUrl = `${serverUrl.replace(TRAILING_SLASHES2, "")}/cli/authorize?user_code=${deviceAuth.user_code}`;
+  log.info("");
+  log.info("  To authenticate, visit:");
+  log.info(`  ${verificationUrl}`);
+  log.info("");
+  log.info(`  Your code: ${deviceAuth.user_code}`);
+  log.info("");
+  openBrowser(verificationUrl);
+  const expiresMinutes = Math.ceil(
+    Math.min(deviceAuth.expires_in, timeoutSeconds) / 60
+  );
+  const pollSpinner = spinner();
+  pollSpinner.start(
+    `Waiting for authentication... (expires in ${expiresMinutes} minutes)`
+  );
+  let session;
+  try {
+    session = await pollForSession(
+      authConfig.convexSiteUrl,
+      deviceAuth.device_code,
+      deviceAuth.interval,
+      deviceAuth.expires_in,
+      timeoutSeconds
+    );
+    pollSpinner.stop(`Authenticated as ${session.user.email}`);
+  } catch (error) {
+    pollSpinner.stop("Authentication failed");
+    handlePollingError(error);
+  }
+  await setApiKeyAsync(session.sessionToken);
+  if (options.scope !== false) {
+    await configureDefaultScopeAsync(authConfig.convexSiteUrl);
+  }
+  log.success(`Session saved to ${CONFIG_FILE}`);
+  outro(
+    "You're authenticated! Run 'braid install' to use your saved scope (or pass '--profile <name>' to override)."
+  );
+}
+async function authCommand(options) {
+  intro("braid auth");
+  const serverUrl = options.server ?? "https://braid.cloud";
+  const config = await loadMergedConfigAsync();
+  if (config.token) {
+    const shouldReplace = await confirm({
+      message: "An API key is already configured. Replace it?",
+      initialValue: false
+    });
+    if (isCancel(shouldReplace) || !shouldReplace) {
+      outro("Auth cancelled.");
+      return;
+    }
+  }
+  if (options.token) {
+    await manualTokenFlow(options.token, serverUrl, options);
+    return;
+  }
+  const timeoutSeconds = options.timeout ? Number.parseInt(options.timeout, 10) : DEFAULT_TIMEOUT_SECONDS;
+  if (Number.isNaN(timeoutSeconds) || timeoutSeconds <= 0) {
+    log.error("Invalid timeout value. Must be a positive number of seconds.");
+    process6.exit(1);
+  }
+  await deviceFlow(serverUrl, timeoutSeconds, options);
+}
+async function displayTokenSource(masked) {
+  if (process6.env.BRAID_API_KEY) {
+    log.info(`Authenticated with key: ${masked}`);
+    log.info("Source: BRAID_API_KEY environment variable");
+    return;
+  }
+  const userConfigPath = await findUserConfigFileAsync();
+  log.info(`Authenticated with key: ${masked}`);
+  log.info(`Source: ${userConfigPath ?? CONFIG_FILE}`);
+}
+async function displayProjectConfig() {
+  const projectConfigPath = await findProjectConfigFileAsync();
+  if (projectConfigPath) {
+    log.info(`Project config: ${projectConfigPath}`);
+  }
+}
+function displayResolvedSettings(config) {
+  const hasOrgProjects = config.orgProjects && config.orgProjects.length > 0;
+  const hasPersonalProjects = config.personalProjects && config.personalProjects.length > 0;
+  if (!(config.profile || hasOrgProjects || hasPersonalProjects)) {
+    return;
+  }
+  log.info("");
+  if (config.profile) {
+    log.info(`Default profile: ${config.profile}`);
+  }
+  if (hasOrgProjects) {
+    log.info(`Org projects: ${config.orgProjects?.join(", ")}`);
+  }
+  if (hasPersonalProjects) {
+    log.info(`Personal projects: ${config.personalProjects?.join(", ")}`);
+  }
+  if (config.serverUrl !== "https://braid.cloud") {
+    log.info(`Server: ${config.serverUrl}`);
+  }
+}
+async function displaySessionInfo(token) {
+  const serverUrl = await getServerUrlAsync();
+  try {
+    const authConfig = await fetchAuthConfig(serverUrl);
+    const info = await fetchSessionInfo(authConfig.convexSiteUrl, token);
+    if (!info) {
+      log.warn(
+        "Session is expired or revoked. Run 'braid auth' to re-authenticate."
+      );
+      return;
+    }
+    log.info(
+      `Authenticated as: ${info.email}${info.name ? ` (${info.name})` : ""}`
+    );
+    log.info("Session type: CLI session");
+    if (info.deviceName || info.deviceHostname) {
+      log.info(
+        `Device: ${info.deviceName ?? info.deviceHostname ?? "unknown"}`
+      );
+    }
+    const expiresDate = new Date(info.expiresAt);
+    const daysRemaining = Math.ceil(
+      (info.expiresAt - Date.now()) / (24 * 60 * 60 * 1e3)
+    );
+    log.info(
+      `Expires: ${expiresDate.toLocaleDateString()} (${daysRemaining} days)`
+    );
+    if (info.lastActiveAt) {
+      log.info(`Last active: ${new Date(info.lastActiveAt).toLocaleString()}`);
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    log.warn(`Could not fetch session details: ${message}`);
+    const masked = `${token.slice(0, 7)}...${token.slice(-4)}`;
+    log.info(`Session token: ${masked}`);
+  }
+}
+async function authStatusCommand() {
+  const config = await loadMergedConfigAsync();
+  if (!config.token) {
+    log.warn("Not authenticated. Run 'braid auth' to configure your API key.");
+    log.info(
+      `Or create a ${USER_CONFIG_FILENAME} file with: { "token": "br_xxx" }`
+    );
+    return;
+  }
+  if (config.token.startsWith(SESSION_TOKEN_PREFIX)) {
+    await displaySessionInfo(config.token);
+    await displayProjectConfig();
+    displayResolvedSettings(config);
+    return;
+  }
+  const masked = `${config.token.slice(0, 7)}...${config.token.slice(-4)}`;
+  await displayTokenSource(masked);
+  await displayProjectConfig();
+  displayResolvedSettings(config);
+}
+async function revokeSessionIfActive(token) {
+  const serverUrl = await getServerUrlAsync();
+  try {
+    const authConfig = await fetchAuthConfig(serverUrl);
+    await revokeSession(authConfig.convexSiteUrl, token);
+  } catch {
+    return;
+  }
+}
+async function authLogoutCommand() {
+  const config = await loadMergedConfigAsync();
+  const { clearApiKeyAsync: clearApiKeyAsync2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  if (config.token?.startsWith(SESSION_TOKEN_PREFIX)) {
+    await revokeSessionIfActive(config.token);
+  }
+  await clearApiKeyAsync2();
+  log.success("Logged out. API key removed from config.");
+}
+
+// src/commands/discover.ts
+init_esm_shims();
+init_api();
+init_config();
+init_tui();
+import process7 from "process";
+var parseCsv2 = (input) => {
+  if (!input) {
+    return void 0;
+  }
+  const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  return values.length > 0 ? values : void 0;
+};
+var writeJson2 = (value) => {
+  process7.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var exitWithError2 = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process7.exit(1);
+};
+var applyCommonOptions = (base, options) => ({
+  ...base,
+  ...options.server ? { serverUrl: options.server } : {},
+  ...options.apiKey ? { apiKey: options.apiKey } : {}
+});
+var applyOptionalString = (target, key, value) => {
+  if (value) {
+    target[key] = value;
+  }
+};
+var applyOptionalArray = (target, key, value) => {
+  if (value && value.length > 0) {
+    target[key] = value;
+  }
+};
+var applyOptionalBoolean = (target, key, value) => {
+  if (value !== void 0) {
+    target[key] = value;
+  }
+};
+async function projectsListCommand(options) {
+  try {
+    const result = await fetchScopeOptionsAsync(
+      applyCommonOptions({}, options)
+    );
+    if (options.json) {
+      writeJson2(result);
+      return;
+    }
+    log.info("Personal projects:");
+    if (result.personalProjects.length === 0) {
+      log.info("  (none)");
+    }
+    for (const project of result.personalProjects) {
+      log.info(`  ${project.id}  ${project.name}`);
+    }
+    for (const orgProjects of result.orgProjects) {
+      log.info(`
+Organization: ${orgProjects.orgName} (${orgProjects.orgId})`);
+      if (orgProjects.projects.length === 0) {
+        log.info("  (none)");
+        continue;
+      }
+      for (const project of orgProjects.projects) {
+        log.info(`  ${project.id}  ${project.name}`);
+      }
+    }
+  } catch (error) {
+    exitWithError2(error);
+  }
+}
+var buildRulesRequest = async (options) => {
+  const config = await loadMergedConfigAsync();
+  const orgProjects = parseCsv2(options.orgProjects) ?? config.orgProjects;
+  const personalProjects = parseCsv2(options.personalProjects) ?? config.personalProjects;
+  const request = applyCommonOptions({}, options);
+  applyOptionalString(request, "orgId", options.orgId ?? config.org);
+  applyOptionalArray(request, "orgProjects", orgProjects);
+  applyOptionalArray(request, "personalProjects", personalProjects);
+  applyOptionalBoolean(request, "includeUserGlobal", options.includeUserGlobal);
+  applyOptionalBoolean(request, "includeOrgGlobal", options.includeOrgGlobal);
+  return request;
+};
+async function rulesListCommand(options) {
+  try {
+    const result = await fetchRuleOptionsAsync(
+      await buildRulesRequest(options)
+    );
+    if (options.json) {
+      writeJson2(result);
+      return;
+    }
+    if (result.rules.length === 0) {
+      log.info("No rules found.");
+      return;
+    }
+    for (const rule of result.rules) {
+      log.info(`${rule.id}  ${rule.title}`);
+    }
+  } catch (error) {
+    exitWithError2(error);
+  }
+}
+var buildSkillsRequest = async (options) => {
+  const config = await loadMergedConfigAsync();
+  const orgProjects = parseCsv2(options.orgProjects) ?? config.orgProjects;
+  const personalProjects = parseCsv2(options.personalProjects) ?? config.personalProjects;
+  const request = applyCommonOptions({}, options);
+  applyOptionalString(request, "profile", options.profile ?? config.profile);
+  applyOptionalArray(request, "orgProjects", orgProjects);
+  applyOptionalArray(request, "personalProjects", personalProjects);
+  applyOptionalBoolean(request, "includeUserGlobal", options.includeUserGlobal);
+  applyOptionalBoolean(request, "includeOrgGlobal", options.includeOrgGlobal);
+  return request;
+};
+async function skillsListCommand(options) {
+  try {
+    const result = await fetchSkillsAsync(await buildSkillsRequest(options));
+    if (options.json) {
+      writeJson2(result);
+      return;
+    }
+    if (result.skills.length === 0) {
+      log.info("No skills found.");
+      return;
+    }
+    for (const skill of result.skills) {
+      log.info(`${skill.name}`);
+    }
+  } catch (error) {
+    exitWithError2(error);
+  }
+}
+
+// src/commands/install.ts
+init_esm_shims();
+init_api();
+init_config();
+
+// src/lib/metadata.ts
+init_esm_shims();
+import { readFile as readFile2, writeFile as writeFile3 } from "fs/promises";
+import { join as join3 } from "path";
+import { Data as Data4, Effect as Effect5, pipe as pipe5 } from "effect";
+var METADATA_FILENAME = ".braidskills-metadata.json";
+var MetadataReadError = class extends Data4.TaggedError("MetadataReadError") {
+};
+var MetadataWriteError = class extends Data4.TaggedError("MetadataWriteError") {
+};
+var getMetadataPath = (skillsDir) => join3(skillsDir, METADATA_FILENAME);
+var readMetadata = (skillsDir) => {
+  const metadataPath = getMetadataPath(skillsDir);
+  return pipe5(
+    Effect5.tryPromise({
+      try: () => readFile2(metadataPath, "utf-8"),
+      catch: (e) => new MetadataReadError({ path: metadataPath, cause: e })
+    }),
+    Effect5.flatMap(
+      (content) => Effect5.try({
+        try: () => JSON.parse(content),
+        catch: () => ({ skills: [] })
+      })
+    ),
+    Effect5.orElseSucceed(() => ({ skills: [] }))
+  );
+};
+var writeMetadata = (skillsDir, metadata) => {
+  const metadataPath = getMetadataPath(skillsDir);
+  return Effect5.tryPromise({
+    try: () => writeFile3(metadataPath, JSON.stringify(metadata, null, 2), "utf-8"),
+    catch: (e) => new MetadataWriteError({ path: metadataPath, cause: e })
+  });
+};
+var updateMetadata = (skillsDir, newSkills) => pipe5(
+  readMetadata(skillsDir),
+  Effect5.map((existing) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const updatedSkills = [...existing.skills];
+    for (const skill of newSkills) {
+      const existingIndex = updatedSkills.findIndex(
+        (s) => s.name === skill.name
+      );
+      const newEntry = {
+        name: skill.name,
+        source: skill.source,
+        version: skill.version,
+        installedAt: now,
+        serverUrl: skill.serverUrl
+      };
+      if (existingIndex >= 0) {
+        updatedSkills[existingIndex] = newEntry;
+      } else {
+        updatedSkills.push(newEntry);
+      }
+    }
+    return { skills: updatedSkills };
+  }),
+  Effect5.flatMap((metadata) => writeMetadata(skillsDir, metadata))
 );
-var writeMarkdownDirRules = (basePath, rules) => pipe5(
+var removeFromMetadata = (skillsDir, skillName) => pipe5(
+  readMetadata(skillsDir),
+  Effect5.map((metadata) => ({
+    skills: metadata.skills.filter((s) => s.name !== skillName)
+  })),
+  Effect5.flatMap((metadata) => writeMetadata(skillsDir, metadata))
+);
+var readMetadataAsync = (skillsDir) => Effect5.runPromise(readMetadata(skillsDir));
+var updateMetadataAsync = (skillsDir, newSkills) => Effect5.runPromise(updateMetadata(skillsDir, newSkills));
+var removeFromMetadataAsync = (skillsDir, skillName) => Effect5.runPromise(removeFromMetadata(skillsDir, skillName));
+
+// src/lib/rule-writer.ts
+init_esm_shims();
+import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname3, resolve as resolve2, sep as sep2 } from "path";
+import { Data as Data5, Effect as Effect6, pipe as pipe6 } from "effect";
+var RuleWriteError = class extends Data5.TaggedError("RuleWriteError") {
+};
+var createDirectory = (dir) => Effect6.tryPromise({
+  try: () => mkdir3(dir, { recursive: true }),
+  catch: (e) => new RuleWriteError({ path: dir, operation: "mkdir", cause: e })
+});
+var writeTextFile = (fullPath, content) => Effect6.tryPromise({
+  try: () => writeFile4(fullPath, content, "utf-8"),
+  catch: (e) => new RuleWriteError({ path: fullPath, operation: "write", cause: e })
+});
+var readTextFile = (fullPath) => Effect6.tryPromise({
+  try: () => readFile3(fullPath, "utf-8"),
+  catch: (e) => new RuleWriteError({ path: fullPath, operation: "read", cause: e })
+});
+var assertRulePathWithinBase = (basePath, ruleName) => {
+  const resolvedBase = resolve2(basePath);
+  const resolvedFull = resolve2(basePath, ruleName);
+  if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep2)) {
+    return Effect6.fail(
+      new RuleWriteError({
+        path: ruleName,
+        operation: "write",
+        cause: new Error(
+          `Path traversal detected: "${ruleName}" resolves outside base directory`
+        )
+      })
+    );
+  }
+  return Effect6.succeed(resolvedFull);
+};
+var BRAID_SECTION_START = "<!-- braid:rules:start -->";
+var BRAID_SECTION_END = "<!-- braid:rules:end -->";
+var YAML_SPECIAL_CHARS = /[\n\r:#{}[\],&*?|>!'"%@`]/;
+function escapeYamlValue(value) {
+  if (YAML_SPECIAL_CHARS.test(value) || value.startsWith(" ") || value.endsWith(" ")) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+  }
+  return value;
+}
+function buildMdcContent(rule) {
+  const lines = ["---"];
+  lines.push(`description: ${escapeYamlValue(rule.title)}`);
+  lines.push("alwaysApply: true");
+  lines.push("---");
+  lines.push("");
+  lines.push(`# ${rule.title}`);
+  lines.push("");
+  lines.push(rule.content);
+  return lines.join("\n");
+}
+function buildAppendContent(rules2) {
+  const lines = [BRAID_SECTION_START, ""];
+  for (const rule of rules2) {
+    lines.push(`## ${rule.title}`);
+    lines.push("");
+    lines.push(rule.content);
+    lines.push("");
+  }
+  lines.push(BRAID_SECTION_END);
+  return lines.join("\n");
+}
+var writeMdcRules = (basePath, rules2) => pipe6(
+  createDirectory(basePath),
+  Effect6.flatMap(
+    () => Effect6.forEach(
+      rules2,
+      (rule) => pipe6(
+        assertRulePathWithinBase(basePath, `${rule.name}.mdc`),
+        Effect6.flatMap(
+          (filePath) => writeTextFile(filePath, buildMdcContent(rule))
+        )
+      ),
+      { concurrency: "unbounded" }
+    )
+  ),
+  Effect6.asVoid
+);
+var writeMarkdownDirRules = (basePath, rules2) => pipe6(
   createDirectory(basePath),
-  Effect5.flatMap(
-    () => Effect5.forEach(
-      rules,
-      (rule) => pipe5(
+  Effect6.flatMap(
+    () => Effect6.forEach(
+      rules2,
+      (rule) => pipe6(
         assertRulePathWithinBase(basePath, `${rule.name}.md`),
-        Effect5.flatMap(
+        Effect6.flatMap(
           (filePath) => writeTextFile(filePath, `# ${rule.title}
 
 ${rule.content}`)
@@ -1951,18 +3082,18 @@ ${rule.content}`)
       { concurrency: "unbounded" }
     )
   ),
-  Effect5.asVoid
+  Effect6.asVoid
 );
-var writeAppendSingleRules = (filePath, rules) => pipe5(
-  createDirectory(dirname2(filePath)),
-  Effect5.flatMap(
-    () => pipe5(
+var writeAppendSingleRules = (filePath, rules2) => pipe6(
+  createDirectory(dirname3(filePath)),
+  Effect6.flatMap(
+    () => pipe6(
       readTextFile(filePath),
-      Effect5.orElseSucceed(() => "")
+      Effect6.orElseSucceed(() => "")
     )
   ),
-  Effect5.flatMap((existing) => {
-    const braidContent = buildAppendContent(rules);
+  Effect6.flatMap((existing) => {
+    const braidContent = buildAppendContent(rules2);
     const startIdx = existing.indexOf(BRAID_SECTION_START);
     const endIdx = existing.indexOf(BRAID_SECTION_END);
     let newContent;
@@ -1976,30 +3107,30 @@ ${braidContent}` : braidContent;
     return writeTextFile(filePath, newContent);
   })
 );
-var writeRulesForFormat = (basePath, rules, format) => {
+var writeRulesForFormat = (basePath, rules2, format) => {
   switch (format) {
     case "mdc":
-      return writeMdcRules(basePath, rules);
+      return writeMdcRules(basePath, rules2);
     case "markdown-dir":
-      return writeMarkdownDirRules(basePath, rules);
+      return writeMarkdownDirRules(basePath, rules2);
     case "append-single":
-      return writeAppendSingleRules(basePath, rules);
+      return writeAppendSingleRules(basePath, rules2);
     default:
-      return Effect5.void;
+      return Effect6.void;
   }
 };
-var writeRulesForAgent = (agent, rules, rulesPath) => {
-  if (!agent.ruleFormat || rules.length === 0) {
-    return Effect5.succeed({ written: 0, errors: [] });
-  }
-  return pipe5(
-    writeRulesForFormat(rulesPath, rules, agent.ruleFormat),
-    Effect5.map(() => ({
-      written: rules.length,
+var writeRulesForAgent = (agent, rules2, rulesPath) => {
+  if (!agent.ruleFormat || rules2.length === 0) {
+    return Effect6.succeed({ written: 0, errors: [] });
+  }
+  return pipe6(
+    writeRulesForFormat(rulesPath, rules2, agent.ruleFormat),
+    Effect6.map(() => ({
+      written: rules2.length,
       errors: []
     })),
-    Effect5.catchAll(
-      (error) => Effect5.succeed({
+    Effect6.catchAll(
+      (error) => Effect6.succeed({
         written: 0,
         errors: [
           {
@@ -2011,36 +3142,36 @@ var writeRulesForAgent = (agent, rules, rulesPath) => {
     )
   );
 };
-var writeRulesForAgentAsync = (agent, rules, rulesPath) => Effect5.runPromise(writeRulesForAgent(agent, rules, rulesPath));
+var writeRulesForAgentAsync = (agent, rules2, rulesPath) => Effect6.runPromise(writeRulesForAgent(agent, rules2, rulesPath));
 
 // src/lib/skill-writer.ts
 init_esm_shims();
-import { chmod, mkdir as mkdir3, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname3, resolve as resolve2, sep as sep2 } from "path";
-import { Data as Data5, Effect as Effect6, pipe as pipe6 } from "effect";
-var WriteError = class extends Data5.TaggedError("WriteError") {
+import { chmod, mkdir as mkdir4, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname4, resolve as resolve3, sep as sep3 } from "path";
+import { Data as Data6, Effect as Effect7, pipe as pipe7 } from "effect";
+var WriteError = class extends Data6.TaggedError("WriteError") {
 };
-var createDirectory2 = (dir, fullPath) => Effect6.tryPromise({
-  try: () => mkdir3(dir, { recursive: true }),
+var createDirectory2 = (dir, fullPath) => Effect7.tryPromise({
+  try: () => mkdir4(dir, { recursive: true }),
   catch: (e) => new WriteError({ path: fullPath, operation: "mkdir", cause: e })
 });
-var writeTextFile2 = (fullPath, content) => Effect6.tryPromise({
-  try: () => writeFile4(fullPath, content, "utf-8"),
+var writeTextFile2 = (fullPath, content) => Effect7.tryPromise({
+  try: () => writeFile5(fullPath, content, "utf-8"),
   catch: (e) => new WriteError({ path: fullPath, operation: "write", cause: e })
 });
-var writeBinaryFile = (fullPath, content) => Effect6.tryPromise({
-  try: () => writeFile4(fullPath, content),
+var writeBinaryFile = (fullPath, content) => Effect7.tryPromise({
+  try: () => writeFile5(fullPath, content),
   catch: (e) => new WriteError({ path: fullPath, operation: "write", cause: e })
 });
-var makeExecutable = (fullPath) => Effect6.tryPromise({
+var makeExecutable = (fullPath) => Effect7.tryPromise({
   try: () => chmod(fullPath, 493),
   catch: (e) => new WriteError({ path: fullPath, operation: "chmod", cause: e })
 });
-var assertWithinBase = (basePath, untrustedPath) => {
-  const resolvedBase = resolve2(basePath);
-  const resolvedFull = resolve2(basePath, untrustedPath);
-  if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep2)) {
-    return Effect6.fail(
+var assertWithinBase2 = (basePath, untrustedPath) => {
+  const resolvedBase = resolve3(basePath);
+  const resolvedFull = resolve3(basePath, untrustedPath);
+  if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep3)) {
+    return Effect7.fail(
       new WriteError({
         path: untrustedPath,
         operation: "write",
@@ -2050,7 +3181,7 @@ var assertWithinBase = (basePath, untrustedPath) => {
       })
     );
   }
-  return Effect6.succeed(resolvedFull);
+  return Effect7.succeed(resolvedFull);
 };
 var COMPATIBILITY_REGEX = /^compatibility:\s*.+$/m;
 var rewriteCompatibility = (content, agentId) => {
@@ -2093,41 +3224,41 @@ var isScriptFile = (path2) => {
   return inScriptsDir && scriptExtensions.some((ext) => lowerPath.endsWith(ext));
 };
 var writeFileContent = (fullPath, file, agentId) => isBinaryFile(file.path) ? writeBinaryFile(fullPath, decodeFileContentBinary(file)) : writeTextFile2(fullPath, decodeFileContent(file, agentId));
-var setExecutableIfScript = (fullPath, filePath) => isScriptFile(filePath) ? makeExecutable(fullPath) : Effect6.void;
-var writeSkillFile = (basePath, file, agentId) => pipe6(
-  assertWithinBase(basePath, file.path),
-  Effect6.flatMap((fullPath) => {
-    const dir = dirname3(fullPath);
-    return pipe6(
+var setExecutableIfScript = (fullPath, file, agentId) => isScriptFile(file.path) && decodeFileContent(file, agentId).startsWith("#!") ? makeExecutable(fullPath) : Effect7.void;
+var writeSkillFile = (basePath, file, agentId) => pipe7(
+  assertWithinBase2(basePath, file.path),
+  Effect7.flatMap((fullPath) => {
+    const dir = dirname4(fullPath);
+    return pipe7(
       createDirectory2(dir, fullPath),
-      Effect6.flatMap(() => writeFileContent(fullPath, file, agentId)),
-      Effect6.flatMap(() => setExecutableIfScript(fullPath, file.path))
+      Effect7.flatMap(() => writeFileContent(fullPath, file, agentId)),
+      Effect7.flatMap(() => setExecutableIfScript(fullPath, file, agentId))
     );
   })
 );
-var writeSkill = (basePath, skill, agentId) => pipe6(
-  assertWithinBase(basePath, skill.name),
-  Effect6.flatMap(
-    (skillDir) => pipe6(
-      Effect6.forEach(
+var writeSkill = (basePath, skill, agentId) => pipe7(
+  assertWithinBase2(basePath, skill.name),
+  Effect7.flatMap(
+    (skillDir) => pipe7(
+      Effect7.forEach(
         skill.files,
         (file) => writeSkillFile(skillDir, file, agentId),
         {
           concurrency: "unbounded"
         }
       ),
-      Effect6.map(() => void 0)
+      Effect7.map(() => void 0)
     )
   )
 );
-var writeSkills = (basePath, skills, agentId) => pipe6(
-  Effect6.forEach(
-    skills,
-    (skill) => pipe6(
+var writeSkills = (basePath, skills2, agentId) => pipe7(
+  Effect7.forEach(
+    skills2,
+    (skill) => pipe7(
       writeSkill(basePath, skill, agentId),
-      Effect6.map(() => ({ success: true, skill: skill.name })),
-      Effect6.catchAll(
-        (error) => Effect6.succeed({
+      Effect7.map(() => ({ success: true, skill: skill.name })),
+      Effect7.catchAll(
+        (error) => Effect7.succeed({
           success: false,
           skill: skill.name,
           error: error.cause instanceof Error ? error.cause.message : String(error.cause)
@@ -2136,14 +3267,14 @@ var writeSkills = (basePath, skills, agentId) => pipe6(
     ),
     { concurrency: "unbounded" }
   ),
-  Effect6.map((results) => ({
+  Effect7.map((results) => ({
     written: results.filter((r) => r.success).map((r) => r.skill),
     errors: results.filter(
       (r) => !r.success
     ).map((r) => ({ skill: r.skill, error: r.error }))
   }))
 );
-var writeSkillsAsync = (basePath, skills, agentId) => Effect6.runPromise(writeSkills(basePath, skills, agentId));
+var writeSkillsAsync = (basePath, skills2, agentId) => Effect7.runPromise(writeSkills(basePath, skills2, agentId));
 
 // src/commands/install.ts
 init_tui();
@@ -2220,9 +3351,9 @@ function buildFetchOptions(resolved) {
   }
   return fetchOptions;
 }
-function displaySkillsAndExit(skills) {
+function displaySkillsAndExit(skills2) {
   log.info("\nSkills:");
-  for (const skill of skills) {
+  for (const skill of skills2) {
     const fileCount = skill.files.length;
     log.info(
       `  ${skill.name} (${fileCount} file${fileCount !== 1 ? "s" : ""})`
@@ -2330,14 +3461,14 @@ async function installSkillsToAgent(agent, response, installPath) {
   return { written: result.written.length, errors: result.errors.length };
 }
 async function installRulesToAgent(agent, response, options) {
-  const rules = response.rules ?? [];
+  const rules2 = response.rules ?? [];
   const rulesPath = resolveRulesInstallPath(agent, {
     global: options.global === true
   });
-  if (rules.length === 0 || !rulesPath || !agent.ruleFormat) {
+  if (rules2.length === 0 || !rulesPath || !agent.ruleFormat) {
     return { written: 0, errors: 0 };
   }
-  const result = await writeRulesForAgentAsync(agent, rules, rulesPath);
+  const result = await writeRulesForAgentAsync(agent, rules2, rulesPath);
   for (const err of result.errors) {
     log.warn(`  Failed rules: ${err.agent} - ${err.error}`);
   }
@@ -2358,33 +3489,206 @@ async function installToAgent(agent, response, serverUrl, options, installSpinne
     global: options.global === true
   });
   installSpinner.start(`Installing to ${agent.name}...`);
-  const skills = installPath ? await installSkillsToAgent(agent, response, installPath) : { written: 0, errors: 0 };
-  const rules = await installRulesToAgent(agent, response, options);
-  const totalWritten = skills.written + rules.written;
-  const totalErrors = skills.errors + rules.errors;
+  const skills2 = installPath ? await installSkillsToAgent(agent, response, installPath) : { written: 0, errors: 0 };
+  const rules2 = await installRulesToAgent(agent, response, options);
+  const totalWritten = skills2.written + rules2.written;
+  const totalErrors = skills2.errors + rules2.errors;
   if (totalErrors > 0) {
     installSpinner.stop(
       `${agent.name}: ${totalWritten} installed, ${totalErrors} failed`
     );
   } else {
     installSpinner.stop(
-      formatInstallSummary(agent.name, skills.written, rules.written)
+      formatInstallSummary(agent.name, skills2.written, rules2.written)
+    );
+  }
+  if (response.skills.length > 0 && installPath) {
+    await updateMetadataAsync(
+      installPath,
+      response.skills.map((s) => ({
+        name: s.name,
+        source: response.source,
+        version: response.version,
+        serverUrl
+      }))
+    );
+  }
+  return { written: totalWritten, errors: totalErrors };
+}
+var PUBLIC_SOURCE_REGEX = /^@([a-z0-9-]+)\/([a-z0-9-]+)$/;
+function parsePublicSource(source) {
+  const match = source.match(PUBLIC_SOURCE_REGEX);
+  if (!(match?.[1] && match[2])) {
+    return null;
+  }
+  return { handle: match[1], slug: match[2] };
+}
+function displayPublicMetadata(metadata) {
+  if (metadata.type === "project") {
+    const { project, rules: rules2 } = metadata;
+    log.info(`
+Project: ${project.name}`);
+    if (project.description) {
+      log.info(`  ${project.description}`);
+    }
+    log.info(`  ${rules2.length} rule(s) available`);
+  } else {
+    const { rule } = metadata;
+    log.info(`
+Rule: ${rule.title}`);
+    log.info(`  Type: ${rule.type}`);
+    if (rule.tags.length > 0) {
+      log.info(`  Tags: ${rule.tags.join(", ")}`);
+    }
+    if (rule.description) {
+      log.info(`  ${rule.description}`);
+    }
+  }
+}
+async function selectPublicRules(metadata, options) {
+  if (metadata.type !== "project") {
+    return null;
+  }
+  if (options.yes) {
+    return metadata.rules.map((r) => r.id);
+  }
+  const selected = await multiselect({
+    message: "Select rules to install:",
+    options: metadata.rules.map((r) => ({
+      value: r.id,
+      label: r.title,
+      hint: r.type
+    })),
+    initialValues: metadata.rules.map((r) => r.id),
+    required: true
+  });
+  if (isCancel(selected)) {
+    cancel("Install cancelled.");
+    process.exit(0);
+  }
+  return selected;
+}
+async function confirmRuleInstall(metadata, options) {
+  if (metadata.type !== "rule") {
+    return true;
+  }
+  if (options.yes) {
+    return true;
+  }
+  const confirmed = await confirm({
+    message: `Install "${metadata.rule.title}"?`
+  });
+  if (isCancel(confirmed)) {
+    cancel("Install cancelled.");
+    process.exit(0);
+  }
+  return confirmed === true;
+}
+function summarizeContent(response) {
+  const ruleCount = response.rules?.length ?? 0;
+  const skillCount = response.skills.length;
+  const parts = [];
+  if (skillCount > 0) {
+    parts.push(`${skillCount} skills`);
+  }
+  if (ruleCount > 0) {
+    parts.push(`${ruleCount} rules`);
+  }
+  return parts.join(", ") || "nothing";
+}
+function hasNoContent(response) {
+  return response.skills.length === 0 && (response.rules?.length ?? 0) === 0;
+}
+async function installToSelectedAgents(response, serverUrl, options, installSpinner) {
+  const agentResolution = await resolveAgents(options, installSpinner);
+  const selectedAgents = await selectAgents(
+    agentResolution.availableAgents,
+    agentResolution.preselectedAgents,
+    options
+  );
+  let totalWritten = 0;
+  let totalErrors = 0;
+  for (const agent of selectedAgents) {
+    const result = await installToAgent(
+      agent,
+      response,
+      serverUrl,
+      options,
+      installSpinner
+    );
+    totalWritten += result.written;
+    totalErrors += result.errors;
+  }
+  return { totalWritten, totalErrors };
+}
+function showInstallOutro(totalWritten, totalErrors, suffix) {
+  if (totalErrors > 0) {
+    outro(`Installed ${totalWritten} items with ${totalErrors} errors.`);
+  } else {
+    outro(`Successfully installed ${totalWritten} items${suffix}.`);
+  }
+}
+async function fetchPublicContent(handle, slug, options, installSpinner) {
+  const metadata = await fetchPublicMetadataAsync(handle, slug, options.server);
+  installSpinner.stop("Found public content");
+  displayPublicMetadata(metadata);
+  let ruleIds;
+  if (metadata.type === "project") {
+    const selected = await selectPublicRules(metadata, options);
+    ruleIds = selected ?? void 0;
+  } else {
+    const confirmed = await confirmRuleInstall(metadata, options);
+    if (!confirmed) {
+      outro("Install cancelled.");
+      process.exit(0);
+    }
+  }
+  installSpinner.start("Downloading content...");
+  return fetchPublicExportAsync(handle, slug, ruleIds, options.server);
+}
+async function publicInstallCommand(source, options) {
+  const parsed = parsePublicSource(source);
+  if (!parsed) {
+    log.error(`Invalid public source: ${source}`);
+    log.info("Expected format: @handle/slug (e.g., @acme/coding-standards)");
+    process.exit(1);
+  }
+  const { handle, slug } = parsed;
+  intro(`Installing from @${handle}/${slug}`);
+  const installSpinner = spinner();
+  installSpinner.start("Fetching public content...");
+  try {
+    const response = await fetchPublicContent(
+      handle,
+      slug,
+      options,
+      installSpinner
     );
-  }
-  if (response.skills.length > 0 && installPath) {
-    await updateMetadataAsync(
-      installPath,
-      response.skills.map((s) => ({
-        name: s.name,
-        source: response.source,
-        version: response.version,
-        serverUrl
-      }))
+    installSpinner.stop(`Downloaded ${summarizeContent(response)}`);
+    if (hasNoContent(response)) {
+      log.warn("No content to install.");
+      process.exit(0);
+    }
+    const serverUrl = options.server ?? "https://braid.cloud";
+    const { totalWritten, totalErrors } = await installToSelectedAgents(
+      response,
+      serverUrl,
+      options,
+      installSpinner
     );
+    showInstallOutro(totalWritten, totalErrors, ` from @${handle}/${slug}`);
+  } catch (error) {
+    installSpinner.stop("Install failed");
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(message);
+    process.exit(1);
   }
-  return { written: totalWritten, errors: totalErrors };
 }
-async function installCommand(options) {
+async function installCommand(sourceOrOptions, maybeOptions) {
+  if (typeof sourceOrOptions === "string") {
+    return handlePublicSource(sourceOrOptions, maybeOptions ?? {});
+  }
+  const options = sourceOrOptions;
   const config = await loadMergedConfigAsync();
   const resolved = resolveInstallConfig(options, config);
   validateInstallOptions(resolved);
@@ -2395,17 +3699,8 @@ async function installCommand(options) {
   try {
     const fetchOptions = buildFetchOptions(resolved);
     const response = await fetchSkillsAsync(fetchOptions);
-    const ruleCount = response.rules?.length ?? 0;
-    const skillCount = response.skills.length;
-    const foundParts = [];
-    if (skillCount > 0) {
-      foundParts.push(`${skillCount} skills`);
-    }
-    if (ruleCount > 0) {
-      foundParts.push(`${ruleCount} rules`);
-    }
-    installSpinner.stop(`Found ${foundParts.join(", ") || "nothing"}`);
-    if (skillCount === 0 && ruleCount === 0) {
+    installSpinner.stop(`Found ${summarizeContent(response)}`);
+    if (hasNoContent(response)) {
       log.warn(
         "No skills or rules found. Check that your profile/project has enabled prompts."
       );
@@ -2414,32 +3709,13 @@ async function installCommand(options) {
     if (options.list) {
       displaySkillsAndExit(response.skills);
     }
-    const agentResolution = await resolveAgents(options, installSpinner);
-    const selectedAgents = await selectAgents(
-      agentResolution.availableAgents,
-      agentResolution.preselectedAgents,
-      options
+    const { totalWritten, totalErrors } = await installToSelectedAgents(
+      response,
+      resolved.serverUrl,
+      options,
+      installSpinner
     );
-    let totalWritten = 0;
-    let totalErrors = 0;
-    for (const agent of selectedAgents) {
-      const result = await installToAgent(
-        agent,
-        response,
-        resolved.serverUrl,
-        options,
-        installSpinner
-      );
-      totalWritten += result.written;
-      totalErrors += result.errors;
-    }
-    if (totalErrors > 0) {
-      outro(`Installed ${totalWritten} items with ${totalErrors} errors.`);
-    } else {
-      outro(
-        `Successfully installed ${totalWritten} items to ${selectedAgents.length} agent(s).`
-      );
-    }
+    showInstallOutro(totalWritten, totalErrors, ` to ${totalWritten} agent(s)`);
     log.info("Run 'braid list' to see installed skills.");
   } catch (error) {
     installSpinner.stop("Install failed");
@@ -2448,6 +3724,15 @@ async function installCommand(options) {
     process.exit(1);
   }
 }
+function handlePublicSource(source, options) {
+  const publicParsed = parsePublicSource(source);
+  if (publicParsed) {
+    return publicInstallCommand(source, options);
+  }
+  log.error(`Unknown source: ${source}`);
+  log.info("Public sources use format: @handle/slug");
+  process.exit(1);
+}
 
 // src/commands/list.ts
 init_esm_shims();
@@ -2545,36 +3830,39 @@ async function listCommand(options) {
 
 // src/commands/mcp.ts
 init_esm_shims();
-import process7 from "process";
+import process8 from "process";
 init_config();
 
 // src/lib/mcp-config.ts
 init_esm_shims();
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname4 } from "path";
-import { Data as Data6, Effect as Effect7, pipe as pipe7 } from "effect";
-var McpConfigReadError = class extends Data6.TaggedError("McpConfigReadError") {
+import { mkdir as mkdir5, readFile as readFile4, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname5 } from "path";
+import { Data as Data7, Effect as Effect8, pipe as pipe8 } from "effect";
+var McpConfigReadError = class extends Data7.TaggedError("McpConfigReadError") {
 };
-var McpConfigWriteError = class extends Data6.TaggedError("McpConfigWriteError") {
+var McpConfigWriteError = class extends Data7.TaggedError("McpConfigWriteError") {
 };
-var readMcpConfig = (path2) => pipe7(
-  Effect7.tryPromise({
+var readMcpConfig = (path2) => pipe8(
+  Effect8.tryPromise({
     try: () => readFile4(path2, "utf-8"),
     catch: (e) => new McpConfigReadError({ path: path2, cause: e })
   }),
-  Effect7.flatMap(
-    (content) => Effect7.try({
+  Effect8.flatMap(
+    (content) => Effect8.try({
       try: () => JSON.parse(content),
       catch: () => ({})
     })
   ),
-  Effect7.orElseSucceed(() => ({}))
+  Effect8.orElseSucceed(() => ({}))
 );
-var writeMcpConfig = (path2, config) => Effect7.tryPromise({
+var writeMcpConfig = (path2, config) => Effect8.tryPromise({
   try: async () => {
-    await mkdir4(dirname4(path2), { recursive: true });
-    await writeFile5(path2, `${JSON.stringify(config, null, 2)}
-`, "utf-8");
+    await mkdir5(dirname5(path2), { recursive: true, mode: 448 });
+    await writeFile6(path2, `${JSON.stringify(config, null, 2)}
+`, {
+      encoding: "utf-8",
+      mode: 384
+    });
   },
   catch: (e) => new McpConfigWriteError({ path: path2, cause: e })
 });
@@ -2600,8 +3888,8 @@ var hasbraidEntry = (config, rootKey, entryName) => {
   const servers = config[rootKey];
   return servers !== void 0 && entryName in servers;
 };
-var readMcpConfigAsync = (path2) => Effect7.runPromise(readMcpConfig(path2));
-var writeMcpConfigAsync = (path2, config) => Effect7.runPromise(writeMcpConfig(path2, config));
+var readMcpConfigAsync = (path2) => Effect8.runPromise(readMcpConfig(path2));
+var writeMcpConfigAsync = (path2, config) => Effect8.runPromise(writeMcpConfig(path2, config));
 
 // src/commands/mcp.ts
 init_tui();
@@ -2630,7 +3918,7 @@ async function selectTool(mcpAgents, toolFlag) {
     if (!agent) {
       log.error(`Unknown or unsupported tool: ${toolFlag}`);
       log.info(`Supported tools: ${mcpAgents.map((a) => a.id).join(", ")}`);
-      process7.exit(1);
+      process8.exit(1);
     }
     return agent;
   }
@@ -2649,12 +3937,12 @@ async function selectTool(mcpAgents, toolFlag) {
   });
   if (isCancel(toolChoice)) {
     cancel("MCP setup cancelled.");
-    process7.exit(0);
+    process8.exit(0);
   }
   const found = mcpAgents.find((a) => a.id === toolChoice);
   if (!found) {
     log.error("Agent not found.");
-    process7.exit(1);
+    process8.exit(1);
   }
   return found;
 }
@@ -2680,7 +3968,7 @@ async function selectScope(agent, options) {
   });
   if (isCancel(scopeChoice)) {
     cancel("MCP setup cancelled.");
-    process7.exit(0);
+    process8.exit(0);
   }
   return scopeChoice;
 }
@@ -2711,7 +3999,7 @@ async function resolveToken(options, existingToken) {
     });
     if (isCancel(authChoice)) {
       cancel("MCP setup cancelled.");
-      process7.exit(0);
+      process8.exit(0);
     }
     if (authChoice === "existing") {
       return existingToken;
@@ -2734,7 +4022,7 @@ async function resolveToken(options, existingToken) {
   });
   if (isCancel(token)) {
     cancel("MCP setup cancelled.");
-    process7.exit(0);
+    process8.exit(0);
   }
   return token;
 }
@@ -2765,7 +4053,7 @@ async function addFlow(options) {
   const mcpAgents = getMcpAgents();
   if (mcpAgents.length === 0) {
     log.error("No agents with MCP configuration support found.");
-    process7.exit(1);
+    process8.exit(1);
   }
   const selectedAgent = await selectTool(mcpAgents, options.tool);
   const scope = await selectScope(selectedAgent, options);
@@ -2774,7 +4062,7 @@ async function addFlow(options) {
   });
   if (!configPath) {
     log.error(`No ${scope} config path available for ${selectedAgent.name}.`);
-    process7.exit(1);
+    process8.exit(1);
   }
   const token = await resolveToken(options, config.token);
   const env = buildEnvVars(token, options.server);
@@ -2785,115 +4073,430 @@ async function addFlow(options) {
       ...config.token ? { apiKey: config.token } : {}
     });
   }
-  const mcpSpinner = spinner();
-  mcpSpinner.start(`Configuring ${selectedAgent.name}...`);
+  const mcpSpinner = spinner();
+  mcpSpinner.start(`Configuring ${selectedAgent.name}...`);
+  try {
+    await writeEntry(selectedAgent, configPath, env);
+    mcpSpinner.stop(`Configured ${selectedAgent.name}`);
+    log.info(`Config written to ${configPath}`);
+    if (!token) {
+      log.info("Set BRAID_TOKEN environment variable before using.");
+    }
+    outro(`Done! Restart ${selectedAgent.name} to activate.`);
+  } catch (error) {
+    mcpSpinner.stop("Configuration failed");
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Failed to write config: ${message}`);
+    process8.exit(1);
+  }
+}
+async function removeFlow(options) {
+  const mcpAgents = getMcpAgents();
+  const selectedAgent = await selectTool(mcpAgents, options.tool);
+  const scope = resolveScope(selectedAgent, options);
+  const configPath = resolveMcpConfigPath(selectedAgent, {
+    global: scope === "global"
+  });
+  if (!configPath) {
+    log.error(`No ${scope} config path available for ${selectedAgent.name}.`);
+    process8.exit(1);
+  }
+  const removeSpinner = spinner();
+  removeSpinner.start(`Removing braid from ${selectedAgent.name}...`);
+  try {
+    const rootKey = selectedAgent.mcpRootKey ?? "mcpServers";
+    const existingConfig = await readMcpConfigAsync(configPath);
+    if (!hasbraidEntry(existingConfig, rootKey, BRAID_ENTRY_NAME)) {
+      removeSpinner.stop("No braid MCP entry found");
+      log.info(
+        `${selectedAgent.name} doesn't have a braid MCP entry at ${configPath}`
+      );
+      return;
+    }
+    const updatedConfig = removebraidEntry(
+      existingConfig,
+      rootKey,
+      BRAID_ENTRY_NAME
+    );
+    await writeMcpConfigAsync(configPath, updatedConfig);
+    removeSpinner.stop(`Removed braid from ${selectedAgent.name}`);
+    outro(`braid MCP removed from ${configPath}`);
+  } catch (error) {
+    removeSpinner.stop("Removal failed");
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(`Failed to remove config: ${message}`);
+    process8.exit(1);
+  }
+}
+async function statusFlow() {
+  const mcpAgents = getMcpAgents();
+  const statusSpinner = spinner();
+  statusSpinner.start("Checking MCP configuration status...");
+  const results = [];
+  for (const agent of mcpAgents) {
+    const rootKey = agent.mcpRootKey ?? "mcpServers";
+    for (const scope of ["project", "global"]) {
+      const configPath = resolveMcpConfigPath(agent, {
+        global: scope === "global"
+      });
+      if (!configPath) {
+        continue;
+      }
+      const config = await readMcpConfigAsync(configPath);
+      if (hasbraidEntry(config, rootKey, BRAID_ENTRY_NAME)) {
+        results.push({
+          name: agent.name,
+          path: configPath,
+          scope
+        });
+      }
+    }
+  }
+  statusSpinner.stop(`Found ${results.length} configured tool(s)`);
+  if (results.length === 0) {
+    log.info("No tools have braid MCP configured.");
+    log.info("Run 'braid mcp' to set up MCP for your AI tools.");
+    return;
+  }
+  for (const result of results) {
+    log.info(`  ${result.name} (${result.scope}) \u2192 ${result.path}`);
+  }
+}
+function helpCommandsFlow() {
+  log.info("MCP manual command reference:");
+  log.info("  braid projects list --json");
+  log.info("  braid rules list --json");
+  log.info("  braid skills list --profile <name> --json");
+  log.info("");
+  log.info("Common local management commands:");
+  log.info("  braid install --yes --profile <name>");
+  log.info("  braid update --yes");
+  log.info("  braid list");
+  log.info("  braid remove --yes --all");
+  log.info(
+    "  braid scope --file user --organization personal --source profile --profile <name>"
+  );
+}
+async function mcpCommand(options) {
+  if (options.helpCommands) {
+    intro("braid mcp help");
+    helpCommandsFlow();
+    return;
+  }
+  if (options.status) {
+    intro("braid mcp status");
+    await statusFlow();
+    return;
+  }
+  if (options.remove) {
+    intro("braid mcp remove");
+    await removeFlow(options);
+    return;
+  }
+  intro("braid mcp");
+  await addFlow(options);
+}
+
+// src/commands/profiles.ts
+init_esm_shims();
+init_api();
+init_tui();
+import process9 from "process";
+var writeJson3 = (value) => {
+  process9.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var exitWithError3 = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process9.exit(1);
+};
+var fail2 = (message) => {
+  throw new Error(message);
+};
+var parseContext = (contextJson) => {
+  if (!contextJson) {
+    return void 0;
+  }
+  return JSON.parse(contextJson);
+};
+var run2 = async (command, args, options) => {
+  const apiOptions = {
+    ...options.server ? { serverUrl: options.server } : {},
+    ...options.apiKey ? { apiKey: options.apiKey } : {}
+  };
+  const result = await runLifecycleCommandAsync(
+    {
+      domain: "profiles",
+      command,
+      args
+    },
+    apiOptions
+  );
+  if (options.json) {
+    writeJson3(result);
+    return;
+  }
+  log.success(`profiles ${command} completed`);
+};
+async function profilesListCommand(options) {
+  try {
+    await run2("list", {}, options);
+  } catch (error) {
+    exitWithError3(error);
+  }
+}
+async function profilesGetCommand(options) {
+  try {
+    if (!(options.id || options.name)) {
+      fail2("profiles get requires --id or --name");
+    }
+    await run2("get", { id: options.id, name: options.name }, options);
+  } catch (error) {
+    exitWithError3(error);
+  }
+}
+async function profilesCreateCommand(options) {
+  try {
+    const name = options.name ?? fail2("profiles create requires --name");
+    await run2(
+      "create",
+      { name, context: parseContext(options.contextJson) },
+      options
+    );
+  } catch (error) {
+    exitWithError3(error);
+  }
+}
+async function profilesUpdateCommand(options) {
+  try {
+    const id = options.id ?? fail2("profiles update requires --id");
+    await run2(
+      "update",
+      {
+        id,
+        name: options.name,
+        context: parseContext(options.contextJson)
+      },
+      options
+    );
+  } catch (error) {
+    exitWithError3(error);
+  }
+}
+async function profilesRemoveCommand(options) {
+  try {
+    const id = options.id ?? fail2("profiles remove requires --id");
+    if (!options.yes) {
+      fail2("profiles remove requires --yes");
+    }
+    await run2("remove", { id, yes: true }, options);
+  } catch (error) {
+    exitWithError3(error);
+  }
+}
+async function profilesSetDefaultCommand(options) {
+  try {
+    const id = options.id ?? fail2("profiles set-default requires --id");
+    await run2("set-default", { id }, options);
+  } catch (error) {
+    exitWithError3(error);
+  }
+}
+
+// src/commands/projects.ts
+init_esm_shims();
+init_api();
+init_tui();
+import process10 from "process";
+var writeJson4 = (value) => {
+  process10.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var fail3 = (message) => {
+  throw new Error(message);
+};
+var run3 = async (command, args, options) => {
+  const apiOptions = {
+    ...options.server ? { serverUrl: options.server } : {},
+    ...options.apiKey ? { apiKey: options.apiKey } : {}
+  };
+  const result = await runLifecycleCommandAsync(
+    {
+      domain: "projects",
+      command,
+      args
+    },
+    apiOptions
+  );
+  if (options.json) {
+    writeJson4(result);
+    return;
+  }
+  log.success(`projects ${command} completed`);
+};
+var exitWithError4 = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process10.exit(1);
+};
+async function projectsGetCommand(options) {
+  try {
+    const id = options.id ?? fail3("projects get requires --id");
+    await run3("get", { id }, options);
+  } catch (error) {
+    exitWithError4(error);
+  }
+}
+async function projectsCreateCommand(options) {
+  try {
+    const name = options.name ?? fail3("projects create requires --name");
+    await run3(
+      "create",
+      { name, description: options.description, orgId: options.orgId },
+      options
+    );
+  } catch (error) {
+    exitWithError4(error);
+  }
+}
+async function projectsUpdateCommand(options) {
+  try {
+    const id = options.id ?? fail3("projects update requires --id");
+    await run3(
+      "update",
+      {
+        id,
+        name: options.name,
+        description: options.description
+      },
+      options
+    );
+  } catch (error) {
+    exitWithError4(error);
+  }
+}
+async function projectsRemoveCommand(options) {
+  try {
+    const id = options.id ?? fail3("projects remove requires --id");
+    if (!options.yes) {
+      fail3("projects remove requires --yes");
+    }
+    await run3("remove", { id, yes: true }, options);
+  } catch (error) {
+    exitWithError4(error);
+  }
+}
+
+// src/commands/references.ts
+init_esm_shims();
+init_api();
+init_tui();
+import process11 from "process";
+var writeJson5 = (value) => {
+  process11.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var parseCsv3 = (input) => {
+  if (!input) {
+    return void 0;
+  }
+  const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  return values.length > 0 ? values : void 0;
+};
+var exitWithError5 = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process11.exit(1);
+};
+var fail4 = (message) => {
+  throw new Error(message);
+};
+var run4 = async (command, args, options) => {
+  const apiOptions = {
+    ...options.server ? { serverUrl: options.server } : {},
+    ...options.apiKey ? { apiKey: options.apiKey } : {}
+  };
+  const result = await runLifecycleCommandAsync(
+    {
+      domain: "references",
+      command,
+      args
+    },
+    apiOptions
+  );
+  if (options.json) {
+    writeJson5(result);
+    return;
+  }
+  log.success(`references ${command} completed`);
+};
+async function referencesListCommand(options) {
   try {
-    await writeEntry(selectedAgent, configPath, env);
-    mcpSpinner.stop(`Configured ${selectedAgent.name}`);
-    log.info(`Config written to ${configPath}`);
-    if (!token) {
-      log.info("Set BRAID_TOKEN environment variable before using.");
-    }
-    outro(`Done! Restart ${selectedAgent.name} to activate.`);
+    const ruleId = options.ruleId ?? fail4("references list requires --rule-id");
+    await run4("list", { ruleId }, options);
   } catch (error) {
-    mcpSpinner.stop("Configuration failed");
-    const message = error instanceof Error ? error.message : String(error);
-    log.error(`Failed to write config: ${message}`);
-    process7.exit(1);
+    exitWithError5(error);
   }
 }
-async function removeFlow(options) {
-  const mcpAgents = getMcpAgents();
-  const selectedAgent = await selectTool(mcpAgents, options.tool);
-  const scope = resolveScope(selectedAgent, options);
-  const configPath = resolveMcpConfigPath(selectedAgent, {
-    global: scope === "global"
-  });
-  if (!configPath) {
-    log.error(`No ${scope} config path available for ${selectedAgent.name}.`);
-    process7.exit(1);
+async function referencesGetCommand(options) {
+  try {
+    const id = options.id ?? fail4("references get requires --id");
+    await run4("get", { id }, options);
+  } catch (error) {
+    exitWithError5(error);
   }
-  const removeSpinner = spinner();
-  removeSpinner.start(`Removing braid from ${selectedAgent.name}...`);
+}
+async function referencesCreateCommand(options) {
   try {
-    const rootKey = selectedAgent.mcpRootKey ?? "mcpServers";
-    const existingConfig = await readMcpConfigAsync(configPath);
-    if (!hasbraidEntry(existingConfig, rootKey, BRAID_ENTRY_NAME)) {
-      removeSpinner.stop("No braid MCP entry found");
-      log.info(
-        `${selectedAgent.name} doesn't have a braid MCP entry at ${configPath}`
-      );
-      return;
-    }
-    const updatedConfig = removebraidEntry(
-      existingConfig,
-      rootKey,
-      BRAID_ENTRY_NAME
+    const ruleId = options.ruleId ?? fail4("references create requires --rule-id");
+    const file = options.file ?? fail4("references create requires --file");
+    await run4("create", { ruleId, file }, options);
+  } catch (error) {
+    exitWithError5(error);
+  }
+}
+async function referencesUpdateCommand(options) {
+  try {
+    const id = options.id ?? fail4("references update requires --id");
+    await run4(
+      "update",
+      { id, label: options.label, replaceFile: options.replaceFile },
+      options
     );
-    await writeMcpConfigAsync(configPath, updatedConfig);
-    removeSpinner.stop(`Removed braid from ${selectedAgent.name}`);
-    outro(`braid MCP removed from ${configPath}`);
   } catch (error) {
-    removeSpinner.stop("Removal failed");
-    const message = error instanceof Error ? error.message : String(error);
-    log.error(`Failed to remove config: ${message}`);
-    process7.exit(1);
+    exitWithError5(error);
   }
 }
-async function statusFlow() {
-  const mcpAgents = getMcpAgents();
-  const statusSpinner = spinner();
-  statusSpinner.start("Checking MCP configuration status...");
-  const results = [];
-  for (const agent of mcpAgents) {
-    const rootKey = agent.mcpRootKey ?? "mcpServers";
-    for (const scope of ["project", "global"]) {
-      const configPath = resolveMcpConfigPath(agent, {
-        global: scope === "global"
-      });
-      if (!configPath) {
-        continue;
-      }
-      const config = await readMcpConfigAsync(configPath);
-      if (hasbraidEntry(config, rootKey, BRAID_ENTRY_NAME)) {
-        results.push({
-          name: agent.name,
-          path: configPath,
-          scope
-        });
-      }
+async function referencesRemoveCommand(options) {
+  try {
+    const id = options.id ?? fail4("references remove requires --id");
+    if (!options.yes) {
+      fail4("references remove requires --yes");
     }
-  }
-  statusSpinner.stop(`Found ${results.length} configured tool(s)`);
-  if (results.length === 0) {
-    log.info("No tools have braid MCP configured.");
-    log.info("Run 'braid mcp' to set up MCP for your AI tools.");
-    return;
-  }
-  for (const result of results) {
-    log.info(`  ${result.name} (${result.scope}) \u2192 ${result.path}`);
+    await run4("remove", { id, yes: true }, options);
+  } catch (error) {
+    exitWithError5(error);
   }
 }
-async function mcpCommand(options) {
-  if (options.status) {
-    intro("braid mcp status");
-    await statusFlow();
-    return;
-  }
-  if (options.remove) {
-    intro("braid mcp remove");
-    await removeFlow(options);
-    return;
+async function referencesReorderCommand(options) {
+  try {
+    const ruleId = options.ruleId ?? fail4("references reorder requires --rule-id");
+    const orderedIds = parseCsv3(options.orderedIds);
+    if (!orderedIds || orderedIds.length === 0) {
+      fail4("references reorder requires --ordered-ids");
+    }
+    await run4("reorder", { ruleId, orderedIds }, options);
+  } catch (error) {
+    exitWithError5(error);
   }
-  intro("braid mcp");
-  await addFlow(options);
 }
 
 // src/commands/remove.ts
 init_esm_shims();
 import { rm } from "fs/promises";
-import { join as join4, resolve as resolve3 } from "path";
-import process8 from "process";
+import { join as join4, resolve as resolve4 } from "path";
+import process12 from "process";
 init_tui();
 async function collectInstalledSkills(detectedAgents, options) {
   const skillsToRemove = [];
@@ -2926,7 +4529,7 @@ async function selectSkillsToRemove(skillsToRemove, options) {
     if (selected.length === 0) {
       log.error(`Skill '${options.skill}' not found.`);
       log.info("Run 'braid list' to see installed skills.");
-      process8.exit(1);
+      process12.exit(1);
     }
     return selected;
   }
@@ -2945,7 +4548,7 @@ async function selectSkillsToRemove(skillsToRemove, options) {
   });
   if (isCancel(result)) {
     cancel("Remove cancelled.");
-    process8.exit(0);
+    process12.exit(0);
   }
   return result;
 }
@@ -2959,14 +4562,14 @@ async function confirmRemoval(selectedCount, options) {
   });
   if (isCancel(confirmed) || !confirmed) {
     cancel("Remove cancelled.");
-    process8.exit(0);
+    process12.exit(0);
   }
 }
 async function removeSkill(skill, removeSpinner) {
   removeSpinner.start(`Removing ${skill.name} from ${skill.agentName}...`);
   try {
-    const resolvedSkillPath = resolve3(skill.skillPath);
-    const resolvedInstallPath = resolve3(skill.installPath);
+    const resolvedSkillPath = resolve4(skill.skillPath);
+    const resolvedInstallPath = resolve4(skill.installPath);
     if (!resolvedSkillPath.startsWith(`${resolvedInstallPath}/`)) {
       removeSpinner.stop(`Unsafe path for ${skill.name}`);
       log.warn("  Skill path escapes install directory, skipping.");
@@ -3023,7 +4626,203 @@ async function removeCommand(options) {
     removeSpinner.stop("Remove failed");
     const message = error instanceof Error ? error.message : String(error);
     log.error(message);
-    process8.exit(1);
+    process12.exit(1);
+  }
+}
+
+// src/commands/rules.ts
+init_esm_shims();
+init_api();
+init_tui();
+import process13 from "process";
+var parseCsv4 = (input) => {
+  if (!input) {
+    return void 0;
+  }
+  const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  return values.length > 0 ? values : void 0;
+};
+var writeJson6 = (value) => {
+  process13.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var exitWithError6 = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process13.exit(1);
+};
+var fail5 = (message) => {
+  throw new Error(message);
+};
+var run5 = async (command, args, options) => {
+  const apiOptions = {
+    ...options.server ? { serverUrl: options.server } : {},
+    ...options.apiKey ? { apiKey: options.apiKey } : {}
+  };
+  const result = await runLifecycleCommandAsync(
+    {
+      domain: "rules",
+      command,
+      args
+    },
+    apiOptions
+  );
+  if (options.json) {
+    writeJson6(result);
+    return;
+  }
+  log.success(`rules ${command} completed`);
+};
+async function rulesGetCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules get requires --id");
+    await run5("get", { id }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesCreateCommand(options) {
+  try {
+    const title = options.title ?? fail5("rules create requires --title");
+    const content = options.content ?? fail5("rules create requires --content");
+    await run5(
+      "create",
+      {
+        title,
+        content,
+        projectId: options.projectId,
+        tags: parseCsv4(options.tags),
+        priority: options.priority
+      },
+      options
+    );
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesUpdateCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules update requires --id");
+    await run5(
+      "update",
+      {
+        id,
+        title: options.title,
+        content: options.content,
+        tags: parseCsv4(options.tags),
+        priority: options.priority
+      },
+      options
+    );
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesRemoveCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules remove requires --id");
+    if (!options.yes) {
+      fail5("rules remove requires --yes");
+    }
+    await run5("remove", { id, yes: true }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesEnableCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules enable requires --id");
+    await run5("enable", { id }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesDisableCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules disable requires --id");
+    await run5("disable", { id }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesMoveCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules move requires --id");
+    const projectId = options.projectId ?? fail5("rules move requires --project-id");
+    await run5("move", { id, projectId }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesDuplicateCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules duplicate requires --id");
+    await run5(
+      "duplicate",
+      { id, targetProjectId: options.targetProjectId },
+      options
+    );
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesForkCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules fork requires --id");
+    await run5(
+      "fork",
+      { id, targetProjectId: options.targetProjectId },
+      options
+    );
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesSyncStatusCommand(options) {
+  try {
+    await run5("sync-status", { id: options.id }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesSyncHistoryCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules sync-history requires --id");
+    await run5("sync-history", { id }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesSyncEnableCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules sync-enable requires --id");
+    await run5("sync-enable", { id }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesSyncDisableCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules sync-disable requires --id");
+    await run5("sync-disable", { id }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesSyncCheckCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules sync-check requires --id");
+    await run5("sync-check", { id }, options);
+  } catch (error) {
+    exitWithError6(error);
+  }
+}
+async function rulesSyncNowCommand(options) {
+  try {
+    const id = options.id ?? fail5("rules sync-now requires --id");
+    await run5("sync-now", { id }, options);
+  } catch (error) {
+    exitWithError6(error);
   }
 }
 
@@ -3040,11 +4839,11 @@ import {
   outro as outro2,
   spinner as spinner3
 } from "@clack/prompts";
-import { Data as Data7, Effect as Effect8, pipe as pipe8 } from "effect";
+import { Data as Data8, Effect as Effect9, pipe as pipe9 } from "effect";
 init_api();
-var UpdateError = class extends Data7.TaggedError("UpdateError") {
+var UpdateError = class extends Data8.TaggedError("UpdateError") {
 };
-var UserCancelledError = class extends Data7.TaggedError("UserCancelledError") {
+var UserCancelledError = class extends Data8.TaggedError("UserCancelledError") {
 };
 async function resolveValidInstallPath(agent, options) {
   const installPath = resolveInstallPath(agent, {
@@ -3056,7 +4855,7 @@ async function resolveValidInstallPath(agent, options) {
   const exists = await directoryExistsAsync(installPath);
   return exists ? installPath : null;
 }
-var collectSourcesFromAgent = (agent, options, sourcesToUpdate) => Effect8.tryPromise({
+var collectSourcesFromAgent = (agent, options, sourcesToUpdate) => Effect9.tryPromise({
   try: async () => {
     const installPath = await resolveValidInstallPath(agent, options);
     if (!installPath) {
@@ -3087,10 +4886,10 @@ var collectSourcesFromAgent = (agent, options, sourcesToUpdate) => Effect8.tryPr
   },
   catch: () => new UpdateError({ message: "Failed to collect sources" })
 });
-var collectSources = (detectedAgents, options) => pipe8(
-  Effect8.succeed(/* @__PURE__ */ new Map()),
-  Effect8.tap(
-    (sourcesToUpdate) => Effect8.forEach(
+var collectSources = (detectedAgents, options) => pipe9(
+  Effect9.succeed(/* @__PURE__ */ new Map()),
+  Effect9.tap(
+    (sourcesToUpdate) => Effect9.forEach(
       detectedAgents,
       (agent) => collectSourcesFromAgent(agent, options, sourcesToUpdate),
       { concurrency: 1 }
@@ -3099,9 +4898,9 @@ var collectSources = (detectedAgents, options) => pipe8(
 );
 var selectSources = (sourcesToUpdate, options) => {
   if (options.yes) {
-    return Effect8.succeed(sourcesToUpdate);
+    return Effect9.succeed(sourcesToUpdate);
   }
-  return Effect8.tryPromise({
+  return Effect9.tryPromise({
     try: async () => {
       const sources = Array.from(sourcesToUpdate.entries()).map(
         ([key, source]) => ({
@@ -3152,7 +4951,7 @@ var buildFetchOptionsForSource = (source, options) => {
   }
   return fetchOptions;
 };
-var updateAgentSkills = (agentId, agentName, installPath, response, serverUrl, updateSpinner) => Effect8.tryPromise({
+var updateAgentSkills = (agentId, agentName, installPath, response, serverUrl, updateSpinner) => Effect9.tryPromise({
   try: async () => {
     updateSpinner.start(`Updating ${agentName}...`);
     const result = await writeSkillsAsync(
@@ -3190,15 +4989,15 @@ var updateSource = (source, options, updateSpinner) => {
   const serverUrl = options.server ?? source.serverUrl;
   const fetchOptions = buildFetchOptionsForSource(source, options);
   if (fetchOptions === null) {
-    return Effect8.fail(
+    return Effect9.fail(
       new UpdateError({
         message: "Skills installed with legacy metadata format. Please reinstall using 'braid install --profile <name>' or 'braid install --projects <names>'.",
         source: sourceDesc
       })
     );
   }
-  return pipe8(
-    Effect8.tryPromise({
+  return pipe9(
+    Effect9.tryPromise({
       try: async () => {
         updateSpinner.start(`Fetching latest skills from ${sourceDesc}...`);
         const response = await fetchSkillsAsync(fetchOptions);
@@ -3212,9 +5011,9 @@ var updateSource = (source, options, updateSpinner) => {
         source: sourceDesc
       })
     }),
-    Effect8.flatMap(
-      (response) => pipe8(
-        Effect8.forEach(
+    Effect9.flatMap(
+      (response) => pipe9(
+        Effect9.forEach(
           source.agents,
           ({ agentId, agentName, installPath }) => updateAgentSkills(
             agentId,
@@ -3226,7 +5025,7 @@ var updateSource = (source, options, updateSpinner) => {
           ),
           { concurrency: 1 }
         ),
-        Effect8.map((results) => ({
+        Effect9.map((results) => ({
           updated: results.reduce((sum, r) => sum + r.updated, 0),
           errors: results.reduce((sum, r) => sum + r.errors, 0)
         }))
@@ -3234,22 +5033,22 @@ var updateSource = (source, options, updateSpinner) => {
     )
   );
 };
-var updateAllSources = (sources, options, updateSpinner) => pipe8(
-  Effect8.forEach(
+var updateAllSources = (sources, options, updateSpinner) => pipe9(
+  Effect9.forEach(
     Array.from(sources.values()),
-    (source) => pipe8(
+    (source) => pipe9(
       updateSource(source, options, updateSpinner),
-      Effect8.catchAll((error) => {
+      Effect9.catchAll((error) => {
         updateSpinner.stop(
           `Failed to update from ${getSourceDesc(source)}`
         );
         log3.error(`  ${error.message}`);
-        return Effect8.succeed({ updated: 0, errors: 1 });
+        return Effect9.succeed({ updated: 0, errors: 1 });
       })
     ),
     { concurrency: 1 }
   ),
-  Effect8.map((results) => ({
+  Effect9.map((results) => ({
     totalUpdated: results.reduce((sum, r) => sum + r.updated, 0),
     totalErrors: results.reduce((sum, r) => sum + r.errors, 0)
   }))
@@ -3288,28 +5087,28 @@ var handleProgramExit = (result, updateSpinner) => {
 async function updateCommand(options) {
   const updateSpinner = spinner3();
   updateSpinner.start("Scanning for installed skills...");
-  const program2 = pipe8(
-    Effect8.tryPromise({
+  const program2 = pipe9(
+    Effect9.tryPromise({
       try: () => detectAgentsAsync(),
       catch: () => new UpdateError({ message: "Failed to detect agents" })
     }),
-    Effect8.filterOrFail(
-      (agents) => agents.length > 0,
+    Effect9.filterOrFail(
+      (agents2) => agents2.length > 0,
       () => new UpdateError({ message: "No AI coding agents detected." })
     ),
-    Effect8.flatMap((detectedAgents) => collectSources(detectedAgents, options)),
-    Effect8.tap((sources) => {
+    Effect9.flatMap((detectedAgents) => collectSources(detectedAgents, options)),
+    Effect9.tap((sources) => {
       updateSpinner.stop(`Found ${sources.size} source(s) to update`);
     }),
-    Effect8.filterOrFail(
+    Effect9.filterOrFail(
       (sources) => sources.size > 0,
       () => new UpdateError({ message: "No skills installed via braid." })
     ),
-    Effect8.flatMap((sources) => selectSources(sources, options)),
-    Effect8.flatMap(
+    Effect9.flatMap((sources) => selectSources(sources, options)),
+    Effect9.flatMap(
       (selectedSources) => updateAllSources(selectedSources, options, updateSpinner)
     ),
-    Effect8.tap(({ totalUpdated, totalErrors }) => {
+    Effect9.tap(({ totalUpdated, totalErrors }) => {
       if (totalErrors > 0) {
         outro2(`Updated ${totalUpdated} skills with ${totalErrors} errors.`);
       } else {
@@ -3317,10 +5116,136 @@ async function updateCommand(options) {
       }
     })
   );
-  const result = await Effect8.runPromiseExit(program2);
+  const result = await Effect9.runPromiseExit(program2);
   handleProgramExit(result, updateSpinner);
 }
 
+// src/commands/workflows.ts
+init_esm_shims();
+init_api();
+init_tui();
+import process14 from "process";
+var writeJson7 = (value) => {
+  process14.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var fail6 = (message) => {
+  throw new Error(message);
+};
+var parseMetadata = (metadata) => {
+  if (!metadata) {
+    return void 0;
+  }
+  try {
+    return JSON.parse(metadata);
+  } catch {
+    throw new Error("metadata must be valid JSON");
+  }
+};
+var run6 = async (command, args, options) => {
+  const apiOptions = {
+    ...options.server ? { serverUrl: options.server } : {},
+    ...options.apiKey ? { apiKey: options.apiKey } : {}
+  };
+  const result = await runLifecycleCommandAsync(
+    {
+      domain: "workflows",
+      command,
+      args
+    },
+    apiOptions
+  );
+  if (options.json) {
+    writeJson7(result);
+    return;
+  }
+  log.success(`workflows ${command} completed`);
+};
+var exitWithError7 = (error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process14.exit(1);
+};
+async function workflowsListCommand(options) {
+  try {
+    await run6("list", { projectId: options.projectId }, options);
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsStartCommand(options) {
+  try {
+    const sessionId = options.sessionId ?? fail6("workflows start requires --session-id");
+    const flowId = options.flowId ?? fail6("workflows start requires --flow-id");
+    await run6(
+      "start",
+      {
+        sessionId,
+        flowId,
+        currentNodeId: options.currentNodeId,
+        currentStepLabel: options.currentStepLabel,
+        metadata: parseMetadata(options.metadata)
+      },
+      options
+    );
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsProgressCommand(options) {
+  try {
+    const executionId = options.executionId ?? fail6("workflows progress requires --execution-id");
+    await run6(
+      "progress",
+      {
+        executionId,
+        currentNodeId: options.currentNodeId,
+        currentStepLabel: options.currentStepLabel,
+        metadata: parseMetadata(options.metadata)
+      },
+      options
+    );
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsActiveCommand(options) {
+  try {
+    const sessionId = options.sessionId ?? fail6("workflows active requires --session-id");
+    await run6("active", { sessionId }, options);
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsCompleteCommand(options) {
+  try {
+    const executionId = options.executionId ?? fail6("workflows complete requires --execution-id");
+    await run6("complete", { executionId }, options);
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsFailCommand(options) {
+  try {
+    const executionId = options.executionId ?? fail6("workflows fail requires --execution-id");
+    await run6(
+      "fail",
+      { executionId, errorMessage: options.errorMessage },
+      options
+    );
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+async function workflowsCancelCommand(options) {
+  try {
+    const executionId = options.executionId ?? fail6("workflows cancel requires --execution-id");
+    await run6("cancel", { executionId }, options);
+  } catch (error) {
+    exitWithError7(error);
+  }
+}
+
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var { version: PACKAGE_VERSION } = require2("../package.json");
@@ -3329,10 +5254,18 @@ program.name("braid").description(
   "Install braid prompts as agent skills to your local development environment"
 ).version(PACKAGE_VERSION);
 var auth = program.command("auth").description("Configure API key for braid authentication");
-auth.command("login", { isDefault: true }).description("Configure API key").option("-s, --server <url>", "braid server URL (for review apps, local dev)").action(authCommand);
+auth.command("login", { isDefault: true }).description("Authenticate with braid via browser login or API key").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option(
+  "--token <token>",
+  "API key for non-interactive login (skips device flow)"
+).option(
+  "--timeout <seconds>",
+  "Device flow timeout in seconds (default: 300)"
+).option("--no-scope", "Skip scope setup after login").action(authCommand);
 auth.command("status").description("Show current authentication status").action(authStatusCommand);
 auth.command("logout").description("Remove stored API key").action(authLogoutCommand);
-program.command("install").alias("add").description("Install skills from a profile or project").option("-p, --profile <name>", "Profile name to install from").option(
+program.command("install").alias("add").description(
+  "Install skills from a profile, project, or public source (@handle/slug)"
+).argument("[source]", "Public source to install from (e.g., @handle/slug)").option("-p, --profile <name>", "Profile name to install from").option(
   "--org-projects <ids>",
   "Comma-separated organization project IDs to install from"
 ).option(
@@ -3347,7 +5280,12 @@ program.command("install").alias("add").description("Install skills from a profi
 ).option("--no-include-org-globals", "Exclude organization's global prompts").option(
   "-a, --agents <list>",
   "Comma-separated list of agents (e.g., claude-code,opencode)"
-).option("-g, --global", "Install to global agent directories").option("-y, --yes", "Skip confirmation prompts").option("-l, --list", "Preview skills without installing").option("-s, --server <url>", "braid server URL (for review apps, local dev)").action(installCommand);
+).option("-g, --global", "Install to global agent directories").option("-y, --yes", "Skip confirmation prompts").option("-l, --list", "Preview skills without installing").option("-s, --server <url>", "braid server URL (for review apps, local dev)").action((source, options) => {
+  if (source) {
+    return installCommand(source, options);
+  }
+  return installCommand(options);
+});
 program.command("scope").description("Interactively configure braid.json or braid.user.json scope").option("--file <target>", "Config file target: user or project").option(
   "--organization <type>",
   "Scope organization for non-interactive mode: personal or organization"
@@ -3371,8 +5309,65 @@ program.command("scope").description("Interactively configure braid.json or brai
   "Include org global rules in non-interactive mode"
 ).option("-s, --server <url>", "braid server URL (for review apps, local dev)").action(scopeCommand);
 program.command("list").alias("ls").description("List installed skills").option("-g, --global", "List skills in global directories only").action(listCommand);
+var projects = program.command("projects").description("Discover available projects from braid");
+projects.command("list").description("List available personal and org projects").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(projectsListCommand);
+projects.command("get").description("Get a project by id").requiredOption("--id <id>", "Project ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(projectsGetCommand);
+projects.command("create").description("Create a project").requiredOption("--name <name>", "Project name").option("--description <description>", "Project description").option("--org-id <id>", "Organization ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(projectsCreateCommand);
+projects.command("update").description("Update a project").requiredOption("--id <id>", "Project ID").option("--name <name>", "Project name").option("--description <description>", "Project description").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(projectsUpdateCommand);
+projects.command("remove").description("Remove a project").requiredOption("--id <id>", "Project ID").option("-y, --yes", "Confirm destructive action").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(projectsRemoveCommand);
+var rules = program.command("rules").description("Discover available rules from braid");
+rules.command("list").description("List available rules for a scope").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--org-id <id>", "Organization ID").option("--org-projects <ids>", "Comma-separated organization project IDs").option("--personal-projects <ids>", "Comma-separated personal project IDs").option("--include-user-global", "Include personal global rules").option("--include-org-global", "Include org global rules").option("--json", "Output JSON").action(rulesListCommand);
+rules.command("get").description("Get a rule by id").requiredOption("--id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesGetCommand);
+rules.command("create").description("Create a rule").requiredOption("--title <title>", "Rule title").requiredOption("--content <content>", "Rule content").option("--project-id <id>", "Project ID").option("--tags <list>", "Comma-separated tags").option("--priority <priority>", "Priority").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesCreateCommand);
+rules.command("update").description("Update a rule").requiredOption("--id <id>", "Rule ID").option("--title <title>", "Rule title").option("--content <content>", "Rule content").option("--tags <list>", "Comma-separated tags").option("--priority <priority>", "Priority").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesUpdateCommand);
+rules.command("remove").description("Remove a rule").requiredOption("--id <id>", "Rule ID").option("-y, --yes", "Confirm destructive action").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesRemoveCommand);
+rules.command("enable").description("Enable a rule").requiredOption("--id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesEnableCommand);
+rules.command("disable").description("Disable a rule").requiredOption("--id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesDisableCommand);
+rules.command("move").description("Move a rule to a project").requiredOption("--id <id>", "Rule ID").requiredOption("--project-id <id>", "Project ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesMoveCommand);
+rules.command("duplicate").description("Duplicate a rule").requiredOption("--id <id>", "Rule ID").option("--target-project-id <id>", "Target project ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesDuplicateCommand);
+rules.command("fork").description("Fork a rule").requiredOption("--id <id>", "Rule ID").option("--target-project-id <id>", "Target project ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesForkCommand);
+rules.command("sync-status").description("Show sync status for one rule or all").option("--id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesSyncStatusCommand);
+rules.command("sync-history").description("Show sync history for a rule").requiredOption("--id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesSyncHistoryCommand);
+rules.command("sync-enable").description("Enable sync for a rule").requiredOption("--id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesSyncEnableCommand);
+rules.command("sync-disable").description("Disable sync for a rule").requiredOption("--id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesSyncDisableCommand);
+rules.command("sync-check").description("Check for upstream updates").requiredOption("--id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesSyncCheckCommand);
+rules.command("sync-now").description("Run sync now").requiredOption("--id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(rulesSyncNowCommand);
+var skills = program.command("skills").description("Discover available skills from braid");
+skills.command("list").description("List available skills for a profile or project scope").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("-p, --profile <name>", "Profile name").option("--org-projects <ids>", "Comma-separated organization project IDs").option("--personal-projects <ids>", "Comma-separated personal project IDs").option("--include-user-global", "Include personal global rules").option("--include-org-global", "Include org global rules").option("--json", "Output JSON").action(skillsListCommand);
+var profiles = program.command("profiles").description("Manage scope profiles");
+profiles.command("list").description("List profiles").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(profilesListCommand);
+profiles.command("get").description("Get profile by id or name").option("--id <id>", "Profile ID").option("--name <name>", "Profile name").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(profilesGetCommand);
+profiles.command("create").description("Create profile").requiredOption("--name <name>", "Profile name").option("--context-json <json>", "Context JSON").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(profilesCreateCommand);
+profiles.command("update").description("Update profile").requiredOption("--id <id>", "Profile ID").option("--name <name>", "Profile name").option("--context-json <json>", "Context JSON").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(profilesUpdateCommand);
+profiles.command("remove").description("Remove profile").requiredOption("--id <id>", "Profile ID").option("-y, --yes", "Confirm destructive action").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(profilesRemoveCommand);
+profiles.command("set-default").description("Set default profile").requiredOption("--id <id>", "Profile ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(profilesSetDefaultCommand);
+var agents = program.command("agents").description("Manage agent artifacts");
+var workflows = program.command("workflows").description("Manage local workflow execution lifecycle");
+workflows.command("list").description("List control flows available for execution").option("--project-id <id>", "Project ID filter").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsListCommand);
+workflows.command("start").description("Start a workflow execution for a CLI session").requiredOption("--session-id <id>", "CLI session ID").requiredOption("--flow-id <id>", "Control flow ID").option("--current-node-id <id>", "Current node ID").option("--current-step-label <label>", "Current step label").option("--metadata <json>", "JSON metadata payload").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsStartCommand);
+workflows.command("progress").description("Update workflow execution progress").requiredOption("--execution-id <id>", "Workflow execution ID").option("--current-node-id <id>", "Current node ID").option("--current-step-label <label>", "Current step label").option("--metadata <json>", "JSON metadata payload").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsProgressCommand);
+workflows.command("active").description("Get active workflow execution for a CLI session").requiredOption("--session-id <id>", "CLI session ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsActiveCommand);
+workflows.command("complete").description("Mark a workflow execution complete").requiredOption("--execution-id <id>", "Workflow execution ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsCompleteCommand);
+workflows.command("fail").description("Mark a workflow execution failed").requiredOption("--execution-id <id>", "Workflow execution ID").option("--error-message <message>", "Failure message").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsFailCommand);
+workflows.command("cancel").description("Cancel a workflow execution").requiredOption("--execution-id <id>", "Workflow execution ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(workflowsCancelCommand);
+agents.command("list").description("List saved agents").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsListCommand);
+agents.command("get").description("Get an agent by id").requiredOption("--id <id>", "Agent ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsGetCommand);
+agents.command("create").description("Create an agent").requiredOption("--name <name>", "Agent name").requiredOption("--description <description>", "Agent description").requiredOption("--prompt <prompt>", "Agent system prompt").option("--scope <scope>", "Scope: global or project").option("--project-id <id>", "Project ID for project-scoped agent").option("--mode <mode>", "Mode: primary, subagent, all").option("--model <model>", "Model override").option("--skills <list>", "Comma-separated skill names").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsCreateCommand);
+agents.command("update").description("Update an agent").requiredOption("--id <id>", "Agent ID").option("--name <name>", "Agent name").option("--description <description>", "Agent description").option("--prompt <prompt>", "Agent system prompt").option("--mode <mode>", "Mode: primary, subagent, all").option("--model <model>", "Model override").option("--skills <list>", "Comma-separated skill names").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsUpdateCommand);
+agents.command("remove").description("Remove an agent").requiredOption("--id <id>", "Agent ID").option("-y, --yes", "Confirm destructive action").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsRemoveCommand);
+agents.command("install").description("Install a saved agent to local coding tools").requiredOption("--id <id>", "Agent ID").option(
+  "-a, --agents <list>",
+  "Comma-separated list of target coding tools (eg. claude-code,opencode)"
+).option("-g, --global", "Install to global agent directories").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(agentsInstallCommand);
+var references = program.command("references").description("Manage rule references");
+references.command("list").description("List references for a rule").requiredOption("--rule-id <id>", "Rule ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(referencesListCommand);
+references.command("get").description("Get a reference by id").requiredOption("--id <id>", "Reference ID").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(referencesGetCommand);
+references.command("create").description("Create a reference from file").requiredOption("--rule-id <id>", "Rule ID").requiredOption("--file <path>", "Reference file path").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(referencesCreateCommand);
+references.command("update").description("Update reference metadata").requiredOption("--id <id>", "Reference ID").option("--label <label>", "Reference label").option("--replace-file <path>", "Replace reference with file").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(referencesUpdateCommand);
+references.command("remove").description("Remove reference").requiredOption("--id <id>", "Reference ID").option("-y, --yes", "Confirm destructive action").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(referencesRemoveCommand);
+references.command("reorder").description("Reorder references").requiredOption("--rule-id <id>", "Rule ID").requiredOption("--ordered-ids <ids>", "Comma-separated reference IDs").option("-s, --server <url>", "braid server URL (for review apps, local dev)").option("--api-key <token>", "API key override").option("--json", "Output JSON").action(referencesReorderCommand);
 program.command("update").alias("up").description("Update installed skills to the latest version").option("-g, --global", "Update skills in global directories only").option("-y, --yes", "Skip confirmation prompts").option("-s, --server <url>", "braid server URL (for review apps, local dev)").action(updateCommand);
 program.command("remove").alias("rm").description("Remove installed skills").option("-a, --all", "Remove all installed skills").option("-g, --global", "Remove skills from global directories only").option("-y, --yes", "Skip confirmation prompts").option("--skill <name>", "Remove a specific skill by name").action(removeCommand);
-program.command("mcp").description("Configure braid MCP in your AI coding tools").option("-t, --tool <name>", "Tool to configure").option("-g, --global", "Use global config instead of project").option("--token <token>", "API token to embed").option("--no-auth", "Skip authentication setup").option("--scope", "Run interactive scope configuration").option("--remove", "Remove braid MCP from a tool").option("--status", "Show which tools have braid MCP configured").option("-y, --yes", "Skip confirmation prompts").option("-s, --server <url>", "Custom MCP server URL").action(mcpCommand);
+program.command("mcp").description("Configure braid MCP in your AI coding tools").option("-t, --tool <name>", "Tool to configure").option("-g, --global", "Use global config instead of project").option("--token <token>", "API token to embed").option("--no-auth", "Skip authentication setup").option("--scope", "Run interactive scope configuration").option("--remove", "Remove braid MCP from a tool").option("--status", "Show which tools have braid MCP configured").option("--help-commands", "Show MCP manual command reference").option("-y, --yes", "Skip confirmation prompts").option("-s, --server <url>", "Custom MCP server URL").action(mcpCommand);
 program.parse();
 //# sourceMappingURL=index.js.map