@brainbase-labs/cli 0.15.0 → 0.16.0-rc.1

package/dist/index.js

@@ -35141,7 +35141,7 @@ var require_dist2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-var import_picocolors42 = __toESM(require_picocolors(), 1);
+var import_picocolors43 = __toESM(require_picocolors(), 1);
 import process14 from "node:process";
 import fs76 from "node:fs";
 
@@ -36008,7 +36008,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.15.0",
+  version: "0.16.0-rc.1",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -36022,8 +36022,10 @@ var package_default = {
   scripts: {
     dev: "bun run src/index.ts",
     build: "bun run scripts/build.ts",
+    test: "bun test",
     typecheck: "tsc --noEmit",
-    prepublishOnly: "bun run typecheck && bun run build"
+    verify: "bun run typecheck && bun test && bun run build",
+    prepublishOnly: "bun run verify"
   },
   repository: {
     type: "git",
@@ -53348,7 +53350,8 @@ function apiErrorMessage(body, status) {
 }
 
 // src/core/api.ts
-var DEFAULT_API_BASE = "https://kafka-llm-service.onrender.com";
+var DEFAULT_CONTROL_PLANE_BASE = "https://api.brainbaselabs.com";
+var DEFAULT_PROXY_BASE = "https://api.v1.brainbaselabs.com";
 
 class ApiError extends Error {
   status;
@@ -53360,13 +53363,25 @@ class ApiError extends Error {
     this.name = "ApiError";
   }
 }
-function apiBase(session) {
-  const envOverride = process.env.BRAINBASE_API_URL;
-  if (envOverride)
-    return envOverride.replace(/\/+$/, "");
-  if (session?.server)
-    return session.server.replace(/\/+$/, "");
-  return DEFAULT_API_BASE.replace(/\/+$/, "");
+function apiBase(_session) {
+  const controlPlane = process.env.BRAINBASE_CONTROL_PLANE_URL;
+  if (controlPlane) {
+    return `${controlPlane.replace(/\/+$/, "")}/v2/cli`;
+  }
+  const legacyApi = process.env.BRAINBASE_API_URL;
+  if (legacyApi) {
+    return `${legacyApi.replace(/\/+$/, "")}/api/cli`;
+  }
+  return `${DEFAULT_CONTROL_PLANE_BASE}/v2/cli`;
+}
+function usesLegacyControlPlane() {
+  return !process.env.BRAINBASE_CONTROL_PLANE_URL && !!process.env.BRAINBASE_API_URL;
+}
+function legacyScheduleError() {
+  return new ApiError("Schedule-trigger writes require the MAS control plane. Set BRAINBASE_CONTROL_PLANE_URL or unset the legacy BRAINBASE_API_URL override.", 400);
+}
+function legacyAgentConfigError() {
+  return new ApiError("Declarative machine/model config requires the MAS control plane. Set BRAINBASE_CONTROL_PLANE_URL or unset the legacy BRAINBASE_API_URL override.", 400);
 }
 function requireSession() {
   const status = authStatus();
@@ -53412,87 +53427,113 @@ async function request(pathname, init = {}) {
 }
 var api = {
   listOrgs() {
-    return request("/api/cli/orgs");
+    return request("/orgs");
   },
   listTeams(orgId) {
-    return request(`/api/cli/orgs/${encodeURIComponent(orgId)}/teams`);
+    return request(`/orgs/${encodeURIComponent(orgId)}/teams`);
   },
   createTeam(orgId, name) {
-    return request(`/api/cli/orgs/${encodeURIComponent(orgId)}/teams`, {
+    return request(`/orgs/${encodeURIComponent(orgId)}/teams`, {
       method: "POST",
       body: JSON.stringify({ name })
     });
   },
   createAgent(input) {
-    return request("/api/cli/agents", {
+    if (usesLegacyControlPlane() && (input.machine_kind !== undefined || input.default_model !== undefined)) {
+      return Promise.reject(legacyAgentConfigError());
+    }
+    return request("/agents", {
       method: "POST",
       body: JSON.stringify(input)
     });
   },
   getAgent(agentId) {
-    return request(`/api/cli/agents/${encodeURIComponent(agentId)}`);
+    return request(`/agents/${encodeURIComponent(agentId)}`);
   },
   getAgentRevision(agentId) {
-    return request(`/api/cli/agents/${encodeURIComponent(agentId)}/revision`);
+    return request(`/agents/${encodeURIComponent(agentId)}/revision`);
   },
   getAgentManifest(agentId) {
-    return request(`/api/cli/agents/${encodeURIComponent(agentId)}/manifest`);
+    return request(`/agents/${encodeURIComponent(agentId)}/manifest`);
   },
   updateAgent(agentId, input) {
-    return request(`/api/cli/agents/${encodeURIComponent(agentId)}`, {
+    if (usesLegacyControlPlane() && (input.machine_kind !== undefined || input.default_model !== undefined)) {
+      return Promise.reject(legacyAgentConfigError());
+    }
+    return request(`/agents/${encodeURIComponent(agentId)}`, {
       method: "PUT",
       body: JSON.stringify(input)
     });
   },
   pushAgentManifest(agentId, input) {
-    return request(`/api/cli/agents/${encodeURIComponent(agentId)}/manifest`, {
+    return request(`/agents/${encodeURIComponent(agentId)}/manifest`, {
       method: "PUT",
       body: JSON.stringify(input)
     });
   },
   getAgentSecrets(agentId) {
-    return request(`/api/cli/agents/${encodeURIComponent(agentId)}/secrets`);
+    return request(`/agents/${encodeURIComponent(agentId)}/secrets`);
   },
   putAgentSecrets(agentId, secrets) {
-    return request(`/api/cli/agents/${encodeURIComponent(agentId)}/secrets`, {
+    return request(`/agents/${encodeURIComponent(agentId)}/secrets`, {
       method: "PUT",
       body: JSON.stringify({ secrets })
     });
   },
   createCliKey(agentId, input) {
-    return request(`/api/cli/agents/${encodeURIComponent(agentId)}/keys`, {
+    return request(`/agents/${encodeURIComponent(agentId)}/keys`, {
       method: "POST",
       body: JSON.stringify(input)
     });
   },
   revokeCliKey(keyId) {
-    return request(`/api/cli/keys/${encodeURIComponent(keyId)}`, {
+    return request(`/keys/${encodeURIComponent(keyId)}`, {
       method: "DELETE"
     });
   },
   listOrchestrations(orgId, teamId) {
-    return request(`/api/cli/orgs/${encodeURIComponent(orgId)}/teams/${encodeURIComponent(teamId)}/orchestrations`);
+    return request(`/orgs/${encodeURIComponent(orgId)}/teams/${encodeURIComponent(teamId)}/orchestrations`);
+  },
+  createOrchestration(input) {
+    if (usesLegacyControlPlane()) {
+      return Promise.reject(new ApiError("Orchestration creation requires the MAS control plane. Set BRAINBASE_CONTROL_PLANE_URL or unset the legacy BRAINBASE_API_URL override.", 400));
+    }
+    return request("/orchestrations", {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
   },
   getOrchestration(orchId) {
-    return request(`/api/cli/orchestrations/${encodeURIComponent(orchId)}`);
+    return request(`/orchestrations/${encodeURIComponent(orchId)}`);
   },
   getOrchestrationManifest(orchId) {
-    return request(`/api/cli/orchestrations/${encodeURIComponent(orchId)}/manifest`);
+    return request(`/orchestrations/${encodeURIComponent(orchId)}/manifest`);
   },
-  updateOrchestration(orchId, input) {
-    return request(`/api/cli/orchestrations/${encodeURIComponent(orchId)}`, {
+  async updateOrchestration(orchId, input) {
+    let payload = input;
+    if (usesLegacyControlPlane() && input.triggers !== undefined) {
+      if (input.triggers.length > 0)
+        throw legacyScheduleError();
+      const current = await request(`/orchestrations/${encodeURIComponent(orchId)}`);
+      if ((current.triggers ?? []).some((trigger) => trigger.trigger_type === "schedule")) {
+        throw legacyScheduleError();
+      }
+      const { triggers: _unsupported, ...legacyPayload } = input;
+      payload = legacyPayload;
+    }
+    return request(`/orchestrations/${encodeURIComponent(orchId)}`, {
       method: "PUT",
-      body: JSON.stringify(input)
+      body: JSON.stringify(payload)
     });
   }
 };
 function proxyBaseUrl(session) {
-  const envOverride = process.env.BRAINBASE_API_URL;
+  const envOverride = process.env.BRAINBASE_PROXY_URL || process.env.BRAINBASE_API_URL;
   if (envOverride)
     return envOverride.replace(/\/+$/, "");
   if (session?.server)
     return session.server.replace(/\/+$/, "");
-  return DEFAULT_API_BASE.replace(/\/+$/, "");
+  return DEFAULT_PROXY_BASE.replace(/\/+$/, "");
 }
 
 // src/core/token.ts
@@ -53554,9 +53595,9 @@ function clearToken() {
 }
 
 // src/core/registry-client.ts
-var DEFAULT_BASE = "https://kafka-llm-service.onrender.com";
+var DEFAULT_BASE = "https://api.v1.brainbaselabs.com";
 function baseUrl(session) {
-  const env3 = process.env.BRAINBASE_REGISTRY_URL ?? process.env.BRAINBASE_API_URL;
+  const env3 = process.env.BRAINBASE_REGISTRY_URL || process.env.BRAINBASE_API_URL;
   if (env3)
     return env3.replace(/\/+$/, "");
   if (session?.server)
@@ -53564,7 +53605,7 @@ function baseUrl(session) {
   return DEFAULT_BASE.replace(/\/+$/, "");
 }
 function registryHost() {
-  const env3 = process.env.BRAINBASE_REGISTRY_URL ?? process.env.BRAINBASE_API_URL;
+  const env3 = process.env.BRAINBASE_REGISTRY_URL || process.env.BRAINBASE_API_URL;
   if (env3)
     return env3.replace(/\/+$/, "");
   const s = readAuth();
@@ -60799,10 +60840,13 @@ var EvalSchema = exports_external.object({
   message: "classification_values must not contain duplicate labels",
   path: ["classification_values"]
 });
+var MODEL_ID_RE = /^[A-Za-z0-9._:/-]{1,128}$/;
 var AgentManifestSchema = exports_external.object({
   schema: exports_external.literal(1),
   id: exports_external.string().min(1).optional(),
   harness: exports_external.string().min(1).optional(),
+  machine_kind: exports_external.string().trim().min(1).optional(),
+  default_model: exports_external.string().trim().regex(MODEL_ID_RE, "default_model must use letters, digits, and . _ - : / only (max 128)").nullable().optional(),
   agent: AgentMetaSchema,
   instructions: InstructionsSchema.optional(),
   entrypoint: EntrypointSchema.optional(),
@@ -61037,7 +61081,9 @@ var SyncedComponentSchema = exports_external.object({
 var AgentMetaSnapshotSchema = exports_external.object({
   name: exports_external.string(),
   tagline: exports_external.string().nullish().transform((v3) => v3 ?? undefined),
-  entrypoint: exports_external.string().optional()
+  entrypoint: exports_external.string().optional(),
+  machine_kind: exports_external.string().min(1).optional(),
+  default_model: exports_external.string().nullable().optional()
 });
 var SyncStateSchema = exports_external.object({
   schemaVersion: exports_external.literal(1),
@@ -61933,7 +61979,8 @@ async function runSync(cwd2, args) {
       agent_id: link2.agent_id,
       revision: manifest.revision,
       synced_at: new Date().toISOString(),
-      components: prevState?.components ?? []
+      components: prevState?.components ?? [],
+      agentMeta: prevState?.agentMeta
     });
     return;
   }
@@ -62102,7 +62149,8 @@ async function runSync(cwd2, args) {
       agent_id: link2.agent_id,
       revision: manifest.revision,
       synced_at: new Date().toISOString(),
-      components: nextComponents
+      components: nextComponents,
+      agentMeta: prevState?.agentMeta
     };
     writeSyncState(cwd2, newState);
     $e(`Synced ${link2.name} to revision ${manifest.revision}.`);
@@ -62241,17 +62289,15 @@ function canonicalJson(value) {
   throw new Error(`Unsupported value in canonicalJson: ${typeof value}`);
 }
 function hashMcpEntry(entry) {
-  const payload = {};
+  const payload = {
+    args: entry.args ?? [],
+    env: entry.env ?? {},
+    headers: entry.headers ?? {}
+  };
   if (entry.url !== undefined)
     payload.url = entry.url;
   if (entry.command !== undefined)
     payload.command = entry.command;
-  if (entry.args !== undefined)
-    payload.args = entry.args;
-  if (entry.env !== undefined)
-    payload.env = entry.env;
-  if (entry.headers !== undefined)
-    payload.headers = entry.headers;
   payload.is_enabled = entry.is_enabled ?? true;
   return crypto4.createHash("sha256").update(canonicalJson(payload)).digest("hex");
 }
@@ -62422,7 +62468,10 @@ function threeWayDiff(input) {
       const sourceChanged = !!local && local.hash === null && !!local.declaredSource && lock?.source !== undefined && lock.source !== local.declaredSource;
       const localChanged = sourceChanged || localHash !== null && lockHash !== undefined && localHash !== lockHash;
       const cloudChanged = cloudHash !== undefined && lockHash !== undefined && cloudHash !== lockHash;
-      if (localChanged && cloudChanged)
+      const converged = !sourceChanged && localHash !== null && cloudHash !== undefined && localHash === cloudHash;
+      if (converged)
+        status = "in-sync";
+      else if (localChanged && cloudChanged)
         status = "modified-both";
       else if (localChanged)
         status = "modified-local";
@@ -62489,6 +62538,60 @@ function diffAgentMeta(manifestMeta, lockMeta, cloudMeta) {
     cloudChanged: !!cloudMeta && !!lockMeta && !eq(cloudMeta, lockMeta)
   };
 }
+function hasOwn(value, key2) {
+  return !!value && Object.prototype.hasOwnProperty.call(value, key2);
+}
+function diffAgentConfig(manifest, lock, cloud) {
+  const unsupported = [];
+  const machineSupported = cloud.machine_kind !== undefined;
+  const defaultModelSupported = hasOwn(cloud, "default_model");
+  if (manifest.machine_kind !== undefined && !machineSupported) {
+    unsupported.push("machine_kind");
+  }
+  if (manifest.default_model !== undefined && !defaultModelSupported) {
+    unsupported.push("default_model");
+  }
+  const machineMismatch = manifest.machine_kind !== undefined && machineSupported && manifest.machine_kind !== cloud.machine_kind;
+  const machineLocalChanged = manifest.machine_kind !== undefined && machineSupported && (lock?.machine_kind !== undefined ? manifest.machine_kind !== lock.machine_kind && manifest.machine_kind !== cloud.machine_kind : manifest.machine_kind !== cloud.machine_kind);
+  const machineCloudChanged = lock?.machine_kind !== undefined && machineSupported && lock.machine_kind !== cloud.machine_kind && manifest.machine_kind !== cloud.machine_kind;
+  const machineConverged = manifest.machine_kind !== undefined && machineSupported && manifest.machine_kind === cloud.machine_kind && (lock?.machine_kind === undefined || lock.machine_kind !== cloud.machine_kind);
+  let defaultModelLocalChanged = false;
+  let defaultModelCloudChanged = false;
+  let defaultModelConflict = false;
+  let defaultModelConverged = false;
+  if (defaultModelSupported) {
+    const cloudValue = cloud.default_model ?? null;
+    const localAuthored = manifest.default_model !== undefined;
+    const lockSupported = hasOwn(lock, "default_model");
+    if (localAuthored) {
+      const localValue = manifest.default_model ?? null;
+      if (lockSupported) {
+        const lockValue = lock?.default_model ?? null;
+        const localMoved = localValue !== lockValue;
+        const cloudMoved = cloudValue !== lockValue;
+        defaultModelConflict = localMoved && cloudMoved && localValue !== cloudValue;
+        defaultModelLocalChanged = localMoved && localValue !== cloudValue;
+        defaultModelCloudChanged = cloudMoved && localValue !== cloudValue;
+        defaultModelConverged = localMoved && cloudMoved && localValue === cloudValue;
+      } else {
+        defaultModelLocalChanged = localValue !== cloudValue;
+        defaultModelConverged = localValue === cloudValue;
+      }
+    } else if (lockSupported) {
+      defaultModelCloudChanged = cloudValue !== (lock?.default_model ?? null);
+    }
+  }
+  return {
+    unsupported,
+    machineMismatch,
+    machineLocalChanged,
+    machineCloudChanged,
+    defaultModelLocalChanged,
+    defaultModelCloudChanged,
+    defaultModelConflict,
+    baselineConverged: machineConverged || defaultModelConverged
+  };
+}
 
 // src/core/secrets-env.ts
 import path75 from "node:path";
@@ -62714,7 +62817,7 @@ async function runAgentUnpack(cwd2, args) {
       cwd: cwd2,
       scope,
       resolveConflict: async (_c) => "overwrite",
-      resolveSecret: async () => null
+      resolveSecret: makeLocalSecretResolver(cwd2)
     };
     const sp = de();
     sp.start("Installing harness layout…");
@@ -62799,10 +62902,10 @@ function stageLocalSkill(source, cwd2, stageRoot, scope, toInstall) {
     return null;
   }
   try {
-    const parsed = parseSkillSource(source);
+    const parsed = resolveSkillSourceForUnpack(source);
     if (parsed.type === "local" || parsed.type === "inline")
       return null;
-    const slug = defaultSlugForSource(source);
+    const slug = skillComponentSlugForUnpack(source);
     const compDir = path76.join(stageRoot, "skill", slug);
     ensureDir(compDir);
     toInstall.push({
@@ -62818,10 +62921,35 @@ function stageLocalSkill(source, cwd2, stageRoot, scope, toInstall) {
     return `Skill ${source}: ${err.message} — skipped.`;
   }
 }
+function resolveSkillSourceForUnpack(source) {
+  if (source.startsWith("registry:")) {
+    const parsed = parseSkillSource2(source);
+    if (parsed.kind !== "registry" || !parsed.creator) {
+      throw new Error(`Registry skill source must include a creator: ${source}`);
+    }
+    return {
+      type: "brainbase",
+      creator: parsed.creator,
+      slug: parsed.slug,
+      version: parsed.version
+    };
+  }
+  return parseSkillSource(source);
+}
+function makeLocalSecretResolver(cwd2) {
+  const secrets = readLocalSecrets(cwd2);
+  return async (key2) => secrets[key2] ?? null;
+}
+function skillComponentSlugForUnpack(source) {
+  if (source.startsWith("registry:")) {
+    const parsed = parseSkillSource2(source);
+    if (parsed.kind === "registry") {
+      return registrySkillComponentSlug(parsed);
+    }
+  }
+  return defaultSlugForSource(source);
+}
 function defaultSlugForSource(source) {
-  const reg = /^registry:(?:[a-z0-9_-]+\/)?([a-z0-9_-]+)/i.exec(source);
-  if (reg)
-    return reg[1].toLowerCase();
   const gh = /^(?:github|git):[^/]*\/?([a-z0-9_-]+)/i.exec(source);
   if (gh)
     return gh[1].toLowerCase();
@@ -62915,6 +63043,23 @@ async function runAgentPull(cwd2, args) {
     lock: lock?.components ?? [],
     cloud: cloud.components
   });
+  const config = diffAgentConfig(existingManifest ?? {}, lock?.agentMeta, cloudAgent);
+  const localRuntimeConfigChanged = config.machineLocalChanged || config.defaultModelLocalChanged;
+  if (localRuntimeConfigChanged && !args.force) {
+    f2.error(`Runtime config has local edits that pull would overwrite: ${[
+      ...config.machineLocalChanged ? ["machine_kind"] : [],
+      ...config.defaultModelLocalChanged ? ["default_model"] : []
+    ].join(", ")}.`);
+    if (config.machineLocalChanged) {
+      f2.info(`machine_kind cannot change on an existing agent. Run ${import_picocolors26.default.cyan("brainbase agent pull --force")} to discard the edit, or create a new agent for that provider.`);
+    }
+    if (config.defaultModelLocalChanged) {
+      f2.info(`Push the default_model edit first, or run ${import_picocolors26.default.cyan("brainbase agent pull --force")} to discard it.`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const runtimeConfigChanged = config.machineCloudChanged || config.defaultModelCloudChanged || !!args.force && localRuntimeConfigChanged;
   const toInstallKeys = new Set;
   const toRemoveKeys = new Set;
   const conflicts = [];
@@ -62968,7 +63113,7 @@ async function runAgentPull(cwd2, args) {
     declaredSlugs: declaredMcpSlugs,
     scope: args.scope ?? "project"
   });
-  if (toInstallKeys.size === 0 && toRemoveKeys.size === 0 && builtinInstall.length === 0 && builtinRemoveSlugs.length === 0 && !override) {
+  if (toInstallKeys.size === 0 && toRemoveKeys.size === 0 && builtinInstall.length === 0 && builtinRemoveSlugs.length === 0 && !runtimeConfigChanged && !override) {
     f2.info(`You're up to date.`);
     writeLink(cwd2, buildLinkFromAgent(cloudAgent, harness, readLink(cwd2)));
     writeSyncState(cwd2, buildLockFromCloud(agentId, cloud, lock, cloudAgent));
@@ -63002,6 +63147,13 @@ async function runAgentPull(cwd2, args) {
       text: String(keepLocalKeys.size)
     });
   }
+  if (runtimeConfigChanged) {
+    resultRows.push({
+      type: "upd",
+      label: "runtime config",
+      text: "machine/model from cloud"
+    });
+  }
   await showResultCard({
     title: override ? "PULL (FORCE)" : "PULL",
     tone: override ? "warn" : "info",
@@ -63022,6 +63174,7 @@ async function runAgentPull(cwd2, args) {
   const stageRoot = stageManifestComponents(installComponents);
   const justInstalledPaths = new Map;
   try {
+    const availableSecrets = await pullSecrets(cwd2, agentId);
     if (installComponents.length > 0 || builtinInstall.length > 0) {
       const installSpinner = de();
       installSpinner.start("Applying updates…");
@@ -63032,7 +63185,7 @@ async function runAgentPull(cwd2, args) {
         rootDir: path77.join(stageRoot, c2.type, c2.slug),
         description: c2.description,
         meta: c2.meta,
-        payload: proxifyMcpPayload(c2.meta?.mcp),
+        payload: proxifyMcpPayload(structuredClone(c2.meta?.mcp)),
         checksum: c2.hash,
         source: skillSourceFromMeta(c2)
       }));
@@ -63041,7 +63194,7 @@ async function runAgentPull(cwd2, args) {
         cwd: cwd2,
         scope,
         resolveConflict: async (_c) => "overwrite",
-        resolveSecret: async () => null
+        resolveSecret: async (name) => availableSecrets[name] ?? null
       };
       const result2 = await runHarnessInstall3(adapter.id, componentsForNativeInstall(toInstall, !!args.acp), opts, cloudAgent.name);
       installSpinner.stop("Applied.");
@@ -63096,11 +63249,12 @@ async function runAgentPull(cwd2, args) {
       agentMeta: {
         name: cloudAgent.name,
         tagline: cloudAgent.tagline,
-        ...cloudAgent.entrypoint ? { entrypoint: cloudAgent.entrypoint.trim() } : {}
+        ...cloudAgent.entrypoint ? { entrypoint: cloudAgent.entrypoint.trim() } : {},
+        ...cloudAgent.machine_kind ? { machine_kind: cloudAgent.machine_kind } : lock?.agentMeta?.machine_kind ? { machine_kind: lock.agentMeta.machine_kind } : {},
+        ...Object.prototype.hasOwnProperty.call(cloudAgent, "default_model") ? { default_model: cloudAgent.default_model ?? null } : Object.prototype.hasOwnProperty.call(lock?.agentMeta ?? {}, "default_model") ? { default_model: lock.agentMeta.default_model ?? null } : {}
       }
     };
     writeSyncState(cwd2, newState);
-    await pullSecrets(cwd2, agentId);
     await runEntrypointIfPresent(cwd2, yaml, entrypointExecutionAllowed({ flag: args.runEntrypoint, env: process.env }));
     $e(`Pulled ${cloudAgent.name} at revision ${cloud.revision}.`);
   } finally {
@@ -63299,10 +63453,14 @@ function mergeManifest(cwd2, prev, cloud, cloudAgent, harness) {
     return entry;
   });
   const caps = capabilitiesFromAgent(cloudAgent);
+  const machineKind = cloudAgent.machine_kind ?? prev?.machine_kind;
+  const defaultModelSupported = Object.prototype.hasOwnProperty.call(cloudAgent, "default_model");
   return {
     schema: 1,
     id: cloudAgent.id,
     harness,
+    ...machineKind ? { machine_kind: machineKind } : {},
+    ...defaultModelSupported ? cloudAgent.default_model ? { default_model: cloudAgent.default_model } : prev?.default_model === null ? { default_model: null } : {} : prev?.default_model !== undefined ? { default_model: prev.default_model } : {},
     agent: {
       name: cloudAgent.name,
       ...cloudAgent.tagline ? { tagline: cloudAgent.tagline } : {}
@@ -63379,7 +63537,9 @@ function buildLockFromCloud(agent_id, cloud, prev, cloudAgent) {
     agentMeta: cloudAgent ? {
       name: cloudAgent.name,
       tagline: cloudAgent.tagline,
-      ...cloudAgent.entrypoint ? { entrypoint: cloudAgent.entrypoint.trim() } : {}
+      ...cloudAgent.entrypoint ? { entrypoint: cloudAgent.entrypoint.trim() } : {},
+      ...cloudAgent.machine_kind ? { machine_kind: cloudAgent.machine_kind } : prev?.agentMeta?.machine_kind ? { machine_kind: prev.agentMeta.machine_kind } : {},
+      ...Object.prototype.hasOwnProperty.call(cloudAgent, "default_model") ? { default_model: cloudAgent.default_model ?? null } : Object.prototype.hasOwnProperty.call(prev?.agentMeta ?? {}, "default_model") ? { default_model: prev.agentMeta.default_model ?? null } : {}
     } : prev?.agentMeta
   };
 }
@@ -63449,6 +63609,7 @@ async function runEntrypointIfPresent(cwd2, manifest, execute) {
   }
 }
 async function pullSecrets(cwd2, agentId) {
+  const localSecrets = readLocalSecrets(cwd2);
   let cloudSecrets;
   const sp = de();
   sp.start("Fetching secrets…");
@@ -63461,9 +63622,8 @@ async function pullSecrets(cwd2, agentId) {
     if (err instanceof ApiError && err.status !== 404) {
       f2.warn(`Skipped secrets: ${err.message}`);
     }
-    return;
+    return localSecrets;
   }
-  const localSecrets = readLocalSecrets(cwd2);
   const diff2 = diffSecrets(localSecrets, cloudSecrets);
   if (diff2.localOnly.length > 0 || diff2.changed.length > 0) {
     if (diff2.localOnly.length) {
@@ -63475,6 +63635,7 @@ async function pullSecrets(cwd2, agentId) {
   }
   const merged = { ...cloudSecrets, ...localSecrets };
   writeLocalSecrets(cwd2, merged);
+  return merged;
 }
 function handleApiError2(err) {
   if (err instanceof ApiError) {
@@ -63703,8 +63864,12 @@ async function runAgentPush(cwd2, args) {
   const sp = de();
   sp.start(`Fetching cloud state…`);
   let cloud;
+  let cloudAgent;
   try {
-    cloud = await api.getAgentManifest(agentId);
+    [cloud, cloudAgent] = await Promise.all([
+      api.getAgentManifest(agentId),
+      api.getAgent(agentId)
+    ]);
     sp.stop(`Cloud revision ${cloud.revision}.`);
   } catch (err) {
     sp.stop("Failed.");
@@ -63717,6 +63882,33 @@ async function runAgentPush(cwd2, args) {
     lock: lock?.components ?? [],
     cloud: cloud.components
   });
+  const config = diffAgentConfig(manifest, lock?.agentMeta, cloudAgent);
+  if (config.unsupported.length > 0) {
+    f2.error(`This control plane does not support declarative ${config.unsupported.join(" / ")} config.`);
+    f2.info(`Use the MAS control plane, then run ${import_picocolors28.default.cyan("brainbase agent pull")} before retrying.`);
+    process.exitCode = 1;
+    return;
+  }
+  if (config.machineMismatch) {
+    if (config.machineCloudChanged && !config.machineLocalChanged) {
+      f2.error("Cannot push: machine_kind changed on the cloud.");
+      f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent pull")} to accept the cloud provider.`);
+    } else {
+      f2.error(`Cannot change machine_kind on an existing agent (${import_picocolors28.default.dim(cloudAgent.machine_kind ?? "unknown")} → ${import_picocolors28.default.bold(manifest.machine_kind)}).`);
+      f2.info("machine_kind applies when the agent is created; create a new agent to use a different provider.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+  if (config.defaultModelConflict && !args.force) {
+    f2.error("Cannot push: default_model changed both locally and on the cloud.");
+    f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent pull")} first to reconcile, or ${import_picocolors28.default.cyan("brainbase agent push --force")} to keep the local model.`);
+    process.exitCode = 1;
+    return;
+  }
+  if (config.defaultModelConflict && args.force) {
+    f2.warn(`${import_picocolors28.default.yellow("--force")}: overwriting the cloud default_model with the local value.`);
+  }
   const registryRefs = new Map;
   for (const entry of manifest.skills) {
     try {
@@ -63775,14 +63967,7 @@ async function runAgentPush(cwd2, args) {
       row.status = "modified-local";
     }
   }
-  let cloudMeta = lock?.agentMeta;
-  if (!cloudMeta) {
-    try {
-      const a3 = await api.getAgent(agentId);
-      cloudMeta = { name: a3.name, tagline: a3.tagline, entrypoint: a3.entrypoint };
-    } catch {}
-  }
-  const meta = diffAgentMeta(manifest.agent, lock?.agentMeta, cloudMeta);
+  const meta = diffAgentMeta(manifest.agent, lock?.agentMeta, cloudAgent);
   let resolvedEntrypoint;
   if (manifest.entrypoint) {
     const body = resolveEntrypoint(cwd2, manifest);
@@ -63832,10 +64017,6 @@ async function runAgentPush(cwd2, args) {
   }
   const { toSend, conflicts, upstreamOnly } = partitionPushRows(rows, !!args.force);
   const forcedOverrides = args.force ? rows.filter((r2) => r2.status === "modified-both") : [];
-  if (!meta.localChanged && !entrypointChanged && toSend.length === 0 && conflicts.length === 0) {
-    f2.info("Nothing to push — local is in sync with the cloud.");
-    return;
-  }
   if (conflicts.length > 0) {
     f2.error(`Cannot push: ${conflicts.length} component${conflicts.length === 1 ? "" : "s"} changed both locally and on the cloud:`);
     for (const r2 of conflicts) {
@@ -63857,6 +64038,61 @@ async function runAgentPush(cwd2, args) {
     }
     f2.info(`If you push now, your push targets revision ${cloud.revision} and may race. Consider \`brainbase agent pull\` first.`);
   }
+  if (config.defaultModelCloudChanged || config.machineCloudChanged) {
+    f2.warn(`Cloud runtime config changed since the last sync. Run ${import_picocolors28.default.cyan("brainbase agent pull")} to accept it locally.`);
+  }
+  const shouldPushManifest = meta.localChanged || entrypointChanged || toSend.length > 0;
+  const shouldUpdateAgent = meta.localChanged || entrypointChanged || config.defaultModelLocalChanged;
+  const hasAgentChanges = shouldPushManifest || shouldUpdateAgent;
+  const outgoing = hasAgentChanges ? await buildOutgoingComponents(cwd2, manifest, cloud, resolvedVersions) : null;
+  if (hasAgentChanges && outgoing === null) {
+    process.exitCode = 1;
+    return;
+  }
+  let secretPlan = null;
+  try {
+    secretPlan = await planSecretPush(cwd2, agentId);
+  } catch (err) {
+    if (!hasAgentChanges) {
+      handleApiError3(err);
+      return;
+    }
+    f2.warn(`Couldn't read cloud secrets to diff: ${err.message}. Skipping secret push.`);
+  }
+  if (!hasAgentChanges && config.baselineConverged) {
+    writeSyncState(cwd2, lock ? {
+      ...lock,
+      synced_at: new Date().toISOString(),
+      agentMeta: buildAgentMetaAfterPush({
+        manifest,
+        lock,
+        cloudAgent,
+        resolvedEntrypoint,
+        config
+      })
+    } : {
+      schemaVersion: 1,
+      agent_id: agentId,
+      revision: cloud.revision,
+      synced_at: new Date().toISOString(),
+      components: [],
+      agentMeta: buildAgentMetaAfterPush({
+        manifest,
+        lock,
+        cloudAgent,
+        resolvedEntrypoint,
+        config
+      })
+    });
+  }
+  if (!hasAgentChanges && !secretPlan) {
+    if (config.defaultModelCloudChanged || config.machineCloudChanged) {
+      f2.info("Nothing local to push; cloud runtime config is awaiting pull.");
+      return;
+    }
+    f2.info("Nothing to push — local is in sync with the cloud.");
+    return;
+  }
   const sendKeys = new Set(toSend.map((r2) => r2.key));
   for (const u2 of skillUpdates) {
     if (!sendKeys.has(compKey("skill", u2.componentSlug)))
@@ -63882,6 +64118,13 @@ async function runAgentPush(cwd2, args) {
       text: resolvedEntrypoint === "" ? "cleared" : "updated"
     });
   }
+  if (config.defaultModelLocalChanged) {
+    resultRows.push({
+      type: "upd",
+      label: "default model",
+      text: manifest.default_model === null ? "cleared" : manifest.default_model
+    });
+  }
   if (toSend.length) {
     resultRows.push({
       type: "add",
@@ -63889,6 +64132,13 @@ async function runAgentPush(cwd2, args) {
       text: `${toSend.length} · ${toSend.map((r2) => `${r2.type}/${r2.slug}`).join(", ")}`
     });
   }
+  if (secretPlan) {
+    resultRows.push({
+      type: "upd",
+      label: "secrets",
+      text: secretDiffSummary(secretPlan.diff)
+    });
+  }
   await showResultCard({
     title: "PUSH",
     tone: "info",
@@ -63902,9 +64152,15 @@ async function runAgentPush(cwd2, args) {
       return;
     }
   }
-  if (meta.localChanged || entrypointChanged) {
+  if (!hasAgentChanges) {
+    if (!secretPlan || !await pushSecrets(agentId, secretPlan))
+      return;
+    $e(`Pushed secrets for ${manifest.agent.name}.`);
+    return;
+  }
+  if (meta.localChanged || entrypointChanged || config.defaultModelLocalChanged) {
     const metaSpinner = de();
-    metaSpinner.start("Updating agent metadata…");
+    metaSpinner.start("Updating agent config…");
     try {
       const update2 = {};
       if (meta.localChanged) {
@@ -63914,16 +64170,37 @@ async function runAgentPush(cwd2, args) {
       if (entrypointChanged) {
         update2.entrypoint = resolvedEntrypoint;
       }
-      await api.updateAgent(agentId, update2);
-      metaSpinner.stop("Metadata updated.");
+      if (config.defaultModelLocalChanged) {
+        update2.default_model = manifest.default_model ?? null;
+      }
+      cloudAgent = await api.updateAgent(agentId, update2);
+      metaSpinner.stop("Agent config updated.");
     } catch (err) {
       metaSpinner.stop("Failed.");
       return handleApiError3(err);
     }
   }
-  const outgoing = await buildOutgoingComponents(cwd2, manifest, cloud, resolvedVersions);
-  if (outgoing === null)
+  if (!shouldPushManifest) {
+    const state = {
+      schemaVersion: 1,
+      agent_id: agentId,
+      revision: cloud.revision,
+      synced_at: new Date().toISOString(),
+      components: lock?.components ?? [],
+      agentMeta: buildAgentMetaAfterPush({
+        manifest,
+        lock,
+        cloudAgent,
+        resolvedEntrypoint,
+        config
+      })
+    };
+    writeSyncState(cwd2, state);
+    if (secretPlan && !await pushSecrets(agentId, secretPlan))
+      return;
+    $e(`Pushed agent config for ${manifest.agent.name}.`);
     return;
+  }
   const pushSpinner = de();
   pushSpinner.start("Pushing…");
   let updatedCloud;
@@ -63939,6 +64216,7 @@ async function runAgentPush(cwd2, args) {
     if (err instanceof ApiError && err.status === 409) {
       f2.error(err.message);
       f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent pull")} and try again.`);
+      process.exitCode = 1;
       return;
     }
     return handleApiError3(err);
@@ -63985,43 +64263,67 @@ async function runAgentPush(cwd2, args) {
         ...decl ? { source: decl } : {}
       };
     }),
-    agentMeta: {
-      name: manifest.agent.name,
-      tagline: manifest.agent.tagline,
-      entrypoint: resolvedEntrypoint !== undefined ? resolvedEntrypoint.trim() : lock?.agentMeta?.entrypoint
-    }
+    agentMeta: buildAgentMetaAfterPush({
+      manifest,
+      lock,
+      cloudAgent,
+      resolvedEntrypoint,
+      config
+    })
   };
   writeSyncState(cwd2, newLock);
-  await pushSecrets(cwd2, agentId);
+  if (secretPlan && !await pushSecrets(agentId, secretPlan)) {
+    return;
+  }
   $e(`Pushed ${manifest.agent.name} at revision ${updatedCloud.revision}.`);
 }
-async function pushSecrets(cwd2, agentId) {
+function buildAgentMetaAfterPush({
+  manifest,
+  lock,
+  cloudAgent,
+  resolvedEntrypoint,
+  config
+}) {
+  return {
+    name: manifest.agent.name,
+    tagline: manifest.agent.tagline,
+    entrypoint: resolvedEntrypoint !== undefined ? resolvedEntrypoint.trim() : lock?.agentMeta?.entrypoint,
+    ...config.machineCloudChanged ? lock?.agentMeta?.machine_kind ? { machine_kind: lock.agentMeta.machine_kind } : {} : cloudAgent.machine_kind ? { machine_kind: cloudAgent.machine_kind } : lock?.agentMeta?.machine_kind ? { machine_kind: lock.agentMeta.machine_kind } : {},
+    ...config.defaultModelCloudChanged && !config.defaultModelLocalChanged ? Object.prototype.hasOwnProperty.call(lock?.agentMeta ?? {}, "default_model") ? { default_model: lock.agentMeta.default_model ?? null } : {} : Object.prototype.hasOwnProperty.call(cloudAgent, "default_model") ? { default_model: cloudAgent.default_model ?? null } : Object.prototype.hasOwnProperty.call(lock?.agentMeta ?? {}, "default_model") ? { default_model: lock.agentMeta.default_model ?? null } : {}
+  };
+}
+async function planSecretPush(cwd2, agentId) {
+  if (!exists(secretsPath(cwd2)))
+    return null;
   const localSecrets = readLocalSecrets(cwd2);
   if (Object.keys(localSecrets).length === 0)
-    return;
-  let cloudSecrets = {};
-  try {
-    const res = await api.getAgentSecrets(agentId);
-    cloudSecrets = res.secrets ?? {};
-  } catch (err) {
-    f2.warn(`Couldn't read cloud secrets to diff: ${err.message}. Skipping secret push.`);
-    return;
-  }
+    return null;
+  const res = await api.getAgentSecrets(agentId);
+  const cloudSecrets = res.secrets ?? {};
   const diff2 = diffSecrets(localSecrets, cloudSecrets);
   if (diff2.localOnly.length === 0 && diff2.changed.length === 0 && diff2.cloudOnly.length === 0) {
-    return;
+    return null;
   }
+  return { secrets: localSecrets, diff: diff2 };
+}
+async function pushSecrets(agentId, plan) {
   const sp = de();
   sp.start("Pushing secrets…");
   try {
-    await api.putAgentSecrets(agentId, localSecrets);
-    sp.stop(`Secrets pushed (${diff2.localOnly.length} added, ${diff2.changed.length} updated, ${diff2.cloudOnly.length} removed).`);
+    await api.putAgentSecrets(agentId, plan.secrets);
+    sp.stop(`Secrets pushed (${secretDiffSummary(plan.diff)}).`);
+    return true;
   } catch (err) {
     sp.stop("Failed.");
     handleApiError3(err);
+    return false;
   }
 }
+function secretDiffSummary(diff2) {
+  return `${diff2.localOnly.length} added, ${diff2.changed.length} updated, ${diff2.cloudOnly.length} removed`;
+}
 function handleApiError3(err) {
+  process.exitCode = 1;
   if (err instanceof ApiError) {
     if (err.status === 401) {
       f2.error("Your session is invalid. Run `brainbase login` and try again.");
@@ -64046,10 +64348,14 @@ async function runAgentStatus(cwd2) {
   const manifest = hasManifest(cwd2) ? readManifest(cwd2) : null;
   const lock = readSyncState(cwd2);
   let cloud = null;
+  let cloudAgent = null;
   const sp = de();
   sp.start(`Fetching ${link2.name}…`);
   try {
-    cloud = await api.getAgentManifest(link2.agent_id);
+    [cloud, cloudAgent] = await Promise.all([
+      api.getAgentManifest(link2.agent_id),
+      api.getAgent(link2.agent_id)
+    ]);
     sp.stop(`Cloud revision ${cloud.revision}.`);
   } catch (err) {
     sp.stop("Failed to reach brainbase.");
@@ -64071,7 +64377,8 @@ async function runAgentStatus(cwd2) {
     lock: lock?.components ?? [],
     cloud: cloud.components
   });
-  const meta = diffAgentMeta(manifest.agent, lock?.agentMeta, { name: link2.name, tagline: link2.tagline });
+  const meta = diffAgentMeta(manifest.agent, lock?.agentMeta, cloudAgent);
+  const config = diffAgentConfig(manifest, lock?.agentMeta, cloudAgent);
   const toPush = [];
   const toPull = [];
   const conflicts = [];
@@ -64115,6 +64422,29 @@ async function runAgentStatus(cwd2) {
     }
     lines.push("");
   }
+  if (config.unsupported.length > 0 || config.machineMismatch || config.machineCloudChanged || config.defaultModelLocalChanged || config.defaultModelCloudChanged) {
+    lines.push(`  ${import_picocolors29.default.bold("runtime config")}`);
+    if (config.unsupported.length > 0) {
+      lines.push(`    ${import_picocolors29.default.red("! unsupported")}  ${config.unsupported.join(", ")} not exposed by this control plane`);
+    }
+    if (config.machineMismatch && !(config.machineCloudChanged && !config.machineLocalChanged)) {
+      lines.push(`    ${import_picocolors29.default.red("! blocked")}  machine_kind differs; provider changes require a new agent`);
+    }
+    if (config.machineCloudChanged && !config.machineLocalChanged) {
+      lines.push(`    ${import_picocolors29.default.cyan("← pull")}  machine_kind changed on cloud`);
+    }
+    if (config.defaultModelConflict) {
+      lines.push(`    ${import_picocolors29.default.red("! conflict")}  default_model changed locally and on cloud`);
+    } else {
+      if (config.defaultModelLocalChanged) {
+        lines.push(`    ${import_picocolors29.default.yellow("→ push")}  default_model edited locally`);
+      }
+      if (config.defaultModelCloudChanged) {
+        lines.push(`    ${import_picocolors29.default.cyan("← pull")}  default_model changed on cloud`);
+      }
+    }
+    lines.push("");
+  }
   try {
     const localSecrets = readLocalSecrets(cwd2);
     const cloudRes = await api.getAgentSecrets(link2.agent_id);
@@ -64131,7 +64461,7 @@ async function runAgentStatus(cwd2) {
       lines.push("");
     }
   } catch {}
-  if (conflicts.length === 0 && toPush.length === 0 && toPull.length === 0) {
+  if (conflicts.length === 0 && toPush.length === 0 && toPull.length === 0 && !meta.localChanged && !meta.cloudChanged && config.unsupported.length === 0 && !config.machineMismatch && !config.machineCloudChanged && !config.defaultModelLocalChanged && !config.defaultModelCloudChanged) {
     lines.push(`  ${import_picocolors29.default.green("✓")} everything is in sync`);
     lines.push("");
     console.log(lines.join(`
@@ -64272,7 +64602,7 @@ async function runAgentCreate(cwd2, args) {
   }
   let org;
   if (args.orgId) {
-    const found = orgs.find((o2) => o2.id === args.orgId);
+    const found = orgs.find((o2) => o2.id === args.orgId || o2.slug === args.orgId);
     if (!found) {
       f2.error(`Org ${args.orgId} not found or you're not a member.`);
       return;
@@ -64285,7 +64615,7 @@ async function runAgentCreate(cwd2, args) {
     const orgId = await select({
       message: "Pick an organization",
       options: orgs.map((o2) => ({ value: o2.id, label: o2.name, hint: o2.role })),
-      flagHint: "Pass --org <id> to choose non-interactively."
+      flagHint: "Pass --org <id-or-slug> to choose non-interactively."
     });
     org = orgs.find((o2) => o2.id === orgId);
   }
@@ -64405,7 +64735,9 @@ async function runAgentCreate(cwd2, args) {
       name: agentName,
       tagline,
       harness,
-      ...resolvedEntrypoint !== undefined ? { entrypoint: resolvedEntrypoint } : {}
+      ...resolvedEntrypoint !== undefined ? { entrypoint: resolvedEntrypoint } : {},
+      ...manifest.machine_kind !== undefined ? { machine_kind: manifest.machine_kind } : {},
+      ...manifest.default_model !== undefined ? { default_model: manifest.default_model } : {}
     });
     createSpinner.stop(`Created ${import_picocolors31.default.bold(agent.name)}.`);
   } catch (err) {
@@ -64413,6 +64745,29 @@ async function runAgentCreate(cwd2, args) {
     handleApiError4(err);
     return;
   }
+  const machineConfigMissing = manifest.machine_kind !== undefined && agent.machine_kind !== manifest.machine_kind;
+  const modelConfigMissing = manifest.default_model !== undefined && (!Object.prototype.hasOwnProperty.call(agent, "default_model") || (agent.default_model ?? null) !== (manifest.default_model ?? null));
+  if (machineConfigMissing || modelConfigMissing) {
+    manifest.id = agent.id;
+    manifest.harness = harness;
+    writeManifest(cwd2, manifest);
+    const fields = [
+      ...machineConfigMissing ? ["machine_kind"] : [],
+      ...modelConfigMissing ? ["default_model"] : []
+    ];
+    f2.error(`Agent ${import_picocolors31.default.bold(agent.id)} was created, but this control plane did not apply ${fields.join(" / ")}.`);
+    if (machineConfigMissing) {
+      if (agent.machine_kind) {
+        f2.info(`machine_kind is immutable. Run ${import_picocolors31.default.cyan("brainbase agent pull --force")} to accept ${agent.machine_kind}, or delete this agent and recreate it after upgrading the control plane.`);
+      } else {
+        f2.info("machine_kind is immutable and this server did not report the provider it created. Upgrade the control plane, delete this agent, and recreate it.");
+      }
+    } else {
+      f2.info(`Upgrade the control plane, then run ${import_picocolors31.default.cyan("brainbase agent push")} to apply default_model.`);
+    }
+    process.exitCode = 1;
+    return;
+  }
   const session = authStatus().session;
   let tracking;
   const adapter = getRouteAdapter(harness);
@@ -64514,31 +64869,33 @@ async function runAgentCreate(cwd2, args) {
       manifest.playbooks = backfill.playbooks;
       writeManifest(cwd2, manifest);
     }
-    const localHashByKey = new Map;
-    for (const lc of readLocalComponents(cwd2, manifest)) {
-      if (lc.hash)
-        localHashByKey.set(`${lc.type}/${lc.slug}`, lc.hash);
-    }
-    const syncedComponents = updatedCloud.components.map((c2) => ({
-      type: c2.type,
-      slug: c2.slug,
-      hash: localHashByKey.get(`${c2.type}/${c2.slug}`) ?? c2.hash,
-      installedPaths: []
-    }));
-    const state = {
-      schemaVersion: 1,
-      agent_id: agent.id,
-      revision: updatedCloud.revision,
-      synced_at: new Date().toISOString(),
-      components: syncedComponents,
-      agentMeta: {
-        name: agent.name,
-        tagline: agent.tagline,
-        ...resolvedEntrypoint ? { entrypoint: resolvedEntrypoint.trim() } : {}
-      }
-    };
-    writeSyncState(cwd2, state);
   }
+  const localHashByKey = new Map;
+  for (const lc of readLocalComponents(cwd2, manifest)) {
+    if (lc.hash)
+      localHashByKey.set(`${lc.type}/${lc.slug}`, lc.hash);
+  }
+  const syncedComponents = (updatedCloud?.components ?? []).map((c2) => ({
+    type: c2.type,
+    slug: c2.slug,
+    hash: localHashByKey.get(`${c2.type}/${c2.slug}`) ?? c2.hash,
+    installedPaths: []
+  }));
+  const state = {
+    schemaVersion: 1,
+    agent_id: agent.id,
+    revision: updatedCloud?.revision ?? agent.revision ?? 0,
+    synced_at: new Date().toISOString(),
+    components: syncedComponents,
+    agentMeta: {
+      name: agent.name,
+      tagline: agent.tagline,
+      ...resolvedEntrypoint ? { entrypoint: resolvedEntrypoint.trim() } : {},
+      ...agent.machine_kind ? { machine_kind: agent.machine_kind } : {},
+      ...Object.prototype.hasOwnProperty.call(agent, "default_model") ? { default_model: agent.default_model ?? null } : {}
+    }
+  };
+  writeSyncState(cwd2, state);
   $e(`Created ${import_picocolors31.default.bold(agent.name)} and linked this folder.`);
   await showResultCard({
     title: "CREATED",
@@ -64632,6 +64989,10 @@ function handleApiError4(err) {
 
 // src/cli/agent.ts
 async function runAgent(cwd2, sub, args, opts) {
+  if (args.some((arg) => arg === "--help" || arg === "-h")) {
+    printHelp();
+    return;
+  }
   switch (sub) {
     case "create":
       await runAgentCreate(cwd2, {
@@ -64702,7 +65063,7 @@ function printHelp() {
 }
 
 // src/cli/orchestration.ts
-var import_picocolors38 = __toESM(require_picocolors(), 1);
+var import_picocolors39 = __toESM(require_picocolors(), 1);
 
 // src/cli/orchestration-pull.ts
 import path82 from "node:path";
@@ -64730,20 +65091,32 @@ var EdgeSchema = exports_external.object({
   from: exports_external.string().min(1),
   to: exports_external.string().min(1),
   description: exports_external.string().optional(),
-  payload_schema: exports_external.record(exports_external.unknown()).optional()
+  payload_schema: exports_external.record(exports_external.unknown()).optional(),
+  settings: exports_external.record(exports_external.unknown()).optional()
 });
 var TriggerEdgeSchema = exports_external.object({
   agent: exports_external.string(),
   description: exports_external.string().optional(),
   payload_schema: exports_external.record(exports_external.unknown()).optional()
 });
-var TriggerSchema = exports_external.object({
-  type: exports_external.string(),
-  node_id: exports_external.string(),
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var ScheduleTriggerSchema = exports_external.object({
+  type: exports_external.literal("schedule"),
+  node_id: exports_external.string().regex(UUID_RE, "must be a UUID"),
+  is_active: exports_external.boolean().optional(),
+  config: exports_external.record(exports_external.unknown()).optional(),
+  to: exports_external.array(TriggerEdgeSchema).default([])
+});
+var ReadOnlyTriggerSchema = exports_external.object({
+  type: exports_external.string().refine((value) => value !== "schedule", {
+    message: "schedule triggers must use a UUID node_id"
+  }),
+  node_id: exports_external.string().min(1),
   is_active: exports_external.boolean().optional(),
   config: exports_external.record(exports_external.unknown()).optional(),
   to: exports_external.array(TriggerEdgeSchema).default([])
 });
+var TriggerSchema = exports_external.union([ScheduleTriggerSchema, ReadOnlyTriggerSchema]);
 var OrchestrationManifestSchema = exports_external.object({
   schema: exports_external.literal(1),
   orchestration: OrchMetaSchema,
@@ -64779,7 +65152,9 @@ function writeOrchManifest(cwd2, manifest) {
   doc.contents = manifest;
   doc.commentBefore = ` brainbase-orchestration.yaml — declarative orchestration manifest.
 ` + ` Committed to source control. Edit by hand, then
-` + " `brainbase orchestration push`. Member agents live under ./agents/." + "\n A `triggers:` block (if present) is READ-ONLY — managed in the web app\n" + " and ignored by `orchestration push`.";
+` + " `brainbase orchestration push`. Member agents live under ./agents/." + `
+ Schedule triggers are writable. App/Pipedream triggers are preserved
+` + " as read-only context and ignored by `orchestration push`.";
   fs70.writeFileSync(orchManifestPath(cwd2), String(doc), "utf8");
 }
 function memberDir(cwd2, slug) {
@@ -64918,6 +65293,7 @@ async function installAgentFresh(input) {
   const { cwd: cwd2, agent, cloud, harness } = input;
   const scope = input.scope ?? "project";
   ensureDir(cwd2);
+  const availableSecrets = input.pullSecrets === false ? {} : await pullAgentSecrets(cwd2, agent.id);
   const stageRoot = stageManifestComponents2(cloud.components);
   const justInstalledPaths = new Map;
   const caps = capabilitiesFromAgent(agent);
@@ -64936,7 +65312,7 @@ async function installAgentFresh(input) {
         rootDir: path81.join(stageRoot, c2.type, c2.slug),
         description: c2.description,
         meta: c2.meta,
-        payload: proxifyMcpPayload(c2.meta?.mcp),
+        payload: proxifyMcpPayload(structuredClone(c2.meta?.mcp)),
         checksum: c2.hash
       }));
       toInstall.push(...builtinInstall);
@@ -64944,7 +65320,7 @@ async function installAgentFresh(input) {
         cwd: cwd2,
         scope,
         resolveConflict: async (_c) => "overwrite",
-        resolveSecret: async () => null
+        resolveSecret: async (name) => availableSecrets[name] ?? null
       };
       const result2 = await runHarnessInstall4(harness, toInstall, installOpts, agent.name);
       for (const o2 of result2.installed) {
@@ -64952,6 +65328,7 @@ async function installAgentFresh(input) {
       }
     }
     materializeInstructions2(cwd2, cloud);
+    materializePlaybooks2(cwd2, cloud);
     const manifest = input.preserveManifest ? null : buildManifestFromCloud(cloud, agent);
     if (manifest)
       writeManifest(cwd2, manifest);
@@ -64979,11 +65356,13 @@ async function installAgentFresh(input) {
       revision: cloud.revision,
       synced_at: new Date().toISOString(),
       components: syncedComponents,
-      agentMeta: { name: agent.name, tagline: agent.tagline }
+      agentMeta: {
+        name: agent.name,
+        tagline: agent.tagline,
+        ...agent.machine_kind ? { machine_kind: agent.machine_kind } : {},
+        ...Object.prototype.hasOwnProperty.call(agent, "default_model") ? { default_model: agent.default_model ?? null } : {}
+      }
     });
-    if (input.pullSecrets !== false) {
-      await pullAgentSecrets(cwd2, agent.id);
-    }
     const returnedManifest = manifest ?? buildManifestFromCloud(cloud, agent);
     return {
       installedPaths: justInstalledPaths,
@@ -65043,6 +65422,19 @@ function materializeInstructions2(cwd2, cloud) {
     return;
   }
 }
+function materializePlaybooks2(cwd2, cloud) {
+  for (const c2 of cloud.components) {
+    if (c2.type !== "playbook")
+      continue;
+    const raw = c2.files[0]?.content ?? "";
+    if (!raw.trim())
+      continue;
+    const { body } = stripPlaybookFrontmatter(raw);
+    const target = path81.join(cwd2, DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`);
+    ensureDir(path81.dirname(target));
+    fs72.writeFileSync(target, body, "utf8");
+  }
+}
 function buildManifestFromCloud(cloud, agent) {
   const skills = cloud.components.filter((c2) => c2.type === "skill").map((c2) => {
     const meta = c2.meta ?? {};
@@ -65071,15 +65463,31 @@ function buildManifestFromCloud(cloud, agent) {
       entry.is_enabled = payload.is_enabled;
     return entry;
   });
+  const playbooks = cloud.components.filter((c2) => c2.type === "playbook").map((c2) => {
+    const raw = c2.files[0]?.content ?? "";
+    const { frontmatter } = stripPlaybookFrontmatter(raw);
+    const pbMeta = c2.meta ?? {};
+    const title = typeof frontmatter.title === "string" && frontmatter.title || c2.slug;
+    const description = typeof frontmatter.description === "string" ? frontmatter.description : undefined;
+    return {
+      ...typeof pbMeta.playbook_id === "string" && pbMeta.playbook_id ? { id: pbMeta.playbook_id } : {},
+      title,
+      ...description ? { description } : {},
+      ...typeof pbMeta.icon === "string" && pbMeta.icon ? { icon: pbMeta.icon } : {},
+      content: { file: path81.join(DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`) }
+    };
+  });
   const caps = capabilitiesFromAgent(agent);
   return {
     schema: 1,
+    ...agent.machine_kind ? { machine_kind: agent.machine_kind } : {},
+    ...agent.default_model ? { default_model: agent.default_model } : {},
     agent: {
       name: agent.name,
       ...agent.tagline ? { tagline: agent.tagline } : {}
     },
     ...hasInstructions ? { instructions: { file: DEFAULT_INSTRUCTIONS_FILE } } : {},
-    playbooks: [],
+    playbooks,
     evals: [],
     skills,
     mcp,
@@ -65098,14 +65506,58 @@ async function pullAgentSecrets(cwd2, agentId) {
     if (Object.keys(secrets).length > 0) {
       writeLocalSecrets(cwd2, secrets);
     }
+    return secrets;
   } catch (err) {
     if (err instanceof ApiError && err.status !== 404) {
       f2.warn(`Skipped secrets for agent ${agentId}: ${err.message}`);
     }
+    return {};
   }
 }
 
+// src/core/orchestration-trigger-config.ts
+function normalizeScheduleTriggerConfig(config) {
+  const cron = config?.cron_expression;
+  const result2 = {};
+  if (typeof cron === "string" && cron.trim()) {
+    result2.cron_expression = cron.trim();
+  }
+  const configuredProps = config?.configured_props;
+  if (configuredProps && typeof configuredProps === "object" && !Array.isArray(configuredProps) && Object.keys(configuredProps).length > 0) {
+    result2.configured_props = configuredProps;
+  }
+  return result2;
+}
+function scheduleTriggerConfigForManifest(config) {
+  const normalized = normalizeScheduleTriggerConfig(config);
+  return Object.keys(normalized).length ? normalized : undefined;
+}
+function formatScheduleTriggerLabel(input) {
+  const config = normalizeScheduleTriggerConfig(input.config);
+  const cron = typeof config.cron_expression === "string" ? config.cron_expression : "missing cron";
+  const state = input.isActive ?? false ? "active" : "inactive";
+  const targetText = input.targets.length ? ` -> ${input.targets.join(", ")}` : "";
+  return `schedule ${input.nodeId} (${cron}, ${state})${targetText}`;
+}
+
 // src/cli/orchestration-pull.ts
+function triggersForManifest(triggers, slugFor) {
+  return triggers.map((trigger) => {
+    const schedule = trigger.trigger_type === "schedule";
+    const config = schedule ? scheduleTriggerConfigForManifest(trigger.config) : trigger.config;
+    return {
+      type: trigger.trigger_type,
+      node_id: trigger.node_id,
+      is_active: trigger.is_active,
+      ...config && Object.keys(config).length ? { config } : {},
+      to: trigger.edges.map((edge) => ({
+        agent: slugFor(edge.to_agent_id),
+        ...edge.description ? { description: edge.description } : {},
+        ...edge.payload_schema && Object.keys(edge.payload_schema).length ? { payload_schema: edge.payload_schema } : {}
+      }))
+    };
+  });
+}
 async function runOrchestrationPull(cwd2, args) {
   banner("orchestration pull — fetch orchestration + all member agents");
   let orchId = null;
@@ -65129,6 +65581,7 @@ async function runOrchestrationPull(cwd2, args) {
   } catch (err) {
     sp.stop("Failed.");
     handleApiError5(err);
+    process.exitCode = 1;
     return;
   }
   const slugByAgent = resolveMemberSlugs(cloud.members);
@@ -65196,7 +65649,9 @@ async function runOrchestrationPull(cwd2, args) {
           org_id: cloud.group_id,
           team_id: cloud.group_id,
           url: undefined,
-          harness: fallbackHarness
+          harness: fallbackHarness,
+          machine_kind: m3.machine_kind,
+          default_model: m3.default_model
         },
         cloud: m3.manifest,
         harness: fallbackHarness,
@@ -65214,6 +65669,7 @@ async function runOrchestrationPull(cwd2, args) {
       f2.error(err.message);
     }
   }
+  const manifestTriggers = triggersForManifest(cloud.triggers ?? [], slugFor);
   const manifest = {
     schema: 1,
     orchestration: {
@@ -65234,21 +65690,10 @@ async function runOrchestrationPull(cwd2, args) {
       from: slugFor(e2.from_agent_id),
       to: slugFor(e2.to_agent_id),
       ...e2.description ? { description: e2.description } : {},
-      ...e2.payload_schema && Object.keys(e2.payload_schema).length ? { payload_schema: e2.payload_schema } : {}
+      ...e2.payload_schema && Object.keys(e2.payload_schema).length ? { payload_schema: e2.payload_schema } : {},
+      ...e2.settings && Object.keys(e2.settings).length ? { settings: e2.settings } : {}
     })),
-    ...cloud.triggers && cloud.triggers.length ? {
-      triggers: cloud.triggers.map((t) => ({
-        type: t.trigger_type,
-        node_id: t.node_id,
-        is_active: t.is_active,
-        ...t.config && Object.keys(t.config).length ? { config: t.config } : {},
-        to: t.edges.map((e2) => ({
-          agent: slugFor(e2.to_agent_id),
-          ...e2.description ? { description: e2.description } : {},
-          ...e2.payload_schema && Object.keys(e2.payload_schema).length ? { payload_schema: e2.payload_schema } : {}
-        }))
-      }))
-    } : {}
+    ...manifestTriggers.length ? { triggers: manifestTriggers } : {}
   };
   writeOrchManifest(cwd2, manifest);
   writeOrchLink(cwd2, {
@@ -65292,6 +65737,70 @@ function handleApiError5(err) {
 
 // src/cli/orchestration-push.ts
 var import_picocolors34 = __toESM(require_picocolors(), 1);
+
+// src/core/orchestration-outgoing.ts
+function buildOrchestrationGraphPayload(manifest, slugToAgentId) {
+  const memberSlugs = new Set(manifest.members.map((m3) => m3.slug));
+  for (const e2 of manifest.edges) {
+    if (!memberSlugs.has(e2.from)) {
+      throw new Error(`Edge from "${e2.from}" references a slug that isn't in members.`);
+    }
+    if (!memberSlugs.has(e2.to)) {
+      throw new Error(`Edge to "${e2.to}" references a slug that isn't in members.`);
+    }
+    if (e2.from === e2.to) {
+      throw new Error(`Edge ${e2.from} -> ${e2.to}: self-loops are not allowed.`);
+    }
+  }
+  const scheduleTriggers = (manifest.triggers ?? []).filter((t) => t.type === "schedule");
+  const seenTriggerNodeIds = new Set;
+  for (const t of scheduleTriggers) {
+    if (seenTriggerNodeIds.has(t.node_id)) {
+      throw new Error(`Schedule trigger ${t.node_id} is duplicated.`);
+    }
+    seenTriggerNodeIds.add(t.node_id);
+    const config = normalizeScheduleTriggerConfig(t.config);
+    const cron = config.cron_expression;
+    if (typeof cron !== "string" || !cron.trim()) {
+      throw new Error(`Schedule trigger ${t.node_id} is missing cron_expression.`);
+    }
+    if (cron.trim().split(/\s+/).length !== 5) {
+      throw new Error(`Schedule trigger ${t.node_id} cron_expression must use standard 5-field cron syntax.`);
+    }
+    for (const e2 of t.to) {
+      if (!memberSlugs.has(e2.agent)) {
+        throw new Error(`Trigger ${t.node_id} points to "${e2.agent}", which isn't in members.`);
+      }
+    }
+  }
+  const missing = manifest.members.map((m3) => m3.slug).filter((slug) => !slugToAgentId.has(slug));
+  if (missing.length) {
+    throw new Error(`These members have no local checkout (expected at agents/<slug>/brainbase.agent.yaml): ${missing.join(", ")}.`);
+  }
+  return {
+    memberIds: manifest.members.map((m3) => slugToAgentId.get(m3.slug)),
+    edges: manifest.edges.map((e2) => ({
+      from_agent_id: slugToAgentId.get(e2.from),
+      to_agent_id: slugToAgentId.get(e2.to),
+      description: e2.description ?? "",
+      payload_schema: e2.payload_schema ?? {},
+      settings: e2.settings ?? {}
+    })),
+    triggers: scheduleTriggers.map((t) => ({
+      node_id: t.node_id,
+      type: "schedule",
+      is_active: t.is_active ?? false,
+      config: normalizeScheduleTriggerConfig(t.config),
+      edges: t.to.map((e2) => ({
+        to_agent_id: slugToAgentId.get(e2.agent),
+        description: e2.description ?? "",
+        payload_schema: e2.payload_schema ?? {}
+      }))
+    }))
+  };
+}
+
+// src/cli/orchestration-push.ts
 async function runOrchestrationPush(cwd2, args) {
   banner("orchestration push — recursively push each member, then update the graph");
   const link2 = readOrchLink(cwd2);
@@ -65310,23 +65819,9 @@ async function runOrchestrationPush(cwd2, args) {
     manifest = readOrchManifest(cwd2);
   } catch (err) {
     f2.error(err.message);
+    process.exitCode = 1;
     return;
   }
-  const memberSlugs = new Set(manifest.members.map((m3) => m3.slug));
-  for (const e2 of manifest.edges) {
-    if (!memberSlugs.has(e2.from)) {
-      f2.error(`Edge from "${import_picocolors34.default.bold(e2.from)}" references a slug that isn't in members.`);
-      return;
-    }
-    if (!memberSlugs.has(e2.to)) {
-      f2.error(`Edge to "${import_picocolors34.default.bold(e2.to)}" references a slug that isn't in members.`);
-      return;
-    }
-    if (e2.from === e2.to) {
-      f2.error(`Edge ${import_picocolors34.default.bold(e2.from)} → ${import_picocolors34.default.bold(e2.to)}: self-loops are not allowed.`);
-      return;
-    }
-  }
   const slugToAgentId = new Map;
   const missing = [];
   for (const m3 of manifest.members) {
@@ -65339,13 +65834,21 @@ async function runOrchestrationPush(cwd2, args) {
     slugToAgentId.set(m3.slug, memberLink.agent_id);
   }
   if (missing.length) {
-    f2.error(`These members have no local checkout (expected at agents/<slug>/brainbase.agent.yaml): ${missing.join(", ")}.`);
+    f2.error(`Missing local checkouts for: ${missing.join(", ")}.`);
     f2.info(`Run ${import_picocolors34.default.cyan("brainbase orchestration pull")} to materialise the missing folders.`);
     return;
   }
+  let graph;
+  try {
+    graph = buildOrchestrationGraphPayload(manifest, slugToAgentId);
+  } catch (err) {
+    f2.error(err.message);
+    process.exitCode = 1;
+    return;
+  }
   const plan = [""];
   plan.push(`  ${import_picocolors34.default.bold(link2.name)} ${import_picocolors34.default.dim(`(${link2.orchestration_id})`)}`);
-  plan.push(`  ${import_picocolors34.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}`)}`);
+  plan.push(`  ${import_picocolors34.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
   plan.push("");
   if (!args.graphOnly) {
     plan.push(`  ${import_picocolors34.default.dim("per-member agent push:")}`);
@@ -65358,7 +65861,7 @@ async function runOrchestrationPush(cwd2, args) {
 `));
   if (!autoProceed(args.yes)) {
     const ok = await se({
-      message: args.graphOnly ? "Push graph (members + edges) only?" : "Push each member, then update the graph?",
+      message: args.graphOnly ? "Push graph (members, edges + triggers) only?" : "Push each member, then update the graph?",
       initialValue: true
     });
     if (!ensureNotCancelled(ok)) {
@@ -65375,17 +65878,11 @@ async function runOrchestrationPush(cwd2, args) {
         await runAgentPush(dir, { yes: true });
       } catch (err) {
         f2.error(`Failed to push ${m3.slug}: ${err.message}`);
+        process.exitCode = 1;
         return;
       }
     }
   }
-  const memberIds = manifest.members.map((m3) => slugToAgentId.get(m3.slug));
-  const edges = manifest.edges.map((e2) => ({
-    from_agent_id: slugToAgentId.get(e2.from),
-    to_agent_id: slugToAgentId.get(e2.to),
-    description: e2.description ?? "",
-    payload_schema: e2.payload_schema ?? {}
-  }));
   const sp = de();
   sp.start("Updating orchestration graph…");
   const lock = readOrchSyncState(cwd2);
@@ -65396,8 +65893,9 @@ async function runOrchestrationPush(cwd2, args) {
       icon: manifest.orchestration.icon,
       icon_color: manifest.orchestration.icon_color,
       credit_limit: manifest.orchestration.credit_limit,
-      members: memberIds,
-      edges,
+      members: graph.memberIds,
+      edges: graph.edges,
+      triggers: graph.triggers,
       ...lock?.revision != null ? { base_revision: lock.revision } : {}
     });
     sp.stop(`Graph updated. New cloud revision ${updated.revision}.`);
@@ -65408,7 +65906,7 @@ async function runOrchestrationPush(cwd2, args) {
       synced_at: new Date().toISOString(),
       members: updated.members.map((m3) => ({
         agent_id: m3.agent_id,
-        slug: m3.slug,
+        slug: manifest.members.find((member) => slugToAgentId.get(member.slug) === m3.agent_id)?.slug ?? m3.slug,
         revision: m3.revision ?? 0
       })),
       edges: updated.edges.map((e2) => ({
@@ -65422,6 +65920,7 @@ async function runOrchestrationPush(cwd2, args) {
   } catch (err) {
     sp.stop("Failed.");
     handleApiError6(err);
+    process.exitCode = 1;
   }
 }
 function handleApiError6(err) {
@@ -65466,6 +65965,7 @@ async function runOrchestrationStatus(cwd2) {
     } else {
       f2.error(err.message);
     }
+    process.exitCode = 1;
     return;
   }
   const lines = [];
@@ -65473,7 +65973,14 @@ async function runOrchestrationStatus(cwd2) {
   lines.push(`  ${import_picocolors35.default.bold(link2.name)} ${import_picocolors35.default.dim(`(${link2.orchestration_id})`)}`);
   lines.push(`  ${import_picocolors35.default.dim("revision")}  cloud ${cloud.revision}${lock ? ` · lock ${lock.revision}` : " · never pulled"}`);
   lines.push("");
-  const cloudMemberSet = new Set(cloud.members.map((m3) => m3.slug));
+  const localSlugByAgentId = new Map;
+  for (const m3 of localManifest?.members ?? []) {
+    const link3 = readLink(memberDir(cwd2, m3.slug));
+    if (link3)
+      localSlugByAgentId.set(link3.agent_id, m3.slug);
+  }
+  const slugForAgent = (agentId, fallback) => localSlugByAgentId.get(agentId) ?? fallback;
+  const cloudMemberSet = new Set(cloud.members.map((m3) => slugForAgent(m3.agent_id, m3.slug)));
   const localMemberSet = new Set((localManifest?.members ?? []).map((m3) => m3.slug));
   const membersAdded = [...localMemberSet].filter((s3) => !cloudMemberSet.has(s3));
   const membersRemoved = [...cloudMemberSet].filter((s3) => !localMemberSet.has(s3));
@@ -65487,8 +65994,8 @@ async function runOrchestrationStatus(cwd2) {
     }
     lines.push("");
   }
-  const cloudEdgeKey = (e2) => `${e2.from_slug ?? e2.from_agent_id}->${e2.to_slug ?? e2.to_agent_id}|${e2.description ?? ""}`;
-  const localEdgeKey = (e2) => `${e2.from}->${e2.to}|${e2.description ?? ""}`;
+  const cloudEdgeKey = (e2) => `${slugForAgent(e2.from_agent_id, e2.from_slug ?? e2.from_agent_id)}->${slugForAgent(e2.to_agent_id, e2.to_slug ?? e2.to_agent_id)}|${e2.description ?? ""}|${stableJson(e2.payload_schema ?? {})}|${stableJson(e2.settings ?? {})}`;
+  const localEdgeKey = (e2) => `${e2.from}->${e2.to}|${e2.description ?? ""}|${stableJson(e2.payload_schema ?? {})}|${stableJson(e2.settings ?? {})}`;
   const cloudEdges = new Map;
   for (const e2 of cloud.edges)
     cloudEdges.set(cloudEdgeKey(e2), true);
@@ -65505,20 +66012,63 @@ async function runOrchestrationStatus(cwd2) {
       lines.push(`    ${import_picocolors35.default.cyan("← pull")}  added on cloud: ${k3}`);
     lines.push("");
   }
+  const cloudTriggerKey = (t) => {
+    const edges = t.edges.map((e2) => `${slugForAgent(e2.to_agent_id, e2.to_slug ?? e2.to_agent_id)}|${e2.description ?? ""}|${stableJson(e2.payload_schema ?? {})}`).sort().join(",");
+    return `${t.node_id}|${t.is_active ?? false}|${stableJson(normalizeScheduleTriggerConfig(t.config))}|${edges}`;
+  };
+  const cloudTriggerLabel = (t) => formatScheduleTriggerLabel({
+    nodeId: t.node_id,
+    isActive: t.is_active ?? false,
+    config: t.config,
+    targets: t.edges.map((e2) => slugForAgent(e2.to_agent_id, e2.to_slug ?? e2.to_agent_id))
+  });
+  const localTriggerKey = (t) => {
+    const edges = t.to.map((e2) => `${e2.agent}|${e2.description ?? ""}|${stableJson(e2.payload_schema ?? {})}`).sort().join(",");
+    return `${t.node_id}|${t.is_active ?? false}|${stableJson(normalizeScheduleTriggerConfig(t.config))}|${edges}`;
+  };
+  const localTriggerLabel = (t) => formatScheduleTriggerLabel({
+    nodeId: t.node_id,
+    isActive: t.is_active ?? false,
+    config: t.config,
+    targets: t.to.map((e2) => e2.agent)
+  });
+  const cloudTriggers = new Map;
+  for (const t of cloud.triggers ?? []) {
+    if (t.trigger_type === "schedule") {
+      cloudTriggers.set(cloudTriggerKey(t), cloudTriggerLabel(t));
+    }
+  }
+  const localTriggers = new Map;
+  for (const t of localManifest?.triggers ?? []) {
+    if (t.type === "schedule") {
+      localTriggers.set(localTriggerKey(t), localTriggerLabel(t));
+    }
+  }
+  const triggersAdded = [...localTriggers.keys()].filter((k3) => !cloudTriggers.has(k3));
+  const triggersRemoved = [...cloudTriggers.keys()].filter((k3) => !localTriggers.has(k3));
+  if (triggersAdded.length || triggersRemoved.length) {
+    lines.push(`  ${import_picocolors35.default.bold("schedule triggers")}`);
+    for (const k3 of triggersAdded)
+      lines.push(`    ${import_picocolors35.default.yellow("→ push")}  added/changed in yaml: ${localTriggers.get(k3) ?? k3}`);
+    for (const k3 of triggersRemoved)
+      lines.push(`    ${import_picocolors35.default.cyan("← pull")}  added/changed on cloud: ${cloudTriggers.get(k3) ?? k3}`);
+    lines.push("");
+  }
   const lockByAgentId = new Map((lock?.members ?? []).map((m3) => [m3.agent_id, m3]));
   const memberDrift = [];
   for (const m3 of cloud.members) {
-    const dir = memberDir(cwd2, m3.slug);
+    const slug = slugForAgent(m3.agent_id, m3.slug);
+    const dir = memberDir(cwd2, slug);
     const memberSync = readSyncState(dir);
     if (!memberSync) {
-      memberDrift.push({ slug: m3.slug, reason: "no local checkout" });
+      memberDrift.push({ slug, reason: "no local checkout" });
       continue;
     }
     const lockEntry = lockByAgentId.get(m3.agent_id);
     const lockedRev = lockEntry?.revision;
     if (m3.revision != null && lockedRev != null && m3.revision !== lockedRev) {
       memberDrift.push({
-        slug: m3.slug,
+        slug,
         reason: `cloud rev ${m3.revision} ≠ lock ${lockedRev}`
       });
     }
@@ -65531,7 +66081,13 @@ async function runOrchestrationStatus(cwd2) {
     lines.push(`    ${import_picocolors35.default.dim("cd into each member folder and run")} ${import_picocolors35.default.cyan("brainbase agent status")}`);
     lines.push("");
   }
-  if (!membersAdded.length && !membersRemoved.length && !edgesAdded.length && !edgesRemoved.length && !memberDrift.length) {
+  const revisionDrift = lock?.revision != null && cloud.revision !== lock.revision;
+  if (revisionDrift) {
+    lines.push(`  ${import_picocolors35.default.bold("cloud revision")}`);
+    lines.push(`    ${import_picocolors35.default.cyan("← pull")}  cloud changed since last pull: ${import_picocolors35.default.dim(`lock ${lock.revision} → cloud ${cloud.revision}`)}`);
+    lines.push("");
+  }
+  if (!membersAdded.length && !membersRemoved.length && !edgesAdded.length && !edgesRemoved.length && !triggersAdded.length && !triggersRemoved.length && !memberDrift.length && !revisionDrift) {
     lines.push(`  ${import_picocolors35.default.green("✓")} everything is in sync`);
     lines.push("");
     console.log(lines.join(`
@@ -65543,6 +66099,14 @@ async function runOrchestrationStatus(cwd2) {
   console.log(lines.join(`
 `));
 }
+function stableJson(value) {
+  if (value == null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(stableJson).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key2) => `${JSON.stringify(key2)}:${stableJson(obj[key2])}`).join(",")}}`;
+}
 
 // src/cli/orchestration-list.ts
 var import_picocolors36 = __toESM(require_picocolors(), 1);
@@ -65550,7 +66114,7 @@ async function runOrchestrationList(args) {
   banner("orchestration list — orchestrations under a team");
   let orgId = args.orgId;
   let teamId = args.teamId;
-  if (!orgId) {
+  if (!orgId || !isUuid(orgId)) {
     let orgs;
     try {
       orgs = await api.listOrgs();
@@ -65562,13 +66126,20 @@ async function runOrchestrationList(args) {
       f2.warn("You are not a member of any organization.");
       return;
     }
-    if (orgs.length === 1) {
+    if (orgId) {
+      const found = orgs.find((o2) => o2.id === orgId || o2.slug === orgId);
+      if (!found) {
+        f2.error(`Org ${orgId} not found or you're not a member.`);
+        return;
+      }
+      orgId = found.id;
+    } else if (orgs.length === 1) {
       orgId = orgs[0].id;
     } else {
       orgId = await select({
         message: "Which organization?",
-        options: orgs.map((o2) => ({ value: o2.id, label: o2.name })),
-        flagHint: "Pass --org <id>."
+        options: orgs.map((o2) => ({ value: o2.id, label: o2.name, hint: o2.role })),
+        flagHint: "Pass --org <id-or-slug>."
       });
     }
   }
@@ -65622,6 +66193,9 @@ async function runOrchestrationList(args) {
   console.log(lines.join(`
 `));
 }
+function isUuid(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-9a-f][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
 function handleApiError7(err) {
   if (err instanceof ApiError) {
     if (err.status === 401) {
@@ -65820,9 +66394,224 @@ async function runOrchestrationAddAgent(cwd2, args) {
   await runOrchestrationPush(cwd2, { yes: true, graphOnly: true });
 }
 
+// src/cli/orchestration-create.ts
+var import_picocolors38 = __toESM(require_picocolors(), 1);
+async function runOrchestrationCreate(cwd2, args) {
+  banner("orchestration create — claim a brainbase-orchestration.yaml");
+  if (readOrchLink(cwd2)) {
+    f2.warn("This folder is already linked to an orchestration.");
+    f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration push")} to update it.`);
+    return;
+  }
+  if (!hasOrchManifest(cwd2)) {
+    f2.warn(`No ${import_picocolors38.default.bold(ORCH_MANIFEST_FILE)} here.`);
+    f2.info(`Create one, or pull an existing orchestration first.`);
+    return;
+  }
+  let manifest;
+  try {
+    manifest = readOrchManifest(cwd2);
+  } catch (err) {
+    f2.error(err.message);
+    process.exitCode = 1;
+    return;
+  }
+  const slugToAgentId = new Map;
+  for (const m3 of manifest.members) {
+    const link2 = readLink(memberDir(cwd2, m3.slug));
+    if (link2)
+      slugToAgentId.set(m3.slug, link2.agent_id);
+  }
+  let graph;
+  try {
+    graph = buildOrchestrationGraphPayload(manifest, slugToAgentId);
+  } catch (err) {
+    f2.error(err.message);
+    process.exitCode = 1;
+    return;
+  }
+  const target = await resolveOrgAndTeam(args);
+  if (!target)
+    return;
+  const plan = [
+    "",
+    `  ${import_picocolors38.default.bold(manifest.orchestration.name)}`,
+    `  ${import_picocolors38.default.dim("org")}      ${import_picocolors38.default.bold(target.org.name)}`,
+    `  ${import_picocolors38.default.dim("team")}     ${import_picocolors38.default.bold(target.team.name)}`,
+    `  ${import_picocolors38.default.dim("graph")}    ${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`,
+    ""
+  ];
+  console.log(plan.join(`
+`));
+  if (!autoProceed(args.yes)) {
+    const ok = await se({
+      message: "Create this orchestration?",
+      initialValue: true
+    });
+    if (!ensureNotCancelled(ok)) {
+      $e("Aborted.");
+      return;
+    }
+  }
+  const sp = de();
+  sp.start("Creating orchestration…");
+  try {
+    const created = await api.createOrchestration({
+      org_id: target.org.id,
+      team_id: target.team.id,
+      name: manifest.orchestration.name,
+      description: manifest.orchestration.description ?? "",
+      icon: manifest.orchestration.icon,
+      icon_color: manifest.orchestration.icon_color,
+      credit_limit: manifest.orchestration.credit_limit,
+      members: graph.memberIds,
+      edges: graph.edges,
+      triggers: graph.triggers
+    });
+    sp.stop(`Created ${import_picocolors38.default.bold(created.name)}.`);
+    writeOrchLink(cwd2, {
+      schemaVersion: 1,
+      orchestration_id: created.id,
+      group_id: created.group_id,
+      org_id: target.org.id,
+      team_id: target.team.id,
+      name: created.name,
+      description: created.description || undefined,
+      linked_at: new Date().toISOString()
+    });
+    writeOrchSyncState(cwd2, {
+      schemaVersion: 1,
+      orchestration_id: created.id,
+      revision: created.revision,
+      synced_at: new Date().toISOString(),
+      members: created.members.map((m3) => ({
+        agent_id: m3.agent_id,
+        slug: manifest.members.find((member) => slugToAgentId.get(member.slug) === m3.agent_id)?.slug ?? m3.slug,
+        revision: m3.revision ?? 0
+      })),
+      edges: created.edges.map((e2) => ({
+        from_slug: e2.from_slug ?? e2.from_agent_id,
+        to_slug: e2.to_slug ?? e2.to_agent_id,
+        description: e2.description ?? "",
+        payload_schema: e2.payload_schema ?? {}
+      }))
+    });
+    $e(`Created ${created.name} at revision ${created.revision}.`);
+  } catch (err) {
+    sp.stop("Failed.");
+    handleApiError8(err);
+    process.exitCode = 1;
+  }
+}
+async function resolveOrgAndTeam(args) {
+  const orgsSpinner = de();
+  orgsSpinner.start("Loading your organizations…");
+  let orgs;
+  try {
+    orgs = await api.listOrgs();
+  } catch (err) {
+    orgsSpinner.stop("Failed.");
+    handleApiError8(err);
+    process.exitCode = 1;
+    return null;
+  }
+  orgsSpinner.stop(`Found ${orgs.length} organization${orgs.length === 1 ? "" : "s"}.`);
+  if (orgs.length === 0) {
+    f2.warn("You are not in any organizations yet.");
+    process.exitCode = 1;
+    return null;
+  }
+  let org;
+  if (args.orgId) {
+    const found = orgs.find((o2) => o2.id === args.orgId || o2.slug === args.orgId);
+    if (!found) {
+      f2.error(`Org ${args.orgId} not found or you're not a member.`);
+      process.exitCode = 1;
+      return null;
+    }
+    org = found;
+  } else if (orgs.length === 1) {
+    org = orgs[0];
+    f2.info(`Using organization ${import_picocolors38.default.bold(org.name)}.`);
+  } else if (!isInteractive()) {
+    throw new NonInteractiveError("Multiple organizations. Pass --org <id-or-slug> to choose non-interactively.");
+  } else {
+    const orgId = await select({
+      message: "Pick an organization",
+      options: orgs.map((o2) => ({ value: o2.id, label: o2.name, hint: o2.role })),
+      flagHint: "Pass --org <id-or-slug> to choose non-interactively."
+    });
+    org = orgs.find((o2) => o2.id === orgId);
+  }
+  const teamsSpinner = de();
+  teamsSpinner.start(`Loading teams in ${org.name}…`);
+  let teams;
+  try {
+    teams = await api.listTeams(org.id);
+  } catch (err) {
+    teamsSpinner.stop("Failed.");
+    handleApiError8(err);
+    process.exitCode = 1;
+    return null;
+  }
+  teamsSpinner.stop(`Found ${teams.length} team${teams.length === 1 ? "" : "s"}.`);
+  if (teams.length === 0) {
+    f2.warn(`No teams in ${org.name} yet.`);
+    process.exitCode = 1;
+    return null;
+  }
+  let team;
+  if (args.teamId) {
+    const found = teams.find((t) => t.id === args.teamId);
+    if (!found) {
+      f2.error(`Team ${args.teamId} not found in this org.`);
+      process.exitCode = 1;
+      return null;
+    }
+    team = found;
+  } else if (teams.length === 1) {
+    team = teams[0];
+    f2.info(`Using team ${import_picocolors38.default.bold(team.name)}.`);
+  } else if (!isInteractive()) {
+    throw new NonInteractiveError("Multiple teams. Pass --team <id> to choose non-interactively.");
+  } else {
+    const teamId = await select({
+      message: "Pick a team",
+      options: teams.map((t) => ({ value: t.id, label: t.name, hint: t.role })),
+      flagHint: "Pass --team <id> to choose non-interactively."
+    });
+    team = teams.find((t) => t.id === teamId);
+  }
+  return { org, team };
+}
+function handleApiError8(err) {
+  if (err instanceof ApiError) {
+    if (err.status === 401) {
+      f2.error("Your session is invalid. Run `brainbase login` and try again.");
+    } else if (err.status === 403) {
+      f2.error("You do not have access to create this orchestration.");
+    } else {
+      f2.error(err.message);
+    }
+  } else {
+    f2.error(err.message);
+  }
+}
+
 // src/cli/orchestration.ts
 async function runOrchestration(cwd2, sub, args, opts) {
+  if (args.some((arg) => arg === "--help" || arg === "-h")) {
+    printHelp2();
+    return;
+  }
   switch (sub) {
+    case "create":
+      await runOrchestrationCreate(cwd2, {
+        yes: opts.yes,
+        orgId: opts.orgId,
+        teamId: opts.teamId
+      });
+      return;
     case "pull":
       await runOrchestrationPull(cwd2, {
         orchestrationId: args[0],
@@ -65873,20 +66662,21 @@ async function runOrchestration(cwd2, sub, args, opts) {
 function printHelp2() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors38.default.bold("brainbase orchestration")} ${import_picocolors38.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors39.default.bold("brainbase orchestration")} ${import_picocolors39.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors38.default.cyan("pull")} ${import_picocolors38.default.dim("<id>")}      ${import_picocolors38.default.dim("fetch orchestration + every member agent into this folder")}`);
-  out.push(`  ${import_picocolors38.default.cyan("push")}             ${import_picocolors38.default.dim("push each member, then update the orchestration graph")}`);
-  out.push(`  ${import_picocolors38.default.cyan("add-agent")} ${import_picocolors38.default.dim("<name>")}    ${import_picocolors38.default.dim("create a member agent, wire edges (--from/--to), and push")}`);
-  out.push(`  ${import_picocolors38.default.cyan("status")}           ${import_picocolors38.default.dim("show what would push and what would pull")}`);
-  out.push(`  ${import_picocolors38.default.cyan("list")}             ${import_picocolors38.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors39.default.cyan("create")}           ${import_picocolors39.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors39.default.cyan("pull")} ${import_picocolors39.default.dim("<id>")}      ${import_picocolors39.default.dim("fetch orchestration + every member agent into this folder")}`);
+  out.push(`  ${import_picocolors39.default.cyan("push")}             ${import_picocolors39.default.dim("push each member, then update the orchestration graph")}`);
+  out.push(`  ${import_picocolors39.default.cyan("add-agent")} ${import_picocolors39.default.dim("<name>")}    ${import_picocolors39.default.dim("create a member agent, wire edges (--from/--to), and push")}`);
+  out.push(`  ${import_picocolors39.default.cyan("status")}           ${import_picocolors39.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors39.default.cyan("list")}             ${import_picocolors39.default.dim("list orchestrations under a team")}`);
   out.push("");
-  out.push(`  ${import_picocolors38.default.bold("Flags")}`);
-  out.push(`    ${import_picocolors38.default.dim("--yes, -y")}        skip confirmations`);
-  out.push(`    ${import_picocolors38.default.dim("--harness <id>")}   harness for newly-created member folders (default claude-code)`);
-  out.push(`    ${import_picocolors38.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`);
-  out.push(`    ${import_picocolors38.default.dim("--org <id>")}       for list: org id (CLI vocab — DB teams.id)`);
-  out.push(`    ${import_picocolors38.default.dim("--team <id>")}      for list: team id (CLI vocab — DB groups.id)`);
+  out.push(`  ${import_picocolors39.default.bold("Flags")}`);
+  out.push(`    ${import_picocolors39.default.dim("--yes, -y")}        skip confirmations`);
+  out.push(`    ${import_picocolors39.default.dim("--harness <id>")}   harness for newly-created member folders (default claude-code)`);
+  out.push(`    ${import_picocolors39.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`);
+  out.push(`    ${import_picocolors39.default.dim("--org <id>")}       for create/list: org id or slug (CLI vocab — DB teams.id)`);
+  out.push(`    ${import_picocolors39.default.dim("--team <id>")}      for create/list: team id (CLI vocab — DB groups.id)`);
   out.push("");
   console.log(out.join(`
 `));
@@ -65931,16 +66721,16 @@ async function runRun(cwd2, args) {
 }
 
 // src/cli/publish.ts
-var import_picocolors39 = __toESM(require_picocolors(), 1);
+var import_picocolors40 = __toESM(require_picocolors(), 1);
 async function runPublish(cwd2, _args) {
   banner("publish — send your changes to the team");
   const link2 = readLink(cwd2);
   if (!link2) {
     f2.warn("This folder is not linked to any agent.");
-    f2.info(`Run ${import_picocolors39.default.cyan("brainbase link")} first.`);
+    f2.info(`Run ${import_picocolors40.default.cyan("brainbase link")} first.`);
     return;
   }
-  f2.info(`${import_picocolors39.default.bold("publish")} is coming soon — for now, edit the agent on the web app and run ${import_picocolors39.default.cyan("brainbase sync")} to bring changes here.`);
+  f2.info(`${import_picocolors40.default.bold("publish")} is coming soon — for now, edit the agent on the web app and run ${import_picocolors40.default.cyan("brainbase sync")} to bring changes here.`);
 }
 
 // src/ui/ink/StatusCard.tsx
@@ -66238,7 +67028,7 @@ async function runStatus(cwd2) {
 }
 
 // src/cli/token.ts
-var import_picocolors40 = __toESM(require_picocolors(), 1);
+var import_picocolors41 = __toESM(require_picocolors(), 1);
 
 // src/ui/ink/TokenCards.tsx
 var jsx_dev_runtime17 = __toESM(require_jsx_dev_runtime(), 1);
@@ -66532,7 +67322,7 @@ async function runTokenRevoke(args) {
   }
   if (!autoProceed(args.yes)) {
     const ok = await se({
-      message: `Revoke token ${import_picocolors40.default.bold(args.id)}? CIs and machines using it will stop working.`,
+      message: `Revoke token ${import_picocolors41.default.bold(args.id)}? CIs and machines using it will stop working.`,
       initialValue: false
     });
     if (!ensureNotCancelled(ok))
@@ -66547,7 +67337,7 @@ async function runTokenRevoke(args) {
 }
 async function runTokenClear() {
   if (!readToken()) {
-    console.log(import_picocolors40.default.dim("No local token stored."));
+    console.log(import_picocolors41.default.dim("No local token stored."));
     return;
   }
   clearToken();
@@ -66598,24 +67388,24 @@ async function runToken(sub, rest2, args) {
 function printTokenHelp() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors40.default.bold("brainbase token")} ${import_picocolors40.default.dim("<command>")}`);
+  out.push(`  ${import_picocolors41.default.bold("brainbase token")} ${import_picocolors41.default.dim("<command>")}`);
   out.push("");
-  out.push(`  ${import_picocolors40.default.cyan("create")}                        ${import_picocolors40.default.dim("issue a new long-lived CLI key (PAT)")}`);
-  out.push(`  ${import_picocolors40.default.cyan("list")}                          ${import_picocolors40.default.dim("show your active tokens")}`);
-  out.push(`  ${import_picocolors40.default.cyan("revoke")} ${import_picocolors40.default.dim("<id>")}                  ${import_picocolors40.default.dim("revoke a token by id")}`);
-  out.push(`  ${import_picocolors40.default.cyan("clear")}                         ${import_picocolors40.default.dim("forget the local token (does not revoke)")}`);
+  out.push(`  ${import_picocolors41.default.cyan("create")}                        ${import_picocolors41.default.dim("issue a new long-lived CLI key (PAT)")}`);
+  out.push(`  ${import_picocolors41.default.cyan("list")}                          ${import_picocolors41.default.dim("show your active tokens")}`);
+  out.push(`  ${import_picocolors41.default.cyan("revoke")} ${import_picocolors41.default.dim("<id>")}                  ${import_picocolors41.default.dim("revoke a token by id")}`);
+  out.push(`  ${import_picocolors41.default.cyan("clear")}                         ${import_picocolors41.default.dim("forget the local token (does not revoke)")}`);
   out.push("");
-  out.push(`  ${import_picocolors40.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors40.default.cyan("--name, -n")} ${import_picocolors40.default.dim("<label>")}        ${import_picocolors40.default.dim("token label (prompted if omitted)")}`);
-  out.push(`  ${import_picocolors40.default.cyan("--scopes")} ${import_picocolors40.default.dim("<list>")}           ${import_picocolors40.default.dim("comma-separated; allowed: read, publish, admin")}`);
-  out.push(`                                ${import_picocolors40.default.dim("default: read,publish")}`);
+  out.push(`  ${import_picocolors41.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors41.default.cyan("--name, -n")} ${import_picocolors41.default.dim("<label>")}        ${import_picocolors41.default.dim("token label (prompted if omitted)")}`);
+  out.push(`  ${import_picocolors41.default.cyan("--scopes")} ${import_picocolors41.default.dim("<list>")}           ${import_picocolors41.default.dim("comma-separated; allowed: read, publish, admin")}`);
+  out.push(`                                ${import_picocolors41.default.dim("default: read,publish")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/mcp.ts
-var import_picocolors41 = __toESM(require_picocolors(), 1);
+var import_picocolors42 = __toESM(require_picocolors(), 1);
 
 // src/core/mcp-check/collect-servers.ts
 import path83 from "node:path";
@@ -74963,17 +75753,17 @@ async function runMcpCheck(cwd2, options) {
 function renderHuman(report) {
   const lines = [];
   if (report.check_status === "skipped") {
-    lines.push(import_picocolors41.default.dim("No MCP servers configured — nothing to check."));
+    lines.push(import_picocolors42.default.dim("No MCP servers configured — nothing to check."));
     return lines.join(`
 `) + `
 `;
   }
   for (const s3 of report.servers) {
-    const mark = s3.status === "ok" ? import_picocolors41.default.green("✓") : s3.status === "auth_failed" ? import_picocolors41.default.red("✗") : import_picocolors41.default.yellow("⚠");
-    const detail = s3.status === "ok" ? import_picocolors41.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors41.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
+    const mark = s3.status === "ok" ? import_picocolors42.default.green("✓") : s3.status === "auth_failed" ? import_picocolors42.default.red("✗") : import_picocolors42.default.yellow("⚠");
+    const detail = s3.status === "ok" ? import_picocolors42.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors42.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
     lines.push(`  ${mark} ${s3.name}  ${detail}`);
   }
-  const summary = report.check_status === "ok" ? import_picocolors41.default.green("All MCP servers connected.") : import_picocolors41.default.yellow("Some MCP servers are unhealthy.");
+  const summary = report.check_status === "ok" ? import_picocolors42.default.green("All MCP servers connected.") : import_picocolors42.default.yellow("Some MCP servers are unhealthy.");
   lines.push("", summary);
   return lines.join(`
 `) + `
@@ -75009,97 +75799,100 @@ var PROTECTED = new Set([
 function help() {
   const out = [];
   out.push("");
-  out.push(`  ${brandTint("◆")}  ${import_picocolors42.default.bold("brainbase")}  ${import_picocolors42.default.dim(`v${VERSION}`)}`);
-  out.push(`     ${import_picocolors42.default.dim("connect your local agent to the brainbase platform")}`);
+  out.push(`  ${brandTint("◆")}  ${import_picocolors43.default.bold("brainbase")}  ${import_picocolors43.default.dim(`v${VERSION}`)}`);
+  out.push(`     ${import_picocolors43.default.dim("connect your local agent to the brainbase platform")}`);
   out.push("");
   out.push(divider("USAGE"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.bold("brainbase")} ${import_picocolors42.default.dim("<command> [options]")}`);
+  out.push(`  ${import_picocolors43.default.bold("brainbase")} ${import_picocolors43.default.dim("<command> [options]")}`);
   out.push("");
   out.push(divider("AUTH"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.cyan("login")}     ${import_picocolors42.default.dim("  open the web app and connect this device")}`);
-  out.push(`  ${import_picocolors42.default.cyan("logout")}    ${import_picocolors42.default.dim("  clear the local session")}`);
-  out.push(`  ${import_picocolors42.default.cyan("whoami")}    ${import_picocolors42.default.dim("  show the current user")}`);
+  out.push(`  ${import_picocolors43.default.cyan("login")}     ${import_picocolors43.default.dim("  open the web app and connect this device")}`);
+  out.push(`  ${import_picocolors43.default.cyan("logout")}    ${import_picocolors43.default.dim("  clear the local session")}`);
+  out.push(`  ${import_picocolors43.default.cyan("whoami")}    ${import_picocolors43.default.dim("  show the current user")}`);
   out.push("");
   out.push(divider("LINKED AGENT"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.cyan("agent create")}               ${import_picocolors42.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors42.default.cyan("agent pull")} ${import_picocolors42.default.dim("[<id>]")}          ${import_picocolors42.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
-  out.push(`  ${import_picocolors42.default.cyan("agent push")}                 ${import_picocolors42.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors42.default.cyan("agent unpack")}               ${import_picocolors42.default.dim("install the claimed agent into a harness layout")}`);
-  out.push(`  ${import_picocolors42.default.cyan("link")}                       ${import_picocolors42.default.dim("attach this folder to an existing agent")}`);
-  out.push(`  ${import_picocolors42.default.cyan("agent status")}               ${import_picocolors42.default.dim("show what would pull and what would push")}`);
-  out.push(`  ${import_picocolors42.default.cyan("agent env")}                  ${import_picocolors42.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
-  out.push(`  ${import_picocolors42.default.cyan("run")} ${import_picocolors42.default.dim("<cmd> [args...]")}         ${import_picocolors42.default.dim("run <cmd> with secrets.env loaded into env")}`);
-  out.push(`  ${import_picocolors42.default.cyan("status")}                     ${import_picocolors42.default.dim("show what this folder is linked to")}`);
-  out.push(`  ${import_picocolors42.default.cyan("unlink")}                     ${import_picocolors42.default.dim("disconnect this folder")}`);
+  out.push(`  ${import_picocolors43.default.cyan("agent create")}               ${import_picocolors43.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
+  out.push(`  ${import_picocolors43.default.cyan("agent pull")} ${import_picocolors43.default.dim("[<id>]")}          ${import_picocolors43.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
+  out.push(`  ${import_picocolors43.default.cyan("agent push")}                 ${import_picocolors43.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors43.default.cyan("agent unpack")}               ${import_picocolors43.default.dim("install the claimed agent into a harness layout")}`);
+  out.push(`  ${import_picocolors43.default.cyan("link")}                       ${import_picocolors43.default.dim("attach this folder to an existing agent")}`);
+  out.push(`  ${import_picocolors43.default.cyan("agent status")}               ${import_picocolors43.default.dim("show what would pull and what would push")}`);
+  out.push(`  ${import_picocolors43.default.cyan("agent env")}                  ${import_picocolors43.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
+  out.push(`  ${import_picocolors43.default.cyan("run")} ${import_picocolors43.default.dim("<cmd> [args...]")}         ${import_picocolors43.default.dim("run <cmd> with secrets.env loaded into env")}`);
+  out.push(`  ${import_picocolors43.default.cyan("status")}                     ${import_picocolors43.default.dim("show what this folder is linked to")}`);
+  out.push(`  ${import_picocolors43.default.cyan("unlink")}                     ${import_picocolors43.default.dim("disconnect this folder")}`);
   out.push("");
   out.push(divider("ORCHESTRATIONS"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.cyan("orchestration list")}             ${import_picocolors42.default.dim("list orchestrations under a team")}`);
-  out.push(`  ${import_picocolors42.default.cyan("orchestration pull")} ${import_picocolors42.default.dim("<id>")}        ${import_picocolors42.default.dim("recursively fetch an orchestration + every member agent")}`);
-  out.push(`  ${import_picocolors42.default.cyan("orchestration push")}             ${import_picocolors42.default.dim("recursively push each member, then update the graph")}`);
-  out.push(`  ${import_picocolors42.default.cyan("orchestration status")}           ${import_picocolors42.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors43.default.cyan("orchestration create")}           ${import_picocolors43.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors43.default.cyan("orchestration list")}             ${import_picocolors43.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors43.default.cyan("orchestration pull")} ${import_picocolors43.default.dim("<id>")}        ${import_picocolors43.default.dim("recursively fetch an orchestration + every member agent")}`);
+  out.push(`  ${import_picocolors43.default.cyan("orchestration push")}             ${import_picocolors43.default.dim("recursively push each member, then update the graph")}`);
+  out.push(`  ${import_picocolors43.default.cyan("orchestration status")}           ${import_picocolors43.default.dim("show what would push and what would pull")}`);
   out.push("");
   out.push(divider("TEMPLATES"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.cyan("template pack")}                       ${import_picocolors42.default.dim("bundle the current agent into a template")}`);
-  out.push(`  ${import_picocolors42.default.cyan("template publish")}                    ${import_picocolors42.default.dim("upload a template to the registry")}`);
-  out.push(`  ${import_picocolors42.default.cyan("template search")} ${import_picocolors42.default.dim("[query]")}             ${import_picocolors42.default.dim("search the registry")}`);
-  out.push(`  ${import_picocolors42.default.cyan("template info")}    ${import_picocolors42.default.dim("<creator/slug>")}     ${import_picocolors42.default.dim("show registry details for a template")}`);
-  out.push(`  ${import_picocolors42.default.cyan("template onboard")} ${import_picocolors42.default.dim("<creator/slug>")}     ${import_picocolors42.default.dim("install (or refresh) a template")}`);
-  out.push(`  ${import_picocolors42.default.cyan("template list")}                       ${import_picocolors42.default.dim("show installed templates")}`);
-  out.push(`  ${import_picocolors42.default.cyan("template remove")}  ${import_picocolors42.default.dim("<creator/slug>")}     ${import_picocolors42.default.dim("uninstall a template")}`);
+  out.push(`  ${import_picocolors43.default.cyan("template pack")}                       ${import_picocolors43.default.dim("bundle the current agent into a template")}`);
+  out.push(`  ${import_picocolors43.default.cyan("template publish")}                    ${import_picocolors43.default.dim("upload a template to the registry")}`);
+  out.push(`  ${import_picocolors43.default.cyan("template search")} ${import_picocolors43.default.dim("[query]")}             ${import_picocolors43.default.dim("search the registry")}`);
+  out.push(`  ${import_picocolors43.default.cyan("template info")}    ${import_picocolors43.default.dim("<creator/slug>")}     ${import_picocolors43.default.dim("show registry details for a template")}`);
+  out.push(`  ${import_picocolors43.default.cyan("template onboard")} ${import_picocolors43.default.dim("<creator/slug>")}     ${import_picocolors43.default.dim("install (or refresh) a template")}`);
+  out.push(`  ${import_picocolors43.default.cyan("template list")}                       ${import_picocolors43.default.dim("show installed templates")}`);
+  out.push(`  ${import_picocolors43.default.cyan("template remove")}  ${import_picocolors43.default.dim("<creator/slug>")}     ${import_picocolors43.default.dim("uninstall a template")}`);
   out.push("");
   out.push(divider("SKILLS"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.cyan("skill add")} ${import_picocolors42.default.dim("<source>")}                  ${import_picocolors42.default.dim("install a skill (github / git / brainbase)")}`);
-  out.push(`  ${import_picocolors42.default.cyan("skill list")}                            ${import_picocolors42.default.dim("show locally installed skills + their source")}`);
-  out.push(`  ${import_picocolors42.default.cyan("skill update")} ${import_picocolors42.default.dim("<slug>")}                  ${import_picocolors42.default.dim("re-fetch a skill from its recorded source")}`);
-  out.push(`  ${import_picocolors42.default.cyan("skill remove")} ${import_picocolors42.default.dim("<slug>")}                  ${import_picocolors42.default.dim("uninstall a skill")}`);
-  out.push(`  ${import_picocolors42.default.cyan("skill search")} ${import_picocolors42.default.dim("[query]")}                 ${import_picocolors42.default.dim("search the brainbase skill registry")}`);
-  out.push(`  ${import_picocolors42.default.cyan("skill info")} ${import_picocolors42.default.dim("<creator/slug>")}            ${import_picocolors42.default.dim("show registry details for a skill")}`);
-  out.push(`  ${import_picocolors42.default.cyan("skill publish")} ${import_picocolors42.default.dim("[dir]")}                  ${import_picocolors42.default.dim("publish a SKILL.md folder (defaults to .)")}`);
+  out.push(`  ${import_picocolors43.default.cyan("skill add")} ${import_picocolors43.default.dim("<source>")}                  ${import_picocolors43.default.dim("install a skill (github / git / brainbase)")}`);
+  out.push(`  ${import_picocolors43.default.cyan("skill list")}                            ${import_picocolors43.default.dim("show locally installed skills + their source")}`);
+  out.push(`  ${import_picocolors43.default.cyan("skill update")} ${import_picocolors43.default.dim("<slug>")}                  ${import_picocolors43.default.dim("re-fetch a skill from its recorded source")}`);
+  out.push(`  ${import_picocolors43.default.cyan("skill remove")} ${import_picocolors43.default.dim("<slug>")}                  ${import_picocolors43.default.dim("uninstall a skill")}`);
+  out.push(`  ${import_picocolors43.default.cyan("skill search")} ${import_picocolors43.default.dim("[query]")}                 ${import_picocolors43.default.dim("search the brainbase skill registry")}`);
+  out.push(`  ${import_picocolors43.default.cyan("skill info")} ${import_picocolors43.default.dim("<creator/slug>")}            ${import_picocolors43.default.dim("show registry details for a skill")}`);
+  out.push(`  ${import_picocolors43.default.cyan("skill publish")} ${import_picocolors43.default.dim("[dir]")}                  ${import_picocolors43.default.dim("publish a SKILL.md folder (defaults to .)")}`);
   out.push("");
   out.push(divider("CLI TOKENS"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.cyan("token create")}                        ${import_picocolors42.default.dim("issue a long-lived CLI key for CI / scripts")}`);
-  out.push(`  ${import_picocolors42.default.cyan("token list")}                          ${import_picocolors42.default.dim("show your active tokens")}`);
-  out.push(`  ${import_picocolors42.default.cyan("token revoke")} ${import_picocolors42.default.dim("<id>")}                  ${import_picocolors42.default.dim("revoke a token")}`);
+  out.push(`  ${import_picocolors43.default.cyan("token create")}                        ${import_picocolors43.default.dim("issue a long-lived CLI key for CI / scripts")}`);
+  out.push(`  ${import_picocolors43.default.cyan("token list")}                          ${import_picocolors43.default.dim("show your active tokens")}`);
+  out.push(`  ${import_picocolors43.default.cyan("token revoke")} ${import_picocolors43.default.dim("<id>")}                  ${import_picocolors43.default.dim("revoke a token")}`);
   out.push("");
   out.push(divider("MCP"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.cyan("mcp check")} ${import_picocolors42.default.dim("[--json]")}              ${import_picocolors42.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
+  out.push(`  ${import_picocolors43.default.cyan("mcp check")} ${import_picocolors43.default.dim("[--json]")}              ${import_picocolors43.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
   out.push("");
   out.push(divider("FLAGS"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
-  out.push(`  ${import_picocolors42.default.dim("--scope <s>")}        force scope: global | project`);
-  out.push(`  ${import_picocolors42.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
-  out.push(`  ${import_picocolors42.default.dim("--agent <id>")}       for link: attach this folder to an existing agent non-interactively`);
-  out.push(`  ${import_picocolors42.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
-  out.push(`  ${import_picocolors42.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
-  out.push(`  ${import_picocolors42.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
-  out.push(`  ${import_picocolors42.default.dim("--all")}              for template list: include installs from other folders`);
-  out.push(`  ${import_picocolors42.default.dim("--web <url>")}        for login: web app URL (default https://new.usekafka.com)`);
+  out.push(`  ${import_picocolors43.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
+  out.push(`  ${import_picocolors43.default.dim("--scope <s>")}        force scope: global | project`);
+  out.push(`  ${import_picocolors43.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
+  out.push(`  ${import_picocolors43.default.dim("--agent <id>")}       for link: attach this folder to an existing agent non-interactively`);
+  out.push(`  ${import_picocolors43.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
+  out.push(`  ${import_picocolors43.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
+  out.push(`  ${import_picocolors43.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
+  out.push(`  ${import_picocolors43.default.dim("--all")}              for template list: include installs from other folders`);
+  out.push(`  ${import_picocolors43.default.dim("--web <url>")}        for login: web app URL (default https://new.usekafka.com)`);
   out.push("");
   out.push(divider("ENV"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
-  out.push(`  ${import_picocolors42.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
-  out.push(`  ${import_picocolors42.default.dim("BRAINBASE_API_URL")}      override the API URL used by link / sync`);
-  out.push(`  ${import_picocolors42.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL`);
-  out.push(`  ${import_picocolors42.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT (overrides token.json)`);
-  out.push(`  ${import_picocolors42.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
-  out.push(`  ${import_picocolors42.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
-  out.push(`  ${import_picocolors42.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS control-plane host (uses /v2/cli)`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT (overrides token.json)`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
+  out.push(`  ${import_picocolors43.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
   out.push("");
   out.push(divider("HARNESSES"));
   out.push("");
-  out.push(`  ${import_picocolors42.default.dim("•")} ${import_picocolors42.default.bold("claude-code")}  ${import_picocolors42.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors42.default.dim("•")} ${import_picocolors42.default.bold("codex")}        ${import_picocolors42.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors42.default.dim("•")} ${import_picocolors42.default.bold("kafka")}        ${import_picocolors42.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors43.default.dim("•")} ${import_picocolors43.default.bold("claude-code")}  ${import_picocolors43.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors43.default.dim("•")} ${import_picocolors43.default.bold("codex")}        ${import_picocolors43.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors43.default.dim("•")} ${import_picocolors43.default.bold("kafka")}        ${import_picocolors43.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -75153,13 +75946,13 @@ async function requireAuth(cmd) {
   if (status.ok)
     return;
   console.error("");
-  console.error(`  ${brandTint("◆")}  ${import_picocolors42.default.bold("brainbase")}`);
+  console.error(`  ${brandTint("◆")}  ${import_picocolors43.default.bold("brainbase")}`);
   console.error("");
-  console.error(`  ${import_picocolors42.default.red("✗")}  You need to sign in to use ${import_picocolors42.default.bold("brainbase " + cmd)}.`);
+  console.error(`  ${import_picocolors43.default.red("✗")}  You need to sign in to use ${import_picocolors43.default.bold("brainbase " + cmd)}.`);
   if (status.reason)
-    console.error(`     ${import_picocolors42.default.dim(status.reason)}`);
+    console.error(`     ${import_picocolors43.default.dim(status.reason)}`);
   console.error("");
-  console.error(`     Run ${import_picocolors42.default.cyan("brainbase login")} to connect this device.`);
+  console.error(`     Run ${import_picocolors43.default.cyan("brainbase login")} to connect this device.`);
   console.error("");
   process14.exit(1);
 }
@@ -75337,7 +76130,7 @@ async function main() {
         process14.exit(1);
     }
   } catch (err) {
-    console.error(import_picocolors42.default.red(`
+    console.error(import_picocolors43.default.red(`
 ${err.message}`));
     if (process14.env.BRAINBASE_DEBUG)
       console.error(err.stack);