@brainbase-labs/cli 0.21.0 → 0.21.1

package/dist/index.js

@@ -31708,8 +31708,8 @@ var require_utils = __commonJS((exports, module) => {
     }
     return ind;
   }
-  function removeDotSegments(path87) {
-    let input = path87;
+  function removeDotSegments(path88) {
+    let input = path88;
     const output = [];
     let nextSlash = -1;
     let len = 0;
@@ -31952,8 +31952,8 @@ var require_schemes = __commonJS((exports, module) => {
       wsComponent.secure = undefined;
     }
     if (wsComponent.resourceName) {
-      const [path87, query] = wsComponent.resourceName.split("?");
-      wsComponent.path = path87 && path87 !== "/" ? path87 : undefined;
+      const [path88, query] = wsComponent.resourceName.split("?");
+      wsComponent.path = path88 && path88 !== "/" ? path88 : undefined;
       wsComponent.query = query;
       wsComponent.resourceName = undefined;
     }
@@ -35128,12 +35128,12 @@ var require_dist2 = __commonJS((exports, module) => {
       throw new Error(`Unknown format "${name}"`);
     return f4;
   };
-  function addFormats(ajv, list, fs79, exportName) {
+  function addFormats(ajv, list, fs80, exportName) {
     var _a;
     var _b;
     (_a = (_b = ajv.opts.code).formats) !== null && _a !== undefined || (_b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`);
     for (const f4 of list)
-      ajv.addFormat(f4, fs79[f4]);
+      ajv.addFormat(f4, fs80[f4]);
   }
   module.exports = exports = formatsPlugin;
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -35143,7 +35143,7 @@ var require_dist2 = __commonJS((exports, module) => {
 // src/index.ts
 var import_picocolors49 = __toESM(require_picocolors(), 1);
 import process14 from "node:process";
-import fs81 from "node:fs";
+import fs82 from "node:fs";
 
 // src/cli/template.ts
 var import_picocolors12 = __toESM(require_picocolors(), 1);
@@ -36008,7 +36008,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.21.0",
+  version: "0.21.1",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -40917,7 +40917,7 @@ function readAuth() {
   }
 }
 function acquireLock(lockFile, timeoutMs) {
-  ensureDir(BRAINBASE_HOME);
+  ensureDir(path8.dirname(lockFile));
   const deadline = Date.now() + timeoutMs;
   const lockId = randomUUID();
   const owner = `${process.pid}:${lockId}`;
@@ -53845,6 +53845,8 @@ function apiErrorMessage(body, status) {
 import path57 from "node:path";
 import fs47 from "node:fs";
 var TOKEN_FILE = path57.join(BRAINBASE_HOME, "token.json");
+var TOKEN_LOCK_FILE = `${TOKEN_FILE}.lock`;
+var TOKEN_LOCK_TIMEOUT_MS = 5000;
 var TOKEN_PREFIX = "bbpat_";
 var TOKEN_PREFIX_LEN = 14;
 function tokenPrefix(token) {
@@ -53867,6 +53869,17 @@ var StoredTokenSchema = exports_external.object({
   name: exports_external.string().optional(),
   createdAt: exports_external.string()
 });
+function withTokenLock(operation) {
+  const release = acquireLock(TOKEN_LOCK_FILE, TOKEN_LOCK_TIMEOUT_MS);
+  if (!release) {
+    throw new Error(`Timed out waiting to update the local CLI token; if no other brainbase process is running, remove ${TOKEN_LOCK_FILE}`);
+  }
+  try {
+    return operation();
+  } finally {
+    release();
+  }
+}
 function readToken() {
   if (!exists(TOKEN_FILE))
     return null;
@@ -53880,7 +53893,6 @@ function writeToken(token, name) {
   if (!isValidTokenFormat(token)) {
     throw new Error("refusing to store token: invalid format");
   }
-  ensureDir(BRAINBASE_HOME);
   const stored = {
     schemaVersion: 1,
     token,
@@ -53888,15 +53900,35 @@ function writeToken(token, name) {
     name,
     createdAt: new Date().toISOString()
   };
-  writeJson(TOKEN_FILE, stored);
-  try {
-    fs47.chmodSync(TOKEN_FILE, 384);
-  } catch {}
+  withTokenLock(() => writeJsonAtomic(TOKEN_FILE, stored));
   return stored;
 }
 function clearToken() {
-  if (exists(TOKEN_FILE))
-    fs47.rmSync(TOKEN_FILE);
+  withTokenLock(() => {
+    if (exists(TOKEN_FILE))
+      fs47.rmSync(TOKEN_FILE);
+  });
+}
+function clearTokenIfMatches(prefix) {
+  if (!prefix.startsWith(TOKEN_PREFIX))
+    return "unverifiable";
+  if (prefix.length < TOKEN_PREFIX_LEN)
+    return "unverifiable";
+  const before2 = readToken();
+  if (!before2)
+    return "absent";
+  if (!before2.token.startsWith(prefix))
+    return "kept";
+  return withTokenLock(() => {
+    const stored = readToken();
+    if (!stored)
+      return "absent";
+    if (!stored.token.startsWith(prefix))
+      return "kept";
+    if (exists(TOKEN_FILE))
+      fs47.rmSync(TOKEN_FILE);
+    return "cleared";
+  });
 }
 
 // src/core/api.ts
@@ -54297,8 +54329,13 @@ var api = {
       body: JSON.stringify(input)
     });
   },
-  getAgentSecrets(agentId) {
-    return request(`/agents/${encodeURIComponent(agentId)}/secrets`);
+  async getAgentSecrets(agentId) {
+    const body = await request(`/agents/${encodeURIComponent(agentId)}/secrets`);
+    const secrets = body && typeof body === "object" ? body.secrets : undefined;
+    if (!secrets || typeof secrets !== "object" || Array.isArray(secrets) || !Object.values(secrets).every((value) => typeof value === "string")) {
+      throw new ApiError("The control plane returned an unreadable secrets response", undefined);
+    }
+    return { secrets };
   },
   putAgentSecrets(agentId, secrets) {
     return request(`/agents/${encodeURIComponent(agentId)}/secrets`, {
@@ -54599,6 +54636,12 @@ var registryApi = {
       body: JSON.stringify(input)
     });
   },
+  renameCliToken(id, name) {
+    return jsonRequest(`/v1/registry/cli-tokens/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      body: JSON.stringify({ name })
+    });
+  },
   revokeCliToken(id) {
     return jsonRequest(`/v1/registry/cli-tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
   }
@@ -61797,6 +61840,9 @@ var EvalSchema = exports_external.object({
   path: ["classification_values"]
 });
 var MODEL_ID_RE = /^[A-Za-z0-9._:/-]{1,128}$/;
+var UNSYNCED_MANIFEST_KEYS = ["commands", "hooks", "files"];
+var UnsyncedBlockSchema = exports_external.array(exports_external.record(exports_external.unknown())).optional();
+var UnsyncedBlocksShape = Object.fromEntries(UNSYNCED_MANIFEST_KEYS.map((key2) => [key2, UnsyncedBlockSchema]));
 var AgentManifestSchema = exports_external.object({
   schema: exports_external.literal(1),
   id: exports_external.string().min(1).optional(),
@@ -61823,9 +61869,7 @@ var AgentManifestSchema = exports_external.object({
     });
   }).default([]),
   capabilities: CapabilitiesSchema.optional(),
-  commands: exports_external.array(exports_external.record(exports_external.unknown())).optional(),
-  hooks: exports_external.array(exports_external.record(exports_external.unknown())).optional(),
-  files: exports_external.array(exports_external.record(exports_external.unknown())).optional()
+  ...UnsyncedBlocksShape
 });
 function manifestPath(cwd2) {
   return path73.join(cwd2, AGENT_MANIFEST_FILE);
@@ -63244,13 +63288,132 @@ var import_picocolors34 = __toESM(require_picocolors(), 1);
 // src/cli/agent-pull.ts
 import { spawn as spawn2 } from "node:child_process";
 import path80 from "node:path";
-import fs72 from "node:fs";
+import fs73 from "node:fs";
 import os14 from "node:os";
 var import_picocolors26 = __toESM(require_picocolors(), 1);
 
+// src/core/manifest-unsynced.ts
+import fs69 from "node:fs";
+var import_yaml3 = __toESM(require_dist(), 1);
+function findUnsyncedBlocks(manifest) {
+  const found = [];
+  for (const key2 of UNSYNCED_MANIFEST_KEYS) {
+    const block = manifest[key2];
+    if (Array.isArray(block) && block.length > 0) {
+      found.push({ key: key2, entries: block.length });
+    }
+  }
+  return found;
+}
+function unsyncedBlockReason(block) {
+  const entries = `${block.entries} ${block.entries === 1 ? "entry" : "entries"}`;
+  return `\`${block.key}\` is declared in ${AGENT_MANIFEST_FILE} (${entries}) but this ` + `CLI does not sync ${block.key} yet — pushing would discard it.`;
+}
+function unsyncedBlockRemedy(blocks) {
+  const keys2 = blocks.map((b4) => `\`${b4.key}\``).join(", ");
+  const plural = blocks.length === 1 ? "" : "s";
+  return `Remove the ${keys2} block${plural} from ${AGENT_MANIFEST_FILE} to continue. ` + `These blocks are unsupported with no target release — see "Reserved ` + `fields" in the agent manifest reference.`;
+}
+function reportUnsyncedBlocks(manifest, opts = {}) {
+  const blocks = findUnsyncedBlocks(manifest);
+  if (blocks.length === 0)
+    return false;
+  const prefix = opts.label ? `${opts.label}: ` : "";
+  for (const block of blocks) {
+    f2.error(`${prefix}${unsyncedBlockReason(block)}`);
+  }
+  f2.info(unsyncedBlockRemedy(blocks));
+  return true;
+}
+function carryForwardUnsyncedBlocks(prev) {
+  const carried = {};
+  for (const key2 of UNSYNCED_MANIFEST_KEYS) {
+    const block = prev?.[key2];
+    if (block !== undefined)
+      carried[key2] = block;
+  }
+  return carried;
+}
+function salvageLocalOnlyContent(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return {};
+  const doc = raw;
+  const salvaged = {};
+  for (const key2 of UNSYNCED_MANIFEST_KEYS) {
+    if (doc[key2] === undefined)
+      continue;
+    const result2 = AgentManifestSchema.shape[key2].safeParse(doc[key2]);
+    if (result2.success && result2.data !== undefined) {
+      salvaged[key2] = result2.data;
+    }
+  }
+  if (doc.evals !== undefined) {
+    const evals = AgentManifestSchema.shape.evals.safeParse(doc.evals);
+    if (evals.success)
+      salvaged.evals = evals.data;
+  }
+  return salvaged;
+}
+function readLocalOnlyContent(cwd2) {
+  if (!hasManifest(cwd2))
+    return { content: {}, status: "absent" };
+  try {
+    const prev = readManifest(cwd2);
+    return {
+      content: {
+        evals: prev?.evals ?? [],
+        ...carryForwardUnsyncedBlocks(prev)
+      },
+      status: "parsed"
+    };
+  } catch {}
+  const file = existingManifestPath(cwd2);
+  let raw = null;
+  if (file) {
+    try {
+      raw = import_yaml3.default.parse(fs69.readFileSync(file, "utf8"));
+    } catch {
+      raw = null;
+    }
+  }
+  const content = salvageLocalOnlyContent(raw);
+  return {
+    content,
+    status: Object.keys(content).length > 0 ? "recovered" : "unreadable"
+  };
+}
+function readManifestAgentId(cwd2) {
+  if (!hasManifest(cwd2))
+    return;
+  const clean = (value) => typeof value === "string" && value.trim() ? value.trim() : undefined;
+  try {
+    return clean(readManifest(cwd2)?.id);
+  } catch {}
+  const file = existingManifestPath(cwd2);
+  if (!file)
+    return;
+  try {
+    const raw = import_yaml3.default.parse(fs69.readFileSync(file, "utf8"));
+    if (!raw || typeof raw !== "object")
+      return;
+    return clean(raw.id);
+  } catch {
+    return;
+  }
+}
+function readLocalOnlyContentReporting(cwd2) {
+  const { content, status } = readLocalOnlyContent(cwd2);
+  if (status === "recovered") {
+    f2.warn(`${AGENT_MANIFEST_FILE} could not be read; kept its ${Object.keys(content).join(", ")} and rebuilt the rest from the cloud.`);
+  } else if (status === "unreadable") {
+    f2.warn(`${AGENT_MANIFEST_FILE} could not be read and was replaced with cloud state.`);
+  }
+  return content;
+}
+
 // src/core/agent-diff.ts
 import path77 from "node:path";
-import fs69 from "node:fs";
+import fs70 from "node:fs";
 import crypto4 from "node:crypto";
 function compKey(type, slug) {
   return `${type}/${slug}`;
@@ -63300,7 +63463,7 @@ function fileHash(p2) {
   if (!exists(p2))
     return null;
   try {
-    const buf = fs69.readFileSync(p2);
+    const buf = fs70.readFileSync(p2);
     return crypto4.createHash("sha256").update(buf).digest("hex");
   } catch {
     return null;
@@ -63322,7 +63485,7 @@ function hashDirectoryAsComponent(dir) {
   const walk = (sub) => {
     let entries;
     try {
-      entries = fs69.readdirSync(sub, { withFileTypes: true });
+      entries = fs70.readdirSync(sub, { withFileTypes: true });
     } catch {
       return;
     }
@@ -63590,7 +63753,7 @@ function diffAgentConfig(manifest, lock, cloud) {
 
 // src/core/secrets-env.ts
 import path78 from "node:path";
-import fs70 from "node:fs";
+import fs71 from "node:fs";
 var SECRETS_FILE = "secrets.env";
 function secretsPath(cwd2) {
   return path78.join(cwd2, LINK_DIR, SECRETS_FILE);
@@ -63638,18 +63801,18 @@ function readLocalSecrets(cwd2) {
   const p2 = secretsPath(cwd2);
   if (!exists(p2))
     return {};
-  return parseSecretsEnv(fs70.readFileSync(p2, "utf8"));
+  return parseSecretsEnv(fs71.readFileSync(p2, "utf8"));
 }
 function writeLocalSecrets(cwd2, secrets) {
   ensureDir(path78.join(cwd2, LINK_DIR));
-  fs70.writeFileSync(secretsPath(cwd2), formatSecretsEnv(secrets), "utf8");
+  fs71.writeFileSync(secretsPath(cwd2), formatSecretsEnv(secrets), "utf8");
   ensureSecretsGitignore(cwd2);
 }
 function ensureSecretsGitignore(cwd2) {
   const ignorePath = path78.join(cwd2, LINK_DIR, ".gitignore");
   const needed = [SYNC_STATE_FILE, SECRETS_FILE];
   try {
-    const current = exists(ignorePath) ? fs70.readFileSync(ignorePath, "utf8") : "";
+    const current = exists(ignorePath) ? fs71.readFileSync(ignorePath, "utf8") : "";
     const lines = new Set(current.split(/\r?\n/).map((l2) => l2.trim()).filter(Boolean));
     let changed = false;
     for (const n of needed) {
@@ -63659,7 +63822,7 @@ function ensureSecretsGitignore(cwd2) {
       }
     }
     if (changed) {
-      fs70.writeFileSync(ignorePath, [...lines].join(`
+      fs71.writeFileSync(ignorePath, [...lines].join(`
 `) + `
 `);
     }
@@ -63698,7 +63861,7 @@ function entrypointExecutionAllowed(opts) {
 
 // src/cli/agent-unpack.ts
 import path79 from "node:path";
-import fs71 from "node:fs";
+import fs72 from "node:fs";
 import os13 from "node:os";
 var import_picocolors25 = __toESM(require_picocolors(), 1);
 function componentsForNativeInstall(components, acp) {
@@ -63747,14 +63910,14 @@ async function runAgentUnpack(cwd2, args) {
     }
   }
   const scope = args.scope ?? "project";
-  const stageRoot = fs71.mkdtempSync(path79.join(os13.tmpdir(), "brainbase-unpack-"));
+  const stageRoot = fs72.mkdtempSync(path79.join(os13.tmpdir(), "brainbase-unpack-"));
   try {
     const toInstall = [];
     const instructionsBody = readInstructions(cwd2, manifest);
     if (instructionsBody && instructionsBody.trim()) {
       const compDir = path79.join(stageRoot, "instruction", "agent-instructions");
       ensureDir(compDir);
-      fs71.writeFileSync(path79.join(compDir, "instructions.md"), instructionsBody, "utf8");
+      fs72.writeFileSync(path79.join(compDir, "instructions.md"), instructionsBody, "utf8");
       toInstall.push({
         type: "instruction",
         slug: "agent-instructions",
@@ -63833,7 +63996,7 @@ async function runAgentUnpack(cwd2, args) {
     return;
   } finally {
     try {
-      fs71.rmSync(stageRoot, { recursive: true, force: true });
+      fs72.rmSync(stageRoot, { recursive: true, force: true });
     } catch {}
   }
   if (manifest.harness !== harness) {
@@ -63854,8 +64017,8 @@ async function runAgentUnpack(cwd2, args) {
 function writeResolvedMcps(workdir, toInstall) {
   const mcps = toInstall.filter((c2) => c2.type === "mcp").map((c2) => ({ name: c2.slug, ...c2.payload }));
   const dir = path79.join(workdir, ".brainbase");
-  fs71.mkdirSync(dir, { recursive: true });
-  fs71.writeFileSync(path79.join(dir, "resolved-mcps.json"), JSON.stringify(mcps, null, 2));
+  fs72.mkdirSync(dir, { recursive: true });
+  fs72.writeFileSync(path79.join(dir, "resolved-mcps.json"), JSON.stringify(mcps, null, 2));
 }
 function stageLocalPlaybook(entry, cwd2, stageRoot, scope, toInstall) {
   if (entry.content.text !== undefined && entry.content.file !== undefined) {
@@ -63869,7 +64032,7 @@ function stageLocalPlaybook(entry, cwd2, stageRoot, scope, toInstall) {
   const compDir = path79.join(stageRoot, "playbook", slug);
   ensureDir(compDir);
   const wireBody = /^---\s*\n/.test(body) ? body : assembleFrontmatter(entry.title, entry.description) + body.replace(/^\n+/, "");
-  fs71.writeFileSync(path79.join(compDir, `${slug}.md`), wireBody, "utf8");
+  fs72.writeFileSync(path79.join(compDir, `${slug}.md`), wireBody, "utf8");
   toInstall.push({
     type: "playbook",
     slug,
@@ -63883,7 +64046,7 @@ function stageLocalPlaybook(entry, cwd2, stageRoot, scope, toInstall) {
 function stageLocalSkill(source, cwd2, stageRoot, scope, toInstall) {
   if (source.startsWith("./") || source.startsWith("../") || source.startsWith("/")) {
     const abs = path79.resolve(cwd2, source);
-    if (!fs71.existsSync(abs)) {
+    if (!fs72.existsSync(abs)) {
       return `Skill ${source}: not found on disk — skipped.`;
     }
     const slug = path79.basename(abs);
@@ -63956,13 +64119,13 @@ function defaultSlugForSource(source) {
 }
 function copyDirRecursive(src, dest) {
   ensureDir(dest);
-  for (const entry of fs71.readdirSync(src, { withFileTypes: true })) {
+  for (const entry of fs72.readdirSync(src, { withFileTypes: true })) {
     const s3 = path79.join(src, entry.name);
     const d3 = path79.join(dest, entry.name);
     if (entry.isDirectory())
       copyDirRecursive(s3, d3);
     else if (entry.isFile())
-      fs71.copyFileSync(s3, d3);
+      fs72.copyFileSync(s3, d3);
   }
 }
 function assembleFrontmatter(title, description) {
@@ -64214,14 +64377,14 @@ async function runAgentPull(cwd2, args) {
       if (!prior)
         continue;
       for (const filePath of prior.installedPaths) {
-        if (!fs72.existsSync(filePath))
+        if (!fs73.existsSync(filePath))
           continue;
         try {
-          const stat = fs72.statSync(filePath);
+          const stat = fs73.statSync(filePath);
           if (stat.isDirectory())
-            fs72.rmSync(filePath, { recursive: true, force: true });
+            fs73.rmSync(filePath, { recursive: true, force: true });
           else
-            fs72.rmSync(filePath);
+            fs73.rmSync(filePath);
         } catch (err) {
           f2.warn(`Failed to remove ${filePath}: ${err.message}`);
         }
@@ -64230,7 +64393,7 @@ async function runAgentPull(cwd2, args) {
     materializeInstructions(cwd2, cloud, toInstallKeys, keepLocalKeys, existingManifest);
     materializeEntrypoint(cwd2, cloudAgent.entrypoint ?? "", existingManifest);
     materializePlaybooks(cwd2, cloud, toInstallKeys, keepLocalKeys, existingManifest);
-    const yaml = mergeManifest(cwd2, existingManifest, cloud, cloudAgent, harness);
+    const yaml = mergeManifest(cwd2, existingManifest, cloud, cloudAgent, harness, override ? {} : readLocalOnlyContentReporting(cwd2));
     writeManifest(cwd2, yaml);
     writeLink(cwd2, buildLinkFromAgent(cloudAgent, harness, readLink(cwd2)));
     const lockComponents = buildLockComponents({
@@ -64260,7 +64423,7 @@ async function runAgentPull(cwd2, args) {
     $e(`Pulled ${cloudAgent.name} at revision ${cloud.revision}.`);
   } finally {
     try {
-      fs72.rmSync(stageRoot, { recursive: true, force: true });
+      fs73.rmSync(stageRoot, { recursive: true, force: true });
     } catch {}
   }
 }
@@ -64316,14 +64479,14 @@ function skillSourceFromMeta(c2) {
   }
 }
 function stageManifestComponents(components) {
-  const root = fs72.mkdtempSync(path80.join(os14.tmpdir(), "brainbase-pull-"));
+  const root = fs73.mkdtempSync(path80.join(os14.tmpdir(), "brainbase-pull-"));
   for (const c2 of components) {
     const compDir = path80.join(root, c2.type, c2.slug);
     ensureDir(compDir);
     for (const f4 of c2.files) {
       const target = path80.join(compDir, f4.path);
       ensureDir(path80.dirname(target));
-      fs72.writeFileSync(target, f4.content);
+      fs73.writeFileSync(target, f4.content);
     }
   }
   return root;
@@ -64366,7 +64529,7 @@ function materializeInstructions(cwd2, cloud, toInstall, keepLocal, existingMani
     const targetRel = existingManifest?.instructions?.file ?? DEFAULT_INSTRUCTIONS_FILE;
     const target = path80.resolve(cwd2, targetRel);
     ensureDir(path80.dirname(target));
-    fs72.writeFileSync(target, normalizeInstructionBody(body), "utf8");
+    fs73.writeFileSync(target, normalizeInstructionBody(body), "utf8");
   }
 }
 function materializePlaybooks(cwd2, cloud, toInstall, keepLocal, existingManifest) {
@@ -64388,10 +64551,10 @@ function materializePlaybooks(cwd2, cloud, toInstall, keepLocal, existingManifes
     const targetRel = existing?.content?.file ?? path80.join(DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`);
     const target = path80.resolve(cwd2, targetRel);
     ensureDir(path80.dirname(target));
-    fs72.writeFileSync(target, body, "utf8");
+    fs73.writeFileSync(target, body, "utf8");
   }
 }
-function mergeManifest(cwd2, prev, cloud, cloudAgent, harness) {
+function mergeManifest(cwd2, prev, cloud, cloudAgent, harness, localOnly = {}) {
   const skills = cloud.components.filter((c2) => c2.type === "skill").map((c2) => {
     const localDecl = prev?.skills.find((s3) => looseSkillComponentSlug(s3.source) === c2.slug);
     if (localDecl)
@@ -64472,7 +64635,8 @@ function mergeManifest(cwd2, prev, cloud, cloudAgent, harness) {
     playbooks,
     skills,
     mcp,
-    evals: prev?.evals ?? [],
+    evals: [],
+    ...localOnly,
     capabilities: {
       memory: caps.memory,
       browser: caps.browser,
@@ -64491,9 +64655,9 @@ function materializeEntrypoint(cwd2, cloudEntrypoint, prev) {
     return;
   const filename = prev?.entrypoint?.file ?? DEFAULT_ENTRYPOINT_FILE;
   const target = path80.resolve(cwd2, filename);
-  fs72.writeFileSync(target, cloudEntrypoint, "utf8");
+  fs73.writeFileSync(target, cloudEntrypoint, "utf8");
   try {
-    fs72.chmodSync(target, 493);
+    fs73.chmodSync(target, 493);
   } catch {}
 }
 function buildLockComponents(input) {
@@ -64572,9 +64736,9 @@ async function runEntrypointIfPresent(cwd2, manifest, execute) {
   ensureDir(stateDir);
   const scriptPath = path80.join(stateDir, "entrypoint.sh");
   const logPath = path80.join(stateDir, "entrypoint.log");
-  fs72.writeFileSync(scriptPath, body, "utf8");
+  fs73.writeFileSync(scriptPath, body, "utf8");
   try {
-    fs72.chmodSync(scriptPath, 493);
+    fs73.chmodSync(scriptPath, 493);
   } catch {}
   if (!execute) {
     f2.info(`Agent has an entrypoint — written to ${import_picocolors26.default.dim(path80.relative(cwd2, scriptPath))}, not executed. ` + `Run it with ${import_picocolors26.default.cyan("brainbase run bash .brainbase/entrypoint.sh")} or re-pull with ${import_picocolors26.default.cyan("--run-entrypoint")}. Sandboxes run it automatically.`);
@@ -64583,7 +64747,7 @@ async function runEntrypointIfPresent(cwd2, manifest, execute) {
   f2.info(`Running entrypoint ${import_picocolors26.default.dim(`(${path80.relative(cwd2, scriptPath)})`)}`);
   const secrets = readLocalSecrets(cwd2);
   const env3 = { ...process.env, ...secrets };
-  const logStream = fs72.createWriteStream(logPath, { flags: "w" });
+  const logStream = fs73.createWriteStream(logPath, { flags: "w" });
   const exitCode = await new Promise((resolve) => {
     const child = spawn2("bash", [scriptPath], {
       cwd: cwd2,
@@ -64618,7 +64782,7 @@ async function pullSecrets(cwd2, agentId) {
   sp.start("Fetching secrets…");
   try {
     const res = await api.getAgentSecrets(agentId);
-    cloudSecrets = res.secrets ?? {};
+    cloudSecrets = res.secrets;
     sp.stop(Object.keys(cloudSecrets).length === 0 ? "No secrets on cloud." : `Got ${Object.keys(cloudSecrets).length} secret${Object.keys(cloudSecrets).length === 1 ? "" : "s"}.`);
   } catch (err) {
     sp.stop("Failed to fetch secrets.");
@@ -64859,6 +65023,10 @@ async function runAgentPush(cwd2, args) {
     process.exitCode = 1;
     return;
   }
+  if (reportUnsyncedBlocks(manifest)) {
+    process.exitCode = 1;
+    return;
+  }
   if (!manifest.id) {
     f2.warn(`${import_picocolors28.default.bold(AGENT_MANIFEST_FILE)} is unclaimed (no ${import_picocolors28.default.cyan("id")}). Nothing to push to.`);
     f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent create")} first — that creates the cloud agent and stamps an id here.`);
@@ -64961,6 +65129,7 @@ async function runAgentPush(cwd2, args) {
       const version = registryRefs.get(name)?.version ?? "0.1.0";
       f2.info(`  ${import_picocolors28.default.cyan(`brainbase skill publish ./path/to/skill --name ${name} --skill-version ${version} --yes`)}`);
     }
+    process.exitCode = 1;
     return;
   }
   const skillUpdates = planRegistrySkillUpdates(manifest.skills, cloud.components, latestByName);
@@ -64981,6 +65150,7 @@ async function runAgentPush(cwd2, args) {
       } else {
         f2.error("Entrypoint block is empty.");
       }
+      process.exitCode = 1;
       return;
     }
     resolvedEntrypoint = body;
@@ -64993,6 +65163,7 @@ async function runAgentPush(cwd2, args) {
   for (const r2 of rows) {
     if (r2.type !== "instruction" && r2.type !== "skill" && r2.type !== "mcp" && r2.type !== "playbook") {
       f2.error(`Component ${fmtType(r2.type)} ${import_picocolors28.default.bold(r2.slug)} can't be pushed yet — the server accepts instructions, skills, and mcps in this version.`);
+      process.exitCode = 1;
       return;
     }
   }
@@ -65005,6 +65176,7 @@ async function runAgentPush(cwd2, args) {
     }
     if (parsed.kind === "local") {
       f2.error(`Skill ${import_picocolors28.default.bold(entry.source)} is a local-authored skill. Local skill push isn't supported yet — publish it to the registry first (\`brainbase skill publish\`).`);
+      process.exitCode = 1;
       return;
     }
   }
@@ -65017,6 +65189,7 @@ async function runAgentPush(cwd2, args) {
   }).map((c2) => c2.slug);
   if (preIdSchemaSlugs.length > 0) {
     f2.error(`Playbook ${preIdSchemaSlugs.length === 1 ? "entry" : "entries"} ${preIdSchemaSlugs.map((s3) => import_picocolors28.default.bold(s3)).join(", ")} in ${import_picocolors28.default.bold("brainbase.agent.yaml")} ${preIdSchemaSlugs.length === 1 ? "is" : "are"} missing ${import_picocolors28.default.cyan("id:")}. Run ${import_picocolors28.default.bold("brainbase agent pull")} first to sync playbook ids, then push.`);
+    process.exitCode = 1;
     return;
   }
   const { toSend, conflicts, upstreamOnly } = partitionPushRows(rows, !!args.force);
@@ -65027,6 +65200,7 @@ async function runAgentPush(cwd2, args) {
       console.error(`  ${import_picocolors28.default.red("!")} ${fmtType(r2.type)} ${import_picocolors28.default.bold(r2.slug)}`);
     }
     f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent pull")} first to reconcile, then push again — or ${import_picocolors28.default.cyan("brainbase agent push --force")} to overwrite the cloud with your local version.`);
+    process.exitCode = 1;
     return;
   }
   if (forcedOverrides.length > 0) {
@@ -65303,7 +65477,7 @@ async function planSecretPush(cwd2, agentId) {
   if (Object.keys(localSecrets).length === 0)
     return null;
   const res = await api.getAgentSecrets(agentId);
-  const cloudSecrets = res.secrets ?? {};
+  const cloudSecrets = res.secrets;
   const diff2 = diffSecrets(localSecrets, cloudSecrets);
   if (diff2.localOnly.length === 0 && diff2.changed.length === 0 && diff2.cloudOnly.length === 0) {
     return null;
@@ -65340,37 +65514,64 @@ function handleApiError3(err) {
 }
 
 // src/cli/agent-status.ts
+import path81 from "node:path";
 var import_picocolors29 = __toESM(require_picocolors(), 1);
-async function runAgentStatus(cwd2) {
-  banner("agent status — what changed locally, remotely, both");
+async function runAgentStatus(cwd2, args = {}) {
+  const json = args.json === true;
+  if (!json)
+    banner("agent status — what changed locally, remotely, both");
   const link2 = readLink(cwd2);
   if (!link2) {
+    if (json) {
+      emitJson({ linked: false, ignored: [], unchecked: [] });
+      return;
+    }
     f2.warn("This folder is not linked to any agent.");
     f2.info(`Run ${import_picocolors29.default.cyan("brainbase link")} first.`);
     return;
   }
   const manifest = hasManifest(cwd2) ? readManifest(cwd2) : null;
   const lock = readSyncState(cwd2);
+  const ignoredBlocks = manifest ? findUnsyncedBlocks(manifest) : [];
+  const ignored = ignoredBlocks.map((block) => ({
+    block: block.key,
+    entries: block.entries,
+    reason: unsyncedBlockReason(block)
+  }));
   let cloud = null;
   let cloudAgent = null;
-  const sp = de();
-  sp.start(`Fetching ${link2.name}…`);
+  const sp = json ? null : de();
+  sp?.start(`Fetching ${link2.name}…`);
   try {
     [cloud, cloudAgent] = await Promise.all([
       api.getAgentManifest(link2.agent_id),
       api.getAgent(link2.agent_id)
     ]);
-    sp.stop(`Cloud revision ${cloud.revision}.`);
+    sp?.stop(`Cloud revision ${cloud.revision}.`);
   } catch (err) {
-    sp.stop("Failed to reach brainbase.");
-    if (err instanceof ApiError && err.status === 401) {
-      f2.error("Your session is invalid. Run `brainbase login` and try again.");
-    } else {
-      f2.error(err.message);
+    const unauthorized = err instanceof ApiError && err.status === 401;
+    const message = unauthorized ? "Your session is invalid. Run `brainbase login` and try again." : err.message;
+    if (json) {
+      console.error(message);
+      process.exitCode = 1;
+      return;
     }
+    sp?.stop("Failed to reach brainbase.");
+    f2.error(message);
     return;
   }
   if (!manifest) {
+    if (json) {
+      emitJson({
+        linked: true,
+        manifest: false,
+        agent: { id: link2.agent_id, name: link2.name, slug: link2.slug },
+        revision: { cloud: cloud.revision, lock: lock?.revision ?? null },
+        ignored,
+        unchecked: []
+      });
+      return;
+    }
     f2.info(`${import_picocolors29.default.dim("No")} ${import_picocolors29.default.bold("brainbase.agent.yaml")} ${import_picocolors29.default.dim("here yet.")} Run ${import_picocolors29.default.cyan("brainbase agent pull")} to populate this folder.`);
     f2.info(`Cloud has ${import_picocolors29.default.bold(String(cloud.components.length))} component${cloud.components.length === 1 ? "" : "s"} at revision ${cloud.revision}.`);
     return;
@@ -65415,21 +65616,68 @@ async function runAgentStatus(cwd2) {
     cloudOnly: [],
     changed: []
   };
+  let secretsChecked = true;
+  let secretsUncheckedReason = "";
   try {
     const localSecrets = readLocalSecrets(cwd2);
     const cloudRes = await api.getAgentSecrets(link2.agent_id);
-    secretDrift = diffSecrets(localSecrets, cloudRes.secrets ?? {});
-  } catch {}
+    secretDrift = diffSecrets(localSecrets, cloudRes.secrets);
+  } catch (err) {
+    if (!(err instanceof ApiError && err.status === 404)) {
+      secretsChecked = false;
+      secretsUncheckedReason = describeSecretsFailure(err);
+    }
+  }
   const componentsDrifted = conflicts.length > 0 || toPush.length > 0 || toPull.length > 0;
   const metaDrifted = meta.localChanged || meta.cloudChanged;
   const configDrifted = config.unsupported.length > 0 || config.machineMismatch || config.machineCloudChanged || config.defaultModelLocalChanged || config.defaultModelCloudChanged;
   const secretsDrifted = secretDrift.localOnly.length > 0 || secretDrift.cloudOnly.length > 0 || secretDrift.changed.length > 0;
+  const everythingInSync = !componentsDrifted && !metaDrifted && !configDrifted && !secretsDrifted;
+  const unchecked = secretsChecked ? [] : [{ signal: "secrets", reason: secretsUncheckedReason }];
+  if (json) {
+    emitJson({
+      linked: true,
+      manifest: true,
+      agent: { id: link2.agent_id, name: link2.name, slug: link2.slug },
+      revision: { cloud: cloud.revision, lock: lock?.revision ?? null },
+      ignored,
+      metadata: { push: meta.localChanged, pull: meta.cloudChanged },
+      runtimeConfig: {
+        unsupported: config.unsupported,
+        machineMismatch: config.machineMismatch,
+        machineCloudChanged: config.machineCloudChanged,
+        defaultModelLocalChanged: config.defaultModelLocalChanged,
+        defaultModelCloudChanged: config.defaultModelCloudChanged,
+        defaultModelConflict: config.defaultModelConflict
+      },
+      secrets: secretsChecked ? {
+        localOnly: secretDrift.localOnly,
+        cloudOnly: secretDrift.cloudOnly,
+        changed: secretDrift.changed
+      } : null,
+      components: {
+        push: toPush.map(rowJson),
+        pull: toPull.map(rowJson),
+        conflicts: conflicts.map(rowJson)
+      },
+      inSync: everythingInSync,
+      unchecked
+    });
+    return;
+  }
   const lines = [];
   lines.push("");
   lines.push(`  ${import_picocolors29.default.bold(link2.name)} ${import_picocolors29.default.dim(`(${link2.slug})`)}`);
   lines.push(`  ${import_picocolors29.default.dim("agent_id")}  ${link2.agent_id}`);
   lines.push(`  ${import_picocolors29.default.dim("revision")}  cloud ${cloud.revision}${lock ? ` · lock ${lock.revision}` : " · never pulled"}`);
   lines.push("");
+  if (ignoredBlocks.length > 0) {
+    lines.push(`  ${import_picocolors29.default.bold("ignored manifest blocks")}`);
+    for (const block of ignoredBlocks) {
+      lines.push(`    ${import_picocolors29.default.red("! ignored")}  ${import_picocolors29.default.bold(block.key)} (${block.entries}) — not synced by this CLI; ${import_picocolors29.default.cyan("agent push")} will refuse it`);
+    }
+    lines.push("");
+  }
   if (metaDrifted) {
     lines.push(`  ${import_picocolors29.default.bold("agent metadata")}`);
     if (meta.localChanged) {
@@ -65463,8 +65711,11 @@ async function runAgentStatus(cwd2) {
     }
     lines.push("");
   }
-  if (secretsDrifted) {
+  if (secretsDrifted || !secretsChecked) {
     lines.push(`  ${import_picocolors29.default.bold("secrets")}`);
+    if (!secretsChecked) {
+      lines.push(`    ${import_picocolors29.default.dim("? unchecked")}  ${secretsUncheckedReason}`);
+    }
     if (secretDrift.localOnly.length)
       lines.push(`    ${import_picocolors29.default.yellow("→ push")}  new locally: ${secretDrift.localOnly.join(", ")}`);
     if (secretDrift.changed.length)
@@ -65473,8 +65724,9 @@ async function runAgentStatus(cwd2) {
       lines.push(`    ${import_picocolors29.default.cyan("← pull")}  new on cloud: ${secretDrift.cloudOnly.join(", ")}`);
     lines.push("");
   }
-  if (!componentsDrifted && !metaDrifted && !configDrifted && !secretsDrifted) {
-    lines.push(`  ${import_picocolors29.default.green("✓")} everything is in sync`);
+  if (everythingInSync) {
+    const qualifier = secretsChecked ? "" : ` ${import_picocolors29.default.dim("(secrets not checked)")}`;
+    lines.push(`  ${import_picocolors29.default.green("✓")} everything is in sync${qualifier}`);
     lines.push("");
     console.log(lines.join(`
 `));
@@ -65503,6 +65755,26 @@ async function runAgentStatus(cwd2) {
   console.log(lines.join(`
 `));
 }
+function emitJson(report) {
+  console.log(JSON.stringify(report, null, 2));
+}
+function rowJson(r2) {
+  return { type: r2.type, slug: r2.slug, status: r2.status };
+}
+var MAX_REASON_LENGTH = 120;
+function oneLine(text2) {
+  const collapsed = text2.replace(/\s+/g, " ").trim();
+  return collapsed.length > MAX_REASON_LENGTH ? `${collapsed.slice(0, MAX_REASON_LENGTH - 1)}…` : collapsed;
+}
+function describeSecretsFailure(err) {
+  const remote = err instanceof ApiError;
+  if (remote && err.status === 401) {
+    return "could not fetch secrets: your session is invalid — run `brainbase login`";
+  }
+  const where = remote ? "could not fetch secrets from the control plane" : `could not read ${path81.join(LINK_DIR, SECRETS_FILE)}`;
+  const detail = oneLine(err instanceof Error ? err.message : typeof err === "string" ? err : "");
+  return detail ? `${where}: ${detail}` : where;
+}
 function fmtRow(r2) {
   const head3 = `${fmtType(r2.type)} ${import_picocolors29.default.bold(r2.slug)}`;
   switch (r2.status) {
@@ -65558,7 +65830,7 @@ function formatExport(shell, key2, value) {
 }
 
 // src/cli/agent-create.ts
-import path81 from "node:path";
+import path82 from "node:path";
 var import_picocolors32 = __toESM(require_picocolors(), 1);
 
 // src/ui/box.ts
@@ -65762,6 +66034,10 @@ async function runAgentCreate(cwd2, args) {
     f2.info(`If you want to detach it, run ${import_picocolors32.default.cyan("brainbase unlink")} first; or move to a different directory.`);
     return;
   }
+  if (reportUnsyncedBlocks(manifest)) {
+    process.exitCode = 1;
+    return;
+  }
   const { org, team } = await resolveOrgAndTeam({
     orgId: args.orgId,
     teamId: args.teamId,
@@ -66030,7 +66306,7 @@ async function loadOrScaffoldManifest(cwd2, args) {
       return null;
     }
   }
-  const seedName = args.name?.trim() ?? path81.basename(path81.resolve(cwd2)) ?? "My Agent";
+  const seedName = args.name?.trim() ?? path82.basename(path82.resolve(cwd2)) ?? "My Agent";
   const seedHarness = args.harness ? normalizeHarnessId(args.harness) : undefined;
   const scaffold = {
     schema: 1,
@@ -66168,7 +66444,7 @@ async function runAgent(cwd2, sub, args, opts) {
       });
       return;
     case "status":
-      await runAgentStatus(cwd2);
+      await runAgentStatus(cwd2, { json: opts.json });
       return;
     case "env":
       await runAgentEnv(cwd2, { shell: opts.shell });
@@ -66196,7 +66472,7 @@ function printHelp() {
   out.push(`  ${import_picocolors34.default.cyan("pull")} ${import_picocolors34.default.dim("[<id>]")}      ${import_picocolors34.default.dim("apply cloud changes into this folder — pass <id> to switch (--force to override); --run-entrypoint to also execute the agent entrypoint")}`);
   out.push(`  ${import_picocolors34.default.cyan("push")}               ${import_picocolors34.default.dim("send local changes to the cloud — instructions, playbooks, skills, MCPs, entrypoint (--force to overwrite cloud-side conflicts with local)")}`);
   out.push(`  ${import_picocolors34.default.cyan("unpack")}             ${import_picocolors34.default.dim("install the claimed agent into a harness layout (--harness to override)")}`);
-  out.push(`  ${import_picocolors34.default.cyan("status")}             ${import_picocolors34.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors34.default.cyan("status")}             ${import_picocolors34.default.dim("show what would push, what would pull, and which manifest blocks are ignored (--json for scripts)")}`);
   out.push(`  ${import_picocolors34.default.cyan("env")}                ${import_picocolors34.default.dim('print export statements — use with `eval "$(brainbase agent env)"`')}`);
   out.push("");
   console.log(out.join(`
@@ -66291,14 +66567,14 @@ function printHelp2() {
 var import_picocolors43 = __toESM(require_picocolors(), 1);
 
 // src/cli/orchestration-pull.ts
-import path85 from "node:path";
-import fs76 from "node:fs";
+import path86 from "node:path";
+import fs77 from "node:fs";
 var import_picocolors37 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-manifest.ts
-import path82 from "node:path";
-import fs73 from "node:fs";
-var import_yaml3 = __toESM(require_dist(), 1);
+import path83 from "node:path";
+import fs74 from "node:fs";
+var import_yaml4 = __toESM(require_dist(), 1);
 var ORCH_MANIFEST_FILE = "brainbase-orchestration.yaml";
 var ORCH_MEMBERS_DIR = "agents";
 var OrchMetaSchema = exports_external.object({
@@ -66350,19 +66626,19 @@ var OrchestrationManifestSchema = exports_external.object({
   triggers: exports_external.array(TriggerSchema).optional()
 });
 function orchManifestPath(cwd2) {
-  return path82.join(cwd2, ORCH_MANIFEST_FILE);
+  return path83.join(cwd2, ORCH_MANIFEST_FILE);
 }
 function hasOrchManifest(cwd2) {
-  return fs73.existsSync(orchManifestPath(cwd2));
+  return fs74.existsSync(orchManifestPath(cwd2));
 }
 function readOrchManifest(cwd2) {
   const p2 = orchManifestPath(cwd2);
-  if (!fs73.existsSync(p2))
+  if (!fs74.existsSync(p2))
     return null;
-  const raw = fs73.readFileSync(p2, "utf8");
+  const raw = fs74.readFileSync(p2, "utf8");
   let parsed;
   try {
-    parsed = import_yaml3.default.parse(raw);
+    parsed = import_yaml4.default.parse(raw);
   } catch (err) {
     throw new Error(`${ORCH_MANIFEST_FILE} is not valid YAML: ${err.message}`);
   }
@@ -66373,17 +66649,17 @@ function readOrchManifest(cwd2) {
   return result2.data;
 }
 function writeOrchManifest(cwd2, manifest) {
-  const doc = new import_yaml3.default.Document;
+  const doc = new import_yaml4.default.Document;
   doc.contents = manifest;
   doc.commentBefore = ` brainbase-orchestration.yaml — declarative orchestration manifest.
 ` + ` Committed to source control. Edit by hand, then
 ` + " `brainbase orchestration push`. Member agents live under ./agents/." + `
  Schedule triggers are writable. App/Pipedream triggers are preserved
 ` + " as read-only context and ignored by `orchestration push`.";
-  fs73.writeFileSync(orchManifestPath(cwd2), String(doc), "utf8");
+  fs74.writeFileSync(orchManifestPath(cwd2), String(doc), "utf8");
 }
 function memberDir(cwd2, slug) {
-  return path82.join(cwd2, ORCH_MEMBERS_DIR, slug);
+  return path83.join(cwd2, ORCH_MEMBERS_DIR, slug);
 }
 var MEMBER_SLUG_MAX = 50;
 function slugifyRaw(raw) {
@@ -66417,8 +66693,8 @@ function resolveMemberSlugs(members) {
 }
 
 // src/core/orchestration-link.ts
-import path83 from "node:path";
-import fs74 from "node:fs";
+import path84 from "node:path";
+import fs75 from "node:fs";
 var ORCH_LINK_FILE = "orchestration-link.json";
 var ORCH_SYNC_STATE_FILE = "orchestration-sync-state.json";
 var OrchestrationLinkSchema = exports_external.object({
@@ -66452,10 +66728,10 @@ var OrchestrationSyncStateSchema = exports_external.object({
   edges: exports_external.array(SyncedEdgeSchema)
 });
 function orchLinkPath(cwd2) {
-  return path83.join(cwd2, LINK_DIR, ORCH_LINK_FILE);
+  return path84.join(cwd2, LINK_DIR, ORCH_LINK_FILE);
 }
 function orchSyncStatePath(cwd2) {
-  return path83.join(cwd2, LINK_DIR, ORCH_SYNC_STATE_FILE);
+  return path84.join(cwd2, LINK_DIR, ORCH_SYNC_STATE_FILE);
 }
 function readOrchLink(cwd2) {
   const p2 = orchLinkPath(cwd2);
@@ -66468,7 +66744,7 @@ function readOrchLink(cwd2) {
   }
 }
 function writeOrchLink(cwd2, link2) {
-  ensureDir(path83.join(cwd2, LINK_DIR));
+  ensureDir(path84.join(cwd2, LINK_DIR));
   const clean = {};
   for (const [k3, v3] of Object.entries(link2)) {
     if (v3 !== null && v3 !== undefined)
@@ -66488,22 +66764,22 @@ function readOrchSyncState(cwd2) {
   }
 }
 function writeOrchSyncState(cwd2, state) {
-  ensureDir(path83.join(cwd2, LINK_DIR));
+  ensureDir(path84.join(cwd2, LINK_DIR));
   writeJson(orchSyncStatePath(cwd2), state);
   ensureGitignore2(cwd2);
 }
 function ensureGitignore2(cwd2) {
-  const ignorePath = path83.join(cwd2, LINK_DIR, ".gitignore");
+  const ignorePath = path84.join(cwd2, LINK_DIR, ".gitignore");
   const desired = `${ORCH_SYNC_STATE_FILE}
 `;
   try {
     if (!exists(ignorePath)) {
-      fs74.writeFileSync(ignorePath, desired);
+      fs75.writeFileSync(ignorePath, desired);
       return;
     }
-    const current = fs74.readFileSync(ignorePath, "utf8");
+    const current = fs75.readFileSync(ignorePath, "utf8");
     if (!current.split(/\r?\n/).some((l2) => l2.trim() === ORCH_SYNC_STATE_FILE)) {
-      fs74.writeFileSync(ignorePath, current.endsWith(`
+      fs75.writeFileSync(ignorePath, current.endsWith(`
 `) ? current + desired : current + `
 ` + desired);
     }
@@ -66511,8 +66787,8 @@ function ensureGitignore2(cwd2) {
 }
 
 // src/core/agent-fresh-install.ts
-import path84 from "node:path";
-import fs75 from "node:fs";
+import path85 from "node:path";
+import fs76 from "node:fs";
 import os15 from "node:os";
 async function installAgentFresh(input) {
   const { cwd: cwd2, agent, cloud, harness } = input;
@@ -66534,7 +66810,7 @@ async function installAgentFresh(input) {
         type: c2.type,
         slug: c2.slug,
         scope,
-        rootDir: path84.join(stageRoot, c2.type, c2.slug),
+        rootDir: path85.join(stageRoot, c2.type, c2.slug),
         description: c2.description,
         meta: c2.meta,
         payload: proxifyMcpPayload(structuredClone(c2.meta?.mcp)),
@@ -66556,7 +66832,12 @@ async function installAgentFresh(input) {
     }
     materializeInstructions2(cwd2, cloud);
     materializePlaybooks2(cwd2, cloud);
-    const manifest = input.preserveManifest ? null : buildManifestFromCloud(cloud, agent);
+    const claimedByOther = folderClaimedByOtherAgent(cwd2, agent.id);
+    const localOnly = input.preserveManifest || claimedByOther ? {} : readLocalOnlyContentReporting(cwd2);
+    if (claimedByOther) {
+      f2.warn(`${path85.basename(cwd2)} was linked to a different agent; its local-only blocks were left out of the rebuilt manifest.`);
+    }
+    const manifest = input.preserveManifest ? null : buildManifestFromCloud(cloud, agent, localOnly);
     if (manifest)
       writeManifest(cwd2, manifest);
     writeLink(cwd2, {
@@ -66590,7 +66871,7 @@ async function installAgentFresh(input) {
         ...Object.prototype.hasOwnProperty.call(agent, "default_model") ? { default_model: agent.default_model ?? null } : {}
       }
     });
-    const returnedManifest = manifest ?? buildManifestFromCloud(cloud, agent);
+    const returnedManifest = manifest ?? buildManifestFromCloud(cloud, agent, localOnly);
     return {
       installedPaths: justInstalledPaths,
       manifest: returnedManifest,
@@ -66598,19 +66879,19 @@ async function installAgentFresh(input) {
     };
   } finally {
     try {
-      fs75.rmSync(stageRoot, { recursive: true, force: true });
+      fs76.rmSync(stageRoot, { recursive: true, force: true });
     } catch {}
   }
 }
 function stageManifestComponents2(components) {
-  const root = fs75.mkdtempSync(path84.join(os15.tmpdir(), "brainbase-orch-pull-"));
+  const root = fs76.mkdtempSync(path85.join(os15.tmpdir(), "brainbase-orch-pull-"));
   for (const c2 of components) {
-    const compDir = path84.join(root, c2.type, c2.slug);
+    const compDir = path85.join(root, c2.type, c2.slug);
     ensureDir(compDir);
     for (const f4 of c2.files) {
-      const target = path84.join(compDir, f4.path);
-      ensureDir(path84.dirname(target));
-      fs75.writeFileSync(target, f4.content);
+      const target = path85.join(compDir, f4.path);
+      ensureDir(path85.dirname(target));
+      fs76.writeFileSync(target, f4.content);
     }
   }
   return root;
@@ -66643,9 +66924,9 @@ function materializeInstructions2(cwd2, cloud) {
     const body = c2.files[0]?.content ?? "";
     if (!body.trim())
       continue;
-    const target = path84.join(cwd2, DEFAULT_INSTRUCTIONS_FILE);
-    ensureDir(path84.dirname(target));
-    fs75.writeFileSync(target, normalizeInstructionBody(body), "utf8");
+    const target = path85.join(cwd2, DEFAULT_INSTRUCTIONS_FILE);
+    ensureDir(path85.dirname(target));
+    fs76.writeFileSync(target, normalizeInstructionBody(body), "utf8");
     return;
   }
 }
@@ -66657,12 +66938,12 @@ function materializePlaybooks2(cwd2, cloud) {
     if (!raw.trim())
       continue;
     const { body } = stripPlaybookFrontmatter(raw);
-    const target = path84.join(cwd2, DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`);
-    ensureDir(path84.dirname(target));
-    fs75.writeFileSync(target, body, "utf8");
+    const target = path85.join(cwd2, DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`);
+    ensureDir(path85.dirname(target));
+    fs76.writeFileSync(target, body, "utf8");
   }
 }
-function buildManifestFromCloud(cloud, agent) {
+function buildManifestFromCloud(cloud, agent, localOnly = {}) {
   const skills = cloud.components.filter((c2) => c2.type === "skill").map((c2) => {
     const meta = c2.meta ?? {};
     if (meta.name && meta.name.includes("/")) {
@@ -66701,7 +66982,7 @@ function buildManifestFromCloud(cloud, agent) {
       title,
       ...description ? { description } : {},
       ...typeof pbMeta.icon === "string" && pbMeta.icon ? { icon: pbMeta.icon } : {},
-      content: { file: path84.join(DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`) }
+      content: { file: path85.join(DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`) }
     };
   });
   const caps = capabilitiesFromAgent(agent);
@@ -66715,7 +66996,8 @@ function buildManifestFromCloud(cloud, agent) {
     },
     ...hasInstructions ? { instructions: { file: DEFAULT_INSTRUCTIONS_FILE } } : {},
     playbooks,
-    evals: [],
+    evals: localOnly.evals ?? [],
+    ...localOnly,
     skills,
     mcp,
     capabilities: {
@@ -66730,7 +67012,7 @@ function buildManifestFromCloud(cloud, agent) {
 async function pullAgentSecrets(cwd2, agentId) {
   try {
     const res = await api.getAgentSecrets(agentId);
-    const secrets = res.secrets ?? {};
+    const secrets = res.secrets;
     if (Object.keys(secrets).length > 0) {
       writeLocalSecrets(cwd2, secrets);
     }
@@ -66742,6 +67024,17 @@ async function pullAgentSecrets(cwd2, agentId) {
     return {};
   }
 }
+function folderClaimedByOtherAgent(cwd2, agentId) {
+  const claimedBy = readManifestAgentId(cwd2) ?? safeRead(() => readLink(cwd2)?.agent_id) ?? safeRead(() => readSyncState(cwd2)?.agent_id);
+  return claimedBy !== undefined && claimedBy !== agentId;
+}
+function safeRead(read) {
+  try {
+    return read();
+  } catch {
+    return;
+  }
+}
 
 // src/core/orchestration-trigger-config.ts
 function normalizeScheduleTriggerConfig(config) {
@@ -66851,7 +67144,7 @@ async function runOrchestrationPull(cwd2, args) {
     }
   }
   const fallbackHarness = args.harness ?? "claude-code";
-  fs76.mkdirSync(cwd2, { recursive: true });
+  fs77.mkdirSync(cwd2, { recursive: true });
   if (hasOrchManifest(cwd2) && existingLink && existingLink.orchestration_id !== orchId) {
     f2.error(`This folder is linked to orchestration ${existingLink.orchestration_id}, not ${orchId}. Move to a fresh directory or unlink first.`);
     return;
@@ -66947,7 +67240,7 @@ async function runOrchestrationPull(cwd2, args) {
       payload_schema: e2.payload_schema ?? {}
     }))
   });
-  $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path85.basename(cwd2)}/ ${import_picocolors37.default.dim(`(${installedMembers.length}/${cloud.members.length} members)`)}.`);
+  $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path86.basename(cwd2)}/ ${import_picocolors37.default.dim(`(${installedMembers.length}/${cloud.members.length} members)`)}.`);
 }
 function handleApiError5(err) {
   if (err instanceof ApiError) {
@@ -67029,6 +67322,34 @@ function buildOrchestrationGraphPayload(manifest, slugToAgentId) {
 }
 
 // src/cli/orchestration-push.ts
+function findUnpushableMembers(cwd2, members) {
+  const blocked = [];
+  for (const m3 of members) {
+    const dir = memberDir(cwd2, m3.slug);
+    if (!hasManifest(dir)) {
+      f2.error(`${m3.slug}: no ${AGENT_MANIFEST_FILE} in this member folder.`);
+      blocked.push(m3.slug);
+      continue;
+    }
+    let memberManifest;
+    try {
+      memberManifest = readManifest(dir);
+    } catch (err) {
+      f2.error(`${m3.slug}: ${err.message}`);
+      blocked.push(m3.slug);
+      continue;
+    }
+    if (!memberManifest.id) {
+      f2.error(`${m3.slug}: ${AGENT_MANIFEST_FILE} is unclaimed (no ${import_picocolors38.default.cyan("id")}), so there is nothing to push to.`);
+      blocked.push(m3.slug);
+      continue;
+    }
+    if (reportUnsyncedBlocks(memberManifest, { label: m3.slug })) {
+      blocked.push(m3.slug);
+    }
+  }
+  return blocked;
+}
 async function runOrchestrationPush(cwd2, args) {
   banner("orchestration push — recursively push each member, then update the graph");
   const link2 = readOrchLink(cwd2);
@@ -67064,6 +67385,7 @@ async function runOrchestrationPush(cwd2, args) {
   if (missing.length) {
     f2.error(`Missing local checkouts for: ${missing.join(", ")}.`);
     f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration pull")} to materialise the missing folders.`);
+    process.exitCode = 1;
     return;
   }
   let graph;
@@ -67074,6 +67396,14 @@ async function runOrchestrationPush(cwd2, args) {
     process.exitCode = 1;
     return;
   }
+  if (!args.graphOnly) {
+    const blockedMembers = findUnpushableMembers(cwd2, manifest.members);
+    if (blockedMembers.length > 0) {
+      f2.error(`Aborted — ${blockedMembers.join(", ")} cannot be pushed, so no member was pushed and the graph is unchanged.`);
+      process.exitCode = 1;
+      return;
+    }
+  }
   const plan = [""];
   plan.push(`  ${import_picocolors38.default.bold(link2.name)} ${import_picocolors38.default.dim(`(${link2.orchestration_id})`)}`);
   plan.push(`  ${import_picocolors38.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
@@ -67102,6 +67432,7 @@ async function runOrchestrationPush(cwd2, args) {
       const dir = memberDir(cwd2, m3.slug);
       console.log("");
       console.log(`${import_picocolors38.default.dim("───")} ${import_picocolors38.default.bold(m3.slug)} ${import_picocolors38.default.dim("───")}`);
+      const exitCodeBeforePush = process.exitCode;
       try {
         await runAgentPush(dir, { yes: true });
       } catch (err) {
@@ -67109,6 +67440,11 @@ async function runOrchestrationPush(cwd2, args) {
         process.exitCode = 1;
         return;
       }
+      if (process.exitCode !== exitCodeBeforePush) {
+        f2.error(`Aborted — ${m3.slug} was not pushed, so the graph is left unchanged.`);
+        process.exitCode = 1;
+        return;
+      }
     }
   }
   const sp = de();
@@ -67374,7 +67710,7 @@ async function runOrchestrationList(args) {
 }
 
 // src/cli/orchestration-add-agent.ts
-import fs77 from "node:fs";
+import fs78 from "node:fs";
 var import_picocolors41 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-add.ts
@@ -67460,10 +67796,10 @@ async function runOrchestrationAddAgent(cwd2, args) {
     })).trim();
   }
   let slug = slugifyMemberName(name);
-  if (manifest.members.some((m3) => m3.slug === slug) || fs77.existsSync(memberDir(cwd2, slug))) {
+  if (manifest.members.some((m3) => m3.slug === slug) || fs78.existsSync(memberDir(cwd2, slug))) {
     let n = 2;
     let candidate = `${slug}-${n}`;
-    while (manifest.members.some((m3) => m3.slug === candidate) || fs77.existsSync(memberDir(cwd2, candidate))) {
+    while (manifest.members.some((m3) => m3.slug === candidate) || fs78.existsSync(memberDir(cwd2, candidate))) {
       candidate = `${slug}-${++n}`;
     }
     f2.info(`Slug ${import_picocolors41.default.bold(slug)} is taken — using ${import_picocolors41.default.bold(candidate)}.`);
@@ -67535,7 +67871,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   }
   const dest = memberDir(cwd2, slug);
   try {
-    fs77.mkdirSync(dest, { recursive: true });
+    fs78.mkdirSync(dest, { recursive: true });
     await runAgentCreate(dest, {
       name,
       orgId,
@@ -67546,7 +67882,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
     });
   } catch (err) {
     try {
-      fs77.rmSync(dest, { recursive: true, force: true });
+      fs78.rmSync(dest, { recursive: true, force: true });
     } catch {}
     f2.error(`Failed to create ${slug}: ${err.message}`);
     return;
@@ -68234,10 +68570,13 @@ function TokenListCard(props) {
       ]
     }, undefined, true, undefined, this);
   }
+  const liveCount = props.active.filter((t) => !t.expired).length;
+  const expiredCount = props.active.length - liveCount;
+  const subtitle = expiredCount ? `${liveCount} active, ${expiredCount} expired` : `${liveCount} active`;
   return /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Card, {
     title: "TOKENS",
     tone: "info",
-    subtitle: `${props.active.length} active`,
+    subtitle,
     children: [
       /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Box_default, {
         flexDirection: "column",
@@ -68249,8 +68588,17 @@ function TokenListCard(props) {
               children: [
                 /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Text, {
                   bold: true,
+                  dimColor: t.expired,
                   children: t.name
                 }, undefined, false, undefined, this),
+                t.expired && /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Box_default, {
+                  marginLeft: 1,
+                  children: /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Badge, {
+                    tone: "warn",
+                    outline: true,
+                    children: "expired"
+                  }, undefined, false, undefined, this)
+                }, undefined, false, undefined, this),
                 t.isThisCli && /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Box_default, {
                   marginLeft: 1,
                   children: /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Badge, {
@@ -68335,11 +68683,18 @@ function TokenListCard(props) {
       }, undefined, true, undefined, this),
       /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Box_default, {
         marginTop: 1,
-        children: /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Text, {
-          dimColor: true,
-          children: "› brainbase token revoke <id>"
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this)
+        flexDirection: "column",
+        children: [
+          /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Text, {
+            dimColor: true,
+            children: "› brainbase token rename <id> --name <label>"
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Text, {
+            dimColor: true,
+            children: "› brainbase token revoke <id>"
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this)
     ]
   }, undefined, true, undefined, this);
 }
@@ -68351,6 +68706,16 @@ async function showTokenListCard(props) {
 
 // src/cli/token.ts
 var DEFAULT_SCOPES = ["read", "publish"];
+var MAX_NAME_LENGTH = 128;
+function isExpired2(token) {
+  return Boolean(token.expires_at && Date.parse(token.expires_at) <= Date.now());
+}
+function withLoginHint(error) {
+  if (error instanceof ApiError && error.status === 403) {
+    return new Error("Managing tokens needs a logged-in session; a PAT (BRAINBASE_TOKEN) cannot. " + "Run `brainbase login` and try again.");
+  }
+  return error;
+}
 async function runTokenCreate(args) {
   banner("token create — make a long-lived CLI key");
   let name = args.name;
@@ -68370,7 +68735,15 @@ async function runTokenCreate(args) {
     scopes
   });
   spinner.stop("Token created.");
-  writeToken(created.token, name);
+  try {
+    writeToken(created.token, name);
+  } catch (error) {
+    throw new Error(`Created token ${created.id}, but could not save it locally: ${error.message}
+` + `This is the only time it is shown — copy it now:
+
+  ${created.token}
+`);
+  }
   await showTokenCreatedCard({
     token: created.token,
     id: created.id,
@@ -68392,30 +68765,147 @@ async function runTokenList() {
       prefix: t.prefix,
       scopes: t.scopes,
       lastUsed: t.last_used_at ?? null,
-      isThisCli: !!(local && local.token.startsWith(t.prefix))
+      isThisCli: !!(local && local.token.startsWith(t.prefix)),
+      expired: isExpired2(t)
     })),
     revokedCount: revoked.length
   });
 }
+async function runTokenRename(args) {
+  if (!args.id) {
+    throw new Error("Usage: brainbase token rename <id> --name <label>");
+  }
+  banner("token rename — relabel a CLI key");
+  let tokens;
+  try {
+    tokens = await registryApi.listCliTokens();
+  } catch (error) {
+    throw withLoginHint(error);
+  }
+  const target = tokens.find((t) => t.id === args.id);
+  if (!target) {
+    throw new Error(`No token with id ${args.id}. Run \`brainbase token list\` to see yours.`);
+  }
+  if (target.revoked_at) {
+    throw new Error(`Token ${args.id} is revoked, and revoked tokens cannot be renamed.`);
+  }
+  if (isExpired2(target)) {
+    throw new Error(`Token ${args.id} expired on ${target.expires_at}, and expired tokens cannot be renamed.`);
+  }
+  const takenBy = new Map;
+  for (const t of tokens) {
+    if (t.revoked_at || isExpired2(t) || t.id === target.id)
+      continue;
+    takenBy.set(t.name.trim().toLowerCase(), t);
+  }
+  const validate2 = (value) => {
+    const candidate = value.trim();
+    if (!candidate)
+      return "Required.";
+    if (candidate.length > MAX_NAME_LENGTH) {
+      return `Too long — keep the label to ${MAX_NAME_LENGTH} characters or fewer.`;
+    }
+    const clash = takenBy.get(candidate.toLowerCase());
+    if (clash) {
+      return `Token ${clash.id} already uses the label "${clash.name}". Labels are how \`token list\` tells keys apart, so pick a different one.`;
+    }
+    return;
+  };
+  let name;
+  if (args.name === undefined) {
+    const answer = await text({
+      message: "New label",
+      placeholder: target.name,
+      validate: validate2,
+      flagHint: "Pass --name <label>."
+    });
+    name = answer.trim();
+  } else {
+    name = args.name.trim();
+    const problem = validate2(name);
+    if (problem) {
+      throw new Error(name ? problem : "--name cannot be blank.");
+    }
+  }
+  if (name === target.name.trim()) {
+    console.log(`${sym.ok} ${import_picocolors45.default.bold(target.name.trim())} already has that label; nothing to do.`);
+    return;
+  }
+  try {
+    await registryApi.renameCliToken(target.id, name);
+  } catch (error) {
+    throw withLoginHint(error);
+  }
+  console.log(`${sym.ok} Renamed ${import_picocolors45.default.dim(target.name)} → ${import_picocolors45.default.bold(name)}`);
+}
 async function runTokenRevoke(args) {
   if (!args.id) {
     console.error("Usage: brainbase token revoke <id>");
     process.exit(1);
   }
+  const tokens = await registryApi.listCliTokens();
+  const target = tokens.find((t) => t.id === args.id);
+  if (!target) {
+    throw new Error(`No token with id ${args.id}. Run \`brainbase token list\` to see yours.`);
+  }
+  if (target.revoked_at) {
+    reconcileDeadToken(target, `${import_picocolors45.default.bold(target.name)} is already revoked.`);
+    return;
+  }
+  const stored = readToken();
+  const isLocalToken = Boolean(stored && stored.token.startsWith(target.prefix));
   if (!autoProceed(args.yes)) {
     const ok = await se({
-      message: `Revoke token ${import_picocolors45.default.bold(args.id)}? CIs and machines using it will stop working.`,
+      message: isLocalToken ? `Revoke ${import_picocolors45.default.bold(target.name)} (${args.id})? This is the token this CLI is using, so it will stop working here too.` : `Revoke ${import_picocolors45.default.bold(target.name)} (${args.id})? CIs and machines using it will stop working.`,
       initialValue: false
     });
     if (!ensureNotCancelled(ok))
       return;
   }
-  await registryApi.revokeCliToken(args.id);
-  const local = readToken();
-  if (local) {
-    clearToken();
+  try {
+    await registryApi.revokeCliToken(args.id);
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 404) {
+      const expiryPassed = Boolean(target.expires_at && Date.parse(target.expires_at) <= Date.now());
+      if (expiryPassed) {
+        reconcileDeadToken(target, `${import_picocolors45.default.bold(target.name)} had already expired.`);
+        return;
+      }
+      throw new Error(`The server reported no active token with id ${args.id}, but it listed one a moment ago. ` + "The local token has been left alone, since that key may still work. " + "If this server predates `DELETE /v1/registry/cli-tokens/{id}`, revoke from the web app instead.");
+    }
+    throw error;
+  }
+  reconcileDeadToken(target, `Revoked ${import_picocolors45.default.bold(target.name)}.`);
+}
+function reconcileDeadToken(target, headline) {
+  let outcome;
+  try {
+    outcome = clearTokenIfMatches(target.prefix);
+  } catch (error) {
+    throw new Error(`${headline} That key is dead server-side, but the local token could not be ` + `cleared: ${error.message}
+` + "Run `brainbase token clear` to remove it.");
+  }
+  reportLocalToken(headline, outcome);
+}
+function reportLocalToken(headline, outcome) {
+  switch (outcome) {
+    case "cleared":
+      console.log(`${sym.ok} ${headline} Cleared the local token too.`);
+      return;
+    case "kept":
+      console.log(`${sym.ok} ${headline} The local token is a different key and is untouched.`);
+      return;
+    case "absent":
+      console.log(`${sym.ok} ${headline}`);
+      return;
+    case "unverifiable":
+      console.log(`${sym.ok} ${headline} Left the local token alone.`);
+      return;
+    default: {
+      const exhaustive = outcome;
+      throw new Error(`unhandled outcome: ${String(exhaustive)}`);
+    }
   }
-  console.log(`${sym.ok} Revoked.`);
 }
 async function runTokenClear() {
   if (!readToken()) {
@@ -68433,22 +68923,45 @@ function pickFlag(rest2, ...names) {
   }
   return;
 }
+function firstPositional(rest2, ...valueFlags) {
+  const consumesValue = new Set(valueFlags);
+  for (let i = 0;i < rest2.length; i++) {
+    const arg = rest2[i];
+    if (consumesValue.has(arg)) {
+      i++;
+      continue;
+    }
+    if (arg.startsWith("-"))
+      continue;
+    return arg;
+  }
+  return;
+}
 function parseScopes(raw) {
   if (!raw)
     return;
   return raw.split(",").map((s3) => s3.trim()).filter((s3) => s3.length > 0);
 }
 async function runToken(sub, rest2, args) {
+  const nameFlag = args.name || pickFlag(rest2, "--name", "-n");
   switch (sub) {
     case "create":
     case "new": {
-      const name = pickFlag(rest2, "--name", "-n");
       const scopes = parseScopes(pickFlag(rest2, "--scope", "--scopes"));
-      return runTokenCreate({ name, scopes });
+      return runTokenCreate({ name: nameFlag, scopes });
     }
     case "list":
     case "ls":
       return runTokenList();
+    case "rename": {
+      if (pickFlag(rest2, "--scope", "--scopes") !== undefined) {
+        throw new Error("token rename only changes the label; a token's scopes are fixed when it is created. " + "Mint a replacement with `brainbase token create --scopes <list>`.");
+      }
+      return runTokenRename({
+        id: firstPositional(rest2, "--name", "-n") ?? "",
+        name: nameFlag
+      });
+    }
     case "revoke":
     case "rm":
       return runTokenRevoke({ id: rest2[0] ?? "", yes: args.yes });
@@ -68473,7 +68986,8 @@ function printTokenHelp() {
   out.push(`  ${import_picocolors45.default.bold("brainbase token")} ${import_picocolors45.default.dim("<command>")}`);
   out.push("");
   out.push(`  ${import_picocolors45.default.cyan("create")}                        ${import_picocolors45.default.dim("issue a new long-lived CLI key (PAT)")}`);
-  out.push(`  ${import_picocolors45.default.cyan("list")}                          ${import_picocolors45.default.dim("show your active tokens")}`);
+  out.push(`  ${import_picocolors45.default.cyan("list")}                          ${import_picocolors45.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors45.default.cyan("rename")} ${import_picocolors45.default.dim("<id>")}                  ${import_picocolors45.default.dim("relabel a token by id")}`);
   out.push(`  ${import_picocolors45.default.cyan("revoke")} ${import_picocolors45.default.dim("<id>")}                  ${import_picocolors45.default.dim("revoke a token by id")}`);
   out.push(`  ${import_picocolors45.default.cyan("clear")}                         ${import_picocolors45.default.dim("forget the local token (does not revoke)")}`);
   out.push("");
@@ -68482,6 +68996,9 @@ function printTokenHelp() {
   out.push(`  ${import_picocolors45.default.cyan("--scopes")} ${import_picocolors45.default.dim("<list>")}           ${import_picocolors45.default.dim("comma-separated; allowed: read, publish, admin")}`);
   out.push(`                                ${import_picocolors45.default.dim("default: read,publish")}`);
   out.push("");
+  out.push(`  ${import_picocolors45.default.bold("rename flags")}`);
+  out.push(`  ${import_picocolors45.default.cyan("--name, -n")} ${import_picocolors45.default.dim("<label>")}        ${import_picocolors45.default.dim("new label (prompted if omitted)")}`);
+  out.push("");
   console.log(out.join(`
 `));
 }
@@ -68490,8 +69007,8 @@ function printTokenHelp() {
 var import_picocolors46 = __toESM(require_picocolors(), 1);
 
 // src/core/mcp-check/collect-servers.ts
-import path86 from "node:path";
-import fs78 from "node:fs";
+import path87 from "node:path";
+import fs79 from "node:fs";
 function collectServers(cwd2, env3 = process.env) {
   const out = [];
   const seen = new Set;
@@ -68542,10 +69059,10 @@ function pushResolved(out, seen, name, entry, env3) {
   out.push({ name, url: finalUrl, headers });
 }
 function* readResolvedMcps(cwd2) {
-  const p2 = path86.join(cwd2, ".brainbase", "resolved-mcps.json");
+  const p2 = path87.join(cwd2, ".brainbase", "resolved-mcps.json");
   let raw;
   try {
-    raw = fs78.readFileSync(p2, "utf-8");
+    raw = fs79.readFileSync(p2, "utf-8");
   } catch {
     return;
   }
@@ -68569,12 +69086,12 @@ function* readResolvedMcps(cwd2) {
   }
 }
 function readClaudeCode(cwd2) {
-  const file = path86.join(cwd2, ".mcp.json");
+  const file = path87.join(cwd2, ".mcp.json");
   const map2 = listMcpServersFromMcpJson(file);
   return Object.entries(map2);
 }
 function readCodex(cwd2) {
-  const file = path86.join(cwd2, ".codex", "config.toml");
+  const file = path87.join(cwd2, ".codex", "config.toml");
   try {
     return Object.entries(listMcpServers2(file));
   } catch {
@@ -68582,7 +69099,7 @@ function readCodex(cwd2) {
   }
 }
 function readKafka(cwd2) {
-  const file = path86.join(cwd2, ".kafka", "kafka.json");
+  const file = path87.join(cwd2, ".kafka", "kafka.json");
   try {
     return Object.entries(listMcpServers3(file));
   } catch {
@@ -68861,10 +69378,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path87) {
-  if (!path87)
+function getElementAtPath(obj, path88) {
+  if (!path88)
     return obj;
-  return path87.reduce((acc, key2) => acc?.[key2], obj);
+  return path88.reduce((acc, key2) => acc?.[key2], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys2 = Object.keys(promisesObj);
@@ -69180,11 +69697,11 @@ function aborted(x3, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path87, issues) {
+function prefixIssues(path88, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path87);
+    iss.path.unshift(path88);
     return iss;
   });
 }
@@ -77078,9 +77595,9 @@ import {
   spawn as spawn5
 } from "node:child_process";
 import crypto7 from "node:crypto";
-import fs80 from "node:fs";
+import fs81 from "node:fs";
 import os17 from "node:os";
-import path88 from "node:path";
+import path89 from "node:path";
 
 // src/core/benchmark-phase.ts
 import {
@@ -77088,9 +77605,9 @@ import {
   spawn as spawn4
 } from "node:child_process";
 import crypto6 from "node:crypto";
-import fs79 from "node:fs";
+import fs80 from "node:fs";
 import os16 from "node:os";
-import path87 from "node:path";
+import path88 from "node:path";
 import { pipeline as pipeline2 } from "node:stream/promises";
 var SCHEMA_VERSION = "1";
 var SHA256_RE = /^[a-f0-9]{64}$/i;
@@ -77115,7 +77632,7 @@ var BASE_ENV_NAMES = [
   "USER"
 ];
 var SENSITIVE_ENV_NAME_RE = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|ACCESS_KEY|PAT|CREDENTIAL)(?:$|_)|^(?:PGPASSWORD|DATABASE_URL|REDIS_URL|MONGODB_URI)$/i;
-var AbsolutePathSchema = exports_external.string().min(1).refine(path87.isAbsolute, {
+var AbsolutePathSchema = exports_external.string().min(1).refine(path88.isAbsolute, {
   message: "must be an absolute path"
 });
 var Sha256Schema = exports_external.string().regex(SHA256_RE).transform((value) => value.toLowerCase());
@@ -77331,35 +77848,35 @@ function normalizedRootRelative(input) {
   return safeRelPath(input);
 }
 function isWithin(root, candidate) {
-  const relative = path87.relative(path87.resolve(root), path87.resolve(candidate));
-  return relative === "" || !relative.startsWith("..") && !path87.isAbsolute(relative);
+  const relative = path88.relative(path88.resolve(root), path88.resolve(candidate));
+  return relative === "" || !relative.startsWith("..") && !path88.isAbsolute(relative);
 }
 function canonicalFuturePath(input) {
-  const resolved = path87.resolve(input);
+  const resolved = path88.resolve(input);
   const suffix = [];
   let current = resolved;
-  while (!fs79.existsSync(current)) {
-    const parent = path87.dirname(current);
+  while (!fs80.existsSync(current)) {
+    const parent = path88.dirname(current);
     if (parent === current)
       break;
-    suffix.unshift(path87.basename(current));
+    suffix.unshift(path88.basename(current));
     current = parent;
   }
-  const canonicalBase = fs79.realpathSync(current);
-  return path87.join(canonicalBase, ...suffix);
+  const canonicalBase = fs80.realpathSync(current);
+  return path88.join(canonicalBase, ...suffix);
 }
 function validateRoots(spec) {
-  const workspace = path87.resolve(spec.workspace_root);
-  if (!fs79.existsSync(workspace) || fs79.lstatSync(workspace).isSymbolicLink() || !fs79.lstatSync(workspace).isDirectory()) {
+  const workspace = path88.resolve(spec.workspace_root);
+  if (!fs80.existsSync(workspace) || fs80.lstatSync(workspace).isSymbolicLink() || !fs80.lstatSync(workspace).isDirectory()) {
     throw new BenchmarkPhaseError("invalid_workspace_root", "workspace_root must be an existing real directory");
   }
   const canonicalWorkspace = canonicalFuturePath(workspace);
-  const staging = path87.resolve(spec.staging_root);
-  const expectedStaging = path87.join(workspace, ".brainbase", "benchmark", spec.attempt_id, "incoming");
+  const staging = path88.resolve(spec.staging_root);
+  const expectedStaging = path88.join(workspace, ".brainbase", "benchmark", spec.attempt_id, "incoming");
   if (staging !== expectedStaging) {
     throw new BenchmarkPhaseError("invalid_staging_root", `staging_root must be ${expectedStaging}`);
   }
-  if (!fs79.existsSync(staging) || fs79.lstatSync(staging).isSymbolicLink() || !fs79.lstatSync(staging).isDirectory() || fs79.realpathSync(staging) !== path87.join(canonicalWorkspace, ".brainbase", "benchmark", spec.attempt_id, "incoming")) {
+  if (!fs80.existsSync(staging) || fs80.lstatSync(staging).isSymbolicLink() || !fs80.lstatSync(staging).isDirectory() || fs80.realpathSync(staging) !== path88.join(canonicalWorkspace, ".brainbase", "benchmark", spec.attempt_id, "incoming")) {
     throw new BenchmarkPhaseError("invalid_staging_root", "staging_root must be a real directory under workspace_root");
   }
   const canonicalLogs = validateExternalRoot("logs_root", spec.logs_root, canonicalWorkspace);
@@ -77371,11 +77888,11 @@ function validateRoots(spec) {
   }
 }
 function validateExternalRoot(label, input, canonicalWorkspace) {
-  const candidate = path87.resolve(input);
-  if (candidate === path87.parse(candidate).root) {
+  const candidate = path88.resolve(input);
+  if (candidate === path88.parse(candidate).root) {
     throw new BenchmarkPhaseError(`invalid_${label}`, `${label} cannot be a filesystem root`);
   }
-  if (fs79.existsSync(candidate) && fs79.lstatSync(candidate).isSymbolicLink()) {
+  if (fs80.existsSync(candidate) && fs80.lstatSync(candidate).isSymbolicLink()) {
     throw new BenchmarkPhaseError(`invalid_${label}`, `${label} cannot be a symlink`);
   }
   const canonicalCandidate = canonicalFuturePath(candidate);
@@ -77402,12 +77919,12 @@ function assertNoSymlinkTraversal(root, relative) {
   const rel = normalizedRootRelative(relative);
   if (rel === ".")
     return;
-  let current = path87.resolve(root);
+  let current = path88.resolve(root);
   for (const segment of rel.split("/").slice(0, -1)) {
-    current = path87.join(current, segment);
-    if (!fs79.existsSync(current))
+    current = path88.join(current, segment);
+    if (!fs80.existsSync(current))
       continue;
-    if (fs79.lstatSync(current).isSymbolicLink()) {
+    if (fs80.lstatSync(current).isSymbolicLink()) {
       throw new BenchmarkPhaseError("unsafe_path", `path traverses symlink: ${relative}`);
     }
   }
@@ -77417,9 +77934,9 @@ function assertOpenedFileWithinRoot(root, filePath, openedStat, label) {
   let canonicalFile;
   let currentStat;
   try {
-    canonicalRoot = fs79.realpathSync(root);
-    canonicalFile = fs79.realpathSync(filePath);
-    currentStat = fs79.statSync(filePath);
+    canonicalRoot = fs80.realpathSync(root);
+    canonicalFile = fs80.realpathSync(filePath);
+    currentStat = fs80.statSync(filePath);
   } catch {
     throw new BenchmarkPhaseError("unsafe_path", `${label} changed while it was opened`);
   }
@@ -77428,10 +77945,10 @@ function assertOpenedFileWithinRoot(root, filePath, openedStat, label) {
   }
 }
 function openRegularFileNoFollow(filePath, label, root) {
-  const noFollow = typeof fs79.constants.O_NOFOLLOW === "number" ? fs79.constants.O_NOFOLLOW : 0;
+  const noFollow = typeof fs80.constants.O_NOFOLLOW === "number" ? fs80.constants.O_NOFOLLOW : 0;
   let fd;
   try {
-    fd = fs79.openSync(filePath, fs79.constants.O_RDONLY | noFollow);
+    fd = fs80.openSync(filePath, fs80.constants.O_RDONLY | noFollow);
   } catch (error2) {
     const code = error2.code;
     if (code === "ELOOP") {
@@ -77439,16 +77956,16 @@ function openRegularFileNoFollow(filePath, label, root) {
     }
     throw error2;
   }
-  const stat = fs79.fstatSync(fd);
+  const stat = fs80.fstatSync(fd);
   if (!stat.isFile()) {
-    fs79.closeSync(fd);
+    fs80.closeSync(fd);
     throw new BenchmarkPhaseError("invalid_input", `${label} must be a regular file`);
   }
   if (root) {
     try {
       assertOpenedFileWithinRoot(root, filePath, stat, label);
     } catch (error2) {
-      fs79.closeSync(fd);
+      fs80.closeSync(fd);
       throw error2;
     }
   }
@@ -77456,7 +77973,7 @@ function openRegularFileNoFollow(filePath, label, root) {
 }
 async function sha256OfDescriptor(fd) {
   const hash = crypto6.createHash("sha256");
-  const stream = fs79.createReadStream("", {
+  const stream = fs80.createReadStream("", {
     fd,
     autoClose: false,
     start: 0
@@ -77467,19 +77984,19 @@ async function sha256OfDescriptor(fd) {
   return hash.digest("hex");
 }
 function readDescriptor(fd) {
-  return fs79.readFileSync(fd);
+  return fs80.readFileSync(fd);
 }
 function assertWritableDestination(root, relative) {
   const rel = normalizedRootRelative(relative);
   if (rel === ".")
     return;
-  let current = path87.resolve(root);
+  let current = path88.resolve(root);
   const segments = rel.split("/");
   for (const segment of segments.slice(0, -1)) {
-    current = path87.join(current, segment);
-    if (!fs79.existsSync(current))
+    current = path88.join(current, segment);
+    if (!fs80.existsSync(current))
       continue;
-    const stat = fs79.lstatSync(current);
+    const stat = fs80.lstatSync(current);
     if (stat.isSymbolicLink()) {
       throw new BenchmarkPhaseError("unsafe_path", `path traverses symlink: ${relative}`);
     }
@@ -77487,8 +78004,8 @@ function assertWritableDestination(root, relative) {
       throw new BenchmarkPhaseError("destination_conflict", `destination parent is not a directory: ${relative}`);
     }
   }
-  const destination = path87.resolve(root, rel);
-  if (fs79.existsSync(destination) && fs79.lstatSync(destination).isDirectory()) {
+  const destination = path88.resolve(root, rel);
+  if (fs80.existsSync(destination) && fs80.lstatSync(destination).isDirectory()) {
     throw new BenchmarkPhaseError("destination_conflict", `file destination is an existing directory: ${relative}`);
   }
 }
@@ -77513,14 +78030,14 @@ function validateDestinationGraph(paths) {
 }
 function sourcePath(stagingRoot, relative) {
   const rel = safeRelPath(relative);
-  const source = path87.resolve(stagingRoot, rel);
+  const source = path88.resolve(stagingRoot, rel);
   if (!isWithin(stagingRoot, source)) {
     throw new BenchmarkPhaseError("unsafe_path", `source escapes staging root: ${relative}`);
   }
   assertNoSymlinkTraversal(stagingRoot, rel);
   let stat;
   try {
-    stat = fs79.lstatSync(source);
+    stat = fs80.lstatSync(source);
   } catch {
     throw new BenchmarkPhaseError("missing_input", `staged input does not exist: ${relative}`);
   }
@@ -77548,13 +78065,13 @@ async function verifyRecordsUnchanged(records, spec) {
     }
     const relative = safeRelPath(record3.path);
     assertNoSymlinkTraversal(root, relative);
-    const candidate = path87.resolve(root, relative);
-    if (!isWithin(root, candidate) || !fs79.existsSync(candidate)) {
+    const candidate = path88.resolve(root, relative);
+    if (!isWithin(root, candidate) || !fs80.existsSync(candidate)) {
       throw new BenchmarkPhaseError("evidence_tampered", `evidence was removed during evaluation: ${record3.root}:${record3.path}`);
     }
-    const stat = fs79.lstatSync(candidate);
+    const stat = fs80.lstatSync(candidate);
     if (record3.kind === "symlink") {
-      const target = stat.isSymbolicLink() ? fs79.readlinkSync(candidate) : null;
+      const target = stat.isSymbolicLink() ? fs80.readlinkSync(candidate) : null;
       if (target === null || Buffer.byteLength(target) !== record3.size || sha256(target) !== record3.sha256) {
         throw new BenchmarkPhaseError("evidence_tampered", `evidence changed during evaluation: ${record3.root}:${record3.path}`);
       }
@@ -77569,7 +78086,7 @@ async function verifyRecordsUnchanged(records, spec) {
         throw new BenchmarkPhaseError("evidence_tampered", `evidence changed during evaluation: ${record3.root}:${record3.path}`);
       }
     } finally {
-      fs79.closeSync(opened.fd);
+      fs80.closeSync(opened.fd);
     }
   }
 }
@@ -77585,35 +78102,35 @@ async function verifyInput(stagingRoot, material) {
       throw new BenchmarkPhaseError("digest_mismatch", `checksum mismatch for ${material.source}`, { expected: material.sha256, actual });
     }
   } finally {
-    fs79.closeSync(opened.fd);
+    fs80.closeSync(opened.fd);
   }
   return source;
 }
 async function atomicCopy(source, destination, mode, sourceRoot) {
-  fs79.mkdirSync(path87.dirname(destination), { recursive: true });
+  fs80.mkdirSync(path88.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   const opened = openRegularFileNoFollow(source, `copy source ${source}`, sourceRoot);
   try {
-    await pipeline2(fs79.createReadStream("", {
+    await pipeline2(fs80.createReadStream("", {
       fd: opened.fd,
       autoClose: false,
       start: 0
-    }), fs79.createWriteStream(temporary, {
+    }), fs80.createWriteStream(temporary, {
       flags: "wx",
       mode: 384
     }));
-    fs79.chmodSync(temporary, mode ?? opened.stat.mode & 511);
-    fs79.renameSync(temporary, destination);
+    fs80.chmodSync(temporary, mode ?? opened.stat.mode & 511);
+    fs80.renameSync(temporary, destination);
   } finally {
-    fs79.closeSync(opened.fd);
-    fs79.rmSync(temporary, { force: true });
+    fs80.closeSync(opened.fd);
+    fs80.rmSync(temporary, { force: true });
   }
 }
 async function recordFile(root, filePath, rootName, kind = "file") {
-  const relative = path87.relative(root, filePath).replace(/\\/g, "/");
+  const relative = path88.relative(root, filePath).replace(/\\/g, "/");
   if (kind === "symlink") {
-    const stat = fs79.lstatSync(filePath);
-    const target = fs79.readlinkSync(filePath);
+    const stat = fs80.lstatSync(filePath);
+    const target = fs80.readlinkSync(filePath);
     return {
       root: rootName,
       path: relative,
@@ -77633,7 +78150,7 @@ async function recordFile(root, filePath, rootName, kind = "file") {
       mode: opened.stat.mode & 511
     };
   } finally {
-    fs79.closeSync(opened.fd);
+    fs80.closeSync(opened.fd);
   }
 }
 async function copyMaterial(material, sourceRoot, destinationRoot, destinationRootName, protectWorkspace) {
@@ -77647,7 +78164,7 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
       throw new BenchmarkPhaseError("unsafe_path", "file destination cannot be a directory root");
     }
     assertWritableDestination(destinationRoot, destinationRel);
-    const destination = path87.resolve(destinationRoot, destinationRel);
+    const destination = path88.resolve(destinationRoot, destinationRel);
     await atomicCopy(source, destination, material.mode, sourceRoot);
     const record3 = await recordFile(destinationRoot, destination, destinationRootName);
     if (record3.sha256 !== material.sha256 || record3.size !== material.size_bytes) {
@@ -77655,15 +78172,15 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     }
     return [record3];
   }
-  const temporary = fs79.mkdtempSync(path87.join(os16.tmpdir(), "brainbase-benchmark-"));
+  const temporary = fs80.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-"));
   try {
-    const verifiedArchive = path87.join(temporary, "material.tar.gz");
+    const verifiedArchive = path88.join(temporary, "material.tar.gz");
     await atomicCopy(source, verifiedArchive, 384, sourceRoot);
     const archiveRecord = await recordFile(temporary, verifiedArchive, "staging");
     if (archiveRecord.sha256 !== material.sha256 || archiveRecord.size !== material.size_bytes) {
       throw new BenchmarkPhaseError("evidence_tampered", `material changed while it was copied: ${material.source}`);
     }
-    const extractedRoot = path87.join(temporary, "extracted");
+    const extractedRoot = path88.join(temporary, "extracted");
     const extracted = await extract({
       tarFile: verifiedArchive,
       outDir: extractedRoot,
@@ -77672,23 +78189,23 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     });
     const outputs = [];
     for (const extractedRel of extracted.sort()) {
-      const sourceFile = path87.resolve(extractedRoot, safeRelPath(extractedRel));
-      const stat = fs79.lstatSync(sourceFile);
+      const sourceFile = path88.resolve(extractedRoot, safeRelPath(extractedRel));
+      const stat = fs80.lstatSync(sourceFile);
       if (!stat.isFile())
         continue;
-      const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path87.posix.join(destinationRel, extractedRel));
+      const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path88.posix.join(destinationRel, extractedRel));
       const checked = protectWorkspace ? workspaceRel(combined) : combined;
       if (!protectWorkspace && checked.toLowerCase() === ".brainbase-benchmark-owner.json") {
         throw new BenchmarkPhaseError("reserved_path", "benchmark input cannot replace the phase ownership marker");
       }
       assertWritableDestination(destinationRoot, checked);
-      const destination = path87.resolve(destinationRoot, checked);
+      const destination = path88.resolve(destinationRoot, checked);
       await atomicCopy(sourceFile, destination, material.mode, extractedRoot);
       outputs.push(await recordFile(destinationRoot, destination, destinationRootName));
     }
     return outputs;
   } finally {
-    fs79.rmSync(temporary, { recursive: true, force: true });
+    fs80.rmSync(temporary, { recursive: true, force: true });
   }
 }
 async function preflightMaterial(material, sourceRoot, destinationRoot, protectWorkspace) {
@@ -77704,15 +78221,15 @@ async function preflightMaterial(material, sourceRoot, destinationRoot, protectW
     assertWritableDestination(destinationRoot, destinationRel);
     return [destinationRel];
   }
-  const temporary = fs79.mkdtempSync(path87.join(os16.tmpdir(), "brainbase-benchmark-preflight-"));
+  const temporary = fs80.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-preflight-"));
   try {
-    const verifiedArchive = path87.join(temporary, "material.tar.gz");
+    const verifiedArchive = path88.join(temporary, "material.tar.gz");
     await atomicCopy(source, verifiedArchive, 384, sourceRoot);
     const archiveRecord = await recordFile(temporary, verifiedArchive, "staging");
     if (archiveRecord.sha256 !== material.sha256 || archiveRecord.size !== material.size_bytes) {
       throw new BenchmarkPhaseError("evidence_tampered", `material changed while it was copied: ${material.source}`);
     }
-    const extractedRoot = path87.join(temporary, "extracted");
+    const extractedRoot = path88.join(temporary, "extracted");
     const extracted = await extract({
       tarFile: verifiedArchive,
       outDir: extractedRoot,
@@ -77721,7 +78238,7 @@ async function preflightMaterial(material, sourceRoot, destinationRoot, protectW
     });
     const planned = [];
     for (const extractedRel of extracted) {
-      const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path87.posix.join(destinationRel, extractedRel));
+      const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path88.posix.join(destinationRel, extractedRel));
       const checked = protectWorkspace ? workspaceRel(combined) : combined;
       if (!protectWorkspace && checked.toLowerCase() === ".brainbase-benchmark-owner.json") {
         throw new BenchmarkPhaseError("reserved_path", "benchmark input cannot replace the phase ownership marker");
@@ -77731,34 +78248,34 @@ async function preflightMaterial(material, sourceRoot, destinationRoot, protectW
     }
     return planned;
   } finally {
-    fs79.rmSync(temporary, { recursive: true, force: true });
+    fs80.rmSync(temporary, { recursive: true, force: true });
   }
 }
 function ownerMarker(root) {
-  return path87.join(root, ".brainbase-benchmark-owner.json");
+  return path88.join(root, ".brainbase-benchmark-owner.json");
 }
 function verifyOwnedDirectory(root, role, spec) {
-  if (!fs79.existsSync(root) || fs79.lstatSync(root).isSymbolicLink())
+  if (!fs80.existsSync(root) || fs80.lstatSync(root).isSymbolicLink())
     return false;
   try {
-    const marker = JSON.parse(fs79.readFileSync(ownerMarker(root), "utf8"));
+    const marker = JSON.parse(fs80.readFileSync(ownerMarker(root), "utf8"));
     return marker.attempt_id === spec.attempt_id && marker.phase === spec.phase && marker.phase_id === spec.phase_id && marker.role === role;
   } catch {
     return false;
   }
 }
 function prepareOwnedDirectory(root, role, spec) {
-  if (fs79.existsSync(root)) {
+  if (fs80.existsSync(root)) {
     if (!verifyOwnedDirectory(root, role, spec)) {
-      const stat = fs79.lstatSync(root);
-      if (!stat.isDirectory() || fs79.readdirSync(root).length > 0) {
+      const stat = fs80.lstatSync(root);
+      if (!stat.isDirectory() || fs80.readdirSync(root).length > 0) {
         throw new BenchmarkPhaseError(`unowned_${role}_root`, `${role}_root exists without a matching attempt ownership marker`);
       }
     } else {
-      fs79.rmSync(root, { recursive: true, force: true });
+      fs80.rmSync(root, { recursive: true, force: true });
     }
   }
-  fs79.mkdirSync(root, { recursive: true, mode: 448 });
+  fs80.mkdirSync(root, { recursive: true, mode: 448 });
   writeJsonAtomic(ownerMarker(root), {
     schema_version: SCHEMA_VERSION,
     attempt_id: spec.attempt_id,
@@ -77847,10 +78364,10 @@ function terminate(child) {
 async function runCommand(command, root, spec, context, additions = {}) {
   const cwdRel = normalizedRootRelative(command.cwd);
   assertNoSymlinkTraversal(root, cwdRel);
-  const cwd2 = path87.resolve(root, cwdRel);
+  const cwd2 = path88.resolve(root, cwdRel);
   let cwdStat;
   try {
-    cwdStat = fs79.lstatSync(cwd2);
+    cwdStat = fs80.lstatSync(cwd2);
   } catch {
     throw new BenchmarkPhaseError("invalid_command_cwd", `command cwd is invalid: ${command.cwd}`);
   }
@@ -77921,28 +78438,28 @@ async function runCommand(command, root, spec, context, additions = {}) {
   });
 }
 async function writeLog(root, name, data, spec) {
-  const destination = path87.join(root, name);
-  fs79.mkdirSync(path87.dirname(destination), { recursive: true });
+  const destination = path88.join(root, name);
+  fs80.mkdirSync(path88.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   try {
-    fs79.writeFileSync(temporary, redactCommandOutput(data, spec), {
+    fs80.writeFileSync(temporary, redactCommandOutput(data, spec), {
       flag: "wx",
       mode: 384
     });
-    fs79.renameSync(temporary, destination);
+    fs80.renameSync(temporary, destination);
   } finally {
-    fs79.rmSync(temporary, { force: true });
+    fs80.rmSync(temporary, { force: true });
   }
   return await recordFile(root, destination, "logs");
 }
 function writeBufferAtomic(destination, data) {
-  fs79.mkdirSync(path87.dirname(destination), { recursive: true });
+  fs80.mkdirSync(path88.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   try {
-    fs79.writeFileSync(temporary, data, { flag: "wx", mode: 384 });
-    fs79.renameSync(temporary, destination);
+    fs80.writeFileSync(temporary, data, { flag: "wx", mode: 384 });
+    fs80.renameSync(temporary, destination);
   } finally {
-    fs79.rmSync(temporary, { force: true });
+    fs80.rmSync(temporary, { force: true });
   }
 }
 function assertBudget(context) {
@@ -77951,7 +78468,7 @@ function assertBudget(context) {
   }
 }
 async function executeHydrate(spec, context) {
-  fs79.mkdirSync(spec.workspace_root, { recursive: true });
+  fs80.mkdirSync(spec.workspace_root, { recursive: true });
   prepareOwnedDirectory(spec.logs_root, "logs", spec);
   context.logsOwned = true;
   const outputs = [];
@@ -78030,11 +78547,11 @@ async function executeHydrate(spec, context) {
       finalOutputs.push(output);
       continue;
     }
-    const candidate = path87.resolve(spec.workspace_root, safeRelPath(output.path));
+    const candidate = path88.resolve(spec.workspace_root, safeRelPath(output.path));
     assertNoSymlinkTraversal(spec.workspace_root, output.path);
-    if (!fs79.existsSync(candidate))
+    if (!fs80.existsSync(candidate))
       continue;
-    const stat = fs79.lstatSync(candidate);
+    const stat = fs80.lstatSync(candidate);
     if (!stat.isFile() && !stat.isSymbolicLink())
       continue;
     finalOutputs.push(await recordFile(spec.workspace_root, candidate, "workspace", stat.isSymbolicLink() ? "symlink" : "file"));
@@ -78061,27 +78578,27 @@ async function readEvidence(stagingRoot, evidence) {
       buffer,
       record: {
         root: "staging",
-        path: path87.relative(stagingRoot, filePath).replace(/\\/g, "/"),
+        path: path88.relative(stagingRoot, filePath).replace(/\\/g, "/"),
         sha256: evidence.sha256,
         size: opened.stat.size,
         mode: opened.stat.mode & 511
       }
     };
   } finally {
-    fs79.closeSync(opened.fd);
+    fs80.closeSync(opened.fd);
   }
 }
 async function workspaceManifest(spec, context) {
   const records = [];
   let totalBytes = 0;
-  const stack = [path87.resolve(spec.workspace_root)];
+  const stack = [path88.resolve(spec.workspace_root)];
   while (stack.length > 0) {
     const directory = stack.pop();
-    const entries = fs79.readdirSync(directory, { withFileTypes: true }).sort((a3, b4) => a3.name.localeCompare(b4.name));
+    const entries = fs80.readdirSync(directory, { withFileTypes: true }).sort((a3, b4) => a3.name.localeCompare(b4.name));
     for (const entry of entries) {
       assertBudget(context);
-      const full = path87.join(directory, entry.name);
-      const relative = path87.relative(spec.workspace_root, full).replace(/\\/g, "/");
+      const full = path88.join(directory, entry.name);
+      const relative = path88.relative(spec.workspace_root, full).replace(/\\/g, "/");
       if (relative === ".brainbase" || relative.startsWith(".brainbase/"))
         continue;
       if (relative === ".git" || relative.startsWith(".git/"))
@@ -78183,10 +78700,10 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
   if (evaluator.type === "workspace_assertion") {
     const relative = workspaceRel(evaluator.path);
     assertNoSymlinkTraversal(spec.workspace_root, relative);
-    const candidate = path87.resolve(spec.workspace_root, relative);
+    const candidate = path88.resolve(spec.workspace_root, relative);
     let stat = null;
     try {
-      stat = fs79.lstatSync(candidate);
+      stat = fs80.lstatSync(candidate);
     } catch (error2) {
       const code = error2.code;
       if (code !== "ENOENT" && code !== "ENOTDIR")
@@ -78207,7 +78724,7 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
         try {
           verdict2 = await sha256OfDescriptor(opened.fd) === evaluator.assertion.expected;
         } finally {
-          fs79.closeSync(opened.fd);
+          fs80.closeSync(opened.fd);
         }
       }
     }
@@ -78217,7 +78734,7 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
         try {
           verdict2 = readDescriptor(opened.fd).toString("utf8").includes(evaluator.assertion.expected);
         } finally {
-          fs79.closeSync(opened.fd);
+          fs80.closeSync(opened.fd);
         }
       }
     }
@@ -78271,8 +78788,8 @@ async function executeEvaluate(spec, context) {
   context.logsOwned = true;
   validateRoots(spec);
   const outputs = [];
-  const finalOutputPath = path87.join(spec.logs_root, "candidate-evidence", "final-output");
-  const trajectoryPath = path87.join(spec.logs_root, "candidate-evidence", "trajectory.json");
+  const finalOutputPath = path88.join(spec.logs_root, "candidate-evidence", "final-output");
+  const trajectoryPath = path88.join(spec.logs_root, "candidate-evidence", "trajectory.json");
   writeBufferAtomic(finalOutputPath, finalOutput.buffer);
   writeBufferAtomic(trajectoryPath, trajectoryEvidence.buffer);
   const frozenEvidenceRecords = [
@@ -78283,7 +78800,7 @@ async function executeEvaluate(spec, context) {
   context.outputs.push(...frozenEvidenceRecords);
   assertBudget(context);
   const manifest = await workspaceManifest(spec, context);
-  const manifestPath2 = path87.join(spec.logs_root, "candidate-workspace-manifest.json");
+  const manifestPath2 = path88.join(spec.logs_root, "candidate-workspace-manifest.json");
   writeJsonAtomic(manifestPath2, {
     schema_version: SCHEMA_VERSION,
     attempt_id: spec.attempt_id,
@@ -78296,12 +78813,12 @@ async function executeEvaluate(spec, context) {
   for (const artifactRelInput of spec.candidate_artifacts) {
     const artifactRel = workspaceRel(artifactRelInput);
     assertNoSymlinkTraversal(spec.workspace_root, artifactRel);
-    const source = path87.resolve(spec.workspace_root, artifactRel);
+    const source = path88.resolve(spec.workspace_root, artifactRel);
     const frozenArtifact = manifest.find((entry) => entry.path === artifactRel && entry.kind !== "symlink");
-    if (!frozenArtifact || !fs79.existsSync(source) || !fs79.lstatSync(source).isFile()) {
+    if (!frozenArtifact || !fs80.existsSync(source) || !fs80.lstatSync(source).isFile()) {
       throw new BenchmarkPhaseError("missing_artifact", `candidate artifact is missing: ${artifactRel}`);
     }
-    const destination = path87.resolve(spec.logs_root, "candidate-artifacts", artifactRel);
+    const destination = path88.resolve(spec.logs_root, "candidate-artifacts", artifactRel);
     await atomicCopy(source, destination, undefined, spec.workspace_root);
     const artifact = await recordFile(spec.logs_root, destination, "logs");
     if (artifact.sha256 !== frozenArtifact.sha256 || artifact.size !== frozenArtifact.size || artifact.mode !== frozenArtifact.mode) {
@@ -78312,13 +78829,13 @@ async function executeEvaluate(spec, context) {
   }
   if (spec.capture_workspace_archive) {
     const regularFiles = manifest.filter((entry) => entry.kind !== "symlink").map((entry) => entry.path);
-    const archive = path87.join(spec.logs_root, "candidate-workspace.tar.gz");
+    const archive = path88.join(spec.logs_root, "candidate-workspace.tar.gz");
     const temporary = `${archive}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
     try {
       await pack({ rootDir: spec.workspace_root, outFile: temporary, files: regularFiles });
-      fs79.renameSync(temporary, archive);
+      fs80.renameSync(temporary, archive);
     } finally {
-      fs79.rmSync(temporary, { force: true });
+      fs80.rmSync(temporary, { force: true });
     }
     const archiveRecord = await recordFile(spec.logs_root, archive, "logs");
     outputs.push(archiveRecord);
@@ -78417,22 +78934,22 @@ function rawIdentity(value) {
   };
 }
 function readSpecBytes(specPathInput) {
-  const specPath = path87.resolve(specPathInput);
-  const noFollow = typeof fs79.constants.O_NOFOLLOW === "number" ? fs79.constants.O_NOFOLLOW : 0;
+  const specPath = path88.resolve(specPathInput);
+  const noFollow = typeof fs80.constants.O_NOFOLLOW === "number" ? fs80.constants.O_NOFOLLOW : 0;
   let fd;
   try {
-    fd = fs79.openSync(specPath, fs79.constants.O_RDONLY | noFollow);
+    fd = fs80.openSync(specPath, fs80.constants.O_RDONLY | noFollow);
   } catch {
     throw new BenchmarkPhaseError("spec_read_failed", "spec file could not be read");
   }
   try {
-    const stat = fs79.fstatSync(fd);
+    const stat = fs80.fstatSync(fd);
     if (!stat.isFile() || stat.size > MAX_SPEC_BYTES) {
       throw new BenchmarkPhaseError("invalid_spec_file", "spec must be a regular JSON file no larger than 20 MiB");
     }
     return readDescriptor(fd);
   } finally {
-    fs79.closeSync(fd);
+    fs80.closeSync(fd);
   }
 }
 function validateBenchmarkInvocationBytes(bytes, resultPathInput, expectedPhase) {
@@ -78448,8 +78965,8 @@ function validateBenchmarkInvocationBytes(bytes, resultPathInput, expectedPhase)
     throw new BenchmarkPhaseError("phase_mismatch", `the ${expectedPhase} command cannot execute a ${spec.phase} spec`);
   }
   validateRoots(spec);
-  const resultPath = path87.resolve(resultPathInput);
-  const expectedResultPath = path87.join(path87.resolve(spec.logs_root), "result.json");
+  const resultPath = path88.resolve(resultPathInput);
+  const expectedResultPath = path88.join(path88.resolve(spec.logs_root), "result.json");
   if (resultPath !== expectedResultPath) {
     throw new BenchmarkPhaseError("invalid_result_path", `result path must be ${expectedResultPath}`);
   }
@@ -78476,9 +78993,9 @@ function prepareBenchmarkPhaseInvocation(specPathInput, resultPathInput, expecte
       spec_digest: digest,
       timeout_ms: spec.budget.timeout_ms
     };
-    if (fs79.existsSync(resultPath)) {
+    if (fs80.existsSync(resultPath)) {
       try {
-        const cached2 = JSON.parse(fs79.readFileSync(resultPath, "utf8"));
+        const cached2 = JSON.parse(fs80.readFileSync(resultPath, "utf8"));
         if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
           return {
             ok: true,
@@ -78546,7 +79063,7 @@ function writeBenchmarkPhaseTimeoutResult(specBytes, resultPathInput, expectedPh
 async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase, immutableSpecBytes) {
   const startedAt = nowIso();
   const started = Date.now();
-  const resultPath = path87.resolve(resultPathInput);
+  const resultPath = path88.resolve(resultPathInput);
   let raw = undefined;
   let digest = null;
   let identity2 = rawIdentity(raw);
@@ -78580,14 +79097,14 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
       throw new BenchmarkPhaseError("phase_mismatch", `the ${expectedPhase} command cannot execute a ${spec.phase} spec`);
     }
     validateRoots(spec);
-    const expectedResultPath = path87.join(path87.resolve(spec.logs_root), "result.json");
+    const expectedResultPath = path88.join(path88.resolve(spec.logs_root), "result.json");
     if (resultPath !== expectedResultPath) {
       throw new BenchmarkPhaseError("invalid_result_path", `result path must be ${expectedResultPath}`);
     }
     resultPathValidated = true;
-    if (fs79.existsSync(resultPath)) {
+    if (fs80.existsSync(resultPath)) {
       try {
-        const cached2 = JSON.parse(fs79.readFileSync(resultPath, "utf8"));
+        const cached2 = JSON.parse(fs80.readFileSync(resultPath, "utf8"));
         if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
           return { exitCode: 0, result: cached2 };
         }
@@ -78783,14 +79300,14 @@ function terminatePhase(child) {
   }
 }
 function createAnonymousSpecFd(bytes) {
-  const temporary = path88.join(os17.tmpdir(), `brainbase-benchmark-spec-${process.pid}-${crypto7.randomBytes(12).toString("hex")}`);
-  fs80.writeFileSync(temporary, bytes, { flag: "wx", mode: 384 });
+  const temporary = path89.join(os17.tmpdir(), `brainbase-benchmark-spec-${process.pid}-${crypto7.randomBytes(12).toString("hex")}`);
+  fs81.writeFileSync(temporary, bytes, { flag: "wx", mode: 384 });
   try {
-    const fd = fs80.openSync(temporary, "r");
-    fs80.unlinkSync(temporary);
+    const fd = fs81.openSync(temporary, "r");
+    fs81.unlinkSync(temporary);
     return fd;
   } catch (error2) {
-    fs80.rmSync(temporary, { force: true });
+    fs81.rmSync(temporary, { force: true });
     throw error2;
   }
 }
@@ -78859,13 +79376,13 @@ async function runSupervisedPhase(phase, parsed, write) {
       detached: process.platform !== "win32"
     });
   } catch {
-    fs80.closeSync(specFd);
+    fs81.closeSync(specFd);
     const failure = phaseFailure(invocation, startedAt, started, "phase_supervisor_failed", "benchmark phase child process could not be started");
     write(`${JSON.stringify(failure)}
 `);
     return 1;
   }
-  fs80.closeSync(specFd);
+  fs81.closeSync(specFd);
   return await new Promise((resolve) => {
     const stdout = [];
     let settled = false;
@@ -78947,7 +79464,7 @@ async function runBenchmark(sub, args, write = (value) => process.stdout.write(v
       if (phase !== "hydrate" && phase !== "evaluate" || resultFlag !== "--result" || !resultPath || specFdFlag !== "--spec-fd" || !Number.isInteger(specFd) || specFd < 3 || tokenFlag !== "--token" || !token || token !== process.env.BRAINBASE_BENCHMARK_PHASE_CHILD_TOKEN) {
         throw new Error("Invalid internal benchmark phase invocation");
       }
-      const specBytes = fs80.readFileSync(specFd);
+      const specBytes = fs81.readFileSync(specFd);
       const { exitCode, result: result2 } = await runBenchmarkPhase("", resultPath, phase, specBytes);
       write(`${JSON.stringify(result2)}
 `);
@@ -79092,7 +79609,8 @@ function help() {
   out.push(divider("CLI TOKENS"));
   out.push("");
   out.push(`  ${import_picocolors49.default.cyan("token create")}                        ${import_picocolors49.default.dim("issue a long-lived CLI key for CI / scripts")}`);
-  out.push(`  ${import_picocolors49.default.cyan("token list")}                          ${import_picocolors49.default.dim("show your active tokens")}`);
+  out.push(`  ${import_picocolors49.default.cyan("token list")}                          ${import_picocolors49.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors49.default.cyan("token rename")} ${import_picocolors49.default.dim("<id>")}                  ${import_picocolors49.default.dim("relabel a token")}`);
   out.push(`  ${import_picocolors49.default.cyan("token revoke")} ${import_picocolors49.default.dim("<id>")}                  ${import_picocolors49.default.dim("revoke a token")}`);
   out.push("");
   out.push(divider("MCP"));
@@ -79222,7 +79740,7 @@ async function main() {
   const rawCwd = process14.cwd();
   const cwd2 = (() => {
     try {
-      return fs81.realpathSync(rawCwd);
+      return fs82.realpathSync(rawCwd);
     } catch {
       return rawCwd;
     }
@@ -79319,7 +79837,7 @@ async function main() {
       }
       case "token": {
         const sub = argv.shift();
-        await runToken(sub, argv, { yes });
+        await runToken(sub, argv, { yes, name: nameFlag });
         break;
       }
       case "link": {