@brainbase-labs/cli 0.21.1 → 0.22.0

package/dist/index.js

@@ -35128,12 +35128,12 @@ var require_dist2 = __commonJS((exports, module) => {
       throw new Error(`Unknown format "${name}"`);
     return f4;
   };
-  function addFormats(ajv, list, fs80, exportName) {
+  function addFormats(ajv, list, fs81, exportName) {
     var _a;
     var _b;
     (_a = (_b = ajv.opts.code).formats) !== null && _a !== undefined || (_b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`);
     for (const f4 of list)
-      ajv.addFormat(f4, fs80[f4]);
+      ajv.addFormat(f4, fs81[f4]);
   }
   module.exports = exports = formatsPlugin;
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -35141,9 +35141,9 @@ var require_dist2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-var import_picocolors49 = __toESM(require_picocolors(), 1);
+var import_picocolors52 = __toESM(require_picocolors(), 1);
 import process14 from "node:process";
-import fs82 from "node:fs";
+import fs83 from "node:fs";
 
 // src/cli/template.ts
 var import_picocolors12 = __toESM(require_picocolors(), 1);
@@ -36008,7 +36008,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.21.1",
+  version: "0.22.0",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -53969,6 +53969,7 @@ class NetworkApiError extends ApiError {
 
 class TaskRecoveryDeadlineError extends ApiError {
 }
+var GET_NETWORK_RETRY_DELAYS_MS = [100, 250];
 function normalizeControlPlaneUrl(url) {
   const normalized = url?.trim().replace(/\/+$/, "");
   return normalized || DEFAULT_CONTROL_PLANE_BASE;
@@ -54101,9 +54102,33 @@ async function sendWithAuthRetry(session, send) {
 }
 async function request(pathname, init = {}) {
   const credential = await resolveCredential();
-  const retrySession = credential.source === "session" && !new Headers(init.headers).has("Authorization") ? credential.session : null;
-  const res = await sendWithAuthRetry(retrySession, (refreshed) => sendRequest(`${apiBase(refreshed ?? credential.session)}${pathname}`, init, refreshed?.access_token ?? credential.bearer));
-  const text2 = await res.text();
+  let currentSession = credential.session;
+  let refreshSessionAvailable = credential.source === "session" && !new Headers(init.headers).has("Authorization");
+  const method2 = (init.method ?? "GET").toUpperCase();
+  let res;
+  let text2;
+  for (let attempt2 = 0;; attempt2 += 1) {
+    try {
+      res = await sendWithAuthRetry(refreshSessionAvailable ? currentSession : null, async (refreshed) => {
+        if (refreshed) {
+          currentSession = refreshed;
+          refreshSessionAvailable = false;
+        }
+        return await sendRequest(`${apiBase(currentSession)}${pathname}`, init, currentSession?.access_token ?? credential.bearer);
+      });
+      try {
+        text2 = await res.text();
+      } catch (error) {
+        throw new NetworkApiError(`Network error while reading response: ${error.message}`, false);
+      }
+      break;
+    } catch (error) {
+      if (method2 !== "GET" || !(error instanceof NetworkApiError) || attempt2 >= GET_NETWORK_RETRY_DELAYS_MS.length) {
+        throw error;
+      }
+      await new Promise((resolve) => setTimeout(resolve, GET_NETWORK_RETRY_DELAYS_MS[attempt2]));
+    }
+  }
   let body = text2;
   try {
     body = text2 ? JSON.parse(text2) : null;
@@ -54267,6 +54292,19 @@ var masApi = {
     return parseMasTaskCreateResponse(body);
   }
 };
+function isUnroutedPath(body) {
+  return !!body && typeof body === "object" && body.detail === "Not Found";
+}
+async function connectionsRequest(pathname, init) {
+  try {
+    return await request(pathname, init);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404 && isUnroutedPath(err.body)) {
+      throw new ApiError("This control plane does not support reading or changing connections yet. Update the server, or use the web app.", 404, err.body);
+    }
+    throw err;
+  }
+}
 var api = {
   listOrgs() {
     return request("/orgs");
@@ -54354,6 +54392,21 @@ var api = {
       method: "DELETE"
     });
   },
+  getAgentConnections(agentId) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/connections`);
+  },
+  connectSlack(agentId, input) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/connections/slack`, { method: "PUT", body: JSON.stringify(input) });
+  },
+  connectMeeting(agentId, input) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/connections/meeting`, { method: "PUT", body: JSON.stringify(input) });
+  },
+  disconnectIntegration(agentId, integration) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/connections/${encodeURIComponent(integration)}`, { method: "DELETE" });
+  },
+  listAgentMcpServers(agentId) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/mcp-servers`);
+  },
   listOrchestrations(orgId, teamId) {
     return request(`/orgs/${encodeURIComponent(orgId)}/teams/${encodeURIComponent(teamId)}/orchestrations`);
   },
@@ -63283,7 +63336,7 @@ function runHarnessInstall(harnessId, components, opts, agentName) {
 }
 
 // src/cli/agent.ts
-var import_picocolors34 = __toESM(require_picocolors(), 1);
+var import_picocolors37 = __toESM(require_picocolors(), 1);
 
 // src/cli/agent-pull.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -66396,6 +66449,396 @@ function formatAgentList(agents, labels) {
 `);
 }
 
+// src/cli/agent-connections.ts
+var import_picocolors35 = __toESM(require_picocolors(), 1);
+
+// src/core/integrations.ts
+var IMPLEMENTED_INTEGRATIONS = ["slack", "meeting"];
+function isImplemented(name) {
+  return IMPLEMENTED_INTEGRATIONS.includes(name);
+}
+function actionability(state) {
+  if (!state.manageable_from_cli) {
+    return { kind: "web-only", ...state.unmanageable_reason ? { reason: state.unmanageable_reason } : {} };
+  }
+  return isImplemented(state.name) ? { kind: "connectable" } : { kind: "needs-newer-cli" };
+}
+var GENERIC_WEB_ONLY_REASON = "This integration cannot be connected from the terminal. Use the web app.";
+var UPGRADE_HINT = "This control plane supports connecting it, but this version of the CLI does not. Upgrade the CLI.";
+function explain(state) {
+  const action = actionability(state);
+  switch (action.kind) {
+    case "connectable":
+      return `brainbase agent connect ${state.name}`;
+    case "needs-newer-cli":
+      return UPGRADE_HINT;
+    case "web-only":
+      return action.reason ?? GENERIC_WEB_ONLY_REASON;
+    default: {
+      const exhaustive = action;
+      return exhaustive;
+    }
+  }
+}
+
+// src/cli/agent-connect.ts
+var import_picocolors34 = __toESM(require_picocolors(), 1);
+
+// src/core/secret-input.ts
+import fs74 from "node:fs";
+function clean(value) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : undefined;
+}
+var STDIN_IDLE_TIMEOUT_MS = 5000;
+var STDIN_TIMEOUT_MIN_MS = 100;
+var STDIN_TIMEOUT_MAX_MS = 600000;
+function stdinTimeoutMs(env3) {
+  const raw = Number(env3.BRAINBASE_STDIN_TIMEOUT_MS);
+  if (!Number.isFinite(raw) || raw <= 0)
+    return STDIN_IDLE_TIMEOUT_MS;
+  return Math.min(Math.max(raw, STDIN_TIMEOUT_MIN_MS), STDIN_TIMEOUT_MAX_MS);
+}
+
+class StdinTimeoutError extends Error {
+  constructor(idleTimeoutMs, bytesRead) {
+    super(`stdin went quiet for ${idleTimeoutMs}ms after ${bytesRead} byte(s), before it was closed. ` + "Refusing to use a partial value. If the source is slow, raise " + "BRAINBASE_STDIN_TIMEOUT_MS; if it will not close its end of the pipe, " + "pass the value with a flag or an environment variable instead.");
+    this.name = "StdinTimeoutError";
+  }
+}
+function readPipeUntilEof(stream, idleTimeoutMs) {
+  return new Promise((resolve, reject2) => {
+    const chunks = [];
+    let received = 0;
+    let timer;
+    const stopTimer = () => {
+      if (timer !== undefined) {
+        clearTimeout(timer);
+        timer = undefined;
+      }
+    };
+    const restartTimer = () => {
+      stopTimer();
+      timer = setTimeout(onIdle, idleTimeoutMs);
+    };
+    const detach = () => {
+      stopTimer();
+      stream.removeListener("data", onData);
+      stream.removeListener("end", onEnd);
+      stream.removeListener("error", onError);
+      stream.pause();
+      stream.unref?.();
+    };
+    function onIdle() {
+      if (received > 0) {
+        detach();
+        reject2(new StdinTimeoutError(idleTimeoutMs, received));
+        return;
+      }
+      detach();
+      resolve("");
+    }
+    function onData(chunk2) {
+      const buf = Buffer.from(chunk2);
+      received += buf.length;
+      chunks.push(buf);
+      restartTimer();
+    }
+    function onEnd() {
+      detach();
+      resolve(Buffer.concat(chunks).toString("utf8"));
+    }
+    function onError(err) {
+      detach();
+      reject2(err);
+    }
+    stream.on("data", onData);
+    stream.on("end", onEnd);
+    stream.on("error", onError);
+    restartTimer();
+  });
+}
+async function defaultReadStdin(env3 = process.env) {
+  if (process.stdin.isTTY)
+    return null;
+  let isRegularFile = false;
+  try {
+    isRegularFile = fs74.fstatSync(0).isFile();
+  } catch {
+    return "";
+  }
+  if (isRegularFile) {
+    try {
+      return fs74.readFileSync(0, "utf8");
+    } catch {
+      return "";
+    }
+  }
+  try {
+    return await readPipeUntilEof(process.stdin, stdinTimeoutMs(env3));
+  } catch (err) {
+    if (err instanceof StdinTimeoutError)
+      throw err;
+    return "";
+  }
+}
+async function defaultPrompt(field) {
+  const answer = await re({
+    message: field.label,
+    validate: (v3) => v3 && v3.trim() ? undefined : "Required"
+  });
+  return String(ensureNotCancelled(answer)).trim();
+}
+function parseStdinSecrets(raw, missing) {
+  const body = raw.trim();
+  if (!body)
+    return {};
+  if (body.startsWith("{")) {
+    let source;
+    try {
+      source = JSON.parse(body);
+    } catch {
+      throw new Error('stdin looked like JSON but could not be parsed. Pass an object such as {"bot_token":"…","signing_secret":"…"}.');
+    }
+    const out = {};
+    for (const field of missing) {
+      const value = clean(source[field.key]);
+      if (value)
+        out[field.key] = value;
+    }
+    return out;
+  }
+  if (missing.length === 1) {
+    return { [missing[0].key]: body };
+  }
+  throw new Error(`stdin supplies one value, but ${missing.length} are still missing (${missing.map((f4) => f4.key).join(", ")}). Pipe a JSON object instead, or pass the rest as flags.`);
+}
+async function resolveSecrets(fields, deps = {}) {
+  const env3 = deps.env ?? process.env;
+  const readStdin = deps.readStdin ?? (() => defaultReadStdin(env3));
+  const prompt = deps.prompt ?? defaultPrompt;
+  const interactive = deps.interactive ?? isInteractive;
+  const resolved = {};
+  for (const field of fields) {
+    const value = clean(field.value) ?? clean(env3[field.envVar]);
+    if (value)
+      resolved[field.key] = value;
+  }
+  let missing = fields.filter((f4) => !resolved[f4.key]);
+  if (missing.length > 0) {
+    const raw = await readStdin();
+    if (raw !== null) {
+      Object.assign(resolved, parseStdinSecrets(raw, missing));
+      missing = fields.filter((f4) => !resolved[f4.key]);
+    }
+  }
+  for (const field of missing) {
+    if (!interactive()) {
+      throw new NonInteractiveError(`${field.label} is required. Pass ${field.flag}, set ${field.envVar}, or pipe it on stdin.`);
+    }
+    resolved[field.key] = await prompt(field);
+  }
+  return resolved;
+}
+
+// src/cli/agent-connect.ts
+async function runAgentConnect(cwd2, target, args, deps = {}) {
+  const json = Boolean(args.json);
+  try {
+    report(await connect(cwd2, target, args, deps, json), json);
+  } catch (err) {
+    if (!json)
+      throw err;
+    reportFailure(err);
+  }
+}
+async function connect(cwd2, target, args, deps, json) {
+  if (!target) {
+    throw new Error(`Which integration? Try: ${IMPLEMENTED_INTEGRATIONS.join(", ")}.`);
+  }
+  if (!json)
+    banner(`agent connect ${target}`);
+  const link2 = readLink(cwd2);
+  if (!link2) {
+    throw new Error("This folder is not linked to any agent. Run `brainbase link` first.");
+  }
+  await assertConnectable(link2.agent_id, target, deps);
+  return target === "slack" ? connectSlack(link2.agent_id, args, deps, json) : connectMeeting(link2.agent_id, args, deps, json);
+}
+async function assertConnectable(agentId, target, deps) {
+  const fetchConnections = deps.fetchConnections ?? ((id) => api.getAgentConnections(id));
+  const { integrations } = await fetchConnections(agentId);
+  const state = integrations.find((i) => i.name === target);
+  if (!state) {
+    const known = integrations.map((i) => i.name).join(", ");
+    throw new Error(`Unknown integration ${JSON.stringify(target)}. This agent has: ${known}.`);
+  }
+  const action = actionability(state);
+  if (action.kind === "connectable")
+    return;
+  throw new Error(explain(state));
+}
+async function connectSlack(agentId, args, deps, json) {
+  const secrets = await resolveSecrets([
+    {
+      key: "bot_token",
+      flag: "--bot-token",
+      envVar: "BRAINBASE_SLACK_BOT_TOKEN",
+      label: "Slack bot token (xoxb-…)",
+      value: args.botToken
+    },
+    {
+      key: "signing_secret",
+      flag: "--signing-secret",
+      envVar: "BRAINBASE_SLACK_SIGNING_SECRET",
+      label: "Slack signing secret",
+      value: args.signingSecret
+    }
+  ], { ...deps.secrets, ...json ? { interactive: () => false } : {} });
+  return api.connectSlack(agentId, {
+    bot_token: secrets.bot_token,
+    signing_secret: secrets.signing_secret,
+    ...args.appId ? { app_id: args.appId } : {},
+    ...args.appName ? { app_name: args.appName } : {}
+  });
+}
+async function connectMeeting(agentId, args, deps, json) {
+  const ask = deps.askBotName ?? (() => text({
+    message: "Name for the meeting bot",
+    placeholder: "Notetaker",
+    flagHint: "Pass --bot-name <name>."
+  }));
+  let botName = args.botName?.trim();
+  if (!botName) {
+    if (json) {
+      throw new Error("A meeting bot name is required. Pass --bot-name <name>.");
+    }
+    botName = (await ask()).trim();
+  }
+  if (!botName)
+    throw new Error("A meeting bot name is required. Pass --bot-name <name>.");
+  return api.connectMeeting(agentId, {
+    bot_name: botName,
+    ...args.botImageUrl ? { bot_image_url: args.botImageUrl } : {}
+  });
+}
+function reportFailure(err) {
+  console.log(JSON.stringify({ error: err.message }, null, 2));
+  process.exitCode = 1;
+}
+function report(result2, json) {
+  if (json) {
+    console.log(JSON.stringify(result2, null, 2));
+    return;
+  }
+  const detail = result2.detail ? ` ${import_picocolors34.default.dim(`(${result2.detail})`)}` : "";
+  f2.success(`${result2.name} connected${detail}`);
+  f2.info(`Run ${import_picocolors34.default.cyan("brainbase agent pull")} to pick up the built-in ${result2.name} MCP server.`);
+}
+
+// src/cli/agent-connections.ts
+async function runAgentConnections(cwd2, args) {
+  const json = Boolean(args.json);
+  if (!json)
+    banner("agent connections — what this agent is wired to");
+  const link2 = readLink(cwd2);
+  if (!link2) {
+    if (json) {
+      console.log(JSON.stringify({ linked: false, integrations: [] }, null, 2));
+      process.exitCode = 1;
+      return;
+    }
+    f2.warn("This folder is not linked to any agent.");
+    f2.info(`Run ${import_picocolors35.default.cyan("brainbase link")} first.`);
+    process.exitCode = 1;
+    return;
+  }
+  let connections;
+  try {
+    connections = await api.getAgentConnections(link2.agent_id);
+  } catch (err) {
+    if (!json)
+      throw err;
+    reportFailure(err);
+    return;
+  }
+  if (json) {
+    console.log(JSON.stringify({ linked: true, ...connections }, null, 2));
+    return;
+  }
+  console.log(formatConnections(connections));
+}
+function formatConnections(connections) {
+  const lines = [""];
+  for (const integration of connections.integrations) {
+    lines.push(`  ${statusMark(integration)} ${import_picocolors35.default.bold(integration.name)}${describe(integration)}`);
+    const hint = hintFor(integration);
+    if (hint)
+      lines.push(`      ${import_picocolors35.default.dim(hint)}`);
+  }
+  lines.push("");
+  return lines.join(`
+`);
+}
+function statusMark(integration) {
+  return integration.connected ? import_picocolors35.default.green("✓") : import_picocolors35.default.dim("·");
+}
+function describe(integration) {
+  if (!integration.connected)
+    return `  ${import_picocolors35.default.dim("not connected")}`;
+  return integration.detail ? `  ${import_picocolors35.default.dim(integration.detail)}` : `  ${import_picocolors35.default.dim("connected")}`;
+}
+function hintFor(integration) {
+  const action = actionability(integration);
+  if (integration.connected) {
+    return action.kind === "connectable" ? `brainbase agent disconnect ${integration.name}` : undefined;
+  }
+  return explain(integration);
+}
+
+// src/cli/agent-disconnect.ts
+var import_picocolors36 = __toESM(require_picocolors(), 1);
+async function runAgentDisconnect(cwd2, target, args) {
+  const json = Boolean(args.json);
+  try {
+    await disconnect(cwd2, target, args, json);
+  } catch (err) {
+    if (!json)
+      throw err;
+    reportFailure(err);
+  }
+}
+async function disconnect(cwd2, target, args, json) {
+  if (!target) {
+    throw new Error(`Which integration? Try: ${IMPLEMENTED_INTEGRATIONS.join(", ")}.`);
+  }
+  if (!isImplemented(target)) {
+    throw new Error(`Cannot disconnect ${JSON.stringify(target)} from the CLI. Try: ${IMPLEMENTED_INTEGRATIONS.join(", ")}.`);
+  }
+  if (!json)
+    banner(`agent disconnect ${target}`);
+  const link2 = readLink(cwd2);
+  if (!link2) {
+    throw new Error("This folder is not linked to any agent. Run `brainbase link` first.");
+  }
+  if (!json && !autoProceed(args.yes)) {
+    const ok = ensureNotCancelled(await se({ message: `Disconnect ${target} from ${link2.name}?` }));
+    if (!ok) {
+      f2.info("Nothing changed.");
+      return;
+    }
+  }
+  const result2 = await api.disconnectIntegration(link2.agent_id, target);
+  if (json) {
+    console.log(JSON.stringify(result2, null, 2));
+    return;
+  }
+  f2.success(`${target} disconnected`);
+  f2.info(`Run ${import_picocolors36.default.cyan("brainbase agent pull")} to drop the built-in ${target} MCP server locally.`);
+}
+
 // src/cli/agent.ts
 async function runAgent(cwd2, sub, args, opts) {
   if (args.some((arg) => arg === "--help" || arg === "-h")) {
@@ -66446,6 +66889,23 @@ async function runAgent(cwd2, sub, args, opts) {
     case "status":
       await runAgentStatus(cwd2, { json: opts.json });
       return;
+    case "connections":
+      await runAgentConnections(cwd2, { json: opts.json });
+      return;
+    case "connect":
+      await runAgentConnect(cwd2, args[0], {
+        botToken: opts.botToken,
+        signingSecret: opts.signingSecret,
+        appId: opts.appId,
+        appName: opts.appName,
+        botName: opts.botName,
+        botImageUrl: opts.botImageUrl,
+        json: opts.json
+      });
+      return;
+    case "disconnect":
+      await runAgentDisconnect(cwd2, args[0], { yes: opts.yes, json: opts.json });
+      return;
     case "env":
       await runAgentEnv(cwd2, { shell: opts.shell });
       return;
@@ -66465,25 +66925,31 @@ async function runAgent(cwd2, sub, args, opts) {
 function printHelp() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors34.default.bold("brainbase agent")} ${import_picocolors34.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors37.default.bold("brainbase agent")} ${import_picocolors37.default.dim("<sub> [options]")}`);
+  out.push("");
+  out.push(`  ${import_picocolors37.default.cyan("list")}               ${import_picocolors37.default.dim("show the agents in a team, with the ids `brainbase link` takes (--json for scripts)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("create")}             ${import_picocolors37.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
+  out.push(`  ${import_picocolors37.default.cyan("pull")} ${import_picocolors37.default.dim("[<id>]")}      ${import_picocolors37.default.dim("apply cloud changes into this folder — pass <id> to switch (--force to override); --run-entrypoint to also execute the agent entrypoint")}`);
+  out.push(`  ${import_picocolors37.default.cyan("push")}               ${import_picocolors37.default.dim("send local changes to the cloud — instructions, playbooks, skills, MCPs, entrypoint (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("unpack")}             ${import_picocolors37.default.dim("install the claimed agent into a harness layout (--harness to override)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("status")}             ${import_picocolors37.default.dim("show what would push, what would pull, and which manifest blocks are ignored (--json for scripts)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("connections")}        ${import_picocolors37.default.dim("show which integrations this agent is wired to (--json for scripts)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("connect")} ${import_picocolors37.default.dim("<name>")}     ${import_picocolors37.default.dim("connect slack or meeting — credentials come from flags, env, or stdin")}`);
+  out.push(`  ${import_picocolors37.default.cyan("disconnect")} ${import_picocolors37.default.dim("<name>")}  ${import_picocolors37.default.dim("revoke a slack or meeting install")}`);
+  out.push(`  ${import_picocolors37.default.cyan("env")}                ${import_picocolors37.default.dim('print export statements — use with `eval "$(brainbase agent env)"`')}`);
   out.push("");
-  out.push(`  ${import_picocolors34.default.cyan("list")}               ${import_picocolors34.default.dim("show the agents in a team, with the ids `brainbase link` takes (--json for scripts)")}`);
-  out.push(`  ${import_picocolors34.default.cyan("create")}             ${import_picocolors34.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors34.default.cyan("pull")} ${import_picocolors34.default.dim("[<id>]")}      ${import_picocolors34.default.dim("apply cloud changes into this folder — pass <id> to switch (--force to override); --run-entrypoint to also execute the agent entrypoint")}`);
-  out.push(`  ${import_picocolors34.default.cyan("push")}               ${import_picocolors34.default.dim("send local changes to the cloud — instructions, playbooks, skills, MCPs, entrypoint (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors34.default.cyan("unpack")}             ${import_picocolors34.default.dim("install the claimed agent into a harness layout (--harness to override)")}`);
-  out.push(`  ${import_picocolors34.default.cyan("status")}             ${import_picocolors34.default.dim("show what would push, what would pull, and which manifest blocks are ignored (--json for scripts)")}`);
-  out.push(`  ${import_picocolors34.default.cyan("env")}                ${import_picocolors34.default.dim('print export statements — use with `eval "$(brainbase agent env)"`')}`);
+  out.push(`  ${import_picocolors37.default.dim("Slack credentials:")} ${import_picocolors37.default.dim("--bot-token / BRAINBASE_SLACK_BOT_TOKEN, --signing-secret / BRAINBASE_SLACK_SIGNING_SECRET,")}`);
+  out.push(`  ${import_picocolors37.default.dim('or pipe {"bot_token":"…","signing_secret":"…"} on stdin to keep them out of argv.')}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/team.ts
-var import_picocolors36 = __toESM(require_picocolors(), 1);
+var import_picocolors39 = __toESM(require_picocolors(), 1);
 
 // src/cli/team-list.ts
-var import_picocolors35 = __toESM(require_picocolors(), 1);
+var import_picocolors38 = __toESM(require_picocolors(), 1);
 async function runTeamList(args) {
   if (!args.json)
     banner("team list — teams you can put agents in");
@@ -66503,25 +66969,25 @@ async function runTeamList(args) {
 function formatTeamList(grouped) {
   const lines = [""];
   if (grouped.length === 0) {
-    lines.push(`  ${import_picocolors35.default.dim("You are not a member of any organization.")}`, "");
+    lines.push(`  ${import_picocolors38.default.dim("You are not a member of any organization.")}`, "");
     return lines.join(`
 `);
   }
   const nameWidth = Math.max(...grouped.flatMap(({ teams }) => teams.map((t) => t.name.length)), 0);
   for (const { org, teams, error } of grouped) {
-    const slug = org.slug ? `  ${import_picocolors35.default.dim(org.slug)}` : "";
-    lines.push(`  ${import_picocolors35.default.bold(org.name)}${slug}`);
+    const slug = org.slug ? `  ${import_picocolors38.default.dim(org.slug)}` : "";
+    lines.push(`  ${import_picocolors38.default.bold(org.name)}${slug}`);
     if (error) {
-      lines.push(`    ${import_picocolors35.default.red(`could not load teams: ${error}`)}`);
+      lines.push(`    ${import_picocolors38.default.red(`could not load teams: ${error}`)}`);
     } else if (teams.length === 0) {
-      lines.push(`    ${import_picocolors35.default.dim("no teams yet — create one in the web app")}`);
+      lines.push(`    ${import_picocolors38.default.dim("no teams yet — create one in the web app")}`);
     }
     for (const team of teams) {
-      lines.push(`    ${team.name.padEnd(nameWidth)}  ${import_picocolors35.default.dim(team.id)}`);
+      lines.push(`    ${team.name.padEnd(nameWidth)}  ${import_picocolors38.default.dim(team.id)}`);
     }
     lines.push("");
   }
-  lines.push(`  ${import_picocolors35.default.dim("list a team’s agents with")} ${import_picocolors35.default.cyan("brainbase agent list --team <id>")}`, "");
+  lines.push(`  ${import_picocolors38.default.dim("list a team’s agents with")} ${import_picocolors38.default.cyan("brainbase agent list --team <id>")}`, "");
   return lines.join(`
 `);
 }
@@ -66552,28 +67018,28 @@ async function runTeam(sub, args, opts) {
 function printHelp2() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors36.default.bold("brainbase team")} ${import_picocolors36.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors39.default.bold("brainbase team")} ${import_picocolors39.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors36.default.cyan("list")}   ${import_picocolors36.default.dim("show the teams you can create agents in, grouped by organization")}`);
+  out.push(`  ${import_picocolors39.default.cyan("list")}   ${import_picocolors39.default.dim("show the teams you can create agents in, grouped by organization")}`);
   out.push("");
-  out.push(`  ${import_picocolors36.default.dim("--org <id-or-slug>")}  ${import_picocolors36.default.dim("limit to one organization")}`);
-  out.push(`  ${import_picocolors36.default.dim("--json")}              ${import_picocolors36.default.dim("machine-readable output")}`);
+  out.push(`  ${import_picocolors39.default.dim("--org <id-or-slug>")}  ${import_picocolors39.default.dim("limit to one organization")}`);
+  out.push(`  ${import_picocolors39.default.dim("--json")}              ${import_picocolors39.default.dim("machine-readable output")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/orchestration.ts
-var import_picocolors43 = __toESM(require_picocolors(), 1);
+var import_picocolors46 = __toESM(require_picocolors(), 1);
 
 // src/cli/orchestration-pull.ts
 import path86 from "node:path";
-import fs77 from "node:fs";
-var import_picocolors37 = __toESM(require_picocolors(), 1);
+import fs78 from "node:fs";
+var import_picocolors40 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-manifest.ts
 import path83 from "node:path";
-import fs74 from "node:fs";
+import fs75 from "node:fs";
 var import_yaml4 = __toESM(require_dist(), 1);
 var ORCH_MANIFEST_FILE = "brainbase-orchestration.yaml";
 var ORCH_MEMBERS_DIR = "agents";
@@ -66629,13 +67095,13 @@ function orchManifestPath(cwd2) {
   return path83.join(cwd2, ORCH_MANIFEST_FILE);
 }
 function hasOrchManifest(cwd2) {
-  return fs74.existsSync(orchManifestPath(cwd2));
+  return fs75.existsSync(orchManifestPath(cwd2));
 }
 function readOrchManifest(cwd2) {
   const p2 = orchManifestPath(cwd2);
-  if (!fs74.existsSync(p2))
+  if (!fs75.existsSync(p2))
     return null;
-  const raw = fs74.readFileSync(p2, "utf8");
+  const raw = fs75.readFileSync(p2, "utf8");
   let parsed;
   try {
     parsed = import_yaml4.default.parse(raw);
@@ -66656,7 +67122,7 @@ function writeOrchManifest(cwd2, manifest) {
 ` + " `brainbase orchestration push`. Member agents live under ./agents/." + `
  Schedule triggers are writable. App/Pipedream triggers are preserved
 ` + " as read-only context and ignored by `orchestration push`.";
-  fs74.writeFileSync(orchManifestPath(cwd2), String(doc), "utf8");
+  fs75.writeFileSync(orchManifestPath(cwd2), String(doc), "utf8");
 }
 function memberDir(cwd2, slug) {
   return path83.join(cwd2, ORCH_MEMBERS_DIR, slug);
@@ -66694,7 +67160,7 @@ function resolveMemberSlugs(members) {
 
 // src/core/orchestration-link.ts
 import path84 from "node:path";
-import fs75 from "node:fs";
+import fs76 from "node:fs";
 var ORCH_LINK_FILE = "orchestration-link.json";
 var ORCH_SYNC_STATE_FILE = "orchestration-sync-state.json";
 var OrchestrationLinkSchema = exports_external.object({
@@ -66745,12 +67211,12 @@ function readOrchLink(cwd2) {
 }
 function writeOrchLink(cwd2, link2) {
   ensureDir(path84.join(cwd2, LINK_DIR));
-  const clean = {};
+  const clean2 = {};
   for (const [k3, v3] of Object.entries(link2)) {
     if (v3 !== null && v3 !== undefined)
-      clean[k3] = v3;
+      clean2[k3] = v3;
   }
-  writeJson(orchLinkPath(cwd2), clean);
+  writeJson(orchLinkPath(cwd2), clean2);
   ensureGitignore2(cwd2);
 }
 function readOrchSyncState(cwd2) {
@@ -66774,12 +67240,12 @@ function ensureGitignore2(cwd2) {
 `;
   try {
     if (!exists(ignorePath)) {
-      fs75.writeFileSync(ignorePath, desired);
+      fs76.writeFileSync(ignorePath, desired);
       return;
     }
-    const current = fs75.readFileSync(ignorePath, "utf8");
+    const current = fs76.readFileSync(ignorePath, "utf8");
     if (!current.split(/\r?\n/).some((l2) => l2.trim() === ORCH_SYNC_STATE_FILE)) {
-      fs75.writeFileSync(ignorePath, current.endsWith(`
+      fs76.writeFileSync(ignorePath, current.endsWith(`
 `) ? current + desired : current + `
 ` + desired);
     }
@@ -66788,7 +67254,7 @@ function ensureGitignore2(cwd2) {
 
 // src/core/agent-fresh-install.ts
 import path85 from "node:path";
-import fs76 from "node:fs";
+import fs77 from "node:fs";
 import os15 from "node:os";
 async function installAgentFresh(input) {
   const { cwd: cwd2, agent, cloud, harness } = input;
@@ -66879,19 +67345,19 @@ async function installAgentFresh(input) {
     };
   } finally {
     try {
-      fs76.rmSync(stageRoot, { recursive: true, force: true });
+      fs77.rmSync(stageRoot, { recursive: true, force: true });
     } catch {}
   }
 }
 function stageManifestComponents2(components) {
-  const root = fs76.mkdtempSync(path85.join(os15.tmpdir(), "brainbase-orch-pull-"));
+  const root = fs77.mkdtempSync(path85.join(os15.tmpdir(), "brainbase-orch-pull-"));
   for (const c2 of components) {
     const compDir = path85.join(root, c2.type, c2.slug);
     ensureDir(compDir);
     for (const f4 of c2.files) {
       const target = path85.join(compDir, f4.path);
       ensureDir(path85.dirname(target));
-      fs76.writeFileSync(target, f4.content);
+      fs77.writeFileSync(target, f4.content);
     }
   }
   return root;
@@ -66926,7 +67392,7 @@ function materializeInstructions2(cwd2, cloud) {
       continue;
     const target = path85.join(cwd2, DEFAULT_INSTRUCTIONS_FILE);
     ensureDir(path85.dirname(target));
-    fs76.writeFileSync(target, normalizeInstructionBody(body), "utf8");
+    fs77.writeFileSync(target, normalizeInstructionBody(body), "utf8");
     return;
   }
 }
@@ -66940,7 +67406,7 @@ function materializePlaybooks2(cwd2, cloud) {
     const { body } = stripPlaybookFrontmatter(raw);
     const target = path85.join(cwd2, DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`);
     ensureDir(path85.dirname(target));
-    fs76.writeFileSync(target, body, "utf8");
+    fs77.writeFileSync(target, body, "utf8");
   }
 }
 function buildManifestFromCloud(cloud, agent, localOnly = {}) {
@@ -67089,8 +67555,8 @@ async function runOrchestrationPull(cwd2, args) {
     orchId = args.orchestrationId;
   } else {
     f2.warn("This folder is not linked to any orchestration.");
-    f2.info(`Run ${import_picocolors37.default.cyan("brainbase orchestration pull <id>")} with an orchestration id,
-  or ${import_picocolors37.default.cyan("brainbase orchestration list")} to find one.`);
+    f2.info(`Run ${import_picocolors40.default.cyan("brainbase orchestration pull <id>")} with an orchestration id,
+  or ${import_picocolors40.default.cyan("brainbase orchestration list")} to find one.`);
     return;
   }
   const sp = de();
@@ -67109,24 +67575,24 @@ async function runOrchestrationPull(cwd2, args) {
   const slugFor = (agentId) => slugByAgent.get(agentId) ?? agentId;
   const planLines = [];
   planLines.push("");
-  planLines.push(`  ${import_picocolors37.default.bold(cloud.name)} ${import_picocolors37.default.dim(`(${cloud.id})`)}`);
+  planLines.push(`  ${import_picocolors40.default.bold(cloud.name)} ${import_picocolors40.default.dim(`(${cloud.id})`)}`);
   if (cloud.description)
-    planLines.push(`  ${import_picocolors37.default.dim(cloud.description)}`);
+    planLines.push(`  ${import_picocolors40.default.dim(cloud.description)}`);
   planLines.push("");
-  planLines.push(`  ${import_picocolors37.default.dim("members:")}`);
+  planLines.push(`  ${import_picocolors40.default.dim("members:")}`);
   for (const m3 of cloud.members) {
     const skipped = !m3.manifest;
-    const tail2 = skipped ? import_picocolors37.default.red(" (manifest unavailable — skipped)") : "";
-    planLines.push(`    ${import_picocolors37.default.cyan("•")} ${import_picocolors37.default.bold(slugFor(m3.agent_id))} ${import_picocolors37.default.dim(`(${m3.name})`)}${tail2}`);
+    const tail2 = skipped ? import_picocolors40.default.red(" (manifest unavailable — skipped)") : "";
+    planLines.push(`    ${import_picocolors40.default.cyan("•")} ${import_picocolors40.default.bold(slugFor(m3.agent_id))} ${import_picocolors40.default.dim(`(${m3.name})`)}${tail2}`);
   }
   if (cloud.edges.length) {
     planLines.push("");
-    planLines.push(`  ${import_picocolors37.default.dim("edges:")}`);
+    planLines.push(`  ${import_picocolors40.default.dim("edges:")}`);
     for (const e2 of cloud.edges) {
       const from = slugFor(e2.from_agent_id);
       const to2 = slugFor(e2.to_agent_id);
-      const desc = e2.description ? `  ${import_picocolors37.default.dim("— " + e2.description)}` : "";
-      planLines.push(`    ${import_picocolors37.default.cyan(from)} ${import_picocolors37.default.dim("→")} ${import_picocolors37.default.cyan(to2)}${desc}`);
+      const desc = e2.description ? `  ${import_picocolors40.default.dim("— " + e2.description)}` : "";
+      planLines.push(`    ${import_picocolors40.default.cyan(from)} ${import_picocolors40.default.dim("→")} ${import_picocolors40.default.cyan(to2)}${desc}`);
     }
   }
   planLines.push("");
@@ -67135,7 +67601,7 @@ async function runOrchestrationPull(cwd2, args) {
   const isRefresh = !!existingLink;
   if (!autoProceed(args.yes) && !isRefresh) {
     const ok = await se({
-      message: `Pull into ${import_picocolors37.default.bold(cwd2)}?`,
+      message: `Pull into ${import_picocolors40.default.bold(cwd2)}?`,
       initialValue: true
     });
     if (!ensureNotCancelled(ok)) {
@@ -67144,7 +67610,7 @@ async function runOrchestrationPull(cwd2, args) {
     }
   }
   const fallbackHarness = args.harness ?? "claude-code";
-  fs77.mkdirSync(cwd2, { recursive: true });
+  fs78.mkdirSync(cwd2, { recursive: true });
   if (hasOrchManifest(cwd2) && existingLink && existingLink.orchestration_id !== orchId) {
     f2.error(`This folder is linked to orchestration ${existingLink.orchestration_id}, not ${orchId}. Move to a fresh directory or unlink first.`);
     return;
@@ -67179,7 +67645,7 @@ async function runOrchestrationPull(cwd2, args) {
         scope: "project",
         pullSecrets: true
       });
-      memberSp.stop(`Installed ${import_picocolors37.default.bold(slug)} ${import_picocolors37.default.dim(`(${m3.manifest.components.length} components)`)}.`);
+      memberSp.stop(`Installed ${import_picocolors40.default.bold(slug)} ${import_picocolors40.default.dim(`(${m3.manifest.components.length} components)`)}.`);
       installedMembers.push({
         agent_id: m3.agent_id,
         slug,
@@ -67240,7 +67706,7 @@ async function runOrchestrationPull(cwd2, args) {
       payload_schema: e2.payload_schema ?? {}
     }))
   });
-  $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path86.basename(cwd2)}/ ${import_picocolors37.default.dim(`(${installedMembers.length}/${cloud.members.length} members)`)}.`);
+  $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path86.basename(cwd2)}/ ${import_picocolors40.default.dim(`(${installedMembers.length}/${cloud.members.length} members)`)}.`);
 }
 function handleApiError5(err) {
   if (err instanceof ApiError) {
@@ -67257,7 +67723,7 @@ function handleApiError5(err) {
 }
 
 // src/cli/orchestration-push.ts
-var import_picocolors38 = __toESM(require_picocolors(), 1);
+var import_picocolors41 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-outgoing.ts
 function buildOrchestrationGraphPayload(manifest, slugToAgentId) {
@@ -67340,7 +67806,7 @@ function findUnpushableMembers(cwd2, members) {
       continue;
     }
     if (!memberManifest.id) {
-      f2.error(`${m3.slug}: ${AGENT_MANIFEST_FILE} is unclaimed (no ${import_picocolors38.default.cyan("id")}), so there is nothing to push to.`);
+      f2.error(`${m3.slug}: ${AGENT_MANIFEST_FILE} is unclaimed (no ${import_picocolors41.default.cyan("id")}), so there is nothing to push to.`);
       blocked.push(m3.slug);
       continue;
     }
@@ -67355,12 +67821,12 @@ async function runOrchestrationPush(cwd2, args) {
   const link2 = readOrchLink(cwd2);
   if (!link2) {
     f2.warn("This folder is not linked to any orchestration.");
-    f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration pull <id>")} first.`);
+    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   if (!hasOrchManifest(cwd2)) {
-    f2.warn(`No ${import_picocolors38.default.bold(ORCH_MANIFEST_FILE)} here.`);
-    f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration pull")} to materialise the manifest before pushing.`);
+    f2.warn(`No ${import_picocolors41.default.bold(ORCH_MANIFEST_FILE)} here.`);
+    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull")} to materialise the manifest before pushing.`);
     return;
   }
   let manifest;
@@ -67384,7 +67850,7 @@ async function runOrchestrationPush(cwd2, args) {
   }
   if (missing.length) {
     f2.error(`Missing local checkouts for: ${missing.join(", ")}.`);
-    f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration pull")} to materialise the missing folders.`);
+    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull")} to materialise the missing folders.`);
     process.exitCode = 1;
     return;
   }
@@ -67405,13 +67871,13 @@ async function runOrchestrationPush(cwd2, args) {
     }
   }
   const plan = [""];
-  plan.push(`  ${import_picocolors38.default.bold(link2.name)} ${import_picocolors38.default.dim(`(${link2.orchestration_id})`)}`);
-  plan.push(`  ${import_picocolors38.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
+  plan.push(`  ${import_picocolors41.default.bold(link2.name)} ${import_picocolors41.default.dim(`(${link2.orchestration_id})`)}`);
+  plan.push(`  ${import_picocolors41.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
   plan.push("");
   if (!args.graphOnly) {
-    plan.push(`  ${import_picocolors38.default.dim("per-member agent push:")}`);
+    plan.push(`  ${import_picocolors41.default.dim("per-member agent push:")}`);
     for (const m3 of manifest.members) {
-      plan.push(`    ${import_picocolors38.default.cyan("•")} ${import_picocolors38.default.bold(m3.slug)}`);
+      plan.push(`    ${import_picocolors41.default.cyan("•")} ${import_picocolors41.default.bold(m3.slug)}`);
     }
     plan.push("");
   }
@@ -67431,7 +67897,7 @@ async function runOrchestrationPush(cwd2, args) {
     for (const m3 of manifest.members) {
       const dir = memberDir(cwd2, m3.slug);
       console.log("");
-      console.log(`${import_picocolors38.default.dim("───")} ${import_picocolors38.default.bold(m3.slug)} ${import_picocolors38.default.dim("───")}`);
+      console.log(`${import_picocolors41.default.dim("───")} ${import_picocolors41.default.bold(m3.slug)} ${import_picocolors41.default.dim("───")}`);
       const exitCodeBeforePush = process.exitCode;
       try {
         await runAgentPush(dir, { yes: true });
@@ -67495,7 +67961,7 @@ function handleApiError6(err) {
       f2.error("You do not have access to this orchestration.");
     } else if (err.status === 409) {
       f2.error(err.message);
-      f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration pull")} to reconcile, then push again.`);
+      f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull")} to reconcile, then push again.`);
     } else {
       f2.error(err.message);
     }
@@ -67505,13 +67971,13 @@ function handleApiError6(err) {
 }
 
 // src/cli/orchestration-status.ts
-var import_picocolors39 = __toESM(require_picocolors(), 1);
+var import_picocolors42 = __toESM(require_picocolors(), 1);
 async function runOrchestrationStatus(cwd2) {
   banner("orchestration status — what changed locally, remotely, both");
   const link2 = readOrchLink(cwd2);
   if (!link2) {
     f2.warn("This folder is not linked to any orchestration.");
-    f2.info(`Run ${import_picocolors39.default.cyan("brainbase orchestration pull <id>")} first.`);
+    f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   const localManifest = hasOrchManifest(cwd2) ? readOrchManifest(cwd2) : null;
@@ -67534,8 +68000,8 @@ async function runOrchestrationStatus(cwd2) {
   }
   const lines = [];
   lines.push("");
-  lines.push(`  ${import_picocolors39.default.bold(link2.name)} ${import_picocolors39.default.dim(`(${link2.orchestration_id})`)}`);
-  lines.push(`  ${import_picocolors39.default.dim("revision")}  cloud ${cloud.revision}${lock ? ` · lock ${lock.revision}` : " · never pulled"}`);
+  lines.push(`  ${import_picocolors42.default.bold(link2.name)} ${import_picocolors42.default.dim(`(${link2.orchestration_id})`)}`);
+  lines.push(`  ${import_picocolors42.default.dim("revision")}  cloud ${cloud.revision}${lock ? ` · lock ${lock.revision}` : " · never pulled"}`);
   lines.push("");
   const localSlugByAgentId = new Map;
   for (const m3 of localManifest?.members ?? []) {
@@ -67549,12 +68015,12 @@ async function runOrchestrationStatus(cwd2) {
   const membersAdded = [...localMemberSet].filter((s3) => !cloudMemberSet.has(s3));
   const membersRemoved = [...cloudMemberSet].filter((s3) => !localMemberSet.has(s3));
   if (membersAdded.length || membersRemoved.length) {
-    lines.push(`  ${import_picocolors39.default.bold("members")}`);
+    lines.push(`  ${import_picocolors42.default.bold("members")}`);
     for (const slug of membersAdded) {
-      lines.push(`    ${import_picocolors39.default.yellow("→ push")}  added in yaml: ${import_picocolors39.default.bold(slug)}`);
+      lines.push(`    ${import_picocolors42.default.yellow("→ push")}  added in yaml: ${import_picocolors42.default.bold(slug)}`);
     }
     for (const slug of membersRemoved) {
-      lines.push(`    ${import_picocolors39.default.cyan("← pull")}  added on cloud: ${import_picocolors39.default.bold(slug)}`);
+      lines.push(`    ${import_picocolors42.default.cyan("← pull")}  added on cloud: ${import_picocolors42.default.bold(slug)}`);
     }
     lines.push("");
   }
@@ -67569,11 +68035,11 @@ async function runOrchestrationStatus(cwd2) {
   const edgesAdded = [...localEdges.keys()].filter((k3) => !cloudEdges.has(k3));
   const edgesRemoved = [...cloudEdges.keys()].filter((k3) => !localEdges.has(k3));
   if (edgesAdded.length || edgesRemoved.length) {
-    lines.push(`  ${import_picocolors39.default.bold("edges")}`);
+    lines.push(`  ${import_picocolors42.default.bold("edges")}`);
     for (const k3 of edgesAdded)
-      lines.push(`    ${import_picocolors39.default.yellow("→ push")}  added in yaml: ${k3}`);
+      lines.push(`    ${import_picocolors42.default.yellow("→ push")}  added in yaml: ${k3}`);
     for (const k3 of edgesRemoved)
-      lines.push(`    ${import_picocolors39.default.cyan("← pull")}  added on cloud: ${k3}`);
+      lines.push(`    ${import_picocolors42.default.cyan("← pull")}  added on cloud: ${k3}`);
     lines.push("");
   }
   const cloudTriggerKey = (t) => {
@@ -67611,11 +68077,11 @@ async function runOrchestrationStatus(cwd2) {
   const triggersAdded = [...localTriggers.keys()].filter((k3) => !cloudTriggers.has(k3));
   const triggersRemoved = [...cloudTriggers.keys()].filter((k3) => !localTriggers.has(k3));
   if (triggersAdded.length || triggersRemoved.length) {
-    lines.push(`  ${import_picocolors39.default.bold("schedule triggers")}`);
+    lines.push(`  ${import_picocolors42.default.bold("schedule triggers")}`);
     for (const k3 of triggersAdded)
-      lines.push(`    ${import_picocolors39.default.yellow("→ push")}  added/changed in yaml: ${localTriggers.get(k3) ?? k3}`);
+      lines.push(`    ${import_picocolors42.default.yellow("→ push")}  added/changed in yaml: ${localTriggers.get(k3) ?? k3}`);
     for (const k3 of triggersRemoved)
-      lines.push(`    ${import_picocolors39.default.cyan("← pull")}  added/changed on cloud: ${cloudTriggers.get(k3) ?? k3}`);
+      lines.push(`    ${import_picocolors42.default.cyan("← pull")}  added/changed on cloud: ${cloudTriggers.get(k3) ?? k3}`);
     lines.push("");
   }
   const lockByAgentId = new Map((lock?.members ?? []).map((m3) => [m3.agent_id, m3]));
@@ -67638,27 +68104,27 @@ async function runOrchestrationStatus(cwd2) {
     }
   }
   if (memberDrift.length) {
-    lines.push(`  ${import_picocolors39.default.bold("member content drift")}`);
+    lines.push(`  ${import_picocolors42.default.bold("member content drift")}`);
     for (const d3 of memberDrift) {
-      lines.push(`    ${import_picocolors39.default.cyan("?")} ${import_picocolors39.default.bold(d3.slug)}  ${import_picocolors39.default.dim("— " + d3.reason)}`);
+      lines.push(`    ${import_picocolors42.default.cyan("?")} ${import_picocolors42.default.bold(d3.slug)}  ${import_picocolors42.default.dim("— " + d3.reason)}`);
     }
-    lines.push(`    ${import_picocolors39.default.dim("cd into each member folder and run")} ${import_picocolors39.default.cyan("brainbase agent status")}`);
+    lines.push(`    ${import_picocolors42.default.dim("cd into each member folder and run")} ${import_picocolors42.default.cyan("brainbase agent status")}`);
     lines.push("");
   }
   const revisionDrift = lock?.revision != null && cloud.revision !== lock.revision;
   if (revisionDrift) {
-    lines.push(`  ${import_picocolors39.default.bold("cloud revision")}`);
-    lines.push(`    ${import_picocolors39.default.cyan("← pull")}  cloud changed since last pull: ${import_picocolors39.default.dim(`lock ${lock.revision} → cloud ${cloud.revision}`)}`);
+    lines.push(`  ${import_picocolors42.default.bold("cloud revision")}`);
+    lines.push(`    ${import_picocolors42.default.cyan("← pull")}  cloud changed since last pull: ${import_picocolors42.default.dim(`lock ${lock.revision} → cloud ${cloud.revision}`)}`);
     lines.push("");
   }
   if (!membersAdded.length && !membersRemoved.length && !edgesAdded.length && !edgesRemoved.length && !triggersAdded.length && !triggersRemoved.length && !memberDrift.length && !revisionDrift) {
-    lines.push(`  ${import_picocolors39.default.green("✓")} everything is in sync`);
+    lines.push(`  ${import_picocolors42.default.green("✓")} everything is in sync`);
     lines.push("");
     console.log(lines.join(`
 `));
     return;
   }
-  lines.push(`  ${import_picocolors39.default.dim("run")} ${import_picocolors39.default.cyan("brainbase orchestration pull")} ${import_picocolors39.default.dim("to apply cloud changes,")} ${import_picocolors39.default.cyan("brainbase orchestration push")} ${import_picocolors39.default.dim("to send yours")}`);
+  lines.push(`  ${import_picocolors42.default.dim("run")} ${import_picocolors42.default.cyan("brainbase orchestration pull")} ${import_picocolors42.default.dim("to apply cloud changes,")} ${import_picocolors42.default.cyan("brainbase orchestration push")} ${import_picocolors42.default.dim("to send yours")}`);
   lines.push("");
   console.log(lines.join(`
 `));
@@ -67673,7 +68139,7 @@ function stableJson(value) {
 }
 
 // src/cli/orchestration-list.ts
-var import_picocolors40 = __toESM(require_picocolors(), 1);
+var import_picocolors43 = __toESM(require_picocolors(), 1);
 async function runOrchestrationList(args) {
   banner("orchestration list — orchestrations under a team");
   const { org, team } = await resolveOrgAndTeam({
@@ -67697,21 +68163,21 @@ async function runOrchestrationList(args) {
   }
   const lines = [""];
   for (const o2 of items) {
-    lines.push(`  ${import_picocolors40.default.bold(o2.name)}  ${import_picocolors40.default.dim(o2.id)}`);
+    lines.push(`  ${import_picocolors43.default.bold(o2.name)}  ${import_picocolors43.default.dim(o2.id)}`);
     if (o2.description)
-      lines.push(`    ${import_picocolors40.default.dim(o2.description)}`);
-    lines.push(`    ${import_picocolors40.default.dim(`${o2.member_count} member${o2.member_count === 1 ? "" : "s"} · ${o2.edge_count} edge${o2.edge_count === 1 ? "" : "s"}`)}`);
+      lines.push(`    ${import_picocolors43.default.dim(o2.description)}`);
+    lines.push(`    ${import_picocolors43.default.dim(`${o2.member_count} member${o2.member_count === 1 ? "" : "s"} · ${o2.edge_count} edge${o2.edge_count === 1 ? "" : "s"}`)}`);
     lines.push("");
   }
-  lines.push(`  ${import_picocolors40.default.dim("pull one with")} ${import_picocolors40.default.cyan("brainbase orchestration pull <id>")}`);
+  lines.push(`  ${import_picocolors43.default.dim("pull one with")} ${import_picocolors43.default.cyan("brainbase orchestration pull <id>")}`);
   lines.push("");
   console.log(lines.join(`
 `));
 }
 
 // src/cli/orchestration-add-agent.ts
-import fs78 from "node:fs";
-var import_picocolors41 = __toESM(require_picocolors(), 1);
+import fs79 from "node:fs";
+var import_picocolors44 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-add.ts
 function resolveOrgIdForGroup(groupId, orgsWithTeams) {
@@ -67776,7 +68242,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   const link2 = readOrchLink(cwd2);
   if (!link2 || !hasOrchManifest(cwd2)) {
     f2.warn("This folder is not a linked orchestration.");
-    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull <id>")} first.`);
+    f2.info(`Run ${import_picocolors44.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   let manifest;
@@ -67796,13 +68262,13 @@ async function runOrchestrationAddAgent(cwd2, args) {
     })).trim();
   }
   let slug = slugifyMemberName(name);
-  if (manifest.members.some((m3) => m3.slug === slug) || fs78.existsSync(memberDir(cwd2, slug))) {
+  if (manifest.members.some((m3) => m3.slug === slug) || fs79.existsSync(memberDir(cwd2, slug))) {
     let n = 2;
     let candidate = `${slug}-${n}`;
-    while (manifest.members.some((m3) => m3.slug === candidate) || fs78.existsSync(memberDir(cwd2, candidate))) {
+    while (manifest.members.some((m3) => m3.slug === candidate) || fs79.existsSync(memberDir(cwd2, candidate))) {
       candidate = `${slug}-${++n}`;
     }
-    f2.info(`Slug ${import_picocolors41.default.bold(slug)} is taken — using ${import_picocolors41.default.bold(candidate)}.`);
+    f2.info(`Slug ${import_picocolors44.default.bold(slug)} is taken — using ${import_picocolors44.default.bold(candidate)}.`);
     slug = candidate;
   }
   let payloadSchema;
@@ -67826,7 +68292,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
       const resolved = resolveOrgIdForGroup(link2.group_id, orgsWithTeams);
       if (!resolved) {
         sp.stop("Failed.");
-        f2.error(`Could not find an org that owns group ${import_picocolors41.default.bold(link2.group_id)}. ` + `Pass ${import_picocolors41.default.cyan("--org <id>")} explicitly.`);
+        f2.error(`Could not find an org that owns group ${import_picocolors44.default.bold(link2.group_id)}. ` + `Pass ${import_picocolors44.default.cyan("--org <id>")} explicitly.`);
         return;
       }
       orgId = resolved;
@@ -67843,14 +68309,14 @@ async function runOrchestrationAddAgent(cwd2, args) {
   if (from.length === 0 && to2.length === 0 && isInteractive() && manifest.members.length > 0) {
     const memberOptions = manifest.members.map((m3) => ({ value: m3.slug, label: m3.slug }));
     const pickedFrom = await ae({
-      message: `Connect ${import_picocolors41.default.bold(slug)} FROM which member(s)? — edges INTO ${slug} (space to select, enter to skip)`,
+      message: `Connect ${import_picocolors44.default.bold(slug)} FROM which member(s)? — edges INTO ${slug} (space to select, enter to skip)`,
       options: memberOptions,
       required: false
     });
     if (Array.isArray(pickedFrom))
       from = pickedFrom;
     const pickedTo = await ae({
-      message: `Connect ${import_picocolors41.default.bold(slug)} TO which member(s)? — edges OUT of ${slug} (space to select, enter to skip)`,
+      message: `Connect ${import_picocolors44.default.bold(slug)} TO which member(s)? — edges OUT of ${slug} (space to select, enter to skip)`,
       options: memberOptions,
       required: false
     });
@@ -67871,7 +68337,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   }
   const dest = memberDir(cwd2, slug);
   try {
-    fs78.mkdirSync(dest, { recursive: true });
+    fs79.mkdirSync(dest, { recursive: true });
     await runAgentCreate(dest, {
       name,
       orgId,
@@ -67882,30 +68348,30 @@ async function runOrchestrationAddAgent(cwd2, args) {
     });
   } catch (err) {
     try {
-      fs78.rmSync(dest, { recursive: true, force: true });
+      fs79.rmSync(dest, { recursive: true, force: true });
     } catch {}
     f2.error(`Failed to create ${slug}: ${err.message}`);
     return;
   }
   writeOrchManifest(cwd2, updated);
   if (args.noPush) {
-    f2.info(`Manifest updated. Run ${import_picocolors41.default.cyan("brainbase orchestration push")} to apply.`);
+    f2.info(`Manifest updated. Run ${import_picocolors44.default.cyan("brainbase orchestration push")} to apply.`);
     return;
   }
   await runOrchestrationPush(cwd2, { yes: true, graphOnly: true });
 }
 
 // src/cli/orchestration-create.ts
-var import_picocolors42 = __toESM(require_picocolors(), 1);
+var import_picocolors45 = __toESM(require_picocolors(), 1);
 async function runOrchestrationCreate(cwd2, args) {
   banner("orchestration create — claim a brainbase-orchestration.yaml");
   if (readOrchLink(cwd2)) {
     f2.warn("This folder is already linked to an orchestration.");
-    f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration push")} to update it.`);
+    f2.info(`Run ${import_picocolors45.default.cyan("brainbase orchestration push")} to update it.`);
     return;
   }
   if (!hasOrchManifest(cwd2)) {
-    f2.warn(`No ${import_picocolors42.default.bold(ORCH_MANIFEST_FILE)} here.`);
+    f2.warn(`No ${import_picocolors45.default.bold(ORCH_MANIFEST_FILE)} here.`);
     f2.info(`Create one, or pull an existing orchestration first.`);
     return;
   }
@@ -67938,10 +68404,10 @@ async function runOrchestrationCreate(cwd2, args) {
   });
   const plan = [
     "",
-    `  ${import_picocolors42.default.bold(manifest.orchestration.name)}`,
-    `  ${import_picocolors42.default.dim("org")}      ${import_picocolors42.default.bold(target.org.name)}`,
-    `  ${import_picocolors42.default.dim("team")}     ${import_picocolors42.default.bold(target.team.name)}`,
-    `  ${import_picocolors42.default.dim("graph")}    ${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`,
+    `  ${import_picocolors45.default.bold(manifest.orchestration.name)}`,
+    `  ${import_picocolors45.default.dim("org")}      ${import_picocolors45.default.bold(target.org.name)}`,
+    `  ${import_picocolors45.default.dim("team")}     ${import_picocolors45.default.bold(target.team.name)}`,
+    `  ${import_picocolors45.default.dim("graph")}    ${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`,
     ""
   ];
   console.log(plan.join(`
@@ -67971,7 +68437,7 @@ async function runOrchestrationCreate(cwd2, args) {
       edges: graph.edges,
       triggers: graph.triggers
     });
-    sp.stop(`Created ${import_picocolors42.default.bold(created.name)}.`);
+    sp.stop(`Created ${import_picocolors45.default.bold(created.name)}.`);
     writeOrchLink(cwd2, {
       schemaVersion: 1,
       orchestration_id: created.id,
@@ -68084,21 +68550,21 @@ async function runOrchestration(cwd2, sub, args, opts) {
 function printHelp3() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors43.default.bold("brainbase orchestration")} ${import_picocolors43.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors46.default.bold("brainbase orchestration")} ${import_picocolors46.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors43.default.cyan("create")}           ${import_picocolors43.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
-  out.push(`  ${import_picocolors43.default.cyan("pull")} ${import_picocolors43.default.dim("<id>")}      ${import_picocolors43.default.dim("fetch orchestration + every member agent into this folder")}`);
-  out.push(`  ${import_picocolors43.default.cyan("push")}             ${import_picocolors43.default.dim("push each member, then update the orchestration graph")}`);
-  out.push(`  ${import_picocolors43.default.cyan("add-agent")} ${import_picocolors43.default.dim("<name>")}    ${import_picocolors43.default.dim("create a member agent, wire edges (--from/--to), and push")}`);
-  out.push(`  ${import_picocolors43.default.cyan("status")}           ${import_picocolors43.default.dim("show what would push and what would pull")}`);
-  out.push(`  ${import_picocolors43.default.cyan("list")}             ${import_picocolors43.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors46.default.cyan("create")}           ${import_picocolors46.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors46.default.cyan("pull")} ${import_picocolors46.default.dim("<id>")}      ${import_picocolors46.default.dim("fetch orchestration + every member agent into this folder")}`);
+  out.push(`  ${import_picocolors46.default.cyan("push")}             ${import_picocolors46.default.dim("push each member, then update the orchestration graph")}`);
+  out.push(`  ${import_picocolors46.default.cyan("add-agent")} ${import_picocolors46.default.dim("<name>")}    ${import_picocolors46.default.dim("create a member agent, wire edges (--from/--to), and push")}`);
+  out.push(`  ${import_picocolors46.default.cyan("status")}           ${import_picocolors46.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors46.default.cyan("list")}             ${import_picocolors46.default.dim("list orchestrations under a team")}`);
   out.push("");
-  out.push(`  ${import_picocolors43.default.bold("Flags")}`);
-  out.push(`    ${import_picocolors43.default.dim("--yes, -y")}        skip confirmations`);
-  out.push(`    ${import_picocolors43.default.dim("--harness <id>")}   harness for newly-created member folders (default claude-code)`);
-  out.push(`    ${import_picocolors43.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`);
-  out.push(`    ${import_picocolors43.default.dim("--org <id>")}       for create/list: org id or slug (CLI vocab — DB teams.id)`);
-  out.push(`    ${import_picocolors43.default.dim("--team <id>")}      for create/list: team id (CLI vocab — DB groups.id)`);
+  out.push(`  ${import_picocolors46.default.bold("Flags")}`);
+  out.push(`    ${import_picocolors46.default.dim("--yes, -y")}        skip confirmations`);
+  out.push(`    ${import_picocolors46.default.dim("--harness <id>")}   harness for newly-created member folders (default claude-code)`);
+  out.push(`    ${import_picocolors46.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`);
+  out.push(`    ${import_picocolors46.default.dim("--org <id>")}       for create/list: org id or slug (CLI vocab — DB teams.id)`);
+  out.push(`    ${import_picocolors46.default.dim("--team <id>")}      for create/list: team id (CLI vocab — DB groups.id)`);
   out.push("");
   console.log(out.join(`
 `));
@@ -68143,11 +68609,11 @@ async function runRun(cwd2, args) {
 }
 
 // src/cli/publish.ts
-var import_picocolors44 = __toESM(require_picocolors(), 1);
+var import_picocolors47 = __toESM(require_picocolors(), 1);
 function runPublish() {
   banner("publish — moved");
-  f2.error(`${import_picocolors44.default.bold("brainbase publish")} does not exist.`);
-  f2.info(`Use ${import_picocolors44.default.cyan("brainbase agent push")} to send your local changes to the cloud.`);
+  f2.error(`${import_picocolors47.default.bold("brainbase publish")} does not exist.`);
+  f2.info(`Use ${import_picocolors47.default.cyan("brainbase agent push")} to send your local changes to the cloud.`);
   process.exit(1);
 }
 
@@ -68446,7 +68912,7 @@ async function runStatus(cwd2) {
 }
 
 // src/cli/token.ts
-var import_picocolors45 = __toESM(require_picocolors(), 1);
+var import_picocolors48 = __toESM(require_picocolors(), 1);
 
 // src/ui/ink/TokenCards.tsx
 var jsx_dev_runtime17 = __toESM(require_jsx_dev_runtime(), 1);
@@ -68707,6 +69173,10 @@ async function showTokenListCard(props) {
 // src/cli/token.ts
 var DEFAULT_SCOPES = ["read", "publish"];
 var MAX_NAME_LENGTH = 128;
+var ALLOWED_SCOPES = ["read", "publish", "admin"];
+function isAllowedScope(value) {
+  return ALLOWED_SCOPES.includes(value);
+}
 function isExpired2(token) {
   return Boolean(token.expires_at && Date.parse(token.expires_at) <= Date.now());
 }
@@ -68727,7 +69197,14 @@ async function runTokenCreate(args) {
       flagHint: "Pass --name <label>."
     });
   }
-  const scopes = args.scopes && args.scopes.length > 0 ? args.scopes : DEFAULT_SCOPES;
+  let scopes;
+  if (args.scopes === undefined) {
+    scopes = DEFAULT_SCOPES;
+  } else if (args.scopes.length === 0) {
+    throw new Error("Usage: brainbase token create --scopes <list>  (allowed: read, publish, admin)");
+  } else {
+    scopes = args.scopes;
+  }
   const spinner = de();
   spinner.start("Creating token…");
   const created = await registryApi.createCliToken({
@@ -68812,7 +69289,7 @@ async function runTokenRename(args) {
     return;
   };
   let name;
-  if (args.name === undefined) {
+  if (!args.name) {
     const answer = await text({
       message: "New label",
       placeholder: target.name,
@@ -68828,7 +69305,7 @@ async function runTokenRename(args) {
     }
   }
   if (name === target.name.trim()) {
-    console.log(`${sym.ok} ${import_picocolors45.default.bold(target.name.trim())} already has that label; nothing to do.`);
+    console.log(`${sym.ok} ${import_picocolors48.default.bold(target.name.trim())} already has that label; nothing to do.`);
     return;
   }
   try {
@@ -68836,27 +69313,32 @@ async function runTokenRename(args) {
   } catch (error) {
     throw withLoginHint(error);
   }
-  console.log(`${sym.ok} Renamed ${import_picocolors45.default.dim(target.name)} → ${import_picocolors45.default.bold(name)}`);
+  console.log(`${sym.ok} Renamed ${import_picocolors48.default.dim(target.name)} → ${import_picocolors48.default.bold(name)}`);
 }
 async function runTokenRevoke(args) {
   if (!args.id) {
     console.error("Usage: brainbase token revoke <id>");
     process.exit(1);
   }
-  const tokens = await registryApi.listCliTokens();
+  let tokens;
+  try {
+    tokens = await registryApi.listCliTokens();
+  } catch (error) {
+    throw withLoginHint(error);
+  }
   const target = tokens.find((t) => t.id === args.id);
   if (!target) {
     throw new Error(`No token with id ${args.id}. Run \`brainbase token list\` to see yours.`);
   }
   if (target.revoked_at) {
-    reconcileDeadToken(target, `${import_picocolors45.default.bold(target.name)} is already revoked.`);
+    reconcileDeadToken(target, `${import_picocolors48.default.bold(target.name)} is already revoked.`);
     return;
   }
   const stored = readToken();
   const isLocalToken = Boolean(stored && stored.token.startsWith(target.prefix));
   if (!autoProceed(args.yes)) {
     const ok = await se({
-      message: isLocalToken ? `Revoke ${import_picocolors45.default.bold(target.name)} (${args.id})? This is the token this CLI is using, so it will stop working here too.` : `Revoke ${import_picocolors45.default.bold(target.name)} (${args.id})? CIs and machines using it will stop working.`,
+      message: isLocalToken ? `Revoke ${import_picocolors48.default.bold(target.name)} (${args.id})? This is the token this CLI is using, so it will stop working here too.` : `Revoke ${import_picocolors48.default.bold(target.name)} (${args.id})? CIs and machines using it will stop working.`,
       initialValue: false
     });
     if (!ensureNotCancelled(ok))
@@ -68866,16 +69348,15 @@ async function runTokenRevoke(args) {
     await registryApi.revokeCliToken(args.id);
   } catch (error) {
     if (error instanceof ApiError && error.status === 404) {
-      const expiryPassed = Boolean(target.expires_at && Date.parse(target.expires_at) <= Date.now());
-      if (expiryPassed) {
-        reconcileDeadToken(target, `${import_picocolors45.default.bold(target.name)} had already expired.`);
+      if (isExpired2(target)) {
+        reconcileDeadToken(target, `${import_picocolors48.default.bold(target.name)} had already expired.`);
         return;
       }
       throw new Error(`The server reported no active token with id ${args.id}, but it listed one a moment ago. ` + "The local token has been left alone, since that key may still work. " + "If this server predates `DELETE /v1/registry/cli-tokens/{id}`, revoke from the web app instead.");
     }
     throw error;
   }
-  reconcileDeadToken(target, `Revoked ${import_picocolors45.default.bold(target.name)}.`);
+  reconcileDeadToken(target, `Revoked ${import_picocolors48.default.bold(target.name)}.`);
 }
 function reconcileDeadToken(target, headline) {
   let outcome;
@@ -68909,17 +69390,35 @@ function reportLocalToken(headline, outcome) {
 }
 async function runTokenClear() {
   if (!readToken()) {
-    console.log(import_picocolors45.default.dim("No local token stored."));
+    console.log(import_picocolors48.default.dim("No local token stored."));
     return;
   }
   clearToken();
   console.log(`${sym.ok} Cleared local token. (Server-side token still active until revoked.)`);
 }
+var TOKEN_VALUE_FLAGS = new Set(["--name", "-n", "--scope", "--scopes"]);
+function isValueOfPriorFlag(rest2, index) {
+  return index > 0 && TOKEN_VALUE_FLAGS.has(rest2[index - 1]);
+}
 function pickFlag(rest2, ...names) {
   for (const n of names) {
-    const i = rest2.indexOf(n);
-    if (i !== -1 && i + 1 < rest2.length)
-      return rest2[i + 1];
+    const prefix = `${n}=`;
+    for (let i = 0;i < rest2.length; i++) {
+      if (isValueOfPriorFlag(rest2, i))
+        continue;
+      const a3 = rest2[i];
+      if (a3 === n) {
+        const v3 = rest2[i + 1];
+        if (v3 === undefined)
+          return "";
+        const label = n === "--name" || n === "-n";
+        if (!label && v3.startsWith("-"))
+          return "";
+        return v3;
+      }
+      if (a3.startsWith(prefix))
+        return a3.slice(prefix.length);
+    }
   }
   return;
 }
@@ -68938,9 +69437,17 @@ function firstPositional(rest2, ...valueFlags) {
   return;
 }
 function parseScopes(raw) {
-  if (!raw)
+  if (raw === undefined)
     return;
-  return raw.split(",").map((s3) => s3.trim()).filter((s3) => s3.length > 0);
+  const scopes = raw.split(",").map((s3) => s3.trim().toLowerCase()).filter((s3) => s3.length > 0);
+  if (scopes.length === 0) {
+    throw new Error("Usage: brainbase token create --scopes <list>  (allowed: read, publish, admin)");
+  }
+  const unknown = scopes.filter((s3) => !isAllowedScope(s3));
+  if (unknown.length > 0) {
+    throw new Error(`Unknown scope${unknown.length === 1 ? "" : "s"} ${unknown.join(", ")} — allowed: read, publish, admin`);
+  }
+  return scopes;
 }
 async function runToken(sub, rest2, args) {
   const nameFlag = args.name || pickFlag(rest2, "--name", "-n");
@@ -68983,32 +69490,32 @@ async function runToken(sub, rest2, args) {
 function printTokenHelp() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors45.default.bold("brainbase token")} ${import_picocolors45.default.dim("<command>")}`);
+  out.push(`  ${import_picocolors48.default.bold("brainbase token")} ${import_picocolors48.default.dim("<command>")}`);
   out.push("");
-  out.push(`  ${import_picocolors45.default.cyan("create")}                        ${import_picocolors45.default.dim("issue a new long-lived CLI key (PAT)")}`);
-  out.push(`  ${import_picocolors45.default.cyan("list")}                          ${import_picocolors45.default.dim("show your tokens")}`);
-  out.push(`  ${import_picocolors45.default.cyan("rename")} ${import_picocolors45.default.dim("<id>")}                  ${import_picocolors45.default.dim("relabel a token by id")}`);
-  out.push(`  ${import_picocolors45.default.cyan("revoke")} ${import_picocolors45.default.dim("<id>")}                  ${import_picocolors45.default.dim("revoke a token by id")}`);
-  out.push(`  ${import_picocolors45.default.cyan("clear")}                         ${import_picocolors45.default.dim("forget the local token (does not revoke)")}`);
+  out.push(`  ${import_picocolors48.default.cyan("create")}                        ${import_picocolors48.default.dim("issue a new long-lived CLI key (PAT)")}`);
+  out.push(`  ${import_picocolors48.default.cyan("list")}                          ${import_picocolors48.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors48.default.cyan("rename")} ${import_picocolors48.default.dim("<id>")}                  ${import_picocolors48.default.dim("relabel a token by id")}`);
+  out.push(`  ${import_picocolors48.default.cyan("revoke")} ${import_picocolors48.default.dim("<id>")}                  ${import_picocolors48.default.dim("revoke a token by id")}`);
+  out.push(`  ${import_picocolors48.default.cyan("clear")}                         ${import_picocolors48.default.dim("forget the local token (does not revoke)")}`);
   out.push("");
-  out.push(`  ${import_picocolors45.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors45.default.cyan("--name, -n")} ${import_picocolors45.default.dim("<label>")}        ${import_picocolors45.default.dim("token label (prompted if omitted)")}`);
-  out.push(`  ${import_picocolors45.default.cyan("--scopes")} ${import_picocolors45.default.dim("<list>")}           ${import_picocolors45.default.dim("comma-separated; allowed: read, publish, admin")}`);
-  out.push(`                                ${import_picocolors45.default.dim("default: read,publish")}`);
+  out.push(`  ${import_picocolors48.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors48.default.cyan("--name, -n")} ${import_picocolors48.default.dim("<label>")}        ${import_picocolors48.default.dim("token label (prompted if omitted)")}`);
+  out.push(`  ${import_picocolors48.default.cyan("--scopes")} ${import_picocolors48.default.dim("<list>")}           ${import_picocolors48.default.dim("comma-separated; allowed: read, publish, admin")}`);
+  out.push(`                                ${import_picocolors48.default.dim("default: read,publish")}`);
   out.push("");
-  out.push(`  ${import_picocolors45.default.bold("rename flags")}`);
-  out.push(`  ${import_picocolors45.default.cyan("--name, -n")} ${import_picocolors45.default.dim("<label>")}        ${import_picocolors45.default.dim("new label (prompted if omitted)")}`);
+  out.push(`  ${import_picocolors48.default.bold("rename flags")}`);
+  out.push(`  ${import_picocolors48.default.cyan("--name, -n")} ${import_picocolors48.default.dim("<label>")}        ${import_picocolors48.default.dim("new label (prompted if omitted)")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/mcp.ts
-var import_picocolors46 = __toESM(require_picocolors(), 1);
+var import_picocolors49 = __toESM(require_picocolors(), 1);
 
 // src/core/mcp-check/collect-servers.ts
 import path87 from "node:path";
-import fs79 from "node:fs";
+import fs80 from "node:fs";
 function collectServers(cwd2, env3 = process.env) {
   const out = [];
   const seen = new Set;
@@ -69062,7 +69569,7 @@ function* readResolvedMcps(cwd2) {
   const p2 = path87.join(cwd2, ".brainbase", "resolved-mcps.json");
   let raw;
   try {
-    raw = fs79.readFileSync(p2, "utf-8");
+    raw = fs80.readFileSync(p2, "utf-8");
   } catch {
     return;
   }
@@ -69122,10 +69629,19 @@ function classifyError(err) {
   }
   return "protocol_error";
 }
+var CREDENTIAL_NAMES = "(x-api-key|api[-_]?key|auth[-_]?token|access[-_]?token|private[-_]?token|secret)";
 var REDACTIONS = [
   [/https?:\/\/[^\s'"`]+/gi, "[url]"],
   [/Bearer\s+\S+/gi, "Bearer [redacted]"],
-  [/\bbb(?:pat|_live)_[A-Za-z0-9._-]+/g, "[redacted]"]
+  [/\bbb(?:pat|_live)_[A-Za-z0-9._-]+/g, "[redacted]"],
+  [
+    new RegExp(`\\b${CREDENTIAL_NAMES}\\b([\\s:=]*)(["'])[^"']+\\3`, "gi"),
+    "$1$2$3[redacted]$3"
+  ],
+  [
+    new RegExp(`\\b${CREDENTIAL_NAMES}\\b(\\s*[:=]\\s*)["']?[^\\s,;"'}]+`, "gi"),
+    "$1$2[redacted]"
+  ]
 ];
 function redactSecrets2(msg) {
   let out = msg;
@@ -77252,11 +77768,11 @@ function withTimeout(inner, ms2, label) {
 function isTransient(status) {
   return status === "unreachable";
 }
-async function probeWithConnector(server, connect, opts) {
+async function probeWithConnector(server, connect2, opts) {
   let lastErr;
   for (let attempt2 = 0;attempt2 < 2; attempt2++) {
     try {
-      const { toolCount } = await connect(server, opts.timeoutMs);
+      const { toolCount } = await connect2(server, opts.timeoutMs);
       return { name: server.name, status: "ok", tool_count: toolCount, error: null };
     } catch (err) {
       lastErr = err;
@@ -77332,42 +77848,177 @@ async function runMcpCheck(cwd2, options) {
       }
     }));
     results.sort((a3, b4) => a3.name.localeCompare(b4.name));
-    const report = {
+    const report2 = {
       check_status: deriveCheckStatus(results),
       servers: results
     };
     if (options.json) {
-      write(JSON.stringify(report) + `
+      write(JSON.stringify(report2) + `
 `);
     } else {
-      write(renderHuman(report));
+      write(renderHuman(report2));
     }
-    return { exitCode: 0, report };
+    return { exitCode: 0, report: report2 };
   } catch (err) {
     writeErr(`brainbase mcp check failed to run: ${truncateError(err) ?? "unknown error"}
 `);
     return { exitCode: 1 };
   }
 }
-function renderHuman(report) {
+function renderHuman(report2) {
   const lines = [];
-  if (report.check_status === "skipped") {
-    lines.push(import_picocolors46.default.dim("No MCP servers configured — nothing to check."));
+  if (report2.check_status === "skipped") {
+    lines.push(import_picocolors49.default.dim("No MCP servers configured — nothing to check."));
     return lines.join(`
 `) + `
 `;
   }
-  for (const s3 of report.servers) {
-    const mark = s3.status === "ok" ? import_picocolors46.default.green("✓") : s3.status === "auth_failed" ? import_picocolors46.default.red("✗") : import_picocolors46.default.yellow("⚠");
-    const detail = s3.status === "ok" ? import_picocolors46.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors46.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
+  for (const s3 of report2.servers) {
+    const mark = s3.status === "ok" ? import_picocolors49.default.green("✓") : s3.status === "auth_failed" ? import_picocolors49.default.red("✗") : import_picocolors49.default.yellow("⚠");
+    const detail = s3.status === "ok" ? import_picocolors49.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors49.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
     lines.push(`  ${mark} ${s3.name}  ${detail}`);
   }
-  const summary = report.check_status === "ok" ? import_picocolors46.default.green("All MCP servers connected.") : import_picocolors46.default.yellow("Some MCP servers are unhealthy.");
+  const summary = report2.check_status === "ok" ? import_picocolors49.default.green("All MCP servers connected.") : import_picocolors49.default.yellow("Some MCP servers are unhealthy.");
   lines.push("", summary);
   return lines.join(`
 `) + `
 `;
 }
+async function runMcpList(cwd2, options) {
+  const write = options.write ?? ((s3) => process.stdout.write(s3));
+  const writeErr = options.writeErr ?? ((s3) => process.stderr.write(s3));
+  const fetchServers = options.fetchServers ?? ((id) => api.listAgentMcpServers(id));
+  const resolveAgentId = options.resolveAgentId ?? ((dir) => readLink(dir)?.agent_id ?? null);
+  const agentId = resolveAgentId(cwd2);
+  if (!agentId) {
+    if (options.json) {
+      write(JSON.stringify({ linked: false, servers: [] }) + `
+`);
+    } else {
+      writeErr("This folder is not linked to any agent. Run `brainbase link` first.\n");
+    }
+    return 1;
+  }
+  let report2;
+  try {
+    report2 = await fetchServers(agentId);
+  } catch (err) {
+    if (options.json) {
+      write(JSON.stringify({ error: err.message }) + `
+`);
+    } else {
+      writeErr(`brainbase mcp list failed: ${err.message}
+`);
+    }
+    return 1;
+  }
+  if (options.json) {
+    write(JSON.stringify({ linked: true, ...sanitizeReport(report2) }) + `
+`);
+  } else {
+    write(renderServerList(report2.servers));
+  }
+  return 0;
+}
+function sanitizeReport(report2) {
+  return {
+    ...report2,
+    servers: report2.servers.map((s3) => ({
+      ...s3,
+      url: sanitizeUrl(s3.url),
+      command: sanitizeCommand(s3.command),
+      last_error: s3.last_error ? truncateError(s3.last_error) : s3.last_error
+    }))
+  };
+}
+function sanitizeUrl(url2) {
+  if (!url2)
+    return url2;
+  try {
+    const parsed = new URL(url2);
+    parsed.search = "";
+    parsed.hash = "";
+    parsed.username = "";
+    parsed.password = "";
+    return parsed.toString();
+  } catch {
+    return null;
+  }
+}
+function sanitizeCommand(command) {
+  if (!command)
+    return command;
+  return command.trim().split(/\s+/)[0] ?? null;
+}
+var AUTH_LABEL = {
+  none: "",
+  oauth_required: "needs authorization",
+  oauth_connected: "authorized",
+  oauth_expired: "authorization expired — reconnect"
+};
+var HEALTH_LABEL = {
+  unreachable: "unreachable",
+  protocol_error: "connection error",
+  auth_failed: "last check failed to authenticate",
+  expired: "last check saw an expired token",
+  unknown: "last check inconclusive"
+};
+function healthLabel(server) {
+  const status = server.last_status;
+  if (!status || status === "ok")
+    return;
+  return HEALTH_LABEL[status] ?? `last check: ${status}`;
+}
+function isUnhealthy(server) {
+  return Boolean(server.last_status) && server.last_status !== "ok";
+}
+function renderServerList(servers) {
+  if (servers.length === 0) {
+    return import_picocolors49.default.dim("No MCP servers configured for this agent.") + `
+`;
+  }
+  const lines = [""];
+  for (const s3 of servers) {
+    const mark = s3.auth === "oauth_expired" ? import_picocolors49.default.red("✗") : s3.auth === "oauth_required" || isUnhealthy(s3) ? import_picocolors49.default.yellow("!") : !s3.is_enabled ? import_picocolors49.default.dim("·") : import_picocolors49.default.green("✓");
+    const bits = [s3.transport];
+    if (!s3.is_enabled)
+      bits.push("disabled");
+    const label = AUTH_LABEL[s3.auth];
+    if (label)
+      bits.push(label);
+    const health = healthLabel(s3);
+    if (health)
+      bits.push(health);
+    const expiry = describeExpiry(s3);
+    if (expiry)
+      bits.push(expiry);
+    lines.push(`  ${mark} ${import_picocolors49.default.bold(s3.name)}  ${import_picocolors49.default.dim(bits.join(" · "))}`);
+  }
+  if (servers.some((s3) => s3.auth === "oauth_required" || s3.auth === "oauth_expired")) {
+    lines.push("", import_picocolors49.default.dim("Authorize OAuth-backed servers in the web app; the CLI cannot run that flow yet."));
+  }
+  lines.push("");
+  return lines.join(`
+`);
+}
+var MAX_EXPIRY_DAYS = 90;
+function describeExpiry(server, now2 = Date.now()) {
+  if (server.auth !== "oauth_connected" || !server.oauth_token_expires_at)
+    return;
+  const at3 = Date.parse(server.oauth_token_expires_at);
+  if (!Number.isFinite(at3))
+    return;
+  const minutes = Math.round((at3 - now2) / 60000);
+  if (minutes <= 0)
+    return;
+  if (minutes < 60)
+    return `expires in ${minutes}m`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 48)
+    return `expires in ${hours}h`;
+  const days = Math.round(hours / 24);
+  return days > MAX_EXPIRY_DAYS ? `expires in >${MAX_EXPIRY_DAYS}d` : `expires in ${days}d`;
+}
 async function runMcp(cwd2, sub, _argv, options) {
   const writeErr = options.writeErr ?? ((s3) => process.stderr.write(s3));
   switch (sub) {
@@ -77375,17 +78026,19 @@ async function runMcp(cwd2, sub, _argv, options) {
       const { exitCode } = await runMcpCheck(cwd2, options);
       return exitCode;
     }
+    case "list":
+      return runMcpList(cwd2, options);
     default:
       writeErr(`Unknown mcp subcommand: ${sub ?? "(none)"}
 `);
-      writeErr(`Usage: brainbase mcp check [--json]
+      writeErr(`Usage: brainbase mcp <check|list> [--json]
 `);
       return 1;
   }
 }
 
 // src/cli/task.ts
-var import_picocolors47 = __toESM(require_picocolors(), 1);
+var import_picocolors50 = __toESM(require_picocolors(), 1);
 
 // src/cli/task-create.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -77571,31 +78224,31 @@ async function runTask(cwd2, sub, args) {
 function printHelp4() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors47.default.bold("brainbase task")} ${import_picocolors47.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors50.default.bold("brainbase task")} ${import_picocolors50.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors47.default.cyan("create")} ${import_picocolors47.default.dim("--message <text>")}   ${import_picocolors47.default.dim("create a task and start its first run")}`);
+  out.push(`  ${import_picocolors50.default.cyan("create")} ${import_picocolors50.default.dim("--message <text>")}   ${import_picocolors50.default.dim("create a task and start its first run")}`);
   out.push("");
-  out.push(`  ${import_picocolors47.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors47.default.dim("--message <text>")}   required first user message`);
-  out.push(`  ${import_picocolors47.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
-  out.push(`  ${import_picocolors47.default.dim("--title <text>")}     optional task title`);
-  out.push(`  ${import_picocolors47.default.dim("--model <id>")}       optional model override`);
-  out.push(`  ${import_picocolors47.default.dim("--json")}             print task_id, agent_id, and status as JSON`);
+  out.push(`  ${import_picocolors50.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors50.default.dim("--message <text>")}   required first user message`);
+  out.push(`  ${import_picocolors50.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
+  out.push(`  ${import_picocolors50.default.dim("--title <text>")}     optional task title`);
+  out.push(`  ${import_picocolors50.default.dim("--model <id>")}       optional model override`);
+  out.push(`  ${import_picocolors50.default.dim("--json")}             print task_id, agent_id, and status as JSON`);
   out.push("");
-  out.push(`  ${import_picocolors47.default.dim("Flag-like values:")} use ${import_picocolors47.default.cyan("--flag=value")} or ${import_picocolors47.default.cyan("--flag -- <value>")}`);
+  out.push(`  ${import_picocolors50.default.dim("Flag-like values:")} use ${import_picocolors50.default.cyan("--flag=value")} or ${import_picocolors50.default.cyan("--flag -- <value>")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/benchmark.ts
-var import_picocolors48 = __toESM(require_picocolors(), 1);
+var import_picocolors51 = __toESM(require_picocolors(), 1);
 import {
   execFileSync as execFileSync3,
   spawn as spawn5
 } from "node:child_process";
 import crypto7 from "node:crypto";
-import fs81 from "node:fs";
+import fs82 from "node:fs";
 import os17 from "node:os";
 import path89 from "node:path";
 
@@ -77605,7 +78258,7 @@ import {
   spawn as spawn4
 } from "node:child_process";
 import crypto6 from "node:crypto";
-import fs80 from "node:fs";
+import fs81 from "node:fs";
 import os16 from "node:os";
 import path88 from "node:path";
 import { pipeline as pipeline2 } from "node:stream/promises";
@@ -77855,19 +78508,19 @@ function canonicalFuturePath(input) {
   const resolved = path88.resolve(input);
   const suffix = [];
   let current = resolved;
-  while (!fs80.existsSync(current)) {
+  while (!fs81.existsSync(current)) {
     const parent = path88.dirname(current);
     if (parent === current)
       break;
     suffix.unshift(path88.basename(current));
     current = parent;
   }
-  const canonicalBase = fs80.realpathSync(current);
+  const canonicalBase = fs81.realpathSync(current);
   return path88.join(canonicalBase, ...suffix);
 }
 function validateRoots(spec) {
   const workspace = path88.resolve(spec.workspace_root);
-  if (!fs80.existsSync(workspace) || fs80.lstatSync(workspace).isSymbolicLink() || !fs80.lstatSync(workspace).isDirectory()) {
+  if (!fs81.existsSync(workspace) || fs81.lstatSync(workspace).isSymbolicLink() || !fs81.lstatSync(workspace).isDirectory()) {
     throw new BenchmarkPhaseError("invalid_workspace_root", "workspace_root must be an existing real directory");
   }
   const canonicalWorkspace = canonicalFuturePath(workspace);
@@ -77876,7 +78529,7 @@ function validateRoots(spec) {
   if (staging !== expectedStaging) {
     throw new BenchmarkPhaseError("invalid_staging_root", `staging_root must be ${expectedStaging}`);
   }
-  if (!fs80.existsSync(staging) || fs80.lstatSync(staging).isSymbolicLink() || !fs80.lstatSync(staging).isDirectory() || fs80.realpathSync(staging) !== path88.join(canonicalWorkspace, ".brainbase", "benchmark", spec.attempt_id, "incoming")) {
+  if (!fs81.existsSync(staging) || fs81.lstatSync(staging).isSymbolicLink() || !fs81.lstatSync(staging).isDirectory() || fs81.realpathSync(staging) !== path88.join(canonicalWorkspace, ".brainbase", "benchmark", spec.attempt_id, "incoming")) {
     throw new BenchmarkPhaseError("invalid_staging_root", "staging_root must be a real directory under workspace_root");
   }
   const canonicalLogs = validateExternalRoot("logs_root", spec.logs_root, canonicalWorkspace);
@@ -77892,7 +78545,7 @@ function validateExternalRoot(label, input, canonicalWorkspace) {
   if (candidate === path88.parse(candidate).root) {
     throw new BenchmarkPhaseError(`invalid_${label}`, `${label} cannot be a filesystem root`);
   }
-  if (fs80.existsSync(candidate) && fs80.lstatSync(candidate).isSymbolicLink()) {
+  if (fs81.existsSync(candidate) && fs81.lstatSync(candidate).isSymbolicLink()) {
     throw new BenchmarkPhaseError(`invalid_${label}`, `${label} cannot be a symlink`);
   }
   const canonicalCandidate = canonicalFuturePath(candidate);
@@ -77922,9 +78575,9 @@ function assertNoSymlinkTraversal(root, relative) {
   let current = path88.resolve(root);
   for (const segment of rel.split("/").slice(0, -1)) {
     current = path88.join(current, segment);
-    if (!fs80.existsSync(current))
+    if (!fs81.existsSync(current))
       continue;
-    if (fs80.lstatSync(current).isSymbolicLink()) {
+    if (fs81.lstatSync(current).isSymbolicLink()) {
       throw new BenchmarkPhaseError("unsafe_path", `path traverses symlink: ${relative}`);
     }
   }
@@ -77934,9 +78587,9 @@ function assertOpenedFileWithinRoot(root, filePath, openedStat, label) {
   let canonicalFile;
   let currentStat;
   try {
-    canonicalRoot = fs80.realpathSync(root);
-    canonicalFile = fs80.realpathSync(filePath);
-    currentStat = fs80.statSync(filePath);
+    canonicalRoot = fs81.realpathSync(root);
+    canonicalFile = fs81.realpathSync(filePath);
+    currentStat = fs81.statSync(filePath);
   } catch {
     throw new BenchmarkPhaseError("unsafe_path", `${label} changed while it was opened`);
   }
@@ -77945,10 +78598,10 @@ function assertOpenedFileWithinRoot(root, filePath, openedStat, label) {
   }
 }
 function openRegularFileNoFollow(filePath, label, root) {
-  const noFollow = typeof fs80.constants.O_NOFOLLOW === "number" ? fs80.constants.O_NOFOLLOW : 0;
+  const noFollow = typeof fs81.constants.O_NOFOLLOW === "number" ? fs81.constants.O_NOFOLLOW : 0;
   let fd;
   try {
-    fd = fs80.openSync(filePath, fs80.constants.O_RDONLY | noFollow);
+    fd = fs81.openSync(filePath, fs81.constants.O_RDONLY | noFollow);
   } catch (error2) {
     const code = error2.code;
     if (code === "ELOOP") {
@@ -77956,16 +78609,16 @@ function openRegularFileNoFollow(filePath, label, root) {
     }
     throw error2;
   }
-  const stat = fs80.fstatSync(fd);
+  const stat = fs81.fstatSync(fd);
   if (!stat.isFile()) {
-    fs80.closeSync(fd);
+    fs81.closeSync(fd);
     throw new BenchmarkPhaseError("invalid_input", `${label} must be a regular file`);
   }
   if (root) {
     try {
       assertOpenedFileWithinRoot(root, filePath, stat, label);
     } catch (error2) {
-      fs80.closeSync(fd);
+      fs81.closeSync(fd);
       throw error2;
     }
   }
@@ -77973,7 +78626,7 @@ function openRegularFileNoFollow(filePath, label, root) {
 }
 async function sha256OfDescriptor(fd) {
   const hash = crypto6.createHash("sha256");
-  const stream = fs80.createReadStream("", {
+  const stream = fs81.createReadStream("", {
     fd,
     autoClose: false,
     start: 0
@@ -77984,7 +78637,7 @@ async function sha256OfDescriptor(fd) {
   return hash.digest("hex");
 }
 function readDescriptor(fd) {
-  return fs80.readFileSync(fd);
+  return fs81.readFileSync(fd);
 }
 function assertWritableDestination(root, relative) {
   const rel = normalizedRootRelative(relative);
@@ -77994,9 +78647,9 @@ function assertWritableDestination(root, relative) {
   const segments = rel.split("/");
   for (const segment of segments.slice(0, -1)) {
     current = path88.join(current, segment);
-    if (!fs80.existsSync(current))
+    if (!fs81.existsSync(current))
       continue;
-    const stat = fs80.lstatSync(current);
+    const stat = fs81.lstatSync(current);
     if (stat.isSymbolicLink()) {
       throw new BenchmarkPhaseError("unsafe_path", `path traverses symlink: ${relative}`);
     }
@@ -78005,7 +78658,7 @@ function assertWritableDestination(root, relative) {
     }
   }
   const destination = path88.resolve(root, rel);
-  if (fs80.existsSync(destination) && fs80.lstatSync(destination).isDirectory()) {
+  if (fs81.existsSync(destination) && fs81.lstatSync(destination).isDirectory()) {
     throw new BenchmarkPhaseError("destination_conflict", `file destination is an existing directory: ${relative}`);
   }
 }
@@ -78037,7 +78690,7 @@ function sourcePath(stagingRoot, relative) {
   assertNoSymlinkTraversal(stagingRoot, rel);
   let stat;
   try {
-    stat = fs80.lstatSync(source);
+    stat = fs81.lstatSync(source);
   } catch {
     throw new BenchmarkPhaseError("missing_input", `staged input does not exist: ${relative}`);
   }
@@ -78066,12 +78719,12 @@ async function verifyRecordsUnchanged(records, spec) {
     const relative = safeRelPath(record3.path);
     assertNoSymlinkTraversal(root, relative);
     const candidate = path88.resolve(root, relative);
-    if (!isWithin(root, candidate) || !fs80.existsSync(candidate)) {
+    if (!isWithin(root, candidate) || !fs81.existsSync(candidate)) {
       throw new BenchmarkPhaseError("evidence_tampered", `evidence was removed during evaluation: ${record3.root}:${record3.path}`);
     }
-    const stat = fs80.lstatSync(candidate);
+    const stat = fs81.lstatSync(candidate);
     if (record3.kind === "symlink") {
-      const target = stat.isSymbolicLink() ? fs80.readlinkSync(candidate) : null;
+      const target = stat.isSymbolicLink() ? fs81.readlinkSync(candidate) : null;
       if (target === null || Buffer.byteLength(target) !== record3.size || sha256(target) !== record3.sha256) {
         throw new BenchmarkPhaseError("evidence_tampered", `evidence changed during evaluation: ${record3.root}:${record3.path}`);
       }
@@ -78086,7 +78739,7 @@ async function verifyRecordsUnchanged(records, spec) {
         throw new BenchmarkPhaseError("evidence_tampered", `evidence changed during evaluation: ${record3.root}:${record3.path}`);
       }
     } finally {
-      fs80.closeSync(opened.fd);
+      fs81.closeSync(opened.fd);
     }
   }
 }
@@ -78102,35 +78755,35 @@ async function verifyInput(stagingRoot, material) {
       throw new BenchmarkPhaseError("digest_mismatch", `checksum mismatch for ${material.source}`, { expected: material.sha256, actual });
     }
   } finally {
-    fs80.closeSync(opened.fd);
+    fs81.closeSync(opened.fd);
   }
   return source;
 }
 async function atomicCopy(source, destination, mode, sourceRoot) {
-  fs80.mkdirSync(path88.dirname(destination), { recursive: true });
+  fs81.mkdirSync(path88.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   const opened = openRegularFileNoFollow(source, `copy source ${source}`, sourceRoot);
   try {
-    await pipeline2(fs80.createReadStream("", {
+    await pipeline2(fs81.createReadStream("", {
       fd: opened.fd,
       autoClose: false,
       start: 0
-    }), fs80.createWriteStream(temporary, {
+    }), fs81.createWriteStream(temporary, {
       flags: "wx",
       mode: 384
     }));
-    fs80.chmodSync(temporary, mode ?? opened.stat.mode & 511);
-    fs80.renameSync(temporary, destination);
+    fs81.chmodSync(temporary, mode ?? opened.stat.mode & 511);
+    fs81.renameSync(temporary, destination);
   } finally {
-    fs80.closeSync(opened.fd);
-    fs80.rmSync(temporary, { force: true });
+    fs81.closeSync(opened.fd);
+    fs81.rmSync(temporary, { force: true });
   }
 }
 async function recordFile(root, filePath, rootName, kind = "file") {
   const relative = path88.relative(root, filePath).replace(/\\/g, "/");
   if (kind === "symlink") {
-    const stat = fs80.lstatSync(filePath);
-    const target = fs80.readlinkSync(filePath);
+    const stat = fs81.lstatSync(filePath);
+    const target = fs81.readlinkSync(filePath);
     return {
       root: rootName,
       path: relative,
@@ -78150,7 +78803,7 @@ async function recordFile(root, filePath, rootName, kind = "file") {
       mode: opened.stat.mode & 511
     };
   } finally {
-    fs80.closeSync(opened.fd);
+    fs81.closeSync(opened.fd);
   }
 }
 async function copyMaterial(material, sourceRoot, destinationRoot, destinationRootName, protectWorkspace) {
@@ -78172,7 +78825,7 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     }
     return [record3];
   }
-  const temporary = fs80.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-"));
+  const temporary = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-"));
   try {
     const verifiedArchive = path88.join(temporary, "material.tar.gz");
     await atomicCopy(source, verifiedArchive, 384, sourceRoot);
@@ -78190,7 +78843,7 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     const outputs = [];
     for (const extractedRel of extracted.sort()) {
       const sourceFile = path88.resolve(extractedRoot, safeRelPath(extractedRel));
-      const stat = fs80.lstatSync(sourceFile);
+      const stat = fs81.lstatSync(sourceFile);
       if (!stat.isFile())
         continue;
       const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path88.posix.join(destinationRel, extractedRel));
@@ -78205,7 +78858,7 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     }
     return outputs;
   } finally {
-    fs80.rmSync(temporary, { recursive: true, force: true });
+    fs81.rmSync(temporary, { recursive: true, force: true });
   }
 }
 async function preflightMaterial(material, sourceRoot, destinationRoot, protectWorkspace) {
@@ -78221,7 +78874,7 @@ async function preflightMaterial(material, sourceRoot, destinationRoot, protectW
     assertWritableDestination(destinationRoot, destinationRel);
     return [destinationRel];
   }
-  const temporary = fs80.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-preflight-"));
+  const temporary = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-preflight-"));
   try {
     const verifiedArchive = path88.join(temporary, "material.tar.gz");
     await atomicCopy(source, verifiedArchive, 384, sourceRoot);
@@ -78248,34 +78901,34 @@ async function preflightMaterial(material, sourceRoot, destinationRoot, protectW
     }
     return planned;
   } finally {
-    fs80.rmSync(temporary, { recursive: true, force: true });
+    fs81.rmSync(temporary, { recursive: true, force: true });
   }
 }
 function ownerMarker(root) {
   return path88.join(root, ".brainbase-benchmark-owner.json");
 }
 function verifyOwnedDirectory(root, role, spec) {
-  if (!fs80.existsSync(root) || fs80.lstatSync(root).isSymbolicLink())
+  if (!fs81.existsSync(root) || fs81.lstatSync(root).isSymbolicLink())
     return false;
   try {
-    const marker = JSON.parse(fs80.readFileSync(ownerMarker(root), "utf8"));
+    const marker = JSON.parse(fs81.readFileSync(ownerMarker(root), "utf8"));
     return marker.attempt_id === spec.attempt_id && marker.phase === spec.phase && marker.phase_id === spec.phase_id && marker.role === role;
   } catch {
     return false;
   }
 }
 function prepareOwnedDirectory(root, role, spec) {
-  if (fs80.existsSync(root)) {
+  if (fs81.existsSync(root)) {
     if (!verifyOwnedDirectory(root, role, spec)) {
-      const stat = fs80.lstatSync(root);
-      if (!stat.isDirectory() || fs80.readdirSync(root).length > 0) {
+      const stat = fs81.lstatSync(root);
+      if (!stat.isDirectory() || fs81.readdirSync(root).length > 0) {
         throw new BenchmarkPhaseError(`unowned_${role}_root`, `${role}_root exists without a matching attempt ownership marker`);
       }
     } else {
-      fs80.rmSync(root, { recursive: true, force: true });
+      fs81.rmSync(root, { recursive: true, force: true });
     }
   }
-  fs80.mkdirSync(root, { recursive: true, mode: 448 });
+  fs81.mkdirSync(root, { recursive: true, mode: 448 });
   writeJsonAtomic(ownerMarker(root), {
     schema_version: SCHEMA_VERSION,
     attempt_id: spec.attempt_id,
@@ -78367,7 +79020,7 @@ async function runCommand(command, root, spec, context, additions = {}) {
   const cwd2 = path88.resolve(root, cwdRel);
   let cwdStat;
   try {
-    cwdStat = fs80.lstatSync(cwd2);
+    cwdStat = fs81.lstatSync(cwd2);
   } catch {
     throw new BenchmarkPhaseError("invalid_command_cwd", `command cwd is invalid: ${command.cwd}`);
   }
@@ -78439,27 +79092,27 @@ async function runCommand(command, root, spec, context, additions = {}) {
 }
 async function writeLog(root, name, data, spec) {
   const destination = path88.join(root, name);
-  fs80.mkdirSync(path88.dirname(destination), { recursive: true });
+  fs81.mkdirSync(path88.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   try {
-    fs80.writeFileSync(temporary, redactCommandOutput(data, spec), {
+    fs81.writeFileSync(temporary, redactCommandOutput(data, spec), {
       flag: "wx",
       mode: 384
     });
-    fs80.renameSync(temporary, destination);
+    fs81.renameSync(temporary, destination);
   } finally {
-    fs80.rmSync(temporary, { force: true });
+    fs81.rmSync(temporary, { force: true });
   }
   return await recordFile(root, destination, "logs");
 }
 function writeBufferAtomic(destination, data) {
-  fs80.mkdirSync(path88.dirname(destination), { recursive: true });
+  fs81.mkdirSync(path88.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   try {
-    fs80.writeFileSync(temporary, data, { flag: "wx", mode: 384 });
-    fs80.renameSync(temporary, destination);
+    fs81.writeFileSync(temporary, data, { flag: "wx", mode: 384 });
+    fs81.renameSync(temporary, destination);
   } finally {
-    fs80.rmSync(temporary, { force: true });
+    fs81.rmSync(temporary, { force: true });
   }
 }
 function assertBudget(context) {
@@ -78468,7 +79121,7 @@ function assertBudget(context) {
   }
 }
 async function executeHydrate(spec, context) {
-  fs80.mkdirSync(spec.workspace_root, { recursive: true });
+  fs81.mkdirSync(spec.workspace_root, { recursive: true });
   prepareOwnedDirectory(spec.logs_root, "logs", spec);
   context.logsOwned = true;
   const outputs = [];
@@ -78549,9 +79202,9 @@ async function executeHydrate(spec, context) {
     }
     const candidate = path88.resolve(spec.workspace_root, safeRelPath(output.path));
     assertNoSymlinkTraversal(spec.workspace_root, output.path);
-    if (!fs80.existsSync(candidate))
+    if (!fs81.existsSync(candidate))
       continue;
-    const stat = fs80.lstatSync(candidate);
+    const stat = fs81.lstatSync(candidate);
     if (!stat.isFile() && !stat.isSymbolicLink())
       continue;
     finalOutputs.push(await recordFile(spec.workspace_root, candidate, "workspace", stat.isSymbolicLink() ? "symlink" : "file"));
@@ -78585,7 +79238,7 @@ async function readEvidence(stagingRoot, evidence) {
       }
     };
   } finally {
-    fs80.closeSync(opened.fd);
+    fs81.closeSync(opened.fd);
   }
 }
 async function workspaceManifest(spec, context) {
@@ -78594,7 +79247,7 @@ async function workspaceManifest(spec, context) {
   const stack = [path88.resolve(spec.workspace_root)];
   while (stack.length > 0) {
     const directory = stack.pop();
-    const entries = fs80.readdirSync(directory, { withFileTypes: true }).sort((a3, b4) => a3.name.localeCompare(b4.name));
+    const entries = fs81.readdirSync(directory, { withFileTypes: true }).sort((a3, b4) => a3.name.localeCompare(b4.name));
     for (const entry of entries) {
       assertBudget(context);
       const full = path88.join(directory, entry.name);
@@ -78703,7 +79356,7 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
     const candidate = path88.resolve(spec.workspace_root, relative);
     let stat = null;
     try {
-      stat = fs80.lstatSync(candidate);
+      stat = fs81.lstatSync(candidate);
     } catch (error2) {
       const code = error2.code;
       if (code !== "ENOENT" && code !== "ENOTDIR")
@@ -78724,7 +79377,7 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
         try {
           verdict2 = await sha256OfDescriptor(opened.fd) === evaluator.assertion.expected;
         } finally {
-          fs80.closeSync(opened.fd);
+          fs81.closeSync(opened.fd);
         }
       }
     }
@@ -78734,7 +79387,7 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
         try {
           verdict2 = readDescriptor(opened.fd).toString("utf8").includes(evaluator.assertion.expected);
         } finally {
-          fs80.closeSync(opened.fd);
+          fs81.closeSync(opened.fd);
         }
       }
     }
@@ -78815,7 +79468,7 @@ async function executeEvaluate(spec, context) {
     assertNoSymlinkTraversal(spec.workspace_root, artifactRel);
     const source = path88.resolve(spec.workspace_root, artifactRel);
     const frozenArtifact = manifest.find((entry) => entry.path === artifactRel && entry.kind !== "symlink");
-    if (!frozenArtifact || !fs80.existsSync(source) || !fs80.lstatSync(source).isFile()) {
+    if (!frozenArtifact || !fs81.existsSync(source) || !fs81.lstatSync(source).isFile()) {
       throw new BenchmarkPhaseError("missing_artifact", `candidate artifact is missing: ${artifactRel}`);
     }
     const destination = path88.resolve(spec.logs_root, "candidate-artifacts", artifactRel);
@@ -78833,9 +79486,9 @@ async function executeEvaluate(spec, context) {
     const temporary = `${archive}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
     try {
       await pack({ rootDir: spec.workspace_root, outFile: temporary, files: regularFiles });
-      fs80.renameSync(temporary, archive);
+      fs81.renameSync(temporary, archive);
     } finally {
-      fs80.rmSync(temporary, { force: true });
+      fs81.rmSync(temporary, { force: true });
     }
     const archiveRecord = await recordFile(spec.logs_root, archive, "logs");
     outputs.push(archiveRecord);
@@ -78935,21 +79588,21 @@ function rawIdentity(value) {
 }
 function readSpecBytes(specPathInput) {
   const specPath = path88.resolve(specPathInput);
-  const noFollow = typeof fs80.constants.O_NOFOLLOW === "number" ? fs80.constants.O_NOFOLLOW : 0;
+  const noFollow = typeof fs81.constants.O_NOFOLLOW === "number" ? fs81.constants.O_NOFOLLOW : 0;
   let fd;
   try {
-    fd = fs80.openSync(specPath, fs80.constants.O_RDONLY | noFollow);
+    fd = fs81.openSync(specPath, fs81.constants.O_RDONLY | noFollow);
   } catch {
     throw new BenchmarkPhaseError("spec_read_failed", "spec file could not be read");
   }
   try {
-    const stat = fs80.fstatSync(fd);
+    const stat = fs81.fstatSync(fd);
     if (!stat.isFile() || stat.size > MAX_SPEC_BYTES) {
       throw new BenchmarkPhaseError("invalid_spec_file", "spec must be a regular JSON file no larger than 20 MiB");
     }
     return readDescriptor(fd);
   } finally {
-    fs80.closeSync(fd);
+    fs81.closeSync(fd);
   }
 }
 function validateBenchmarkInvocationBytes(bytes, resultPathInput, expectedPhase) {
@@ -78993,9 +79646,9 @@ function prepareBenchmarkPhaseInvocation(specPathInput, resultPathInput, expecte
       spec_digest: digest,
       timeout_ms: spec.budget.timeout_ms
     };
-    if (fs80.existsSync(resultPath)) {
+    if (fs81.existsSync(resultPath)) {
       try {
-        const cached2 = JSON.parse(fs80.readFileSync(resultPath, "utf8"));
+        const cached2 = JSON.parse(fs81.readFileSync(resultPath, "utf8"));
         if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
           return {
             ok: true,
@@ -79102,9 +79755,9 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
       throw new BenchmarkPhaseError("invalid_result_path", `result path must be ${expectedResultPath}`);
     }
     resultPathValidated = true;
-    if (fs80.existsSync(resultPath)) {
+    if (fs81.existsSync(resultPath)) {
       try {
-        const cached2 = JSON.parse(fs80.readFileSync(resultPath, "utf8"));
+        const cached2 = JSON.parse(fs81.readFileSync(resultPath, "utf8"));
         if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
           return { exitCode: 0, result: cached2 };
         }
@@ -79301,13 +79954,13 @@ function terminatePhase(child) {
 }
 function createAnonymousSpecFd(bytes) {
   const temporary = path89.join(os17.tmpdir(), `brainbase-benchmark-spec-${process.pid}-${crypto7.randomBytes(12).toString("hex")}`);
-  fs81.writeFileSync(temporary, bytes, { flag: "wx", mode: 384 });
+  fs82.writeFileSync(temporary, bytes, { flag: "wx", mode: 384 });
   try {
-    const fd = fs81.openSync(temporary, "r");
-    fs81.unlinkSync(temporary);
+    const fd = fs82.openSync(temporary, "r");
+    fs82.unlinkSync(temporary);
     return fd;
   } catch (error2) {
-    fs81.rmSync(temporary, { force: true });
+    fs82.rmSync(temporary, { force: true });
     throw error2;
   }
 }
@@ -79376,13 +80029,13 @@ async function runSupervisedPhase(phase, parsed, write) {
       detached: process.platform !== "win32"
     });
   } catch {
-    fs81.closeSync(specFd);
+    fs82.closeSync(specFd);
     const failure = phaseFailure(invocation, startedAt, started, "phase_supervisor_failed", "benchmark phase child process could not be started");
     write(`${JSON.stringify(failure)}
 `);
     return 1;
   }
-  fs81.closeSync(specFd);
+  fs82.closeSync(specFd);
   return await new Promise((resolve) => {
     const stdout = [];
     let settled = false;
@@ -79464,7 +80117,7 @@ async function runBenchmark(sub, args, write = (value) => process.stdout.write(v
       if (phase !== "hydrate" && phase !== "evaluate" || resultFlag !== "--result" || !resultPath || specFdFlag !== "--spec-fd" || !Number.isInteger(specFd) || specFd < 3 || tokenFlag !== "--token" || !token || token !== process.env.BRAINBASE_BENCHMARK_PHASE_CHILD_TOKEN) {
         throw new Error("Invalid internal benchmark phase invocation");
       }
-      const specBytes = fs81.readFileSync(specFd);
+      const specBytes = fs82.readFileSync(specFd);
       const { exitCode, result: result2 } = await runBenchmarkPhase("", resultPath, phase, specBytes);
       write(`${JSON.stringify(result2)}
 `);
@@ -79504,13 +80157,13 @@ async function runBenchmark(sub, args, write = (value) => process.stdout.write(v
 function printHelp5() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors48.default.bold("brainbase benchmark")} ${import_picocolors48.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors51.default.bold("brainbase benchmark")} ${import_picocolors51.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors48.default.cyan("hydrate")} ${import_picocolors48.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors48.default.cyan("evaluate")} ${import_picocolors48.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors48.default.cyan("capabilities")} ${import_picocolors48.default.dim("--json")}`);
+  out.push(`  ${import_picocolors51.default.cyan("hydrate")} ${import_picocolors51.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors51.default.cyan("evaluate")} ${import_picocolors51.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors51.default.cyan("capabilities")} ${import_picocolors51.default.dim("--json")}`);
   out.push("");
-  out.push(`  ${import_picocolors48.default.dim("These machine-only commands execute versioned benchmark phase specs inside a task sandbox.")}`);
+  out.push(`  ${import_picocolors51.default.dim("These machine-only commands execute versioned benchmark phase specs inside a task sandbox.")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -79537,164 +80190,259 @@ var SUBCOMMAND_OWNED_FLAGS = {
 function help() {
   const out = [];
   out.push("");
-  out.push(`  ${brandTint("◆")}  ${import_picocolors49.default.bold("brainbase")}  ${import_picocolors49.default.dim(`v${VERSION}`)}`);
-  out.push(`     ${import_picocolors49.default.dim("connect your local agent to the brainbase platform")}`);
+  out.push(`  ${brandTint("◆")}  ${import_picocolors52.default.bold("brainbase")}  ${import_picocolors52.default.dim(`v${VERSION}`)}`);
+  out.push(`     ${import_picocolors52.default.dim("connect your local agent to the brainbase platform")}`);
   out.push("");
   out.push(divider("USAGE"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.bold("brainbase")} ${import_picocolors49.default.dim("<command> [options]")}`);
+  out.push(`  ${import_picocolors52.default.bold("brainbase")} ${import_picocolors52.default.dim("<command> [options]")}`);
   out.push("");
   out.push(divider("AUTH"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("login")}     ${import_picocolors49.default.dim("  open the web app and connect this device")}`);
-  out.push(`  ${import_picocolors49.default.cyan("logout")}    ${import_picocolors49.default.dim("  clear the local session")}`);
-  out.push(`  ${import_picocolors49.default.cyan("whoami")}    ${import_picocolors49.default.dim("  show the current user")}`);
+  out.push(`  ${import_picocolors52.default.cyan("login")}     ${import_picocolors52.default.dim("  open the web app and connect this device")}`);
+  out.push(`  ${import_picocolors52.default.cyan("logout")}    ${import_picocolors52.default.dim("  clear the local session")}`);
+  out.push(`  ${import_picocolors52.default.cyan("whoami")}    ${import_picocolors52.default.dim("  show the current user")}`);
   out.push("");
   out.push(divider("DISCOVERY"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("team list")}                  ${import_picocolors49.default.dim("show the teams you can create agents in")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent list")}                 ${import_picocolors49.default.dim("show a team's agents and their ids")}`);
+  out.push(`  ${import_picocolors52.default.cyan("team list")}                  ${import_picocolors52.default.dim("show the teams you can create agents in")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent list")}                 ${import_picocolors52.default.dim("show a team's agents and their ids")}`);
   out.push("");
   out.push(divider("LINKED AGENT"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("agent create")}               ${import_picocolors49.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent pull")} ${import_picocolors49.default.dim("[<id>]")}          ${import_picocolors49.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent push")}                 ${import_picocolors49.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent unpack")}               ${import_picocolors49.default.dim("install the claimed agent into a harness layout")}`);
-  out.push(`  ${import_picocolors49.default.cyan("link")}                       ${import_picocolors49.default.dim("attach this folder to an existing agent")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent status")}               ${import_picocolors49.default.dim("show what would pull and what would push")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent env")}                  ${import_picocolors49.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
-  out.push(`  ${import_picocolors49.default.cyan("run")} ${import_picocolors49.default.dim("<cmd> [args...]")}         ${import_picocolors49.default.dim("run <cmd> with secrets.env loaded into env")}`);
-  out.push(`  ${import_picocolors49.default.cyan("status")}                     ${import_picocolors49.default.dim("show what this folder is linked to")}`);
-  out.push(`  ${import_picocolors49.default.cyan("unlink")}                     ${import_picocolors49.default.dim("disconnect this folder")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent create")}               ${import_picocolors52.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent pull")} ${import_picocolors52.default.dim("[<id>]")}          ${import_picocolors52.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent push")}                 ${import_picocolors52.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent unpack")}               ${import_picocolors52.default.dim("install the claimed agent into a harness layout")}`);
+  out.push(`  ${import_picocolors52.default.cyan("link")}                       ${import_picocolors52.default.dim("attach this folder to an existing agent")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent status")}               ${import_picocolors52.default.dim("show what would pull and what would push")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent connections")}          ${import_picocolors52.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent connect")} ${import_picocolors52.default.dim("<name>")}       ${import_picocolors52.default.dim("connect slack or meeting from the terminal")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent disconnect")} ${import_picocolors52.default.dim("<name>")}    ${import_picocolors52.default.dim("revoke a slack or meeting install")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent env")}                  ${import_picocolors52.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
+  out.push(`  ${import_picocolors52.default.cyan("run")} ${import_picocolors52.default.dim("<cmd> [args...]")}         ${import_picocolors52.default.dim("run <cmd> with secrets.env loaded into env")}`);
+  out.push(`  ${import_picocolors52.default.cyan("status")}                     ${import_picocolors52.default.dim("show what this folder is linked to")}`);
+  out.push(`  ${import_picocolors52.default.cyan("unlink")}                     ${import_picocolors52.default.dim("disconnect this folder")}`);
   out.push("");
   out.push(divider("TASKS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("task create")} ${import_picocolors49.default.dim("--message <text>")}   ${import_picocolors49.default.dim("create a managed task and start its first run")}`);
+  out.push(`  ${import_picocolors52.default.cyan("task create")} ${import_picocolors52.default.dim("--message <text>")}   ${import_picocolors52.default.dim("create a managed task and start its first run")}`);
   out.push("");
   out.push(divider("BENCHMARK RUNTIME"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("benchmark hydrate")} ${import_picocolors49.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors49.default.cyan("benchmark evaluate")} ${import_picocolors49.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors49.default.cyan("benchmark capabilities")} ${import_picocolors49.default.dim("--json")}`);
+  out.push(`  ${import_picocolors52.default.cyan("benchmark hydrate")} ${import_picocolors52.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors52.default.cyan("benchmark evaluate")} ${import_picocolors52.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors52.default.cyan("benchmark capabilities")} ${import_picocolors52.default.dim("--json")}`);
   out.push("");
   out.push(divider("ORCHESTRATIONS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("orchestration create")}           ${import_picocolors49.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
-  out.push(`  ${import_picocolors49.default.cyan("orchestration list")}             ${import_picocolors49.default.dim("list orchestrations under a team")}`);
-  out.push(`  ${import_picocolors49.default.cyan("orchestration pull")} ${import_picocolors49.default.dim("<id>")}        ${import_picocolors49.default.dim("recursively fetch an orchestration + every member agent")}`);
-  out.push(`  ${import_picocolors49.default.cyan("orchestration push")}             ${import_picocolors49.default.dim("recursively push each member, then update the graph")}`);
-  out.push(`  ${import_picocolors49.default.cyan("orchestration status")}           ${import_picocolors49.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration create")}           ${import_picocolors52.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration list")}             ${import_picocolors52.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration pull")} ${import_picocolors52.default.dim("<id>")}        ${import_picocolors52.default.dim("recursively fetch an orchestration + every member agent")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration push")}             ${import_picocolors52.default.dim("recursively push each member, then update the graph")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration status")}           ${import_picocolors52.default.dim("show what would push and what would pull")}`);
   out.push("");
   out.push(divider("TEMPLATES"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("template pack")}                       ${import_picocolors49.default.dim("bundle the current agent into a template")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template publish")}                    ${import_picocolors49.default.dim("upload a template to the registry")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template search")} ${import_picocolors49.default.dim("[query]")}             ${import_picocolors49.default.dim("search the registry")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template info")}    ${import_picocolors49.default.dim("<creator/slug>")}     ${import_picocolors49.default.dim("show registry details for a template")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template onboard")} ${import_picocolors49.default.dim("<creator/slug>")}     ${import_picocolors49.default.dim("install (or refresh) a template")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template list")}                       ${import_picocolors49.default.dim("show installed templates")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template remove")}  ${import_picocolors49.default.dim("<creator/slug>")}     ${import_picocolors49.default.dim("uninstall a template")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template pack")}                       ${import_picocolors52.default.dim("bundle the current agent into a template")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template publish")}                    ${import_picocolors52.default.dim("upload a template to the registry")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template search")} ${import_picocolors52.default.dim("[query]")}             ${import_picocolors52.default.dim("search the registry")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template info")}    ${import_picocolors52.default.dim("<creator/slug>")}     ${import_picocolors52.default.dim("show registry details for a template")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template onboard")} ${import_picocolors52.default.dim("<creator/slug>")}     ${import_picocolors52.default.dim("install (or refresh) a template")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template list")}                       ${import_picocolors52.default.dim("show installed templates")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template remove")}  ${import_picocolors52.default.dim("<creator/slug>")}     ${import_picocolors52.default.dim("uninstall a template")}`);
   out.push("");
   out.push(divider("SKILLS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("skill add")} ${import_picocolors49.default.dim("<source>")}                  ${import_picocolors49.default.dim("install a skill (github / git / brainbase)")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill list")}                            ${import_picocolors49.default.dim("show locally installed skills + their source")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill update")} ${import_picocolors49.default.dim("<slug>")}                  ${import_picocolors49.default.dim("re-fetch a skill from its recorded source")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill remove")} ${import_picocolors49.default.dim("<slug>")}                  ${import_picocolors49.default.dim("uninstall a skill")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill search")} ${import_picocolors49.default.dim("[query]")}                 ${import_picocolors49.default.dim("search the brainbase skill registry")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill info")} ${import_picocolors49.default.dim("<creator/slug>")}            ${import_picocolors49.default.dim("show registry details for a skill")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill publish")} ${import_picocolors49.default.dim("[dir]")}                  ${import_picocolors49.default.dim("publish a SKILL.md folder (defaults to .)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill add")} ${import_picocolors52.default.dim("<source>")}                  ${import_picocolors52.default.dim("install a skill (github / git / brainbase)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill list")}                            ${import_picocolors52.default.dim("show locally installed skills + their source")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill update")} ${import_picocolors52.default.dim("<slug>")}                  ${import_picocolors52.default.dim("re-fetch a skill from its recorded source")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill remove")} ${import_picocolors52.default.dim("<slug>")}                  ${import_picocolors52.default.dim("uninstall a skill")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill search")} ${import_picocolors52.default.dim("[query]")}                 ${import_picocolors52.default.dim("search the brainbase skill registry")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill info")} ${import_picocolors52.default.dim("<creator/slug>")}            ${import_picocolors52.default.dim("show registry details for a skill")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill publish")} ${import_picocolors52.default.dim("[dir]")}                  ${import_picocolors52.default.dim("publish a SKILL.md folder (defaults to .)")}`);
   out.push("");
   out.push(divider("CLI TOKENS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("token create")}                        ${import_picocolors49.default.dim("issue a long-lived CLI key for CI / scripts")}`);
-  out.push(`  ${import_picocolors49.default.cyan("token list")}                          ${import_picocolors49.default.dim("show your tokens")}`);
-  out.push(`  ${import_picocolors49.default.cyan("token rename")} ${import_picocolors49.default.dim("<id>")}                  ${import_picocolors49.default.dim("relabel a token")}`);
-  out.push(`  ${import_picocolors49.default.cyan("token revoke")} ${import_picocolors49.default.dim("<id>")}                  ${import_picocolors49.default.dim("revoke a token")}`);
+  out.push(`  ${import_picocolors52.default.cyan("token create")}                        ${import_picocolors52.default.dim("issue a long-lived CLI key for CI / scripts")}`);
+  out.push(`  ${import_picocolors52.default.cyan("token list")}                          ${import_picocolors52.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors52.default.cyan("token rename")} ${import_picocolors52.default.dim("<id>")}                  ${import_picocolors52.default.dim("relabel a token")}`);
+  out.push(`  ${import_picocolors52.default.cyan("token revoke")} ${import_picocolors52.default.dim("<id>")}                  ${import_picocolors52.default.dim("revoke a token")}`);
   out.push("");
   out.push(divider("MCP"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("mcp check")} ${import_picocolors49.default.dim("[--json]")}              ${import_picocolors49.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("mcp check")} ${import_picocolors52.default.dim("[--json]")}              ${import_picocolors52.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("mcp list")} ${import_picocolors52.default.dim("[--json]")}               ${import_picocolors52.default.dim("show configured servers with OAuth state and expiry")}`);
   out.push("");
   out.push(divider("FLAGS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
-  out.push(`  ${import_picocolors49.default.dim("--scope <s>")}        force scope: global | project`);
-  out.push(`  ${import_picocolors49.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
-  out.push(`  ${import_picocolors49.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly`);
-  out.push(`  ${import_picocolors49.default.dim("--message <text>")}   for task create: required first user message`);
-  out.push(`  ${import_picocolors49.default.dim("--title <text>")}     for task create: optional task title`);
-  out.push(`  ${import_picocolors49.default.dim("--model <id>")}       for task create: optional model override`);
-  out.push(`  ${import_picocolors49.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
-  out.push(`  ${import_picocolors49.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
-  out.push(`  ${import_picocolors49.default.dim("--json")}             machine-readable output for supported commands`);
-  out.push(`  ${import_picocolors49.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
-  out.push(`  ${import_picocolors49.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
-  out.push(`  ${import_picocolors49.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
-  out.push(`  ${import_picocolors49.default.dim("--all")}              for template list: include installs from other folders`);
-  out.push(`  ${import_picocolors49.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors52.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
+  out.push(`  ${import_picocolors52.default.dim("--scope <s>")}        force scope: global | project`);
+  out.push(`  ${import_picocolors52.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
+  out.push(`  ${import_picocolors52.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly`);
+  out.push(`  ${import_picocolors52.default.dim("--message <text>")}   for task create: required first user message`);
+  out.push(`  ${import_picocolors52.default.dim("--title <text>")}     for task create: optional task title`);
+  out.push(`  ${import_picocolors52.default.dim("--model <id>")}       for task create: optional model override`);
+  out.push(`  ${import_picocolors52.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
+  out.push(`  ${import_picocolors52.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
+  out.push(`  ${import_picocolors52.default.dim("--json")}             machine-readable output for supported commands`);
+  out.push(`  ${import_picocolors52.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
+  out.push(`  ${import_picocolors52.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
+  out.push(`  ${import_picocolors52.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
+  out.push(`  ${import_picocolors52.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
+  out.push(`  ${import_picocolors52.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
+  out.push(`  ${import_picocolors52.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
+  out.push(`  ${import_picocolors52.default.dim("--all")}              for template list: include installs from other folders`);
+  out.push(`  ${import_picocolors52.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
   out.push("");
   out.push(divider("ENV"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task create uses /v2/tasks)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT (overrides token.json)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task create uses /v2/tasks)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT (overrides token.json)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
   out.push("");
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
   out.push("");
   out.push(divider("HARNESSES"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.dim("•")} ${import_picocolors49.default.bold("claude-code")}  ${import_picocolors49.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors49.default.dim("•")} ${import_picocolors49.default.bold("codex")}        ${import_picocolors49.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors49.default.dim("•")} ${import_picocolors49.default.bold("kafka")}        ${import_picocolors49.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors52.default.dim("•")} ${import_picocolors52.default.bold("claude-code")}  ${import_picocolors52.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors52.default.dim("•")} ${import_picocolors52.default.bold("codex")}        ${import_picocolors52.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors52.default.dim("•")} ${import_picocolors52.default.bold("kafka")}        ${import_picocolors52.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
-function getFlag(args, ...names) {
+var VALUE_TAKING_FLAGS = new Set([
+  "--scope",
+  "--name",
+  "-n",
+  "--harness",
+  "--web",
+  "--visibility",
+  "--category",
+  "--target",
+  "--page",
+  "--as",
+  "--agent",
+  "--shell",
+  "--skill-version",
+  "--tagline",
+  "--org",
+  "--team",
+  "--description",
+  "--schema",
+  "--from",
+  "--to",
+  "--bot-token",
+  "--signing-secret",
+  "--app-id",
+  "--app-name",
+  "--bot-name",
+  "--bot-image-url"
+]);
+function isValueOfPriorFlag2(args, index) {
+  return index > 0 && VALUE_TAKING_FLAGS.has(args[index - 1]);
+}
+function findFlag(args, name) {
+  const prefix = `${name}=`;
+  for (let i = 0;i < args.length; i++) {
+    if (isValueOfPriorFlag2(args, i))
+      continue;
+    const a3 = args[i];
+    if (a3 === name)
+      return { index: i };
+    if (a3.startsWith(prefix))
+      return { index: i, joinedValue: a3.slice(prefix.length) };
+  }
+  return null;
+}
+function takeFlagOnce(args, names) {
+  let best = null;
   for (const n of names) {
-    const i = args.indexOf(n);
-    if (i >= 0) {
-      const v3 = args[i + 1];
-      args.splice(i, v3 && !v3.startsWith("--") && !(n.startsWith("-") && v3.startsWith("-")) ? 2 : 1);
-      return v3 && !v3.startsWith("--") ? v3 : "";
-    }
+    const hit = findFlag(args, n);
+    if (hit && (!best || hit.index < best.index))
+      best = hit;
   }
-  return;
+  if (!best)
+    return;
+  if (best.joinedValue !== undefined) {
+    args.splice(best.index, 1);
+    return best.joinedValue;
+  }
+  const v3 = args[best.index + 1];
+  if (v3 && !v3.startsWith("-")) {
+    args.splice(best.index, 2);
+    return v3;
+  }
+  args.splice(best.index, 1);
+  return "";
+}
+function getFlag(args, ...names) {
+  const first = takeFlagOnce(args, names);
+  if (first === undefined)
+    return;
+  while (takeFlagOnce(args, names) !== undefined) {}
+  return first;
 }
 function getFlagAll(args, ...names) {
   const out = [];
-  let v3 = getFlag(args, ...names);
+  let v3 = takeFlagOnce(args, names);
   while (v3 !== undefined) {
     if (v3)
       out.push(v3);
-    v3 = getFlag(args, ...names);
+    v3 = takeFlagOnce(args, names);
   }
   return out;
 }
-function hasFlag2(args, ...names) {
-  for (const n of names) {
-    const i = args.indexOf(n);
-    if (i >= 0) {
-      args.splice(i, 1);
+function interpretJoinedBoolean(value, name) {
+  const v3 = value.trim().toLowerCase();
+  if (v3 === "")
+    return false;
+  switch (v3) {
+    case "false":
+    case "0":
+    case "no":
+    case "off":
+      return false;
+    case "true":
+    case "1":
+    case "yes":
+    case "on":
       return true;
+    default:
+      throw new Error(`Unrecognised value for ${name}: ${value}`);
+  }
+}
+function hasFlag2(args, ...names) {
+  let leftmost;
+  while (true) {
+    let best = null;
+    for (const n of names) {
+      const hit = findFlag(args, n);
+      if (hit && (!best || hit.index < best.index))
+        best = { ...hit, name: n };
     }
+    if (!best)
+      break;
+    args.splice(best.index, 1);
+    const enabled = best.joinedValue === undefined ? true : interpretJoinedBoolean(best.joinedValue, best.name);
+    if (leftmost === undefined)
+      leftmost = enabled;
   }
-  return false;
+  return leftmost ?? false;
 }
 async function requireAuth(cmd) {
   if (!PROTECTED.has(cmd))
@@ -79724,13 +80472,13 @@ async function requireAuth(cmd) {
   if (STORED_PAT_COMMANDS.has(cmd) && readToken())
     return;
   console.error("");
-  console.error(`  ${brandTint("◆")}  ${import_picocolors49.default.bold("brainbase")}`);
+  console.error(`  ${brandTint("◆")}  ${import_picocolors52.default.bold("brainbase")}`);
   console.error("");
-  console.error(`  ${import_picocolors49.default.red("✗")}  You need to sign in to use ${import_picocolors49.default.bold("brainbase " + cmd)}.`);
+  console.error(`  ${import_picocolors52.default.red("✗")}  You need to sign in to use ${import_picocolors52.default.bold("brainbase " + cmd)}.`);
   if (status.reason)
-    console.error(`     ${import_picocolors49.default.dim(status.reason)}`);
+    console.error(`     ${import_picocolors52.default.dim(status.reason)}`);
   console.error("");
-  console.error(`     Run ${import_picocolors49.default.cyan("brainbase login")} to connect this device.`);
+  console.error(`     Run ${import_picocolors52.default.cyan("brainbase login")} to connect this device.`);
   console.error("");
   process14.exit(1);
 }
@@ -79740,7 +80488,7 @@ async function main() {
   const rawCwd = process14.cwd();
   const cwd2 = (() => {
     try {
-      return fs82.realpathSync(rawCwd);
+      return fs83.realpathSync(rawCwd);
     } catch {
       return rawCwd;
     }
@@ -79789,6 +80537,12 @@ async function main() {
   const noPushFlag = hasFlag2(sharedArgs, "--no-push");
   const jsonFlag = hasFlag2(sharedArgs, "--json");
   const acpFlag = hasFlag2(sharedArgs, "--acp");
+  const botTokenFlag = getFlag(sharedArgs, "--bot-token");
+  const signingSecretFlag = getFlag(sharedArgs, "--signing-secret");
+  const appIdFlag = getFlag(sharedArgs, "--app-id");
+  const appNameFlag = getFlag(sharedArgs, "--app-name");
+  const botNameFlag = getFlag(sharedArgs, "--bot-name");
+  const botImageUrlFlag = getFlag(sharedArgs, "--bot-image-url");
   ensureSkillResolversRegistered();
   await requireAuth(cmd);
   try {
@@ -79872,7 +80626,13 @@ async function main() {
           track,
           force: forceFlag,
           runEntrypoint: runEntrypointFlag,
-          acp: acpFlag
+          acp: acpFlag,
+          botToken: botTokenFlag,
+          signingSecret: signingSecretFlag,
+          appId: appIdFlag,
+          appName: appNameFlag,
+          botName: botNameFlag,
+          botImageUrl: botImageUrlFlag
         });
         break;
       }
@@ -79931,10 +80691,10 @@ async function main() {
         process14.exit(1);
     }
   } catch (err) {
-    console.error(import_picocolors49.default.red(`
+    console.error(import_picocolors52.default.red(`
 ${err.message}`));
     if (err instanceof ApiError && err.status === 401) {
-      console.error(`  Run ${import_picocolors49.default.cyan("brainbase login")} to connect this device.`);
+      console.error(`  Run ${import_picocolors52.default.cyan("brainbase login")} to connect this device.`);
     }
     if (process14.env.BRAINBASE_DEBUG)
       console.error(err.stack);