@brainbase-labs/cli 0.21.2 → 0.23.0

package/dist/index.js

@@ -35128,12 +35128,12 @@ var require_dist2 = __commonJS((exports, module) => {
       throw new Error(`Unknown format "${name}"`);
     return f4;
   };
-  function addFormats(ajv, list, fs80, exportName) {
+  function addFormats(ajv, list, fs81, exportName) {
     var _a;
     var _b;
     (_a = (_b = ajv.opts.code).formats) !== null && _a !== undefined || (_b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`);
     for (const f4 of list)
-      ajv.addFormat(f4, fs80[f4]);
+      ajv.addFormat(f4, fs81[f4]);
   }
   module.exports = exports = formatsPlugin;
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -35141,9 +35141,9 @@ var require_dist2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-var import_picocolors49 = __toESM(require_picocolors(), 1);
+var import_picocolors52 = __toESM(require_picocolors(), 1);
 import process14 from "node:process";
-import fs82 from "node:fs";
+import fs83 from "node:fs";
 
 // src/cli/template.ts
 var import_picocolors12 = __toESM(require_picocolors(), 1);
@@ -36008,7 +36008,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.21.2",
+  version: "0.23.0",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -53931,6 +53931,76 @@ function clearTokenIfMatches(prefix) {
   });
 }
 
+// src/core/credentials.ts
+var REGISTRY_COMMANDS = "template, skill, token";
+var CONTROL_PLANE_COMMANDS = "agent, orchestration, link, unlink, sync, status, team";
+var NOT_A_PAT = "(not a bbpat_… token)";
+function maskPat(token) {
+  if (!isValidTokenFormat(token))
+    return NOT_A_PAT;
+  return token.slice(0, TOKEN_PREFIX_LEN);
+}
+function readEnvPat() {
+  const value = process.env.BRAINBASE_TOKEN?.trim();
+  if (!value)
+    return null;
+  return { prefix: maskPat(value), malformed: !isValidTokenFormat(value) };
+}
+function storedPatIgnoredHint(client) {
+  const setEnv = `Set BRAINBASE_TOKEN to that token's value to authenticate with it here, ` + "or run `brainbase login` to refresh the session";
+  switch (client) {
+    case "control-plane":
+      return `The PAT saved in ${TOKEN_FILE} is never used by control-plane ` + `commands (${CONTROL_PLANE_COMMANDS}). ${setEnv}.`;
+    case "managed-task":
+      return `The PAT saved in ${TOKEN_FILE} is not used while a login session is ` + `configured. ${setEnv} — or \`brainbase logout\`, which leaves the ` + "PAT as the only credential.";
+    default: {
+      const exhaustive = client;
+      throw new Error(`unhandled credential client: ${String(exhaustive)}`);
+    }
+  }
+}
+function withStoredPatHint(reason, client) {
+  if (!readToken())
+    return reason;
+  const trimmed = reason.trimEnd();
+  const separator = /[.!?:]$/.test(trimmed) ? " " : ". ";
+  return `${trimmed}${separator}${storedPatIgnoredHint(client)}`;
+}
+function withRejectedSessionHint(message, source, client) {
+  if (source !== "session")
+    return message;
+  return withStoredPatHint(message, client);
+}
+function isRefreshable(session) {
+  return Boolean(session.refresh_token && session.supabase_url && session.supabase_anon_key);
+}
+function describeCredentials() {
+  const env3 = readEnvPat();
+  const status = authStatus();
+  const stored = readToken();
+  const refreshable = Boolean(status.session && !status.ok && isRefreshable(status.session));
+  const session = status.session ? {
+    email: status.session.email ?? null,
+    userId: status.session.user_id,
+    expiresAt: status.session.expires_at ?? null,
+    expired: !status.ok,
+    refreshable
+  } : null;
+  let active = null;
+  if (env3)
+    active = "env_pat";
+  else if (status.ok || refreshable)
+    active = "session";
+  else if (stored)
+    active = "stored_pat";
+  return {
+    active,
+    envPat: env3,
+    session,
+    storedPat: stored ? { name: stored.name ?? null, prefix: stored.prefix } : null
+  };
+}
+
 // src/core/api.ts
 var DEFAULT_CONTROL_PLANE_BASE = "https://api.brainbaselabs.com";
 var DEFAULT_PROXY_BASE = "https://api.v1.brainbaselabs.com";
@@ -54005,7 +54075,7 @@ function legacyScheduleError() {
 function legacyAgentConfigError() {
   return new ApiError("Declarative machine/model config requires the MAS control plane. Set BRAINBASE_CONTROL_PLANE_URL or unset the legacy BRAINBASE_API_URL override.", 400);
 }
-async function resolveCredential() {
+async function resolveCredential(storedPatHint = "control-plane") {
   const envToken = process.env.BRAINBASE_TOKEN;
   if (envToken && envToken.trim()) {
     return {
@@ -54023,19 +54093,20 @@ async function resolveCredential() {
     };
   }
   const status = authStatus();
-  throw new ApiError(status.ok ? "CLI authentication changed while this command was starting; retry it" : status.reason ?? "not logged in", 401);
+  const reason = status.reason ?? "not logged in";
+  throw new ApiError(status.ok ? "CLI authentication changed while this command was starting; retry it" : storedPatHint ? withStoredPatHint(reason, storedPatHint) : reason, 401);
 }
 async function resolveMasCredential() {
   const configuredSession = readAuth();
   try {
-    return await resolveCredential();
+    return await resolveCredential(null);
   } catch (error) {
     if (!(error instanceof ApiError && error.status === 401)) {
       throw error;
     }
     if (configuredSession || readAuth()) {
       if (readToken()) {
-        throw new ApiError(`${error.message}. A stored PAT is available but will not be used while a login session is configured. Run \`brainbase logout\` to use the stored PAT, or \`brainbase login\` to refresh the session.`, 401);
+        throw new ApiError(`${error.message}. ${storedPatIgnoredHint("managed-task")}`, 401);
       }
       throw error;
     }
@@ -54134,7 +54205,8 @@ async function request(pathname, init = {}) {
     body = text2 ? JSON.parse(text2) : null;
   } catch {}
   if (!res.ok) {
-    throw new ApiError(apiErrorMessage(body, res.status), res.status, body);
+    const message = apiErrorMessage(body, res.status);
+    throw new ApiError(res.status === 401 ? withRejectedSessionHint(message, credential.source, "control-plane") : message, res.status, body);
   }
   return body;
 }
@@ -54277,7 +54349,7 @@ async function masRequest(pathname, init) {
     }
     if (!res.ok) {
       const message = masApiErrorMessage(body, res.status);
-      throw new ApiError(res.status >= 500 ? `${message} Task creation may still be processing; check your tasks before running this command again.` : message, res.status, body);
+      throw new ApiError(res.status >= 500 ? `${message} Task creation may still be processing; check your tasks before running this command again.` : res.status === 401 ? withRejectedSessionHint(message, credential.source, "managed-task") : message, res.status, body);
     }
     return body;
   }
@@ -54292,6 +54364,19 @@ var masApi = {
     return parseMasTaskCreateResponse(body);
   }
 };
+function isUnroutedPath(body) {
+  return !!body && typeof body === "object" && body.detail === "Not Found";
+}
+async function connectionsRequest(pathname, init) {
+  try {
+    return await request(pathname, init);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404 && isUnroutedPath(err.body)) {
+      throw new ApiError("This control plane does not support reading or changing connections yet. Update the server, or use the web app.", 404, err.body);
+    }
+    throw err;
+  }
+}
 var api = {
   listOrgs() {
     return request("/orgs");
@@ -54379,6 +54464,21 @@ var api = {
       method: "DELETE"
     });
   },
+  getAgentConnections(agentId) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/connections`);
+  },
+  connectSlack(agentId, input) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/connections/slack`, { method: "PUT", body: JSON.stringify(input) });
+  },
+  connectMeeting(agentId, input) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/connections/meeting`, { method: "PUT", body: JSON.stringify(input) });
+  },
+  disconnectIntegration(agentId, integration) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/connections/${encodeURIComponent(integration)}`, { method: "DELETE" });
+  },
+  listAgentMcpServers(agentId) {
+    return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/mcp-servers`);
+  },
   listOrchestrations(orgId, teamId) {
     return request(`/orgs/${encodeURIComponent(orgId)}/teams/${encodeURIComponent(teamId)}/orchestrations`);
   },
@@ -61630,12 +61730,13 @@ async function runLogin(_cwd, args) {
 // src/ui/ink/IdentityCard.tsx
 var jsx_dev_runtime15 = __toESM(require_jsx_dev_runtime(), 1);
 function IdentityCard(props) {
+  const hasRows = Boolean(props.rows?.length || props.controlPlaneUrl || props.expiresAt);
   return /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Card, {
     title: props.title,
     tone: props.tone ?? "info",
     children: [
       props.email && /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Box_default, {
-        marginBottom: props.controlPlaneUrl || props.expiresAt ? 1 : 0,
+        marginBottom: hasRows ? 1 : 0,
         children: /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Text, {
           bold: true,
           children: props.email
@@ -61644,6 +61745,20 @@ function IdentityCard(props) {
       /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Box_default, {
         flexDirection: "column",
         children: [
+          props.rows?.map(([label, value]) => /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Box_default, {
+            children: [
+              /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Box_default, {
+                width: 15,
+                children: /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Text, {
+                  dimColor: true,
+                  children: label
+                }, undefined, false, undefined, this)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Text, {
+                children: value
+              }, undefined, false, undefined, this)
+            ]
+          }, label, true, undefined, this)),
           props.controlPlaneUrl && /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Box_default, {
             children: [
               /* @__PURE__ */ jsx_dev_runtime15.jsxDEV(Box_default, {
@@ -61711,22 +61826,117 @@ async function runLogout() {
 }
 
 // src/cli/whoami.ts
-async function runWhoami() {
-  const { ok, session, reason } = authStatus();
-  if (!ok || !session) {
-    await showIdentityCard({
-      title: "NOT SIGNED IN",
-      tone: "warn",
-      message: `${reason ?? "not logged in"}. Run \`brainbase login\` to connect this device.`
-    });
-    process.exit(1);
+function usableForControlPlane(report) {
+  switch (report.active) {
+    case "env_pat":
+      return !report.envPat?.malformed;
+    case "session":
+      return true;
+    case "stored_pat":
+    case null:
+      return false;
+    default: {
+      const exhaustive = report.active;
+      throw new Error(`unhandled credential: ${String(exhaustive)}`);
+    }
+  }
+}
+function exitCodeFor(report) {
+  return usableForControlPlane(report) ? 0 : 1;
+}
+function reasonFor(report) {
+  switch (report.active) {
+    case "env_pat":
+      return report.envPat?.malformed ? "BRAINBASE_TOKEN is set to something that is not a `bbpat_…` token, " + "and it outranks every other credential — so every request will fail " + "until it is corrected or unset. Mint one with `brainbase token create`." : null;
+    case "session":
+      return null;
+    case "stored_pat":
+      return `The stored PAT authenticates registry commands (${REGISTRY_COMMANDS}) only. ` + `Set BRAINBASE_TOKEN to its value for ${CONTROL_PLANE_COMMANDS}, ` + "or run `brainbase login`.";
+    case null:
+      return report.session?.expired ? "Session expired. Run `brainbase login` to connect this device." : "Not logged in. Run `brainbase login` to connect this device.";
+    default: {
+      const exhaustive = report.active;
+      throw new Error(`unhandled credential: ${String(exhaustive)}`);
+    }
+  }
+}
+function toJson(report, reason) {
+  const usingSession = report.active === "session";
+  return {
+    credential: report.active,
+    authenticated: report.active !== null && !report.envPat?.malformed,
+    control_plane: usableForControlPlane(report),
+    email: usingSession ? report.session?.email ?? null : null,
+    user_id: usingSession ? report.session?.userId ?? null : null,
+    expires_at: usingSession ? report.session?.expiresAt ?? null : null,
+    token_prefix: report.active === "env_pat" ? report.envPat?.prefix ?? null : report.active === "stored_pat" ? report.storedPat?.prefix ?? null : null,
+    control_plane_url: controlPlaneBaseUrl(usingSession ? readAuth() : null),
+    session: report.session ? {
+      present: true,
+      expired: report.session.expired,
+      refreshable: report.session.refreshable
+    } : { present: false, expired: false, refreshable: false },
+    stored_pat: report.storedPat ? { present: true, name: report.storedPat.name } : { present: false, name: null },
+    reason
+  };
+}
+function displayPrefix(prefix) {
+  return prefix === NOT_A_PAT ? prefix : `${prefix}…`;
+}
+function cardRows(report) {
+  const rows = [];
+  switch (report.active) {
+    case "env_pat":
+      rows.push(["credential", "BRAINBASE_TOKEN (env PAT)"]);
+      if (report.envPat) {
+        rows.push(["token", displayPrefix(report.envPat.prefix)]);
+      }
+      break;
+    case "session":
+      rows.push([
+        "credential",
+        report.session?.refreshable ? "login session (auth.json) — expired, renews on next use" : "login session (auth.json)"
+      ]);
+      break;
+    case "stored_pat":
+      rows.push(["credential", "stored PAT (token.json)"]);
+      rows.push([
+        "token",
+        report.storedPat?.name ? `${displayPrefix(report.storedPat.prefix)} (${report.storedPat.name})` : displayPrefix(report.storedPat?.prefix ?? "?")
+      ]);
+      break;
+    case null:
+      break;
+    default: {
+      const exhaustive = report.active;
+      throw new Error(`unhandled credential: ${String(exhaustive)}`);
+    }
   }
+  if (report.session && report.active !== "session") {
+    rows.push([
+      "session",
+      `${report.session.email ?? report.session.userId} (${report.session.expired ? "expired" : "not used — env PAT wins"})`
+    ]);
+  }
+  return rows;
+}
+async function runWhoami(args = {}) {
+  const report = describeCredentials();
+  const reason = reasonFor(report);
+  process.exitCode = exitCodeFor(report);
+  if (args.json) {
+    console.log(JSON.stringify(toJson(report, reason), null, 2));
+    return;
+  }
+  const signedIn = report.active !== null;
   await showIdentityCard({
-    title: "WHOAMI",
-    tone: "ok",
-    email: session.email ?? session.user_id,
-    controlPlaneUrl: controlPlaneBaseUrl(session),
-    expiresAt: session.expires_at
+    title: signedIn ? "WHOAMI" : "NOT SIGNED IN",
+    tone: process.exitCode === 0 ? "ok" : "warn",
+    email: report.active === "session" ? report.session?.email ?? report.session?.userId ?? null : null,
+    controlPlaneUrl: signedIn ? controlPlaneBaseUrl(report.active === "session" ? readAuth() : null) : null,
+    expiresAt: report.active === "session" ? report.session?.expiresAt : null,
+    rows: cardRows(report),
+    message: reason ?? undefined
   });
 }
 
@@ -63308,7 +63518,7 @@ function runHarnessInstall(harnessId, components, opts, agentName) {
 }
 
 // src/cli/agent.ts
-var import_picocolors34 = __toESM(require_picocolors(), 1);
+var import_picocolors37 = __toESM(require_picocolors(), 1);
 
 // src/cli/agent-pull.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -66421,6 +66631,396 @@ function formatAgentList(agents, labels) {
 `);
 }
 
+// src/cli/agent-connections.ts
+var import_picocolors35 = __toESM(require_picocolors(), 1);
+
+// src/core/integrations.ts
+var IMPLEMENTED_INTEGRATIONS = ["slack", "meeting"];
+function isImplemented(name) {
+  return IMPLEMENTED_INTEGRATIONS.includes(name);
+}
+function actionability(state) {
+  if (!state.manageable_from_cli) {
+    return { kind: "web-only", ...state.unmanageable_reason ? { reason: state.unmanageable_reason } : {} };
+  }
+  return isImplemented(state.name) ? { kind: "connectable" } : { kind: "needs-newer-cli" };
+}
+var GENERIC_WEB_ONLY_REASON = "This integration cannot be connected from the terminal. Use the web app.";
+var UPGRADE_HINT = "This control plane supports connecting it, but this version of the CLI does not. Upgrade the CLI.";
+function explain(state) {
+  const action = actionability(state);
+  switch (action.kind) {
+    case "connectable":
+      return `brainbase agent connect ${state.name}`;
+    case "needs-newer-cli":
+      return UPGRADE_HINT;
+    case "web-only":
+      return action.reason ?? GENERIC_WEB_ONLY_REASON;
+    default: {
+      const exhaustive = action;
+      return exhaustive;
+    }
+  }
+}
+
+// src/cli/agent-connect.ts
+var import_picocolors34 = __toESM(require_picocolors(), 1);
+
+// src/core/secret-input.ts
+import fs74 from "node:fs";
+function clean(value) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : undefined;
+}
+var STDIN_IDLE_TIMEOUT_MS = 5000;
+var STDIN_TIMEOUT_MIN_MS = 100;
+var STDIN_TIMEOUT_MAX_MS = 600000;
+function stdinTimeoutMs(env3) {
+  const raw = Number(env3.BRAINBASE_STDIN_TIMEOUT_MS);
+  if (!Number.isFinite(raw) || raw <= 0)
+    return STDIN_IDLE_TIMEOUT_MS;
+  return Math.min(Math.max(raw, STDIN_TIMEOUT_MIN_MS), STDIN_TIMEOUT_MAX_MS);
+}
+
+class StdinTimeoutError extends Error {
+  constructor(idleTimeoutMs, bytesRead) {
+    super(`stdin went quiet for ${idleTimeoutMs}ms after ${bytesRead} byte(s), before it was closed. ` + "Refusing to use a partial value. If the source is slow, raise " + "BRAINBASE_STDIN_TIMEOUT_MS; if it will not close its end of the pipe, " + "pass the value with a flag or an environment variable instead.");
+    this.name = "StdinTimeoutError";
+  }
+}
+function readPipeUntilEof(stream, idleTimeoutMs) {
+  return new Promise((resolve, reject2) => {
+    const chunks = [];
+    let received = 0;
+    let timer;
+    const stopTimer = () => {
+      if (timer !== undefined) {
+        clearTimeout(timer);
+        timer = undefined;
+      }
+    };
+    const restartTimer = () => {
+      stopTimer();
+      timer = setTimeout(onIdle, idleTimeoutMs);
+    };
+    const detach = () => {
+      stopTimer();
+      stream.removeListener("data", onData);
+      stream.removeListener("end", onEnd);
+      stream.removeListener("error", onError);
+      stream.pause();
+      stream.unref?.();
+    };
+    function onIdle() {
+      if (received > 0) {
+        detach();
+        reject2(new StdinTimeoutError(idleTimeoutMs, received));
+        return;
+      }
+      detach();
+      resolve("");
+    }
+    function onData(chunk2) {
+      const buf = Buffer.from(chunk2);
+      received += buf.length;
+      chunks.push(buf);
+      restartTimer();
+    }
+    function onEnd() {
+      detach();
+      resolve(Buffer.concat(chunks).toString("utf8"));
+    }
+    function onError(err) {
+      detach();
+      reject2(err);
+    }
+    stream.on("data", onData);
+    stream.on("end", onEnd);
+    stream.on("error", onError);
+    restartTimer();
+  });
+}
+async function defaultReadStdin(env3 = process.env) {
+  if (process.stdin.isTTY)
+    return null;
+  let isRegularFile = false;
+  try {
+    isRegularFile = fs74.fstatSync(0).isFile();
+  } catch {
+    return "";
+  }
+  if (isRegularFile) {
+    try {
+      return fs74.readFileSync(0, "utf8");
+    } catch {
+      return "";
+    }
+  }
+  try {
+    return await readPipeUntilEof(process.stdin, stdinTimeoutMs(env3));
+  } catch (err) {
+    if (err instanceof StdinTimeoutError)
+      throw err;
+    return "";
+  }
+}
+async function defaultPrompt(field) {
+  const answer = await re({
+    message: field.label,
+    validate: (v3) => v3 && v3.trim() ? undefined : "Required"
+  });
+  return String(ensureNotCancelled(answer)).trim();
+}
+function parseStdinSecrets(raw, missing) {
+  const body = raw.trim();
+  if (!body)
+    return {};
+  if (body.startsWith("{")) {
+    let source;
+    try {
+      source = JSON.parse(body);
+    } catch {
+      throw new Error('stdin looked like JSON but could not be parsed. Pass an object such as {"bot_token":"…","signing_secret":"…"}.');
+    }
+    const out = {};
+    for (const field of missing) {
+      const value = clean(source[field.key]);
+      if (value)
+        out[field.key] = value;
+    }
+    return out;
+  }
+  if (missing.length === 1) {
+    return { [missing[0].key]: body };
+  }
+  throw new Error(`stdin supplies one value, but ${missing.length} are still missing (${missing.map((f4) => f4.key).join(", ")}). Pipe a JSON object instead, or pass the rest as flags.`);
+}
+async function resolveSecrets(fields, deps = {}) {
+  const env3 = deps.env ?? process.env;
+  const readStdin = deps.readStdin ?? (() => defaultReadStdin(env3));
+  const prompt = deps.prompt ?? defaultPrompt;
+  const interactive = deps.interactive ?? isInteractive;
+  const resolved = {};
+  for (const field of fields) {
+    const value = clean(field.value) ?? clean(env3[field.envVar]);
+    if (value)
+      resolved[field.key] = value;
+  }
+  let missing = fields.filter((f4) => !resolved[f4.key]);
+  if (missing.length > 0) {
+    const raw = await readStdin();
+    if (raw !== null) {
+      Object.assign(resolved, parseStdinSecrets(raw, missing));
+      missing = fields.filter((f4) => !resolved[f4.key]);
+    }
+  }
+  for (const field of missing) {
+    if (!interactive()) {
+      throw new NonInteractiveError(`${field.label} is required. Pass ${field.flag}, set ${field.envVar}, or pipe it on stdin.`);
+    }
+    resolved[field.key] = await prompt(field);
+  }
+  return resolved;
+}
+
+// src/cli/agent-connect.ts
+async function runAgentConnect(cwd2, target, args, deps = {}) {
+  const json = Boolean(args.json);
+  try {
+    report(await connect(cwd2, target, args, deps, json), json);
+  } catch (err) {
+    if (!json)
+      throw err;
+    reportFailure(err);
+  }
+}
+async function connect(cwd2, target, args, deps, json) {
+  if (!target) {
+    throw new Error(`Which integration? Try: ${IMPLEMENTED_INTEGRATIONS.join(", ")}.`);
+  }
+  if (!json)
+    banner(`agent connect ${target}`);
+  const link2 = readLink(cwd2);
+  if (!link2) {
+    throw new Error("This folder is not linked to any agent. Run `brainbase link` first.");
+  }
+  await assertConnectable(link2.agent_id, target, deps);
+  return target === "slack" ? connectSlack(link2.agent_id, args, deps, json) : connectMeeting(link2.agent_id, args, deps, json);
+}
+async function assertConnectable(agentId, target, deps) {
+  const fetchConnections = deps.fetchConnections ?? ((id) => api.getAgentConnections(id));
+  const { integrations } = await fetchConnections(agentId);
+  const state = integrations.find((i) => i.name === target);
+  if (!state) {
+    const known = integrations.map((i) => i.name).join(", ");
+    throw new Error(`Unknown integration ${JSON.stringify(target)}. This agent has: ${known}.`);
+  }
+  const action = actionability(state);
+  if (action.kind === "connectable")
+    return;
+  throw new Error(explain(state));
+}
+async function connectSlack(agentId, args, deps, json) {
+  const secrets = await resolveSecrets([
+    {
+      key: "bot_token",
+      flag: "--bot-token",
+      envVar: "BRAINBASE_SLACK_BOT_TOKEN",
+      label: "Slack bot token (xoxb-…)",
+      value: args.botToken
+    },
+    {
+      key: "signing_secret",
+      flag: "--signing-secret",
+      envVar: "BRAINBASE_SLACK_SIGNING_SECRET",
+      label: "Slack signing secret",
+      value: args.signingSecret
+    }
+  ], { ...deps.secrets, ...json ? { interactive: () => false } : {} });
+  return api.connectSlack(agentId, {
+    bot_token: secrets.bot_token,
+    signing_secret: secrets.signing_secret,
+    ...args.appId ? { app_id: args.appId } : {},
+    ...args.appName ? { app_name: args.appName } : {}
+  });
+}
+async function connectMeeting(agentId, args, deps, json) {
+  const ask = deps.askBotName ?? (() => text({
+    message: "Name for the meeting bot",
+    placeholder: "Notetaker",
+    flagHint: "Pass --bot-name <name>."
+  }));
+  let botName = args.botName?.trim();
+  if (!botName) {
+    if (json) {
+      throw new Error("A meeting bot name is required. Pass --bot-name <name>.");
+    }
+    botName = (await ask()).trim();
+  }
+  if (!botName)
+    throw new Error("A meeting bot name is required. Pass --bot-name <name>.");
+  return api.connectMeeting(agentId, {
+    bot_name: botName,
+    ...args.botImageUrl ? { bot_image_url: args.botImageUrl } : {}
+  });
+}
+function reportFailure(err) {
+  console.log(JSON.stringify({ error: err.message }, null, 2));
+  process.exitCode = 1;
+}
+function report(result2, json) {
+  if (json) {
+    console.log(JSON.stringify(result2, null, 2));
+    return;
+  }
+  const detail = result2.detail ? ` ${import_picocolors34.default.dim(`(${result2.detail})`)}` : "";
+  f2.success(`${result2.name} connected${detail}`);
+  f2.info(`Run ${import_picocolors34.default.cyan("brainbase agent pull")} to pick up the built-in ${result2.name} MCP server.`);
+}
+
+// src/cli/agent-connections.ts
+async function runAgentConnections(cwd2, args) {
+  const json = Boolean(args.json);
+  if (!json)
+    banner("agent connections — what this agent is wired to");
+  const link2 = readLink(cwd2);
+  if (!link2) {
+    if (json) {
+      console.log(JSON.stringify({ linked: false, integrations: [] }, null, 2));
+      process.exitCode = 1;
+      return;
+    }
+    f2.warn("This folder is not linked to any agent.");
+    f2.info(`Run ${import_picocolors35.default.cyan("brainbase link")} first.`);
+    process.exitCode = 1;
+    return;
+  }
+  let connections;
+  try {
+    connections = await api.getAgentConnections(link2.agent_id);
+  } catch (err) {
+    if (!json)
+      throw err;
+    reportFailure(err);
+    return;
+  }
+  if (json) {
+    console.log(JSON.stringify({ linked: true, ...connections }, null, 2));
+    return;
+  }
+  console.log(formatConnections(connections));
+}
+function formatConnections(connections) {
+  const lines = [""];
+  for (const integration of connections.integrations) {
+    lines.push(`  ${statusMark(integration)} ${import_picocolors35.default.bold(integration.name)}${describe(integration)}`);
+    const hint = hintFor(integration);
+    if (hint)
+      lines.push(`      ${import_picocolors35.default.dim(hint)}`);
+  }
+  lines.push("");
+  return lines.join(`
+`);
+}
+function statusMark(integration) {
+  return integration.connected ? import_picocolors35.default.green("✓") : import_picocolors35.default.dim("·");
+}
+function describe(integration) {
+  if (!integration.connected)
+    return `  ${import_picocolors35.default.dim("not connected")}`;
+  return integration.detail ? `  ${import_picocolors35.default.dim(integration.detail)}` : `  ${import_picocolors35.default.dim("connected")}`;
+}
+function hintFor(integration) {
+  const action = actionability(integration);
+  if (integration.connected) {
+    return action.kind === "connectable" ? `brainbase agent disconnect ${integration.name}` : undefined;
+  }
+  return explain(integration);
+}
+
+// src/cli/agent-disconnect.ts
+var import_picocolors36 = __toESM(require_picocolors(), 1);
+async function runAgentDisconnect(cwd2, target, args) {
+  const json = Boolean(args.json);
+  try {
+    await disconnect(cwd2, target, args, json);
+  } catch (err) {
+    if (!json)
+      throw err;
+    reportFailure(err);
+  }
+}
+async function disconnect(cwd2, target, args, json) {
+  if (!target) {
+    throw new Error(`Which integration? Try: ${IMPLEMENTED_INTEGRATIONS.join(", ")}.`);
+  }
+  if (!isImplemented(target)) {
+    throw new Error(`Cannot disconnect ${JSON.stringify(target)} from the CLI. Try: ${IMPLEMENTED_INTEGRATIONS.join(", ")}.`);
+  }
+  if (!json)
+    banner(`agent disconnect ${target}`);
+  const link2 = readLink(cwd2);
+  if (!link2) {
+    throw new Error("This folder is not linked to any agent. Run `brainbase link` first.");
+  }
+  if (!json && !autoProceed(args.yes)) {
+    const ok = ensureNotCancelled(await se({ message: `Disconnect ${target} from ${link2.name}?` }));
+    if (!ok) {
+      f2.info("Nothing changed.");
+      return;
+    }
+  }
+  const result2 = await api.disconnectIntegration(link2.agent_id, target);
+  if (json) {
+    console.log(JSON.stringify(result2, null, 2));
+    return;
+  }
+  f2.success(`${target} disconnected`);
+  f2.info(`Run ${import_picocolors36.default.cyan("brainbase agent pull")} to drop the built-in ${target} MCP server locally.`);
+}
+
 // src/cli/agent.ts
 async function runAgent(cwd2, sub, args, opts) {
   if (args.some((arg) => arg === "--help" || arg === "-h")) {
@@ -66471,6 +67071,23 @@ async function runAgent(cwd2, sub, args, opts) {
     case "status":
       await runAgentStatus(cwd2, { json: opts.json });
       return;
+    case "connections":
+      await runAgentConnections(cwd2, { json: opts.json });
+      return;
+    case "connect":
+      await runAgentConnect(cwd2, args[0], {
+        botToken: opts.botToken,
+        signingSecret: opts.signingSecret,
+        appId: opts.appId,
+        appName: opts.appName,
+        botName: opts.botName,
+        botImageUrl: opts.botImageUrl,
+        json: opts.json
+      });
+      return;
+    case "disconnect":
+      await runAgentDisconnect(cwd2, args[0], { yes: opts.yes, json: opts.json });
+      return;
     case "env":
       await runAgentEnv(cwd2, { shell: opts.shell });
       return;
@@ -66490,25 +67107,31 @@ async function runAgent(cwd2, sub, args, opts) {
 function printHelp() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors34.default.bold("brainbase agent")} ${import_picocolors34.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors37.default.bold("brainbase agent")} ${import_picocolors37.default.dim("<sub> [options]")}`);
+  out.push("");
+  out.push(`  ${import_picocolors37.default.cyan("list")}               ${import_picocolors37.default.dim("show the agents in a team, with the ids `brainbase link` takes (--json for scripts)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("create")}             ${import_picocolors37.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
+  out.push(`  ${import_picocolors37.default.cyan("pull")} ${import_picocolors37.default.dim("[<id>]")}      ${import_picocolors37.default.dim("apply cloud changes into this folder — pass <id> to switch (--force to override); --run-entrypoint to also execute the agent entrypoint")}`);
+  out.push(`  ${import_picocolors37.default.cyan("push")}               ${import_picocolors37.default.dim("send local changes to the cloud — instructions, playbooks, skills, MCPs, entrypoint (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("unpack")}             ${import_picocolors37.default.dim("install the claimed agent into a harness layout (--harness to override)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("status")}             ${import_picocolors37.default.dim("show what would push, what would pull, and which manifest blocks are ignored (--json for scripts)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("connections")}        ${import_picocolors37.default.dim("show which integrations this agent is wired to (--json for scripts)")}`);
+  out.push(`  ${import_picocolors37.default.cyan("connect")} ${import_picocolors37.default.dim("<name>")}     ${import_picocolors37.default.dim("connect slack or meeting — credentials come from flags, env, or stdin")}`);
+  out.push(`  ${import_picocolors37.default.cyan("disconnect")} ${import_picocolors37.default.dim("<name>")}  ${import_picocolors37.default.dim("revoke a slack or meeting install")}`);
+  out.push(`  ${import_picocolors37.default.cyan("env")}                ${import_picocolors37.default.dim('print export statements — use with `eval "$(brainbase agent env)"`')}`);
   out.push("");
-  out.push(`  ${import_picocolors34.default.cyan("list")}               ${import_picocolors34.default.dim("show the agents in a team, with the ids `brainbase link` takes (--json for scripts)")}`);
-  out.push(`  ${import_picocolors34.default.cyan("create")}             ${import_picocolors34.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors34.default.cyan("pull")} ${import_picocolors34.default.dim("[<id>]")}      ${import_picocolors34.default.dim("apply cloud changes into this folder — pass <id> to switch (--force to override); --run-entrypoint to also execute the agent entrypoint")}`);
-  out.push(`  ${import_picocolors34.default.cyan("push")}               ${import_picocolors34.default.dim("send local changes to the cloud — instructions, playbooks, skills, MCPs, entrypoint (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors34.default.cyan("unpack")}             ${import_picocolors34.default.dim("install the claimed agent into a harness layout (--harness to override)")}`);
-  out.push(`  ${import_picocolors34.default.cyan("status")}             ${import_picocolors34.default.dim("show what would push, what would pull, and which manifest blocks are ignored (--json for scripts)")}`);
-  out.push(`  ${import_picocolors34.default.cyan("env")}                ${import_picocolors34.default.dim('print export statements — use with `eval "$(brainbase agent env)"`')}`);
+  out.push(`  ${import_picocolors37.default.dim("Slack credentials:")} ${import_picocolors37.default.dim("--bot-token / BRAINBASE_SLACK_BOT_TOKEN, --signing-secret / BRAINBASE_SLACK_SIGNING_SECRET,")}`);
+  out.push(`  ${import_picocolors37.default.dim('or pipe {"bot_token":"…","signing_secret":"…"} on stdin to keep them out of argv.')}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/team.ts
-var import_picocolors36 = __toESM(require_picocolors(), 1);
+var import_picocolors39 = __toESM(require_picocolors(), 1);
 
 // src/cli/team-list.ts
-var import_picocolors35 = __toESM(require_picocolors(), 1);
+var import_picocolors38 = __toESM(require_picocolors(), 1);
 async function runTeamList(args) {
   if (!args.json)
     banner("team list — teams you can put agents in");
@@ -66528,25 +67151,25 @@ async function runTeamList(args) {
 function formatTeamList(grouped) {
   const lines = [""];
   if (grouped.length === 0) {
-    lines.push(`  ${import_picocolors35.default.dim("You are not a member of any organization.")}`, "");
+    lines.push(`  ${import_picocolors38.default.dim("You are not a member of any organization.")}`, "");
     return lines.join(`
 `);
   }
   const nameWidth = Math.max(...grouped.flatMap(({ teams }) => teams.map((t) => t.name.length)), 0);
   for (const { org, teams, error } of grouped) {
-    const slug = org.slug ? `  ${import_picocolors35.default.dim(org.slug)}` : "";
-    lines.push(`  ${import_picocolors35.default.bold(org.name)}${slug}`);
+    const slug = org.slug ? `  ${import_picocolors38.default.dim(org.slug)}` : "";
+    lines.push(`  ${import_picocolors38.default.bold(org.name)}${slug}`);
     if (error) {
-      lines.push(`    ${import_picocolors35.default.red(`could not load teams: ${error}`)}`);
+      lines.push(`    ${import_picocolors38.default.red(`could not load teams: ${error}`)}`);
     } else if (teams.length === 0) {
-      lines.push(`    ${import_picocolors35.default.dim("no teams yet — create one in the web app")}`);
+      lines.push(`    ${import_picocolors38.default.dim("no teams yet — create one in the web app")}`);
     }
     for (const team of teams) {
-      lines.push(`    ${team.name.padEnd(nameWidth)}  ${import_picocolors35.default.dim(team.id)}`);
+      lines.push(`    ${team.name.padEnd(nameWidth)}  ${import_picocolors38.default.dim(team.id)}`);
     }
     lines.push("");
   }
-  lines.push(`  ${import_picocolors35.default.dim("list a team’s agents with")} ${import_picocolors35.default.cyan("brainbase agent list --team <id>")}`, "");
+  lines.push(`  ${import_picocolors38.default.dim("list a team’s agents with")} ${import_picocolors38.default.cyan("brainbase agent list --team <id>")}`, "");
   return lines.join(`
 `);
 }
@@ -66577,28 +67200,28 @@ async function runTeam(sub, args, opts) {
 function printHelp2() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors36.default.bold("brainbase team")} ${import_picocolors36.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors39.default.bold("brainbase team")} ${import_picocolors39.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors36.default.cyan("list")}   ${import_picocolors36.default.dim("show the teams you can create agents in, grouped by organization")}`);
+  out.push(`  ${import_picocolors39.default.cyan("list")}   ${import_picocolors39.default.dim("show the teams you can create agents in, grouped by organization")}`);
   out.push("");
-  out.push(`  ${import_picocolors36.default.dim("--org <id-or-slug>")}  ${import_picocolors36.default.dim("limit to one organization")}`);
-  out.push(`  ${import_picocolors36.default.dim("--json")}              ${import_picocolors36.default.dim("machine-readable output")}`);
+  out.push(`  ${import_picocolors39.default.dim("--org <id-or-slug>")}  ${import_picocolors39.default.dim("limit to one organization")}`);
+  out.push(`  ${import_picocolors39.default.dim("--json")}              ${import_picocolors39.default.dim("machine-readable output")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/orchestration.ts
-var import_picocolors43 = __toESM(require_picocolors(), 1);
+var import_picocolors46 = __toESM(require_picocolors(), 1);
 
 // src/cli/orchestration-pull.ts
 import path86 from "node:path";
-import fs77 from "node:fs";
-var import_picocolors37 = __toESM(require_picocolors(), 1);
+import fs78 from "node:fs";
+var import_picocolors40 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-manifest.ts
 import path83 from "node:path";
-import fs74 from "node:fs";
+import fs75 from "node:fs";
 var import_yaml4 = __toESM(require_dist(), 1);
 var ORCH_MANIFEST_FILE = "brainbase-orchestration.yaml";
 var ORCH_MEMBERS_DIR = "agents";
@@ -66654,13 +67277,13 @@ function orchManifestPath(cwd2) {
   return path83.join(cwd2, ORCH_MANIFEST_FILE);
 }
 function hasOrchManifest(cwd2) {
-  return fs74.existsSync(orchManifestPath(cwd2));
+  return fs75.existsSync(orchManifestPath(cwd2));
 }
 function readOrchManifest(cwd2) {
   const p2 = orchManifestPath(cwd2);
-  if (!fs74.existsSync(p2))
+  if (!fs75.existsSync(p2))
     return null;
-  const raw = fs74.readFileSync(p2, "utf8");
+  const raw = fs75.readFileSync(p2, "utf8");
   let parsed;
   try {
     parsed = import_yaml4.default.parse(raw);
@@ -66681,7 +67304,7 @@ function writeOrchManifest(cwd2, manifest) {
 ` + " `brainbase orchestration push`. Member agents live under ./agents/." + `
  Schedule triggers are writable. App/Pipedream triggers are preserved
 ` + " as read-only context and ignored by `orchestration push`.";
-  fs74.writeFileSync(orchManifestPath(cwd2), String(doc), "utf8");
+  fs75.writeFileSync(orchManifestPath(cwd2), String(doc), "utf8");
 }
 function memberDir(cwd2, slug) {
   return path83.join(cwd2, ORCH_MEMBERS_DIR, slug);
@@ -66719,7 +67342,7 @@ function resolveMemberSlugs(members) {
 
 // src/core/orchestration-link.ts
 import path84 from "node:path";
-import fs75 from "node:fs";
+import fs76 from "node:fs";
 var ORCH_LINK_FILE = "orchestration-link.json";
 var ORCH_SYNC_STATE_FILE = "orchestration-sync-state.json";
 var OrchestrationLinkSchema = exports_external.object({
@@ -66770,12 +67393,12 @@ function readOrchLink(cwd2) {
 }
 function writeOrchLink(cwd2, link2) {
   ensureDir(path84.join(cwd2, LINK_DIR));
-  const clean = {};
+  const clean2 = {};
   for (const [k3, v3] of Object.entries(link2)) {
     if (v3 !== null && v3 !== undefined)
-      clean[k3] = v3;
+      clean2[k3] = v3;
   }
-  writeJson(orchLinkPath(cwd2), clean);
+  writeJson(orchLinkPath(cwd2), clean2);
   ensureGitignore2(cwd2);
 }
 function readOrchSyncState(cwd2) {
@@ -66799,12 +67422,12 @@ function ensureGitignore2(cwd2) {
 `;
   try {
     if (!exists(ignorePath)) {
-      fs75.writeFileSync(ignorePath, desired);
+      fs76.writeFileSync(ignorePath, desired);
       return;
     }
-    const current = fs75.readFileSync(ignorePath, "utf8");
+    const current = fs76.readFileSync(ignorePath, "utf8");
     if (!current.split(/\r?\n/).some((l2) => l2.trim() === ORCH_SYNC_STATE_FILE)) {
-      fs75.writeFileSync(ignorePath, current.endsWith(`
+      fs76.writeFileSync(ignorePath, current.endsWith(`
 `) ? current + desired : current + `
 ` + desired);
     }
@@ -66813,7 +67436,7 @@ function ensureGitignore2(cwd2) {
 
 // src/core/agent-fresh-install.ts
 import path85 from "node:path";
-import fs76 from "node:fs";
+import fs77 from "node:fs";
 import os15 from "node:os";
 async function installAgentFresh(input) {
   const { cwd: cwd2, agent, cloud, harness } = input;
@@ -66904,19 +67527,19 @@ async function installAgentFresh(input) {
     };
   } finally {
     try {
-      fs76.rmSync(stageRoot, { recursive: true, force: true });
+      fs77.rmSync(stageRoot, { recursive: true, force: true });
     } catch {}
   }
 }
 function stageManifestComponents2(components) {
-  const root = fs76.mkdtempSync(path85.join(os15.tmpdir(), "brainbase-orch-pull-"));
+  const root = fs77.mkdtempSync(path85.join(os15.tmpdir(), "brainbase-orch-pull-"));
   for (const c2 of components) {
     const compDir = path85.join(root, c2.type, c2.slug);
     ensureDir(compDir);
     for (const f4 of c2.files) {
       const target = path85.join(compDir, f4.path);
       ensureDir(path85.dirname(target));
-      fs76.writeFileSync(target, f4.content);
+      fs77.writeFileSync(target, f4.content);
     }
   }
   return root;
@@ -66951,7 +67574,7 @@ function materializeInstructions2(cwd2, cloud) {
       continue;
     const target = path85.join(cwd2, DEFAULT_INSTRUCTIONS_FILE);
     ensureDir(path85.dirname(target));
-    fs76.writeFileSync(target, normalizeInstructionBody(body), "utf8");
+    fs77.writeFileSync(target, normalizeInstructionBody(body), "utf8");
     return;
   }
 }
@@ -66965,7 +67588,7 @@ function materializePlaybooks2(cwd2, cloud) {
     const { body } = stripPlaybookFrontmatter(raw);
     const target = path85.join(cwd2, DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`);
     ensureDir(path85.dirname(target));
-    fs76.writeFileSync(target, body, "utf8");
+    fs77.writeFileSync(target, body, "utf8");
   }
 }
 function buildManifestFromCloud(cloud, agent, localOnly = {}) {
@@ -67114,8 +67737,8 @@ async function runOrchestrationPull(cwd2, args) {
     orchId = args.orchestrationId;
   } else {
     f2.warn("This folder is not linked to any orchestration.");
-    f2.info(`Run ${import_picocolors37.default.cyan("brainbase orchestration pull <id>")} with an orchestration id,
-  or ${import_picocolors37.default.cyan("brainbase orchestration list")} to find one.`);
+    f2.info(`Run ${import_picocolors40.default.cyan("brainbase orchestration pull <id>")} with an orchestration id,
+  or ${import_picocolors40.default.cyan("brainbase orchestration list")} to find one.`);
     return;
   }
   const sp = de();
@@ -67134,24 +67757,24 @@ async function runOrchestrationPull(cwd2, args) {
   const slugFor = (agentId) => slugByAgent.get(agentId) ?? agentId;
   const planLines = [];
   planLines.push("");
-  planLines.push(`  ${import_picocolors37.default.bold(cloud.name)} ${import_picocolors37.default.dim(`(${cloud.id})`)}`);
+  planLines.push(`  ${import_picocolors40.default.bold(cloud.name)} ${import_picocolors40.default.dim(`(${cloud.id})`)}`);
   if (cloud.description)
-    planLines.push(`  ${import_picocolors37.default.dim(cloud.description)}`);
+    planLines.push(`  ${import_picocolors40.default.dim(cloud.description)}`);
   planLines.push("");
-  planLines.push(`  ${import_picocolors37.default.dim("members:")}`);
+  planLines.push(`  ${import_picocolors40.default.dim("members:")}`);
   for (const m3 of cloud.members) {
     const skipped = !m3.manifest;
-    const tail2 = skipped ? import_picocolors37.default.red(" (manifest unavailable — skipped)") : "";
-    planLines.push(`    ${import_picocolors37.default.cyan("•")} ${import_picocolors37.default.bold(slugFor(m3.agent_id))} ${import_picocolors37.default.dim(`(${m3.name})`)}${tail2}`);
+    const tail2 = skipped ? import_picocolors40.default.red(" (manifest unavailable — skipped)") : "";
+    planLines.push(`    ${import_picocolors40.default.cyan("•")} ${import_picocolors40.default.bold(slugFor(m3.agent_id))} ${import_picocolors40.default.dim(`(${m3.name})`)}${tail2}`);
   }
   if (cloud.edges.length) {
     planLines.push("");
-    planLines.push(`  ${import_picocolors37.default.dim("edges:")}`);
+    planLines.push(`  ${import_picocolors40.default.dim("edges:")}`);
     for (const e2 of cloud.edges) {
       const from = slugFor(e2.from_agent_id);
       const to2 = slugFor(e2.to_agent_id);
-      const desc = e2.description ? `  ${import_picocolors37.default.dim("— " + e2.description)}` : "";
-      planLines.push(`    ${import_picocolors37.default.cyan(from)} ${import_picocolors37.default.dim("→")} ${import_picocolors37.default.cyan(to2)}${desc}`);
+      const desc = e2.description ? `  ${import_picocolors40.default.dim("— " + e2.description)}` : "";
+      planLines.push(`    ${import_picocolors40.default.cyan(from)} ${import_picocolors40.default.dim("→")} ${import_picocolors40.default.cyan(to2)}${desc}`);
     }
   }
   planLines.push("");
@@ -67160,7 +67783,7 @@ async function runOrchestrationPull(cwd2, args) {
   const isRefresh = !!existingLink;
   if (!autoProceed(args.yes) && !isRefresh) {
     const ok = await se({
-      message: `Pull into ${import_picocolors37.default.bold(cwd2)}?`,
+      message: `Pull into ${import_picocolors40.default.bold(cwd2)}?`,
       initialValue: true
     });
     if (!ensureNotCancelled(ok)) {
@@ -67169,7 +67792,7 @@ async function runOrchestrationPull(cwd2, args) {
     }
   }
   const fallbackHarness = args.harness ?? "claude-code";
-  fs77.mkdirSync(cwd2, { recursive: true });
+  fs78.mkdirSync(cwd2, { recursive: true });
   if (hasOrchManifest(cwd2) && existingLink && existingLink.orchestration_id !== orchId) {
     f2.error(`This folder is linked to orchestration ${existingLink.orchestration_id}, not ${orchId}. Move to a fresh directory or unlink first.`);
     return;
@@ -67204,7 +67827,7 @@ async function runOrchestrationPull(cwd2, args) {
         scope: "project",
         pullSecrets: true
       });
-      memberSp.stop(`Installed ${import_picocolors37.default.bold(slug)} ${import_picocolors37.default.dim(`(${m3.manifest.components.length} components)`)}.`);
+      memberSp.stop(`Installed ${import_picocolors40.default.bold(slug)} ${import_picocolors40.default.dim(`(${m3.manifest.components.length} components)`)}.`);
       installedMembers.push({
         agent_id: m3.agent_id,
         slug,
@@ -67265,7 +67888,7 @@ async function runOrchestrationPull(cwd2, args) {
       payload_schema: e2.payload_schema ?? {}
     }))
   });
-  $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path86.basename(cwd2)}/ ${import_picocolors37.default.dim(`(${installedMembers.length}/${cloud.members.length} members)`)}.`);
+  $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path86.basename(cwd2)}/ ${import_picocolors40.default.dim(`(${installedMembers.length}/${cloud.members.length} members)`)}.`);
 }
 function handleApiError5(err) {
   if (err instanceof ApiError) {
@@ -67282,7 +67905,7 @@ function handleApiError5(err) {
 }
 
 // src/cli/orchestration-push.ts
-var import_picocolors38 = __toESM(require_picocolors(), 1);
+var import_picocolors41 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-outgoing.ts
 function buildOrchestrationGraphPayload(manifest, slugToAgentId) {
@@ -67365,7 +67988,7 @@ function findUnpushableMembers(cwd2, members) {
       continue;
     }
     if (!memberManifest.id) {
-      f2.error(`${m3.slug}: ${AGENT_MANIFEST_FILE} is unclaimed (no ${import_picocolors38.default.cyan("id")}), so there is nothing to push to.`);
+      f2.error(`${m3.slug}: ${AGENT_MANIFEST_FILE} is unclaimed (no ${import_picocolors41.default.cyan("id")}), so there is nothing to push to.`);
       blocked.push(m3.slug);
       continue;
     }
@@ -67380,12 +68003,12 @@ async function runOrchestrationPush(cwd2, args) {
   const link2 = readOrchLink(cwd2);
   if (!link2) {
     f2.warn("This folder is not linked to any orchestration.");
-    f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration pull <id>")} first.`);
+    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   if (!hasOrchManifest(cwd2)) {
-    f2.warn(`No ${import_picocolors38.default.bold(ORCH_MANIFEST_FILE)} here.`);
-    f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration pull")} to materialise the manifest before pushing.`);
+    f2.warn(`No ${import_picocolors41.default.bold(ORCH_MANIFEST_FILE)} here.`);
+    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull")} to materialise the manifest before pushing.`);
     return;
   }
   let manifest;
@@ -67409,7 +68032,7 @@ async function runOrchestrationPush(cwd2, args) {
   }
   if (missing.length) {
     f2.error(`Missing local checkouts for: ${missing.join(", ")}.`);
-    f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration pull")} to materialise the missing folders.`);
+    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull")} to materialise the missing folders.`);
     process.exitCode = 1;
     return;
   }
@@ -67430,13 +68053,13 @@ async function runOrchestrationPush(cwd2, args) {
     }
   }
   const plan = [""];
-  plan.push(`  ${import_picocolors38.default.bold(link2.name)} ${import_picocolors38.default.dim(`(${link2.orchestration_id})`)}`);
-  plan.push(`  ${import_picocolors38.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
+  plan.push(`  ${import_picocolors41.default.bold(link2.name)} ${import_picocolors41.default.dim(`(${link2.orchestration_id})`)}`);
+  plan.push(`  ${import_picocolors41.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
   plan.push("");
   if (!args.graphOnly) {
-    plan.push(`  ${import_picocolors38.default.dim("per-member agent push:")}`);
+    plan.push(`  ${import_picocolors41.default.dim("per-member agent push:")}`);
     for (const m3 of manifest.members) {
-      plan.push(`    ${import_picocolors38.default.cyan("•")} ${import_picocolors38.default.bold(m3.slug)}`);
+      plan.push(`    ${import_picocolors41.default.cyan("•")} ${import_picocolors41.default.bold(m3.slug)}`);
     }
     plan.push("");
   }
@@ -67456,7 +68079,7 @@ async function runOrchestrationPush(cwd2, args) {
     for (const m3 of manifest.members) {
       const dir = memberDir(cwd2, m3.slug);
       console.log("");
-      console.log(`${import_picocolors38.default.dim("───")} ${import_picocolors38.default.bold(m3.slug)} ${import_picocolors38.default.dim("───")}`);
+      console.log(`${import_picocolors41.default.dim("───")} ${import_picocolors41.default.bold(m3.slug)} ${import_picocolors41.default.dim("───")}`);
       const exitCodeBeforePush = process.exitCode;
       try {
         await runAgentPush(dir, { yes: true });
@@ -67520,7 +68143,7 @@ function handleApiError6(err) {
       f2.error("You do not have access to this orchestration.");
     } else if (err.status === 409) {
       f2.error(err.message);
-      f2.info(`Run ${import_picocolors38.default.cyan("brainbase orchestration pull")} to reconcile, then push again.`);
+      f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull")} to reconcile, then push again.`);
     } else {
       f2.error(err.message);
     }
@@ -67530,13 +68153,13 @@ function handleApiError6(err) {
 }
 
 // src/cli/orchestration-status.ts
-var import_picocolors39 = __toESM(require_picocolors(), 1);
+var import_picocolors42 = __toESM(require_picocolors(), 1);
 async function runOrchestrationStatus(cwd2) {
   banner("orchestration status — what changed locally, remotely, both");
   const link2 = readOrchLink(cwd2);
   if (!link2) {
     f2.warn("This folder is not linked to any orchestration.");
-    f2.info(`Run ${import_picocolors39.default.cyan("brainbase orchestration pull <id>")} first.`);
+    f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   const localManifest = hasOrchManifest(cwd2) ? readOrchManifest(cwd2) : null;
@@ -67559,8 +68182,8 @@ async function runOrchestrationStatus(cwd2) {
   }
   const lines = [];
   lines.push("");
-  lines.push(`  ${import_picocolors39.default.bold(link2.name)} ${import_picocolors39.default.dim(`(${link2.orchestration_id})`)}`);
-  lines.push(`  ${import_picocolors39.default.dim("revision")}  cloud ${cloud.revision}${lock ? ` · lock ${lock.revision}` : " · never pulled"}`);
+  lines.push(`  ${import_picocolors42.default.bold(link2.name)} ${import_picocolors42.default.dim(`(${link2.orchestration_id})`)}`);
+  lines.push(`  ${import_picocolors42.default.dim("revision")}  cloud ${cloud.revision}${lock ? ` · lock ${lock.revision}` : " · never pulled"}`);
   lines.push("");
   const localSlugByAgentId = new Map;
   for (const m3 of localManifest?.members ?? []) {
@@ -67574,12 +68197,12 @@ async function runOrchestrationStatus(cwd2) {
   const membersAdded = [...localMemberSet].filter((s3) => !cloudMemberSet.has(s3));
   const membersRemoved = [...cloudMemberSet].filter((s3) => !localMemberSet.has(s3));
   if (membersAdded.length || membersRemoved.length) {
-    lines.push(`  ${import_picocolors39.default.bold("members")}`);
+    lines.push(`  ${import_picocolors42.default.bold("members")}`);
     for (const slug of membersAdded) {
-      lines.push(`    ${import_picocolors39.default.yellow("→ push")}  added in yaml: ${import_picocolors39.default.bold(slug)}`);
+      lines.push(`    ${import_picocolors42.default.yellow("→ push")}  added in yaml: ${import_picocolors42.default.bold(slug)}`);
     }
     for (const slug of membersRemoved) {
-      lines.push(`    ${import_picocolors39.default.cyan("← pull")}  added on cloud: ${import_picocolors39.default.bold(slug)}`);
+      lines.push(`    ${import_picocolors42.default.cyan("← pull")}  added on cloud: ${import_picocolors42.default.bold(slug)}`);
     }
     lines.push("");
   }
@@ -67594,11 +68217,11 @@ async function runOrchestrationStatus(cwd2) {
   const edgesAdded = [...localEdges.keys()].filter((k3) => !cloudEdges.has(k3));
   const edgesRemoved = [...cloudEdges.keys()].filter((k3) => !localEdges.has(k3));
   if (edgesAdded.length || edgesRemoved.length) {
-    lines.push(`  ${import_picocolors39.default.bold("edges")}`);
+    lines.push(`  ${import_picocolors42.default.bold("edges")}`);
     for (const k3 of edgesAdded)
-      lines.push(`    ${import_picocolors39.default.yellow("→ push")}  added in yaml: ${k3}`);
+      lines.push(`    ${import_picocolors42.default.yellow("→ push")}  added in yaml: ${k3}`);
     for (const k3 of edgesRemoved)
-      lines.push(`    ${import_picocolors39.default.cyan("← pull")}  added on cloud: ${k3}`);
+      lines.push(`    ${import_picocolors42.default.cyan("← pull")}  added on cloud: ${k3}`);
     lines.push("");
   }
   const cloudTriggerKey = (t) => {
@@ -67636,11 +68259,11 @@ async function runOrchestrationStatus(cwd2) {
   const triggersAdded = [...localTriggers.keys()].filter((k3) => !cloudTriggers.has(k3));
   const triggersRemoved = [...cloudTriggers.keys()].filter((k3) => !localTriggers.has(k3));
   if (triggersAdded.length || triggersRemoved.length) {
-    lines.push(`  ${import_picocolors39.default.bold("schedule triggers")}`);
+    lines.push(`  ${import_picocolors42.default.bold("schedule triggers")}`);
     for (const k3 of triggersAdded)
-      lines.push(`    ${import_picocolors39.default.yellow("→ push")}  added/changed in yaml: ${localTriggers.get(k3) ?? k3}`);
+      lines.push(`    ${import_picocolors42.default.yellow("→ push")}  added/changed in yaml: ${localTriggers.get(k3) ?? k3}`);
     for (const k3 of triggersRemoved)
-      lines.push(`    ${import_picocolors39.default.cyan("← pull")}  added/changed on cloud: ${cloudTriggers.get(k3) ?? k3}`);
+      lines.push(`    ${import_picocolors42.default.cyan("← pull")}  added/changed on cloud: ${cloudTriggers.get(k3) ?? k3}`);
     lines.push("");
   }
   const lockByAgentId = new Map((lock?.members ?? []).map((m3) => [m3.agent_id, m3]));
@@ -67663,27 +68286,27 @@ async function runOrchestrationStatus(cwd2) {
     }
   }
   if (memberDrift.length) {
-    lines.push(`  ${import_picocolors39.default.bold("member content drift")}`);
+    lines.push(`  ${import_picocolors42.default.bold("member content drift")}`);
     for (const d3 of memberDrift) {
-      lines.push(`    ${import_picocolors39.default.cyan("?")} ${import_picocolors39.default.bold(d3.slug)}  ${import_picocolors39.default.dim("— " + d3.reason)}`);
+      lines.push(`    ${import_picocolors42.default.cyan("?")} ${import_picocolors42.default.bold(d3.slug)}  ${import_picocolors42.default.dim("— " + d3.reason)}`);
     }
-    lines.push(`    ${import_picocolors39.default.dim("cd into each member folder and run")} ${import_picocolors39.default.cyan("brainbase agent status")}`);
+    lines.push(`    ${import_picocolors42.default.dim("cd into each member folder and run")} ${import_picocolors42.default.cyan("brainbase agent status")}`);
     lines.push("");
   }
   const revisionDrift = lock?.revision != null && cloud.revision !== lock.revision;
   if (revisionDrift) {
-    lines.push(`  ${import_picocolors39.default.bold("cloud revision")}`);
-    lines.push(`    ${import_picocolors39.default.cyan("← pull")}  cloud changed since last pull: ${import_picocolors39.default.dim(`lock ${lock.revision} → cloud ${cloud.revision}`)}`);
+    lines.push(`  ${import_picocolors42.default.bold("cloud revision")}`);
+    lines.push(`    ${import_picocolors42.default.cyan("← pull")}  cloud changed since last pull: ${import_picocolors42.default.dim(`lock ${lock.revision} → cloud ${cloud.revision}`)}`);
     lines.push("");
   }
   if (!membersAdded.length && !membersRemoved.length && !edgesAdded.length && !edgesRemoved.length && !triggersAdded.length && !triggersRemoved.length && !memberDrift.length && !revisionDrift) {
-    lines.push(`  ${import_picocolors39.default.green("✓")} everything is in sync`);
+    lines.push(`  ${import_picocolors42.default.green("✓")} everything is in sync`);
     lines.push("");
     console.log(lines.join(`
 `));
     return;
   }
-  lines.push(`  ${import_picocolors39.default.dim("run")} ${import_picocolors39.default.cyan("brainbase orchestration pull")} ${import_picocolors39.default.dim("to apply cloud changes,")} ${import_picocolors39.default.cyan("brainbase orchestration push")} ${import_picocolors39.default.dim("to send yours")}`);
+  lines.push(`  ${import_picocolors42.default.dim("run")} ${import_picocolors42.default.cyan("brainbase orchestration pull")} ${import_picocolors42.default.dim("to apply cloud changes,")} ${import_picocolors42.default.cyan("brainbase orchestration push")} ${import_picocolors42.default.dim("to send yours")}`);
   lines.push("");
   console.log(lines.join(`
 `));
@@ -67698,7 +68321,7 @@ function stableJson(value) {
 }
 
 // src/cli/orchestration-list.ts
-var import_picocolors40 = __toESM(require_picocolors(), 1);
+var import_picocolors43 = __toESM(require_picocolors(), 1);
 async function runOrchestrationList(args) {
   banner("orchestration list — orchestrations under a team");
   const { org, team } = await resolveOrgAndTeam({
@@ -67722,21 +68345,21 @@ async function runOrchestrationList(args) {
   }
   const lines = [""];
   for (const o2 of items) {
-    lines.push(`  ${import_picocolors40.default.bold(o2.name)}  ${import_picocolors40.default.dim(o2.id)}`);
+    lines.push(`  ${import_picocolors43.default.bold(o2.name)}  ${import_picocolors43.default.dim(o2.id)}`);
     if (o2.description)
-      lines.push(`    ${import_picocolors40.default.dim(o2.description)}`);
-    lines.push(`    ${import_picocolors40.default.dim(`${o2.member_count} member${o2.member_count === 1 ? "" : "s"} · ${o2.edge_count} edge${o2.edge_count === 1 ? "" : "s"}`)}`);
+      lines.push(`    ${import_picocolors43.default.dim(o2.description)}`);
+    lines.push(`    ${import_picocolors43.default.dim(`${o2.member_count} member${o2.member_count === 1 ? "" : "s"} · ${o2.edge_count} edge${o2.edge_count === 1 ? "" : "s"}`)}`);
     lines.push("");
   }
-  lines.push(`  ${import_picocolors40.default.dim("pull one with")} ${import_picocolors40.default.cyan("brainbase orchestration pull <id>")}`);
+  lines.push(`  ${import_picocolors43.default.dim("pull one with")} ${import_picocolors43.default.cyan("brainbase orchestration pull <id>")}`);
   lines.push("");
   console.log(lines.join(`
 `));
 }
 
 // src/cli/orchestration-add-agent.ts
-import fs78 from "node:fs";
-var import_picocolors41 = __toESM(require_picocolors(), 1);
+import fs79 from "node:fs";
+var import_picocolors44 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-add.ts
 function resolveOrgIdForGroup(groupId, orgsWithTeams) {
@@ -67801,7 +68424,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   const link2 = readOrchLink(cwd2);
   if (!link2 || !hasOrchManifest(cwd2)) {
     f2.warn("This folder is not a linked orchestration.");
-    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull <id>")} first.`);
+    f2.info(`Run ${import_picocolors44.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   let manifest;
@@ -67821,13 +68444,13 @@ async function runOrchestrationAddAgent(cwd2, args) {
     })).trim();
   }
   let slug = slugifyMemberName(name);
-  if (manifest.members.some((m3) => m3.slug === slug) || fs78.existsSync(memberDir(cwd2, slug))) {
+  if (manifest.members.some((m3) => m3.slug === slug) || fs79.existsSync(memberDir(cwd2, slug))) {
     let n = 2;
     let candidate = `${slug}-${n}`;
-    while (manifest.members.some((m3) => m3.slug === candidate) || fs78.existsSync(memberDir(cwd2, candidate))) {
+    while (manifest.members.some((m3) => m3.slug === candidate) || fs79.existsSync(memberDir(cwd2, candidate))) {
       candidate = `${slug}-${++n}`;
     }
-    f2.info(`Slug ${import_picocolors41.default.bold(slug)} is taken — using ${import_picocolors41.default.bold(candidate)}.`);
+    f2.info(`Slug ${import_picocolors44.default.bold(slug)} is taken — using ${import_picocolors44.default.bold(candidate)}.`);
     slug = candidate;
   }
   let payloadSchema;
@@ -67851,7 +68474,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
       const resolved = resolveOrgIdForGroup(link2.group_id, orgsWithTeams);
       if (!resolved) {
         sp.stop("Failed.");
-        f2.error(`Could not find an org that owns group ${import_picocolors41.default.bold(link2.group_id)}. ` + `Pass ${import_picocolors41.default.cyan("--org <id>")} explicitly.`);
+        f2.error(`Could not find an org that owns group ${import_picocolors44.default.bold(link2.group_id)}. ` + `Pass ${import_picocolors44.default.cyan("--org <id>")} explicitly.`);
         return;
       }
       orgId = resolved;
@@ -67868,14 +68491,14 @@ async function runOrchestrationAddAgent(cwd2, args) {
   if (from.length === 0 && to2.length === 0 && isInteractive() && manifest.members.length > 0) {
     const memberOptions = manifest.members.map((m3) => ({ value: m3.slug, label: m3.slug }));
     const pickedFrom = await ae({
-      message: `Connect ${import_picocolors41.default.bold(slug)} FROM which member(s)? — edges INTO ${slug} (space to select, enter to skip)`,
+      message: `Connect ${import_picocolors44.default.bold(slug)} FROM which member(s)? — edges INTO ${slug} (space to select, enter to skip)`,
       options: memberOptions,
       required: false
     });
     if (Array.isArray(pickedFrom))
       from = pickedFrom;
     const pickedTo = await ae({
-      message: `Connect ${import_picocolors41.default.bold(slug)} TO which member(s)? — edges OUT of ${slug} (space to select, enter to skip)`,
+      message: `Connect ${import_picocolors44.default.bold(slug)} TO which member(s)? — edges OUT of ${slug} (space to select, enter to skip)`,
       options: memberOptions,
       required: false
     });
@@ -67896,7 +68519,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   }
   const dest = memberDir(cwd2, slug);
   try {
-    fs78.mkdirSync(dest, { recursive: true });
+    fs79.mkdirSync(dest, { recursive: true });
     await runAgentCreate(dest, {
       name,
       orgId,
@@ -67907,30 +68530,30 @@ async function runOrchestrationAddAgent(cwd2, args) {
     });
   } catch (err) {
     try {
-      fs78.rmSync(dest, { recursive: true, force: true });
+      fs79.rmSync(dest, { recursive: true, force: true });
     } catch {}
     f2.error(`Failed to create ${slug}: ${err.message}`);
     return;
   }
   writeOrchManifest(cwd2, updated);
   if (args.noPush) {
-    f2.info(`Manifest updated. Run ${import_picocolors41.default.cyan("brainbase orchestration push")} to apply.`);
+    f2.info(`Manifest updated. Run ${import_picocolors44.default.cyan("brainbase orchestration push")} to apply.`);
     return;
   }
   await runOrchestrationPush(cwd2, { yes: true, graphOnly: true });
 }
 
 // src/cli/orchestration-create.ts
-var import_picocolors42 = __toESM(require_picocolors(), 1);
+var import_picocolors45 = __toESM(require_picocolors(), 1);
 async function runOrchestrationCreate(cwd2, args) {
   banner("orchestration create — claim a brainbase-orchestration.yaml");
   if (readOrchLink(cwd2)) {
     f2.warn("This folder is already linked to an orchestration.");
-    f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration push")} to update it.`);
+    f2.info(`Run ${import_picocolors45.default.cyan("brainbase orchestration push")} to update it.`);
     return;
   }
   if (!hasOrchManifest(cwd2)) {
-    f2.warn(`No ${import_picocolors42.default.bold(ORCH_MANIFEST_FILE)} here.`);
+    f2.warn(`No ${import_picocolors45.default.bold(ORCH_MANIFEST_FILE)} here.`);
     f2.info(`Create one, or pull an existing orchestration first.`);
     return;
   }
@@ -67963,10 +68586,10 @@ async function runOrchestrationCreate(cwd2, args) {
   });
   const plan = [
     "",
-    `  ${import_picocolors42.default.bold(manifest.orchestration.name)}`,
-    `  ${import_picocolors42.default.dim("org")}      ${import_picocolors42.default.bold(target.org.name)}`,
-    `  ${import_picocolors42.default.dim("team")}     ${import_picocolors42.default.bold(target.team.name)}`,
-    `  ${import_picocolors42.default.dim("graph")}    ${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`,
+    `  ${import_picocolors45.default.bold(manifest.orchestration.name)}`,
+    `  ${import_picocolors45.default.dim("org")}      ${import_picocolors45.default.bold(target.org.name)}`,
+    `  ${import_picocolors45.default.dim("team")}     ${import_picocolors45.default.bold(target.team.name)}`,
+    `  ${import_picocolors45.default.dim("graph")}    ${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`,
     ""
   ];
   console.log(plan.join(`
@@ -67996,7 +68619,7 @@ async function runOrchestrationCreate(cwd2, args) {
       edges: graph.edges,
       triggers: graph.triggers
     });
-    sp.stop(`Created ${import_picocolors42.default.bold(created.name)}.`);
+    sp.stop(`Created ${import_picocolors45.default.bold(created.name)}.`);
     writeOrchLink(cwd2, {
       schemaVersion: 1,
       orchestration_id: created.id,
@@ -68109,21 +68732,21 @@ async function runOrchestration(cwd2, sub, args, opts) {
 function printHelp3() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors43.default.bold("brainbase orchestration")} ${import_picocolors43.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors46.default.bold("brainbase orchestration")} ${import_picocolors46.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors43.default.cyan("create")}           ${import_picocolors43.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
-  out.push(`  ${import_picocolors43.default.cyan("pull")} ${import_picocolors43.default.dim("<id>")}      ${import_picocolors43.default.dim("fetch orchestration + every member agent into this folder")}`);
-  out.push(`  ${import_picocolors43.default.cyan("push")}             ${import_picocolors43.default.dim("push each member, then update the orchestration graph")}`);
-  out.push(`  ${import_picocolors43.default.cyan("add-agent")} ${import_picocolors43.default.dim("<name>")}    ${import_picocolors43.default.dim("create a member agent, wire edges (--from/--to), and push")}`);
-  out.push(`  ${import_picocolors43.default.cyan("status")}           ${import_picocolors43.default.dim("show what would push and what would pull")}`);
-  out.push(`  ${import_picocolors43.default.cyan("list")}             ${import_picocolors43.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors46.default.cyan("create")}           ${import_picocolors46.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors46.default.cyan("pull")} ${import_picocolors46.default.dim("<id>")}      ${import_picocolors46.default.dim("fetch orchestration + every member agent into this folder")}`);
+  out.push(`  ${import_picocolors46.default.cyan("push")}             ${import_picocolors46.default.dim("push each member, then update the orchestration graph")}`);
+  out.push(`  ${import_picocolors46.default.cyan("add-agent")} ${import_picocolors46.default.dim("<name>")}    ${import_picocolors46.default.dim("create a member agent, wire edges (--from/--to), and push")}`);
+  out.push(`  ${import_picocolors46.default.cyan("status")}           ${import_picocolors46.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors46.default.cyan("list")}             ${import_picocolors46.default.dim("list orchestrations under a team")}`);
   out.push("");
-  out.push(`  ${import_picocolors43.default.bold("Flags")}`);
-  out.push(`    ${import_picocolors43.default.dim("--yes, -y")}        skip confirmations`);
-  out.push(`    ${import_picocolors43.default.dim("--harness <id>")}   harness for newly-created member folders (default claude-code)`);
-  out.push(`    ${import_picocolors43.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`);
-  out.push(`    ${import_picocolors43.default.dim("--org <id>")}       for create/list: org id or slug (CLI vocab — DB teams.id)`);
-  out.push(`    ${import_picocolors43.default.dim("--team <id>")}      for create/list: team id (CLI vocab — DB groups.id)`);
+  out.push(`  ${import_picocolors46.default.bold("Flags")}`);
+  out.push(`    ${import_picocolors46.default.dim("--yes, -y")}        skip confirmations`);
+  out.push(`    ${import_picocolors46.default.dim("--harness <id>")}   harness for newly-created member folders (default claude-code)`);
+  out.push(`    ${import_picocolors46.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`);
+  out.push(`    ${import_picocolors46.default.dim("--org <id>")}       for create/list: org id or slug (CLI vocab — DB teams.id)`);
+  out.push(`    ${import_picocolors46.default.dim("--team <id>")}      for create/list: team id (CLI vocab — DB groups.id)`);
   out.push("");
   console.log(out.join(`
 `));
@@ -68168,11 +68791,11 @@ async function runRun(cwd2, args) {
 }
 
 // src/cli/publish.ts
-var import_picocolors44 = __toESM(require_picocolors(), 1);
+var import_picocolors47 = __toESM(require_picocolors(), 1);
 function runPublish() {
   banner("publish — moved");
-  f2.error(`${import_picocolors44.default.bold("brainbase publish")} does not exist.`);
-  f2.info(`Use ${import_picocolors44.default.cyan("brainbase agent push")} to send your local changes to the cloud.`);
+  f2.error(`${import_picocolors47.default.bold("brainbase publish")} does not exist.`);
+  f2.info(`Use ${import_picocolors47.default.cyan("brainbase agent push")} to send your local changes to the cloud.`);
   process.exit(1);
 }
 
@@ -68471,7 +69094,7 @@ async function runStatus(cwd2) {
 }
 
 // src/cli/token.ts
-var import_picocolors45 = __toESM(require_picocolors(), 1);
+var import_picocolors48 = __toESM(require_picocolors(), 1);
 
 // src/ui/ink/TokenCards.tsx
 var jsx_dev_runtime17 = __toESM(require_jsx_dev_runtime(), 1);
@@ -68481,14 +69104,6 @@ function TokenCreatedCard(props) {
     tone: "warn",
     subtitle: "shown ONCE — copy it now",
     children: [
-      /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Box_default, {
-        marginBottom: 1,
-        children: /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Text, {
-          bold: true,
-          color: "yellow",
-          children: props.token
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this),
       /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Box_default, {
         flexDirection: "column",
         marginBottom: 1,
@@ -68549,20 +69164,22 @@ function TokenCreatedCard(props) {
           /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Text, {
             dimColor: true,
             children: [
-              "saved locally to ",
+              "saved to ",
               props.storedAt,
-              " (mode 0600)"
+              " (mode 0600) — covers ",
+              REGISTRY_COMMANDS
             ]
           }, undefined, true, undefined, this),
           /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Text, {
             dimColor: true,
             children: [
-              "for CI: set ",
+              CONTROL_PLANE_COMMANDS,
+              " do ",
               /* @__PURE__ */ jsx_dev_runtime17.jsxDEV(Text, {
                 bold: true,
-                children: "BRAINBASE_TOKEN"
+                children: "not"
               }, undefined, false, undefined, this),
-              " instead of relying on token.json"
+              " read that file — export it instead:"
             ]
           }, undefined, true, undefined, this)
         ]
@@ -68571,9 +69188,12 @@ function TokenCreatedCard(props) {
   }, undefined, true, undefined, this);
 }
 async function showTokenCreatedCard(props) {
+  const { token, ...card } = props;
   await renderStatic(/* @__PURE__ */ jsx_dev_runtime17.jsxDEV(TokenCreatedCard, {
-    ...props
+    ...card
   }, undefined, false, undefined, this));
+  console.log(`  export BRAINBASE_TOKEN=${token}`);
+  console.log("");
 }
 function TokenListCard(props) {
   if (props.active.length === 0) {
@@ -68739,11 +69359,32 @@ function isAllowedScope(value) {
 function isExpired2(token) {
   return Boolean(token.expires_at && Date.parse(token.expires_at) <= Date.now());
 }
+function isJwtRequired(body) {
+  if (!body || typeof body !== "object")
+    return false;
+  const detail = body.detail;
+  if (!detail || typeof detail !== "object")
+    return false;
+  return detail.code === "jwt_required";
+}
+function sessionWouldBeUsed() {
+  const { ok, session } = authStatus();
+  if (ok)
+    return true;
+  return Boolean(session?.refresh_token && session.supabase_url && session.supabase_anon_key);
+}
 function withLoginHint(error) {
-  if (error instanceof ApiError && error.status === 403) {
-    return new Error("Managing tokens needs a logged-in session; a PAT (BRAINBASE_TOKEN) cannot. " + "Run `brainbase login` and try again.");
-  }
-  return error;
+  if (!(error instanceof ApiError) || error.status !== 403)
+    return error;
+  if (!isJwtRequired(error.body))
+    return error;
+  if (!process.env.BRAINBASE_TOKEN?.trim()) {
+    if (sessionWouldBeUsed() || !readToken())
+      return error;
+    return new Error("Managing tokens needs a logged-in session; the stored PAT cannot. " + "Run `brainbase login` and try again.");
+  }
+  const lead = "Managing tokens needs a logged-in session, and BRAINBASE_TOKEN is set — " + "that PAT is being used instead.";
+  return new Error(sessionWouldBeUsed() ? `${lead} Run \`unset BRAINBASE_TOKEN\` and try again.` : `${lead} Run \`unset BRAINBASE_TOKEN\`, then \`brainbase login\`.`);
 }
 async function runTokenCreate(args) {
   banner("token create — make a long-lived CLI key");
@@ -68766,10 +69407,16 @@ async function runTokenCreate(args) {
   }
   const spinner = de();
   spinner.start("Creating token…");
-  const created = await registryApi.createCliToken({
-    name,
-    scopes
-  });
+  let created;
+  try {
+    created = await registryApi.createCliToken({
+      name,
+      scopes
+    });
+  } catch (error) {
+    spinner.stop("Could not create token.");
+    throw withLoginHint(error);
+  }
   spinner.stop("Token created.");
   try {
     writeToken(created.token, name);
@@ -68790,7 +69437,12 @@ async function runTokenCreate(args) {
 }
 async function runTokenList() {
   banner("tokens");
-  const tokens = await registryApi.listCliTokens();
+  let tokens;
+  try {
+    tokens = await registryApi.listCliTokens();
+  } catch (error) {
+    throw withLoginHint(error);
+  }
   const active = tokens.filter((t) => !t.revoked_at);
   const revoked = tokens.filter((t) => t.revoked_at);
   const local = readToken();
@@ -68864,7 +69516,7 @@ async function runTokenRename(args) {
     }
   }
   if (name === target.name.trim()) {
-    console.log(`${sym.ok} ${import_picocolors45.default.bold(target.name.trim())} already has that label; nothing to do.`);
+    console.log(`${sym.ok} ${import_picocolors48.default.bold(target.name.trim())} already has that label; nothing to do.`);
     return;
   }
   try {
@@ -68872,7 +69524,7 @@ async function runTokenRename(args) {
   } catch (error) {
     throw withLoginHint(error);
   }
-  console.log(`${sym.ok} Renamed ${import_picocolors45.default.dim(target.name)} → ${import_picocolors45.default.bold(name)}`);
+  console.log(`${sym.ok} Renamed ${import_picocolors48.default.dim(target.name)} → ${import_picocolors48.default.bold(name)}`);
 }
 async function runTokenRevoke(args) {
   if (!args.id) {
@@ -68890,14 +69542,14 @@ async function runTokenRevoke(args) {
     throw new Error(`No token with id ${args.id}. Run \`brainbase token list\` to see yours.`);
   }
   if (target.revoked_at) {
-    reconcileDeadToken(target, `${import_picocolors45.default.bold(target.name)} is already revoked.`);
+    reconcileDeadToken(target, `${import_picocolors48.default.bold(target.name)} is already revoked.`);
     return;
   }
   const stored = readToken();
   const isLocalToken = Boolean(stored && stored.token.startsWith(target.prefix));
   if (!autoProceed(args.yes)) {
     const ok = await se({
-      message: isLocalToken ? `Revoke ${import_picocolors45.default.bold(target.name)} (${args.id})? This is the token this CLI is using, so it will stop working here too.` : `Revoke ${import_picocolors45.default.bold(target.name)} (${args.id})? CIs and machines using it will stop working.`,
+      message: isLocalToken ? `Revoke ${import_picocolors48.default.bold(target.name)} (${args.id})? This is the token this CLI is using, so it will stop working here too.` : `Revoke ${import_picocolors48.default.bold(target.name)} (${args.id})? CIs and machines using it will stop working.`,
       initialValue: false
     });
     if (!ensureNotCancelled(ok))
@@ -68908,14 +69560,14 @@ async function runTokenRevoke(args) {
   } catch (error) {
     if (error instanceof ApiError && error.status === 404) {
       if (isExpired2(target)) {
-        reconcileDeadToken(target, `${import_picocolors45.default.bold(target.name)} had already expired.`);
+        reconcileDeadToken(target, `${import_picocolors48.default.bold(target.name)} had already expired.`);
         return;
       }
       throw new Error(`The server reported no active token with id ${args.id}, but it listed one a moment ago. ` + "The local token has been left alone, since that key may still work. " + "If this server predates `DELETE /v1/registry/cli-tokens/{id}`, revoke from the web app instead.");
     }
-    throw error;
+    throw withLoginHint(error);
   }
-  reconcileDeadToken(target, `Revoked ${import_picocolors45.default.bold(target.name)}.`);
+  reconcileDeadToken(target, `Revoked ${import_picocolors48.default.bold(target.name)}.`);
 }
 function reconcileDeadToken(target, headline) {
   let outcome;
@@ -68949,7 +69601,7 @@ function reportLocalToken(headline, outcome) {
 }
 async function runTokenClear() {
   if (!readToken()) {
-    console.log(import_picocolors45.default.dim("No local token stored."));
+    console.log(import_picocolors48.default.dim("No local token stored."));
     return;
   }
   clearToken();
@@ -69049,32 +69701,32 @@ async function runToken(sub, rest2, args) {
 function printTokenHelp() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors45.default.bold("brainbase token")} ${import_picocolors45.default.dim("<command>")}`);
+  out.push(`  ${import_picocolors48.default.bold("brainbase token")} ${import_picocolors48.default.dim("<command>")}`);
   out.push("");
-  out.push(`  ${import_picocolors45.default.cyan("create")}                        ${import_picocolors45.default.dim("issue a new long-lived CLI key (PAT)")}`);
-  out.push(`  ${import_picocolors45.default.cyan("list")}                          ${import_picocolors45.default.dim("show your tokens")}`);
-  out.push(`  ${import_picocolors45.default.cyan("rename")} ${import_picocolors45.default.dim("<id>")}                  ${import_picocolors45.default.dim("relabel a token by id")}`);
-  out.push(`  ${import_picocolors45.default.cyan("revoke")} ${import_picocolors45.default.dim("<id>")}                  ${import_picocolors45.default.dim("revoke a token by id")}`);
-  out.push(`  ${import_picocolors45.default.cyan("clear")}                         ${import_picocolors45.default.dim("forget the local token (does not revoke)")}`);
+  out.push(`  ${import_picocolors48.default.cyan("create")}                        ${import_picocolors48.default.dim("issue a new long-lived CLI key (PAT)")}`);
+  out.push(`  ${import_picocolors48.default.cyan("list")}                          ${import_picocolors48.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors48.default.cyan("rename")} ${import_picocolors48.default.dim("<id>")}                  ${import_picocolors48.default.dim("relabel a token by id")}`);
+  out.push(`  ${import_picocolors48.default.cyan("revoke")} ${import_picocolors48.default.dim("<id>")}                  ${import_picocolors48.default.dim("revoke a token by id")}`);
+  out.push(`  ${import_picocolors48.default.cyan("clear")}                         ${import_picocolors48.default.dim("forget the local token (does not revoke)")}`);
   out.push("");
-  out.push(`  ${import_picocolors45.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors45.default.cyan("--name, -n")} ${import_picocolors45.default.dim("<label>")}        ${import_picocolors45.default.dim("token label (prompted if omitted)")}`);
-  out.push(`  ${import_picocolors45.default.cyan("--scopes")} ${import_picocolors45.default.dim("<list>")}           ${import_picocolors45.default.dim("comma-separated; allowed: read, publish, admin")}`);
-  out.push(`                                ${import_picocolors45.default.dim("default: read,publish")}`);
+  out.push(`  ${import_picocolors48.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors48.default.cyan("--name, -n")} ${import_picocolors48.default.dim("<label>")}        ${import_picocolors48.default.dim("token label (prompted if omitted)")}`);
+  out.push(`  ${import_picocolors48.default.cyan("--scopes")} ${import_picocolors48.default.dim("<list>")}           ${import_picocolors48.default.dim("comma-separated; allowed: read, publish, admin")}`);
+  out.push(`                                ${import_picocolors48.default.dim("default: read,publish")}`);
   out.push("");
-  out.push(`  ${import_picocolors45.default.bold("rename flags")}`);
-  out.push(`  ${import_picocolors45.default.cyan("--name, -n")} ${import_picocolors45.default.dim("<label>")}        ${import_picocolors45.default.dim("new label (prompted if omitted)")}`);
+  out.push(`  ${import_picocolors48.default.bold("rename flags")}`);
+  out.push(`  ${import_picocolors48.default.cyan("--name, -n")} ${import_picocolors48.default.dim("<label>")}        ${import_picocolors48.default.dim("new label (prompted if omitted)")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/mcp.ts
-var import_picocolors46 = __toESM(require_picocolors(), 1);
+var import_picocolors49 = __toESM(require_picocolors(), 1);
 
 // src/core/mcp-check/collect-servers.ts
 import path87 from "node:path";
-import fs79 from "node:fs";
+import fs80 from "node:fs";
 function collectServers(cwd2, env3 = process.env) {
   const out = [];
   const seen = new Set;
@@ -69128,7 +69780,7 @@ function* readResolvedMcps(cwd2) {
   const p2 = path87.join(cwd2, ".brainbase", "resolved-mcps.json");
   let raw;
   try {
-    raw = fs79.readFileSync(p2, "utf-8");
+    raw = fs80.readFileSync(p2, "utf-8");
   } catch {
     return;
   }
@@ -69188,10 +69840,19 @@ function classifyError(err) {
   }
   return "protocol_error";
 }
+var CREDENTIAL_NAMES = "(x-api-key|api[-_]?key|auth[-_]?token|access[-_]?token|private[-_]?token|secret)";
 var REDACTIONS = [
   [/https?:\/\/[^\s'"`]+/gi, "[url]"],
   [/Bearer\s+\S+/gi, "Bearer [redacted]"],
-  [/\bbb(?:pat|_live)_[A-Za-z0-9._-]+/g, "[redacted]"]
+  [/\bbb(?:pat|_live)_[A-Za-z0-9._-]+/g, "[redacted]"],
+  [
+    new RegExp(`\\b${CREDENTIAL_NAMES}\\b([\\s:=]*)(["'])[^"']+\\3`, "gi"),
+    "$1$2$3[redacted]$3"
+  ],
+  [
+    new RegExp(`\\b${CREDENTIAL_NAMES}\\b(\\s*[:=]\\s*)["']?[^\\s,;"'}]+`, "gi"),
+    "$1$2[redacted]"
+  ]
 ];
 function redactSecrets2(msg) {
   let out = msg;
@@ -77318,11 +77979,11 @@ function withTimeout(inner, ms2, label) {
 function isTransient(status) {
   return status === "unreachable";
 }
-async function probeWithConnector(server, connect, opts) {
+async function probeWithConnector(server, connect2, opts) {
   let lastErr;
   for (let attempt2 = 0;attempt2 < 2; attempt2++) {
     try {
-      const { toolCount } = await connect(server, opts.timeoutMs);
+      const { toolCount } = await connect2(server, opts.timeoutMs);
       return { name: server.name, status: "ok", tool_count: toolCount, error: null };
     } catch (err) {
       lastErr = err;
@@ -77398,42 +78059,177 @@ async function runMcpCheck(cwd2, options) {
       }
     }));
     results.sort((a3, b4) => a3.name.localeCompare(b4.name));
-    const report = {
+    const report2 = {
       check_status: deriveCheckStatus(results),
       servers: results
     };
     if (options.json) {
-      write(JSON.stringify(report) + `
+      write(JSON.stringify(report2) + `
 `);
     } else {
-      write(renderHuman(report));
+      write(renderHuman(report2));
     }
-    return { exitCode: 0, report };
+    return { exitCode: 0, report: report2 };
   } catch (err) {
     writeErr(`brainbase mcp check failed to run: ${truncateError(err) ?? "unknown error"}
 `);
     return { exitCode: 1 };
   }
 }
-function renderHuman(report) {
+function renderHuman(report2) {
   const lines = [];
-  if (report.check_status === "skipped") {
-    lines.push(import_picocolors46.default.dim("No MCP servers configured — nothing to check."));
+  if (report2.check_status === "skipped") {
+    lines.push(import_picocolors49.default.dim("No MCP servers configured — nothing to check."));
     return lines.join(`
 `) + `
 `;
   }
-  for (const s3 of report.servers) {
-    const mark = s3.status === "ok" ? import_picocolors46.default.green("✓") : s3.status === "auth_failed" ? import_picocolors46.default.red("✗") : import_picocolors46.default.yellow("⚠");
-    const detail = s3.status === "ok" ? import_picocolors46.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors46.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
+  for (const s3 of report2.servers) {
+    const mark = s3.status === "ok" ? import_picocolors49.default.green("✓") : s3.status === "auth_failed" ? import_picocolors49.default.red("✗") : import_picocolors49.default.yellow("⚠");
+    const detail = s3.status === "ok" ? import_picocolors49.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors49.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
     lines.push(`  ${mark} ${s3.name}  ${detail}`);
   }
-  const summary = report.check_status === "ok" ? import_picocolors46.default.green("All MCP servers connected.") : import_picocolors46.default.yellow("Some MCP servers are unhealthy.");
+  const summary = report2.check_status === "ok" ? import_picocolors49.default.green("All MCP servers connected.") : import_picocolors49.default.yellow("Some MCP servers are unhealthy.");
   lines.push("", summary);
   return lines.join(`
 `) + `
 `;
 }
+async function runMcpList(cwd2, options) {
+  const write = options.write ?? ((s3) => process.stdout.write(s3));
+  const writeErr = options.writeErr ?? ((s3) => process.stderr.write(s3));
+  const fetchServers = options.fetchServers ?? ((id) => api.listAgentMcpServers(id));
+  const resolveAgentId = options.resolveAgentId ?? ((dir) => readLink(dir)?.agent_id ?? null);
+  const agentId = resolveAgentId(cwd2);
+  if (!agentId) {
+    if (options.json) {
+      write(JSON.stringify({ linked: false, servers: [] }) + `
+`);
+    } else {
+      writeErr("This folder is not linked to any agent. Run `brainbase link` first.\n");
+    }
+    return 1;
+  }
+  let report2;
+  try {
+    report2 = await fetchServers(agentId);
+  } catch (err) {
+    if (options.json) {
+      write(JSON.stringify({ error: err.message }) + `
+`);
+    } else {
+      writeErr(`brainbase mcp list failed: ${err.message}
+`);
+    }
+    return 1;
+  }
+  if (options.json) {
+    write(JSON.stringify({ linked: true, ...sanitizeReport(report2) }) + `
+`);
+  } else {
+    write(renderServerList(report2.servers));
+  }
+  return 0;
+}
+function sanitizeReport(report2) {
+  return {
+    ...report2,
+    servers: report2.servers.map((s3) => ({
+      ...s3,
+      url: sanitizeUrl(s3.url),
+      command: sanitizeCommand(s3.command),
+      last_error: s3.last_error ? truncateError(s3.last_error) : s3.last_error
+    }))
+  };
+}
+function sanitizeUrl(url2) {
+  if (!url2)
+    return url2;
+  try {
+    const parsed = new URL(url2);
+    parsed.search = "";
+    parsed.hash = "";
+    parsed.username = "";
+    parsed.password = "";
+    return parsed.toString();
+  } catch {
+    return null;
+  }
+}
+function sanitizeCommand(command) {
+  if (!command)
+    return command;
+  return command.trim().split(/\s+/)[0] ?? null;
+}
+var AUTH_LABEL = {
+  none: "",
+  oauth_required: "needs authorization",
+  oauth_connected: "authorized",
+  oauth_expired: "authorization expired — reconnect"
+};
+var HEALTH_LABEL = {
+  unreachable: "unreachable",
+  protocol_error: "connection error",
+  auth_failed: "last check failed to authenticate",
+  expired: "last check saw an expired token",
+  unknown: "last check inconclusive"
+};
+function healthLabel(server) {
+  const status = server.last_status;
+  if (!status || status === "ok")
+    return;
+  return HEALTH_LABEL[status] ?? `last check: ${status}`;
+}
+function isUnhealthy(server) {
+  return Boolean(server.last_status) && server.last_status !== "ok";
+}
+function renderServerList(servers) {
+  if (servers.length === 0) {
+    return import_picocolors49.default.dim("No MCP servers configured for this agent.") + `
+`;
+  }
+  const lines = [""];
+  for (const s3 of servers) {
+    const mark = s3.auth === "oauth_expired" ? import_picocolors49.default.red("✗") : s3.auth === "oauth_required" || isUnhealthy(s3) ? import_picocolors49.default.yellow("!") : !s3.is_enabled ? import_picocolors49.default.dim("·") : import_picocolors49.default.green("✓");
+    const bits = [s3.transport];
+    if (!s3.is_enabled)
+      bits.push("disabled");
+    const label = AUTH_LABEL[s3.auth];
+    if (label)
+      bits.push(label);
+    const health = healthLabel(s3);
+    if (health)
+      bits.push(health);
+    const expiry = describeExpiry(s3);
+    if (expiry)
+      bits.push(expiry);
+    lines.push(`  ${mark} ${import_picocolors49.default.bold(s3.name)}  ${import_picocolors49.default.dim(bits.join(" · "))}`);
+  }
+  if (servers.some((s3) => s3.auth === "oauth_required" || s3.auth === "oauth_expired")) {
+    lines.push("", import_picocolors49.default.dim("Authorize OAuth-backed servers in the web app; the CLI cannot run that flow yet."));
+  }
+  lines.push("");
+  return lines.join(`
+`);
+}
+var MAX_EXPIRY_DAYS = 90;
+function describeExpiry(server, now2 = Date.now()) {
+  if (server.auth !== "oauth_connected" || !server.oauth_token_expires_at)
+    return;
+  const at3 = Date.parse(server.oauth_token_expires_at);
+  if (!Number.isFinite(at3))
+    return;
+  const minutes = Math.round((at3 - now2) / 60000);
+  if (minutes <= 0)
+    return;
+  if (minutes < 60)
+    return `expires in ${minutes}m`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 48)
+    return `expires in ${hours}h`;
+  const days = Math.round(hours / 24);
+  return days > MAX_EXPIRY_DAYS ? `expires in >${MAX_EXPIRY_DAYS}d` : `expires in ${days}d`;
+}
 async function runMcp(cwd2, sub, _argv, options) {
   const writeErr = options.writeErr ?? ((s3) => process.stderr.write(s3));
   switch (sub) {
@@ -77441,17 +78237,19 @@ async function runMcp(cwd2, sub, _argv, options) {
       const { exitCode } = await runMcpCheck(cwd2, options);
       return exitCode;
     }
+    case "list":
+      return runMcpList(cwd2, options);
     default:
       writeErr(`Unknown mcp subcommand: ${sub ?? "(none)"}
 `);
-      writeErr(`Usage: brainbase mcp check [--json]
+      writeErr(`Usage: brainbase mcp <check|list> [--json]
 `);
       return 1;
   }
 }
 
 // src/cli/task.ts
-var import_picocolors47 = __toESM(require_picocolors(), 1);
+var import_picocolors50 = __toESM(require_picocolors(), 1);
 
 // src/cli/task-create.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -77637,31 +78435,31 @@ async function runTask(cwd2, sub, args) {
 function printHelp4() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors47.default.bold("brainbase task")} ${import_picocolors47.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors50.default.bold("brainbase task")} ${import_picocolors50.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors47.default.cyan("create")} ${import_picocolors47.default.dim("--message <text>")}   ${import_picocolors47.default.dim("create a task and start its first run")}`);
+  out.push(`  ${import_picocolors50.default.cyan("create")} ${import_picocolors50.default.dim("--message <text>")}   ${import_picocolors50.default.dim("create a task and start its first run")}`);
   out.push("");
-  out.push(`  ${import_picocolors47.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors47.default.dim("--message <text>")}   required first user message`);
-  out.push(`  ${import_picocolors47.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
-  out.push(`  ${import_picocolors47.default.dim("--title <text>")}     optional task title`);
-  out.push(`  ${import_picocolors47.default.dim("--model <id>")}       optional model override`);
-  out.push(`  ${import_picocolors47.default.dim("--json")}             print task_id, agent_id, and status as JSON`);
+  out.push(`  ${import_picocolors50.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors50.default.dim("--message <text>")}   required first user message`);
+  out.push(`  ${import_picocolors50.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
+  out.push(`  ${import_picocolors50.default.dim("--title <text>")}     optional task title`);
+  out.push(`  ${import_picocolors50.default.dim("--model <id>")}       optional model override`);
+  out.push(`  ${import_picocolors50.default.dim("--json")}             print task_id, agent_id, and status as JSON`);
   out.push("");
-  out.push(`  ${import_picocolors47.default.dim("Flag-like values:")} use ${import_picocolors47.default.cyan("--flag=value")} or ${import_picocolors47.default.cyan("--flag -- <value>")}`);
+  out.push(`  ${import_picocolors50.default.dim("Flag-like values:")} use ${import_picocolors50.default.cyan("--flag=value")} or ${import_picocolors50.default.cyan("--flag -- <value>")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/benchmark.ts
-var import_picocolors48 = __toESM(require_picocolors(), 1);
+var import_picocolors51 = __toESM(require_picocolors(), 1);
 import {
   execFileSync as execFileSync3,
   spawn as spawn5
 } from "node:child_process";
 import crypto7 from "node:crypto";
-import fs81 from "node:fs";
+import fs82 from "node:fs";
 import os17 from "node:os";
 import path89 from "node:path";
 
@@ -77671,7 +78469,7 @@ import {
   spawn as spawn4
 } from "node:child_process";
 import crypto6 from "node:crypto";
-import fs80 from "node:fs";
+import fs81 from "node:fs";
 import os16 from "node:os";
 import path88 from "node:path";
 import { pipeline as pipeline2 } from "node:stream/promises";
@@ -77921,19 +78719,19 @@ function canonicalFuturePath(input) {
   const resolved = path88.resolve(input);
   const suffix = [];
   let current = resolved;
-  while (!fs80.existsSync(current)) {
+  while (!fs81.existsSync(current)) {
     const parent = path88.dirname(current);
     if (parent === current)
       break;
     suffix.unshift(path88.basename(current));
     current = parent;
   }
-  const canonicalBase = fs80.realpathSync(current);
+  const canonicalBase = fs81.realpathSync(current);
   return path88.join(canonicalBase, ...suffix);
 }
 function validateRoots(spec) {
   const workspace = path88.resolve(spec.workspace_root);
-  if (!fs80.existsSync(workspace) || fs80.lstatSync(workspace).isSymbolicLink() || !fs80.lstatSync(workspace).isDirectory()) {
+  if (!fs81.existsSync(workspace) || fs81.lstatSync(workspace).isSymbolicLink() || !fs81.lstatSync(workspace).isDirectory()) {
     throw new BenchmarkPhaseError("invalid_workspace_root", "workspace_root must be an existing real directory");
   }
   const canonicalWorkspace = canonicalFuturePath(workspace);
@@ -77942,7 +78740,7 @@ function validateRoots(spec) {
   if (staging !== expectedStaging) {
     throw new BenchmarkPhaseError("invalid_staging_root", `staging_root must be ${expectedStaging}`);
   }
-  if (!fs80.existsSync(staging) || fs80.lstatSync(staging).isSymbolicLink() || !fs80.lstatSync(staging).isDirectory() || fs80.realpathSync(staging) !== path88.join(canonicalWorkspace, ".brainbase", "benchmark", spec.attempt_id, "incoming")) {
+  if (!fs81.existsSync(staging) || fs81.lstatSync(staging).isSymbolicLink() || !fs81.lstatSync(staging).isDirectory() || fs81.realpathSync(staging) !== path88.join(canonicalWorkspace, ".brainbase", "benchmark", spec.attempt_id, "incoming")) {
     throw new BenchmarkPhaseError("invalid_staging_root", "staging_root must be a real directory under workspace_root");
   }
   const canonicalLogs = validateExternalRoot("logs_root", spec.logs_root, canonicalWorkspace);
@@ -77958,7 +78756,7 @@ function validateExternalRoot(label, input, canonicalWorkspace) {
   if (candidate === path88.parse(candidate).root) {
     throw new BenchmarkPhaseError(`invalid_${label}`, `${label} cannot be a filesystem root`);
   }
-  if (fs80.existsSync(candidate) && fs80.lstatSync(candidate).isSymbolicLink()) {
+  if (fs81.existsSync(candidate) && fs81.lstatSync(candidate).isSymbolicLink()) {
     throw new BenchmarkPhaseError(`invalid_${label}`, `${label} cannot be a symlink`);
   }
   const canonicalCandidate = canonicalFuturePath(candidate);
@@ -77988,9 +78786,9 @@ function assertNoSymlinkTraversal(root, relative) {
   let current = path88.resolve(root);
   for (const segment of rel.split("/").slice(0, -1)) {
     current = path88.join(current, segment);
-    if (!fs80.existsSync(current))
+    if (!fs81.existsSync(current))
       continue;
-    if (fs80.lstatSync(current).isSymbolicLink()) {
+    if (fs81.lstatSync(current).isSymbolicLink()) {
       throw new BenchmarkPhaseError("unsafe_path", `path traverses symlink: ${relative}`);
     }
   }
@@ -78000,9 +78798,9 @@ function assertOpenedFileWithinRoot(root, filePath, openedStat, label) {
   let canonicalFile;
   let currentStat;
   try {
-    canonicalRoot = fs80.realpathSync(root);
-    canonicalFile = fs80.realpathSync(filePath);
-    currentStat = fs80.statSync(filePath);
+    canonicalRoot = fs81.realpathSync(root);
+    canonicalFile = fs81.realpathSync(filePath);
+    currentStat = fs81.statSync(filePath);
   } catch {
     throw new BenchmarkPhaseError("unsafe_path", `${label} changed while it was opened`);
   }
@@ -78011,10 +78809,10 @@ function assertOpenedFileWithinRoot(root, filePath, openedStat, label) {
   }
 }
 function openRegularFileNoFollow(filePath, label, root) {
-  const noFollow = typeof fs80.constants.O_NOFOLLOW === "number" ? fs80.constants.O_NOFOLLOW : 0;
+  const noFollow = typeof fs81.constants.O_NOFOLLOW === "number" ? fs81.constants.O_NOFOLLOW : 0;
   let fd;
   try {
-    fd = fs80.openSync(filePath, fs80.constants.O_RDONLY | noFollow);
+    fd = fs81.openSync(filePath, fs81.constants.O_RDONLY | noFollow);
   } catch (error2) {
     const code = error2.code;
     if (code === "ELOOP") {
@@ -78022,16 +78820,16 @@ function openRegularFileNoFollow(filePath, label, root) {
     }
     throw error2;
   }
-  const stat = fs80.fstatSync(fd);
+  const stat = fs81.fstatSync(fd);
   if (!stat.isFile()) {
-    fs80.closeSync(fd);
+    fs81.closeSync(fd);
     throw new BenchmarkPhaseError("invalid_input", `${label} must be a regular file`);
   }
   if (root) {
     try {
       assertOpenedFileWithinRoot(root, filePath, stat, label);
     } catch (error2) {
-      fs80.closeSync(fd);
+      fs81.closeSync(fd);
       throw error2;
     }
   }
@@ -78039,7 +78837,7 @@ function openRegularFileNoFollow(filePath, label, root) {
 }
 async function sha256OfDescriptor(fd) {
   const hash = crypto6.createHash("sha256");
-  const stream = fs80.createReadStream("", {
+  const stream = fs81.createReadStream("", {
     fd,
     autoClose: false,
     start: 0
@@ -78050,7 +78848,7 @@ async function sha256OfDescriptor(fd) {
   return hash.digest("hex");
 }
 function readDescriptor(fd) {
-  return fs80.readFileSync(fd);
+  return fs81.readFileSync(fd);
 }
 function assertWritableDestination(root, relative) {
   const rel = normalizedRootRelative(relative);
@@ -78060,9 +78858,9 @@ function assertWritableDestination(root, relative) {
   const segments = rel.split("/");
   for (const segment of segments.slice(0, -1)) {
     current = path88.join(current, segment);
-    if (!fs80.existsSync(current))
+    if (!fs81.existsSync(current))
       continue;
-    const stat = fs80.lstatSync(current);
+    const stat = fs81.lstatSync(current);
     if (stat.isSymbolicLink()) {
       throw new BenchmarkPhaseError("unsafe_path", `path traverses symlink: ${relative}`);
     }
@@ -78071,7 +78869,7 @@ function assertWritableDestination(root, relative) {
     }
   }
   const destination = path88.resolve(root, rel);
-  if (fs80.existsSync(destination) && fs80.lstatSync(destination).isDirectory()) {
+  if (fs81.existsSync(destination) && fs81.lstatSync(destination).isDirectory()) {
     throw new BenchmarkPhaseError("destination_conflict", `file destination is an existing directory: ${relative}`);
   }
 }
@@ -78103,7 +78901,7 @@ function sourcePath(stagingRoot, relative) {
   assertNoSymlinkTraversal(stagingRoot, rel);
   let stat;
   try {
-    stat = fs80.lstatSync(source);
+    stat = fs81.lstatSync(source);
   } catch {
     throw new BenchmarkPhaseError("missing_input", `staged input does not exist: ${relative}`);
   }
@@ -78132,12 +78930,12 @@ async function verifyRecordsUnchanged(records, spec) {
     const relative = safeRelPath(record3.path);
     assertNoSymlinkTraversal(root, relative);
     const candidate = path88.resolve(root, relative);
-    if (!isWithin(root, candidate) || !fs80.existsSync(candidate)) {
+    if (!isWithin(root, candidate) || !fs81.existsSync(candidate)) {
       throw new BenchmarkPhaseError("evidence_tampered", `evidence was removed during evaluation: ${record3.root}:${record3.path}`);
     }
-    const stat = fs80.lstatSync(candidate);
+    const stat = fs81.lstatSync(candidate);
     if (record3.kind === "symlink") {
-      const target = stat.isSymbolicLink() ? fs80.readlinkSync(candidate) : null;
+      const target = stat.isSymbolicLink() ? fs81.readlinkSync(candidate) : null;
       if (target === null || Buffer.byteLength(target) !== record3.size || sha256(target) !== record3.sha256) {
         throw new BenchmarkPhaseError("evidence_tampered", `evidence changed during evaluation: ${record3.root}:${record3.path}`);
       }
@@ -78152,7 +78950,7 @@ async function verifyRecordsUnchanged(records, spec) {
         throw new BenchmarkPhaseError("evidence_tampered", `evidence changed during evaluation: ${record3.root}:${record3.path}`);
       }
     } finally {
-      fs80.closeSync(opened.fd);
+      fs81.closeSync(opened.fd);
     }
   }
 }
@@ -78168,35 +78966,35 @@ async function verifyInput(stagingRoot, material) {
       throw new BenchmarkPhaseError("digest_mismatch", `checksum mismatch for ${material.source}`, { expected: material.sha256, actual });
     }
   } finally {
-    fs80.closeSync(opened.fd);
+    fs81.closeSync(opened.fd);
   }
   return source;
 }
 async function atomicCopy(source, destination, mode, sourceRoot) {
-  fs80.mkdirSync(path88.dirname(destination), { recursive: true });
+  fs81.mkdirSync(path88.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   const opened = openRegularFileNoFollow(source, `copy source ${source}`, sourceRoot);
   try {
-    await pipeline2(fs80.createReadStream("", {
+    await pipeline2(fs81.createReadStream("", {
       fd: opened.fd,
       autoClose: false,
       start: 0
-    }), fs80.createWriteStream(temporary, {
+    }), fs81.createWriteStream(temporary, {
       flags: "wx",
       mode: 384
     }));
-    fs80.chmodSync(temporary, mode ?? opened.stat.mode & 511);
-    fs80.renameSync(temporary, destination);
+    fs81.chmodSync(temporary, mode ?? opened.stat.mode & 511);
+    fs81.renameSync(temporary, destination);
   } finally {
-    fs80.closeSync(opened.fd);
-    fs80.rmSync(temporary, { force: true });
+    fs81.closeSync(opened.fd);
+    fs81.rmSync(temporary, { force: true });
   }
 }
 async function recordFile(root, filePath, rootName, kind = "file") {
   const relative = path88.relative(root, filePath).replace(/\\/g, "/");
   if (kind === "symlink") {
-    const stat = fs80.lstatSync(filePath);
-    const target = fs80.readlinkSync(filePath);
+    const stat = fs81.lstatSync(filePath);
+    const target = fs81.readlinkSync(filePath);
     return {
       root: rootName,
       path: relative,
@@ -78216,7 +79014,7 @@ async function recordFile(root, filePath, rootName, kind = "file") {
       mode: opened.stat.mode & 511
     };
   } finally {
-    fs80.closeSync(opened.fd);
+    fs81.closeSync(opened.fd);
   }
 }
 async function copyMaterial(material, sourceRoot, destinationRoot, destinationRootName, protectWorkspace) {
@@ -78238,7 +79036,7 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     }
     return [record3];
   }
-  const temporary = fs80.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-"));
+  const temporary = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-"));
   try {
     const verifiedArchive = path88.join(temporary, "material.tar.gz");
     await atomicCopy(source, verifiedArchive, 384, sourceRoot);
@@ -78256,7 +79054,7 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     const outputs = [];
     for (const extractedRel of extracted.sort()) {
       const sourceFile = path88.resolve(extractedRoot, safeRelPath(extractedRel));
-      const stat = fs80.lstatSync(sourceFile);
+      const stat = fs81.lstatSync(sourceFile);
       if (!stat.isFile())
         continue;
       const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path88.posix.join(destinationRel, extractedRel));
@@ -78271,7 +79069,7 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     }
     return outputs;
   } finally {
-    fs80.rmSync(temporary, { recursive: true, force: true });
+    fs81.rmSync(temporary, { recursive: true, force: true });
   }
 }
 async function preflightMaterial(material, sourceRoot, destinationRoot, protectWorkspace) {
@@ -78287,7 +79085,7 @@ async function preflightMaterial(material, sourceRoot, destinationRoot, protectW
     assertWritableDestination(destinationRoot, destinationRel);
     return [destinationRel];
   }
-  const temporary = fs80.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-preflight-"));
+  const temporary = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-preflight-"));
   try {
     const verifiedArchive = path88.join(temporary, "material.tar.gz");
     await atomicCopy(source, verifiedArchive, 384, sourceRoot);
@@ -78314,34 +79112,34 @@ async function preflightMaterial(material, sourceRoot, destinationRoot, protectW
     }
     return planned;
   } finally {
-    fs80.rmSync(temporary, { recursive: true, force: true });
+    fs81.rmSync(temporary, { recursive: true, force: true });
   }
 }
 function ownerMarker(root) {
   return path88.join(root, ".brainbase-benchmark-owner.json");
 }
 function verifyOwnedDirectory(root, role, spec) {
-  if (!fs80.existsSync(root) || fs80.lstatSync(root).isSymbolicLink())
+  if (!fs81.existsSync(root) || fs81.lstatSync(root).isSymbolicLink())
     return false;
   try {
-    const marker = JSON.parse(fs80.readFileSync(ownerMarker(root), "utf8"));
+    const marker = JSON.parse(fs81.readFileSync(ownerMarker(root), "utf8"));
     return marker.attempt_id === spec.attempt_id && marker.phase === spec.phase && marker.phase_id === spec.phase_id && marker.role === role;
   } catch {
     return false;
   }
 }
 function prepareOwnedDirectory(root, role, spec) {
-  if (fs80.existsSync(root)) {
+  if (fs81.existsSync(root)) {
     if (!verifyOwnedDirectory(root, role, spec)) {
-      const stat = fs80.lstatSync(root);
-      if (!stat.isDirectory() || fs80.readdirSync(root).length > 0) {
+      const stat = fs81.lstatSync(root);
+      if (!stat.isDirectory() || fs81.readdirSync(root).length > 0) {
         throw new BenchmarkPhaseError(`unowned_${role}_root`, `${role}_root exists without a matching attempt ownership marker`);
       }
     } else {
-      fs80.rmSync(root, { recursive: true, force: true });
+      fs81.rmSync(root, { recursive: true, force: true });
     }
   }
-  fs80.mkdirSync(root, { recursive: true, mode: 448 });
+  fs81.mkdirSync(root, { recursive: true, mode: 448 });
   writeJsonAtomic(ownerMarker(root), {
     schema_version: SCHEMA_VERSION,
     attempt_id: spec.attempt_id,
@@ -78433,7 +79231,7 @@ async function runCommand(command, root, spec, context, additions = {}) {
   const cwd2 = path88.resolve(root, cwdRel);
   let cwdStat;
   try {
-    cwdStat = fs80.lstatSync(cwd2);
+    cwdStat = fs81.lstatSync(cwd2);
   } catch {
     throw new BenchmarkPhaseError("invalid_command_cwd", `command cwd is invalid: ${command.cwd}`);
   }
@@ -78505,27 +79303,27 @@ async function runCommand(command, root, spec, context, additions = {}) {
 }
 async function writeLog(root, name, data, spec) {
   const destination = path88.join(root, name);
-  fs80.mkdirSync(path88.dirname(destination), { recursive: true });
+  fs81.mkdirSync(path88.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   try {
-    fs80.writeFileSync(temporary, redactCommandOutput(data, spec), {
+    fs81.writeFileSync(temporary, redactCommandOutput(data, spec), {
       flag: "wx",
       mode: 384
     });
-    fs80.renameSync(temporary, destination);
+    fs81.renameSync(temporary, destination);
   } finally {
-    fs80.rmSync(temporary, { force: true });
+    fs81.rmSync(temporary, { force: true });
   }
   return await recordFile(root, destination, "logs");
 }
 function writeBufferAtomic(destination, data) {
-  fs80.mkdirSync(path88.dirname(destination), { recursive: true });
+  fs81.mkdirSync(path88.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   try {
-    fs80.writeFileSync(temporary, data, { flag: "wx", mode: 384 });
-    fs80.renameSync(temporary, destination);
+    fs81.writeFileSync(temporary, data, { flag: "wx", mode: 384 });
+    fs81.renameSync(temporary, destination);
   } finally {
-    fs80.rmSync(temporary, { force: true });
+    fs81.rmSync(temporary, { force: true });
   }
 }
 function assertBudget(context) {
@@ -78534,7 +79332,7 @@ function assertBudget(context) {
   }
 }
 async function executeHydrate(spec, context) {
-  fs80.mkdirSync(spec.workspace_root, { recursive: true });
+  fs81.mkdirSync(spec.workspace_root, { recursive: true });
   prepareOwnedDirectory(spec.logs_root, "logs", spec);
   context.logsOwned = true;
   const outputs = [];
@@ -78615,9 +79413,9 @@ async function executeHydrate(spec, context) {
     }
     const candidate = path88.resolve(spec.workspace_root, safeRelPath(output.path));
     assertNoSymlinkTraversal(spec.workspace_root, output.path);
-    if (!fs80.existsSync(candidate))
+    if (!fs81.existsSync(candidate))
       continue;
-    const stat = fs80.lstatSync(candidate);
+    const stat = fs81.lstatSync(candidate);
     if (!stat.isFile() && !stat.isSymbolicLink())
       continue;
     finalOutputs.push(await recordFile(spec.workspace_root, candidate, "workspace", stat.isSymbolicLink() ? "symlink" : "file"));
@@ -78651,7 +79449,7 @@ async function readEvidence(stagingRoot, evidence) {
       }
     };
   } finally {
-    fs80.closeSync(opened.fd);
+    fs81.closeSync(opened.fd);
   }
 }
 async function workspaceManifest(spec, context) {
@@ -78660,7 +79458,7 @@ async function workspaceManifest(spec, context) {
   const stack = [path88.resolve(spec.workspace_root)];
   while (stack.length > 0) {
     const directory = stack.pop();
-    const entries = fs80.readdirSync(directory, { withFileTypes: true }).sort((a3, b4) => a3.name.localeCompare(b4.name));
+    const entries = fs81.readdirSync(directory, { withFileTypes: true }).sort((a3, b4) => a3.name.localeCompare(b4.name));
     for (const entry of entries) {
       assertBudget(context);
       const full = path88.join(directory, entry.name);
@@ -78769,7 +79567,7 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
     const candidate = path88.resolve(spec.workspace_root, relative);
     let stat = null;
     try {
-      stat = fs80.lstatSync(candidate);
+      stat = fs81.lstatSync(candidate);
     } catch (error2) {
       const code = error2.code;
       if (code !== "ENOENT" && code !== "ENOTDIR")
@@ -78790,7 +79588,7 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
         try {
           verdict2 = await sha256OfDescriptor(opened.fd) === evaluator.assertion.expected;
         } finally {
-          fs80.closeSync(opened.fd);
+          fs81.closeSync(opened.fd);
         }
       }
     }
@@ -78800,7 +79598,7 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
         try {
           verdict2 = readDescriptor(opened.fd).toString("utf8").includes(evaluator.assertion.expected);
         } finally {
-          fs80.closeSync(opened.fd);
+          fs81.closeSync(opened.fd);
         }
       }
     }
@@ -78881,7 +79679,7 @@ async function executeEvaluate(spec, context) {
     assertNoSymlinkTraversal(spec.workspace_root, artifactRel);
     const source = path88.resolve(spec.workspace_root, artifactRel);
     const frozenArtifact = manifest.find((entry) => entry.path === artifactRel && entry.kind !== "symlink");
-    if (!frozenArtifact || !fs80.existsSync(source) || !fs80.lstatSync(source).isFile()) {
+    if (!frozenArtifact || !fs81.existsSync(source) || !fs81.lstatSync(source).isFile()) {
       throw new BenchmarkPhaseError("missing_artifact", `candidate artifact is missing: ${artifactRel}`);
     }
     const destination = path88.resolve(spec.logs_root, "candidate-artifacts", artifactRel);
@@ -78899,9 +79697,9 @@ async function executeEvaluate(spec, context) {
     const temporary = `${archive}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
     try {
       await pack({ rootDir: spec.workspace_root, outFile: temporary, files: regularFiles });
-      fs80.renameSync(temporary, archive);
+      fs81.renameSync(temporary, archive);
     } finally {
-      fs80.rmSync(temporary, { force: true });
+      fs81.rmSync(temporary, { force: true });
     }
     const archiveRecord = await recordFile(spec.logs_root, archive, "logs");
     outputs.push(archiveRecord);
@@ -79001,21 +79799,21 @@ function rawIdentity(value) {
 }
 function readSpecBytes(specPathInput) {
   const specPath = path88.resolve(specPathInput);
-  const noFollow = typeof fs80.constants.O_NOFOLLOW === "number" ? fs80.constants.O_NOFOLLOW : 0;
+  const noFollow = typeof fs81.constants.O_NOFOLLOW === "number" ? fs81.constants.O_NOFOLLOW : 0;
   let fd;
   try {
-    fd = fs80.openSync(specPath, fs80.constants.O_RDONLY | noFollow);
+    fd = fs81.openSync(specPath, fs81.constants.O_RDONLY | noFollow);
   } catch {
     throw new BenchmarkPhaseError("spec_read_failed", "spec file could not be read");
   }
   try {
-    const stat = fs80.fstatSync(fd);
+    const stat = fs81.fstatSync(fd);
     if (!stat.isFile() || stat.size > MAX_SPEC_BYTES) {
       throw new BenchmarkPhaseError("invalid_spec_file", "spec must be a regular JSON file no larger than 20 MiB");
     }
     return readDescriptor(fd);
   } finally {
-    fs80.closeSync(fd);
+    fs81.closeSync(fd);
   }
 }
 function validateBenchmarkInvocationBytes(bytes, resultPathInput, expectedPhase) {
@@ -79059,9 +79857,9 @@ function prepareBenchmarkPhaseInvocation(specPathInput, resultPathInput, expecte
       spec_digest: digest,
       timeout_ms: spec.budget.timeout_ms
     };
-    if (fs80.existsSync(resultPath)) {
+    if (fs81.existsSync(resultPath)) {
       try {
-        const cached2 = JSON.parse(fs80.readFileSync(resultPath, "utf8"));
+        const cached2 = JSON.parse(fs81.readFileSync(resultPath, "utf8"));
         if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
           return {
             ok: true,
@@ -79168,9 +79966,9 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
       throw new BenchmarkPhaseError("invalid_result_path", `result path must be ${expectedResultPath}`);
     }
     resultPathValidated = true;
-    if (fs80.existsSync(resultPath)) {
+    if (fs81.existsSync(resultPath)) {
       try {
-        const cached2 = JSON.parse(fs80.readFileSync(resultPath, "utf8"));
+        const cached2 = JSON.parse(fs81.readFileSync(resultPath, "utf8"));
         if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
           return { exitCode: 0, result: cached2 };
         }
@@ -79367,13 +80165,13 @@ function terminatePhase(child) {
 }
 function createAnonymousSpecFd(bytes) {
   const temporary = path89.join(os17.tmpdir(), `brainbase-benchmark-spec-${process.pid}-${crypto7.randomBytes(12).toString("hex")}`);
-  fs81.writeFileSync(temporary, bytes, { flag: "wx", mode: 384 });
+  fs82.writeFileSync(temporary, bytes, { flag: "wx", mode: 384 });
   try {
-    const fd = fs81.openSync(temporary, "r");
-    fs81.unlinkSync(temporary);
+    const fd = fs82.openSync(temporary, "r");
+    fs82.unlinkSync(temporary);
     return fd;
   } catch (error2) {
-    fs81.rmSync(temporary, { force: true });
+    fs82.rmSync(temporary, { force: true });
     throw error2;
   }
 }
@@ -79442,13 +80240,13 @@ async function runSupervisedPhase(phase, parsed, write) {
       detached: process.platform !== "win32"
     });
   } catch {
-    fs81.closeSync(specFd);
+    fs82.closeSync(specFd);
     const failure = phaseFailure(invocation, startedAt, started, "phase_supervisor_failed", "benchmark phase child process could not be started");
     write(`${JSON.stringify(failure)}
 `);
     return 1;
   }
-  fs81.closeSync(specFd);
+  fs82.closeSync(specFd);
   return await new Promise((resolve) => {
     const stdout = [];
     let settled = false;
@@ -79530,7 +80328,7 @@ async function runBenchmark(sub, args, write = (value) => process.stdout.write(v
       if (phase !== "hydrate" && phase !== "evaluate" || resultFlag !== "--result" || !resultPath || specFdFlag !== "--spec-fd" || !Number.isInteger(specFd) || specFd < 3 || tokenFlag !== "--token" || !token || token !== process.env.BRAINBASE_BENCHMARK_PHASE_CHILD_TOKEN) {
         throw new Error("Invalid internal benchmark phase invocation");
       }
-      const specBytes = fs81.readFileSync(specFd);
+      const specBytes = fs82.readFileSync(specFd);
       const { exitCode, result: result2 } = await runBenchmarkPhase("", resultPath, phase, specBytes);
       write(`${JSON.stringify(result2)}
 `);
@@ -79570,13 +80368,13 @@ async function runBenchmark(sub, args, write = (value) => process.stdout.write(v
 function printHelp5() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors48.default.bold("brainbase benchmark")} ${import_picocolors48.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors51.default.bold("brainbase benchmark")} ${import_picocolors51.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors48.default.cyan("hydrate")} ${import_picocolors48.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors48.default.cyan("evaluate")} ${import_picocolors48.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors48.default.cyan("capabilities")} ${import_picocolors48.default.dim("--json")}`);
+  out.push(`  ${import_picocolors51.default.cyan("hydrate")} ${import_picocolors51.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors51.default.cyan("evaluate")} ${import_picocolors51.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors51.default.cyan("capabilities")} ${import_picocolors51.default.dim("--json")}`);
   out.push("");
-  out.push(`  ${import_picocolors48.default.dim("These machine-only commands execute versioned benchmark phase specs inside a task sandbox.")}`);
+  out.push(`  ${import_picocolors51.default.dim("These machine-only commands execute versioned benchmark phase specs inside a task sandbox.")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -79603,130 +80401,137 @@ var SUBCOMMAND_OWNED_FLAGS = {
 function help() {
   const out = [];
   out.push("");
-  out.push(`  ${brandTint("◆")}  ${import_picocolors49.default.bold("brainbase")}  ${import_picocolors49.default.dim(`v${VERSION}`)}`);
-  out.push(`     ${import_picocolors49.default.dim("connect your local agent to the brainbase platform")}`);
+  out.push(`  ${brandTint("◆")}  ${import_picocolors52.default.bold("brainbase")}  ${import_picocolors52.default.dim(`v${VERSION}`)}`);
+  out.push(`     ${import_picocolors52.default.dim("connect your local agent to the brainbase platform")}`);
   out.push("");
   out.push(divider("USAGE"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.bold("brainbase")} ${import_picocolors49.default.dim("<command> [options]")}`);
+  out.push(`  ${import_picocolors52.default.bold("brainbase")} ${import_picocolors52.default.dim("<command> [options]")}`);
   out.push("");
   out.push(divider("AUTH"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("login")}     ${import_picocolors49.default.dim("  open the web app and connect this device")}`);
-  out.push(`  ${import_picocolors49.default.cyan("logout")}    ${import_picocolors49.default.dim("  clear the local session")}`);
-  out.push(`  ${import_picocolors49.default.cyan("whoami")}    ${import_picocolors49.default.dim("  show the current user")}`);
+  out.push(`  ${import_picocolors52.default.cyan("login")}     ${import_picocolors52.default.dim("  open the web app and connect this device")}`);
+  out.push(`  ${import_picocolors52.default.cyan("logout")}    ${import_picocolors52.default.dim("  clear the local session")}`);
+  out.push(`  ${import_picocolors52.default.cyan("whoami")} ${import_picocolors52.default.dim("[--json]")} ${import_picocolors52.default.dim(" show which credential is in use and what it covers")}`);
   out.push("");
   out.push(divider("DISCOVERY"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("team list")}                  ${import_picocolors49.default.dim("show the teams you can create agents in")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent list")}                 ${import_picocolors49.default.dim("show a team's agents and their ids")}`);
+  out.push(`  ${import_picocolors52.default.cyan("team list")}                  ${import_picocolors52.default.dim("show the teams you can create agents in")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent list")}                 ${import_picocolors52.default.dim("show a team's agents and their ids")}`);
   out.push("");
   out.push(divider("LINKED AGENT"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("agent create")}               ${import_picocolors49.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent pull")} ${import_picocolors49.default.dim("[<id>]")}          ${import_picocolors49.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent push")}                 ${import_picocolors49.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent unpack")}               ${import_picocolors49.default.dim("install the claimed agent into a harness layout")}`);
-  out.push(`  ${import_picocolors49.default.cyan("link")}                       ${import_picocolors49.default.dim("attach this folder to an existing agent")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent status")}               ${import_picocolors49.default.dim("show what would pull and what would push")}`);
-  out.push(`  ${import_picocolors49.default.cyan("agent env")}                  ${import_picocolors49.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
-  out.push(`  ${import_picocolors49.default.cyan("run")} ${import_picocolors49.default.dim("<cmd> [args...]")}         ${import_picocolors49.default.dim("run <cmd> with secrets.env loaded into env")}`);
-  out.push(`  ${import_picocolors49.default.cyan("status")}                     ${import_picocolors49.default.dim("show what this folder is linked to")}`);
-  out.push(`  ${import_picocolors49.default.cyan("unlink")}                     ${import_picocolors49.default.dim("disconnect this folder")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent create")}               ${import_picocolors52.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent pull")} ${import_picocolors52.default.dim("[<id>]")}          ${import_picocolors52.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent push")}                 ${import_picocolors52.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent unpack")}               ${import_picocolors52.default.dim("install the claimed agent into a harness layout")}`);
+  out.push(`  ${import_picocolors52.default.cyan("link")}                       ${import_picocolors52.default.dim("attach this folder to an existing agent")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent status")}               ${import_picocolors52.default.dim("show what would pull and what would push")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent connections")}          ${import_picocolors52.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent connect")} ${import_picocolors52.default.dim("<name>")}       ${import_picocolors52.default.dim("connect slack or meeting from the terminal")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent disconnect")} ${import_picocolors52.default.dim("<name>")}    ${import_picocolors52.default.dim("revoke a slack or meeting install")}`);
+  out.push(`  ${import_picocolors52.default.cyan("agent env")}                  ${import_picocolors52.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
+  out.push(`  ${import_picocolors52.default.cyan("run")} ${import_picocolors52.default.dim("<cmd> [args...]")}         ${import_picocolors52.default.dim("run <cmd> with secrets.env loaded into env")}`);
+  out.push(`  ${import_picocolors52.default.cyan("status")}                     ${import_picocolors52.default.dim("show what this folder is linked to")}`);
+  out.push(`  ${import_picocolors52.default.cyan("unlink")}                     ${import_picocolors52.default.dim("disconnect this folder")}`);
   out.push("");
   out.push(divider("TASKS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("task create")} ${import_picocolors49.default.dim("--message <text>")}   ${import_picocolors49.default.dim("create a managed task and start its first run")}`);
+  out.push(`  ${import_picocolors52.default.cyan("task create")} ${import_picocolors52.default.dim("--message <text>")}   ${import_picocolors52.default.dim("create a managed task and start its first run")}`);
   out.push("");
   out.push(divider("BENCHMARK RUNTIME"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("benchmark hydrate")} ${import_picocolors49.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors49.default.cyan("benchmark evaluate")} ${import_picocolors49.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors49.default.cyan("benchmark capabilities")} ${import_picocolors49.default.dim("--json")}`);
+  out.push(`  ${import_picocolors52.default.cyan("benchmark hydrate")} ${import_picocolors52.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors52.default.cyan("benchmark evaluate")} ${import_picocolors52.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors52.default.cyan("benchmark capabilities")} ${import_picocolors52.default.dim("--json")}`);
   out.push("");
   out.push(divider("ORCHESTRATIONS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("orchestration create")}           ${import_picocolors49.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
-  out.push(`  ${import_picocolors49.default.cyan("orchestration list")}             ${import_picocolors49.default.dim("list orchestrations under a team")}`);
-  out.push(`  ${import_picocolors49.default.cyan("orchestration pull")} ${import_picocolors49.default.dim("<id>")}        ${import_picocolors49.default.dim("recursively fetch an orchestration + every member agent")}`);
-  out.push(`  ${import_picocolors49.default.cyan("orchestration push")}             ${import_picocolors49.default.dim("recursively push each member, then update the graph")}`);
-  out.push(`  ${import_picocolors49.default.cyan("orchestration status")}           ${import_picocolors49.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration create")}           ${import_picocolors52.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration list")}             ${import_picocolors52.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration pull")} ${import_picocolors52.default.dim("<id>")}        ${import_picocolors52.default.dim("recursively fetch an orchestration + every member agent")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration push")}             ${import_picocolors52.default.dim("recursively push each member, then update the graph")}`);
+  out.push(`  ${import_picocolors52.default.cyan("orchestration status")}           ${import_picocolors52.default.dim("show what would push and what would pull")}`);
   out.push("");
   out.push(divider("TEMPLATES"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("template pack")}                       ${import_picocolors49.default.dim("bundle the current agent into a template")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template publish")}                    ${import_picocolors49.default.dim("upload a template to the registry")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template search")} ${import_picocolors49.default.dim("[query]")}             ${import_picocolors49.default.dim("search the registry")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template info")}    ${import_picocolors49.default.dim("<creator/slug>")}     ${import_picocolors49.default.dim("show registry details for a template")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template onboard")} ${import_picocolors49.default.dim("<creator/slug>")}     ${import_picocolors49.default.dim("install (or refresh) a template")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template list")}                       ${import_picocolors49.default.dim("show installed templates")}`);
-  out.push(`  ${import_picocolors49.default.cyan("template remove")}  ${import_picocolors49.default.dim("<creator/slug>")}     ${import_picocolors49.default.dim("uninstall a template")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template pack")}                       ${import_picocolors52.default.dim("bundle the current agent into a template")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template publish")}                    ${import_picocolors52.default.dim("upload a template to the registry")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template search")} ${import_picocolors52.default.dim("[query]")}             ${import_picocolors52.default.dim("search the registry")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template info")}    ${import_picocolors52.default.dim("<creator/slug>")}     ${import_picocolors52.default.dim("show registry details for a template")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template onboard")} ${import_picocolors52.default.dim("<creator/slug>")}     ${import_picocolors52.default.dim("install (or refresh) a template")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template list")}                       ${import_picocolors52.default.dim("show installed templates")}`);
+  out.push(`  ${import_picocolors52.default.cyan("template remove")}  ${import_picocolors52.default.dim("<creator/slug>")}     ${import_picocolors52.default.dim("uninstall a template")}`);
   out.push("");
   out.push(divider("SKILLS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("skill add")} ${import_picocolors49.default.dim("<source>")}                  ${import_picocolors49.default.dim("install a skill (github / git / brainbase)")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill list")}                            ${import_picocolors49.default.dim("show locally installed skills + their source")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill update")} ${import_picocolors49.default.dim("<slug>")}                  ${import_picocolors49.default.dim("re-fetch a skill from its recorded source")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill remove")} ${import_picocolors49.default.dim("<slug>")}                  ${import_picocolors49.default.dim("uninstall a skill")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill search")} ${import_picocolors49.default.dim("[query]")}                 ${import_picocolors49.default.dim("search the brainbase skill registry")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill info")} ${import_picocolors49.default.dim("<creator/slug>")}            ${import_picocolors49.default.dim("show registry details for a skill")}`);
-  out.push(`  ${import_picocolors49.default.cyan("skill publish")} ${import_picocolors49.default.dim("[dir]")}                  ${import_picocolors49.default.dim("publish a SKILL.md folder (defaults to .)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill add")} ${import_picocolors52.default.dim("<source>")}                  ${import_picocolors52.default.dim("install a skill (github / git / brainbase)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill list")}                            ${import_picocolors52.default.dim("show locally installed skills + their source")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill update")} ${import_picocolors52.default.dim("<slug>")}                  ${import_picocolors52.default.dim("re-fetch a skill from its recorded source")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill remove")} ${import_picocolors52.default.dim("<slug>")}                  ${import_picocolors52.default.dim("uninstall a skill")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill search")} ${import_picocolors52.default.dim("[query]")}                 ${import_picocolors52.default.dim("search the brainbase skill registry")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill info")} ${import_picocolors52.default.dim("<creator/slug>")}            ${import_picocolors52.default.dim("show registry details for a skill")}`);
+  out.push(`  ${import_picocolors52.default.cyan("skill publish")} ${import_picocolors52.default.dim("[dir]")}                  ${import_picocolors52.default.dim("publish a SKILL.md folder (defaults to .)")}`);
   out.push("");
   out.push(divider("CLI TOKENS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("token create")}                        ${import_picocolors49.default.dim("issue a long-lived CLI key for CI / scripts")}`);
-  out.push(`  ${import_picocolors49.default.cyan("token list")}                          ${import_picocolors49.default.dim("show your tokens")}`);
-  out.push(`  ${import_picocolors49.default.cyan("token rename")} ${import_picocolors49.default.dim("<id>")}                  ${import_picocolors49.default.dim("relabel a token")}`);
-  out.push(`  ${import_picocolors49.default.cyan("token revoke")} ${import_picocolors49.default.dim("<id>")}                  ${import_picocolors49.default.dim("revoke a token")}`);
+  out.push(`  ${import_picocolors52.default.cyan("token create")}                        ${import_picocolors52.default.dim("issue a long-lived CLI key for CI / scripts")}`);
+  out.push(`  ${import_picocolors52.default.cyan("token list")}                          ${import_picocolors52.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors52.default.cyan("token rename")} ${import_picocolors52.default.dim("<id>")}                  ${import_picocolors52.default.dim("relabel a token")}`);
+  out.push(`  ${import_picocolors52.default.cyan("token revoke")} ${import_picocolors52.default.dim("<id>")}                  ${import_picocolors52.default.dim("revoke a token")}`);
   out.push("");
   out.push(divider("MCP"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.cyan("mcp check")} ${import_picocolors49.default.dim("[--json]")}              ${import_picocolors49.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("mcp check")} ${import_picocolors52.default.dim("[--json]")}              ${import_picocolors52.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
+  out.push(`  ${import_picocolors52.default.cyan("mcp list")} ${import_picocolors52.default.dim("[--json]")}               ${import_picocolors52.default.dim("show configured servers with OAuth state and expiry")}`);
   out.push("");
   out.push(divider("FLAGS"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
-  out.push(`  ${import_picocolors49.default.dim("--scope <s>")}        force scope: global | project`);
-  out.push(`  ${import_picocolors49.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
-  out.push(`  ${import_picocolors49.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly`);
-  out.push(`  ${import_picocolors49.default.dim("--message <text>")}   for task create: required first user message`);
-  out.push(`  ${import_picocolors49.default.dim("--title <text>")}     for task create: optional task title`);
-  out.push(`  ${import_picocolors49.default.dim("--model <id>")}       for task create: optional model override`);
-  out.push(`  ${import_picocolors49.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
-  out.push(`  ${import_picocolors49.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
-  out.push(`  ${import_picocolors49.default.dim("--json")}             machine-readable output for supported commands`);
-  out.push(`  ${import_picocolors49.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
-  out.push(`  ${import_picocolors49.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
-  out.push(`  ${import_picocolors49.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
-  out.push(`  ${import_picocolors49.default.dim("--all")}              for template list: include installs from other folders`);
-  out.push(`  ${import_picocolors49.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors52.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
+  out.push(`  ${import_picocolors52.default.dim("--scope <s>")}        force scope: global | project`);
+  out.push(`  ${import_picocolors52.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
+  out.push(`  ${import_picocolors52.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly`);
+  out.push(`  ${import_picocolors52.default.dim("--message <text>")}   for task create: required first user message`);
+  out.push(`  ${import_picocolors52.default.dim("--title <text>")}     for task create: optional task title`);
+  out.push(`  ${import_picocolors52.default.dim("--model <id>")}       for task create: optional model override`);
+  out.push(`  ${import_picocolors52.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
+  out.push(`  ${import_picocolors52.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
+  out.push(`  ${import_picocolors52.default.dim("--json")}             machine-readable output for supported commands`);
+  out.push(`  ${import_picocolors52.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
+  out.push(`  ${import_picocolors52.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
+  out.push(`  ${import_picocolors52.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
+  out.push(`  ${import_picocolors52.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
+  out.push(`  ${import_picocolors52.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
+  out.push(`  ${import_picocolors52.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
+  out.push(`  ${import_picocolors52.default.dim("--all")}              for template list: include installs from other folders`);
+  out.push(`  ${import_picocolors52.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
   out.push("");
   out.push(divider("ENV"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task create uses /v2/tasks)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT (overrides token.json)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task create uses /v2/tasks)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT; the only PAT control-plane commands accept (token.json is not read there)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
   out.push("");
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
-  out.push(`  ${import_picocolors49.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
+  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
   out.push("");
   out.push(divider("HARNESSES"));
   out.push("");
-  out.push(`  ${import_picocolors49.default.dim("•")} ${import_picocolors49.default.bold("claude-code")}  ${import_picocolors49.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors49.default.dim("•")} ${import_picocolors49.default.bold("codex")}        ${import_picocolors49.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors49.default.dim("•")} ${import_picocolors49.default.bold("kafka")}        ${import_picocolors49.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors52.default.dim("•")} ${import_picocolors52.default.bold("claude-code")}  ${import_picocolors52.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors52.default.dim("•")} ${import_picocolors52.default.bold("codex")}        ${import_picocolors52.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors52.default.dim("•")} ${import_picocolors52.default.bold("kafka")}        ${import_picocolors52.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -79751,7 +80556,13 @@ var VALUE_TAKING_FLAGS = new Set([
   "--description",
   "--schema",
   "--from",
-  "--to"
+  "--to",
+  "--bot-token",
+  "--signing-secret",
+  "--app-id",
+  "--app-name",
+  "--bot-name",
+  "--bot-image-url"
 ]);
 function isValueOfPriorFlag2(args, index) {
   return index > 0 && VALUE_TAKING_FLAGS.has(args[index - 1]);
@@ -79872,13 +80683,13 @@ async function requireAuth(cmd) {
   if (STORED_PAT_COMMANDS.has(cmd) && readToken())
     return;
   console.error("");
-  console.error(`  ${brandTint("◆")}  ${import_picocolors49.default.bold("brainbase")}`);
+  console.error(`  ${brandTint("◆")}  ${import_picocolors52.default.bold("brainbase")}`);
   console.error("");
-  console.error(`  ${import_picocolors49.default.red("✗")}  You need to sign in to use ${import_picocolors49.default.bold("brainbase " + cmd)}.`);
+  console.error(`  ${import_picocolors52.default.red("✗")}  You need to sign in to use ${import_picocolors52.default.bold("brainbase " + cmd)}.`);
   if (status.reason)
-    console.error(`     ${import_picocolors49.default.dim(status.reason)}`);
+    console.error(`     ${import_picocolors52.default.dim(status.reason)}`);
   console.error("");
-  console.error(`     Run ${import_picocolors49.default.cyan("brainbase login")} to connect this device.`);
+  console.error(`     Run ${import_picocolors52.default.cyan("brainbase login")} to connect this device.`);
   console.error("");
   process14.exit(1);
 }
@@ -79888,7 +80699,7 @@ async function main() {
   const rawCwd = process14.cwd();
   const cwd2 = (() => {
     try {
-      return fs82.realpathSync(rawCwd);
+      return fs83.realpathSync(rawCwd);
     } catch {
       return rawCwd;
     }
@@ -79937,6 +80748,12 @@ async function main() {
   const noPushFlag = hasFlag2(sharedArgs, "--no-push");
   const jsonFlag = hasFlag2(sharedArgs, "--json");
   const acpFlag = hasFlag2(sharedArgs, "--acp");
+  const botTokenFlag = getFlag(sharedArgs, "--bot-token");
+  const signingSecretFlag = getFlag(sharedArgs, "--signing-secret");
+  const appIdFlag = getFlag(sharedArgs, "--app-id");
+  const appNameFlag = getFlag(sharedArgs, "--app-name");
+  const botNameFlag = getFlag(sharedArgs, "--bot-name");
+  const botImageUrlFlag = getFlag(sharedArgs, "--bot-image-url");
   ensureSkillResolversRegistered();
   await requireAuth(cmd);
   try {
@@ -79950,7 +80767,7 @@ async function main() {
         break;
       }
       case "whoami": {
-        await runWhoami();
+        await runWhoami({ json: jsonFlag });
         break;
       }
       case "template": {
@@ -80020,7 +80837,13 @@ async function main() {
           track,
           force: forceFlag,
           runEntrypoint: runEntrypointFlag,
-          acp: acpFlag
+          acp: acpFlag,
+          botToken: botTokenFlag,
+          signingSecret: signingSecretFlag,
+          appId: appIdFlag,
+          appName: appNameFlag,
+          botName: botNameFlag,
+          botImageUrl: botImageUrlFlag
         });
         break;
       }
@@ -80079,10 +80902,10 @@ async function main() {
         process14.exit(1);
     }
   } catch (err) {
-    console.error(import_picocolors49.default.red(`
+    console.error(import_picocolors52.default.red(`
 ${err.message}`));
     if (err instanceof ApiError && err.status === 401) {
-      console.error(`  Run ${import_picocolors49.default.cyan("brainbase login")} to connect this device.`);
+      console.error(`  Run ${import_picocolors52.default.cyan("brainbase login")} to connect this device.`);
     }
     if (process14.env.BRAINBASE_DEBUG)
       console.error(err.stack);