@brainbase-labs/cli 0.25.0-eng1209.9 → 0.26.0

package/dist/index.js

@@ -31708,8 +31708,8 @@ var require_utils = __commonJS((exports, module) => {
     }
     return ind;
   }
-  function removeDotSegments(path88) {
-    let input = path88;
+  function removeDotSegments(path89) {
+    let input = path89;
     const output = [];
     let nextSlash = -1;
     let len = 0;
@@ -31952,8 +31952,8 @@ var require_schemes = __commonJS((exports, module) => {
       wsComponent.secure = undefined;
     }
     if (wsComponent.resourceName) {
-      const [path88, query] = wsComponent.resourceName.split("?");
-      wsComponent.path = path88 && path88 !== "/" ? path88 : undefined;
+      const [path89, query] = wsComponent.resourceName.split("?");
+      wsComponent.path = path89 && path89 !== "/" ? path89 : undefined;
       wsComponent.query = query;
       wsComponent.resourceName = undefined;
     }
@@ -35141,7 +35141,7 @@ var require_dist2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-var import_picocolors52 = __toESM(require_picocolors(), 1);
+var import_picocolors53 = __toESM(require_picocolors(), 1);
 import process14 from "node:process";
 import fs83 from "node:fs";
 
@@ -36008,7 +36008,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.25.0-eng1209.9",
+  version: "0.26.0",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -61950,6 +61950,7 @@ import fs66 from "node:fs";
 // src/core/agent-manifest.ts
 import path73 from "node:path";
 import fs65 from "node:fs";
+import { randomBytes } from "node:crypto";
 var import_yaml2 = __toESM(require_dist(), 1);
 var AGENT_MANIFEST_FILE = "brainbase.agent.yaml";
 var LEGACY_AGENT_MANIFEST_FILE = "brainbase.yaml";
@@ -62121,30 +62122,54 @@ function existingManifestPath(cwd2) {
 function hasManifest(cwd2) {
   return existingManifestPath(cwd2) !== null;
 }
-function readManifest(cwd2) {
-  const p2 = existingManifestPath(cwd2);
-  if (!p2)
-    return null;
-  const raw = fs65.readFileSync(p2, "utf8");
+function parseManifest(raw, label = AGENT_MANIFEST_FILE) {
   let parsed;
   try {
     parsed = import_yaml2.default.parse(raw);
   } catch (err) {
-    throw new Error(`${path73.basename(p2)} is not valid YAML: ${err.message}`);
+    throw new Error(`${label} is not valid YAML: ${err.message}`);
   }
   const result2 = AgentManifestSchema.safeParse(parsed);
   if (!result2.success) {
-    throw new Error(`${path73.basename(p2)} is invalid: ${result2.error.issues.map((i) => `${i.path.join(".") || "(root)"} — ${i.message}`).join("; ")}`);
+    throw new Error(`${label} is invalid: ${result2.error.issues.map((i) => `${i.path.join(".") || "(root)"} — ${i.message}`).join("; ")}`);
   }
   return result2.data;
 }
-function writeManifest(cwd2, manifest) {
+function readManifest(cwd2) {
+  const p2 = existingManifestPath(cwd2);
+  if (!p2)
+    return null;
+  return parseManifest(fs65.readFileSync(p2, "utf8"), path73.basename(p2));
+}
+function renderManifest(manifest) {
   const doc = new import_yaml2.default.Document;
   doc.contents = manifest;
   doc.commentBefore = ` brainbase.agent.yaml — declarative agent manifest.
 ` + " Committed to source control. Edit by hand, then `brainbase agent push`.";
-  const out = String(doc);
-  fs65.writeFileSync(manifestPath(cwd2), out, "utf8");
+  return String(doc);
+}
+function writeManifestText(cwd2, body) {
+  const target = manifestPath(cwd2);
+  const tmp = `${target}.${randomBytes(8).toString("hex")}.tmp`;
+  const fd = fs65.openSync(tmp, "wx");
+  let closed = false;
+  try {
+    fs65.writeFileSync(fd, body, "utf8");
+    fs65.closeSync(fd);
+    closed = true;
+    fs65.renameSync(tmp, target);
+  } catch (err) {
+    if (!closed) {
+      try {
+        fs65.closeSync(fd);
+      } catch {}
+    }
+    fs65.rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+function writeManifest(cwd2, manifest) {
+  writeManifestText(cwd2, renderManifest(manifest));
 }
 function resolveInstructionsPath(cwd2, manifest) {
   if (!manifest.instructions?.file)
@@ -62318,7 +62343,9 @@ var AgentMetaSnapshotSchema = exports_external.object({
   tagline: exports_external.string().nullish().transform((v3) => v3 ?? undefined),
   entrypoint: exports_external.string().optional(),
   machine_kind: exports_external.string().min(1).optional(),
-  default_model: exports_external.string().nullable().optional()
+  default_model: exports_external.string().nullable().optional(),
+  memory: exports_external.boolean().nullable().optional(),
+  browser: exports_external.boolean().nullable().optional()
 });
 var SyncStateSchema = exports_external.object({
   schemaVersion: exports_external.literal(1),
@@ -63518,7 +63545,7 @@ function runHarnessInstall(harnessId, components, opts, agentName) {
 }
 
 // src/cli/agent.ts
-var import_picocolors37 = __toESM(require_picocolors(), 1);
+var import_picocolors38 = __toESM(require_picocolors(), 1);
 
 // src/cli/agent-pull.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -63931,9 +63958,44 @@ function diffAgentMeta(manifestMeta, lockMeta, cloudMeta) {
     cloudChanged: !!cloudMeta && !!lockMeta && !eq(cloudMeta, lockMeta)
   };
 }
+var WRITABLE_CAPABILITIES = ["memory", "browser"];
+var MIRRORED_CAPABILITIES = ["slack", "meeting", "github"];
+function manifestConfigState(manifest) {
+  return {
+    ...manifest.machine_kind !== undefined ? { machine_kind: manifest.machine_kind } : {},
+    ...hasOwn(manifest, "default_model") ? { default_model: manifest.default_model ?? null } : {},
+    ...manifest.capabilities?.memory !== undefined ? { memory: manifest.capabilities.memory } : {},
+    ...manifest.capabilities?.browser !== undefined ? { browser: manifest.capabilities.browser } : {}
+  };
+}
+function cloudConfigState(agent) {
+  return {
+    ...agent.machine_kind !== undefined ? { machine_kind: agent.machine_kind } : {},
+    ...hasOwn(agent, "default_model") ? { default_model: agent.default_model ?? null } : {},
+    ...agent.memory_enabled !== undefined ? { memory: agent.memory_enabled } : {},
+    ...agent.browser_enabled !== undefined ? { browser: agent.browser_enabled } : {}
+  };
+}
 function hasOwn(value, key2) {
   return !!value && Object.prototype.hasOwnProperty.call(value, key2);
 }
+function staleConnectionMirrors(manifest, cloud) {
+  const actualByName = {
+    slack: cloud.slack_connected,
+    meeting: cloud.meeting_connected,
+    github: cloud.github_connected
+  };
+  const stale = [];
+  for (const name of MIRRORED_CAPABILITIES) {
+    const authored = manifest.capabilities?.[name];
+    const actual = actualByName[name];
+    if (authored === undefined || actual === undefined)
+      continue;
+    if (authored !== actual)
+      stale.push({ name, authored, actual });
+  }
+  return stale;
+}
 function diffAgentConfig(manifest, lock, cloud) {
   const unsupported = [];
   const machineSupported = cloud.machine_kind !== undefined;
@@ -63948,42 +64010,94 @@ function diffAgentConfig(manifest, lock, cloud) {
   const machineLocalChanged = manifest.machine_kind !== undefined && machineSupported && (lock?.machine_kind !== undefined ? manifest.machine_kind !== lock.machine_kind && manifest.machine_kind !== cloud.machine_kind : manifest.machine_kind !== cloud.machine_kind);
   const machineCloudChanged = lock?.machine_kind !== undefined && machineSupported && lock.machine_kind !== cloud.machine_kind && manifest.machine_kind !== cloud.machine_kind;
   const machineConverged = manifest.machine_kind !== undefined && machineSupported && manifest.machine_kind === cloud.machine_kind && (lock?.machine_kind === undefined || lock.machine_kind !== cloud.machine_kind);
-  let defaultModelLocalChanged = false;
-  let defaultModelCloudChanged = false;
-  let defaultModelConflict = false;
-  let defaultModelConverged = false;
-  if (defaultModelSupported) {
-    const cloudValue = cloud.default_model ?? null;
-    const localAuthored = manifest.default_model !== undefined;
-    const lockSupported = hasOwn(lock, "default_model");
-    if (localAuthored) {
-      const localValue = manifest.default_model ?? null;
-      if (lockSupported) {
-        const lockValue = lock?.default_model ?? null;
-        const localMoved = localValue !== lockValue;
-        const cloudMoved = cloudValue !== lockValue;
-        defaultModelConflict = localMoved && cloudMoved && localValue !== cloudValue;
-        defaultModelLocalChanged = localMoved && localValue !== cloudValue;
-        defaultModelCloudChanged = cloudMoved && localValue !== cloudValue;
-        defaultModelConverged = localMoved && cloudMoved && localValue === cloudValue;
-      } else {
-        defaultModelLocalChanged = localValue !== cloudValue;
-        defaultModelConverged = localValue === cloudValue;
-      }
-    } else if (lockSupported) {
-      defaultModelCloudChanged = cloudValue !== (lock?.default_model ?? null);
-    }
+  const defaultModel = threeWayField(defaultModelSupported, manifest.default_model, cloud.default_model, lock, "default_model");
+  const memory = threeWayField(hasOwn(cloud, "memory"), manifest.memory, cloud.memory, lock, "memory");
+  const browser = threeWayField(hasOwn(cloud, "browser"), manifest.browser, cloud.browser, lock, "browser");
+  if (manifest.memory !== undefined && !hasOwn(cloud, "memory")) {
+    unsupported.push("memory");
+  }
+  if (manifest.browser !== undefined && !hasOwn(cloud, "browser")) {
+    unsupported.push("browser");
   }
   return {
     unsupported,
     machineMismatch,
     machineLocalChanged,
     machineCloudChanged,
-    defaultModelLocalChanged,
-    defaultModelCloudChanged,
-    defaultModelConflict,
-    baselineConverged: machineConverged || defaultModelConverged
+    defaultModelLocalChanged: defaultModel.localChanged,
+    defaultModelCloudChanged: defaultModel.cloudChanged,
+    defaultModelConflict: defaultModel.conflict,
+    memory,
+    browser,
+    baselineConverged: machineConverged || defaultModel.converged || memory.converged || browser.converged
+  };
+}
+function threeWayField(supported, authored, cloudRaw, lock, key2) {
+  const result2 = {
+    localChanged: false,
+    cloudChanged: false,
+    conflict: false,
+    converged: false
   };
+  if (!supported)
+    return result2;
+  const cloudValue = cloudRaw ?? null;
+  const lockSupported = hasOwn(lock, key2);
+  const lockValue = lock?.[key2] ?? null;
+  if (authored === undefined) {
+    if (lockSupported)
+      result2.cloudChanged = cloudValue !== lockValue;
+    return result2;
+  }
+  const localValue = authored ?? null;
+  if (!lockSupported) {
+    result2.localChanged = localValue !== cloudValue;
+    result2.converged = localValue === cloudValue;
+    return result2;
+  }
+  const localMoved = localValue !== lockValue;
+  const cloudMoved = cloudValue !== lockValue;
+  result2.conflict = localMoved && cloudMoved && localValue !== cloudValue;
+  result2.localChanged = localMoved && localValue !== cloudValue;
+  result2.cloudChanged = cloudMoved && localValue !== cloudValue;
+  result2.converged = localMoved && cloudMoved && localValue === cloudValue;
+  return result2;
+}
+
+// src/core/capability-baseline.ts
+var CLOUD_KEY = {
+  memory: "memory_enabled",
+  browser: "browser_enabled"
+};
+function carryForward(previous, name) {
+  return previous && Object.prototype.hasOwnProperty.call(previous, name) ? { [name]: previous[name] ?? null } : {};
+}
+function capabilityBaseline(cloudAgent, previous) {
+  const out = {};
+  for (const name of WRITABLE_CAPABILITIES) {
+    const fromCloud = cloudAgent?.[CLOUD_KEY[name]];
+    if (fromCloud !== undefined) {
+      out[name] = fromCloud;
+      continue;
+    }
+    Object.assign(out, carryForward(previous, name));
+  }
+  return out;
+}
+function capabilityBaselineAfterPush(cloudAgent, previous, diff2) {
+  const out = {};
+  for (const name of WRITABLE_CAPABILITIES) {
+    if (diff2[name].cloudChanged && !diff2[name].localChanged) {
+      Object.assign(out, carryForward(previous, name));
+      continue;
+    }
+    const fromCloud = cloudAgent[CLOUD_KEY[name]];
+    if (fromCloud !== undefined)
+      out[name] = fromCloud;
+    else
+      Object.assign(out, carryForward(previous, name));
+  }
+  return out;
 }
 
 // src/core/secrets-env.ts
@@ -64650,7 +64764,8 @@ async function runAgentPull(cwd2, args) {
         tagline: cloudAgent.tagline,
         ...cloudAgent.entrypoint ? { entrypoint: cloudAgent.entrypoint.trim() } : {},
         ...cloudAgent.machine_kind ? { machine_kind: cloudAgent.machine_kind } : lock?.agentMeta?.machine_kind ? { machine_kind: lock.agentMeta.machine_kind } : {},
-        ...Object.prototype.hasOwnProperty.call(cloudAgent, "default_model") ? { default_model: cloudAgent.default_model ?? null } : Object.prototype.hasOwnProperty.call(lock?.agentMeta ?? {}, "default_model") ? { default_model: lock.agentMeta.default_model ?? null } : {}
+        ...Object.prototype.hasOwnProperty.call(cloudAgent, "default_model") ? { default_model: cloudAgent.default_model ?? null } : Object.prototype.hasOwnProperty.call(lock?.agentMeta ?? {}, "default_model") ? { default_model: lock.agentMeta.default_model ?? null } : {},
+        ...capabilityBaseline(cloudAgent, lock?.agentMeta)
       }
     };
     writeSyncState(cwd2, newState);
@@ -64941,7 +65056,8 @@ function buildLockFromCloud(agent_id, cloud, prev, cloudAgent) {
       tagline: cloudAgent.tagline,
       ...cloudAgent.entrypoint ? { entrypoint: cloudAgent.entrypoint.trim() } : {},
       ...cloudAgent.machine_kind ? { machine_kind: cloudAgent.machine_kind } : prev?.agentMeta?.machine_kind ? { machine_kind: prev.agentMeta.machine_kind } : {},
-      ...Object.prototype.hasOwnProperty.call(cloudAgent, "default_model") ? { default_model: cloudAgent.default_model ?? null } : Object.prototype.hasOwnProperty.call(prev?.agentMeta ?? {}, "default_model") ? { default_model: prev.agentMeta.default_model ?? null } : {}
+      ...Object.prototype.hasOwnProperty.call(cloudAgent, "default_model") ? { default_model: cloudAgent.default_model ?? null } : Object.prototype.hasOwnProperty.call(prev?.agentMeta ?? {}, "default_model") ? { default_model: prev.agentMeta.default_model ?? null } : {},
+      ...capabilityBaseline(cloudAgent, prev?.agentMeta)
     } : prev?.agentMeta
   };
 }
@@ -65289,13 +65405,25 @@ async function runAgentPush(cwd2, args) {
     lock: lock?.components ?? [],
     cloud: cloud.components
   });
-  const config = diffAgentConfig(manifest, lock?.agentMeta, cloudAgent);
+  const config = diffAgentConfig(manifestConfigState(manifest), lock?.agentMeta, cloudConfigState(cloudAgent));
   if (config.unsupported.length > 0) {
     f2.error(`This control plane does not support declarative ${config.unsupported.join(" / ")} config.`);
     f2.info(`Use the MAS control plane, then run ${import_picocolors28.default.cyan("brainbase agent pull")} before retrying.`);
     process.exitCode = 1;
     return;
   }
+  const staleMirrors = staleConnectionMirrors(manifest, cloudAgent);
+  if (staleMirrors.length > 0) {
+    f2.error(`This manifest's connection state is out of date: ${staleMirrors.map((m3) => `${m3.name} says ${m3.authored}, actually ${m3.actual}`).join("; ")}.`);
+    f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent pull")} to refresh it. These are reported by the cloud, not set from the manifest.`);
+    for (const m3 of staleMirrors) {
+      if (!m3.actual) {
+        f2.info(`To actually connect ${m3.name}, run ${import_picocolors28.default.cyan(`brainbase agent connect ${m3.name}`)}.`);
+      }
+    }
+    process.exitCode = 1;
+    return;
+  }
   if (config.machineMismatch) {
     if (config.machineCloudChanged && !config.machineLocalChanged) {
       f2.error("Cannot push: machine_kind changed on the cloud.");
@@ -65316,6 +65444,17 @@ async function runAgentPush(cwd2, args) {
   if (config.defaultModelConflict && args.force) {
     f2.warn(`${import_picocolors28.default.yellow("--force")}: overwriting the cloud default_model with the local value.`);
   }
+  const conflictedCapabilities = WRITABLE_CAPABILITIES.filter((name) => config[name].conflict);
+  if (conflictedCapabilities.length > 0) {
+    const label = conflictedCapabilities.map((name) => `capabilities.${name}`).join(" and ");
+    if (!args.force) {
+      f2.error(`Cannot push: ${label} changed both locally and on the cloud.`);
+      f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent pull")} first to reconcile, or ${import_picocolors28.default.cyan("brainbase agent push --force")} to keep the local value.`);
+      process.exitCode = 1;
+      return;
+    }
+    f2.warn(`${import_picocolors28.default.yellow("--force")}: overwriting the cloud ${label} with the local value.`);
+  }
   const registryRefs = new Map;
   for (const entry of manifest.skills) {
     try {
@@ -65455,7 +65594,7 @@ async function runAgentPush(cwd2, args) {
     f2.warn(`Cloud runtime config changed since the last sync. Run ${import_picocolors28.default.cyan("brainbase agent pull")} to accept it locally.`);
   }
   const shouldPushManifest = meta.localChanged || entrypointChanged || toSend.length > 0;
-  const shouldUpdateAgent = meta.localChanged || entrypointChanged || config.defaultModelLocalChanged;
+  const shouldUpdateAgent = meta.localChanged || entrypointChanged || config.defaultModelLocalChanged || config.memory.localChanged || config.browser.localChanged;
   const hasAgentChanges = shouldPushManifest || shouldUpdateAgent;
   const outgoing = hasAgentChanges ? await buildOutgoingComponents(cwd2, manifest, cloud, resolvedVersions) : null;
   if (hasAgentChanges && outgoing === null) {
@@ -65499,7 +65638,7 @@ async function runAgentPush(cwd2, args) {
     });
   }
   if (!hasAgentChanges && !secretPlan) {
-    if (config.defaultModelCloudChanged || config.machineCloudChanged) {
+    if (config.defaultModelCloudChanged || config.machineCloudChanged || config.memory.cloudChanged || config.browser.cloudChanged) {
       f2.info("Nothing local to push; cloud runtime config is awaiting pull.");
       return;
     }
@@ -65571,7 +65710,7 @@ async function runAgentPush(cwd2, args) {
     $e(`Pushed secrets for ${manifest.agent.name}.`);
     return;
   }
-  if (meta.localChanged || entrypointChanged || config.defaultModelLocalChanged) {
+  if (meta.localChanged || entrypointChanged || config.defaultModelLocalChanged || config.memory.localChanged || config.browser.localChanged) {
     const metaSpinner = de();
     metaSpinner.start("Updating agent config…");
     try {
@@ -65586,6 +65725,12 @@ async function runAgentPush(cwd2, args) {
       if (config.defaultModelLocalChanged) {
         update2.default_model = manifest.default_model ?? null;
       }
+      if (config.memory.localChanged) {
+        update2.memory_enabled = manifest.capabilities?.memory;
+      }
+      if (config.browser.localChanged) {
+        update2.browser_enabled = manifest.capabilities?.browser;
+      }
       cloudAgent = await api.updateAgent(agentId, update2);
       metaSpinner.stop("Agent config updated.");
     } catch (err) {
@@ -65702,7 +65847,8 @@ function buildAgentMetaAfterPush({
     tagline: manifest.agent.tagline,
     entrypoint: resolvedEntrypoint !== undefined ? resolvedEntrypoint.trim() : lock?.agentMeta?.entrypoint,
     ...config.machineCloudChanged ? lock?.agentMeta?.machine_kind ? { machine_kind: lock.agentMeta.machine_kind } : {} : cloudAgent.machine_kind ? { machine_kind: cloudAgent.machine_kind } : lock?.agentMeta?.machine_kind ? { machine_kind: lock.agentMeta.machine_kind } : {},
-    ...config.defaultModelCloudChanged && !config.defaultModelLocalChanged ? Object.prototype.hasOwnProperty.call(lock?.agentMeta ?? {}, "default_model") ? { default_model: lock.agentMeta.default_model ?? null } : {} : Object.prototype.hasOwnProperty.call(cloudAgent, "default_model") ? { default_model: cloudAgent.default_model ?? null } : Object.prototype.hasOwnProperty.call(lock?.agentMeta ?? {}, "default_model") ? { default_model: lock.agentMeta.default_model ?? null } : {}
+    ...config.defaultModelCloudChanged && !config.defaultModelLocalChanged ? Object.prototype.hasOwnProperty.call(lock?.agentMeta ?? {}, "default_model") ? { default_model: lock.agentMeta.default_model ?? null } : {} : Object.prototype.hasOwnProperty.call(cloudAgent, "default_model") ? { default_model: cloudAgent.default_model ?? null } : Object.prototype.hasOwnProperty.call(lock?.agentMeta ?? {}, "default_model") ? { default_model: lock.agentMeta.default_model ?? null } : {},
+    ...capabilityBaselineAfterPush(cloudAgent, lock?.agentMeta, config)
   };
 }
 async function planSecretPush(cwd2, agentId) {
@@ -65751,6 +65897,9 @@ function handleApiError3(err) {
 // src/cli/agent-status.ts
 import path81 from "node:path";
 var import_picocolors29 = __toESM(require_picocolors(), 1);
+function capabilityDrifted(field) {
+  return field.localChanged || field.cloudChanged || field.conflict;
+}
 async function runAgentStatus(cwd2, args = {}) {
   const json = args.json === true;
   if (!json)
@@ -65818,7 +65967,7 @@ async function runAgentStatus(cwd2, args = {}) {
     cloud: cloud.components
   });
   const meta = diffAgentMeta(manifest.agent, lock?.agentMeta, cloudAgent);
-  const config = diffAgentConfig(manifest, lock?.agentMeta, cloudAgent);
+  const config = diffAgentConfig(manifestConfigState(manifest), lock?.agentMeta, cloudConfigState(cloudAgent));
   const toPush = [];
   const toPull = [];
   const conflicts = [];
@@ -65865,7 +66014,7 @@ async function runAgentStatus(cwd2, args = {}) {
   }
   const componentsDrifted = conflicts.length > 0 || toPush.length > 0 || toPull.length > 0;
   const metaDrifted = meta.localChanged || meta.cloudChanged;
-  const configDrifted = config.unsupported.length > 0 || config.machineMismatch || config.machineCloudChanged || config.defaultModelLocalChanged || config.defaultModelCloudChanged;
+  const configDrifted = config.unsupported.length > 0 || config.machineMismatch || config.machineCloudChanged || config.defaultModelLocalChanged || config.defaultModelCloudChanged || capabilityDrifted(config.memory) || capabilityDrifted(config.browser);
   const secretsDrifted = secretDrift.localOnly.length > 0 || secretDrift.cloudOnly.length > 0 || secretDrift.changed.length > 0;
   const everythingInSync = !componentsDrifted && !metaDrifted && !configDrifted && !secretsDrifted;
   const unchecked = secretsChecked ? [] : [{ signal: "secrets", reason: secretsUncheckedReason }];
@@ -65883,7 +66032,9 @@ async function runAgentStatus(cwd2, args = {}) {
         machineCloudChanged: config.machineCloudChanged,
         defaultModelLocalChanged: config.defaultModelLocalChanged,
         defaultModelCloudChanged: config.defaultModelCloudChanged,
-        defaultModelConflict: config.defaultModelConflict
+        defaultModelConflict: config.defaultModelConflict,
+        memory: config.memory,
+        browser: config.browser
       },
       secrets: secretsChecked ? {
         localOnly: secretDrift.localOnly,
@@ -65944,6 +66095,19 @@ async function runAgentStatus(cwd2, args = {}) {
         lines.push(`    ${import_picocolors29.default.cyan("← pull")}  default_model changed on cloud`);
       }
     }
+    for (const name of WRITABLE_CAPABILITIES) {
+      const field = config[name];
+      if (field.conflict) {
+        lines.push(`    ${import_picocolors29.default.red("! conflict")}  capabilities.${name} changed locally and on cloud`);
+        continue;
+      }
+      if (field.localChanged) {
+        lines.push(`    ${import_picocolors29.default.yellow("→ push")}  capabilities.${name} edited locally`);
+      }
+      if (field.cloudChanged) {
+        lines.push(`    ${import_picocolors29.default.cyan("← pull")}  capabilities.${name} changed on cloud`);
+      }
+    }
     lines.push("");
   }
   if (secretsDrifted || !secretsChecked) {
@@ -66065,7 +66229,6 @@ function formatExport(shell, key2, value) {
 }
 
 // src/cli/agent-create.ts
-import path82 from "node:path";
 var import_picocolors32 = __toESM(require_picocolors(), 1);
 
 // src/ui/box.ts
@@ -66258,6 +66421,153 @@ async function listTeamsPerOrg(orgs) {
   return { entries, resolved, failures };
 }
 
+// src/core/agent-scaffold.ts
+var import_yaml4 = __toESM(require_dist(), 1);
+import path82 from "node:path";
+var STARTER_TAGLINE = "A starter agent.";
+var FALLBACK_NAME = "my-agent";
+var FALLBACK_HARNESS = "claude-code";
+function isKnownHarness(id) {
+  return adapters.some((a3) => a3.id === id);
+}
+function knownHarnessIds() {
+  return adapters.map((a3) => a3.id);
+}
+async function resolveScaffoldHarness(cwd2, flag) {
+  const forced = flag?.trim();
+  if (forced)
+    return { id: normalizeHarnessId(forced), source: "flag" };
+  const detections = await detectHarnesses(cwd2);
+  const inProject = detections.find((d3) => d3.detection.hasProject);
+  if (inProject)
+    return { id: inProject.adapter.id, source: "project" };
+  const installed = detections.find((d3) => d3.detection.detected);
+  if (installed)
+    return { id: installed.adapter.id, source: "installed" };
+  return { id: FALLBACK_HARNESS, source: "default" };
+}
+function describeHarnessSource(source) {
+  switch (source) {
+    case "flag":
+      return "from --harness";
+    case "project":
+      return "detected in this folder";
+    case "installed":
+      return "installed on this machine";
+    case "default":
+      return "nothing detected — pass --harness to change it";
+    default: {
+      const never = source;
+      return never;
+    }
+  }
+}
+function singleLine(value) {
+  return (value ?? "").replace(/\s+/g, " ").trim();
+}
+function resolveScaffoldName(cwd2, flag) {
+  return singleLine(flag) || singleLine(path82.basename(path82.resolve(cwd2))) || FALLBACK_NAME;
+}
+function harnessDisplayName(id) {
+  try {
+    return getAdapter(id).displayName;
+  } catch {
+    return id;
+  }
+}
+function starterInstructions(harnessId) {
+  return `You are a helpful ${harnessDisplayName(harnessId)} agent.`;
+}
+function buildStarterManifest(seed) {
+  return {
+    schema: 1,
+    harness: seed.harness,
+    agent: {
+      name: seed.name,
+      tagline: singleLine(seed.tagline) || STARTER_TAGLINE
+    },
+    instructions: { text: starterInstructions(seed.harness) }
+  };
+}
+function scalar(value) {
+  return import_yaml4.default.stringify(value, { lineWidth: 0 }).trimEnd();
+}
+function renderFullTemplate(seed) {
+  return `# ${AGENT_MANIFEST_FILE} — declarative agent manifest.
+# Committed to source control. Edit by hand, then \`brainbase agent push\`.
+#
+# Only \`schema\` and \`agent.name\` are required — uncomment the blocks you
+# need and delete the rest. Full reference:
+# https://docs.brainbaselabs.com/cli/reference/agent-manifest
+
+schema: 1
+
+# Which harness runs this agent locally. One of:
+# ${knownHarnessIds().join(", ")}.
+harness: ${scalar(seed.harness)}
+
+# Sandbox provider, applied when \`brainbase agent create\` claims this file.
+# Immutable afterwards — recreate the agent to change it.
+# machine_kind: daytona
+
+# Agent-level model override. Omit it to leave the cloud value alone, or set
+# null to clear an override that is already set.
+# default_model: openai/gpt-5.6-terra
+
+agent:
+  name: ${scalar(seed.name)}
+  tagline: ${scalar(singleLine(seed.tagline) || STARTER_TAGLINE)}
+
+# The agent's system prompt. Exactly one of \`text\` or \`file\`.
+instructions:
+  text: ${scalar(starterInstructions(seed.harness))}
+  # file: ./.brainbase/instructions.md
+
+# Bash that runs in the sandbox before the agent starts. Exactly one of
+# \`commands\`, \`file\`, or \`text\`.
+# entrypoint:
+#   commands:
+#     - npm install
+
+# Named procedures the agent can follow. Each \`content\` takes exactly one of
+# \`text\` or \`file\`.
+# playbooks:
+#   - title: Release checklist
+#     description: Steps to cut a release
+#     content:
+#       file: ./playbooks/release.md
+
+# Skills to install. A registry ref pins an exact version or omits it to track
+# the latest; ranges are not supported. Local paths start with \`./\`.
+# skills:
+#   - source: registry:brainbase/changelog@1.0.0
+#   - source: ./skills/local-linter
+
+# MCP servers. Each entry needs either \`url\` or \`command\`. Keep tokens out
+# of this file — put them in the gitignored \`.brainbase/secrets.env\`.
+# mcp:
+#   - name: github
+#     url: https://api.githubcopilot.com/mcp/
+#     is_enabled: true
+
+# Criteria a judge scores every completed turn against.
+# evals:
+#   - slug: answered-the-question
+#     criteria: The reply answers what was asked without inventing facts.
+
+# Not shown above: \`capabilities\` is written by \`brainbase agent pull\` from
+# the cloud and never pushed, and \`commands\` / \`hooks\` / \`files\` parse but
+# no command syncs them yet — \`agent push\` refuses them rather than dropping
+# them silently.
+`;
+}
+function writeStarterManifest(cwd2, seed, opts = {}) {
+  const body = opts.full ? renderFullTemplate(seed) : renderManifest(buildStarterManifest(seed));
+  const manifest = parseManifest(body);
+  writeManifestText(cwd2, body);
+  return manifest;
+}
+
 // src/cli/agent-create.ts
 async function runAgentCreate(cwd2, args) {
   banner("agent create — claim a brainbase.agent.yaml and link this folder");
@@ -66495,7 +66805,8 @@ async function runAgentCreate(cwd2, args) {
       tagline: agent.tagline,
       ...resolvedEntrypoint ? { entrypoint: resolvedEntrypoint.trim() } : {},
       ...agent.machine_kind ? { machine_kind: agent.machine_kind } : {},
-      ...Object.prototype.hasOwnProperty.call(agent, "default_model") ? { default_model: agent.default_model ?? null } : {}
+      ...Object.prototype.hasOwnProperty.call(agent, "default_model") ? { default_model: agent.default_model ?? null } : {},
+      ...capabilityBaseline(agent, undefined)
     }
   };
   writeSyncState(cwd2, state);
@@ -66528,12 +66839,9 @@ async function loadOrScaffoldManifest(cwd2, args) {
     }
   }
   f2.warn(`No ${import_picocolors32.default.bold(AGENT_MANIFEST_FILE)} here.`);
-  if (!args.yes) {
-    if (!isInteractive()) {
-      throw new NonInteractiveError(`No ${AGENT_MANIFEST_FILE} here. Create one first, or re-run with --yes to scaffold a minimal one.`);
-    }
+  if (!autoProceed(args.yes)) {
     const ans = await se({
-      message: `Scaffold a minimal ${import_picocolors32.default.bold(AGENT_MANIFEST_FILE)} and continue?`,
+      message: `Scaffold a starter ${import_picocolors32.default.bold(AGENT_MANIFEST_FILE)} and continue?`,
       initialValue: true
     });
     if (!ensureNotCancelled(ans)) {
@@ -66541,25 +66849,21 @@ async function loadOrScaffoldManifest(cwd2, args) {
       return null;
     }
   }
-  const seedName = args.name?.trim() ?? path82.basename(path82.resolve(cwd2)) ?? "My Agent";
-  const seedHarness = args.harness ? normalizeHarnessId(args.harness) : undefined;
-  const scaffold = {
-    schema: 1,
-    ...seedHarness ? { harness: seedHarness } : {},
-    agent: { name: seedName, ...args.tagline ? { tagline: args.tagline } : {} },
-    playbooks: [],
-    evals: [],
-    skills: [],
-    mcp: []
-  };
+  const harness = await resolveScaffoldHarness(cwd2, args.harness);
   try {
-    writeManifest(cwd2, scaffold);
+    const scaffold = writeStarterManifest(cwd2, {
+      name: resolveScaffoldName(cwd2, args.name),
+      harness: harness.id,
+      tagline: args.tagline
+    });
+    f2.info(`harness ${import_picocolors32.default.bold(harness.id)} ${import_picocolors32.default.dim(`(${describeHarnessSource(harness.source)})`)}`);
     f2.info(`Wrote ${import_picocolors32.default.bold(AGENT_MANIFEST_FILE)}.`);
+    return scaffold;
   } catch (err) {
     f2.error(`Failed to write manifest: ${err.message}`);
+    process.exitCode = 1;
     return null;
   }
-  return scaffold;
 }
 async function pickHarness2(cwd2) {
   const detections = await detectHarnesses(cwd2);
@@ -66591,8 +66895,83 @@ function handleApiError4(err) {
   $e("Aborted.");
 }
 
-// src/cli/agent-list.ts
+// src/cli/agent-init.ts
+import path83 from "node:path";
 var import_picocolors33 = __toESM(require_picocolors(), 1);
+function emit(result2) {
+  console.log(JSON.stringify(result2, null, 2));
+}
+async function runAgentInit(cwd2, args = {}) {
+  const json = args.json === true;
+  const target = manifestPath(cwd2);
+  if (args.minimal && args.full) {
+    return refuse(json, {
+      path: target,
+      created: false,
+      reason: "conflicting-flags",
+      message: `Pass either ${import_picocolors33.default.cyan("--minimal")} or ${import_picocolors33.default.cyan("--full")}, not both.`
+    });
+  }
+  const existing = existingManifestPath(cwd2);
+  if (existing && !args.force) {
+    return refuse(json, {
+      path: existing,
+      created: false,
+      reason: "manifest-exists",
+      message: `${import_picocolors33.default.bold(path83.basename(existing))} already exists here. Edit it, or pass ${import_picocolors33.default.cyan("--force")} to overwrite it.`
+    });
+  }
+  const harness = await resolveScaffoldHarness(cwd2, args.harness);
+  if (!isKnownHarness(harness.id)) {
+    return refuse(json, {
+      path: target,
+      created: false,
+      reason: "unknown-harness",
+      message: `Unknown harness ${import_picocolors33.default.bold(harness.id)}. Pick one of: ${knownHarnessIds().join(", ")}.`
+    });
+  }
+  const name = resolveScaffoldName(cwd2, args.name);
+  const template2 = args.full ? "full" : "minimal";
+  if (!json)
+    banner("agent init — write a starter brainbase.agent.yaml");
+  try {
+    writeStarterManifest(cwd2, { name, harness: harness.id, tagline: args.tagline }, { full: args.full });
+  } catch (err) {
+    console.error(import_picocolors33.default.red(`Failed to write ${AGENT_MANIFEST_FILE}: ${err.message}`));
+    process.exitCode = 1;
+    return;
+  }
+  if (json) {
+    emit({
+      path: target,
+      created: true,
+      name,
+      harness: harness.id,
+      harness_source: harness.source,
+      template: template2
+    });
+    return;
+  }
+  f2.info(`harness ${import_picocolors33.default.bold(harness.id)} ${import_picocolors33.default.dim(`(${describeHarnessSource(harness.source)})`)}`);
+  f2.success(`Wrote ${import_picocolors33.default.bold(AGENT_MANIFEST_FILE)}${existing ? " (overwritten)" : ""}.`);
+  console.log();
+  console.log(tip(`Edit it, then run ${import_picocolors33.default.cyan("brainbase agent create")} ${import_picocolors33.default.dim("— creates the cloud agent and stamps its id back into the file.")}`));
+  console.log();
+}
+function refuse(json, outcome) {
+  const { message, ...result2 } = outcome;
+  process.exitCode = 1;
+  if (json) {
+    emit(result2);
+    return;
+  }
+  console.error(`
+  ${import_picocolors33.default.red(message)}
+`);
+}
+
+// src/cli/agent-list.ts
+var import_picocolors34 = __toESM(require_picocolors(), 1);
 async function runAgentList(args) {
   if (!args.json)
     banner("agent list — agents in this team");
@@ -66612,27 +66991,27 @@ async function runAgentList(args) {
 function formatAgentList(agents, labels) {
   const lines = [""];
   if (agents.length === 0) {
-    lines.push(`  ${import_picocolors33.default.dim(`No agents in ${labels.orgName} → ${labels.teamName} yet.`)}`, "", `  ${import_picocolors33.default.dim("create one with")} ${import_picocolors33.default.cyan("brainbase agent create")}`, "");
+    lines.push(`  ${import_picocolors34.default.dim(`No agents in ${labels.orgName} → ${labels.teamName} yet.`)}`, "", `  ${import_picocolors34.default.dim("create one with")} ${import_picocolors34.default.cyan("brainbase agent create")}`, "");
     return lines.join(`
 `);
   }
   for (const agent of agents) {
-    lines.push(`  ${import_picocolors33.default.bold(agent.name)}  ${import_picocolors33.default.dim(agent.slug)}`);
+    lines.push(`  ${import_picocolors34.default.bold(agent.name)}  ${import_picocolors34.default.dim(agent.slug)}`);
     if (agent.tagline)
-      lines.push(`    ${import_picocolors33.default.dim(agent.tagline)}`);
+      lines.push(`    ${import_picocolors34.default.dim(agent.tagline)}`);
     const meta = [agent.harness, agent.machine_kind, agent.default_model].filter((value) => !!value).join(" · ");
     if (meta)
-      lines.push(`    ${import_picocolors33.default.dim(meta)}`);
-    lines.push(`    ${import_picocolors33.default.dim(agent.id)}`);
+      lines.push(`    ${import_picocolors34.default.dim(meta)}`);
+    lines.push(`    ${import_picocolors34.default.dim(agent.id)}`);
     lines.push("");
   }
-  lines.push(`  ${import_picocolors33.default.dim("link this folder to one with")} ${import_picocolors33.default.cyan("brainbase link --agent <id>")}`, "");
+  lines.push(`  ${import_picocolors34.default.dim("link this folder to one with")} ${import_picocolors34.default.cyan("brainbase link --agent <id>")}`, "");
   return lines.join(`
 `);
 }
 
 // src/cli/agent-connections.ts
-var import_picocolors35 = __toESM(require_picocolors(), 1);
+var import_picocolors36 = __toESM(require_picocolors(), 1);
 
 // src/core/integrations.ts
 var IMPLEMENTED_INTEGRATIONS = ["slack", "meeting"];
@@ -66664,7 +67043,7 @@ function explain(state) {
 }
 
 // src/cli/agent-connect.ts
-var import_picocolors34 = __toESM(require_picocolors(), 1);
+var import_picocolors35 = __toESM(require_picocolors(), 1);
 
 // src/core/secret-input.ts
 import fs74 from "node:fs";
@@ -66915,9 +67294,9 @@ function report(result2, json) {
     console.log(JSON.stringify(result2, null, 2));
     return;
   }
-  const detail = result2.detail ? ` ${import_picocolors34.default.dim(`(${result2.detail})`)}` : "";
+  const detail = result2.detail ? ` ${import_picocolors35.default.dim(`(${result2.detail})`)}` : "";
   f2.success(`${result2.name} connected${detail}`);
-  f2.info(`Run ${import_picocolors34.default.cyan("brainbase agent pull")} to pick up the built-in ${result2.name} MCP server.`);
+  f2.info(`Run ${import_picocolors35.default.cyan("brainbase agent pull")} to pick up the built-in ${result2.name} MCP server.`);
 }
 
 // src/cli/agent-connections.ts
@@ -66933,7 +67312,7 @@ async function runAgentConnections(cwd2, args) {
       return;
     }
     f2.warn("This folder is not linked to any agent.");
-    f2.info(`Run ${import_picocolors35.default.cyan("brainbase link")} first.`);
+    f2.info(`Run ${import_picocolors36.default.cyan("brainbase link")} first.`);
     process.exitCode = 1;
     return;
   }
@@ -66955,22 +67334,22 @@ async function runAgentConnections(cwd2, args) {
 function formatConnections(connections) {
   const lines = [""];
   for (const integration of connections.integrations) {
-    lines.push(`  ${statusMark(integration)} ${import_picocolors35.default.bold(integration.name)}${describe(integration)}`);
+    lines.push(`  ${statusMark(integration)} ${import_picocolors36.default.bold(integration.name)}${describe(integration)}`);
     const hint = hintFor(integration);
     if (hint)
-      lines.push(`      ${import_picocolors35.default.dim(hint)}`);
+      lines.push(`      ${import_picocolors36.default.dim(hint)}`);
   }
   lines.push("");
   return lines.join(`
 `);
 }
 function statusMark(integration) {
-  return integration.connected ? import_picocolors35.default.green("✓") : import_picocolors35.default.dim("·");
+  return integration.connected ? import_picocolors36.default.green("✓") : import_picocolors36.default.dim("·");
 }
 function describe(integration) {
   if (!integration.connected)
-    return `  ${import_picocolors35.default.dim("not connected")}`;
-  return integration.detail ? `  ${import_picocolors35.default.dim(integration.detail)}` : `  ${import_picocolors35.default.dim("connected")}`;
+    return `  ${import_picocolors36.default.dim("not connected")}`;
+  return integration.detail ? `  ${import_picocolors36.default.dim(integration.detail)}` : `  ${import_picocolors36.default.dim("connected")}`;
 }
 function hintFor(integration) {
   const action = actionability(integration);
@@ -66981,7 +67360,7 @@ function hintFor(integration) {
 }
 
 // src/cli/agent-disconnect.ts
-var import_picocolors36 = __toESM(require_picocolors(), 1);
+var import_picocolors37 = __toESM(require_picocolors(), 1);
 async function runAgentDisconnect(cwd2, target, args) {
   const json = Boolean(args.json);
   try {
@@ -67018,7 +67397,7 @@ async function disconnect(cwd2, target, args, json) {
     return;
   }
   f2.success(`${target} disconnected`);
-  f2.info(`Run ${import_picocolors36.default.cyan("brainbase agent pull")} to drop the built-in ${target} MCP server locally.`);
+  f2.info(`Run ${import_picocolors37.default.cyan("brainbase agent pull")} to drop the built-in ${target} MCP server locally.`);
 }
 
 // src/cli/agent.ts
@@ -67028,6 +67407,17 @@ async function runAgent(cwd2, sub, args, opts) {
     return;
   }
   switch (sub) {
+    case "init":
+      await runAgentInit(cwd2, {
+        name: opts.name,
+        tagline: opts.tagline,
+        harness: opts.harness,
+        minimal: opts.minimal,
+        full: opts.full,
+        force: opts.force,
+        json: opts.json
+      });
+      return;
     case "create":
       await runAgentCreate(cwd2, {
         yes: opts.yes,
@@ -67107,31 +67497,32 @@ async function runAgent(cwd2, sub, args, opts) {
 function printHelp() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors37.default.bold("brainbase agent")} ${import_picocolors37.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors38.default.bold("brainbase agent")} ${import_picocolors38.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors37.default.cyan("list")}               ${import_picocolors37.default.dim("show the agents in a team, with the ids `brainbase link` takes (--json for scripts)")}`);
-  out.push(`  ${import_picocolors37.default.cyan("create")}             ${import_picocolors37.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors37.default.cyan("pull")} ${import_picocolors37.default.dim("[<id>]")}      ${import_picocolors37.default.dim("apply cloud changes into this folder — pass <id> to switch (--force to override); --run-entrypoint to also execute the agent entrypoint")}`);
-  out.push(`  ${import_picocolors37.default.cyan("push")}               ${import_picocolors37.default.dim("send local changes to the cloud — instructions, playbooks, skills, MCPs, entrypoint (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors37.default.cyan("unpack")}             ${import_picocolors37.default.dim("install the claimed agent into a harness layout (--harness to override)")}`);
-  out.push(`  ${import_picocolors37.default.cyan("status")}             ${import_picocolors37.default.dim("show what would push, what would pull, and which manifest blocks are ignored (--json for scripts)")}`);
-  out.push(`  ${import_picocolors37.default.cyan("connections")}        ${import_picocolors37.default.dim("show which integrations this agent is wired to (--json for scripts)")}`);
-  out.push(`  ${import_picocolors37.default.cyan("connect")} ${import_picocolors37.default.dim("<name>")}     ${import_picocolors37.default.dim("connect slack or meeting — credentials come from flags, env, or stdin")}`);
-  out.push(`  ${import_picocolors37.default.cyan("disconnect")} ${import_picocolors37.default.dim("<name>")}  ${import_picocolors37.default.dim("revoke a slack or meeting install")}`);
-  out.push(`  ${import_picocolors37.default.cyan("env")}                ${import_picocolors37.default.dim('print export statements — use with `eval "$(brainbase agent env)"`')}`);
+  out.push(`  ${import_picocolors38.default.cyan("list")}               ${import_picocolors38.default.dim("show the agents in a team, with the ids `brainbase link` takes (--json for scripts)")}`);
+  out.push(`  ${import_picocolors38.default.cyan("init")}               ${import_picocolors38.default.dim("write a starter brainbase.agent.yaml here — offline, no login (--full for a commented template, --force to overwrite)")}`);
+  out.push(`  ${import_picocolors38.default.cyan("create")}             ${import_picocolors38.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent (scaffolds one if the folder has none)")}`);
+  out.push(`  ${import_picocolors38.default.cyan("pull")} ${import_picocolors38.default.dim("[<id>]")}      ${import_picocolors38.default.dim("apply cloud changes into this folder — pass <id> to switch (--force to override); --run-entrypoint to also execute the agent entrypoint")}`);
+  out.push(`  ${import_picocolors38.default.cyan("push")}               ${import_picocolors38.default.dim("send local changes to the cloud — instructions, playbooks, skills, MCPs, entrypoint (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors38.default.cyan("unpack")}             ${import_picocolors38.default.dim("install the claimed agent into a harness layout (--harness to override)")}`);
+  out.push(`  ${import_picocolors38.default.cyan("status")}             ${import_picocolors38.default.dim("show what would push, what would pull, and which manifest blocks are ignored (--json for scripts)")}`);
+  out.push(`  ${import_picocolors38.default.cyan("connections")}        ${import_picocolors38.default.dim("show which integrations this agent is wired to (--json for scripts)")}`);
+  out.push(`  ${import_picocolors38.default.cyan("connect")} ${import_picocolors38.default.dim("<name>")}     ${import_picocolors38.default.dim("connect slack or meeting — credentials come from flags, env, or stdin")}`);
+  out.push(`  ${import_picocolors38.default.cyan("disconnect")} ${import_picocolors38.default.dim("<name>")}  ${import_picocolors38.default.dim("revoke a slack or meeting install")}`);
+  out.push(`  ${import_picocolors38.default.cyan("env")}                ${import_picocolors38.default.dim('print export statements — use with `eval "$(brainbase agent env)"`')}`);
   out.push("");
-  out.push(`  ${import_picocolors37.default.dim("Slack credentials:")} ${import_picocolors37.default.dim("--bot-token / BRAINBASE_SLACK_BOT_TOKEN, --signing-secret / BRAINBASE_SLACK_SIGNING_SECRET,")}`);
-  out.push(`  ${import_picocolors37.default.dim('or pipe {"bot_token":"…","signing_secret":"…"} on stdin to keep them out of argv.')}`);
+  out.push(`  ${import_picocolors38.default.dim("Slack credentials:")} ${import_picocolors38.default.dim("--bot-token / BRAINBASE_SLACK_BOT_TOKEN, --signing-secret / BRAINBASE_SLACK_SIGNING_SECRET,")}`);
+  out.push(`  ${import_picocolors38.default.dim('or pipe {"bot_token":"…","signing_secret":"…"} on stdin to keep them out of argv.')}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/team.ts
-var import_picocolors39 = __toESM(require_picocolors(), 1);
+var import_picocolors40 = __toESM(require_picocolors(), 1);
 
 // src/cli/team-list.ts
-var import_picocolors38 = __toESM(require_picocolors(), 1);
+var import_picocolors39 = __toESM(require_picocolors(), 1);
 async function runTeamList(args) {
   if (!args.json)
     banner("team list — teams you can put agents in");
@@ -67151,25 +67542,25 @@ async function runTeamList(args) {
 function formatTeamList(grouped) {
   const lines = [""];
   if (grouped.length === 0) {
-    lines.push(`  ${import_picocolors38.default.dim("You are not a member of any organization.")}`, "");
+    lines.push(`  ${import_picocolors39.default.dim("You are not a member of any organization.")}`, "");
     return lines.join(`
 `);
   }
   const nameWidth = Math.max(...grouped.flatMap(({ teams }) => teams.map((t) => t.name.length)), 0);
   for (const { org, teams, error } of grouped) {
-    const slug = org.slug ? `  ${import_picocolors38.default.dim(org.slug)}` : "";
-    lines.push(`  ${import_picocolors38.default.bold(org.name)}${slug}`);
+    const slug = org.slug ? `  ${import_picocolors39.default.dim(org.slug)}` : "";
+    lines.push(`  ${import_picocolors39.default.bold(org.name)}${slug}`);
     if (error) {
-      lines.push(`    ${import_picocolors38.default.red(`could not load teams: ${error}`)}`);
+      lines.push(`    ${import_picocolors39.default.red(`could not load teams: ${error}`)}`);
     } else if (teams.length === 0) {
-      lines.push(`    ${import_picocolors38.default.dim("no teams yet — create one in the web app")}`);
+      lines.push(`    ${import_picocolors39.default.dim("no teams yet — create one in the web app")}`);
     }
     for (const team of teams) {
-      lines.push(`    ${team.name.padEnd(nameWidth)}  ${import_picocolors38.default.dim(team.id)}`);
+      lines.push(`    ${team.name.padEnd(nameWidth)}  ${import_picocolors39.default.dim(team.id)}`);
     }
     lines.push("");
   }
-  lines.push(`  ${import_picocolors38.default.dim("list a team’s agents with")} ${import_picocolors38.default.cyan("brainbase agent list --team <id>")}`, "");
+  lines.push(`  ${import_picocolors39.default.dim("list a team’s agents with")} ${import_picocolors39.default.cyan("brainbase agent list --team <id>")}`, "");
   return lines.join(`
 `);
 }
@@ -67200,29 +67591,29 @@ async function runTeam(sub, args, opts) {
 function printHelp2() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors39.default.bold("brainbase team")} ${import_picocolors39.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors40.default.bold("brainbase team")} ${import_picocolors40.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors39.default.cyan("list")}   ${import_picocolors39.default.dim("show the teams you can create agents in, grouped by organization")}`);
+  out.push(`  ${import_picocolors40.default.cyan("list")}   ${import_picocolors40.default.dim("show the teams you can create agents in, grouped by organization")}`);
   out.push("");
-  out.push(`  ${import_picocolors39.default.dim("--org <id-or-slug>")}  ${import_picocolors39.default.dim("limit to one organization")}`);
-  out.push(`  ${import_picocolors39.default.dim("--json")}              ${import_picocolors39.default.dim("machine-readable output")}`);
+  out.push(`  ${import_picocolors40.default.dim("--org <id-or-slug>")}  ${import_picocolors40.default.dim("limit to one organization")}`);
+  out.push(`  ${import_picocolors40.default.dim("--json")}              ${import_picocolors40.default.dim("machine-readable output")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/orchestration.ts
-var import_picocolors46 = __toESM(require_picocolors(), 1);
+var import_picocolors47 = __toESM(require_picocolors(), 1);
 
 // src/cli/orchestration-pull.ts
-import path86 from "node:path";
+import path87 from "node:path";
 import fs78 from "node:fs";
-var import_picocolors40 = __toESM(require_picocolors(), 1);
+var import_picocolors41 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-manifest.ts
-import path83 from "node:path";
+import path84 from "node:path";
 import fs75 from "node:fs";
-var import_yaml4 = __toESM(require_dist(), 1);
+var import_yaml5 = __toESM(require_dist(), 1);
 var ORCH_MANIFEST_FILE = "brainbase-orchestration.yaml";
 var ORCH_MEMBERS_DIR = "agents";
 var OrchMetaSchema = exports_external.object({
@@ -67274,7 +67665,7 @@ var OrchestrationManifestSchema = exports_external.object({
   triggers: exports_external.array(TriggerSchema).optional()
 });
 function orchManifestPath(cwd2) {
-  return path83.join(cwd2, ORCH_MANIFEST_FILE);
+  return path84.join(cwd2, ORCH_MANIFEST_FILE);
 }
 function hasOrchManifest(cwd2) {
   return fs75.existsSync(orchManifestPath(cwd2));
@@ -67286,7 +67677,7 @@ function readOrchManifest(cwd2) {
   const raw = fs75.readFileSync(p2, "utf8");
   let parsed;
   try {
-    parsed = import_yaml4.default.parse(raw);
+    parsed = import_yaml5.default.parse(raw);
   } catch (err) {
     throw new Error(`${ORCH_MANIFEST_FILE} is not valid YAML: ${err.message}`);
   }
@@ -67297,7 +67688,7 @@ function readOrchManifest(cwd2) {
   return result2.data;
 }
 function writeOrchManifest(cwd2, manifest) {
-  const doc = new import_yaml4.default.Document;
+  const doc = new import_yaml5.default.Document;
   doc.contents = manifest;
   doc.commentBefore = ` brainbase-orchestration.yaml — declarative orchestration manifest.
 ` + ` Committed to source control. Edit by hand, then
@@ -67307,7 +67698,7 @@ function writeOrchManifest(cwd2, manifest) {
   fs75.writeFileSync(orchManifestPath(cwd2), String(doc), "utf8");
 }
 function memberDir(cwd2, slug) {
-  return path83.join(cwd2, ORCH_MEMBERS_DIR, slug);
+  return path84.join(cwd2, ORCH_MEMBERS_DIR, slug);
 }
 var MEMBER_SLUG_MAX = 50;
 function slugifyRaw(raw) {
@@ -67341,7 +67732,7 @@ function resolveMemberSlugs(members) {
 }
 
 // src/core/orchestration-link.ts
-import path84 from "node:path";
+import path85 from "node:path";
 import fs76 from "node:fs";
 var ORCH_LINK_FILE = "orchestration-link.json";
 var ORCH_SYNC_STATE_FILE = "orchestration-sync-state.json";
@@ -67376,10 +67767,10 @@ var OrchestrationSyncStateSchema = exports_external.object({
   edges: exports_external.array(SyncedEdgeSchema)
 });
 function orchLinkPath(cwd2) {
-  return path84.join(cwd2, LINK_DIR, ORCH_LINK_FILE);
+  return path85.join(cwd2, LINK_DIR, ORCH_LINK_FILE);
 }
 function orchSyncStatePath(cwd2) {
-  return path84.join(cwd2, LINK_DIR, ORCH_SYNC_STATE_FILE);
+  return path85.join(cwd2, LINK_DIR, ORCH_SYNC_STATE_FILE);
 }
 function readOrchLink(cwd2) {
   const p2 = orchLinkPath(cwd2);
@@ -67392,7 +67783,7 @@ function readOrchLink(cwd2) {
   }
 }
 function writeOrchLink(cwd2, link2) {
-  ensureDir(path84.join(cwd2, LINK_DIR));
+  ensureDir(path85.join(cwd2, LINK_DIR));
   const clean2 = {};
   for (const [k3, v3] of Object.entries(link2)) {
     if (v3 !== null && v3 !== undefined)
@@ -67412,12 +67803,12 @@ function readOrchSyncState(cwd2) {
   }
 }
 function writeOrchSyncState(cwd2, state) {
-  ensureDir(path84.join(cwd2, LINK_DIR));
+  ensureDir(path85.join(cwd2, LINK_DIR));
   writeJson(orchSyncStatePath(cwd2), state);
   ensureGitignore2(cwd2);
 }
 function ensureGitignore2(cwd2) {
-  const ignorePath = path84.join(cwd2, LINK_DIR, ".gitignore");
+  const ignorePath = path85.join(cwd2, LINK_DIR, ".gitignore");
   const desired = `${ORCH_SYNC_STATE_FILE}
 `;
   try {
@@ -67435,7 +67826,7 @@ function ensureGitignore2(cwd2) {
 }
 
 // src/core/agent-fresh-install.ts
-import path85 from "node:path";
+import path86 from "node:path";
 import fs77 from "node:fs";
 import os15 from "node:os";
 async function installAgentFresh(input) {
@@ -67458,7 +67849,7 @@ async function installAgentFresh(input) {
         type: c2.type,
         slug: c2.slug,
         scope,
-        rootDir: path85.join(stageRoot, c2.type, c2.slug),
+        rootDir: path86.join(stageRoot, c2.type, c2.slug),
         description: c2.description,
         meta: c2.meta,
         payload: proxifyMcpPayload(structuredClone(c2.meta?.mcp)),
@@ -67483,7 +67874,7 @@ async function installAgentFresh(input) {
     const claimedByOther = folderClaimedByOtherAgent(cwd2, agent.id);
     const localOnly = input.preserveManifest || claimedByOther ? {} : readLocalOnlyContentReporting(cwd2);
     if (claimedByOther) {
-      f2.warn(`${path85.basename(cwd2)} was linked to a different agent; its local-only blocks were left out of the rebuilt manifest.`);
+      f2.warn(`${path86.basename(cwd2)} was linked to a different agent; its local-only blocks were left out of the rebuilt manifest.`);
     }
     const manifest = input.preserveManifest ? null : buildManifestFromCloud(cloud, agent, localOnly);
     if (manifest)
@@ -67516,7 +67907,8 @@ async function installAgentFresh(input) {
         name: agent.name,
         tagline: agent.tagline,
         ...agent.machine_kind ? { machine_kind: agent.machine_kind } : {},
-        ...Object.prototype.hasOwnProperty.call(agent, "default_model") ? { default_model: agent.default_model ?? null } : {}
+        ...Object.prototype.hasOwnProperty.call(agent, "default_model") ? { default_model: agent.default_model ?? null } : {},
+        ...capabilityBaseline(agent, undefined)
       }
     });
     const returnedManifest = manifest ?? buildManifestFromCloud(cloud, agent, localOnly);
@@ -67532,13 +67924,13 @@ async function installAgentFresh(input) {
   }
 }
 function stageManifestComponents2(components) {
-  const root = fs77.mkdtempSync(path85.join(os15.tmpdir(), "brainbase-orch-pull-"));
+  const root = fs77.mkdtempSync(path86.join(os15.tmpdir(), "brainbase-orch-pull-"));
   for (const c2 of components) {
-    const compDir = path85.join(root, c2.type, c2.slug);
+    const compDir = path86.join(root, c2.type, c2.slug);
     ensureDir(compDir);
     for (const f4 of c2.files) {
-      const target = path85.join(compDir, f4.path);
-      ensureDir(path85.dirname(target));
+      const target = path86.join(compDir, f4.path);
+      ensureDir(path86.dirname(target));
       fs77.writeFileSync(target, f4.content);
     }
   }
@@ -67572,8 +67964,8 @@ function materializeInstructions2(cwd2, cloud) {
     const body = c2.files[0]?.content ?? "";
     if (!body.trim())
       continue;
-    const target = path85.join(cwd2, DEFAULT_INSTRUCTIONS_FILE);
-    ensureDir(path85.dirname(target));
+    const target = path86.join(cwd2, DEFAULT_INSTRUCTIONS_FILE);
+    ensureDir(path86.dirname(target));
     fs77.writeFileSync(target, normalizeInstructionBody(body), "utf8");
     return;
   }
@@ -67586,8 +67978,8 @@ function materializePlaybooks2(cwd2, cloud) {
     if (!raw.trim())
       continue;
     const { body } = stripPlaybookFrontmatter(raw);
-    const target = path85.join(cwd2, DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`);
-    ensureDir(path85.dirname(target));
+    const target = path86.join(cwd2, DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`);
+    ensureDir(path86.dirname(target));
     fs77.writeFileSync(target, body, "utf8");
   }
 }
@@ -67630,7 +68022,7 @@ function buildManifestFromCloud(cloud, agent, localOnly = {}) {
       title,
       ...description ? { description } : {},
       ...typeof pbMeta.icon === "string" && pbMeta.icon ? { icon: pbMeta.icon } : {},
-      content: { file: path85.join(DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`) }
+      content: { file: path86.join(DEFAULT_PLAYBOOKS_DIR, `${c2.slug}.md`) }
     };
   });
   const caps = capabilitiesFromAgent(agent);
@@ -67737,8 +68129,8 @@ async function runOrchestrationPull(cwd2, args) {
     orchId = args.orchestrationId;
   } else {
     f2.warn("This folder is not linked to any orchestration.");
-    f2.info(`Run ${import_picocolors40.default.cyan("brainbase orchestration pull <id>")} with an orchestration id,
-  or ${import_picocolors40.default.cyan("brainbase orchestration list")} to find one.`);
+    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull <id>")} with an orchestration id,
+  or ${import_picocolors41.default.cyan("brainbase orchestration list")} to find one.`);
     return;
   }
   const sp = de();
@@ -67757,24 +68149,24 @@ async function runOrchestrationPull(cwd2, args) {
   const slugFor = (agentId) => slugByAgent.get(agentId) ?? agentId;
   const planLines = [];
   planLines.push("");
-  planLines.push(`  ${import_picocolors40.default.bold(cloud.name)} ${import_picocolors40.default.dim(`(${cloud.id})`)}`);
+  planLines.push(`  ${import_picocolors41.default.bold(cloud.name)} ${import_picocolors41.default.dim(`(${cloud.id})`)}`);
   if (cloud.description)
-    planLines.push(`  ${import_picocolors40.default.dim(cloud.description)}`);
+    planLines.push(`  ${import_picocolors41.default.dim(cloud.description)}`);
   planLines.push("");
-  planLines.push(`  ${import_picocolors40.default.dim("members:")}`);
+  planLines.push(`  ${import_picocolors41.default.dim("members:")}`);
   for (const m3 of cloud.members) {
     const skipped = !m3.manifest;
-    const tail2 = skipped ? import_picocolors40.default.red(" (manifest unavailable — skipped)") : "";
-    planLines.push(`    ${import_picocolors40.default.cyan("•")} ${import_picocolors40.default.bold(slugFor(m3.agent_id))} ${import_picocolors40.default.dim(`(${m3.name})`)}${tail2}`);
+    const tail2 = skipped ? import_picocolors41.default.red(" (manifest unavailable — skipped)") : "";
+    planLines.push(`    ${import_picocolors41.default.cyan("•")} ${import_picocolors41.default.bold(slugFor(m3.agent_id))} ${import_picocolors41.default.dim(`(${m3.name})`)}${tail2}`);
   }
   if (cloud.edges.length) {
     planLines.push("");
-    planLines.push(`  ${import_picocolors40.default.dim("edges:")}`);
+    planLines.push(`  ${import_picocolors41.default.dim("edges:")}`);
     for (const e2 of cloud.edges) {
       const from = slugFor(e2.from_agent_id);
       const to2 = slugFor(e2.to_agent_id);
-      const desc = e2.description ? `  ${import_picocolors40.default.dim("— " + e2.description)}` : "";
-      planLines.push(`    ${import_picocolors40.default.cyan(from)} ${import_picocolors40.default.dim("→")} ${import_picocolors40.default.cyan(to2)}${desc}`);
+      const desc = e2.description ? `  ${import_picocolors41.default.dim("— " + e2.description)}` : "";
+      planLines.push(`    ${import_picocolors41.default.cyan(from)} ${import_picocolors41.default.dim("→")} ${import_picocolors41.default.cyan(to2)}${desc}`);
     }
   }
   planLines.push("");
@@ -67783,7 +68175,7 @@ async function runOrchestrationPull(cwd2, args) {
   const isRefresh = !!existingLink;
   if (!autoProceed(args.yes) && !isRefresh) {
     const ok = await se({
-      message: `Pull into ${import_picocolors40.default.bold(cwd2)}?`,
+      message: `Pull into ${import_picocolors41.default.bold(cwd2)}?`,
       initialValue: true
     });
     if (!ensureNotCancelled(ok)) {
@@ -67827,7 +68219,7 @@ async function runOrchestrationPull(cwd2, args) {
         scope: "project",
         pullSecrets: true
       });
-      memberSp.stop(`Installed ${import_picocolors40.default.bold(slug)} ${import_picocolors40.default.dim(`(${m3.manifest.components.length} components)`)}.`);
+      memberSp.stop(`Installed ${import_picocolors41.default.bold(slug)} ${import_picocolors41.default.dim(`(${m3.manifest.components.length} components)`)}.`);
       installedMembers.push({
         agent_id: m3.agent_id,
         slug,
@@ -67888,7 +68280,7 @@ async function runOrchestrationPull(cwd2, args) {
       payload_schema: e2.payload_schema ?? {}
     }))
   });
-  $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path86.basename(cwd2)}/ ${import_picocolors40.default.dim(`(${installedMembers.length}/${cloud.members.length} members)`)}.`);
+  $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path87.basename(cwd2)}/ ${import_picocolors41.default.dim(`(${installedMembers.length}/${cloud.members.length} members)`)}.`);
 }
 function handleApiError5(err) {
   if (err instanceof ApiError) {
@@ -67905,7 +68297,7 @@ function handleApiError5(err) {
 }
 
 // src/cli/orchestration-push.ts
-var import_picocolors41 = __toESM(require_picocolors(), 1);
+var import_picocolors42 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-outgoing.ts
 function buildOrchestrationGraphPayload(manifest, slugToAgentId) {
@@ -67988,7 +68380,7 @@ function findUnpushableMembers(cwd2, members) {
       continue;
     }
     if (!memberManifest.id) {
-      f2.error(`${m3.slug}: ${AGENT_MANIFEST_FILE} is unclaimed (no ${import_picocolors41.default.cyan("id")}), so there is nothing to push to.`);
+      f2.error(`${m3.slug}: ${AGENT_MANIFEST_FILE} is unclaimed (no ${import_picocolors42.default.cyan("id")}), so there is nothing to push to.`);
       blocked.push(m3.slug);
       continue;
     }
@@ -68003,12 +68395,12 @@ async function runOrchestrationPush(cwd2, args) {
   const link2 = readOrchLink(cwd2);
   if (!link2) {
     f2.warn("This folder is not linked to any orchestration.");
-    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull <id>")} first.`);
+    f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   if (!hasOrchManifest(cwd2)) {
-    f2.warn(`No ${import_picocolors41.default.bold(ORCH_MANIFEST_FILE)} here.`);
-    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull")} to materialise the manifest before pushing.`);
+    f2.warn(`No ${import_picocolors42.default.bold(ORCH_MANIFEST_FILE)} here.`);
+    f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration pull")} to materialise the manifest before pushing.`);
     return;
   }
   let manifest;
@@ -68032,7 +68424,7 @@ async function runOrchestrationPush(cwd2, args) {
   }
   if (missing.length) {
     f2.error(`Missing local checkouts for: ${missing.join(", ")}.`);
-    f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull")} to materialise the missing folders.`);
+    f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration pull")} to materialise the missing folders.`);
     process.exitCode = 1;
     return;
   }
@@ -68053,13 +68445,13 @@ async function runOrchestrationPush(cwd2, args) {
     }
   }
   const plan = [""];
-  plan.push(`  ${import_picocolors41.default.bold(link2.name)} ${import_picocolors41.default.dim(`(${link2.orchestration_id})`)}`);
-  plan.push(`  ${import_picocolors41.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
+  plan.push(`  ${import_picocolors42.default.bold(link2.name)} ${import_picocolors42.default.dim(`(${link2.orchestration_id})`)}`);
+  plan.push(`  ${import_picocolors42.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
   plan.push("");
   if (!args.graphOnly) {
-    plan.push(`  ${import_picocolors41.default.dim("per-member agent push:")}`);
+    plan.push(`  ${import_picocolors42.default.dim("per-member agent push:")}`);
     for (const m3 of manifest.members) {
-      plan.push(`    ${import_picocolors41.default.cyan("•")} ${import_picocolors41.default.bold(m3.slug)}`);
+      plan.push(`    ${import_picocolors42.default.cyan("•")} ${import_picocolors42.default.bold(m3.slug)}`);
     }
     plan.push("");
   }
@@ -68079,7 +68471,7 @@ async function runOrchestrationPush(cwd2, args) {
     for (const m3 of manifest.members) {
       const dir = memberDir(cwd2, m3.slug);
       console.log("");
-      console.log(`${import_picocolors41.default.dim("───")} ${import_picocolors41.default.bold(m3.slug)} ${import_picocolors41.default.dim("───")}`);
+      console.log(`${import_picocolors42.default.dim("───")} ${import_picocolors42.default.bold(m3.slug)} ${import_picocolors42.default.dim("───")}`);
       const exitCodeBeforePush = process.exitCode;
       try {
         await runAgentPush(dir, { yes: true });
@@ -68143,7 +68535,7 @@ function handleApiError6(err) {
       f2.error("You do not have access to this orchestration.");
     } else if (err.status === 409) {
       f2.error(err.message);
-      f2.info(`Run ${import_picocolors41.default.cyan("brainbase orchestration pull")} to reconcile, then push again.`);
+      f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration pull")} to reconcile, then push again.`);
     } else {
       f2.error(err.message);
     }
@@ -68153,13 +68545,13 @@ function handleApiError6(err) {
 }
 
 // src/cli/orchestration-status.ts
-var import_picocolors42 = __toESM(require_picocolors(), 1);
+var import_picocolors43 = __toESM(require_picocolors(), 1);
 async function runOrchestrationStatus(cwd2) {
   banner("orchestration status — what changed locally, remotely, both");
   const link2 = readOrchLink(cwd2);
   if (!link2) {
     f2.warn("This folder is not linked to any orchestration.");
-    f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration pull <id>")} first.`);
+    f2.info(`Run ${import_picocolors43.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   const localManifest = hasOrchManifest(cwd2) ? readOrchManifest(cwd2) : null;
@@ -68182,8 +68574,8 @@ async function runOrchestrationStatus(cwd2) {
   }
   const lines = [];
   lines.push("");
-  lines.push(`  ${import_picocolors42.default.bold(link2.name)} ${import_picocolors42.default.dim(`(${link2.orchestration_id})`)}`);
-  lines.push(`  ${import_picocolors42.default.dim("revision")}  cloud ${cloud.revision}${lock ? ` · lock ${lock.revision}` : " · never pulled"}`);
+  lines.push(`  ${import_picocolors43.default.bold(link2.name)} ${import_picocolors43.default.dim(`(${link2.orchestration_id})`)}`);
+  lines.push(`  ${import_picocolors43.default.dim("revision")}  cloud ${cloud.revision}${lock ? ` · lock ${lock.revision}` : " · never pulled"}`);
   lines.push("");
   const localSlugByAgentId = new Map;
   for (const m3 of localManifest?.members ?? []) {
@@ -68197,12 +68589,12 @@ async function runOrchestrationStatus(cwd2) {
   const membersAdded = [...localMemberSet].filter((s3) => !cloudMemberSet.has(s3));
   const membersRemoved = [...cloudMemberSet].filter((s3) => !localMemberSet.has(s3));
   if (membersAdded.length || membersRemoved.length) {
-    lines.push(`  ${import_picocolors42.default.bold("members")}`);
+    lines.push(`  ${import_picocolors43.default.bold("members")}`);
     for (const slug of membersAdded) {
-      lines.push(`    ${import_picocolors42.default.yellow("→ push")}  added in yaml: ${import_picocolors42.default.bold(slug)}`);
+      lines.push(`    ${import_picocolors43.default.yellow("→ push")}  added in yaml: ${import_picocolors43.default.bold(slug)}`);
     }
     for (const slug of membersRemoved) {
-      lines.push(`    ${import_picocolors42.default.cyan("← pull")}  added on cloud: ${import_picocolors42.default.bold(slug)}`);
+      lines.push(`    ${import_picocolors43.default.cyan("← pull")}  added on cloud: ${import_picocolors43.default.bold(slug)}`);
     }
     lines.push("");
   }
@@ -68217,11 +68609,11 @@ async function runOrchestrationStatus(cwd2) {
   const edgesAdded = [...localEdges.keys()].filter((k3) => !cloudEdges.has(k3));
   const edgesRemoved = [...cloudEdges.keys()].filter((k3) => !localEdges.has(k3));
   if (edgesAdded.length || edgesRemoved.length) {
-    lines.push(`  ${import_picocolors42.default.bold("edges")}`);
+    lines.push(`  ${import_picocolors43.default.bold("edges")}`);
     for (const k3 of edgesAdded)
-      lines.push(`    ${import_picocolors42.default.yellow("→ push")}  added in yaml: ${k3}`);
+      lines.push(`    ${import_picocolors43.default.yellow("→ push")}  added in yaml: ${k3}`);
     for (const k3 of edgesRemoved)
-      lines.push(`    ${import_picocolors42.default.cyan("← pull")}  added on cloud: ${k3}`);
+      lines.push(`    ${import_picocolors43.default.cyan("← pull")}  added on cloud: ${k3}`);
     lines.push("");
   }
   const cloudTriggerKey = (t) => {
@@ -68259,11 +68651,11 @@ async function runOrchestrationStatus(cwd2) {
   const triggersAdded = [...localTriggers.keys()].filter((k3) => !cloudTriggers.has(k3));
   const triggersRemoved = [...cloudTriggers.keys()].filter((k3) => !localTriggers.has(k3));
   if (triggersAdded.length || triggersRemoved.length) {
-    lines.push(`  ${import_picocolors42.default.bold("schedule triggers")}`);
+    lines.push(`  ${import_picocolors43.default.bold("schedule triggers")}`);
     for (const k3 of triggersAdded)
-      lines.push(`    ${import_picocolors42.default.yellow("→ push")}  added/changed in yaml: ${localTriggers.get(k3) ?? k3}`);
+      lines.push(`    ${import_picocolors43.default.yellow("→ push")}  added/changed in yaml: ${localTriggers.get(k3) ?? k3}`);
     for (const k3 of triggersRemoved)
-      lines.push(`    ${import_picocolors42.default.cyan("← pull")}  added/changed on cloud: ${cloudTriggers.get(k3) ?? k3}`);
+      lines.push(`    ${import_picocolors43.default.cyan("← pull")}  added/changed on cloud: ${cloudTriggers.get(k3) ?? k3}`);
     lines.push("");
   }
   const lockByAgentId = new Map((lock?.members ?? []).map((m3) => [m3.agent_id, m3]));
@@ -68286,27 +68678,27 @@ async function runOrchestrationStatus(cwd2) {
     }
   }
   if (memberDrift.length) {
-    lines.push(`  ${import_picocolors42.default.bold("member content drift")}`);
+    lines.push(`  ${import_picocolors43.default.bold("member content drift")}`);
     for (const d3 of memberDrift) {
-      lines.push(`    ${import_picocolors42.default.cyan("?")} ${import_picocolors42.default.bold(d3.slug)}  ${import_picocolors42.default.dim("— " + d3.reason)}`);
+      lines.push(`    ${import_picocolors43.default.cyan("?")} ${import_picocolors43.default.bold(d3.slug)}  ${import_picocolors43.default.dim("— " + d3.reason)}`);
     }
-    lines.push(`    ${import_picocolors42.default.dim("cd into each member folder and run")} ${import_picocolors42.default.cyan("brainbase agent status")}`);
+    lines.push(`    ${import_picocolors43.default.dim("cd into each member folder and run")} ${import_picocolors43.default.cyan("brainbase agent status")}`);
     lines.push("");
   }
   const revisionDrift = lock?.revision != null && cloud.revision !== lock.revision;
   if (revisionDrift) {
-    lines.push(`  ${import_picocolors42.default.bold("cloud revision")}`);
-    lines.push(`    ${import_picocolors42.default.cyan("← pull")}  cloud changed since last pull: ${import_picocolors42.default.dim(`lock ${lock.revision} → cloud ${cloud.revision}`)}`);
+    lines.push(`  ${import_picocolors43.default.bold("cloud revision")}`);
+    lines.push(`    ${import_picocolors43.default.cyan("← pull")}  cloud changed since last pull: ${import_picocolors43.default.dim(`lock ${lock.revision} → cloud ${cloud.revision}`)}`);
     lines.push("");
   }
   if (!membersAdded.length && !membersRemoved.length && !edgesAdded.length && !edgesRemoved.length && !triggersAdded.length && !triggersRemoved.length && !memberDrift.length && !revisionDrift) {
-    lines.push(`  ${import_picocolors42.default.green("✓")} everything is in sync`);
+    lines.push(`  ${import_picocolors43.default.green("✓")} everything is in sync`);
     lines.push("");
     console.log(lines.join(`
 `));
     return;
   }
-  lines.push(`  ${import_picocolors42.default.dim("run")} ${import_picocolors42.default.cyan("brainbase orchestration pull")} ${import_picocolors42.default.dim("to apply cloud changes,")} ${import_picocolors42.default.cyan("brainbase orchestration push")} ${import_picocolors42.default.dim("to send yours")}`);
+  lines.push(`  ${import_picocolors43.default.dim("run")} ${import_picocolors43.default.cyan("brainbase orchestration pull")} ${import_picocolors43.default.dim("to apply cloud changes,")} ${import_picocolors43.default.cyan("brainbase orchestration push")} ${import_picocolors43.default.dim("to send yours")}`);
   lines.push("");
   console.log(lines.join(`
 `));
@@ -68321,7 +68713,7 @@ function stableJson(value) {
 }
 
 // src/cli/orchestration-list.ts
-var import_picocolors43 = __toESM(require_picocolors(), 1);
+var import_picocolors44 = __toESM(require_picocolors(), 1);
 async function runOrchestrationList(args) {
   banner("orchestration list — orchestrations under a team");
   const { org, team } = await resolveOrgAndTeam({
@@ -68345,13 +68737,13 @@ async function runOrchestrationList(args) {
   }
   const lines = [""];
   for (const o2 of items) {
-    lines.push(`  ${import_picocolors43.default.bold(o2.name)}  ${import_picocolors43.default.dim(o2.id)}`);
+    lines.push(`  ${import_picocolors44.default.bold(o2.name)}  ${import_picocolors44.default.dim(o2.id)}`);
     if (o2.description)
-      lines.push(`    ${import_picocolors43.default.dim(o2.description)}`);
-    lines.push(`    ${import_picocolors43.default.dim(`${o2.member_count} member${o2.member_count === 1 ? "" : "s"} · ${o2.edge_count} edge${o2.edge_count === 1 ? "" : "s"}`)}`);
+      lines.push(`    ${import_picocolors44.default.dim(o2.description)}`);
+    lines.push(`    ${import_picocolors44.default.dim(`${o2.member_count} member${o2.member_count === 1 ? "" : "s"} · ${o2.edge_count} edge${o2.edge_count === 1 ? "" : "s"}`)}`);
     lines.push("");
   }
-  lines.push(`  ${import_picocolors43.default.dim("pull one with")} ${import_picocolors43.default.cyan("brainbase orchestration pull <id>")}`);
+  lines.push(`  ${import_picocolors44.default.dim("pull one with")} ${import_picocolors44.default.cyan("brainbase orchestration pull <id>")}`);
   lines.push("");
   console.log(lines.join(`
 `));
@@ -68359,7 +68751,7 @@ async function runOrchestrationList(args) {
 
 // src/cli/orchestration-add-agent.ts
 import fs79 from "node:fs";
-var import_picocolors44 = __toESM(require_picocolors(), 1);
+var import_picocolors45 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-add.ts
 function resolveOrgIdForGroup(groupId, orgsWithTeams) {
@@ -68424,7 +68816,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   const link2 = readOrchLink(cwd2);
   if (!link2 || !hasOrchManifest(cwd2)) {
     f2.warn("This folder is not a linked orchestration.");
-    f2.info(`Run ${import_picocolors44.default.cyan("brainbase orchestration pull <id>")} first.`);
+    f2.info(`Run ${import_picocolors45.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   let manifest;
@@ -68450,7 +68842,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
     while (manifest.members.some((m3) => m3.slug === candidate) || fs79.existsSync(memberDir(cwd2, candidate))) {
       candidate = `${slug}-${++n}`;
     }
-    f2.info(`Slug ${import_picocolors44.default.bold(slug)} is taken — using ${import_picocolors44.default.bold(candidate)}.`);
+    f2.info(`Slug ${import_picocolors45.default.bold(slug)} is taken — using ${import_picocolors45.default.bold(candidate)}.`);
     slug = candidate;
   }
   let payloadSchema;
@@ -68474,7 +68866,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
       const resolved = resolveOrgIdForGroup(link2.group_id, orgsWithTeams);
       if (!resolved) {
         sp.stop("Failed.");
-        f2.error(`Could not find an org that owns group ${import_picocolors44.default.bold(link2.group_id)}. ` + `Pass ${import_picocolors44.default.cyan("--org <id>")} explicitly.`);
+        f2.error(`Could not find an org that owns group ${import_picocolors45.default.bold(link2.group_id)}. ` + `Pass ${import_picocolors45.default.cyan("--org <id>")} explicitly.`);
         return;
       }
       orgId = resolved;
@@ -68491,14 +68883,14 @@ async function runOrchestrationAddAgent(cwd2, args) {
   if (from.length === 0 && to2.length === 0 && isInteractive() && manifest.members.length > 0) {
     const memberOptions = manifest.members.map((m3) => ({ value: m3.slug, label: m3.slug }));
     const pickedFrom = await ae({
-      message: `Connect ${import_picocolors44.default.bold(slug)} FROM which member(s)? — edges INTO ${slug} (space to select, enter to skip)`,
+      message: `Connect ${import_picocolors45.default.bold(slug)} FROM which member(s)? — edges INTO ${slug} (space to select, enter to skip)`,
       options: memberOptions,
       required: false
     });
     if (Array.isArray(pickedFrom))
       from = pickedFrom;
     const pickedTo = await ae({
-      message: `Connect ${import_picocolors44.default.bold(slug)} TO which member(s)? — edges OUT of ${slug} (space to select, enter to skip)`,
+      message: `Connect ${import_picocolors45.default.bold(slug)} TO which member(s)? — edges OUT of ${slug} (space to select, enter to skip)`,
       options: memberOptions,
       required: false
     });
@@ -68537,23 +68929,23 @@ async function runOrchestrationAddAgent(cwd2, args) {
   }
   writeOrchManifest(cwd2, updated);
   if (args.noPush) {
-    f2.info(`Manifest updated. Run ${import_picocolors44.default.cyan("brainbase orchestration push")} to apply.`);
+    f2.info(`Manifest updated. Run ${import_picocolors45.default.cyan("brainbase orchestration push")} to apply.`);
     return;
   }
   await runOrchestrationPush(cwd2, { yes: true, graphOnly: true });
 }
 
 // src/cli/orchestration-create.ts
-var import_picocolors45 = __toESM(require_picocolors(), 1);
+var import_picocolors46 = __toESM(require_picocolors(), 1);
 async function runOrchestrationCreate(cwd2, args) {
   banner("orchestration create — claim a brainbase-orchestration.yaml");
   if (readOrchLink(cwd2)) {
     f2.warn("This folder is already linked to an orchestration.");
-    f2.info(`Run ${import_picocolors45.default.cyan("brainbase orchestration push")} to update it.`);
+    f2.info(`Run ${import_picocolors46.default.cyan("brainbase orchestration push")} to update it.`);
     return;
   }
   if (!hasOrchManifest(cwd2)) {
-    f2.warn(`No ${import_picocolors45.default.bold(ORCH_MANIFEST_FILE)} here.`);
+    f2.warn(`No ${import_picocolors46.default.bold(ORCH_MANIFEST_FILE)} here.`);
     f2.info(`Create one, or pull an existing orchestration first.`);
     return;
   }
@@ -68586,10 +68978,10 @@ async function runOrchestrationCreate(cwd2, args) {
   });
   const plan = [
     "",
-    `  ${import_picocolors45.default.bold(manifest.orchestration.name)}`,
-    `  ${import_picocolors45.default.dim("org")}      ${import_picocolors45.default.bold(target.org.name)}`,
-    `  ${import_picocolors45.default.dim("team")}     ${import_picocolors45.default.bold(target.team.name)}`,
-    `  ${import_picocolors45.default.dim("graph")}    ${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`,
+    `  ${import_picocolors46.default.bold(manifest.orchestration.name)}`,
+    `  ${import_picocolors46.default.dim("org")}      ${import_picocolors46.default.bold(target.org.name)}`,
+    `  ${import_picocolors46.default.dim("team")}     ${import_picocolors46.default.bold(target.team.name)}`,
+    `  ${import_picocolors46.default.dim("graph")}    ${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`,
     ""
   ];
   console.log(plan.join(`
@@ -68619,7 +69011,7 @@ async function runOrchestrationCreate(cwd2, args) {
       edges: graph.edges,
       triggers: graph.triggers
     });
-    sp.stop(`Created ${import_picocolors45.default.bold(created.name)}.`);
+    sp.stop(`Created ${import_picocolors46.default.bold(created.name)}.`);
     writeOrchLink(cwd2, {
       schemaVersion: 1,
       orchestration_id: created.id,
@@ -68732,21 +69124,21 @@ async function runOrchestration(cwd2, sub, args, opts) {
 function printHelp3() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors46.default.bold("brainbase orchestration")} ${import_picocolors46.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors47.default.bold("brainbase orchestration")} ${import_picocolors47.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors46.default.cyan("create")}           ${import_picocolors46.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
-  out.push(`  ${import_picocolors46.default.cyan("pull")} ${import_picocolors46.default.dim("<id>")}      ${import_picocolors46.default.dim("fetch orchestration + every member agent into this folder")}`);
-  out.push(`  ${import_picocolors46.default.cyan("push")}             ${import_picocolors46.default.dim("push each member, then update the orchestration graph")}`);
-  out.push(`  ${import_picocolors46.default.cyan("add-agent")} ${import_picocolors46.default.dim("<name>")}    ${import_picocolors46.default.dim("create a member agent, wire edges (--from/--to), and push")}`);
-  out.push(`  ${import_picocolors46.default.cyan("status")}           ${import_picocolors46.default.dim("show what would push and what would pull")}`);
-  out.push(`  ${import_picocolors46.default.cyan("list")}             ${import_picocolors46.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors47.default.cyan("create")}           ${import_picocolors47.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors47.default.cyan("pull")} ${import_picocolors47.default.dim("<id>")}      ${import_picocolors47.default.dim("fetch orchestration + every member agent into this folder")}`);
+  out.push(`  ${import_picocolors47.default.cyan("push")}             ${import_picocolors47.default.dim("push each member, then update the orchestration graph")}`);
+  out.push(`  ${import_picocolors47.default.cyan("add-agent")} ${import_picocolors47.default.dim("<name>")}    ${import_picocolors47.default.dim("create a member agent, wire edges (--from/--to), and push")}`);
+  out.push(`  ${import_picocolors47.default.cyan("status")}           ${import_picocolors47.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors47.default.cyan("list")}             ${import_picocolors47.default.dim("list orchestrations under a team")}`);
   out.push("");
-  out.push(`  ${import_picocolors46.default.bold("Flags")}`);
-  out.push(`    ${import_picocolors46.default.dim("--yes, -y")}        skip confirmations`);
-  out.push(`    ${import_picocolors46.default.dim("--harness <id>")}   harness for newly-created member folders (default claude-code)`);
-  out.push(`    ${import_picocolors46.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`);
-  out.push(`    ${import_picocolors46.default.dim("--org <id>")}       for create/list: org id or slug (CLI vocab — DB teams.id)`);
-  out.push(`    ${import_picocolors46.default.dim("--team <id>")}      for create/list: team id (CLI vocab — DB groups.id)`);
+  out.push(`  ${import_picocolors47.default.bold("Flags")}`);
+  out.push(`    ${import_picocolors47.default.dim("--yes, -y")}        skip confirmations`);
+  out.push(`    ${import_picocolors47.default.dim("--harness <id>")}   harness for newly-created member folders (default claude-code)`);
+  out.push(`    ${import_picocolors47.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`);
+  out.push(`    ${import_picocolors47.default.dim("--org <id>")}       for create/list: org id or slug (CLI vocab — DB teams.id)`);
+  out.push(`    ${import_picocolors47.default.dim("--team <id>")}      for create/list: team id (CLI vocab — DB groups.id)`);
   out.push("");
   console.log(out.join(`
 `));
@@ -68791,11 +69183,11 @@ async function runRun(cwd2, args) {
 }
 
 // src/cli/publish.ts
-var import_picocolors47 = __toESM(require_picocolors(), 1);
+var import_picocolors48 = __toESM(require_picocolors(), 1);
 function runPublish() {
   banner("publish — moved");
-  f2.error(`${import_picocolors47.default.bold("brainbase publish")} does not exist.`);
-  f2.info(`Use ${import_picocolors47.default.cyan("brainbase agent push")} to send your local changes to the cloud.`);
+  f2.error(`${import_picocolors48.default.bold("brainbase publish")} does not exist.`);
+  f2.info(`Use ${import_picocolors48.default.cyan("brainbase agent push")} to send your local changes to the cloud.`);
   process.exit(1);
 }
 
@@ -69094,7 +69486,7 @@ async function runStatus(cwd2) {
 }
 
 // src/cli/token.ts
-var import_picocolors48 = __toESM(require_picocolors(), 1);
+var import_picocolors49 = __toESM(require_picocolors(), 1);
 
 // src/ui/ink/TokenCards.tsx
 var jsx_dev_runtime17 = __toESM(require_jsx_dev_runtime(), 1);
@@ -69516,7 +69908,7 @@ async function runTokenRename(args) {
     }
   }
   if (name === target.name.trim()) {
-    console.log(`${sym.ok} ${import_picocolors48.default.bold(target.name.trim())} already has that label; nothing to do.`);
+    console.log(`${sym.ok} ${import_picocolors49.default.bold(target.name.trim())} already has that label; nothing to do.`);
     return;
   }
   try {
@@ -69524,7 +69916,7 @@ async function runTokenRename(args) {
   } catch (error) {
     throw withLoginHint(error);
   }
-  console.log(`${sym.ok} Renamed ${import_picocolors48.default.dim(target.name)} → ${import_picocolors48.default.bold(name)}`);
+  console.log(`${sym.ok} Renamed ${import_picocolors49.default.dim(target.name)} → ${import_picocolors49.default.bold(name)}`);
 }
 async function runTokenRevoke(args) {
   if (!args.id) {
@@ -69542,14 +69934,14 @@ async function runTokenRevoke(args) {
     throw new Error(`No token with id ${args.id}. Run \`brainbase token list\` to see yours.`);
   }
   if (target.revoked_at) {
-    reconcileDeadToken(target, `${import_picocolors48.default.bold(target.name)} is already revoked.`);
+    reconcileDeadToken(target, `${import_picocolors49.default.bold(target.name)} is already revoked.`);
     return;
   }
   const stored = readToken();
   const isLocalToken = Boolean(stored && stored.token.startsWith(target.prefix));
   if (!autoProceed(args.yes)) {
     const ok = await se({
-      message: isLocalToken ? `Revoke ${import_picocolors48.default.bold(target.name)} (${args.id})? This is the token this CLI is using, so it will stop working here too.` : `Revoke ${import_picocolors48.default.bold(target.name)} (${args.id})? CIs and machines using it will stop working.`,
+      message: isLocalToken ? `Revoke ${import_picocolors49.default.bold(target.name)} (${args.id})? This is the token this CLI is using, so it will stop working here too.` : `Revoke ${import_picocolors49.default.bold(target.name)} (${args.id})? CIs and machines using it will stop working.`,
       initialValue: false
     });
     if (!ensureNotCancelled(ok))
@@ -69560,14 +69952,14 @@ async function runTokenRevoke(args) {
   } catch (error) {
     if (error instanceof ApiError && error.status === 404) {
       if (isExpired2(target)) {
-        reconcileDeadToken(target, `${import_picocolors48.default.bold(target.name)} had already expired.`);
+        reconcileDeadToken(target, `${import_picocolors49.default.bold(target.name)} had already expired.`);
         return;
       }
       throw new Error(`The server reported no active token with id ${args.id}, but it listed one a moment ago. ` + "The local token has been left alone, since that key may still work. " + "If this server predates `DELETE /v1/registry/cli-tokens/{id}`, revoke from the web app instead.");
     }
     throw withLoginHint(error);
   }
-  reconcileDeadToken(target, `Revoked ${import_picocolors48.default.bold(target.name)}.`);
+  reconcileDeadToken(target, `Revoked ${import_picocolors49.default.bold(target.name)}.`);
 }
 function reconcileDeadToken(target, headline) {
   let outcome;
@@ -69601,7 +69993,7 @@ function reportLocalToken(headline, outcome) {
 }
 async function runTokenClear() {
   if (!readToken()) {
-    console.log(import_picocolors48.default.dim("No local token stored."));
+    console.log(import_picocolors49.default.dim("No local token stored."));
     return;
   }
   clearToken();
@@ -69701,31 +70093,31 @@ async function runToken(sub, rest2, args) {
 function printTokenHelp() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors48.default.bold("brainbase token")} ${import_picocolors48.default.dim("<command>")}`);
+  out.push(`  ${import_picocolors49.default.bold("brainbase token")} ${import_picocolors49.default.dim("<command>")}`);
   out.push("");
-  out.push(`  ${import_picocolors48.default.cyan("create")}                        ${import_picocolors48.default.dim("issue a new long-lived CLI key (PAT)")}`);
-  out.push(`  ${import_picocolors48.default.cyan("list")}                          ${import_picocolors48.default.dim("show your tokens")}`);
-  out.push(`  ${import_picocolors48.default.cyan("rename")} ${import_picocolors48.default.dim("<id>")}                  ${import_picocolors48.default.dim("relabel a token by id")}`);
-  out.push(`  ${import_picocolors48.default.cyan("revoke")} ${import_picocolors48.default.dim("<id>")}                  ${import_picocolors48.default.dim("revoke a token by id")}`);
-  out.push(`  ${import_picocolors48.default.cyan("clear")}                         ${import_picocolors48.default.dim("forget the local token (does not revoke)")}`);
+  out.push(`  ${import_picocolors49.default.cyan("create")}                        ${import_picocolors49.default.dim("issue a new long-lived CLI key (PAT)")}`);
+  out.push(`  ${import_picocolors49.default.cyan("list")}                          ${import_picocolors49.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors49.default.cyan("rename")} ${import_picocolors49.default.dim("<id>")}                  ${import_picocolors49.default.dim("relabel a token by id")}`);
+  out.push(`  ${import_picocolors49.default.cyan("revoke")} ${import_picocolors49.default.dim("<id>")}                  ${import_picocolors49.default.dim("revoke a token by id")}`);
+  out.push(`  ${import_picocolors49.default.cyan("clear")}                         ${import_picocolors49.default.dim("forget the local token (does not revoke)")}`);
   out.push("");
-  out.push(`  ${import_picocolors48.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors48.default.cyan("--name, -n")} ${import_picocolors48.default.dim("<label>")}        ${import_picocolors48.default.dim("token label (prompted if omitted)")}`);
-  out.push(`  ${import_picocolors48.default.cyan("--scopes")} ${import_picocolors48.default.dim("<list>")}           ${import_picocolors48.default.dim("comma-separated; allowed: read, publish, admin")}`);
-  out.push(`                                ${import_picocolors48.default.dim("default: read,publish")}`);
+  out.push(`  ${import_picocolors49.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors49.default.cyan("--name, -n")} ${import_picocolors49.default.dim("<label>")}        ${import_picocolors49.default.dim("token label (prompted if omitted)")}`);
+  out.push(`  ${import_picocolors49.default.cyan("--scopes")} ${import_picocolors49.default.dim("<list>")}           ${import_picocolors49.default.dim("comma-separated; allowed: read, publish, admin")}`);
+  out.push(`                                ${import_picocolors49.default.dim("default: read,publish")}`);
   out.push("");
-  out.push(`  ${import_picocolors48.default.bold("rename flags")}`);
-  out.push(`  ${import_picocolors48.default.cyan("--name, -n")} ${import_picocolors48.default.dim("<label>")}        ${import_picocolors48.default.dim("new label (prompted if omitted)")}`);
+  out.push(`  ${import_picocolors49.default.bold("rename flags")}`);
+  out.push(`  ${import_picocolors49.default.cyan("--name, -n")} ${import_picocolors49.default.dim("<label>")}        ${import_picocolors49.default.dim("new label (prompted if omitted)")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/mcp.ts
-var import_picocolors49 = __toESM(require_picocolors(), 1);
+var import_picocolors50 = __toESM(require_picocolors(), 1);
 
 // src/core/mcp-check/collect-servers.ts
-import path87 from "node:path";
+import path88 from "node:path";
 import fs80 from "node:fs";
 function collectServers(cwd2, env3 = process.env) {
   const out = [];
@@ -69777,7 +70169,7 @@ function pushResolved(out, seen, name, entry, env3) {
   out.push({ name, url: finalUrl, headers });
 }
 function* readResolvedMcps(cwd2) {
-  const p2 = path87.join(cwd2, ".brainbase", "resolved-mcps.json");
+  const p2 = path88.join(cwd2, ".brainbase", "resolved-mcps.json");
   let raw;
   try {
     raw = fs80.readFileSync(p2, "utf-8");
@@ -69804,12 +70196,12 @@ function* readResolvedMcps(cwd2) {
   }
 }
 function readClaudeCode(cwd2) {
-  const file = path87.join(cwd2, ".mcp.json");
+  const file = path88.join(cwd2, ".mcp.json");
   const map2 = listMcpServersFromMcpJson(file);
   return Object.entries(map2);
 }
 function readCodex(cwd2) {
-  const file = path87.join(cwd2, ".codex", "config.toml");
+  const file = path88.join(cwd2, ".codex", "config.toml");
   try {
     return Object.entries(listMcpServers2(file));
   } catch {
@@ -69817,7 +70209,7 @@ function readCodex(cwd2) {
   }
 }
 function readKafka(cwd2) {
-  const file = path87.join(cwd2, ".kafka", "kafka.json");
+  const file = path88.join(cwd2, ".kafka", "kafka.json");
   try {
     return Object.entries(listMcpServers3(file));
   } catch {
@@ -70105,10 +70497,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path88) {
-  if (!path88)
+function getElementAtPath(obj, path89) {
+  if (!path89)
     return obj;
-  return path88.reduce((acc, key2) => acc?.[key2], obj);
+  return path89.reduce((acc, key2) => acc?.[key2], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys2 = Object.keys(promisesObj);
@@ -70424,11 +70816,11 @@ function aborted(x3, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path88, issues) {
+function prefixIssues(path89, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path88);
+    iss.path.unshift(path89);
     return iss;
   });
 }
@@ -76194,8 +76586,8 @@ async function random2(size2) {
   const evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length;
   let result2 = "";
   while (result2.length < size2) {
-    const randomBytes = await getRandomValues(size2 - result2.length);
-    for (const randomByte of randomBytes) {
+    const randomBytes2 = await getRandomValues(size2 - result2.length);
+    for (const randomByte of randomBytes2) {
       if (randomByte < evenDistCutoff) {
         result2 += mask[randomByte % mask.length];
       }
@@ -78079,17 +78471,17 @@ async function runMcpCheck(cwd2, options) {
 function renderHuman(report2) {
   const lines = [];
   if (report2.check_status === "skipped") {
-    lines.push(import_picocolors49.default.dim("No MCP servers configured — nothing to check."));
+    lines.push(import_picocolors50.default.dim("No MCP servers configured — nothing to check."));
     return lines.join(`
 `) + `
 `;
   }
   for (const s3 of report2.servers) {
-    const mark = s3.status === "ok" ? import_picocolors49.default.green("✓") : s3.status === "auth_failed" ? import_picocolors49.default.red("✗") : import_picocolors49.default.yellow("⚠");
-    const detail = s3.status === "ok" ? import_picocolors49.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors49.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
+    const mark = s3.status === "ok" ? import_picocolors50.default.green("✓") : s3.status === "auth_failed" ? import_picocolors50.default.red("✗") : import_picocolors50.default.yellow("⚠");
+    const detail = s3.status === "ok" ? import_picocolors50.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors50.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
     lines.push(`  ${mark} ${s3.name}  ${detail}`);
   }
-  const summary = report2.check_status === "ok" ? import_picocolors49.default.green("All MCP servers connected.") : import_picocolors49.default.yellow("Some MCP servers are unhealthy.");
+  const summary = report2.check_status === "ok" ? import_picocolors50.default.green("All MCP servers connected.") : import_picocolors50.default.yellow("Some MCP servers are unhealthy.");
   lines.push("", summary);
   return lines.join(`
 `) + `
@@ -78185,12 +78577,12 @@ function isUnhealthy(server) {
 }
 function renderServerList(servers) {
   if (servers.length === 0) {
-    return import_picocolors49.default.dim("No MCP servers configured for this agent.") + `
+    return import_picocolors50.default.dim("No MCP servers configured for this agent.") + `
 `;
   }
   const lines = [""];
   for (const s3 of servers) {
-    const mark = s3.auth === "oauth_expired" ? import_picocolors49.default.red("✗") : s3.auth === "oauth_required" || isUnhealthy(s3) ? import_picocolors49.default.yellow("!") : !s3.is_enabled ? import_picocolors49.default.dim("·") : import_picocolors49.default.green("✓");
+    const mark = s3.auth === "oauth_expired" ? import_picocolors50.default.red("✗") : s3.auth === "oauth_required" || isUnhealthy(s3) ? import_picocolors50.default.yellow("!") : !s3.is_enabled ? import_picocolors50.default.dim("·") : import_picocolors50.default.green("✓");
     const bits = [s3.transport];
     if (!s3.is_enabled)
       bits.push("disabled");
@@ -78203,10 +78595,10 @@ function renderServerList(servers) {
     const expiry = describeExpiry(s3);
     if (expiry)
       bits.push(expiry);
-    lines.push(`  ${mark} ${import_picocolors49.default.bold(s3.name)}  ${import_picocolors49.default.dim(bits.join(" · "))}`);
+    lines.push(`  ${mark} ${import_picocolors50.default.bold(s3.name)}  ${import_picocolors50.default.dim(bits.join(" · "))}`);
   }
   if (servers.some((s3) => s3.auth === "oauth_required" || s3.auth === "oauth_expired")) {
-    lines.push("", import_picocolors49.default.dim("Authorize OAuth-backed servers in the web app; the CLI cannot run that flow yet."));
+    lines.push("", import_picocolors50.default.dim("Authorize OAuth-backed servers in the web app; the CLI cannot run that flow yet."));
   }
   lines.push("");
   return lines.join(`
@@ -78249,7 +78641,7 @@ async function runMcp(cwd2, sub, _argv, options) {
 }
 
 // src/cli/task.ts
-var import_picocolors50 = __toESM(require_picocolors(), 1);
+var import_picocolors51 = __toESM(require_picocolors(), 1);
 
 // src/cli/task-create.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -78435,25 +78827,25 @@ async function runTask(cwd2, sub, args) {
 function printHelp4() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors50.default.bold("brainbase task")} ${import_picocolors50.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors51.default.bold("brainbase task")} ${import_picocolors51.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors50.default.cyan("create")} ${import_picocolors50.default.dim("--message <text>")}   ${import_picocolors50.default.dim("create a task and start its first run")}`);
+  out.push(`  ${import_picocolors51.default.cyan("create")} ${import_picocolors51.default.dim("--message <text>")}   ${import_picocolors51.default.dim("create a task and start its first run")}`);
   out.push("");
-  out.push(`  ${import_picocolors50.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors50.default.dim("--message <text>")}   required first user message`);
-  out.push(`  ${import_picocolors50.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
-  out.push(`  ${import_picocolors50.default.dim("--title <text>")}     optional task title`);
-  out.push(`  ${import_picocolors50.default.dim("--model <id>")}       optional model override`);
-  out.push(`  ${import_picocolors50.default.dim("--json")}             print task_id, agent_id, and status as JSON`);
+  out.push(`  ${import_picocolors51.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors51.default.dim("--message <text>")}   required first user message`);
+  out.push(`  ${import_picocolors51.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
+  out.push(`  ${import_picocolors51.default.dim("--title <text>")}     optional task title`);
+  out.push(`  ${import_picocolors51.default.dim("--model <id>")}       optional model override`);
+  out.push(`  ${import_picocolors51.default.dim("--json")}             print task_id, agent_id, and status as JSON`);
   out.push("");
-  out.push(`  ${import_picocolors50.default.dim("Flag-like values:")} use ${import_picocolors50.default.cyan("--flag=value")} or ${import_picocolors50.default.cyan("--flag -- <value>")}`);
+  out.push(`  ${import_picocolors51.default.dim("Flag-like values:")} use ${import_picocolors51.default.cyan("--flag=value")} or ${import_picocolors51.default.cyan("--flag -- <value>")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/benchmark.ts
-var import_picocolors51 = __toESM(require_picocolors(), 1);
+var import_picocolors52 = __toESM(require_picocolors(), 1);
 import {
   execFileSync as execFileSync3,
   spawn as spawn5
@@ -78461,7 +78853,7 @@ import {
 import crypto7 from "node:crypto";
 import fs82 from "node:fs";
 import os17 from "node:os";
-import path89 from "node:path";
+import path90 from "node:path";
 
 // src/core/benchmark-phase.ts
 import {
@@ -78471,7 +78863,7 @@ import {
 import crypto6 from "node:crypto";
 import fs81 from "node:fs";
 import os16 from "node:os";
-import path88 from "node:path";
+import path89 from "node:path";
 import { Readable, Transform as Transform2 } from "node:stream";
 import { pipeline as pipeline2 } from "node:stream/promises";
 import { createGunzip, createInflateRaw } from "node:zlib";
@@ -78485,6 +78877,8 @@ var MAX_TRAJECTORY_BYTES = 100 * 1024 * 1024;
 var MAX_REMOTE_INPUT_BYTES = 2 * 1024 * 1024 * 1024;
 var MAX_ARCHIVE_EXTRACTED_BYTES = 2 * 1024 * 1024 * 1024;
 var MAX_ARCHIVE_SCAN_BYTES = 2 * 1024 * 1024 * 1024;
+var MAX_HYDRATE_COMMANDS = 150;
+var MAX_PHASE_RESULT_BYTES = 32 * 1024 * 1024;
 var MAX_SANDBOX_COMMANDS = 20;
 var MAX_CRITERIA_PER_EVALUATOR = 200;
 var MAX_CRITERIA_RESULT_BYTES = 24 * 1024 * 1024;
@@ -78496,6 +78890,7 @@ var MAX_ALLOWED_EVIDENCE_IDS = 1e4;
 var COMMAND_PROCESS_MARKER_ENV = "BRAINBASE_BENCHMARK_COMMAND_MARKER";
 var COMMAND_PROCESS_POLL_MS = 10;
 var COMMAND_PROCESS_CLEANUP_MS = 500;
+var JUDGE_ERROR_PREFIX = "BRAINBASE_BENCHMARK_JUDGE_ERROR_V1:";
 var RESERVED_WORKSPACE_PATHS = new Set([
   ".brainbase",
   ".git",
@@ -78512,7 +78907,7 @@ var BASE_ENV_NAMES = [
   "USER"
 ];
 var SENSITIVE_ENV_NAME_RE = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|ACCESS_KEY|PAT|CREDENTIAL)(?:$|_)|^(?:PGPASSWORD|DATABASE_URL|REDIS_URL|MONGODB_URI)$/i;
-var AbsolutePathSchema = exports_external.string().min(1).refine(path88.isAbsolute, {
+var AbsolutePathSchema = exports_external.string().min(1).refine(path89.isAbsolute, {
   message: "must be an absolute path"
 });
 var Sha256Schema = exports_external.string().regex(SHA256_RE).transform((value) => value.toLowerCase());
@@ -78662,7 +79057,7 @@ var TrajectoryEvidenceSchema = EvidenceFileSchema.extend({
 var HydrateSpecSchema = BaseSpecSchema.extend({
   phase: exports_external.literal("hydrate"),
   materials: exports_external.array(MaterialSchema).max(1e4).default([]),
-  setup_commands: exports_external.array(CommandSchema).max(128).default([])
+  setup_commands: exports_external.array(CommandSchema).max(MAX_HYDRATE_COMMANDS).default([])
 }).strict();
 var CandidateOutputSchema = exports_external.object({
   id: IdSchema,
@@ -78803,12 +79198,12 @@ var BenchmarkSpecSchema = exports_external.discriminatedUnion("phase", [
     { items: value.candidate_outputs, path: "candidate_outputs" }
   ];
   for (const { items, path: issuePath } of uniqueLists) {
-    const ids = items.map((item) => item.id);
+    const ids = items.map((item) => issuePath === "candidate_outputs" ? item.id.toLowerCase() : item.id);
     if (new Set(ids).size !== ids.length) {
       context.addIssue({
         code: exports_external.ZodIssueCode.custom,
         path: [issuePath],
-        message: `${issuePath} ids must be unique`
+        message: `${issuePath} ids must be unique${issuePath === "candidate_outputs" ? " ignoring case" : ""}`
       });
     }
   }
@@ -78871,6 +79266,7 @@ var BENCHMARK_CAPABILITIES = {
     "remote_input_references_v1",
     "archive_file_materials_v1",
     "structured_criterion_results_v1",
+    "structured_judge_errors_v1",
     "multiple_sandbox_commands_v1",
     "sandbox_command_workspace_modes_v1",
     "candidate_outputs_v1",
@@ -78884,6 +79280,8 @@ var BENCHMARK_CAPABILITIES = {
   ],
   limits: {
     max_secret_bindings: 100,
+    max_hydrate_commands: MAX_HYDRATE_COMMANDS,
+    max_phase_result_bytes: MAX_PHASE_RESULT_BYTES,
     max_evaluators: 1000,
     max_sandbox_commands: MAX_SANDBOX_COMMANDS,
     max_criteria_per_evaluator: MAX_CRITERIA_PER_EVALUATOR
@@ -78927,35 +79325,35 @@ function normalizedRootRelative(input) {
   return safeRelPath(input);
 }
 function isWithin(root, candidate) {
-  const relative = path88.relative(path88.resolve(root), path88.resolve(candidate));
-  return relative === "" || !relative.startsWith("..") && !path88.isAbsolute(relative);
+  const relative = path89.relative(path89.resolve(root), path89.resolve(candidate));
+  return relative === "" || !relative.startsWith("..") && !path89.isAbsolute(relative);
 }
 function canonicalFuturePath(input) {
-  const resolved = path88.resolve(input);
+  const resolved = path89.resolve(input);
   const suffix = [];
   let current = resolved;
   while (!fs81.existsSync(current)) {
-    const parent = path88.dirname(current);
+    const parent = path89.dirname(current);
     if (parent === current)
       break;
-    suffix.unshift(path88.basename(current));
+    suffix.unshift(path89.basename(current));
     current = parent;
   }
   const canonicalBase = fs81.realpathSync(current);
-  return path88.join(canonicalBase, ...suffix);
+  return path89.join(canonicalBase, ...suffix);
 }
 function validateRoots(spec) {
-  const workspace = path88.resolve(spec.workspace_root);
+  const workspace = path89.resolve(spec.workspace_root);
   if (!fs81.existsSync(workspace) || fs81.lstatSync(workspace).isSymbolicLink() || !fs81.lstatSync(workspace).isDirectory()) {
     throw new BenchmarkPhaseError("invalid_workspace_root", "workspace_root must be an existing real directory");
   }
   const canonicalWorkspace = canonicalFuturePath(workspace);
-  const staging = path88.resolve(spec.staging_root);
-  const expectedStaging = path88.join(workspace, ".brainbase", "benchmark", spec.attempt_id, "incoming");
+  const staging = path89.resolve(spec.staging_root);
+  const expectedStaging = path89.join(workspace, ".brainbase", "benchmark", spec.attempt_id, "incoming");
   if (staging !== expectedStaging) {
     throw new BenchmarkPhaseError("invalid_staging_root", `staging_root must be ${expectedStaging}`);
   }
-  if (!fs81.existsSync(staging) || fs81.lstatSync(staging).isSymbolicLink() || !fs81.lstatSync(staging).isDirectory() || fs81.realpathSync(staging) !== path88.join(canonicalWorkspace, ".brainbase", "benchmark", spec.attempt_id, "incoming")) {
+  if (!fs81.existsSync(staging) || fs81.lstatSync(staging).isSymbolicLink() || !fs81.lstatSync(staging).isDirectory() || fs81.realpathSync(staging) !== path89.join(canonicalWorkspace, ".brainbase", "benchmark", spec.attempt_id, "incoming")) {
     throw new BenchmarkPhaseError("invalid_staging_root", "staging_root must be a real directory under workspace_root");
   }
   const canonicalLogs = validateExternalRoot("logs_root", spec.logs_root, canonicalWorkspace);
@@ -78967,8 +79365,8 @@ function validateRoots(spec) {
   }
 }
 function validateExternalRoot(label, input, canonicalWorkspace) {
-  const candidate = path88.resolve(input);
-  if (candidate === path88.parse(candidate).root) {
+  const candidate = path89.resolve(input);
+  if (candidate === path89.parse(candidate).root) {
     throw new BenchmarkPhaseError(`invalid_${label}`, `${label} cannot be a filesystem root`);
   }
   if (fs81.existsSync(candidate) && fs81.lstatSync(candidate).isSymbolicLink()) {
@@ -78998,9 +79396,9 @@ function assertNoSymlinkTraversal(root, relative) {
   const rel = normalizedRootRelative(relative);
   if (rel === ".")
     return;
-  let current = path88.resolve(root);
+  let current = path89.resolve(root);
   for (const segment of rel.split("/").slice(0, -1)) {
-    current = path88.join(current, segment);
+    current = path89.join(current, segment);
     if (!fs81.existsSync(current))
       continue;
     if (fs81.lstatSync(current).isSymbolicLink()) {
@@ -79069,10 +79467,10 @@ function assertWritableDestination(root, relative) {
   const rel = normalizedRootRelative(relative);
   if (rel === ".")
     return;
-  let current = path88.resolve(root);
+  let current = path89.resolve(root);
   const segments = rel.split("/");
   for (const segment of segments.slice(0, -1)) {
-    current = path88.join(current, segment);
+    current = path89.join(current, segment);
     if (!fs81.existsSync(current))
       continue;
     const stat = fs81.lstatSync(current);
@@ -79083,7 +79481,7 @@ function assertWritableDestination(root, relative) {
       throw new BenchmarkPhaseError("destination_conflict", `destination parent is not a directory: ${relative}`);
     }
   }
-  const destination = path88.resolve(root, rel);
+  const destination = path89.resolve(root, rel);
   if (fs81.existsSync(destination) && fs81.lstatSync(destination).isDirectory()) {
     throw new BenchmarkPhaseError("destination_conflict", `file destination is an existing directory: ${relative}`);
   }
@@ -79109,7 +79507,7 @@ function validateDestinationGraph(paths) {
 }
 function sourcePath(stagingRoot, relative) {
   const rel = safeRelPath(relative);
-  const source = path88.resolve(stagingRoot, rel);
+  const source = path89.resolve(stagingRoot, rel);
   if (!isWithin(stagingRoot, source)) {
     throw new BenchmarkPhaseError("unsafe_path", `source escapes staging root: ${relative}`);
   }
@@ -79144,7 +79542,7 @@ async function verifyRecordsUnchanged(records, spec) {
     }
     const relative = safeRelPath(record3.path);
     assertNoSymlinkTraversal(root, relative);
-    const candidate = path88.resolve(root, relative);
+    const candidate = path89.resolve(root, relative);
     if (!isWithin(root, candidate)) {
       throw new BenchmarkPhaseError("evidence_tampered", `evidence was removed during evaluation: ${record3.root}:${record3.path}`);
     }
@@ -79214,7 +79612,7 @@ async function cachedVerifiedInput(stagingRoot, input, context) {
 function stagedInputRecord(stagingRoot, verified) {
   return {
     root: "staging",
-    path: path88.relative(stagingRoot, verified.source).replace(/\\/g, "/"),
+    path: path89.relative(stagingRoot, verified.source).replace(/\\/g, "/"),
     sha256: verified.sha256,
     size: verified.size,
     mode: verified.mode,
@@ -79235,7 +79633,7 @@ function removeRemoteHydrationInputs(spec) {
     if (!material.download_url_env || removedSources.has(material.source))
       continue;
     const relative = safeRelPath(material.source);
-    const source = path88.resolve(spec.staging_root, relative);
+    const source = path89.resolve(spec.staging_root, relative);
     if (!isWithin(spec.staging_root, source)) {
       throw new BenchmarkPhaseError("unsafe_path", `source escapes staging root: ${material.source}`);
     }
@@ -79267,7 +79665,7 @@ async function downloadInputReference(stagingRoot, input, context) {
     return await cachedVerifiedInput(stagingRoot, input, context);
   }
   const relative = safeRelPath(input.source);
-  const destination = path88.resolve(stagingRoot, relative);
+  const destination = path89.resolve(stagingRoot, relative);
   if (!isWithin(stagingRoot, destination)) {
     throw new BenchmarkPhaseError("unsafe_path", `source escapes staging root: ${input.source}`);
   }
@@ -79296,7 +79694,7 @@ async function downloadInputReference(stagingRoot, input, context) {
   if (remainingMs <= 0) {
     throw new BenchmarkPhaseError("phase_timeout", "phase budget expired");
   }
-  fs81.mkdirSync(path88.dirname(destination), { recursive: true, mode: 448 });
+  fs81.mkdirSync(path89.dirname(destination), { recursive: true, mode: 448 });
   assertNoSymlinkTraversal(stagingRoot, relative);
   assertWritableDestination(stagingRoot, relative);
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.download`;
@@ -79515,7 +79913,7 @@ function findZipMembers(archivePath, requested, context) {
   }
 }
 async function writeVerifiedArchiveMember(source, destination, material, context) {
-  fs81.mkdirSync(path88.dirname(destination), { recursive: true, mode: 448 });
+  fs81.mkdirSync(path89.dirname(destination), { recursive: true, mode: 448 });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   const descriptor = fs81.openSync(temporary, "wx", 384);
   const hash = crypto6.createHash("sha256");
@@ -79630,7 +80028,7 @@ async function extractArchiveMembers(archivePath, outputRoot, materials, context
     const indexed = findZipMembers(archivePath, requested, context);
     for (const [memberPath, material] of requested) {
       assertBudget(context);
-      const destination = path88.resolve(outputRoot, memberPath);
+      const destination = path89.resolve(outputRoot, memberPath);
       if (!isWithin(outputRoot, destination)) {
         throw new BenchmarkPhaseError("unsafe_path", `archive member escapes output root: ${memberPath}`);
       }
@@ -79706,7 +80104,7 @@ async function extractArchiveMembers(archivePath, outputRoot, materials, context
   return extracted;
 }
 async function atomicCopy(source, destination, mode, sourceRoot) {
-  fs81.mkdirSync(path88.dirname(destination), { recursive: true });
+  fs81.mkdirSync(path89.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   const opened = openRegularFileNoFollow(source, `copy source ${source}`, sourceRoot);
   try {
@@ -79726,7 +80124,7 @@ async function atomicCopy(source, destination, mode, sourceRoot) {
   }
 }
 async function recordFile(root, filePath, rootName, kind = "file") {
-  const relative = path88.relative(root, filePath).replace(/\\/g, "/");
+  const relative = path89.relative(root, filePath).replace(/\\/g, "/");
   if (kind === "symlink") {
     const stat = fs81.lstatSync(filePath);
     const target = fs81.readlinkSync(filePath);
@@ -79767,11 +80165,11 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
       throw new BenchmarkPhaseError("unsafe_path", "file destination cannot be a directory root");
     }
     assertWritableDestination(destinationRoot, destinationRel);
-    const destination = path88.resolve(destinationRoot, destinationRel);
+    const destination = path89.resolve(destinationRoot, destinationRel);
     if (material.kind === "file") {
       await atomicCopy(source, destination, material.mode ?? verifiedSource?.mode, sourceRoot);
     } else {
-      await atomicCopy(source, destination, material.mode, path88.dirname(source));
+      await atomicCopy(source, destination, material.mode, path89.dirname(source));
     }
     const record3 = await recordFile(destinationRoot, destination, destinationRootName);
     const expectedSha256 = material.kind === "archive_file" ? material.file_sha256 : material.sha256;
@@ -79781,15 +80179,15 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     }
     return [record3];
   }
-  const temporary = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-"));
+  const temporary = fs81.mkdtempSync(path89.join(os16.tmpdir(), "brainbase-benchmark-"));
   try {
-    const verifiedArchive = path88.join(temporary, "material.tar.gz");
+    const verifiedArchive = path89.join(temporary, "material.tar.gz");
     await atomicCopy(source, verifiedArchive, 384, sourceRoot);
     const archiveRecord = await recordFile(temporary, verifiedArchive, "staging");
     if (archiveRecord.sha256 !== material.sha256 || archiveRecord.size !== material.size_bytes) {
       throw new BenchmarkPhaseError("evidence_tampered", `material changed while it was copied: ${material.source}`);
     }
-    const extractedRoot = path88.join(temporary, "extracted");
+    const extractedRoot = path89.join(temporary, "extracted");
     const extracted = await extract({
       tarFile: verifiedArchive,
       outDir: extractedRoot,
@@ -79798,17 +80196,17 @@ async function copyMaterial(material, sourceRoot, destinationRoot, destinationRo
     });
     const outputs = [];
     for (const extractedRel of extracted.sort()) {
-      const sourceFile = path88.resolve(extractedRoot, safeRelPath(extractedRel));
+      const sourceFile = path89.resolve(extractedRoot, safeRelPath(extractedRel));
       const stat = fs81.lstatSync(sourceFile);
       if (!stat.isFile())
         continue;
-      const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path88.posix.join(destinationRel, extractedRel));
+      const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path89.posix.join(destinationRel, extractedRel));
       const checked = protectWorkspace ? workspaceRel(combined) : combined;
       if (!protectWorkspace && checked.toLowerCase() === ".brainbase-benchmark-owner.json") {
         throw new BenchmarkPhaseError("reserved_path", "benchmark input cannot replace the phase ownership marker");
       }
       assertWritableDestination(destinationRoot, checked);
-      const destination = path88.resolve(destinationRoot, checked);
+      const destination = path89.resolve(destinationRoot, checked);
       await atomicCopy(sourceFile, destination, material.mode, extractedRoot);
       outputs.push(await recordFile(destinationRoot, destination, destinationRootName));
     }
@@ -79832,7 +80230,7 @@ async function preflightMaterial(material, materials, sourceRoot, destinationRoo
       const cacheKey = archiveMemberCacheKey(material);
       let extracted = context.preparedArchiveFiles.get(cacheKey);
       if (!extracted) {
-        const temporary2 = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-member-"));
+        const temporary2 = fs81.mkdtempSync(path89.join(os16.tmpdir(), "brainbase-benchmark-member-"));
         context.temporaryRoots.add(temporary2);
         const archiveKey = archiveSourceCacheKey(material);
         const related = materials.filter((candidate) => candidate.kind === "archive_file" && archiveSourceCacheKey(candidate) === archiveKey);
@@ -79852,15 +80250,15 @@ async function preflightMaterial(material, materials, sourceRoot, destinationRoo
     }
     return [destinationRel];
   }
-  const temporary = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-preflight-"));
+  const temporary = fs81.mkdtempSync(path89.join(os16.tmpdir(), "brainbase-benchmark-preflight-"));
   try {
-    const verifiedArchive = path88.join(temporary, "material.tar.gz");
+    const verifiedArchive = path89.join(temporary, "material.tar.gz");
     await atomicCopy(source, verifiedArchive, 384, sourceRoot);
     const archiveRecord = await recordFile(temporary, verifiedArchive, "staging");
     if (archiveRecord.sha256 !== material.sha256 || archiveRecord.size !== material.size_bytes) {
       throw new BenchmarkPhaseError("evidence_tampered", `material changed while it was copied: ${material.source}`);
     }
-    const extractedRoot = path88.join(temporary, "extracted");
+    const extractedRoot = path89.join(temporary, "extracted");
     const extracted = await extract({
       tarFile: verifiedArchive,
       outDir: extractedRoot,
@@ -79869,7 +80267,7 @@ async function preflightMaterial(material, materials, sourceRoot, destinationRoo
     });
     const planned = [];
     for (const extractedRel of extracted) {
-      const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path88.posix.join(destinationRel, extractedRel));
+      const combined = destinationRel === "." ? safeRelPath(extractedRel) : safeRelPath(path89.posix.join(destinationRel, extractedRel));
       const checked = protectWorkspace ? workspaceRel(combined) : combined;
       if (!protectWorkspace && checked.toLowerCase() === ".brainbase-benchmark-owner.json") {
         throw new BenchmarkPhaseError("reserved_path", "benchmark input cannot replace the phase ownership marker");
@@ -79883,7 +80281,7 @@ async function preflightMaterial(material, materials, sourceRoot, destinationRoo
   }
 }
 function ownerMarker(root) {
-  return path88.join(root, ".brainbase-benchmark-owner.json");
+  return path89.join(root, ".brainbase-benchmark-owner.json");
 }
 function verifyOwnedDirectory(root, role, spec) {
   if (!fs81.existsSync(root) || fs81.lstatSync(root).isSymbolicLink())
@@ -80021,7 +80419,7 @@ function markedProcessPids(marker) {
       if (pid === process.pid)
         continue;
       try {
-        const environment = fs81.readFileSync(path88.join("/proc", entry, "environ"), "utf8");
+        const environment = fs81.readFileSync(path89.join("/proc", entry, "environ"), "utf8");
         if (environment.split("\x00").includes(assignment))
           matches2.push(pid);
       } catch {}
@@ -80055,7 +80453,7 @@ function markedProcessPids(marker) {
 function processExists(pid) {
   if (process.platform === "linux") {
     try {
-      const stat = fs81.readFileSync(path88.join("/proc", String(pid), "stat"), "utf8");
+      const stat = fs81.readFileSync(path89.join("/proc", String(pid), "stat"), "utf8");
       const commandEnd = stat.lastIndexOf(")");
       const state = commandEnd >= 0 ? stat.slice(commandEnd + 2, commandEnd + 3) : "";
       if (state === "Z" || state === "X")
@@ -80099,7 +80497,7 @@ async function terminateCommandProcesses(child, marker, observedDescendants) {
 async function runCommand(command, root, spec, context, options = {}) {
   const cwdRel = normalizedRootRelative(command.cwd);
   assertNoSymlinkTraversal(root, cwdRel);
-  const cwd2 = path88.resolve(root, cwdRel);
+  const cwd2 = path89.resolve(root, cwdRel);
   let cwdStat;
   try {
     cwdStat = fs81.lstatSync(cwd2);
@@ -80222,8 +80620,8 @@ async function runCommand(command, root, spec, context, options = {}) {
   });
 }
 async function writeLog(root, name, data, spec) {
-  const destination = path88.join(root, name);
-  fs81.mkdirSync(path88.dirname(destination), { recursive: true });
+  const destination = path89.join(root, name);
+  fs81.mkdirSync(path89.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   try {
     fs81.writeFileSync(temporary, redactCommandOutput(data, spec), {
@@ -80237,7 +80635,7 @@ async function writeLog(root, name, data, spec) {
   return await recordFile(root, destination, "logs");
 }
 function writeBufferAtomic(destination, data) {
-  fs81.mkdirSync(path88.dirname(destination), { recursive: true });
+  fs81.mkdirSync(path89.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
   try {
     fs81.writeFileSync(temporary, data, { flag: "wx", mode: 384 });
@@ -80337,7 +80735,7 @@ async function executeHydrate(spec, context) {
       finalOutputs.push(output);
       continue;
     }
-    const candidate = path88.resolve(spec.workspace_root, safeRelPath(output.path));
+    const candidate = path89.resolve(spec.workspace_root, safeRelPath(output.path));
     assertNoSymlinkTraversal(spec.workspace_root, output.path);
     if (!fs81.existsSync(candidate))
       continue;
@@ -80368,7 +80766,7 @@ async function readEvidence(stagingRoot, evidence) {
       buffer,
       record: {
         root: "staging",
-        path: path88.relative(stagingRoot, filePath).replace(/\\/g, "/"),
+        path: path89.relative(stagingRoot, filePath).replace(/\\/g, "/"),
         sha256: evidence.sha256,
         size: opened.stat.size,
         mode: opened.stat.mode & 511
@@ -80381,14 +80779,14 @@ async function readEvidence(stagingRoot, evidence) {
 async function workspaceManifest(spec, context) {
   const records = [];
   let totalBytes = 0;
-  const stack = [path88.resolve(spec.workspace_root)];
+  const stack = [path89.resolve(spec.workspace_root)];
   while (stack.length > 0) {
     const directory = stack.pop();
     const entries = fs81.readdirSync(directory, { withFileTypes: true }).sort((a3, b4) => a3.name.localeCompare(b4.name));
     for (const entry of entries) {
       assertBudget(context);
-      const full = path88.join(directory, entry.name);
-      const relative = path88.relative(spec.workspace_root, full).replace(/\\/g, "/");
+      const full = path89.join(directory, entry.name);
+      const relative = path89.relative(spec.workspace_root, full).replace(/\\/g, "/");
       if (relative === ".brainbase" || relative.startsWith(".brainbase/"))
         continue;
       if (relative === ".git" || relative.startsWith(".git/"))
@@ -80421,13 +80819,13 @@ async function verifyWorkspaceManifestUnchanged(expected, spec, context) {
 }
 function treeBytes(root, context) {
   let totalBytes = 0;
-  const stack = [path88.resolve(root)];
+  const stack = [path89.resolve(root)];
   while (stack.length > 0) {
     const directory = stack.pop();
     const entries = fs81.readdirSync(directory, { withFileTypes: true });
     for (const entry of entries) {
       assertBudget(context);
-      const candidate = path88.join(directory, entry.name);
+      const candidate = path89.join(directory, entry.name);
       const stat = fs81.lstatSync(candidate);
       if (stat.isDirectory()) {
         stack.push(candidate);
@@ -80441,7 +80839,7 @@ function treeBytes(root, context) {
         totalBytes += Buffer.byteLength(fs81.readlinkSync(candidate));
         continue;
       }
-      throw new BenchmarkPhaseError("unsafe_path", `evaluate output contains an unsupported filesystem entry: ${path88.relative(root, candidate)}`);
+      throw new BenchmarkPhaseError("unsafe_path", `evaluate output contains an unsupported filesystem entry: ${path89.relative(root, candidate)}`);
     }
   }
   return totalBytes;
@@ -80487,11 +80885,11 @@ function manifestDirectories(manifest, context) {
     assertBudget(context);
     if (entry.kind === "symlink")
       continue;
-    let current = path88.posix.dirname(entry.path);
+    let current = path89.posix.dirname(entry.path);
     while (current !== ".") {
       assertBudget(context);
       directories.add(current);
-      current = path88.posix.dirname(current);
+      current = path89.posix.dirname(current);
     }
   }
   return [...directories].sort();
@@ -80560,8 +80958,8 @@ async function copyCandidateOutput(output, manifest, spec, context) {
   const copied = [];
   for (const frozenFile of selected.files) {
     assertBudget(context);
-    const source = path88.resolve(spec.workspace_root, safeRelPath(frozenFile.path));
-    const destination = path88.resolve(spec.logs_root, "candidate-outputs", output.id, safeRelPath(frozenFile.path));
+    const source = path89.resolve(spec.workspace_root, safeRelPath(frozenFile.path));
+    const destination = path89.resolve(spec.logs_root, "candidate-outputs", output.id, safeRelPath(frozenFile.path));
     if (fs81.existsSync(destination)) {
       throw new BenchmarkPhaseError("destination_conflict", `candidate output destination already exists: ${output.id}/${frozenFile.path}`);
     }
@@ -80575,24 +80973,24 @@ async function copyCandidateOutput(output, manifest, spec, context) {
   return copied;
 }
 async function copyFrozenWorkspace(manifest, spec, context, sourceRoot = spec.workspace_root, symlinkPolicy = "preserve") {
-  const destinationRoot = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-workspace-"));
+  const destinationRoot = fs81.mkdtempSync(path89.join(os16.tmpdir(), "brainbase-benchmark-workspace-"));
   fs81.chmodSync(destinationRoot, 448);
   context.temporaryRoots.add(destinationRoot);
   for (const frozenFile of manifest) {
     assertBudget(context);
-    const source = path88.resolve(sourceRoot, safeRelPath(frozenFile.path));
-    const destination = path88.resolve(destinationRoot, safeRelPath(frozenFile.path));
+    const source = path89.resolve(sourceRoot, safeRelPath(frozenFile.path));
+    const destination = path89.resolve(destinationRoot, safeRelPath(frozenFile.path));
     if (frozenFile.kind === "symlink") {
       const stat = fs81.lstatSync(source);
       const target = stat.isSymbolicLink() ? fs81.readlinkSync(source) : null;
       if (target === null || Buffer.byteLength(target) !== frozenFile.size || sha256(target) !== frozenFile.sha256) {
         throw new BenchmarkPhaseError("evidence_tampered", `workspace changed after it was frozen: ${frozenFile.path}`);
       }
-      const resolvedTarget = path88.resolve(path88.dirname(source), target);
-      if (symlinkPolicy === "contained_relative_only" && (path88.isAbsolute(target) || !isWithin(sourceRoot, resolvedTarget))) {
+      const resolvedTarget = path89.resolve(path89.dirname(source), target);
+      if (symlinkPolicy === "contained_relative_only" && (path89.isAbsolute(target) || !isWithin(sourceRoot, resolvedTarget))) {
         continue;
       }
-      fs81.mkdirSync(path88.dirname(destination), { recursive: true, mode: 448 });
+      fs81.mkdirSync(path89.dirname(destination), { recursive: true, mode: 448 });
       fs81.symlinkSync(target, destination);
       continue;
     }
@@ -80605,12 +81003,12 @@ async function copyFrozenWorkspace(manifest, spec, context, sourceRoot = spec.wo
   return destinationRoot;
 }
 async function copyEvaluatorTests(spec, evaluator, context) {
-  const destinationRoot = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-tests-"));
+  const destinationRoot = fs81.mkdtempSync(path89.join(os16.tmpdir(), "brainbase-benchmark-tests-"));
   fs81.chmodSync(destinationRoot, 448);
   context.temporaryRoots.add(destinationRoot);
   const sourceRoot = evaluatorTestsPath(evaluator, spec.tests_root);
   const relativeRoot = evaluator.tests_path ? normalizedRootRelative(evaluator.tests_path) : ".";
-  const destinationStart = relativeRoot === "." ? destinationRoot : path88.resolve(destinationRoot, relativeRoot);
+  const destinationStart = relativeRoot === "." ? destinationRoot : path89.resolve(destinationRoot, relativeRoot);
   fs81.mkdirSync(destinationStart, { recursive: true, mode: 448 });
   const stack = [{ source: sourceRoot, destination: destinationStart }];
   while (stack.length > 0) {
@@ -80619,11 +81017,11 @@ async function copyEvaluatorTests(spec, evaluator, context) {
     const entries = fs81.readdirSync(current.source, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
     for (const entry of entries) {
       assertBudget(context);
-      const source = path88.join(current.source, entry.name);
-      const destination = path88.join(current.destination, entry.name);
+      const source = path89.join(current.source, entry.name);
+      const destination = path89.join(current.destination, entry.name);
       const stat = fs81.lstatSync(source);
       if (stat.isSymbolicLink()) {
-        throw new BenchmarkPhaseError("unsafe_path", `evaluator reference tree contains a symlink: ${path88.relative(spec.tests_root, source)}`);
+        throw new BenchmarkPhaseError("unsafe_path", `evaluator reference tree contains a symlink: ${path89.relative(spec.tests_root, source)}`);
       }
       if (stat.isDirectory()) {
         fs81.mkdirSync(destination, { recursive: true, mode: stat.mode & 511 });
@@ -80631,7 +81029,7 @@ async function copyEvaluatorTests(spec, evaluator, context) {
         continue;
       }
       if (!stat.isFile()) {
-        throw new BenchmarkPhaseError("unsafe_path", `evaluator reference tree contains an unsupported filesystem entry: ${path88.relative(spec.tests_root, source)}`);
+        throw new BenchmarkPhaseError("unsafe_path", `evaluator reference tree contains an unsupported filesystem entry: ${path89.relative(spec.tests_root, source)}`);
       }
       await atomicCopy(source, destination, stat.mode & 511, spec.tests_root);
       const sourceRecord = await recordFile(spec.tests_root, source, "tests");
@@ -80648,7 +81046,7 @@ function evaluatorTestsPath(evaluator, testsRoot) {
     return testsRoot;
   const relative = normalizedRootRelative(evaluator.tests_path);
   assertNoSymlinkTraversal(testsRoot, relative);
-  const candidate = path88.resolve(testsRoot, relative);
+  const candidate = path89.resolve(testsRoot, relative);
   if (!isWithin(testsRoot, candidate) || !fs81.existsSync(candidate)) {
     throw new BenchmarkPhaseError("invalid_tests_path", `evaluator tests_path does not exist: ${evaluator.tests_path}`);
   }
@@ -80683,10 +81081,33 @@ var CriteriaResultFileSchema = exports_external.object({
     });
   }
 });
+var JudgeErrorSchema = exports_external.object({
+  code: exports_external.enum([
+    "judge_provider_quota_exhausted",
+    "judge_rate_limited",
+    "judge_provider_authentication_failed",
+    "judge_provider_unavailable",
+    "judge_request_failed"
+  ]),
+  message: exports_external.string().min(1).max(500)
+}).strict();
+function structuredJudgeError(stderr) {
+  for (const line of stderr.toString("utf8").split(/\r?\n/).reverse()) {
+    const marker = line.indexOf(JUDGE_ERROR_PREFIX);
+    if (marker < 0)
+      continue;
+    try {
+      const parsed = JudgeErrorSchema.safeParse(JSON.parse(line.slice(marker + JUDGE_ERROR_PREFIX.length)));
+      if (parsed.success)
+        return parsed.data;
+    } catch {}
+  }
+  return null;
+}
 function readCriterionResults(resultPath, criterionKeys, allowedEvidenceIds, spec, additionalSecrets = []) {
   let opened;
   try {
-    opened = openRegularFileNoFollow(resultPath, "criterion result", path88.dirname(resultPath));
+    opened = openRegularFileNoFollow(resultPath, "criterion result", path89.dirname(resultPath));
   } catch (error2) {
     if (error2.code === "ENOENT") {
       throw new BenchmarkPhaseError("missing_criterion_result", "sandbox evaluator did not write its criterion result");
@@ -80833,7 +81254,7 @@ async function evaluateOne(evaluator, spec, manifest, frozenWorkspaceRoot, final
   if (evaluator.type === "workspace_assertion") {
     const relative = workspaceRel(evaluator.path);
     assertNoSymlinkTraversal(frozenWorkspaceRoot, relative);
-    const candidate = path88.resolve(frozenWorkspaceRoot, relative);
+    const candidate = path89.resolve(frozenWorkspaceRoot, relative);
     let stat = null;
     try {
       stat = fs81.lstatSync(candidate);
@@ -80913,10 +81334,10 @@ async function evaluateOne(evaluator, spec, manifest, frozenWorkspaceRoot, final
     };
     let criterionResultPath;
     if (evaluator.criterion_keys) {
-      privateResultRoot = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-criteria-"));
+      privateResultRoot = fs81.mkdtempSync(path89.join(os16.tmpdir(), "brainbase-benchmark-criteria-"));
       fs81.chmodSync(privateResultRoot, 448);
       context.temporaryRoots.add(privateResultRoot);
-      criterionResultPath = path88.join(privateResultRoot, "result.json");
+      criterionResultPath = path89.join(privateResultRoot, "result.json");
       environment.BRAINBASE_BENCHMARK_CRITERIA_RESULT = criterionResultPath;
     }
     const result2 = await runCommand(command, commandRoot, spec, context, {
@@ -80929,7 +81350,13 @@ async function evaluateOne(evaluator, spec, manifest, frozenWorkspaceRoot, final
     try {
       criterionResults = evaluator.criterion_keys && criterionResultPath ? readCriterionResults(criterionResultPath, evaluator.criterion_keys, evaluator.allowed_evidence_ids ?? [], spec, result2.redactions) : undefined;
     } catch (error2) {
-      const normalized = stableError(error2);
+      let normalized = stableError(error2);
+      if (normalized?.code === "missing_criterion_result" && result2.exitCode !== 0) {
+        normalized = structuredJudgeError(result2.stderr) ?? {
+          code: "command_terminated",
+          message: "sandbox evaluator terminated before writing its criterion result"
+        };
+      }
       return {
         ...base2,
         status: "errored",
@@ -81001,8 +81428,8 @@ async function executeEvaluate(spec, context) {
   context.logsOwned = true;
   validateRoots(spec);
   const outputs = [];
-  const finalOutputPath = path88.join(spec.logs_root, "candidate-evidence", "final-output");
-  const trajectoryPath = path88.join(spec.logs_root, "candidate-evidence", "trajectory.json");
+  const finalOutputPath = path89.join(spec.logs_root, "candidate-evidence", "final-output");
+  const trajectoryPath = path89.join(spec.logs_root, "candidate-evidence", "trajectory.json");
   writeBufferAtomic(finalOutputPath, finalOutput.buffer);
   writeBufferAtomic(trajectoryPath, trajectoryEvidence.buffer);
   const frozenEvidenceRecords = [
@@ -81014,7 +81441,7 @@ async function executeEvaluate(spec, context) {
   assertEvaluateOutputBudget(spec, context);
   assertBudget(context);
   const manifest = await workspaceManifest(spec, context);
-  const manifestPath2 = path88.join(spec.logs_root, "candidate-workspace-manifest.json");
+  const manifestPath2 = path89.join(spec.logs_root, "candidate-workspace-manifest.json");
   writeJsonAtomic(manifestPath2, {
     schema_version: SCHEMA_VERSION,
     attempt_id: spec.attempt_id,
@@ -81028,12 +81455,12 @@ async function executeEvaluate(spec, context) {
   for (const artifactRelInput of spec.candidate_artifacts) {
     const artifactRel = workspaceRel(artifactRelInput);
     assertNoSymlinkTraversal(spec.workspace_root, artifactRel);
-    const source = path88.resolve(spec.workspace_root, artifactRel);
+    const source = path89.resolve(spec.workspace_root, artifactRel);
     const frozenArtifact = manifest.find((entry) => entry.path === artifactRel && entry.kind !== "symlink");
     if (!frozenArtifact || !fs81.existsSync(source) || !fs81.lstatSync(source).isFile()) {
       throw new BenchmarkPhaseError("missing_artifact", `candidate artifact is missing: ${artifactRel}`);
     }
-    const destination = path88.resolve(spec.logs_root, "candidate-artifacts", artifactRel);
+    const destination = path89.resolve(spec.logs_root, "candidate-artifacts", artifactRel);
     await atomicCopy(source, destination, undefined, spec.workspace_root);
     const artifact = await recordFile(spec.logs_root, destination, "logs");
     if (artifact.sha256 !== frozenArtifact.sha256 || artifact.size !== frozenArtifact.size || artifact.mode !== frozenArtifact.mode) {
@@ -81051,7 +81478,7 @@ async function executeEvaluate(spec, context) {
   assertEvaluateOutputBudget(spec, context);
   if (spec.capture_workspace_archive) {
     const regularFiles = manifest.filter((entry) => entry.kind !== "symlink").map((entry) => entry.path);
-    const archive = path88.join(spec.logs_root, "candidate-workspace.tar.gz");
+    const archive = path89.join(spec.logs_root, "candidate-workspace.tar.gz");
     const temporary = `${archive}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
     try {
       await pack({ rootDir: spec.workspace_root, outFile: temporary, files: regularFiles });
@@ -81165,6 +81592,67 @@ function stableError(error2) {
     message: error2 instanceof Error ? error2.message : "unknown benchmark phase failure"
   };
 }
+function compactOversizedResult(result2) {
+  const actualBytes = Buffer.byteLength(`${JSON.stringify(result2, null, 2)}
+`);
+  if (actualBytes <= MAX_PHASE_RESULT_BYTES)
+    return result2;
+  return {
+    schema_version: result2.schema_version,
+    cli_version: result2.cli_version,
+    phase: result2.phase,
+    attempt_id: result2.attempt_id,
+    phase_id: result2.phase_id,
+    spec_digest: result2.spec_digest,
+    status: "failed",
+    started_at: result2.started_at,
+    completed_at: result2.completed_at,
+    duration_ms: result2.duration_ms,
+    steps: [],
+    inputs: [],
+    outputs: [],
+    error: {
+      code: "result_too_large",
+      message: "benchmark phase result exceeds the 32 MiB contract limit",
+      details: {
+        actual_bytes: actualBytes,
+        max_bytes: MAX_PHASE_RESULT_BYTES,
+        step_count: result2.steps.length,
+        input_count: result2.inputs.length,
+        output_count: result2.outputs.length,
+        evaluator_count: result2.evaluators?.length ?? 0
+      }
+    }
+  };
+}
+function readCachedPhaseResult(resultPath) {
+  let opened;
+  try {
+    opened = openRegularFileNoFollow(resultPath, "cached benchmark phase result");
+  } catch {
+    return;
+  }
+  try {
+    if (opened.stat.size > MAX_PHASE_RESULT_BYTES)
+      return;
+    const chunks = [];
+    let offset = 0;
+    while (offset <= MAX_PHASE_RESULT_BYTES) {
+      const buffer = Buffer.alloc(Math.min(64 * 1024, MAX_PHASE_RESULT_BYTES + 1 - offset));
+      const bytesRead = fs81.readSync(opened.fd, buffer, 0, buffer.length, offset);
+      if (bytesRead === 0) {
+        return JSON.parse(Buffer.concat(chunks, offset).toString("utf8"));
+      }
+      chunks.push(buffer.subarray(0, bytesRead));
+      offset += bytesRead;
+    }
+    return;
+  } catch {
+    return;
+  } finally {
+    fs81.closeSync(opened.fd);
+  }
+}
 function rawIdentity(value) {
   if (!value || typeof value !== "object") {
     return { phase: "unknown", attemptId: null, phaseId: null };
@@ -81177,7 +81665,7 @@ function rawIdentity(value) {
   };
 }
 function readSpecBytes(specPathInput) {
-  const specPath = path88.resolve(specPathInput);
+  const specPath = path89.resolve(specPathInput);
   const noFollow = typeof fs81.constants.O_NOFOLLOW === "number" ? fs81.constants.O_NOFOLLOW : 0;
   let fd;
   try {
@@ -81208,8 +81696,8 @@ function validateBenchmarkInvocationBytes(bytes, resultPathInput, expectedPhase)
     throw new BenchmarkPhaseError("phase_mismatch", `the ${expectedPhase} command cannot execute a ${spec.phase} spec`);
   }
   validateRoots(spec);
-  const resultPath = path88.resolve(resultPathInput);
-  const expectedResultPath = path88.join(path88.resolve(spec.logs_root), "result.json");
+  const resultPath = path89.resolve(resultPathInput);
+  const expectedResultPath = path89.join(path89.resolve(spec.logs_root), "result.json");
   if (resultPath !== expectedResultPath) {
     throw new BenchmarkPhaseError("invalid_result_path", `result path must be ${expectedResultPath}`);
   }
@@ -81237,13 +81725,9 @@ function prepareBenchmarkPhaseInvocation(specPathInput, resultPathInput, expecte
       timeout_ms: spec.budget.timeout_ms
     };
     let cachedResult;
-    if (fs81.existsSync(resultPath)) {
-      try {
-        const cached2 = JSON.parse(fs81.readFileSync(resultPath, "utf8"));
-        if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
-          cachedResult = cached2;
-        }
-      } catch {}
+    const cached2 = readCachedPhaseResult(resultPath);
+    if (cached2?.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
+      cachedResult = cached2;
     }
     if (cachedResult) {
       if (spec.phase === "hydrate") {
@@ -81260,7 +81744,7 @@ function prepareBenchmarkPhaseInvocation(specPathInput, resultPathInput, expecte
   } catch (error2) {
     return {
       ok: false,
-      result: {
+      result: compactOversizedResult({
         schema_version: SCHEMA_VERSION,
         cli_version: VERSION,
         phase: identity2.phase === "unknown" ? expectedPhase : identity2.phase,
@@ -81275,7 +81759,7 @@ function prepareBenchmarkPhaseInvocation(specPathInput, resultPathInput, expecte
         inputs: [],
         outputs: [],
         error: stableError(error2)
-      }
+      })
     };
   }
 }
@@ -81313,7 +81797,7 @@ function writeBenchmarkPhaseTimeoutResult(specBytes, resultPathInput, expectedPh
 async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase, immutableSpecBytes) {
   const startedAt = nowIso();
   const started = Date.now();
-  const resultPath = path88.resolve(resultPathInput);
+  const resultPath = path89.resolve(resultPathInput);
   let raw = undefined;
   let digest = null;
   let identity2 = rawIdentity(raw);
@@ -81349,19 +81833,15 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
       throw new BenchmarkPhaseError("phase_mismatch", `the ${expectedPhase} command cannot execute a ${spec.phase} spec`);
     }
     validateRoots(spec);
-    const expectedResultPath = path88.join(path88.resolve(spec.logs_root), "result.json");
+    const expectedResultPath = path89.join(path89.resolve(spec.logs_root), "result.json");
     if (resultPath !== expectedResultPath) {
       throw new BenchmarkPhaseError("invalid_result_path", `result path must be ${expectedResultPath}`);
     }
     resultPathValidated = true;
     let cachedResult;
-    if (fs81.existsSync(resultPath)) {
-      try {
-        const cached2 = JSON.parse(fs81.readFileSync(resultPath, "utf8"));
-        if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
-          cachedResult = cached2;
-        }
-      } catch {}
+    const cached2 = readCachedPhaseResult(resultPath);
+    if (cached2?.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
+      cachedResult = cached2;
     }
     if (cachedResult) {
       if (spec.phase === "hydrate") {
@@ -81404,7 +81884,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
       fs81.rmSync(temporary, { recursive: true, force: true });
     }
   }
-  const result2 = {
+  let result2 = {
     schema_version: SCHEMA_VERSION,
     cli_version: VERSION,
     phase: identity2.phase === "unknown" && expectedPhase ? expectedPhase : identity2.phase,
@@ -81422,6 +81902,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
     ...error2 ? { error: error2 } : {}
   };
   if (!resultPathValidated || !context?.logsOwned) {
+    result2 = compactOversizedResult(result2);
     return { exitCode: status === "succeeded" ? 0 : 1, result: result2 };
   }
   if (status === "succeeded" && validatedSpec?.phase === "evaluate") {
@@ -81435,6 +81916,8 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
       result2.error = stableError(budgetError);
     }
   }
+  result2 = compactOversizedResult(result2);
+  status = result2.status;
   try {
     writeJsonAtomic(resultPath, result2);
   } catch (writeError) {
@@ -81578,7 +82061,7 @@ function terminatePhase(child) {
   }
 }
 function createAnonymousSpecFd(bytes) {
-  const temporary = path89.join(os17.tmpdir(), `brainbase-benchmark-spec-${process.pid}-${crypto7.randomBytes(12).toString("hex")}`);
+  const temporary = path90.join(os17.tmpdir(), `brainbase-benchmark-spec-${process.pid}-${crypto7.randomBytes(12).toString("hex")}`);
   fs82.writeFileSync(temporary, bytes, { flag: "wx", mode: 384 });
   try {
     const fd = fs82.openSync(temporary, "r");
@@ -81782,13 +82265,13 @@ async function runBenchmark(sub, args, write = (value) => process.stdout.write(v
 function printHelp5() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors51.default.bold("brainbase benchmark")} ${import_picocolors51.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors52.default.bold("brainbase benchmark")} ${import_picocolors52.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors51.default.cyan("hydrate")} ${import_picocolors51.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors51.default.cyan("evaluate")} ${import_picocolors51.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors51.default.cyan("capabilities")} ${import_picocolors51.default.dim("--json")}`);
+  out.push(`  ${import_picocolors52.default.cyan("hydrate")} ${import_picocolors52.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors52.default.cyan("evaluate")} ${import_picocolors52.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors52.default.cyan("capabilities")} ${import_picocolors52.default.dim("--json")}`);
   out.push("");
-  out.push(`  ${import_picocolors51.default.dim("These machine-only commands execute versioned benchmark phase specs inside a task sandbox.")}`);
+  out.push(`  ${import_picocolors52.default.dim("These machine-only commands execute versioned benchmark phase specs inside a task sandbox.")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -81815,137 +82298,140 @@ var SUBCOMMAND_OWNED_FLAGS = {
 function help() {
   const out = [];
   out.push("");
-  out.push(`  ${brandTint("◆")}  ${import_picocolors52.default.bold("brainbase")}  ${import_picocolors52.default.dim(`v${VERSION}`)}`);
-  out.push(`     ${import_picocolors52.default.dim("connect your local agent to the brainbase platform")}`);
+  out.push(`  ${brandTint("◆")}  ${import_picocolors53.default.bold("brainbase")}  ${import_picocolors53.default.dim(`v${VERSION}`)}`);
+  out.push(`     ${import_picocolors53.default.dim("connect your local agent to the brainbase platform")}`);
   out.push("");
   out.push(divider("USAGE"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.bold("brainbase")} ${import_picocolors52.default.dim("<command> [options]")}`);
+  out.push(`  ${import_picocolors53.default.bold("brainbase")} ${import_picocolors53.default.dim("<command> [options]")}`);
   out.push("");
   out.push(divider("AUTH"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("login")}     ${import_picocolors52.default.dim("  open the web app and connect this device")}`);
-  out.push(`  ${import_picocolors52.default.cyan("logout")}    ${import_picocolors52.default.dim("  clear the local session")}`);
-  out.push(`  ${import_picocolors52.default.cyan("whoami")} ${import_picocolors52.default.dim("[--json]")} ${import_picocolors52.default.dim(" show which credential is in use and what it covers")}`);
+  out.push(`  ${import_picocolors53.default.cyan("login")}     ${import_picocolors53.default.dim("  open the web app and connect this device")}`);
+  out.push(`  ${import_picocolors53.default.cyan("logout")}    ${import_picocolors53.default.dim("  clear the local session")}`);
+  out.push(`  ${import_picocolors53.default.cyan("whoami")} ${import_picocolors53.default.dim("[--json]")} ${import_picocolors53.default.dim(" show which credential is in use and what it covers")}`);
   out.push("");
   out.push(divider("DISCOVERY"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("team list")}                  ${import_picocolors52.default.dim("show the teams you can create agents in")}`);
-  out.push(`  ${import_picocolors52.default.cyan("agent list")}                 ${import_picocolors52.default.dim("show a team's agents and their ids")}`);
+  out.push(`  ${import_picocolors53.default.cyan("team list")}                  ${import_picocolors53.default.dim("show the teams you can create agents in")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent list")}                 ${import_picocolors53.default.dim("show a team's agents and their ids")}`);
   out.push("");
   out.push(divider("LINKED AGENT"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("agent create")}               ${import_picocolors52.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors52.default.cyan("agent pull")} ${import_picocolors52.default.dim("[<id>]")}          ${import_picocolors52.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
-  out.push(`  ${import_picocolors52.default.cyan("agent push")}                 ${import_picocolors52.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors52.default.cyan("agent unpack")}               ${import_picocolors52.default.dim("install the claimed agent into a harness layout")}`);
-  out.push(`  ${import_picocolors52.default.cyan("link")}                       ${import_picocolors52.default.dim("attach this folder to an existing agent")}`);
-  out.push(`  ${import_picocolors52.default.cyan("agent status")}               ${import_picocolors52.default.dim("show what would pull and what would push")}`);
-  out.push(`  ${import_picocolors52.default.cyan("agent connections")}          ${import_picocolors52.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
-  out.push(`  ${import_picocolors52.default.cyan("agent connect")} ${import_picocolors52.default.dim("<name>")}       ${import_picocolors52.default.dim("connect slack or meeting from the terminal")}`);
-  out.push(`  ${import_picocolors52.default.cyan("agent disconnect")} ${import_picocolors52.default.dim("<name>")}    ${import_picocolors52.default.dim("revoke a slack or meeting install")}`);
-  out.push(`  ${import_picocolors52.default.cyan("agent env")}                  ${import_picocolors52.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
-  out.push(`  ${import_picocolors52.default.cyan("run")} ${import_picocolors52.default.dim("<cmd> [args...]")}         ${import_picocolors52.default.dim("run <cmd> with secrets.env loaded into env")}`);
-  out.push(`  ${import_picocolors52.default.cyan("status")}                     ${import_picocolors52.default.dim("show what this folder is linked to")}`);
-  out.push(`  ${import_picocolors52.default.cyan("unlink")}                     ${import_picocolors52.default.dim("disconnect this folder")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent init")}                 ${import_picocolors53.default.dim("write a starter brainbase.agent.yaml here — offline, no login needed")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent create")}               ${import_picocolors53.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent pull")} ${import_picocolors53.default.dim("[<id>]")}          ${import_picocolors53.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent push")}                 ${import_picocolors53.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent unpack")}               ${import_picocolors53.default.dim("install the claimed agent into a harness layout")}`);
+  out.push(`  ${import_picocolors53.default.cyan("link")}                       ${import_picocolors53.default.dim("attach this folder to an existing agent")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent status")}               ${import_picocolors53.default.dim("show what would pull and what would push")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent connections")}          ${import_picocolors53.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent connect")} ${import_picocolors53.default.dim("<name>")}       ${import_picocolors53.default.dim("connect slack or meeting from the terminal")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent disconnect")} ${import_picocolors53.default.dim("<name>")}    ${import_picocolors53.default.dim("revoke a slack or meeting install")}`);
+  out.push(`  ${import_picocolors53.default.cyan("agent env")}                  ${import_picocolors53.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
+  out.push(`  ${import_picocolors53.default.cyan("run")} ${import_picocolors53.default.dim("<cmd> [args...]")}         ${import_picocolors53.default.dim("run <cmd> with secrets.env loaded into env")}`);
+  out.push(`  ${import_picocolors53.default.cyan("status")}                     ${import_picocolors53.default.dim("show what this folder is linked to")}`);
+  out.push(`  ${import_picocolors53.default.cyan("unlink")}                     ${import_picocolors53.default.dim("disconnect this folder")}`);
   out.push("");
   out.push(divider("TASKS"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("task create")} ${import_picocolors52.default.dim("--message <text>")}   ${import_picocolors52.default.dim("create a managed task and start its first run")}`);
+  out.push(`  ${import_picocolors53.default.cyan("task create")} ${import_picocolors53.default.dim("--message <text>")}   ${import_picocolors53.default.dim("create a managed task and start its first run")}`);
   out.push("");
   out.push(divider("BENCHMARK RUNTIME"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("benchmark hydrate")} ${import_picocolors52.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors52.default.cyan("benchmark evaluate")} ${import_picocolors52.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors52.default.cyan("benchmark capabilities")} ${import_picocolors52.default.dim("--json")}`);
+  out.push(`  ${import_picocolors53.default.cyan("benchmark hydrate")} ${import_picocolors53.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors53.default.cyan("benchmark evaluate")} ${import_picocolors53.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors53.default.cyan("benchmark capabilities")} ${import_picocolors53.default.dim("--json")}`);
   out.push("");
   out.push(divider("ORCHESTRATIONS"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("orchestration create")}           ${import_picocolors52.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
-  out.push(`  ${import_picocolors52.default.cyan("orchestration list")}             ${import_picocolors52.default.dim("list orchestrations under a team")}`);
-  out.push(`  ${import_picocolors52.default.cyan("orchestration pull")} ${import_picocolors52.default.dim("<id>")}        ${import_picocolors52.default.dim("recursively fetch an orchestration + every member agent")}`);
-  out.push(`  ${import_picocolors52.default.cyan("orchestration push")}             ${import_picocolors52.default.dim("recursively push each member, then update the graph")}`);
-  out.push(`  ${import_picocolors52.default.cyan("orchestration status")}           ${import_picocolors52.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors53.default.cyan("orchestration create")}           ${import_picocolors53.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors53.default.cyan("orchestration list")}             ${import_picocolors53.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors53.default.cyan("orchestration pull")} ${import_picocolors53.default.dim("<id>")}        ${import_picocolors53.default.dim("recursively fetch an orchestration + every member agent")}`);
+  out.push(`  ${import_picocolors53.default.cyan("orchestration push")}             ${import_picocolors53.default.dim("recursively push each member, then update the graph")}`);
+  out.push(`  ${import_picocolors53.default.cyan("orchestration status")}           ${import_picocolors53.default.dim("show what would push and what would pull")}`);
   out.push("");
   out.push(divider("TEMPLATES"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("template pack")}                       ${import_picocolors52.default.dim("bundle the current agent into a template")}`);
-  out.push(`  ${import_picocolors52.default.cyan("template publish")}                    ${import_picocolors52.default.dim("upload a template to the registry")}`);
-  out.push(`  ${import_picocolors52.default.cyan("template search")} ${import_picocolors52.default.dim("[query]")}             ${import_picocolors52.default.dim("search the registry")}`);
-  out.push(`  ${import_picocolors52.default.cyan("template info")}    ${import_picocolors52.default.dim("<creator/slug>")}     ${import_picocolors52.default.dim("show registry details for a template")}`);
-  out.push(`  ${import_picocolors52.default.cyan("template onboard")} ${import_picocolors52.default.dim("<creator/slug>")}     ${import_picocolors52.default.dim("install (or refresh) a template")}`);
-  out.push(`  ${import_picocolors52.default.cyan("template list")}                       ${import_picocolors52.default.dim("show installed templates")}`);
-  out.push(`  ${import_picocolors52.default.cyan("template remove")}  ${import_picocolors52.default.dim("<creator/slug>")}     ${import_picocolors52.default.dim("uninstall a template")}`);
+  out.push(`  ${import_picocolors53.default.cyan("template pack")}                       ${import_picocolors53.default.dim("bundle the current agent into a template")}`);
+  out.push(`  ${import_picocolors53.default.cyan("template publish")}                    ${import_picocolors53.default.dim("upload a template to the registry")}`);
+  out.push(`  ${import_picocolors53.default.cyan("template search")} ${import_picocolors53.default.dim("[query]")}             ${import_picocolors53.default.dim("search the registry")}`);
+  out.push(`  ${import_picocolors53.default.cyan("template info")}    ${import_picocolors53.default.dim("<creator/slug>")}     ${import_picocolors53.default.dim("show registry details for a template")}`);
+  out.push(`  ${import_picocolors53.default.cyan("template onboard")} ${import_picocolors53.default.dim("<creator/slug>")}     ${import_picocolors53.default.dim("install (or refresh) a template")}`);
+  out.push(`  ${import_picocolors53.default.cyan("template list")}                       ${import_picocolors53.default.dim("show installed templates")}`);
+  out.push(`  ${import_picocolors53.default.cyan("template remove")}  ${import_picocolors53.default.dim("<creator/slug>")}     ${import_picocolors53.default.dim("uninstall a template")}`);
   out.push("");
   out.push(divider("SKILLS"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("skill add")} ${import_picocolors52.default.dim("<source>")}                  ${import_picocolors52.default.dim("install a skill (github / git / brainbase)")}`);
-  out.push(`  ${import_picocolors52.default.cyan("skill list")}                            ${import_picocolors52.default.dim("show locally installed skills + their source")}`);
-  out.push(`  ${import_picocolors52.default.cyan("skill update")} ${import_picocolors52.default.dim("<slug>")}                  ${import_picocolors52.default.dim("re-fetch a skill from its recorded source")}`);
-  out.push(`  ${import_picocolors52.default.cyan("skill remove")} ${import_picocolors52.default.dim("<slug>")}                  ${import_picocolors52.default.dim("uninstall a skill")}`);
-  out.push(`  ${import_picocolors52.default.cyan("skill search")} ${import_picocolors52.default.dim("[query]")}                 ${import_picocolors52.default.dim("search the brainbase skill registry")}`);
-  out.push(`  ${import_picocolors52.default.cyan("skill info")} ${import_picocolors52.default.dim("<creator/slug>")}            ${import_picocolors52.default.dim("show registry details for a skill")}`);
-  out.push(`  ${import_picocolors52.default.cyan("skill publish")} ${import_picocolors52.default.dim("[dir]")}                  ${import_picocolors52.default.dim("publish a SKILL.md folder (defaults to .)")}`);
+  out.push(`  ${import_picocolors53.default.cyan("skill add")} ${import_picocolors53.default.dim("<source>")}                  ${import_picocolors53.default.dim("install a skill (github / git / brainbase)")}`);
+  out.push(`  ${import_picocolors53.default.cyan("skill list")}                            ${import_picocolors53.default.dim("show locally installed skills + their source")}`);
+  out.push(`  ${import_picocolors53.default.cyan("skill update")} ${import_picocolors53.default.dim("<slug>")}                  ${import_picocolors53.default.dim("re-fetch a skill from its recorded source")}`);
+  out.push(`  ${import_picocolors53.default.cyan("skill remove")} ${import_picocolors53.default.dim("<slug>")}                  ${import_picocolors53.default.dim("uninstall a skill")}`);
+  out.push(`  ${import_picocolors53.default.cyan("skill search")} ${import_picocolors53.default.dim("[query]")}                 ${import_picocolors53.default.dim("search the brainbase skill registry")}`);
+  out.push(`  ${import_picocolors53.default.cyan("skill info")} ${import_picocolors53.default.dim("<creator/slug>")}            ${import_picocolors53.default.dim("show registry details for a skill")}`);
+  out.push(`  ${import_picocolors53.default.cyan("skill publish")} ${import_picocolors53.default.dim("[dir]")}                  ${import_picocolors53.default.dim("publish a SKILL.md folder (defaults to .)")}`);
   out.push("");
   out.push(divider("CLI TOKENS"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("token create")}                        ${import_picocolors52.default.dim("issue a long-lived CLI key for CI / scripts")}`);
-  out.push(`  ${import_picocolors52.default.cyan("token list")}                          ${import_picocolors52.default.dim("show your tokens")}`);
-  out.push(`  ${import_picocolors52.default.cyan("token rename")} ${import_picocolors52.default.dim("<id>")}                  ${import_picocolors52.default.dim("relabel a token")}`);
-  out.push(`  ${import_picocolors52.default.cyan("token revoke")} ${import_picocolors52.default.dim("<id>")}                  ${import_picocolors52.default.dim("revoke a token")}`);
+  out.push(`  ${import_picocolors53.default.cyan("token create")}                        ${import_picocolors53.default.dim("issue a long-lived CLI key for CI / scripts")}`);
+  out.push(`  ${import_picocolors53.default.cyan("token list")}                          ${import_picocolors53.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors53.default.cyan("token rename")} ${import_picocolors53.default.dim("<id>")}                  ${import_picocolors53.default.dim("relabel a token")}`);
+  out.push(`  ${import_picocolors53.default.cyan("token revoke")} ${import_picocolors53.default.dim("<id>")}                  ${import_picocolors53.default.dim("revoke a token")}`);
   out.push("");
   out.push(divider("MCP"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("mcp check")} ${import_picocolors52.default.dim("[--json]")}              ${import_picocolors52.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
-  out.push(`  ${import_picocolors52.default.cyan("mcp list")} ${import_picocolors52.default.dim("[--json]")}               ${import_picocolors52.default.dim("show configured servers with OAuth state and expiry")}`);
+  out.push(`  ${import_picocolors53.default.cyan("mcp check")} ${import_picocolors53.default.dim("[--json]")}              ${import_picocolors53.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
+  out.push(`  ${import_picocolors53.default.cyan("mcp list")} ${import_picocolors53.default.dim("[--json]")}               ${import_picocolors53.default.dim("show configured servers with OAuth state and expiry")}`);
   out.push("");
   out.push(divider("FLAGS"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
-  out.push(`  ${import_picocolors52.default.dim("--scope <s>")}        force scope: global | project`);
-  out.push(`  ${import_picocolors52.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
-  out.push(`  ${import_picocolors52.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly`);
-  out.push(`  ${import_picocolors52.default.dim("--message <text>")}   for task create: required first user message`);
-  out.push(`  ${import_picocolors52.default.dim("--title <text>")}     for task create: optional task title`);
-  out.push(`  ${import_picocolors52.default.dim("--model <id>")}       for task create: optional model override`);
-  out.push(`  ${import_picocolors52.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
-  out.push(`  ${import_picocolors52.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
-  out.push(`  ${import_picocolors52.default.dim("--json")}             machine-readable output for supported commands`);
-  out.push(`  ${import_picocolors52.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
-  out.push(`  ${import_picocolors52.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
-  out.push(`  ${import_picocolors52.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
-  out.push(`  ${import_picocolors52.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
-  out.push(`  ${import_picocolors52.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
-  out.push(`  ${import_picocolors52.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
-  out.push(`  ${import_picocolors52.default.dim("--all")}              for template list: include installs from other folders`);
-  out.push(`  ${import_picocolors52.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors53.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
+  out.push(`  ${import_picocolors53.default.dim("--scope <s>")}        force scope: global | project`);
+  out.push(`  ${import_picocolors53.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
+  out.push(`  ${import_picocolors53.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly`);
+  out.push(`  ${import_picocolors53.default.dim("--message <text>")}   for task create: required first user message`);
+  out.push(`  ${import_picocolors53.default.dim("--title <text>")}     for task create: optional task title`);
+  out.push(`  ${import_picocolors53.default.dim("--model <id>")}       for task create: optional model override`);
+  out.push(`  ${import_picocolors53.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
+  out.push(`  ${import_picocolors53.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
+  out.push(`  ${import_picocolors53.default.dim("--json")}             machine-readable output for supported commands`);
+  out.push(`  ${import_picocolors53.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
+  out.push(`  ${import_picocolors53.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
+  out.push(`  ${import_picocolors53.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
+  out.push(`  ${import_picocolors53.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
+  out.push(`  ${import_picocolors53.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
+  out.push(`  ${import_picocolors53.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
+  out.push(`  ${import_picocolors53.default.dim("--full")}             for agent init: write a commented template covering every block`);
+  out.push(`  ${import_picocolors53.default.dim("--minimal")}          for agent init: write the starter manifest (the default)`);
+  out.push(`  ${import_picocolors53.default.dim("--all")}              for template list: include installs from other folders`);
+  out.push(`  ${import_picocolors53.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
   out.push("");
   out.push(divider("ENV"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task create uses /v2/tasks)`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT; the only PAT control-plane commands accept (token.json is not read there)`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task create uses /v2/tasks)`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT; the only PAT control-plane commands accept (token.json is not read there)`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
   out.push("");
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
-  out.push(`  ${import_picocolors52.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
+  out.push(`  ${import_picocolors53.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
   out.push("");
   out.push(divider("HARNESSES"));
   out.push("");
-  out.push(`  ${import_picocolors52.default.dim("•")} ${import_picocolors52.default.bold("claude-code")}  ${import_picocolors52.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors52.default.dim("•")} ${import_picocolors52.default.bold("codex")}        ${import_picocolors52.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors52.default.dim("•")} ${import_picocolors52.default.bold("kafka")}        ${import_picocolors52.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors53.default.dim("•")} ${import_picocolors53.default.bold("claude-code")}  ${import_picocolors53.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors53.default.dim("•")} ${import_picocolors53.default.bold("codex")}        ${import_picocolors53.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors53.default.dim("•")} ${import_picocolors53.default.bold("kafka")}        ${import_picocolors53.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -82097,13 +82583,13 @@ async function requireAuth(cmd) {
   if (STORED_PAT_COMMANDS.has(cmd) && readToken())
     return;
   console.error("");
-  console.error(`  ${brandTint("◆")}  ${import_picocolors52.default.bold("brainbase")}`);
+  console.error(`  ${brandTint("◆")}  ${import_picocolors53.default.bold("brainbase")}`);
   console.error("");
-  console.error(`  ${import_picocolors52.default.red("✗")}  You need to sign in to use ${import_picocolors52.default.bold("brainbase " + cmd)}.`);
+  console.error(`  ${import_picocolors53.default.red("✗")}  You need to sign in to use ${import_picocolors53.default.bold("brainbase " + cmd)}.`);
   if (status.reason)
-    console.error(`     ${import_picocolors52.default.dim(status.reason)}`);
+    console.error(`     ${import_picocolors53.default.dim(status.reason)}`);
   console.error("");
-  console.error(`     Run ${import_picocolors52.default.cyan("brainbase login")} to connect this device.`);
+  console.error(`     Run ${import_picocolors53.default.cyan("brainbase login")} to connect this device.`);
   console.error("");
   process14.exit(1);
 }
@@ -82148,6 +82634,8 @@ async function main() {
   const noTracking = hasFlag2(sharedArgs, "--no-tracking");
   const track = hasFlag2(sharedArgs, "--track");
   const forceFlag = hasFlag2(sharedArgs, "--force");
+  const minimalFlag = hasFlag2(sharedArgs, "--minimal");
+  const fullFlag = hasFlag2(sharedArgs, "--full");
   const runEntrypointFlag = hasFlag2(sharedArgs, "--run-entrypoint");
   const graphOnlyFlag = hasFlag2(sharedArgs, "--graph-only");
   const nameFlag = takeFlag("--name");
@@ -82243,6 +82731,8 @@ async function main() {
           scope: scopeFlag,
           shell: shellFlag,
           harness,
+          minimal: minimalFlag,
+          full: fullFlag,
           name: nameFlag,
           tagline: taglineFlag,
           orgId: orgIdFlag,
@@ -82316,10 +82806,10 @@ async function main() {
         process14.exit(1);
     }
   } catch (err) {
-    console.error(import_picocolors52.default.red(`
+    console.error(import_picocolors53.default.red(`
 ${err.message}`));
     if (err instanceof ApiError && err.status === 401) {
-      console.error(`  Run ${import_picocolors52.default.cyan("brainbase login")} to connect this device.`);
+      console.error(`  Run ${import_picocolors53.default.cyan("brainbase login")} to connect this device.`);
     }
     if (process14.env.BRAINBASE_DEBUG)
       console.error(err.stack);