@brainbase-labs/cli 0.28.0 → 0.29.1

package/dist/index.js

@@ -35141,7 +35141,7 @@ var require_dist2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-var import_picocolors54 = __toESM(require_picocolors(), 1);
+var import_picocolors61 = __toESM(require_picocolors(), 1);
 import process14 from "node:process";
 import fs87 from "node:fs";
 
@@ -35949,6 +35949,16 @@ function me() {
   return new RegExp(r2, "g");
 }
 
+// src/ui/fail.ts
+function fail(message) {
+  f2.error(message);
+  process.exitCode = 1;
+}
+function failWarn(message) {
+  f2.warn(message);
+  process.exitCode = 1;
+}
+
 // src/cli/pack.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
 
@@ -36008,7 +36018,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.28.0",
+  version: "0.29.1",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -36024,7 +36034,7 @@ var package_default = {
     build: "bun run scripts/build.ts",
     test: "bun test",
     typecheck: "tsc --noEmit",
-    verify: "bun run typecheck && bun test && bun run build",
+    verify: "bun run scripts/check-bun-version.ts && bun run typecheck && bun test && bun run build",
     prepublishOnly: "bun run verify"
   },
   repository: {
@@ -36051,6 +36061,7 @@ var package_default = {
   dependencies: {
     "@modelcontextprotocol/sdk": "^1.18.2",
     "@clack/prompts": "^0.7.0",
+    eventsource: "^3.0.2",
     ink: "^5.1.0",
     picocolors: "^1.0.0",
     react: "^18.3.1",
@@ -36156,6 +36167,13 @@ function requireInteractive(flagHint) {
 function autoProceed(yes) {
   return Boolean(yes) || !isInteractive();
 }
+function autoProceedDestructive(yes, opts) {
+  if (yes)
+    return true;
+  if (isInteractive())
+    return false;
+  throw new NonInteractiveError(`${opts.action} is destructive and needs confirmation, but there is no interactive terminal to ask. ` + (opts.flagHint ?? "Pass --yes to confirm."));
+}
 
 // src/ui/symbols.ts
 var import_picocolors5 = __toESM(require_picocolors(), 1);
@@ -40951,7 +40969,7 @@ function acquireLock(lockFile, timeoutMs) {
 function acquireAuthLock() {
   const release = acquireLock(AUTH_LOCK_FILE, AUTH_LOCK_TIMEOUT_MS);
   if (!release) {
-    throw new Error(`Timed out waiting to update CLI authentication; if no other brainbase process is running, remove ${AUTH_LOCK_FILE}`);
+    throw new Error(`Timed out waiting to update CLI authentication.${lockHolderState(AUTH_LOCK_FILE)} Retry, or remove ${AUTH_LOCK_FILE}`);
   }
   return release;
 }
@@ -41003,10 +41021,44 @@ class AuthSessionChangedError extends Error {
     this.name = "AuthSessionChangedError";
   }
 }
+function heldFor(lockFile) {
+  try {
+    const ms = Date.now() - fs6.statSync(lockFile).mtimeMs;
+    if (!Number.isFinite(ms) || ms < 0)
+      return "";
+    if (ms < 60000)
+      return ` Held for ${Math.round(ms / 1000)}s.`;
+    if (ms < 3600000)
+      return ` Held for ${Math.round(ms / 60000)}m.`;
+    return ` Held for ${Math.round(ms / 3600000)}h.`;
+  } catch {
+    return "";
+  }
+}
+function lockHolderState(lockFile) {
+  let pid;
+  try {
+    pid = Number.parseInt(fs6.readFileSync(lockFile, "utf8").split(":")[0] ?? "", 10);
+  } catch {
+    return "";
+  }
+  if (!Number.isInteger(pid) || pid <= 0)
+    return "";
+  const age = heldFor(lockFile);
+  try {
+    process.kill(pid, 0);
+    return ` A process with pid ${pid} is running, so this may clear on its own — but pids get reused, so if that is not a brainbase command the lock is stale.${age}`;
+  } catch (error) {
+    if (error.code === "EPERM") {
+      return ` A process with pid ${pid} is running, so this may clear on its own — but pids get reused, so if that is not a brainbase command the lock is stale.${age}`;
+    }
+    return ` The process that held it (pid ${pid}) is gone, so this lock is stale and will not clear itself.${age}`;
+  }
+}
 
 class AuthRefreshLockTimeoutError extends Error {
   constructor() {
-    super(`Timed out waiting to refresh CLI authentication; retry, or if no other brainbase process is running, remove ${REFRESH_LOCK_FILE}`);
+    super(`Timed out waiting to refresh CLI authentication.${lockHolderState(REFRESH_LOCK_FILE)} Retry, or remove ${REFRESH_LOCK_FILE}`);
     this.name = "AuthRefreshLockTimeoutError";
   }
 }
@@ -53628,7 +53680,7 @@ async function runPack(cwd2) {
   packSpinner.stop(`Packed ${packed.length} component${packed.length === 1 ? "" : "s"}.`);
   const dest = registry.templateDir(name, version);
   if (exists(dest)) {
-    f2.error(`A template at ${name}@${version} already exists. Bump the version.`);
+    fail(`A template at ${name}@${version} already exists. Bump the version.`);
     $e("Aborted.");
     return;
   }
@@ -53872,7 +53924,7 @@ var StoredTokenSchema = exports_external.object({
 function withTokenLock(operation) {
   const release = acquireLock(TOKEN_LOCK_FILE, TOKEN_LOCK_TIMEOUT_MS);
   if (!release) {
-    throw new Error(`Timed out waiting to update the local CLI token; if no other brainbase process is running, remove ${TOKEN_LOCK_FILE}`);
+    throw new Error(`Timed out waiting to update the local CLI token.${lockHolderState(TOKEN_LOCK_FILE)} Retry, or remove ${TOKEN_LOCK_FILE}`);
   }
   try {
     return operation();
@@ -54017,6 +54069,8 @@ var DEFINITELY_UNSENT_NETWORK_CODES = new Set([
   "FailedToOpenSocket",
   "UND_ERR_CONNECT_TIMEOUT"
 ]);
+var LEGACY_DEFAULT_PAGE = 200;
+var LEGACY_MAX_PAGE = 500;
 
 class ApiError extends Error {
   status;
@@ -54354,6 +54408,127 @@ async function masRequest(pathname, init) {
     return body;
   }
 }
+async function masReadRequest(pathname, callerSignal) {
+  const credential = await resolveMasCredential();
+  let currentSession = credential.session;
+  let refreshSessionAvailable = credential.source === "session";
+  let res;
+  let text2;
+  for (let attempt2 = 0;; attempt2 += 1) {
+    if (callerSignal?.aborted)
+      throw callerSignal.reason;
+    try {
+      res = await sendWithAuthRetry(refreshSessionAvailable ? currentSession : null, async (refreshed) => {
+        if (refreshed) {
+          currentSession = refreshed;
+          refreshSessionAvailable = false;
+        }
+        return await sendRequest(`${masApiBase(currentSession)}${pathname}`, {
+          method: "GET",
+          signal: withRequestDeadline(callerSignal, MAS_REQUEST_TIMEOUT_MS)
+        }, currentSession?.access_token ?? credential.bearer);
+      });
+      try {
+        text2 = await res.text();
+      } catch (error) {
+        throw new NetworkApiError(`Network error while reading response: ${error.message}`, false);
+      }
+      break;
+    } catch (error) {
+      if (callerSignal?.aborted || !(error instanceof NetworkApiError) || attempt2 >= GET_NETWORK_RETRY_DELAYS_MS.length) {
+        throw error;
+      }
+      await new Promise((resolve) => setTimeout(resolve, GET_NETWORK_RETRY_DELAYS_MS[attempt2]));
+    }
+  }
+  let body = text2;
+  try {
+    body = text2 ? JSON.parse(text2) : null;
+  } catch {}
+  if (!res.ok) {
+    const message = masApiErrorMessage(body, res.status);
+    throw new ApiError(res.status === 401 ? withRejectedSessionHint(message, credential.source, "managed-task") : message, res.status, body);
+  }
+  return body;
+}
+function withRequestDeadline(callerSignal, timeoutMs) {
+  const deadline = AbortSignal.timeout(timeoutMs);
+  if (!callerSignal)
+    return deadline;
+  if (callerSignal.aborted)
+    return callerSignal;
+  const combined = new AbortController;
+  const abort = (reason) => combined.abort(reason);
+  deadline.addEventListener("abort", () => abort(deadline.reason), { once: true });
+  callerSignal.addEventListener("abort", () => abort(callerSignal.reason), {
+    once: true
+  });
+  return combined.signal;
+}
+async function masResourceRequest(pathname, init = {}) {
+  const credential = await resolveMasCredential();
+  let currentSession = credential.session;
+  const res = await sendWithAuthRetry(credential.source === "session" ? currentSession : null, async (refreshed) => {
+    if (refreshed)
+      currentSession = refreshed;
+    return await sendRequest(`${masApiBase(currentSession)}${pathname}`, {
+      ...init,
+      signal: withRequestDeadline(init.signal ?? undefined, MAS_REQUEST_TIMEOUT_MS)
+    }, currentSession?.access_token ?? credential.bearer);
+  });
+  let text2;
+  try {
+    text2 = await res.text();
+  } catch (error) {
+    throw new NetworkApiError(`Network error while reading response: ${error.message}`, false);
+  }
+  let body = text2;
+  try {
+    body = text2 ? JSON.parse(text2) : null;
+  } catch {}
+  if (!res.ok) {
+    const message = masApiErrorMessage(body, res.status);
+    throw new ApiError(res.status === 401 ? withRejectedSessionHint(message, credential.source, "managed-task") : res.status === 404 && isUnroutedPath(body) ? `This control plane does not serve ${pathname} yet. Update the server, or use the web app.` : message, res.status, body);
+  }
+  return body;
+}
+
+class StreamHostMovedError extends ApiError {
+}
+async function masStreamTarget(pathname) {
+  const credential = await resolveMasCredential();
+  const base2 = masApiBase(credential.session);
+  return {
+    url: `${base2}${pathname}`,
+    resolveBearer: async () => {
+      const fresh = await resolveMasCredential();
+      const freshBase = masApiBase(fresh.session);
+      if (freshBase !== base2) {
+        throw new StreamHostMovedError(`The control plane moved from ${base2} to ${freshBase} while this stream was open, so the current credential was not sent. Re-run the command to follow against the new host.`);
+      }
+      return fresh.session?.access_token ?? fresh.bearer;
+    }
+  };
+}
+function masListQuery(params) {
+  const search = new URLSearchParams;
+  for (const [key2, value] of Object.entries(params)) {
+    if (value !== undefined)
+      search.set(key2, value);
+  }
+  const qs = search.toString();
+  return qs ? `?${qs}` : "";
+}
+function masItems(body, what) {
+  if (Array.isArray(body))
+    return body;
+  if (body && typeof body === "object") {
+    const items = body.items;
+    if (Array.isArray(items))
+      return items;
+  }
+  throw new ApiError(`MAS returned an unreadable ${what} response.`, undefined, body);
+}
 var masApi = {
   async createTask(input, options) {
     const body = await masRequest("/tasks", {
@@ -54362,6 +54537,49 @@ var masApi = {
       body: JSON.stringify(input)
     });
     return parseMasTaskCreateResponse(body);
+  },
+  async listTasks(options = {}) {
+    const params = new URLSearchParams;
+    if (options.agentId)
+      params.set("agent_id", options.agentId);
+    if (options.limit !== undefined)
+      params.set("limit", String(options.limit));
+    const qs = params.toString() ? `?${params.toString()}` : "";
+    return masItems(await masReadRequest(`/tasks${qs}`), "task list");
+  },
+  async getTask(taskId, options = {}) {
+    const body = await masReadRequest(`/tasks/${encodeURIComponent(taskId)}`, options.signal);
+    if (!body || typeof body !== "object" || typeof body.id !== "string" || typeof body.status !== "string") {
+      throw new ApiError("MAS returned an unreadable task response.", undefined, body);
+    }
+    return body;
+  },
+  async listTaskEvents(taskId, options = {}) {
+    const params = new URLSearchParams({ order_by_received: "true" });
+    if (options.limit !== undefined)
+      params.set("limit", String(options.limit));
+    if (options.after) {
+      params.set("after_received_at", options.after.receivedAt);
+      params.set("after_id", options.after.id);
+    }
+    if (options.desc !== undefined)
+      params.set("desc", String(options.desc));
+    const body = await masReadRequest(`/tasks/${encodeURIComponent(taskId)}/events?${params.toString()}`);
+    return masItems(body, "task events");
+  },
+  async listMachines(options = {}) {
+    const body = await masResourceRequest(`/machines${masListQuery({
+      kind: options.kind,
+      include_dead: options.includeDead === undefined ? undefined : String(options.includeDead),
+      limit: options.limit === undefined ? undefined : String(options.limit)
+    })}`);
+    if (!body || !Array.isArray(body.items)) {
+      throw new ApiError("The control plane returned an unreadable machine list", undefined, body);
+    }
+    return body.items;
+  },
+  deleteMachine(machineId) {
+    return masResourceRequest(`/machines/${encodeURIComponent(machineId)}`, { method: "DELETE" });
   }
 };
 function isUnroutedPath(body) {
@@ -54391,20 +54609,48 @@ var api = {
     });
   },
   async listAgents(orgId, teamId) {
-    const path58 = `/orgs/${encodeURIComponent(orgId)}/teams/${encodeURIComponent(teamId)}/agents`;
-    let body;
+    const base2 = `/orgs/${encodeURIComponent(orgId)}/teams/${encodeURIComponent(teamId)}/agents`;
+    const fetchPage = async (limit) => {
+      const path58 = limit === undefined ? base2 : `${base2}?limit=${limit}`;
+      let body;
+      try {
+        body = await request(path58);
+      } catch (err) {
+        if (err instanceof ApiError && err.status === 404) {
+          throw new ApiError("This control plane does not support listing agents yet. Update the server, or use the web app to find the agent id.", 404, err.body);
+        }
+        throw err;
+      }
+      if (!Array.isArray(body)) {
+        throw new ApiError(`Unexpected response listing agents: expected an array from ${path58}.`, undefined, body);
+      }
+      return body;
+    };
+    const agents = await fetchPage();
+    if (agents.length !== LEGACY_DEFAULT_PAGE)
+      return { agents, complete: true };
+    let retried;
     try {
-      body = await request(path58);
+      retried = await fetchPage(LEGACY_MAX_PAGE);
     } catch (err) {
-      if (err instanceof ApiError && err.status === 404) {
-        throw new ApiError("This control plane does not support listing agents yet. Update the server, or use the web app to find the agent id.", 404, err.body);
+      if (err instanceof ApiError && (err.status === 401 || err.status === 403)) {
+        throw err;
       }
-      throw err;
-    }
-    if (!Array.isArray(body)) {
-      throw new ApiError(`Unexpected response listing agents: expected an array from ${path58}.`, undefined, body);
+      const detail = err instanceof Error ? err.message : String(err);
+      return {
+        agents,
+        complete: false,
+        warning: `Warning: showing ${agents.length} agents, and could not confirm that is all of them — ` + `the follow-up request failed (${detail}). ` + "Re-run to check; if it keeps failing, the control plane may need updating."
+      };
     }
-    return body;
+    const best = retried.length > agents.length ? retried : agents;
+    if (best.length < LEGACY_MAX_PAGE)
+      return { agents: best, complete: true };
+    return {
+      agents: best,
+      complete: false,
+      warning: `Warning: this control plane caps agent listings at ${best.length} and offers no way ` + "to read past that, so this list may be incomplete. Update the control plane to see every agent."
+    };
   },
   createAgent(input) {
     if (usesLegacyControlPlane() && (input.machine_kind !== undefined || input.default_model !== undefined)) {
@@ -58918,7 +59164,7 @@ async function runOnboard(cwd2, args) {
   try {
     templateRef = await resolveWithRemoteFallback(registry, name, version);
   } catch (err) {
-    f2.error(err.message);
+    fail(err.message);
     $e("Aborted.");
     return;
   }
@@ -59380,7 +59626,10 @@ async function runRemove(cwd2, args) {
         text: c2.slug
       }))
     });
-    if (!autoProceed(args.yes)) {
+    if (!autoProceedDestructive(args.yes, {
+      action: `Uninstalling ${inst.name}@${inst.version} from ${inst.harness} (${inst.scope})`,
+      flagHint: "Pass --yes to uninstall without a prompt."
+    })) {
       const ans = await se({ message: "Proceed?", initialValue: true });
       if (!ensureNotCancelled(ans))
         continue;
@@ -59842,11 +60091,11 @@ async function publishSkillForTemplate(opts) {
   try {
     probe = await skillsApi.canPublish(creator, pkgSlug);
   } catch (err) {
-    f2.error(err.message);
+    fail(err.message);
     return false;
   }
   if (probe.exists && !probe.can_write) {
-    f2.error(`You can't publish to ${import_picocolors11.default.bold(creator + "/" + pkgSlug)}.`);
+    fail(`You can't publish to ${import_picocolors11.default.bold(creator + "/" + pkgSlug)}.`);
     return false;
   }
   if (!probe.exists) {
@@ -59862,7 +60111,7 @@ async function publishSkillForTemplate(opts) {
       });
     } catch (err) {
       if (!(err instanceof ApiError && err.status === 409)) {
-        f2.error(err.message);
+        fail(err.message);
         return false;
       }
     }
@@ -59895,7 +60144,7 @@ async function publishSkillForTemplate(opts) {
       sp.stop(`Published ${creator}/${pkgSlug}@${version}.`);
     } catch (err) {
       sp.stop("Skill publish failed.");
-      f2.error(err.message);
+      fail(err.message);
       return false;
     }
   } finally {
@@ -59916,7 +60165,7 @@ async function runTemplatePublish(_cwd, args) {
   const registry = new LocalRegistry;
   const localList = await registry.list();
   if (localList.length === 0) {
-    f2.error("No templates in your local registry. Run `brainbase template pack` first.");
+    fail("No templates in your local registry. Run `brainbase template pack` first.");
     return;
   }
   let name;
@@ -59926,7 +60175,7 @@ async function runTemplatePublish(_cwd, args) {
     name = parsed.name;
     const v3 = parsed.version ?? await registry.latest(name);
     if (!v3) {
-      f2.error(`No versions of ${name} in your local registry.`);
+      fail(`No versions of ${name} in your local registry.`);
       return;
     }
     version = v3;
@@ -59965,7 +60214,7 @@ async function runTemplatePublish(_cwd, args) {
 `), import_picocolors11.default.yellow("Findings"));
   }
   if (report.hasBlocker) {
-    f2.error("Blocking issues found. Fix them and re-pack before publishing.");
+    fail("Blocking issues found. Fix them and re-pack before publishing.");
     return;
   }
   if (report.findings.some((f4) => f4.severity === "warn") && !autoProceed(args.yes)) {
@@ -59980,7 +60229,7 @@ async function runTemplatePublish(_cwd, args) {
   }
   const status = authStatus();
   if (!status.ok || !status.session) {
-    f2.error("Not logged in. Run `brainbase login` first.");
+    fail("Not logged in. Run `brainbase login` first.");
     return;
   }
   const me3 = status.session;
@@ -60024,6 +60273,7 @@ async function runTemplatePublish(_cwd, args) {
   }
   const skillEntries = ref.manifest.components.filter((c2) => c2.type === "skill");
   let manifestMutated = false;
+  const inlinedAfterFailure = [];
   for (const entry of skillEntries) {
     const src = entry.source ?? { type: "inline" };
     if (src.type === "github" || src.type === "git" || src.type === "brainbase") {
@@ -60051,6 +60301,8 @@ async function runTemplatePublish(_cwd, args) {
     });
     if (ok)
       manifestMutated = true;
+    else
+      inlinedAfterFailure.push(entry.slug);
   }
   if (manifestMutated) {
     fs57.writeFileSync(path65.join(ref.rootDir, "brainbase.json"), JSON.stringify(ref.manifest, null, 2));
@@ -60064,7 +60316,7 @@ async function runTemplatePublish(_cwd, args) {
     await pack({ rootDir: ref.rootDir, outFile: tarPath });
   } catch (err) {
     buildSpinner.stop("Bundle failed.");
-    f2.error(err.message);
+    fail(err.message);
     return;
   }
   const sha = await sha256OfFile(tarPath);
@@ -60141,15 +60393,25 @@ async function runTemplatePublish(_cwd, args) {
       fs57.rmSync(tmpDir, { recursive: true, force: true });
     } catch {}
   }
-  $e(`${import_picocolors11.default.bold(name)}@${version} published.`);
+  const partial2 = inlinedAfterFailure.length > 0;
+  if (partial2) {
+    const plural = inlinedAfterFailure.length === 1 ? "" : "s";
+    f2.warn(`${import_picocolors11.default.bold(name)}@${version} published, but ${inlinedAfterFailure.length} skill${plural} never reached the registry and shipped inline instead: ${inlinedAfterFailure.map((s3) => import_picocolors11.default.bold(s3)).join(", ")}. Re-run ${import_picocolors11.default.cyan("brainbase skill publish")} for ${inlinedAfterFailure.length === 1 ? "it" : "them"}, then publish the template again to swap the inline bytes for a reference.`);
+    $e(`${import_picocolors11.default.bold(name)}@${version} published with ${inlinedAfterFailure.length} skill failure${plural}.`);
+  } else {
+    $e(`${import_picocolors11.default.bold(name)}@${version} published.`);
+  }
   await showResultCard({
-    title: "PUBLISHED",
-    tone: "ok",
+    title: partial2 ? "PUBLISHED (PARTIAL)" : "PUBLISHED",
+    tone: partial2 ? "warn" : "ok",
     subtitle: `${name}@${version}`,
     meta: [
       ["id", result2.id],
       ["sha256", sha],
       ["visibility", visibility],
+      ...partial2 ? [
+        ["skills inlined after failure", inlinedAfterFailure.join(", ")]
+      ] : [],
       ...visibility === "public" ? [["note", "Quarantined for review on first public publish."]] : []
     ],
     hint: `brainbase template info ${name}`
@@ -60440,7 +60702,7 @@ async function runTemplateInfo(args) {
   const { name, version } = parseRef2(args.ref);
   const [creator, slug] = name.split("/");
   if (!creator || !slug) {
-    f2.error("Expected creator/slug.");
+    fail("Expected creator/slug.");
     return;
   }
   const spinner = de();
@@ -60748,17 +61010,17 @@ async function runSkillAdd(cwd2, args) {
   ensureSkillResolversRegistered();
   const source = parseSkillSource(args.source);
   if (source.type === "local" || source.type === "inline") {
-    f2.error(`${describeSource(source)} sources are not fetchable. Use a github / git / brainbase source.`);
+    fail(`${describeSource(source)} sources are not fetchable. Use a github / git / brainbase source.`);
     return;
   }
   const resolver = getSkillResolver(source.type);
   if (!resolver) {
-    f2.error(`No resolver registered for ${source.type}.`);
+    fail(`No resolver registered for ${source.type}.`);
     return;
   }
   const slug = args.as ?? defaultSkillSlug(source);
   if (!/^[a-zA-Z0-9_-]+$/.test(slug)) {
-    f2.error(`Invalid slug ${import_picocolors13.default.bold(slug)}; pass --as <slug>.`);
+    fail(`Invalid slug ${import_picocolors13.default.bold(slug)}; pass --as <slug>.`);
     return;
   }
   let adapterId = args.harness;
@@ -60793,7 +61055,10 @@ async function runSkillAdd(cwd2, args) {
   const skillsRoot = skillsRootFor(adapterId, cwd2, scope);
   const dest = path68.join(skillsRoot, slug);
   if (exists(dest)) {
-    if (!autoProceed(args.yes)) {
+    if (!autoProceedDestructive(args.yes, {
+      action: `Overwriting the existing skill at ${dest}`,
+      flagHint: "Pass --yes to overwrite it without a prompt."
+    })) {
       const confirm = await se({
         message: `${import_picocolors13.default.bold(slug)} already exists at ${dest}. Overwrite?`,
         initialValue: false
@@ -60813,7 +61078,7 @@ async function runSkillAdd(cwd2, args) {
     sp.stop("Fetched.");
   } catch (err) {
     sp.stop("Fetch failed.");
-    f2.error(err.message);
+    fail(err.message);
     return;
   }
   writeSkillMarker(dest, source);
@@ -60908,7 +61173,10 @@ async function runSkillRemove(cwd2, args) {
     });
     target = candidates[Number(choice)];
   }
-  if (!autoProceed(args.yes)) {
+  if (!autoProceedDestructive(args.yes, {
+    action: `Deleting ${target.dir}`,
+    flagHint: "Pass --yes to delete it without a prompt."
+  })) {
     const ok = await se({
       message: `Delete ${import_picocolors15.default.bold(target.dir)}?`,
       initialValue: false
@@ -60937,11 +61205,11 @@ async function runSkillPublish(cwd2, args) {
   banner("skill publish — send a skill to the registry");
   const skillDir = path71.resolve(cwd2, args.dir ?? ".");
   if (!exists(skillDir) || !fs63.statSync(skillDir).isDirectory()) {
-    f2.error(`Not a directory: ${import_picocolors16.default.bold(skillDir)}`);
+    fail(`Not a directory: ${import_picocolors16.default.bold(skillDir)}`);
     return;
   }
   if (!exists(path71.join(skillDir, "SKILL.md"))) {
-    f2.error(`No ${import_picocolors16.default.bold("SKILL.md")} in ${import_picocolors16.default.bold(skillDir)}. Point at a folder that contains one, or create the file first.`);
+    fail(`No ${import_picocolors16.default.bold("SKILL.md")} in ${import_picocolors16.default.bold(skillDir)}. Point at a folder that contains one, or create the file first.`);
     return;
   }
   const folderSlug = path71.basename(skillDir).toLowerCase();
@@ -60955,12 +61223,12 @@ async function runSkillPublish(cwd2, args) {
   }
   let name = args.name ?? suggestedName;
   if (name && !parseName(name)) {
-    f2.error(`Invalid --name "${name}". Use creator/slug.`);
+    fail(`Invalid --name "${name}". Use creator/slug.`);
     return;
   }
   if (!name) {
     if (args.yes) {
-      f2.error("Non-interactive publish (--yes) requires --name <creator/slug>.");
+      fail("Non-interactive publish (--yes) requires --name <creator/slug>.");
       return;
     }
     const ans = await text({
@@ -60975,12 +61243,12 @@ async function runSkillPublish(cwd2, args) {
   const { creator, slug: pkgSlug } = parseName(name);
   let version = args.version;
   if (version && !/^\d+\.\d+\.\d+$/.test(version)) {
-    f2.error(`Invalid --skill-version "${version}". Use MAJOR.MINOR.PATCH.`);
+    fail(`Invalid --skill-version "${version}". Use MAJOR.MINOR.PATCH.`);
     return;
   }
   if (!version) {
     if (args.yes) {
-      f2.error("Non-interactive publish (--yes) requires --skill-version <MAJOR.MINOR.PATCH>.");
+      fail("Non-interactive publish (--yes) requires --skill-version <MAJOR.MINOR.PATCH>.");
       return;
     }
     const ans = await text({
@@ -60995,17 +61263,17 @@ async function runSkillPublish(cwd2, args) {
   try {
     probe = await skillsApi.canPublish(creator, pkgSlug);
   } catch (err) {
-    f2.error(`can-publish probe failed: ${err.message}`);
+    fail(`can-publish probe failed: ${err.message}`);
     return;
   }
   if (probe.exists && !probe.can_write) {
-    f2.error(`You can't publish to ${import_picocolors16.default.bold(creator + "/" + pkgSlug)}. Pick a name you own.`);
+    fail(`You can't publish to ${import_picocolors16.default.bold(creator + "/" + pkgSlug)}. Pick a name you own.`);
     return;
   }
   if (!probe.exists) {
     const status = authStatus();
     if (!status.ok || !status.session) {
-      f2.error("Not logged in. Run `brainbase login` first.");
+      fail("Not logged in. Run `brainbase login` first.");
       return;
     }
     let owner;
@@ -61052,7 +61320,7 @@ async function runSkillPublish(cwd2, args) {
       });
     } catch (err) {
       if (err instanceof ApiError && err.status === 409) {} else {
-        f2.error(err.message);
+        fail(err.message);
         return;
       }
     }
@@ -61062,7 +61330,7 @@ async function runSkillPublish(cwd2, args) {
   try {
     const files = collectSkillFiles(skillDir).filter((f4) => f4 !== SKILL_MARKER_FILE);
     if (files.length === 0) {
-      f2.error("Skill folder is empty.");
+      fail("Skill folder is empty.");
       return;
     }
     const buildSp = de();
@@ -61194,7 +61462,7 @@ async function runSkillUpdate(cwd2, args) {
       candidates.push({ harness: r2.harness, scope: r2.scope, dir });
   }
   if (candidates.length === 0) {
-    f2.warn(`No skill named ${import_picocolors17.default.bold(args.slug)} found.`);
+    failWarn(`No skill named ${import_picocolors17.default.bold(args.slug)} found.`);
     return;
   }
   let target = candidates[0];
@@ -61211,16 +61479,16 @@ async function runSkillUpdate(cwd2, args) {
   }
   const marker = readSkillMarker(target.dir);
   if (!marker) {
-    f2.error("No marker file. Skills without provenance can't be updated automatically.");
+    fail("No marker file. Skills without provenance can't be updated automatically.");
     return;
   }
   if (marker.source.type === "inline" || marker.source.type === "local") {
-    f2.error(`Skill source is ${describeSource(marker.source)} — nothing to update from.`);
+    fail(`Skill source is ${describeSource(marker.source)} — nothing to update from.`);
     return;
   }
   const resolver = getSkillResolver(marker.source.type);
   if (!resolver) {
-    f2.error(`No resolver for ${marker.source.type}.`);
+    fail(`No resolver for ${marker.source.type}.`);
     return;
   }
   if (!autoProceed(args.yes)) {
@@ -61241,7 +61509,7 @@ async function runSkillUpdate(cwd2, args) {
     sp.stop("Fetched.");
   } catch (err) {
     sp.stop("Fetch failed.");
-    f2.error(err.message);
+    fail(err.message);
     return;
   }
   writeSkillMarker(target.dir, marker.source, marker.component);
@@ -62176,9 +62444,7 @@ var EvalSchema = exports_external.object({
   path: ["classification_values"]
 });
 var MODEL_ID_RE = /^[A-Za-z0-9._:/-]{1,128}$/;
-var UNSYNCED_MANIFEST_KEYS = ["commands", "hooks", "files"];
 var UnsyncedBlockSchema = exports_external.array(exports_external.record(exports_external.unknown())).optional();
-var UnsyncedBlocksShape = Object.fromEntries(UNSYNCED_MANIFEST_KEYS.map((key2) => [key2, UnsyncedBlockSchema]));
 var AgentManifestSchema = exports_external.object({
   schema: exports_external.literal(1),
   id: exports_external.string().min(1).optional(),
@@ -62205,8 +62471,29 @@ var AgentManifestSchema = exports_external.object({
     });
   }).default([]),
   capabilities: CapabilitiesSchema.optional(),
-  ...UnsyncedBlocksShape
+  commands: UnsyncedBlockSchema,
+  hooks: UnsyncedBlockSchema,
+  files: UnsyncedBlockSchema
 });
+var MANIFEST_KEY_SYNC = {
+  schema: "local",
+  id: "synced",
+  harness: "synced",
+  machine_kind: "synced",
+  default_model: "synced",
+  agent: "synced",
+  instructions: "synced",
+  entrypoint: "synced",
+  playbooks: "synced",
+  skills: "synced",
+  mcp: "synced",
+  evals: "synced",
+  capabilities: "synced",
+  commands: "unsynced",
+  hooks: "unsynced",
+  files: "unsynced"
+};
+var UNSYNCED_MANIFEST_KEYS = Object.keys(AgentManifestSchema.shape).filter((key2) => (MANIFEST_KEY_SYNC[key2] ?? "unsynced") === "unsynced");
 function manifestPath(cwd2) {
   return path73.join(cwd2, AGENT_MANIFEST_FILE);
 }
@@ -62879,7 +63166,10 @@ async function handleAlreadyLinked(cwd2, link2, args) {
     return;
   }
   if (next === "unlink") {
-    if (!autoProceed(args.yes)) {
+    if (!autoProceedDestructive(args.yes, {
+      action: `Unlinking this folder from ${link2.name}`,
+      flagHint: "Pass --yes to unlink without a prompt."
+    })) {
       const confirmed = await se({
         message: "Remove the link from this folder? (the cloud agent will stay)",
         initialValue: true
@@ -62901,7 +63191,10 @@ async function handleAlreadyLinked(cwd2, link2, args) {
     flagHint: "Pass --agent <id>."
   });
   const newId = ans.trim();
-  if (!autoProceed(args.yes)) {
+  if (!autoProceedDestructive(args.yes, {
+    action: `Replacing this folder's link to ${link2.name} with ${newId}`,
+    flagHint: "Pass --yes to re-link without a prompt."
+  })) {
     const confirmed = await se({
       message: "This will replace the current link. Continue?",
       initialValue: false
@@ -63072,7 +63365,10 @@ async function runUnlink(cwd2, args) {
     return;
   }
   f2.info(`Currently linked to ${import_picocolors23.default.bold(link2.name)} ${import_picocolors23.default.dim(`(${link2.slug})`)}.`);
-  if (!autoProceed(args.yes)) {
+  if (!autoProceedDestructive(args.yes, {
+    action: `Unlinking this folder from ${link2.name}`,
+    flagHint: "Pass --yes to unlink without a prompt."
+  })) {
     const ok = await se({
       message: "Remove the link from this folder? (the cloud agent will stay)",
       initialValue: true
@@ -63366,7 +63662,7 @@ async function runSync(cwd2, args) {
   banner("sync — bring in the latest changes from your team");
   const link2 = readLink(cwd2);
   if (!link2) {
-    f2.warn("This folder is not linked to any agent.");
+    failWarn("This folder is not linked to any agent.");
     f2.info(`Run ${import_picocolors24.default.cyan("brainbase link")} first.`);
     return;
   }
@@ -63379,9 +63675,9 @@ async function runSync(cwd2, args) {
   } catch (err) {
     manifestSpinner.stop("Failed.");
     if (err instanceof ApiError && err.status === 401) {
-      f2.error("Your session is invalid. Run `brainbase login` and try again.");
+      fail("Your session is invalid. Run `brainbase login` and try again.");
     } else {
-      f2.error(err.message);
+      fail(err.message);
     }
     return;
   }
@@ -64418,7 +64714,7 @@ function componentsForNativeInstall(components, acp) {
 async function runAgentUnpack(cwd2, args) {
   banner("agent unpack — install this agent into a harness layout");
   if (!hasManifest(cwd2)) {
-    f2.error(`No ${import_picocolors25.default.bold(AGENT_MANIFEST_FILE)} here.`);
+    fail(`No ${import_picocolors25.default.bold(AGENT_MANIFEST_FILE)} here.`);
     f2.info(`Run ${import_picocolors25.default.cyan("brainbase agent pull <id>")} to bring an agent into this folder first.`);
     return;
   }
@@ -64431,7 +64727,7 @@ async function runAgentUnpack(cwd2, args) {
     return;
   }
   if (!manifest.id) {
-    f2.error(`${import_picocolors25.default.bold(AGENT_MANIFEST_FILE)} is unclaimed (no ${import_picocolors25.default.cyan("id")}).`);
+    fail(`${import_picocolors25.default.bold(AGENT_MANIFEST_FILE)} is unclaimed (no ${import_picocolors25.default.cyan("id")}).`);
     f2.info(`Run ${import_picocolors25.default.cyan("brainbase agent create")} to claim it, ` + `or ${import_picocolors25.default.cyan("brainbase agent pull <id>")} to link it to an existing agent.`);
     return;
   }
@@ -64440,7 +64736,7 @@ async function runAgentUnpack(cwd2, args) {
     harness = normalizeHarnessId(args.harness);
   } else if (args.yes) {
     if (!manifest.harness) {
-      f2.error(`--yes mode but no harness — set ${import_picocolors25.default.cyan("harness")} in the manifest or pass ${import_picocolors25.default.cyan("--harness")}.`);
+      fail(`--yes mode but no harness — set ${import_picocolors25.default.cyan("harness")} in the manifest or pass ${import_picocolors25.default.cyan("--harness")}.`);
       return;
     }
     harness = normalizeHarnessId(manifest.harness);
@@ -64540,7 +64836,7 @@ async function runAgentUnpack(cwd2, args) {
       runHarnessRemoveMcp(harness, builtinRemoveSlugs, { cwd: cwd2, scope });
     }
   } catch (err) {
-    f2.error(`Install failed: ${err.message}`);
+    fail(`Install failed: ${err.message}`);
     return;
   } finally {
     try {
@@ -64989,7 +65285,7 @@ function resolveTargetAgentId(cwd2, args) {
   const manifestId = manifest?.id;
   if (arg && manifestId && arg !== manifestId) {
     if (!args.force) {
-      f2.error(`This folder is already linked to a different agent (${import_picocolors26.default.dim(manifestId)}).`);
+      fail(`This folder is already linked to a different agent (${import_picocolors26.default.dim(manifestId)}).`);
       f2.info(`Run ${import_picocolors26.default.cyan(`brainbase agent pull ${arg} --force`)} to override. ` + import_picocolors26.default.yellow("This will overwrite brainbase.agent.yaml and any local progress will be lost."));
       return null;
     }
@@ -65000,10 +65296,10 @@ function resolveTargetAgentId(cwd2, args) {
   if (manifestId)
     return { agentId: manifestId, override: false };
   if (manifest) {
-    f2.error(`${import_picocolors26.default.bold(AGENT_MANIFEST_FILE)} is unclaimed (no ${import_picocolors26.default.cyan("id")}).`);
+    fail(`${import_picocolors26.default.bold(AGENT_MANIFEST_FILE)} is unclaimed (no ${import_picocolors26.default.cyan("id")}).`);
     f2.info(`Run ${import_picocolors26.default.cyan("brainbase agent create")} to create a new agent from this manifest, ` + `or ${import_picocolors26.default.cyan("brainbase agent pull <id>")} to pull an existing one.`);
   } else {
-    f2.error(`No ${import_picocolors26.default.bold(AGENT_MANIFEST_FILE)} here and no ${import_picocolors26.default.cyan("<id>")} given.`);
+    fail(`No ${import_picocolors26.default.bold(AGENT_MANIFEST_FILE)} here and no ${import_picocolors26.default.cyan("<id>")} given.`);
     f2.info(`Run ${import_picocolors26.default.cyan("brainbase agent pull <id>")} to pull an existing agent into this folder.`);
   }
   return null;
@@ -65366,42 +65662,87 @@ async function pullSecrets(cwd2, agentId) {
 function handleApiError2(err) {
   if (err instanceof ApiError) {
     if (err.status === 401) {
-      f2.error("Your session is invalid. Run `brainbase login` and try again.");
+      fail("Your session is invalid. Run `brainbase login` and try again.");
     } else if (err.status === 404) {
-      f2.error(`Agent not found, or you don't have access. Double-check the id.`);
+      fail(`Agent not found, or you don't have access. Double-check the id.`);
     } else {
-      f2.error(err.message);
+      fail(err.message);
     }
   } else {
-    f2.error(err.message);
+    fail(err.message);
   }
 }
 
 // src/cli/agent-push.ts
 var import_picocolors28 = __toESM(require_picocolors(), 1);
 
-// src/core/eval-reconcile.ts
-function manifestClaimsEvals(manifest) {
-  return (manifest.evals ?? []).length > 0;
-}
-function decideEvalReconcile(input) {
-  const evalRows = input.rows.filter((r2) => r2.type === "eval");
-  const unseen = evalRows.filter((r2) => r2.status === "added-cloud").map((r2) => r2.slug).sort();
-  const cloudModified = evalRows.filter((r2) => r2.status === "modified-cloud" || r2.status === "modified-both" || r2.status === "added-local" && r2.localHash !== undefined && r2.cloudHash !== undefined && r2.localHash !== r2.cloudHash).map((r2) => r2.slug).sort();
-  const archives = evalRows.filter((r2) => r2.status === "removed-local").map((r2) => r2.slug).sort();
-  if (!input.claimsEvals && archives.length === 0) {
+// src/core/collection-reconcile.ts
+function untouchedRows(decision) {
+  if (decision.kind === "reconcile")
+    return [];
+  return [...decision.unseen, ...decision.cloudModified].sort();
+}
+function decideCollectionReconcile(input) {
+  const rows = input.rows.filter((r2) => r2.type === input.type);
+  const unseen = rows.filter((r2) => r2.status === "added-cloud").map((r2) => r2.slug).sort();
+  const cloudModified = rows.filter((r2) => r2.status === "modified-cloud" || r2.status === "modified-both" || r2.status === "added-local" && r2.localHash !== undefined && r2.cloudHash !== undefined && r2.localHash !== r2.cloudHash).map((r2) => r2.slug).sort();
+  const removedLocal = rows.filter((r2) => r2.status === "removed-local");
+  const archives = removedLocal.map((r2) => r2.slug).sort();
+  const staleArchives = removedLocal.filter((r2) => r2.cloudHash !== undefined && r2.lockHash !== undefined && r2.cloudHash !== r2.lockHash).map((r2) => r2.slug).sort();
+  if (!input.claims && archives.length === 0) {
     if (unseen.length > 0 || cloudModified.length > 0) {
-      return { kind: "skip", unseen: [...unseen, ...cloudModified].sort() };
+      return { kind: "skip", unseen, cloudModified };
     }
     return { kind: "reconcile", archives: [] };
   }
   if (input.force) {
     return { kind: "reconcile", archives: [...archives, ...unseen].sort() };
   }
-  if (unseen.length === 0 && cloudModified.length === 0) {
+  if (unseen.length === 0 && cloudModified.length === 0 && staleArchives.length === 0) {
     return { kind: "reconcile", archives };
   }
-  return { kind: "blocked", unseen, cloudModified, archives };
+  return { kind: "blocked", unseen, cloudModified, staleArchives, archives };
+}
+
+// src/core/eval-reconcile.ts
+function manifestClaimsEvals(manifest) {
+  return (manifest.evals ?? []).length > 0;
+}
+function decideEvalReconcile(input) {
+  return decideCollectionReconcile({
+    rows: input.rows,
+    type: "eval",
+    claims: input.claimsEvals,
+    force: input.force
+  });
+}
+
+// src/core/playbook-reconcile.ts
+function manifestClaimsPlaybooks(manifest) {
+  return (manifest.playbooks ?? []).length > 0;
+}
+function decidePlaybookReconcile(input) {
+  return decideCollectionReconcile({
+    rows: input.rows,
+    type: "playbook",
+    claims: input.claimsPlaybooks,
+    force: input.force
+  });
+}
+function playbookLabels(slugs, cloudComponents) {
+  const titleBySlug = new Map;
+  for (const c2 of cloudComponents) {
+    if (c2.type !== "playbook")
+      continue;
+    const title = c2.meta?.playbook?.title;
+    if (typeof title === "string" && title.trim()) {
+      titleBySlug.set(c2.slug, title);
+    }
+  }
+  return slugs.map((slug) => {
+    const title = titleBySlug.get(slug);
+    return title && title !== slug ? `${title} (${slug})` : slug;
+  });
 }
 
 // src/core/agent-outgoing.ts
@@ -65606,7 +65947,7 @@ function planRegistrySkillUpdates(skills, cloudComponents, latestByName) {
 async function runAgentPush(cwd2, args) {
   banner("agent push — send your local changes to the cloud");
   if (!hasManifest(cwd2)) {
-    f2.warn(`No ${import_picocolors28.default.bold(AGENT_MANIFEST_FILE)} here.`);
+    failWarn(`No ${import_picocolors28.default.bold(AGENT_MANIFEST_FILE)} here.`);
     f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent create")} to claim a new agent from a manifest, ` + `or ${import_picocolors28.default.cyan("brainbase agent pull <id>")} to pull an existing one.`);
     return;
   }
@@ -65623,7 +65964,7 @@ async function runAgentPush(cwd2, args) {
     return;
   }
   if (!manifest.id) {
-    f2.warn(`${import_picocolors28.default.bold(AGENT_MANIFEST_FILE)} is unclaimed (no ${import_picocolors28.default.cyan("id")}). Nothing to push to.`);
+    failWarn(`${import_picocolors28.default.bold(AGENT_MANIFEST_FILE)} is unclaimed (no ${import_picocolors28.default.cyan("id")}). Nothing to push to.`);
     f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent create")} first — that creates the cloud agent and stamps an id here.`);
     return;
   }
@@ -65791,7 +66132,7 @@ async function runAgentPush(cwd2, args) {
     force: !!args.force
   });
   if (evalDecision.kind === "blocked") {
-    const { unseen, cloudModified } = evalDecision;
+    const { unseen, cloudModified, staleArchives } = evalDecision;
     f2.error(unseen.length > 0 ? "Cannot push: the cloud has eval changes this folder has never seen." : "Cannot push: evals changed both locally and in the cloud.");
     for (const slug of unseen) {
       console.error(`  ${import_picocolors28.default.red("!")} ${fmtType("eval")} ${import_picocolors28.default.bold(slug)} ${import_picocolors28.default.dim("(only in the cloud — pushing would archive it)")}`);
@@ -65799,12 +66140,17 @@ async function runAgentPush(cwd2, args) {
     for (const slug of cloudModified) {
       console.error(`  ${import_picocolors28.default.red("!")} ${fmtType("eval")} ${import_picocolors28.default.bold(slug)} ${import_picocolors28.default.dim("(edited in the cloud — pushing would overwrite that edit)")}`);
     }
-    f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent pull")} to bring ${unseen.length + cloudModified.length === 1 ? "it" : "them"} into ${import_picocolors28.default.bold("brainbase.agent.yaml")}, then push — or ${import_picocolors28.default.cyan("brainbase agent push --force")} to make your local evals authoritative and archive the rest.`);
+    for (const slug of staleArchives) {
+      console.error(`  ${import_picocolors28.default.red("!")} ${fmtType("eval")} ${import_picocolors28.default.bold(slug)} ${import_picocolors28.default.dim("(deleted here, edited in the cloud since — pushing would archive that edit)")}`);
+    }
+    const total = unseen.length + cloudModified.length + staleArchives.length;
+    f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent pull")} to bring ${total === 1 ? "it" : "them"} into ${import_picocolors28.default.bold("brainbase.agent.yaml")}, then push — or ${import_picocolors28.default.cyan("brainbase agent push --force")} to make your local evals authoritative and archive the rest.`);
     process.exitCode = 1;
     return;
   }
   if (evalDecision.kind === "skip") {
-    f2.warn(`${evalDecision.unseen.length} cloud eval${evalDecision.unseen.length === 1 ? "" : "s"} (${evalDecision.unseen.map((s3) => import_picocolors28.default.bold(s3)).join(", ")}) ${evalDecision.unseen.length === 1 ? "is" : "are"} not in ${import_picocolors28.default.bold("brainbase.agent.yaml")} and will be left untouched. Run ${import_picocolors28.default.cyan("brainbase agent pull")} to manage ${evalDecision.unseen.length === 1 ? "it" : "them"} from here.`);
+    const left = untouchedRows(evalDecision);
+    f2.warn(`${left.length} cloud eval${left.length === 1 ? "" : "s"} (${left.map((s3) => import_picocolors28.default.bold(s3)).join(", ")}) ${left.length === 1 ? "is" : "are"} not managed by ${import_picocolors28.default.bold("brainbase.agent.yaml")} and will be left untouched. Run ${import_picocolors28.default.cyan("brainbase agent pull")} to manage ${left.length === 1 ? "it" : "them"} from here.`);
   }
   for (const entry of manifest.skills) {
     let parsed;
@@ -65831,6 +66177,32 @@ async function runAgentPush(cwd2, args) {
     process.exitCode = 1;
     return;
   }
+  const playbookDecision = decidePlaybookReconcile({
+    rows,
+    claimsPlaybooks: manifestClaimsPlaybooks(manifest),
+    force: !!args.force
+  });
+  if (playbookDecision.kind === "blocked") {
+    const { unseen, cloudModified, staleArchives } = playbookDecision;
+    f2.error(unseen.length > 0 ? "Cannot push: the cloud has playbooks this folder has never seen." : "Cannot push: playbooks changed both locally and in the cloud.");
+    for (const label of playbookLabels(unseen, cloud.components)) {
+      console.error(`  ${import_picocolors28.default.red("!")} ${fmtType("playbook")} ${import_picocolors28.default.bold(label)} ${import_picocolors28.default.dim("(only in the cloud — pushing would archive it)")}`);
+    }
+    for (const label of playbookLabels(cloudModified, cloud.components)) {
+      console.error(`  ${import_picocolors28.default.red("!")} ${fmtType("playbook")} ${import_picocolors28.default.bold(label)} ${import_picocolors28.default.dim("(edited in the cloud — pushing would overwrite that edit)")}`);
+    }
+    for (const label of playbookLabels(staleArchives, cloud.components)) {
+      console.error(`  ${import_picocolors28.default.red("!")} ${fmtType("playbook")} ${import_picocolors28.default.bold(label)} ${import_picocolors28.default.dim("(deleted here, edited in the cloud since — pushing would archive that edit)")}`);
+    }
+    const total = unseen.length + cloudModified.length + staleArchives.length;
+    f2.info(`Run ${import_picocolors28.default.cyan("brainbase agent pull")} to bring ${total === 1 ? "it" : "them"} into ${import_picocolors28.default.bold(AGENT_MANIFEST_FILE)}, then push — or ${import_picocolors28.default.cyan("brainbase agent push --force")} to make your local playbooks authoritative and archive the rest.`);
+    process.exitCode = 1;
+    return;
+  }
+  if (playbookDecision.kind === "skip") {
+    const labels = playbookLabels(untouchedRows(playbookDecision), cloud.components);
+    f2.warn(`${labels.length} cloud playbook${labels.length === 1 ? "" : "s"} (${labels.map((s3) => import_picocolors28.default.bold(s3)).join(", ")}) ${labels.length === 1 ? "is" : "are"} not managed by ${import_picocolors28.default.bold(AGENT_MANIFEST_FILE)} and will be left untouched. Run ${import_picocolors28.default.cyan("brainbase agent pull")} to manage ${labels.length === 1 ? "it" : "them"} from here.`);
+  }
   const { toSend, conflicts, upstreamOnly } = partitionPushRows(rows, !!args.force);
   const forcedOverrides = args.force ? rows.filter((r2) => r2.status === "modified-both") : [];
   if (conflicts.length > 0) {
@@ -65964,6 +66336,15 @@ async function runAgentPush(cwd2, args) {
       text: `${evalArchives.length} · ${evalArchives.join(", ")}`
     });
   }
+  const playbookArchives = playbookDecision.kind === "reconcile" ? playbookDecision.archives : [];
+  const playbookArchiveLabels = playbookLabels(playbookArchives, cloud.components);
+  if (playbookArchives.length) {
+    resultRows.push({
+      type: "rem",
+      label: "archive",
+      text: `${playbookArchives.length} playbook${playbookArchives.length === 1 ? "" : "s"} · ${playbookArchiveLabels.join(", ")}`
+    });
+  }
   await showResultCard({
     title: "PUSH",
     tone: "info",
@@ -65973,10 +66354,14 @@ async function runAgentPush(cwd2, args) {
   if (evalArchives.length) {
     f2.warn(`${evalArchives.length} cloud eval${evalArchives.length === 1 ? "" : "s"} ${evalArchives.length === 1 ? "is" : "are"} missing from ${import_picocolors28.default.bold("brainbase.agent.yaml")} and will be archived: ${evalArchives.map((s3) => import_picocolors28.default.bold(s3)).join(", ")}. ${import_picocolors28.default.dim("Archived, not deleted — past verdicts are kept, and re-adding the eval restores it.")}`);
   }
+  if (playbookArchives.length) {
+    f2.warn(`${playbookArchives.length} cloud playbook${playbookArchives.length === 1 ? "" : "s"} ${playbookArchives.length === 1 ? "is" : "are"} missing from ${import_picocolors28.default.bold("brainbase.agent.yaml")} and will be archived: ${playbookArchiveLabels.map((s3) => import_picocolors28.default.bold(s3)).join(", ")}. ${import_picocolors28.default.dim("Archived, not deleted — the row is kept, and re-adding the playbook restores it.")}`);
+  }
+  const destructive = evalArchives.length + playbookArchives.length;
   if (!autoProceed(args.yes)) {
     const ok = await se({
-      message: evalArchives.length ? `Send these changes, archiving ${evalArchives.length} eval${evalArchives.length === 1 ? "" : "s"}?` : "Send these changes?",
-      initialValue: evalArchives.length === 0
+      message: destructive ? `Send these changes, archiving ${describeArchiveSet(evalArchives.length, playbookArchives.length)}?` : "Send these changes?",
+      initialValue: destructive === 0
     });
     if (!ensureNotCancelled(ok)) {
       $e("Aborted.");
@@ -66043,11 +66428,12 @@ async function runAgentPush(cwd2, args) {
   let updatedCloud;
   try {
     const reconcileEvals = evalDecision.kind !== "skip";
-    const components = reconcileEvals ? outgoing : outgoing.filter((c2) => c2.type !== "eval");
+    const reconcilePlaybooks = playbookDecision.kind !== "skip";
+    const components = outgoing.filter((c2) => (reconcileEvals || c2.type !== "eval") && (reconcilePlaybooks || c2.type !== "playbook"));
     updatedCloud = await api.pushAgentManifest(agentId, {
       components,
       base_revision: cloud.revision,
-      reconcile_playbooks: true,
+      reconcile_playbooks: reconcilePlaybooks,
       reconcile_evals: reconcileEvals
     });
     pushSpinner.stop(`Pushed. New revision ${updatedCloud.revision}.`);
@@ -66095,16 +66481,21 @@ async function runAgentPush(cwd2, args) {
       localHashByKey.set(`eval/${entry.slug}`, hashEvalEntry(entry));
     }
   }
-  const lockSource = evalDecision.kind === "skip" ? [
-    ...updatedCloud.components.filter((c2) => c2.type !== "eval"),
-    ...(lock?.components ?? []).filter((c2) => c2.type === "eval").map((c2) => ({
+  const skipped = new Set;
+  if (evalDecision.kind === "skip")
+    skipped.add("eval");
+  if (playbookDecision.kind === "skip")
+    skipped.add("playbook");
+  const lockSource = skipped.size === 0 ? updatedCloud.components : [
+    ...updatedCloud.components.filter((c2) => !skipped.has(c2.type)),
+    ...(lock?.components ?? []).filter((c2) => skipped.has(c2.type)).map((c2) => ({
       type: c2.type,
       slug: c2.slug,
       hash: c2.hash,
       files: [],
       meta: undefined
     }))
-  ] : updatedCloud.components;
+  ];
   const newLock = {
     schemaVersion: 1,
     agent_id: agentId,
@@ -66186,6 +66577,15 @@ async function pushSecrets(agentId, plan) {
     return false;
   }
 }
+function describeArchiveSet(evals, playbooks) {
+  const parts = [];
+  if (evals)
+    parts.push(`${evals} eval${evals === 1 ? "" : "s"}`);
+  if (playbooks) {
+    parts.push(`${playbooks} playbook${playbooks === 1 ? "" : "s"}`);
+  }
+  return parts.join(" and ");
+}
 function secretDiffSummary(diff2) {
   return `${diff2.localOnly.length} added, ${diff2.changed.length} updated, ${diff2.cloudOnly.length} removed`;
 }
@@ -66216,9 +66616,10 @@ async function runAgentStatus(cwd2, args = {}) {
   if (!link2) {
     if (json) {
       emitJson({ linked: false, ignored: [], unchecked: [] });
+      process.exitCode = 1;
       return;
     }
-    f2.warn("This folder is not linked to any agent.");
+    failWarn("This folder is not linked to any agent.");
     f2.info(`Run ${import_picocolors29.default.cyan("brainbase link")} first.`);
     return;
   }
@@ -66243,9 +66644,9 @@ async function runAgentStatus(cwd2, args = {}) {
   } catch (err) {
     const unauthorized = err instanceof ApiError && err.status === 401;
     const message = unauthorized ? "Your session is invalid. Run `brainbase login` and try again." : err.message;
+    process.exitCode = 1;
     if (json) {
       console.error(message);
-      process.exitCode = 1;
       return;
     }
     sp?.stop("Failed to reach brainbase.");
@@ -66310,20 +66711,25 @@ async function runAgentStatus(cwd2, args = {}) {
   };
   let secretsChecked = true;
   let secretsUncheckedReason = "";
+  let cloudSecretNames = null;
   try {
-    const localSecrets = readLocalSecrets(cwd2);
     const cloudRes = await api.getAgentSecrets(link2.agent_id);
-    secretDrift = diffSecrets(localSecrets, cloudRes.secrets);
+    cloudSecretNames = new Set(Object.keys(cloudRes.secrets));
+    secretDrift = diffSecrets(readLocalSecrets(cwd2), cloudRes.secrets);
   } catch (err) {
-    if (!(err instanceof ApiError && err.status === 404)) {
-      secretsChecked = false;
-      secretsUncheckedReason = describeSecretsFailure(err);
-    }
+    secretsChecked = false;
+    secretsUncheckedReason = describeSecretsFailure(err);
   }
   const componentsDrifted = conflicts.length > 0 || toPush.length > 0 || toPull.length > 0;
   const metaDrifted = meta.localChanged || meta.cloudChanged;
   const configDrifted = config.unsupported.length > 0 || config.machineMismatch || config.machineCloudChanged || config.defaultModelLocalChanged || config.defaultModelCloudChanged || capabilityDrifted(config.memory) || capabilityDrifted(config.browser);
   const secretsDrifted = secretDrift.localOnly.length > 0 || secretDrift.cloudOnly.length > 0 || secretDrift.changed.length > 0;
+  const secretConflicts = cloudAgent.secret_conflicts ?? [];
+  const inheritedSecrets = (cloudAgent.inherited_secret_keys ?? []).map((entry) => ({
+    ...entry,
+    overridden: entry.overridden ?? cloudSecretNames?.has(entry.key) ?? false
+  }));
+  const hasInheritedSecrets = inheritedSecrets.length > 0 || secretConflicts.length > 0;
   const everythingInSync = !componentsDrifted && !metaDrifted && !configDrifted && !secretsDrifted;
   const unchecked = secretsChecked ? [] : [{ signal: "secrets", reason: secretsUncheckedReason }];
   const evalPlan = decideEvalReconcile({
@@ -66331,12 +66737,13 @@ async function runAgentStatus(cwd2, args = {}) {
     claimsEvals: manifestClaimsEvals(manifest),
     force: false
   });
-  const evalReport = {
-    archive: evalPlan.kind === "reconcile" ? evalPlan.archives : [],
-    unseen: evalPlan.kind === "reconcile" ? [] : evalPlan.unseen,
-    cloudModified: evalPlan.kind === "blocked" ? evalPlan.cloudModified : [],
-    pushBlocked: evalPlan.kind === "blocked"
-  };
+  const evalReport = reconcileReport(evalPlan);
+  const playbookPlan = decidePlaybookReconcile({
+    rows,
+    claimsPlaybooks: manifestClaimsPlaybooks(manifest),
+    force: false
+  });
+  const playbookReport = reconcileReport(playbookPlan);
   if (json) {
     emitJson({
       linked: true,
@@ -66358,17 +66765,26 @@ async function runAgentStatus(cwd2, args = {}) {
       secrets: secretsChecked ? {
         localOnly: secretDrift.localOnly,
         cloudOnly: secretDrift.cloudOnly,
-        changed: secretDrift.changed
+        changed: secretDrift.changed,
+        inherited: inheritedSecrets,
+        conflicts: secretConflicts
       } : null,
+      orchestrationSecrets: {
+        inherited: inheritedSecrets,
+        conflicts: secretConflicts
+      },
       components: {
         push: toPush.map(rowJson),
         pull: toPull.map(rowJson),
         conflicts: conflicts.map(rowJson)
       },
       evals: evalReport,
+      playbooks: playbookReport,
       inSync: everythingInSync,
       unchecked
     });
+    if (!secretsChecked)
+      process.exitCode = 1;
     return;
   }
   const lines = [];
@@ -66430,7 +66846,7 @@ async function runAgentStatus(cwd2, args = {}) {
     }
     lines.push("");
   }
-  if (secretsDrifted || !secretsChecked) {
+  if (secretsDrifted || !secretsChecked || hasInheritedSecrets) {
     lines.push(`  ${import_picocolors29.default.bold("secrets")}`);
     if (!secretsChecked) {
       lines.push(`    ${import_picocolors29.default.dim("? unchecked")}  ${secretsUncheckedReason}`);
@@ -66441,16 +66857,34 @@ async function runAgentStatus(cwd2, args = {}) {
       lines.push(`    ${import_picocolors29.default.yellow("→ push")}  values changed: ${secretDrift.changed.join(", ")}`);
     if (secretDrift.cloudOnly.length)
       lines.push(`    ${import_picocolors29.default.cyan("← pull")}  new on cloud: ${secretDrift.cloudOnly.join(", ")}`);
+    for (const entry of inheritedSecrets) {
+      const source = entry.orchestration_name || entry.orchestration_id;
+      const pendingOverride = !entry.overridden && (secretDrift.localOnly.includes(entry.key) || secretDrift.changed.includes(entry.key));
+      lines.push(entry.overridden ? `    ${entry.key}  ${import_picocolors29.default.dim(`(inherited from ${source}, overridden by this agent's own secret)`)}` : pendingOverride ? `    ${entry.key}  ${import_picocolors29.default.dim(`(inherited from ${source}, will be overridden once pushed)`)}` : `    ${entry.key}  ${import_picocolors29.default.dim(`(inherited from ${source})`)}`);
+    }
+    for (const entry of secretConflicts) {
+      lines.push(`    ${import_picocolors29.default.dim("! conflict")}  ${entry.key} ${import_picocolors29.default.dim(`has different values ${conflictSources(entry)}; neither value is applied until you set one on this agent`)}`);
+    }
+    if (secretConflicts.length > 0 && everythingInSync) {
+      lines.push(`    ${import_picocolors29.default.dim("conflicts are informational; they never block sync")}`);
+    }
     lines.push("");
   }
   if (everythingInSync) {
-    const qualifier = secretsChecked ? "" : ` ${import_picocolors29.default.dim("(secrets not checked)")}`;
-    lines.push(`  ${import_picocolors29.default.green("✓")} everything is in sync${qualifier}`);
+    if (secretsChecked) {
+      lines.push(`  ${import_picocolors29.default.green("✓")} everything is in sync`);
+    } else {
+      lines.push(`  ${import_picocolors29.default.yellow("?")} cannot confirm sync — secrets were not compared`);
+      lines.push(`    ${import_picocolors29.default.dim('everything else came back clean; the reason is under "secrets" above')}`);
+      process.exitCode = 1;
+    }
     lines.push("");
     console.log(lines.join(`
 `));
     return;
   }
+  if (!secretsChecked)
+    process.exitCode = 1;
   if (toPush.length) {
     lines.push(`  ${import_picocolors29.default.bold("changes to push")} ${import_picocolors29.default.dim(`(${toPush.length})`)}`);
     for (const r2 of toPush)
@@ -66485,13 +66919,55 @@ async function runAgentStatus(cwd2, args = {}) {
     for (const slug of evalReport.cloudModified) {
       lines.push(`    ${import_picocolors29.default.red("!")} ${import_picocolors29.default.bold(slug)} ${import_picocolors29.default.dim("— edited in the cloud; pushing would overwrite that edit")}`);
     }
+    for (const slug of evalReport.staleArchives) {
+      lines.push(`    ${import_picocolors29.default.red("!")} ${import_picocolors29.default.bold(slug)} ${import_picocolors29.default.dim("— deleted here, edited in the cloud since; pushing would archive that edit")}`);
+    }
     lines.push(`    ${import_picocolors29.default.dim("run")} ${import_picocolors29.default.cyan("brainbase agent pull")} ${import_picocolors29.default.dim("first")}`);
     lines.push("");
-  } else if (evalReport.unseen.length) {
-    lines.push(`  ${import_picocolors29.default.bold("evals only in the cloud")} ${import_picocolors29.default.dim(`(${evalReport.unseen.length})`)}`);
+  } else if (evalReport.unseen.length || evalReport.cloudModified.length) {
+    const total = evalReport.unseen.length + evalReport.cloudModified.length;
+    lines.push(`  ${import_picocolors29.default.bold("evals this manifest does not manage")} ${import_picocolors29.default.dim(`(${total})`)}`);
     for (const slug of evalReport.unseen) {
-      lines.push(`    ${import_picocolors29.default.cyan("←")} ${import_picocolors29.default.bold(slug)} ${import_picocolors29.default.dim("— left untouched by push; pull to manage it here")}`);
+      lines.push(`    ${import_picocolors29.default.cyan("←")} ${import_picocolors29.default.bold(slug)} ${import_picocolors29.default.dim("— only in the cloud; left untouched by push")}`);
+    }
+    for (const slug of evalReport.cloudModified) {
+      lines.push(`    ${import_picocolors29.default.cyan("←")} ${import_picocolors29.default.bold(slug)} ${import_picocolors29.default.dim("— edited in the cloud; left untouched by push")}`);
+    }
+    lines.push(`    ${import_picocolors29.default.dim("run")} ${import_picocolors29.default.cyan("brainbase agent pull")} ${import_picocolors29.default.dim("to manage them from here")}`);
+    lines.push("");
+  }
+  const pbLabel = (slug) => playbookLabels([slug], cloud.components)[0] ?? slug;
+  if (playbookReport.archive.length) {
+    lines.push(`  ${import_picocolors29.default.bold("playbooks a push would archive")} ${import_picocolors29.default.dim(`(${playbookReport.archive.length})`)}`);
+    for (const slug of playbookReport.archive) {
+      lines.push(`    ${import_picocolors29.default.yellow("⨯")} ${import_picocolors29.default.bold(pbLabel(slug))} ${import_picocolors29.default.dim("— in the cloud, not in this manifest")}`);
     }
+    lines.push(`    ${import_picocolors29.default.dim("archived, not deleted: re-adding the playbook restores it")}`);
+    lines.push("");
+  }
+  if (playbookReport.pushBlocked) {
+    lines.push(`  ${import_picocolors29.default.bold(import_picocolors29.default.red("playbooks: push blocked"))}`);
+    for (const slug of playbookReport.unseen) {
+      lines.push(`    ${import_picocolors29.default.red("!")} ${import_picocolors29.default.bold(pbLabel(slug))} ${import_picocolors29.default.dim("— only in the cloud; pushing would archive it")}`);
+    }
+    for (const slug of playbookReport.cloudModified) {
+      lines.push(`    ${import_picocolors29.default.red("!")} ${import_picocolors29.default.bold(pbLabel(slug))} ${import_picocolors29.default.dim("— edited in the cloud; pushing would overwrite that edit")}`);
+    }
+    for (const slug of playbookReport.staleArchives) {
+      lines.push(`    ${import_picocolors29.default.red("!")} ${import_picocolors29.default.bold(pbLabel(slug))} ${import_picocolors29.default.dim("— deleted here, edited in the cloud since; pushing would archive that edit")}`);
+    }
+    lines.push(`    ${import_picocolors29.default.dim("run")} ${import_picocolors29.default.cyan("brainbase agent pull")} ${import_picocolors29.default.dim("first")}`);
+    lines.push("");
+  } else if (playbookReport.unseen.length || playbookReport.cloudModified.length) {
+    const total = playbookReport.unseen.length + playbookReport.cloudModified.length;
+    lines.push(`  ${import_picocolors29.default.bold("playbooks this manifest does not manage")} ${import_picocolors29.default.dim(`(${total})`)}`);
+    for (const slug of playbookReport.unseen) {
+      lines.push(`    ${import_picocolors29.default.cyan("←")} ${import_picocolors29.default.bold(pbLabel(slug))} ${import_picocolors29.default.dim("— only in the cloud; left untouched by push")}`);
+    }
+    for (const slug of playbookReport.cloudModified) {
+      lines.push(`    ${import_picocolors29.default.cyan("←")} ${import_picocolors29.default.bold(pbLabel(slug))} ${import_picocolors29.default.dim("— edited in the cloud; left untouched by push")}`);
+    }
+    lines.push(`    ${import_picocolors29.default.dim("run")} ${import_picocolors29.default.cyan("brainbase agent pull")} ${import_picocolors29.default.dim("to manage them from here")}`);
     lines.push("");
   }
   lines.push(`  ${import_picocolors29.default.dim("run")} ${import_picocolors29.default.cyan("brainbase agent pull")} ${import_picocolors29.default.dim("to apply cloud changes,")} ${import_picocolors29.default.cyan("brainbase agent push")} ${import_picocolors29.default.dim("to send yours")}`);
@@ -66499,6 +66975,25 @@ async function runAgentStatus(cwd2, args = {}) {
   console.log(lines.join(`
 `));
 }
+function reconcileReport(decision) {
+  return {
+    archive: decision.kind === "reconcile" ? decision.archives : [],
+    unseen: decision.kind === "reconcile" ? [] : decision.unseen,
+    cloudModified: decision.kind === "reconcile" ? [] : decision.cloudModified,
+    staleArchives: decision.kind === "blocked" ? decision.staleArchives : [],
+    pushBlocked: decision.kind === "blocked"
+  };
+}
+function conflictSources(entry) {
+  const names = (entry.orchestration_names ?? []).filter((name) => name);
+  if (names.length > 1) {
+    return `in ${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+  }
+  if (names.length === 1)
+    return `in ${names[0]}`;
+  const count = entry.orchestration_ids?.length ?? 0;
+  return count > 0 ? `in ${count} orchestrations` : "in its orchestrations";
+}
 function emitJson(report) {
   console.log(JSON.stringify(report, null, 2));
 }
@@ -66515,6 +67010,9 @@ function describeSecretsFailure(err) {
   if (remote && err.status === 401) {
     return "could not fetch secrets: your session is invalid — run `brainbase login`";
   }
+  if (remote && err.status === 404) {
+    return "could not fetch secrets: the control plane answered 404 — no secrets " + "route on this deployment, no access to this agent, or the agent is " + "pinned to a benchmark thread";
+  }
   const where = remote ? "could not fetch secrets from the control plane" : `could not read ${path81.join(LINK_DIR, SECRETS_FILE)}`;
   const detail = oneLine(err instanceof Error ? err.message : typeof err === "string" ? err : "");
   return detail ? `${where}: ${detail}` : where;
@@ -66920,7 +67418,7 @@ async function runAgentCreate(cwd2, args) {
   if (!manifest)
     return;
   if (manifest.id) {
-    f2.warn(`This folder already belongs to an agent — ${import_picocolors32.default.bold(manifest.agent.name)} (${import_picocolors32.default.dim(manifest.id)}).`);
+    failWarn(`This folder already belongs to an agent — ${import_picocolors32.default.bold(manifest.agent.name)} (${import_picocolors32.default.dim(manifest.id)}).`);
     f2.info(`If you want to detach it, run ${import_picocolors32.default.cyan("brainbase unlink")} first; or move to a different directory.`);
     return;
   }
@@ -66974,9 +67472,9 @@ async function runAgentCreate(cwd2, args) {
     const body = resolveEntrypoint(cwd2, manifest);
     if (body === null) {
       if (manifest.entrypoint.file) {
-        f2.error(`Entrypoint file ${import_picocolors32.default.bold(manifest.entrypoint.file)} not found.`);
+        fail(`Entrypoint file ${import_picocolors32.default.bold(manifest.entrypoint.file)} not found.`);
       } else {
-        f2.error("Entrypoint block is empty.");
+        fail("Entrypoint block is empty.");
       }
       return;
     }
@@ -67000,7 +67498,6 @@ async function runAgentCreate(cwd2, args) {
   } catch (err) {
     createSpinner.stop("Failed.");
     handleApiError4(err);
-    process.exitCode = 1;
     return;
   }
   const machineConfigMissing = manifest.machine_kind !== undefined && agent.machine_kind !== manifest.machine_kind;
@@ -67097,10 +67594,12 @@ async function runAgentCreate(cwd2, args) {
   manifest = readManifest(cwd2);
   let updatedCloud = null;
   const hasContent = !!manifest.instructions || manifest.skills.length > 0 || (manifest.mcp ?? []).length > 0 || (manifest.playbooks ?? []).length > 0 || (manifest.evals ?? []).length > 0;
+  let contentUploadFailed = false;
   if (hasContent) {
     const outgoing = await buildOutgoingComponents(cwd2, manifest, null);
     if (outgoing === null) {
-      f2.warn(`Agent created, but local content wasn't uploaded. Fix the issue above and run ${import_picocolors32.default.cyan("brainbase agent push")}.`);
+      contentUploadFailed = true;
+      failWarn(`Agent created, but local content wasn't uploaded. Fix the issue above and run ${import_picocolors32.default.cyan("brainbase agent push")}.`);
     } else if (outgoing.length > 0) {
       const pushSpinner = de();
       pushSpinner.start("Pushing local content…");
@@ -67114,10 +67613,11 @@ async function runAgentCreate(cwd2, args) {
         pushSpinner.stop(`Pushed at revision ${updatedCloud.revision}.`);
       } catch (err) {
         pushSpinner.stop("Failed.");
+        contentUploadFailed = true;
         if (err instanceof ApiError) {
-          f2.warn(`Content upload failed: ${err.message}. Run ${import_picocolors32.default.cyan("brainbase agent push")} to retry.`);
+          failWarn(`Agent created and this folder linked, but the content upload failed: ${err.message}. Run ${import_picocolors32.default.cyan("brainbase agent push")} to retry.`);
         } else {
-          f2.warn(`Content upload failed: ${err.message}. Run ${import_picocolors32.default.cyan("brainbase agent push")} to retry.`);
+          failWarn(`Agent created and this folder linked, but the content upload failed: ${err.message}. Run ${import_picocolors32.default.cyan("brainbase agent push")} to retry.`);
         }
       }
     }
@@ -67164,15 +67664,18 @@ async function runAgentCreate(cwd2, args) {
     }
   };
   writeSyncState(cwd2, state);
-  $e(`Created ${import_picocolors32.default.bold(agent.name)} and linked this folder.`);
+  $e(contentUploadFailed ? `Created ${import_picocolors32.default.bold(agent.name)} and linked this folder, without its local content.` : `Created ${import_picocolors32.default.bold(agent.name)} and linked this folder.`);
   await showResultCard({
-    title: "CREATED",
-    tone: "ok",
+    title: contentUploadFailed ? "CREATED (NO CONTENT)" : "CREATED",
+    tone: contentUploadFailed ? "warn" : "ok",
     subtitle: link2.tagline ? `${link2.name} — ${link2.tagline}` : link2.name,
     meta: [
       ["slug", link2.slug],
       ["agent", link2.agent_id],
-      ...link2.url ? [["url", link2.url]] : []
+      ...link2.url ? [["url", link2.url]] : [],
+      ...contentUploadFailed ? [
+        ["content", "not uploaded — run `brainbase agent push`"]
+      ] : []
     ]
   });
   console.log();
@@ -67239,12 +67742,12 @@ async function pickHarness2(cwd2) {
 function handleApiError4(err) {
   if (err instanceof ApiError) {
     if (err.status === 401) {
-      f2.error("Your session is invalid. Run `brainbase login` and try again.");
+      fail("Your session is invalid. Run `brainbase login` and try again.");
     } else {
-      f2.error(err.message);
+      fail(err.message);
     }
   } else {
-    f2.error(err.message);
+    fail(err.message);
   }
   $e("Aborted.");
 }
@@ -67335,12 +67838,18 @@ async function runAgentList(args) {
     allowPrompt: !args.json,
     announce: !args.json
   });
-  const agents = await api.listAgents(org.id, team.id);
+  const { agents, complete, warning } = await api.listAgents(org.id, team.id);
+  if (!complete && warning)
+    console.error(warning);
   if (args.json) {
     console.log(JSON.stringify(agents, null, 2));
     return;
   }
-  console.log(formatAgentList(agents, { orgName: org.name, teamName: team.name }));
+  console.log(formatAgentList(agents, {
+    orgName: org.name,
+    teamName: team.name,
+    complete
+  }));
 }
 function formatAgentList(agents, labels) {
   const lines = [""];
@@ -67349,6 +67858,8 @@ function formatAgentList(agents, labels) {
     return lines.join(`
 `);
   }
+  const count = `${agents.length} agent${agents.length === 1 ? "" : "s"}`;
+  lines.push(`  ${import_picocolors34.default.dim(labels.complete ? `${count} in ${labels.orgName} → ${labels.teamName}` : `${count} in ${labels.orgName} → ${labels.teamName} (may be incomplete)`)}`, "");
   for (const agent of agents) {
     lines.push(`  ${import_picocolors34.default.bold(agent.name)}  ${import_picocolors34.default.dim(agent.slug)}`);
     if (agent.tagline)
@@ -67738,7 +68249,10 @@ async function disconnect(cwd2, target, args, json) {
   if (!link2) {
     throw new Error("This folder is not linked to any agent. Run `brainbase link` first.");
   }
-  if (!json && !autoProceed(args.yes)) {
+  if (!json && !autoProceedDestructive(args.yes, {
+    action: `Disconnecting ${target} from ${link2.name}`,
+    flagHint: "Pass --yes to disconnect without a prompt."
+  })) {
     const ok = ensureNotCancelled(await se({ message: `Disconnect ${target} from ${link2.name}?` }));
     if (!ok) {
       f2.info("Nothing changed.");
@@ -68281,13 +68795,26 @@ var SyncedEdgeSchema = exports_external.object({
   description: exports_external.string().default(""),
   payload_schema: exports_external.record(exports_external.unknown()).default({})
 });
+var SyncedScheduleTriggerSchema = exports_external.object({
+  node_id: exports_external.string(),
+  hash: exports_external.string()
+});
+var SyncedOrchestrationMetaSchema = exports_external.object({
+  name: exports_external.string().optional(),
+  description: exports_external.string().optional(),
+  icon: exports_external.string().optional(),
+  icon_color: exports_external.string().optional(),
+  credit_limit: exports_external.number().optional()
+});
 var OrchestrationSyncStateSchema = exports_external.object({
   schemaVersion: exports_external.literal(1),
   orchestration_id: exports_external.string(),
   revision: exports_external.number(),
   synced_at: exports_external.string(),
   members: exports_external.array(SyncedMemberSchema),
-  edges: exports_external.array(SyncedEdgeSchema)
+  edges: exports_external.array(SyncedEdgeSchema),
+  triggers: exports_external.array(SyncedScheduleTriggerSchema).optional(),
+  meta: SyncedOrchestrationMetaSchema.optional()
 });
 function orchLinkPath(cwd2) {
   return path85.join(cwd2, LINK_DIR, ORCH_LINK_FILE);
@@ -68629,6 +69156,158 @@ function formatScheduleTriggerLabel(input) {
   return `schedule ${input.nodeId} (${cron}, ${state})${targetText}`;
 }
 
+// src/core/orchestration-reconcile.ts
+import crypto5 from "node:crypto";
+var SCHEDULE_TRIGGER = "schedule-trigger";
+function stableJson(value) {
+  if (value == null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(stableJson).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key2) => `${JSON.stringify(key2)}:${stableJson(obj[key2])}`).join(",")}}`;
+}
+function scheduleTriggerHash(t) {
+  const canonical = {
+    is_active: t.is_active,
+    config: normalizeScheduleTriggerConfig(t.config),
+    targets: t.targets.map((e2) => ({
+      agent: e2.agent,
+      description: e2.description,
+      payload_schema: e2.payload_schema
+    })).sort((a3, b4) => stableJson(a3) < stableJson(b4) ? -1 : 1)
+  };
+  return crypto5.createHash("sha256").update(stableJson(canonical)).digest("hex");
+}
+function scheduleTriggerLabel(t) {
+  return formatScheduleTriggerLabel({
+    nodeId: t.node_id,
+    isActive: t.is_active,
+    config: t.config,
+    targets: t.targets.map((e2) => e2.agent)
+  });
+}
+function cloudScheduleTriggers(cloud, slugForAgent) {
+  return (cloud.triggers ?? []).filter((t) => t.trigger_type === "schedule").map((t) => ({
+    node_id: t.node_id,
+    is_active: t.is_active ?? false,
+    config: t.config ?? {},
+    targets: t.edges.map((e2) => ({
+      agent: slugForAgent(e2.to_agent_id, e2.to_slug ?? e2.to_agent_id),
+      description: e2.description ?? "",
+      payload_schema: e2.payload_schema ?? {}
+    }))
+  }));
+}
+function manifestScheduleTriggers(manifest) {
+  return (manifest?.triggers ?? []).filter((t) => t.type === "schedule").map((t) => ({
+    node_id: t.node_id,
+    is_active: t.is_active ?? false,
+    config: t.config ?? {},
+    targets: t.to.map((e2) => ({
+      agent: e2.agent,
+      description: e2.description ?? "",
+      payload_schema: e2.payload_schema ?? {}
+    }))
+  }));
+}
+function decideScheduleTriggerReconcile(input) {
+  const rows = threeWayDiff({
+    local: input.local.map((t) => ({
+      type: SCHEDULE_TRIGGER,
+      slug: t.node_id,
+      hash: scheduleTriggerHash(t)
+    })),
+    lock: (input.baseline ?? []).map((t) => ({
+      type: SCHEDULE_TRIGGER,
+      slug: t.node_id,
+      hash: t.hash,
+      installedPaths: []
+    })),
+    cloud: input.cloud.map((t) => ({
+      type: SCHEDULE_TRIGGER,
+      slug: t.node_id,
+      hash: scheduleTriggerHash(t),
+      files: []
+    }))
+  });
+  return decideCollectionReconcile({
+    rows,
+    type: SCHEDULE_TRIGGER,
+    claims: input.local.length > 0,
+    force: input.force
+  });
+}
+function syncedScheduleTriggers(triggers) {
+  return triggers.map((t) => ({
+    node_id: t.node_id,
+    hash: scheduleTriggerHash(t)
+  }));
+}
+var ORCH_META_FIELDS = [
+  "name",
+  "description",
+  "icon",
+  "icon_color",
+  "credit_limit"
+];
+function metaText(value) {
+  if (value === undefined)
+    return;
+  return value == null ? "" : String(value);
+}
+function decideOrchestrationMeta(input) {
+  const meta = input.manifest?.orchestration;
+  if (!meta)
+    return [];
+  const out = [];
+  for (const field of ORCH_META_FIELDS) {
+    const local = metaText(meta[field]);
+    const cloud = metaText(input.cloud[field]) ?? "";
+    if (local === undefined)
+      continue;
+    if (local === cloud)
+      continue;
+    const base2 = input.baseline === undefined ? undefined : metaText(input.baseline[field]) ?? "";
+    let kind;
+    if (base2 === undefined) {
+      kind = "conflict";
+    } else if (local === base2) {
+      kind = "keep";
+    } else if (cloud === base2) {
+      kind = "push";
+    } else {
+      kind = "conflict";
+    }
+    if (kind === "conflict" && input.force)
+      kind = "push";
+    out.push({ field, kind, local, cloud });
+  }
+  return out;
+}
+function nextOrchestrationMeta(input) {
+  const kept = new Set(input.decisions.filter((d3) => d3.kind === "keep").map((d3) => d3.field));
+  const out = {};
+  for (const field of ORCH_META_FIELDS) {
+    const value = kept.has(field) ? input.previous?.[field] : input.applied[field];
+    if (value == null)
+      continue;
+    if (field === "credit_limit") {
+      out.credit_limit = typeof value === "number" ? value : Number(value);
+    } else {
+      out[field] = String(value);
+    }
+  }
+  return out;
+}
+function syncedOrchestrationMeta(cloud) {
+  return nextOrchestrationMeta({
+    applied: cloud,
+    decisions: [],
+    previous: undefined
+  });
+}
+
 // src/cli/orchestration-pull.ts
 function triggersForManifest(triggers, slugFor) {
   return triggers.map((trigger) => {
@@ -68656,7 +69335,7 @@ async function runOrchestrationPull(cwd2, args) {
   } else if (args.orchestrationId) {
     orchId = args.orchestrationId;
   } else {
-    f2.warn("This folder is not linked to any orchestration.");
+    failWarn("This folder is not linked to any orchestration.");
     f2.info(`Run ${import_picocolors42.default.cyan("brainbase orchestration pull <id>")} with an orchestration id,
   or ${import_picocolors42.default.cyan("brainbase orchestration list")} to find one.`);
     return;
@@ -68714,13 +69393,15 @@ async function runOrchestrationPull(cwd2, args) {
   const fallbackHarness = args.harness ?? "claude-code";
   fs78.mkdirSync(cwd2, { recursive: true });
   if (hasOrchManifest(cwd2) && existingLink && existingLink.orchestration_id !== orchId) {
-    f2.error(`This folder is linked to orchestration ${existingLink.orchestration_id}, not ${orchId}. Move to a fresh directory or unlink first.`);
+    fail(`This folder is linked to orchestration ${existingLink.orchestration_id}, not ${orchId}. Move to a fresh directory or unlink first.`);
     return;
   }
   const installedMembers = [];
+  const missingMembers = [];
   for (const m3 of cloud.members) {
     if (!m3.manifest) {
-      f2.warn(`Skipping member ${m3.slug}: server did not return a manifest.`);
+      missingMembers.push(m3.slug);
+      failWarn(`Skipping member ${m3.slug}: server did not return a manifest.`);
       continue;
     }
     const slug = slugFor(m3.agent_id);
@@ -68755,7 +69436,8 @@ async function runOrchestrationPull(cwd2, args) {
       });
     } catch (err) {
       memberSp.stop(`Failed to install ${slug}.`);
-      f2.error(err.message);
+      missingMembers.push(slug);
+      fail(err.message);
     }
   }
   const manifestTriggers = triggersForManifest(cloud.triggers ?? [], slugFor);
@@ -68806,8 +69488,15 @@ async function runOrchestrationPull(cwd2, args) {
       to_slug: slugFor(e2.to_agent_id),
       description: e2.description ?? "",
       payload_schema: e2.payload_schema ?? {}
-    }))
+    })),
+    triggers: syncedScheduleTriggers(cloudScheduleTriggers(cloud, (agentId, fallback) => slugFor(agentId) || fallback)),
+    meta: syncedOrchestrationMeta(cloud)
   });
+  if (missingMembers.length > 0) {
+    f2.warn(`${installedMembers.length} of ${cloud.members.length} members landed in ${path87.basename(cwd2)}/ and the orchestration is linked, but ${missingMembers.length === 1 ? "this member is" : "these members are"} missing: ${missingMembers.map((s3) => import_picocolors42.default.bold(s3)).join(", ")}. ${import_picocolors42.default.cyan("brainbase orchestration push")} will refuse until ${missingMembers.length === 1 ? "it" : "they"} ${missingMembers.length === 1 ? "is" : "are"} pulled, so re-run this after fixing the cause.`);
+    $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path87.basename(cwd2)}/ ${import_picocolors42.default.dim(`(${installedMembers.length}/${cloud.members.length} members — incomplete)`)}.`);
+    return;
+  }
   $e(`Pulled ${cloud.name} at revision ${cloud.revision} into ${path87.basename(cwd2)}/ ${import_picocolors42.default.dim(`(${installedMembers.length}/${cloud.members.length} members)`)}.`);
 }
 function handleApiError5(err) {
@@ -68890,6 +69579,11 @@ function buildOrchestrationGraphPayload(manifest, slugToAgentId) {
 }
 
 // src/cli/orchestration-push.ts
+function joinList(items) {
+  if (items.length <= 1)
+    return items[0] ?? "";
+  return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+}
 function findUnpushableMembers(cwd2, members) {
   const blocked = [];
   for (const m3 of members) {
@@ -68922,12 +69616,12 @@ async function runOrchestrationPush(cwd2, args) {
   banner("orchestration push — recursively push each member, then update the graph");
   const link2 = readOrchLink(cwd2);
   if (!link2) {
-    f2.warn("This folder is not linked to any orchestration.");
+    failWarn("This folder is not linked to any orchestration.");
     f2.info(`Run ${import_picocolors43.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
   if (!hasOrchManifest(cwd2)) {
-    f2.warn(`No ${import_picocolors43.default.bold(ORCH_MANIFEST_FILE)} here.`);
+    failWarn(`No ${import_picocolors43.default.bold(ORCH_MANIFEST_FILE)} here.`);
     f2.info(`Run ${import_picocolors43.default.cyan("brainbase orchestration pull")} to materialise the manifest before pushing.`);
     return;
   }
@@ -68972,6 +69666,95 @@ async function runOrchestrationPush(cwd2, args) {
       return;
     }
   }
+  const lock = readOrchSyncState(cwd2);
+  const fetchSpinner = de();
+  fetchSpinner.start("Fetching cloud state…");
+  let cloud;
+  try {
+    cloud = await api.getOrchestration(link2.orchestration_id);
+    fetchSpinner.stop(`Cloud revision ${cloud.revision}.`);
+  } catch (err) {
+    fetchSpinner.stop("Failed.");
+    handleApiError6(err);
+    process.exitCode = 1;
+    return;
+  }
+  const agentIdToSlug = new Map([...slugToAgentId.entries()].map(([slug, id]) => [id, slug]));
+  const slugForAgent = (agentId, fallback) => agentIdToSlug.get(agentId) ?? fallback;
+  const localTriggers = manifestScheduleTriggers(manifest);
+  const cloudTriggers = cloudScheduleTriggers(cloud, slugForAgent);
+  const triggerDecision = decideScheduleTriggerReconcile({
+    local: localTriggers,
+    cloud: cloudTriggers,
+    baseline: lock?.triggers,
+    force: !!args.force
+  });
+  const triggerByNode = new Map([...cloudTriggers, ...localTriggers].map((t) => [t.node_id, t]));
+  const labelFor = (nodeId) => {
+    const t = triggerByNode.get(nodeId);
+    return t ? scheduleTriggerLabel(t) : nodeId;
+  };
+  const metaDecisions = decideOrchestrationMeta({
+    manifest,
+    cloud,
+    baseline: lock?.meta,
+    force: !!args.force
+  });
+  const metaConflicts = metaDecisions.filter((d3) => d3.kind === "conflict");
+  const metaOverwrites = metaDecisions.filter((d3) => d3.kind === "push");
+  const metaKept = metaDecisions.filter((d3) => d3.kind === "keep");
+  const blockedTriggers = triggerDecision.kind === "blocked" ? triggerDecision : null;
+  if (blockedTriggers || metaConflicts.length > 0) {
+    const pullTargets = [];
+    const forceEffects = [];
+    if (blockedTriggers) {
+      const { unseen, cloudModified, staleArchives } = blockedTriggers;
+      f2.error(unseen.length > 0 ? "Cannot push: the cloud has schedule triggers this folder has never seen." : "Cannot push: schedule triggers changed both locally and in the cloud.");
+      for (const nodeId of unseen) {
+        console.error(`  ${import_picocolors43.default.red("!")} ${import_picocolors43.default.bold(labelFor(nodeId))} ${import_picocolors43.default.dim("(only in the cloud — pushing would delete it)")}`);
+      }
+      for (const nodeId of cloudModified) {
+        console.error(`  ${import_picocolors43.default.red("!")} ${import_picocolors43.default.bold(labelFor(nodeId))} ${import_picocolors43.default.dim("(edited in the cloud — pushing would overwrite that edit)")}`);
+      }
+      for (const nodeId of staleArchives) {
+        console.error(`  ${import_picocolors43.default.red("!")} ${import_picocolors43.default.bold(labelFor(nodeId))} ${import_picocolors43.default.dim("(deleted here, edited in the cloud since — pushing would delete that edit)")}`);
+      }
+      const total = unseen.length + cloudModified.length + staleArchives.length;
+      pullTargets.push(`${total} schedule trigger${total === 1 ? "" : "s"}`);
+      forceEffects.push("make your local schedule triggers authoritative (deleting the cloud ones above)");
+    }
+    if (metaConflicts.length > 0) {
+      f2.error("Cannot push: orchestration metadata changed both locally and in the cloud.");
+      for (const d3 of metaConflicts) {
+        console.error(`  ${import_picocolors43.default.red("!")} ${import_picocolors43.default.bold(d3.field)} ${import_picocolors43.default.dim(`(local "${d3.local}" vs cloud "${d3.cloud}")`)}`);
+      }
+      if (!lock?.meta) {
+        f2.info("This checkout has no metadata baseline, so the CLI cannot tell which side changed.");
+      }
+      const fields = metaConflicts.map((d3) => d3.field);
+      pullTargets.push(`${fields.length} metadata field${fields.length === 1 ? "" : "s"}`);
+      forceEffects.push(`overwrite the cloud's ${joinList(fields)} with the value${fields.length === 1 ? "" : "s"} in ${ORCH_MANIFEST_FILE}`);
+    }
+    f2.info(`Run ${import_picocolors43.default.cyan("brainbase orchestration pull")} to bring the cloud's ${joinList(pullTargets)} into ${import_picocolors43.default.bold(ORCH_MANIFEST_FILE)}, then push.`);
+    f2.info(`Or ${import_picocolors43.default.cyan("brainbase orchestration push --force")} to ${joinList(forceEffects)}.${forceEffects.length > 1 ? " One flag, both of those — it settles everything listed above, not whichever conflict you had in mind." : ""}`);
+    process.exitCode = 1;
+    return;
+  }
+  if (triggerDecision.kind === "skip") {
+    graph.triggers = cloudTriggers.map((t) => ({
+      node_id: t.node_id,
+      type: "schedule",
+      is_active: t.is_active,
+      config: t.config,
+      edges: t.targets.map((e2) => ({
+        to_agent_id: slugToAgentId.get(e2.agent) ?? e2.agent,
+        description: e2.description,
+        payload_schema: e2.payload_schema
+      }))
+    }));
+    f2.warn(`${cloudTriggers.length} cloud schedule trigger${cloudTriggers.length === 1 ? "" : "s"} ${cloudTriggers.length === 1 ? "is" : "are"} not in ${import_picocolors43.default.bold(ORCH_MANIFEST_FILE)} and will be left untouched. Run ${import_picocolors43.default.cyan("brainbase orchestration pull")} to manage ${cloudTriggers.length === 1 ? "it" : "them"} from here.`);
+  }
+  const triggerDeletes = triggerDecision.kind === "reconcile" ? triggerDecision.archives : [];
   const plan = [""];
   plan.push(`  ${import_picocolors43.default.bold(link2.name)} ${import_picocolors43.default.dim(`(${link2.orchestration_id})`)}`);
   plan.push(`  ${import_picocolors43.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
@@ -68983,12 +69766,34 @@ async function runOrchestrationPush(cwd2, args) {
     }
     plan.push("");
   }
+  if (triggerDeletes.length) {
+    plan.push(`  ${import_picocolors43.default.bold("schedule triggers this push will delete")} ${import_picocolors43.default.dim(`(${triggerDeletes.length})`)}`);
+    for (const nodeId of triggerDeletes) {
+      plan.push(`    ${import_picocolors43.default.yellow("⨯")} ${labelFor(nodeId)}`);
+    }
+    plan.push("");
+  }
+  if (metaOverwrites.length) {
+    plan.push(`  ${import_picocolors43.default.bold("orchestration metadata this push will overwrite")}`);
+    for (const m3 of metaOverwrites) {
+      plan.push(`    ${import_picocolors43.default.yellow("⤒")} ${import_picocolors43.default.bold(m3.field)}  ${import_picocolors43.default.dim(`cloud "${m3.cloud}" → local "${m3.local}"`)}`);
+    }
+    plan.push("");
+  }
+  if (metaKept.length) {
+    plan.push(`  ${import_picocolors43.default.bold("orchestration metadata changed in the cloud")}`);
+    for (const m3 of metaKept) {
+      plan.push(`    ${import_picocolors43.default.cyan("=")} ${import_picocolors43.default.bold(m3.field)}  ${import_picocolors43.default.dim(`keeping cloud "${m3.cloud}"; ${import_picocolors43.default.bold(ORCH_MANIFEST_FILE)} still has "${m3.local}"`)}`);
+    }
+    plan.push(`    ${import_picocolors43.default.dim(`run ${import_picocolors43.default.cyan("brainbase orchestration pull")} to bring ${metaKept.length === 1 ? "it" : "them"} into the file`)}`);
+    plan.push("");
+  }
   console.log(plan.join(`
 `));
   if (!autoProceed(args.yes)) {
     const ok = await se({
-      message: args.graphOnly ? "Push graph (members, edges + triggers) only?" : "Push each member, then update the graph?",
-      initialValue: true
+      message: triggerDeletes.length ? `Push, deleting ${triggerDeletes.length} schedule trigger${triggerDeletes.length === 1 ? "" : "s"}?` : args.graphOnly ? "Push graph (members, edges + triggers) only?" : "Push each member, then update the graph?",
+      initialValue: triggerDeletes.length === 0
     });
     if (!ensureNotCancelled(ok)) {
       $e("Aborted.");
@@ -69015,16 +69820,22 @@ async function runOrchestrationPush(cwd2, args) {
       }
     }
   }
+  const keptFields = new Set(metaKept.map((d3) => d3.field));
+  const metaField = (field) => {
+    const value = manifest.orchestration[field];
+    if (value === undefined || keptFields.has(field))
+      return {};
+    return { [field]: value };
+  };
   const sp = de();
   sp.start("Updating orchestration graph…");
-  const lock = readOrchSyncState(cwd2);
   try {
     const updated = await api.updateOrchestration(link2.orchestration_id, {
-      name: manifest.orchestration.name,
-      description: manifest.orchestration.description ?? "",
-      icon: manifest.orchestration.icon,
-      icon_color: manifest.orchestration.icon_color,
-      credit_limit: manifest.orchestration.credit_limit,
+      ...metaField("name"),
+      ...metaField("description"),
+      ...metaField("icon"),
+      ...metaField("icon_color"),
+      ...metaField("credit_limit"),
       members: graph.memberIds,
       edges: graph.edges,
       triggers: graph.triggers,
@@ -69046,7 +69857,13 @@ async function runOrchestrationPush(cwd2, args) {
         to_slug: e2.to_slug ?? e2.to_agent_id,
         description: e2.description ?? "",
         payload_schema: e2.payload_schema ?? {}
-      }))
+      })),
+      triggers: triggerDecision.kind === "skip" ? lock?.triggers ?? [] : syncedScheduleTriggers(cloudScheduleTriggers(updated, slugForAgent)),
+      meta: nextOrchestrationMeta({
+        applied: updated,
+        decisions: metaDecisions,
+        previous: lock?.meta
+      })
     });
     $e(`Pushed ${link2.name} at revision ${updated.revision}.`);
   } catch (err) {
@@ -69078,7 +69895,7 @@ async function runOrchestrationStatus(cwd2) {
   banner("orchestration status — what changed locally, remotely, both");
   const link2 = readOrchLink(cwd2);
   if (!link2) {
-    f2.warn("This folder is not linked to any orchestration.");
+    failWarn("This folder is not linked to any orchestration.");
     f2.info(`Run ${import_picocolors44.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
@@ -69126,8 +69943,8 @@ async function runOrchestrationStatus(cwd2) {
     }
     lines.push("");
   }
-  const cloudEdgeKey = (e2) => `${slugForAgent(e2.from_agent_id, e2.from_slug ?? e2.from_agent_id)}->${slugForAgent(e2.to_agent_id, e2.to_slug ?? e2.to_agent_id)}|${e2.description ?? ""}|${stableJson(e2.payload_schema ?? {})}|${stableJson(e2.settings ?? {})}`;
-  const localEdgeKey = (e2) => `${e2.from}->${e2.to}|${e2.description ?? ""}|${stableJson(e2.payload_schema ?? {})}|${stableJson(e2.settings ?? {})}`;
+  const cloudEdgeKey = (e2) => `${slugForAgent(e2.from_agent_id, e2.from_slug ?? e2.from_agent_id)}->${slugForAgent(e2.to_agent_id, e2.to_slug ?? e2.to_agent_id)}|${e2.description ?? ""}|${stableJson2(e2.payload_schema ?? {})}|${stableJson2(e2.settings ?? {})}`;
+  const localEdgeKey = (e2) => `${e2.from}->${e2.to}|${e2.description ?? ""}|${stableJson2(e2.payload_schema ?? {})}|${stableJson2(e2.settings ?? {})}`;
   const cloudEdges = new Map;
   for (const e2 of cloud.edges)
     cloudEdges.set(cloudEdgeKey(e2), true);
@@ -69144,46 +69961,74 @@ async function runOrchestrationStatus(cwd2) {
       lines.push(`    ${import_picocolors44.default.cyan("← pull")}  added on cloud: ${k3}`);
     lines.push("");
   }
-  const cloudTriggerKey = (t) => {
-    const edges = t.edges.map((e2) => `${slugForAgent(e2.to_agent_id, e2.to_slug ?? e2.to_agent_id)}|${e2.description ?? ""}|${stableJson(e2.payload_schema ?? {})}`).sort().join(",");
-    return `${t.node_id}|${t.is_active ?? false}|${stableJson(normalizeScheduleTriggerConfig(t.config))}|${edges}`;
-  };
-  const cloudTriggerLabel = (t) => formatScheduleTriggerLabel({
-    nodeId: t.node_id,
-    isActive: t.is_active ?? false,
-    config: t.config,
-    targets: t.edges.map((e2) => slugForAgent(e2.to_agent_id, e2.to_slug ?? e2.to_agent_id))
+  const metaDecisions = decideOrchestrationMeta({
+    manifest: localManifest,
+    cloud,
+    baseline: lock?.meta,
+    force: false
   });
-  const localTriggerKey = (t) => {
-    const edges = t.to.map((e2) => `${e2.agent}|${e2.description ?? ""}|${stableJson(e2.payload_schema ?? {})}`).sort().join(",");
-    return `${t.node_id}|${t.is_active ?? false}|${stableJson(normalizeScheduleTriggerConfig(t.config))}|${edges}`;
+  if (metaDecisions.length) {
+    lines.push(`  ${import_picocolors44.default.bold("orchestration metadata")}`);
+    for (const m3 of metaDecisions) {
+      if (m3.kind === "push") {
+        lines.push(`    ${import_picocolors44.default.yellow("→ push")}  ${import_picocolors44.default.bold(m3.field)}: cloud ${import_picocolors44.default.dim(`"${m3.cloud}"`)} → local ${import_picocolors44.default.dim(`"${m3.local}"`)}`);
+      } else if (m3.kind === "keep") {
+        lines.push(`    ${import_picocolors44.default.cyan("← pull")}  ${import_picocolors44.default.bold(m3.field)}: changed in the cloud to ${import_picocolors44.default.dim(`"${m3.cloud}"`)}; push leaves it alone ${import_picocolors44.default.dim(`(yaml still has "${m3.local}")`)}`);
+      } else {
+        lines.push(`    ${import_picocolors44.default.red("! conflict")}  ${import_picocolors44.default.bold(m3.field)}: local ${import_picocolors44.default.dim(`"${m3.local}"`)} vs cloud ${import_picocolors44.default.dim(`"${m3.cloud}"`)} — push refuses until you pull or ${import_picocolors44.default.cyan("--force")}`);
+      }
+    }
+    lines.push(`    ${import_picocolors44.default.dim("fields the manifest omits, and fields only the cloud changed, are left alone")}`);
+    lines.push("");
+  }
+  const cloudTriggers = cloudScheduleTriggers(cloud, slugForAgent);
+  const localTriggers = manifestScheduleTriggers(localManifest);
+  const triggerPlan = decideScheduleTriggerReconcile({
+    local: localTriggers,
+    cloud: cloudTriggers,
+    baseline: lock?.triggers,
+    force: false
+  });
+  const triggerByNode = new Map([...cloudTriggers, ...localTriggers].map((t) => [t.node_id, t]));
+  const triggerLabel = (nodeId) => {
+    const t = triggerByNode.get(nodeId);
+    return t ? scheduleTriggerLabel(t) : nodeId;
   };
-  const localTriggerLabel = (t) => formatScheduleTriggerLabel({
-    nodeId: t.node_id,
-    isActive: t.is_active ?? false,
-    config: t.config,
-    targets: t.to.map((e2) => e2.agent)
+  const localNodes = new Set(localTriggers.map((t) => t.node_id));
+  const cloudByNode = new Map(cloudTriggers.map((t) => [t.node_id, t]));
+  const triggersToPush = localTriggers.filter((t) => {
+    const remote = cloudByNode.get(t.node_id);
+    return !remote || scheduleTriggerHash(remote) !== scheduleTriggerHash(t);
   });
-  const cloudTriggers = new Map;
-  for (const t of cloud.triggers ?? []) {
-    if (t.trigger_type === "schedule") {
-      cloudTriggers.set(cloudTriggerKey(t), cloudTriggerLabel(t));
+  const triggersToPull = cloudTriggers.filter((t) => !localNodes.has(t.node_id));
+  const triggerDeletes = triggerPlan.kind === "reconcile" ? triggerPlan.archives : [];
+  if (triggersToPush.length || triggersToPull.length) {
+    lines.push(`  ${import_picocolors44.default.bold("schedule triggers")}`);
+    for (const t of triggersToPush) {
+      lines.push(`    ${import_picocolors44.default.yellow("→ push")}  added/changed in yaml: ${scheduleTriggerLabel(t)}`);
     }
-  }
-  const localTriggers = new Map;
-  for (const t of localManifest?.triggers ?? []) {
-    if (t.type === "schedule") {
-      localTriggers.set(localTriggerKey(t), localTriggerLabel(t));
+    for (const t of triggersToPull) {
+      const doomed = triggerDeletes.includes(t.node_id);
+      lines.push(doomed ? `    ${import_picocolors44.default.red("⨯ push deletes")}  ${scheduleTriggerLabel(t)}` : `    ${import_picocolors44.default.cyan("← pull")}  only on cloud: ${scheduleTriggerLabel(t)}`);
     }
+    lines.push("");
   }
-  const triggersAdded = [...localTriggers.keys()].filter((k3) => !cloudTriggers.has(k3));
-  const triggersRemoved = [...cloudTriggers.keys()].filter((k3) => !localTriggers.has(k3));
-  if (triggersAdded.length || triggersRemoved.length) {
-    lines.push(`  ${import_picocolors44.default.bold("schedule triggers")}`);
-    for (const k3 of triggersAdded)
-      lines.push(`    ${import_picocolors44.default.yellow("→ push")}  added/changed in yaml: ${localTriggers.get(k3) ?? k3}`);
-    for (const k3 of triggersRemoved)
-      lines.push(`    ${import_picocolors44.default.cyan("← pull")}  added/changed on cloud: ${cloudTriggers.get(k3) ?? k3}`);
+  if (triggerPlan.kind === "blocked") {
+    lines.push(`  ${import_picocolors44.default.bold(import_picocolors44.default.red("schedule triggers: push blocked"))}`);
+    for (const nodeId of triggerPlan.unseen) {
+      lines.push(`    ${import_picocolors44.default.red("!")} ${triggerLabel(nodeId)} ${import_picocolors44.default.dim("— only in the cloud; pushing would delete it")}`);
+    }
+    for (const nodeId of triggerPlan.cloudModified) {
+      lines.push(`    ${import_picocolors44.default.red("!")} ${triggerLabel(nodeId)} ${import_picocolors44.default.dim("— edited in the cloud; pushing would overwrite that edit")}`);
+    }
+    for (const nodeId of triggerPlan.staleArchives) {
+      lines.push(`    ${import_picocolors44.default.red("!")} ${triggerLabel(nodeId)} ${import_picocolors44.default.dim("— deleted here, edited in the cloud since; pushing would delete that edit")}`);
+    }
+    lines.push(`    ${import_picocolors44.default.dim("run")} ${import_picocolors44.default.cyan("brainbase orchestration pull")} ${import_picocolors44.default.dim("first")}`);
+    lines.push("");
+  } else if (triggerPlan.kind === "skip") {
+    const left = untouchedRows(triggerPlan);
+    lines.push(`  ${import_picocolors44.default.dim(`${left.length} cloud schedule trigger${left.length === 1 ? "" : "s"} not managed by this manifest — push leaves ${left.length === 1 ? "it" : "them"} untouched`)}`);
     lines.push("");
   }
   const lockByAgentId = new Map((lock?.members ?? []).map((m3) => [m3.agent_id, m3]));
@@ -69219,7 +70064,7 @@ async function runOrchestrationStatus(cwd2) {
     lines.push(`    ${import_picocolors44.default.cyan("← pull")}  cloud changed since last pull: ${import_picocolors44.default.dim(`lock ${lock.revision} → cloud ${cloud.revision}`)}`);
     lines.push("");
   }
-  if (!membersAdded.length && !membersRemoved.length && !edgesAdded.length && !edgesRemoved.length && !triggersAdded.length && !triggersRemoved.length && !memberDrift.length && !revisionDrift) {
+  if (!membersAdded.length && !membersRemoved.length && !edgesAdded.length && !edgesRemoved.length && !triggersToPush.length && !triggersToPull.length && !metaDecisions.length && !memberDrift.length && !revisionDrift) {
     lines.push(`  ${import_picocolors44.default.green("✓")} everything is in sync`);
     lines.push("");
     console.log(lines.join(`
@@ -69231,13 +70076,13 @@ async function runOrchestrationStatus(cwd2) {
   console.log(lines.join(`
 `));
 }
-function stableJson(value) {
+function stableJson2(value) {
   if (value == null || typeof value !== "object")
     return JSON.stringify(value);
   if (Array.isArray(value))
-    return `[${value.map(stableJson).join(",")}]`;
+    return `[${value.map(stableJson2).join(",")}]`;
   const obj = value;
-  return `{${Object.keys(obj).sort().map((key2) => `${JSON.stringify(key2)}:${stableJson(obj[key2])}`).join(",")}}`;
+  return `{${Object.keys(obj).sort().map((key2) => `${JSON.stringify(key2)}:${stableJson2(obj[key2])}`).join(",")}}`;
 }
 
 // src/cli/orchestration-list.ts
@@ -69343,7 +70188,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   banner("orchestration add-agent — create a member agent and wire it into the graph");
   const link2 = readOrchLink(cwd2);
   if (!link2 || !hasOrchManifest(cwd2)) {
-    f2.warn("This folder is not a linked orchestration.");
+    failWarn("This folder is not a linked orchestration.");
     f2.info(`Run ${import_picocolors46.default.cyan("brainbase orchestration pull <id>")} first.`);
     return;
   }
@@ -69351,7 +70196,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   try {
     manifest = readOrchManifest(cwd2);
   } catch (err) {
-    f2.error(err.message);
+    fail(err.message);
     return;
   }
   let name = args.name?.trim();
@@ -69377,7 +70222,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   try {
     payloadSchema = parseEdgeSchema(args.schema);
   } catch (err) {
-    f2.error(err.message);
+    fail(err.message);
     return;
   }
   let orgId = args.orgId;
@@ -69394,14 +70239,14 @@ async function runOrchestrationAddAgent(cwd2, args) {
       const resolved = resolveOrgIdForGroup(link2.group_id, orgsWithTeams);
       if (!resolved) {
         sp.stop("Failed.");
-        f2.error(`Could not find an org that owns group ${import_picocolors46.default.bold(link2.group_id)}. ` + `Pass ${import_picocolors46.default.cyan("--org <id>")} explicitly.`);
+        fail(`Could not find an org that owns group ${import_picocolors46.default.bold(link2.group_id)}. ` + `Pass ${import_picocolors46.default.cyan("--org <id>")} explicitly.`);
         return;
       }
       orgId = resolved;
       sp.stop("Resolved org.");
     } catch (err) {
       sp.stop("Failed.");
-      f2.error(err.message);
+      fail(err.message);
       return;
     }
   }
@@ -69434,7 +70279,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
   try {
     updated = mergeMemberAndEdges(manifest, { slug, name, from, to: to2, description, payloadSchema });
   } catch (err) {
-    f2.error(err.message);
+    fail(err.message);
     return;
   }
   const dest = memberDir(cwd2, slug);
@@ -69452,7 +70297,7 @@ async function runOrchestrationAddAgent(cwd2, args) {
     try {
       fs79.rmSync(dest, { recursive: true, force: true });
     } catch {}
-    f2.error(`Failed to create ${slug}: ${err.message}`);
+    fail(`Failed to create ${slug}: ${err.message}`);
     return;
   }
   writeOrchManifest(cwd2, updated);
@@ -69468,12 +70313,12 @@ var import_picocolors47 = __toESM(require_picocolors(), 1);
 async function runOrchestrationCreate(cwd2, args) {
   banner("orchestration create — claim a brainbase-orchestration.yaml");
   if (readOrchLink(cwd2)) {
-    f2.warn("This folder is already linked to an orchestration.");
+    failWarn("This folder is already linked to an orchestration.");
     f2.info(`Run ${import_picocolors47.default.cyan("brainbase orchestration push")} to update it.`);
     return;
   }
   if (!hasOrchManifest(cwd2)) {
-    f2.warn(`No ${import_picocolors47.default.bold(ORCH_MANIFEST_FILE)} here.`);
+    failWarn(`No ${import_picocolors47.default.bold(ORCH_MANIFEST_FILE)} here.`);
     f2.info(`Create one, or pull an existing orchestration first.`);
     return;
   }
@@ -69612,7 +70457,8 @@ async function runOrchestration(cwd2, sub, args, opts) {
     case "push":
       await runOrchestrationPush(cwd2, {
         yes: opts.yes,
-        graphOnly: opts.graphOnly
+        graphOnly: opts.graphOnly,
+        force: opts.force
       });
       return;
     case "status":
@@ -69664,7 +70510,7 @@ function printHelp3() {
   out.push(`  ${import_picocolors48.default.bold("Flags")}`);
   out.push(`    ${import_picocolors48.default.dim("--yes, -y")}        skip confirmations`);
   out.push(`    ${import_picocolors48.default.dim("--harness <id>")}   harness for newly-created member folders (default claude-code)`);
-  out.push(`    ${import_picocolors48.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`);
+  out.push(`    ${import_picocolors48.default.dim("--graph-only")}     for push: only update members + edges, skip per-member push`, `    ${import_picocolors48.default.dim("--force")}         for push: settle every conflict in your file's favour — deletes cloud schedule`, `                        triggers this folder has never seen, and overwrites cloud-side edits to`, `                        name, description, icon, icon_color and credit_limit`);
   out.push(`    ${import_picocolors48.default.dim("--org <id>")}       for create/list: org id or slug (CLI vocab — DB teams.id)`);
   out.push(`    ${import_picocolors48.default.dim("--team <id>")}      for create/list: team id (CLI vocab — DB groups.id)`);
   out.push("");
@@ -70467,7 +71313,10 @@ async function runTokenRevoke(args) {
   }
   const stored = readToken();
   const isLocalToken = Boolean(stored && stored.token.startsWith(target.prefix));
-  if (!autoProceed(args.yes)) {
+  if (!autoProceedDestructive(args.yes, {
+    action: `Revoking ${target.name} (${args.id})`,
+    flagHint: "Pass --yes to revoke it without a prompt."
+  })) {
     const ok = await se({
       message: isLocalToken ? `Revoke ${import_picocolors50.default.bold(target.name)} (${args.id})? This is the token this CLI is using, so it will stop working here too.` : `Revoke ${import_picocolors50.default.bold(target.name)} (${args.id})? CIs and machines using it will stop working.`,
       initialValue: false
@@ -77104,10 +77953,10 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
 }
 
 // node_modules/pkce-challenge/dist/index.node.js
-var crypto5;
-crypto5 = globalThis.crypto?.webcrypto ?? globalThis.crypto ?? import("node:crypto").then((m3) => m3.webcrypto);
+var crypto6;
+crypto6 = globalThis.crypto?.webcrypto ?? globalThis.crypto ?? import("node:crypto").then((m3) => m3.webcrypto);
 async function getRandomValues(size2) {
-  return (await crypto5).getRandomValues(new Uint8Array(size2));
+  return (await crypto6).getRandomValues(new Uint8Array(size2));
 }
 async function random2(size2) {
   const mask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
@@ -77127,7 +77976,7 @@ async function generateVerifier(length) {
   return await random2(length);
 }
 async function generateChallenge(code_verifier) {
-  const buffer = await (await crypto5).subtle.digest("SHA-256", new TextEncoder().encode(code_verifier));
+  const buffer = await (await crypto6).subtle.digest("SHA-256", new TextEncoder().encode(code_verifier));
   return btoa(String.fromCharCode(...new Uint8Array(buffer))).replace(/\//g, "_").replace(/\+/g, "-").replace(/=/g, "");
 }
 async function pkceChallenge(length) {
@@ -79169,10 +80018,99 @@ async function runMcp(cwd2, sub, _argv, options) {
 }
 
 // src/cli/task.ts
-var import_picocolors52 = __toESM(require_picocolors(), 1);
+var import_picocolors56 = __toESM(require_picocolors(), 1);
 
 // src/cli/task-create.ts
+var import_picocolors52 = __toESM(require_picocolors(), 1);
 import { randomUUID as randomUUID2 } from "node:crypto";
+
+// src/cli/task-status.ts
+var TERMINAL_TASK_STATUSES = new Set([
+  "success",
+  "fail",
+  "need_more_info"
+]);
+var SUCCESS_STATUS = "success";
+function isTerminalTaskStatus(status) {
+  return TERMINAL_TASK_STATUSES.has(status);
+}
+function exitCodeForTaskStatus(status) {
+  return status === SUCCESS_STATUS ? 0 : 1;
+}
+var SIGINT_EXIT_CODE = 130;
+async function waitForTask(taskId, options) {
+  const stop = new AbortController;
+  const onExternalAbort = () => stop.abort();
+  options.signal?.addEventListener("abort", onExternalAbort, { once: true });
+  if (options.signal?.aborted)
+    stop.abort();
+  const deadlineTimer = options.timeoutMs === undefined ? null : setTimeout(() => stop.abort(), options.timeoutMs);
+  let latest = null;
+  let lastStatus = null;
+  const givenUp = () => options.signal?.aborted ? { kind: "interrupted", task: latest } : { kind: "timeout", task: latest };
+  try {
+    while (true) {
+      if (stop.signal.aborted)
+        return givenUp();
+      const polled = await raceAbort(masApi.getTask(taskId, { signal: stop.signal }), stop.signal);
+      if (polled.kind === "aborted")
+        return givenUp();
+      if (polled.kind === "failed") {
+        if (stop.signal.aborted)
+          return givenUp();
+        throw polled.error;
+      }
+      latest = polled.value;
+      if (latest.status !== lastStatus) {
+        lastStatus = latest.status;
+        options.onStatus?.(latest);
+      }
+      if (isTerminalTaskStatus(latest.status)) {
+        return { kind: "terminal", task: latest };
+      }
+      const cutShort = await sleep2(options.intervalMs, stop.signal);
+      if (cutShort)
+        return givenUp();
+    }
+  } finally {
+    if (deadlineTimer !== null)
+      clearTimeout(deadlineTimer);
+    options.signal?.removeEventListener("abort", onExternalAbort);
+  }
+}
+function raceAbort(work, signal) {
+  const settled = work.then((value) => ({ kind: "value", value }), (error2) => ({ kind: "failed", error: error2 }));
+  if (signal.aborted) {
+    settled.catch(() => {});
+    return Promise.resolve({ kind: "aborted" });
+  }
+  return new Promise((resolve) => {
+    const onAbort = () => resolve({ kind: "aborted" });
+    signal.addEventListener("abort", onAbort, { once: true });
+    settled.then((outcome) => {
+      signal.removeEventListener("abort", onAbort);
+      resolve(outcome);
+    });
+  });
+}
+function sleep2(ms2, signal) {
+  if (signal.aborted)
+    return Promise.resolve(true);
+  return new Promise((resolve) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve(true);
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve(false);
+    }, ms2);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// src/cli/task-create.ts
+var DEFAULT_POLL_INTERVAL_MS2 = 2000;
 async function createTask(input, options) {
   return await masApi.createTask(input, options);
 }
@@ -79231,21 +80169,633 @@ async function runTaskCreate(cwd2, options, dependencies = {}) {
     }
     throw error2;
   }
+  if (!options.wait) {
+    if (options.json) {
+      console.log(JSON.stringify({
+        task_id: created.id,
+        agent_id: created.agent_id,
+        status: created.status
+      }));
+      return;
+    }
+    console.log([
+      `Task ID: ${created.id}`,
+      `Agent ID: ${created.agent_id}`,
+      `Status: ${created.status}`,
+      "First run accepted."
+    ].join(`
+`));
+    return;
+  }
+  await waitForCreatedTask(created, options, dependencies);
+}
+async function waitForCreatedTask(created, options, dependencies) {
+  const setExitCode = dependencies.setExitCode ?? ((code) => process.exitCode = code);
+  const controller = new AbortController;
+  const onSigint = () => controller.abort();
+  process.on("SIGINT", onSigint);
+  if (!options.json) {
+    console.log(`Task ID: ${created.id}`);
+    console.log(`Agent ID: ${created.agent_id}`);
+  }
+  try {
+    const outcome = await waitForTask(created.id, {
+      intervalMs: options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS2,
+      timeoutMs: options.timeoutSeconds === undefined ? undefined : options.timeoutSeconds * 1000,
+      signal: controller.signal,
+      onStatus: options.json ? undefined : (task) => console.log(`Status: ${task.status}`)
+    });
+    const status = outcome.task?.status ?? created.status;
+    const code = outcome.kind === "terminal" ? exitCodeForTaskStatus(status) : outcome.kind === "interrupted" ? SIGINT_EXIT_CODE : 1;
+    setExitCode(code);
+    if (options.json) {
+      console.log(JSON.stringify({
+        task_id: created.id,
+        agent_id: created.agent_id,
+        status,
+        outcome: outcome.kind,
+        exit_code: code
+      }));
+      return;
+    }
+    if (outcome.kind === "timeout") {
+      console.log(import_picocolors52.default.yellow(`Timed out after ${options.timeoutSeconds}s with the task still ${status}.`));
+      return;
+    }
+    if (outcome.kind === "interrupted") {
+      console.log(import_picocolors52.default.yellow("Interrupted. The task is still running."));
+      return;
+    }
+    console.log(code === 0 ? import_picocolors52.default.green("Task completed.") : import_picocolors52.default.red(`Task finished as ${status}.`));
+  } finally {
+    process.removeListener("SIGINT", onSigint);
+  }
+}
+
+// src/cli/task-get.ts
+var import_picocolors54 = __toESM(require_picocolors(), 1);
+
+// src/cli/task-list.ts
+var import_picocolors53 = __toESM(require_picocolors(), 1);
+async function runTaskList(options) {
+  if (!options.json)
+    banner("task list — recent tasks");
+  const tasks = await masApi.listTasks({
+    agentId: options.agentId,
+    limit: options.limit
+  });
   if (options.json) {
-    console.log(JSON.stringify({
-      task_id: created.id,
-      agent_id: created.agent_id,
-      status: created.status
-    }));
+    console.log(JSON.stringify(tasks, null, 2));
     return;
   }
-  console.log([
-    `Task ID: ${created.id}`,
-    `Agent ID: ${created.agent_id}`,
-    `Status: ${created.status}`,
-    "First run accepted."
-  ].join(`
-`));
+  console.log(formatTaskList(tasks, options.agentId));
+}
+function formatTaskList(tasks, agentId) {
+  const lines = [""];
+  if (tasks.length === 0) {
+    lines.push(`  ${import_picocolors53.default.dim(agentId ? `No tasks for agent ${agentId}.` : "No tasks yet.")}`, "", `  ${import_picocolors53.default.dim("start one with")} ${import_picocolors53.default.cyan('brainbase task create --message "..."')}`, "");
+    return lines.join(`
+`);
+  }
+  for (const task of tasks) {
+    const title = task.title?.trim() || import_picocolors53.default.dim("(untitled)");
+    lines.push(`  ${statusLabel(task.status)}  ${import_picocolors53.default.bold(title)}`);
+    lines.push(`    ${import_picocolors53.default.dim(task.id)}`);
+    lines.push(`    ${import_picocolors53.default.dim(`agent ${task.agent_id} · created ${task.created_at}`)}`);
+    lines.push("");
+  }
+  lines.push(`  ${import_picocolors53.default.dim("inspect one with")} ${import_picocolors53.default.cyan("brainbase task get <id>")}`, "");
+  return lines.join(`
+`);
+}
+function statusLabel(status) {
+  const padded = status.padEnd(14);
+  switch (status) {
+    case "success":
+      return import_picocolors53.default.green(padded);
+    case "fail":
+      return import_picocolors53.default.red(padded);
+    case "need_more_info":
+      return import_picocolors53.default.yellow(padded);
+    case "running":
+    case "initializing":
+      return import_picocolors53.default.cyan(padded);
+    default:
+      return import_picocolors53.default.dim(padded);
+  }
+}
+
+// src/cli/task-get.ts
+async function runTaskGet(taskId, options = {}) {
+  if (!options.json)
+    banner("task get — one task");
+  const task = await masApi.getTask(taskId);
+  const evals = await readEvalRuns(task);
+  if (options.json) {
+    const payload = { task, eval_runs: evals.runs };
+    if (evals.unavailable)
+      payload.eval_runs_unavailable = evals.unavailable;
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  console.log(format(task, evals));
+}
+async function readEvalRuns(task) {
+  try {
+    return { runs: await api.listAgentEvalRuns(task.agent_id, { taskId: task.id }) };
+  } catch (error2) {
+    if (error2 instanceof ApiError && (error2.status === 401 || error2.status === 403)) {
+      return { runs: [], unavailable: error2.message };
+    }
+    if (error2 instanceof ApiError && error2.status === 404) {
+      return { runs: [], unavailable: "This control plane does not expose eval runs." };
+    }
+    throw error2;
+  }
+}
+function format(task, evals) {
+  const lines = [""];
+  const title = task.title?.trim() || import_picocolors54.default.dim("(untitled)");
+  lines.push(`  ${statusLabel(task.status)}  ${import_picocolors54.default.bold(title)}`);
+  lines.push("");
+  lines.push(`  ${import_picocolors54.default.dim("task")}     ${task.id}`);
+  lines.push(`  ${import_picocolors54.default.dim("agent")}    ${task.agent_id}`);
+  lines.push(`  ${import_picocolors54.default.dim("created")}  ${task.created_at}`);
+  if (task.parent_task_id) {
+    lines.push(`  ${import_picocolors54.default.dim("parent")}   ${task.parent_task_id}`);
+  }
+  if (task.machine_id) {
+    lines.push(`  ${import_picocolors54.default.dim("machine")}  ${task.machine_id}${task.machine_size ? ` (${task.machine_size})` : ""}`);
+  }
+  if (task.sandbox_id)
+    lines.push(`  ${import_picocolors54.default.dim("sandbox")}  ${task.sandbox_id}`);
+  const failure = failureSummary(task);
+  if (failure) {
+    lines.push("");
+    lines.push(`  ${import_picocolors54.default.red("failure")}  ${failure}`);
+  }
+  const metadata = Object.entries(task.metadata ?? {});
+  if (metadata.length > 0) {
+    lines.push("");
+    lines.push(`  ${import_picocolors54.default.bold(import_picocolors54.default.dim("METADATA"))}`);
+    for (const [key2, value] of metadata) {
+      lines.push(`  ${import_picocolors54.default.dim(key2)}  ${value}`);
+    }
+  }
+  lines.push("");
+  lines.push(`  ${import_picocolors54.default.bold(import_picocolors54.default.dim("EVAL VERDICTS"))}`);
+  if (evals.unavailable) {
+    lines.push(`  ${import_picocolors54.default.dim(evals.unavailable)}`);
+  } else if (evals.runs.length === 0) {
+    lines.push(`  ${import_picocolors54.default.dim("none")}`);
+  } else {
+    for (const run of evals.runs) {
+      const verdict = run.passed === true ? import_picocolors54.default.green("pass") : run.passed === false ? import_picocolors54.default.red("fail") : import_picocolors54.default.dim(run.status);
+      lines.push(`  ${verdict}  ${run.eval_slug ?? run.eval_id}`);
+      if (run.reasoning)
+        lines.push(`    ${import_picocolors54.default.dim(run.reasoning)}`);
+    }
+  }
+  lines.push("");
+  lines.push(`  ${import_picocolors54.default.dim("read its transcript with")} ${import_picocolors54.default.cyan(`brainbase task logs ${task.id}`)}`, "");
+  return lines.join(`
+`);
+}
+function failureSummary(task) {
+  const info = task.status_info;
+  if (!info)
+    return;
+  for (const key2 of ["failure_summary", "error"]) {
+    const value = info[key2];
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  return;
+}
+
+// src/cli/task-logs.ts
+var import_picocolors55 = __toESM(require_picocolors(), 1);
+
+// src/core/task-events.ts
+var DEFAULT_RETRY_BUDGET_MS = 60000;
+function followTaskEvents(options) {
+  const {
+    url: url2,
+    resolveBearer,
+    onFrame,
+    onOpen,
+    onReconnect,
+    signal,
+    retryBudgetMs = DEFAULT_RETRY_BUDGET_MS
+  } = options;
+  return new Promise((resolve, reject2) => {
+    if (signal?.aborted) {
+      resolve();
+      return;
+    }
+    let source;
+    let settled = false;
+    let closeRequested = false;
+    let downTimer;
+    let lastReason = "connection lost";
+    const clearBudget = () => {
+      if (downTimer !== undefined)
+        clearTimeout(downTimer);
+      downTimer = undefined;
+    };
+    const finish = (error2) => {
+      if (settled)
+        return;
+      settled = true;
+      closeRequested = true;
+      clearBudget();
+      source?.close();
+      if (error2)
+        reject2(error2);
+      else
+        resolve();
+    };
+    source = new EventSource(url2, {
+      fetch: async (input, init) => {
+        let bearer;
+        try {
+          bearer = await resolveBearer();
+        } catch (error2) {
+          if (error2 instanceof StreamHostMovedError) {
+            finish(error2);
+            throw error2;
+          }
+          throw error2;
+        }
+        const headers = new Headers(init?.headers);
+        headers.set("Authorization", `Bearer ${bearer}`);
+        return await fetch(input, { ...init, headers });
+      }
+    });
+    if (closeRequested)
+      source.close();
+    const dispatch = source.dispatchEvent.bind(source);
+    source.dispatchEvent = (event) => {
+      if (event instanceof MessageEvent) {
+        onFrame({
+          id: event.lastEventId,
+          type: event.type,
+          data: parseFrameData(event.data)
+        });
+      }
+      return dispatch(event);
+    };
+    source.addEventListener("open", () => {
+      clearBudget();
+      onOpen?.();
+    });
+    source.addEventListener("error", (event) => {
+      const { message, code } = event;
+      if (source.readyState === source.CLOSED) {
+        finish(streamError(message, code));
+        return;
+      }
+      lastReason = message?.trim() || "connection lost";
+      onReconnect?.(lastReason);
+      if (downTimer === undefined) {
+        downTimer = setTimeout(() => {
+          finish(new ApiError(`The log stream has been unreachable for ${Math.round(retryBudgetMs / 1000)}s (${lastReason}). Giving up — the task may still be running; re-run to reattach.`));
+        }, retryBudgetMs);
+      }
+    });
+    signal?.addEventListener("abort", () => finish(), { once: true });
+  });
+}
+function parseFrameData(raw) {
+  if (typeof raw !== "string")
+    return raw;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
+  }
+}
+function streamError(message, code) {
+  const detail = message?.trim() || "the log stream closed";
+  switch (code) {
+    case 401:
+      return new ApiError(`Not authorized to read this task's events: ${detail}`, 401);
+    case 403:
+      return new ApiError(`Not permitted to read this task's events: ${detail}`, 403);
+    case 404:
+      return new ApiError("No such task, or this control plane does not stream task events yet.", 404);
+    default:
+      return new ApiError(detail, code);
+  }
+}
+
+// src/cli/task-logs.ts
+var MAX_PAGE = 1000;
+var PAGE_SIZE = 500;
+async function runTaskLogs(taskId, options = {}, dependencies = {}) {
+  if (options.follow) {
+    await followTranscript(taskId, options, dependencies);
+    return;
+  }
+  const events = await readTranscript(taskId, options.limit);
+  if (options.json) {
+    console.log(JSON.stringify({ items: events }, null, 2));
+    return;
+  }
+  const ordered = [...events].sort((a3, b4) => a3.ts.localeCompare(b4.ts));
+  const rolledUp = rolledUpLanes(ordered);
+  for (const event of ordered) {
+    if (isSupersededChunk(event, rolledUp))
+      continue;
+    console.log(renderEvent(event));
+  }
+  if (ordered.length === 0) {
+    console.log(import_picocolors55.default.dim("No events for this task yet."));
+  }
+}
+async function followTranscript(taskId, options, dependencies) {
+  const backfill = options.limit === undefined ? "" : `?backfill=${options.limit}`;
+  const { url: url2, resolveBearer } = await masStreamTarget(`/tasks/${encodeURIComponent(taskId)}/events/stream${backfill}`);
+  if (!options.json) {
+    console.log(import_picocolors55.default.dim(`Following task ${taskId} — Ctrl-C to stop.`));
+  }
+  const setExitCode = dependencies.setExitCode ?? ((code) => process.exitCode = code);
+  const controller = new AbortController;
+  let interruptCode;
+  const stopOn = (code) => () => {
+    interruptCode = code;
+    controller.abort();
+  };
+  const onSigint = stopOn(SIGINT_EXIT_CODE);
+  const onSigterm = stopOn(143);
+  process.once("SIGINT", onSigint);
+  process.once("SIGTERM", onSigterm);
+  try {
+    await followTaskEvents({
+      url: url2,
+      resolveBearer,
+      signal: controller.signal,
+      retryBudgetMs: dependencies.retryBudgetMs,
+      onFrame: (frame) => {
+        const event = frame.data;
+        if (isTaskEvent(event)) {
+          console.log(options.json ? JSON.stringify(event) : renderEvent(event));
+          if (isTaskSettled(event))
+            controller.abort();
+        } else if (options.json) {
+          console.log(JSON.stringify(frame));
+        } else {
+          console.log(import_picocolors55.default.dim(frame.type));
+        }
+      },
+      onReconnect: (reason) => console.error(import_picocolors55.default.dim(`reconnecting — ${reason}`))
+    });
+    if (interruptCode !== undefined)
+      setExitCode(interruptCode);
+  } finally {
+    process.off("SIGINT", onSigint);
+    process.off("SIGTERM", onSigterm);
+  }
+}
+function isTaskSettled(event) {
+  if (event.type !== "idle")
+    return false;
+  const status = event.data?.status;
+  return typeof status === "string" && isTerminalTaskStatus(status);
+}
+function isTaskEvent(value) {
+  return !!value && typeof value === "object" && typeof value.type === "string" && typeof value.ts === "string";
+}
+function rolledUpLanes(events) {
+  const lanes = new Set;
+  for (const event of events) {
+    if (event.type === "assistant.message" || event.type === "subagent.assistant.message") {
+      lanes.add(laneOf(event));
+    }
+  }
+  return lanes;
+}
+function isSupersededChunk(event, rolledUp) {
+  return event.type.endsWith(".message.chunk") && rolledUp.has(laneOf(event));
+}
+function laneOf(event) {
+  return `${event.subagent_id ?? ""}\x00${event.turn_id ?? ""}`;
+}
+async function readTranscript(taskId, limit) {
+  const collected = [];
+  let after2;
+  while (true) {
+    const remaining = limit === undefined ? PAGE_SIZE : limit - collected.length;
+    if (remaining <= 0)
+      break;
+    const pageSize = Math.min(MAX_PAGE, remaining === PAGE_SIZE ? PAGE_SIZE : remaining);
+    const page = await masApi.listTaskEvents(taskId, { limit: pageSize, after: after2 });
+    if (page.length < pageSize) {
+      collected.push(...page);
+      break;
+    }
+    const last2 = page[page.length - 1];
+    const next = { receivedAt: last2.received_at, id: last2.id };
+    if (after2 && next.receivedAt === after2.receivedAt && next.id === after2.id) {
+      break;
+    }
+    collected.push(...page);
+    after2 = next;
+  }
+  return collected;
+}
+function renderEvent(event) {
+  const summary = summarize(event);
+  const head3 = `${event.ts}  ${event.type}`;
+  return summary ? `${head3}  ${summary}` : head3;
+}
+function summarize(event) {
+  const data = event.data ?? {};
+  switch (baseType(event.type)) {
+    case "user.message":
+    case "assistant.message":
+    case "assistant.message.chunk":
+      return oneLine2(textOf(data.content));
+    case "assistant.thinking":
+      return oneLine2(asString(data.thought));
+    case "tool_call.start":
+      return oneLine2(`${asString(data.name)} ${compact2(data.args)}`);
+    case "tool_call.end":
+      return oneLine2(`${asString(data.name)} → ${asString(data.status)}`);
+    case "idle":
+      return oneLine2([asString(data.status), asString(data.summary) || asString(data.message)].filter(Boolean).join(" — "));
+    default:
+      return oneLine2(compact2(data));
+  }
+}
+function baseType(type) {
+  return type.startsWith("subagent.") ? type.slice("subagent.".length) : type;
+}
+function textOf(content) {
+  if (!Array.isArray(content))
+    return "";
+  return content.map((item) => {
+    if (!item || typeof item !== "object")
+      return "";
+    const record3 = item;
+    return record3.type === "text" ? asString(record3.content) : "";
+  }).filter(Boolean).join(" ");
+}
+function asString(value) {
+  return typeof value === "string" ? value : "";
+}
+function compact2(value) {
+  if (value === undefined || value === null)
+    return "";
+  try {
+    const encoded = JSON.stringify(value);
+    return encoded === "{}" ? "" : encoded ?? "";
+  } catch {
+    return "";
+  }
+}
+function oneLine2(value) {
+  const flattened = value.replace(/\s+/g, " ").trim();
+  return flattened.length > 300 ? `${flattened.slice(0, 299)}…` : flattened;
+}
+
+// src/core/argv.ts
+class ArgvParseError extends Error {
+  code = "invalid_arguments";
+  constructor(message) {
+    super(message);
+    this.name = "ArgvParseError";
+  }
+}
+function parseBoolean(value, name) {
+  switch (value.trim().toLowerCase()) {
+    case "":
+    case "0":
+    case "false":
+    case "no":
+    case "off":
+      return false;
+    case "1":
+    case "true":
+    case "yes":
+    case "on":
+      return true;
+    default:
+      throw new ArgvParseError(`Unrecognised value for ${name}: ${value}`);
+  }
+}
+function validateDefinitions(definitions) {
+  const names = new Map;
+  const keys2 = new Set;
+  for (const definition of definitions) {
+    if (!definition.key) {
+      throw new Error("argv option keys must not be empty");
+    }
+    if (keys2.has(definition.key)) {
+      throw new Error(`duplicate argv option key: ${definition.key}`);
+    }
+    keys2.add(definition.key);
+    for (const name of definition.names) {
+      if (!name.startsWith("-") || name === "-") {
+        throw new Error(`invalid argv option name: ${name}`);
+      }
+      if (name.includes("=")) {
+        throw new Error(`argv option names must not contain "=": ${name}`);
+      }
+      if (names.has(name)) {
+        throw new Error(`duplicate argv option name: ${name}`);
+      }
+      names.set(name, definition);
+    }
+  }
+  return names;
+}
+function findDefinition(token, definitions) {
+  const exact = definitions.get(token);
+  if (exact)
+    return { definition: exact, name: token };
+  const equals = token.indexOf("=");
+  if (equals < 1)
+    return null;
+  const name = token.slice(0, equals);
+  const definition = definitions.get(name);
+  return definition ? { definition, name, joined: token.slice(equals + 1) } : null;
+}
+function assignOption(options, definition, value, name) {
+  const current = options[definition.key];
+  if (definition.multiple) {
+    if (typeof value !== "string") {
+      throw new Error(`boolean argv option cannot be repeated: ${name}`);
+    }
+    options[definition.key] = [
+      ...Array.isArray(current) ? current : [],
+      value
+    ];
+    return;
+  }
+  if (current !== undefined) {
+    throw new ArgvParseError(`Option ${name} may only be provided once`);
+  }
+  options[definition.key] = value;
+}
+function parseArgv(argv, definitions) {
+  const byName = validateDefinitions(definitions);
+  const options = Object.create(null);
+  const positionals = [];
+  let optionsEnabled = true;
+  for (let index = 0;index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!optionsEnabled) {
+      positionals.push(token);
+      continue;
+    }
+    if (token === "--") {
+      optionsEnabled = false;
+      continue;
+    }
+    if (!token.startsWith("-") || token === "-") {
+      positionals.push(token);
+      continue;
+    }
+    const hit = findDefinition(token, byName);
+    if (!hit) {
+      throw new ArgvParseError(`Unknown option: ${token.split("=", 1)[0]}`);
+    }
+    if (hit.definition.kind === "boolean") {
+      assignOption(options, hit.definition, hit.joined === undefined ? true : parseBoolean(hit.joined, hit.name), hit.name);
+      continue;
+    }
+    let value = hit.joined;
+    if (value === undefined) {
+      const next = argv[index + 1];
+      if (next === "--") {
+        value = argv[index + 2];
+        if (value === undefined) {
+          throw new ArgvParseError(`Option ${hit.name} requires a value`);
+        }
+        index += 2;
+      } else {
+        if (next === undefined || next.startsWith("-")) {
+          throw new ArgvParseError(`Option ${hit.name} requires a value; use ${hit.name}=<value> for values beginning with "-"`);
+        }
+        value = next;
+        index += 1;
+      }
+    }
+    assignOption(options, hit.definition, value, hit.name);
+  }
+  return { options, positionals };
+}
+function stringOption(parsed, key2) {
+  const value = parsed.options[key2];
+  return typeof value === "string" ? value : undefined;
+}
+function stringOptions(parsed, key2) {
+  const value = parsed.options[key2];
+  return Array.isArray(value) ? value : [];
+}
+function booleanOption(parsed, key2) {
+  return parsed.options[key2] === true;
 }
 
 // src/cli/task.ts
@@ -79253,13 +80803,16 @@ var VALUE_FLAGS = [
   ["--agent", "agentId"],
   ["--message", "message"],
   ["--title", "title"],
-  ["--model", "model"]
+  ["--model", "model"],
+  ["--timeout", "timeout"]
 ];
+var BOOLEAN_FLAGS = ["--json", "--wait"];
 var TASK_OPTION_NAMES = new Set([
   ...VALUE_FLAGS.map(([flag]) => flag),
-  "--json"
+  ...BOOLEAN_FLAGS
 ]);
 var HELP_FLAGS = new Set(["--help", "-h"]);
+var LIST_LIMIT_MAX = 200;
 function missingValueError(flag) {
   if (flag === "--message" || flag === "--agent") {
     return new Error(`${flag} is required and must not be blank.`);
@@ -79275,14 +80828,17 @@ function parseCreateArgs(args) {
   for (let index = 0;index < args.length; index += 1) {
     const arg = args[index];
     if (HELP_FLAGS.has(arg)) {
-      return { help: true, options };
+      return { help: true, options: finishCreateArgs(options) };
     }
-    if (arg === "--json") {
+    if (arg === "--json" || arg === "--wait") {
       if (seen.has(arg)) {
         throw new Error(`Duplicate task create option: ${arg}`);
       }
       seen.add(arg);
-      options.json = true;
+      if (arg === "--json")
+        options.json = true;
+      else
+        options.wait = true;
       continue;
     }
     let matched = false;
@@ -79302,7 +80858,7 @@ function parseCreateArgs(args) {
             throw missingValueError(flag);
           index += 1;
         } else if (HELP_FLAGS.has(value) && (option === "agentId" || option === "model")) {
-          return { help: true, options };
+          return { help: true, options: finishCreateArgs(options) };
         } else if (TASK_OPTION_NAMES.has(value)) {
           throw flagLikeValueError(flag, value);
         }
@@ -79326,7 +80882,38 @@ function parseCreateArgs(args) {
       throw new Error(`Unknown task create argument: ${arg}`);
     }
   }
-  return { help: false, options };
+  return { help: false, options: finishCreateArgs(options) };
+}
+function finishCreateArgs(raw) {
+  const { timeout, ...rest2 } = raw;
+  if (timeout === undefined)
+    return rest2;
+  const seconds = Number(timeout.trim());
+  if (!Number.isFinite(seconds) || seconds <= 0) {
+    throw new Error("--timeout must be a positive number of seconds.");
+  }
+  if (!rest2.wait) {
+    throw new Error("--timeout only applies with --wait.");
+  }
+  return { ...rest2, timeoutSeconds: seconds };
+}
+function positiveInteger(value, flag, max2) {
+  if (value === undefined)
+    return;
+  const parsed = Number(value.trim());
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`${flag} must be a positive whole number.`);
+  }
+  if (max2 !== undefined && parsed > max2) {
+    throw new Error(`${flag} must be between 1 and ${max2}.`);
+  }
+  return parsed;
+}
+function requiredTaskId(positionals, usage) {
+  if (positionals.length !== 1 || !positionals[0]?.trim()) {
+    throw new Error(`Usage: ${usage}`);
+  }
+  return positionals[0].trim();
 }
 async function runTask(cwd2, sub, args) {
   switch (sub) {
@@ -79339,6 +80926,56 @@ async function runTask(cwd2, sub, args) {
       await runTaskCreate(cwd2, parsed.options);
       return;
     }
+    case "list": {
+      if (args.some((arg) => HELP_FLAGS.has(arg))) {
+        printHelp4();
+        return;
+      }
+      const parsed = parseArgv(args, [
+        { key: "agent", names: ["--agent"], kind: "value" },
+        { key: "limit", names: ["--limit"], kind: "value" },
+        { key: "json", names: ["--json"], kind: "boolean" }
+      ]);
+      if (parsed.positionals.length > 0) {
+        throw new Error("Usage: brainbase task list [--agent <id>] [--limit <n>] [--json]");
+      }
+      await runTaskList({
+        agentId: stringOption(parsed, "agent"),
+        limit: positiveInteger(stringOption(parsed, "limit"), "--limit", LIST_LIMIT_MAX),
+        json: booleanOption(parsed, "json")
+      });
+      return;
+    }
+    case "get": {
+      if (args.some((arg) => HELP_FLAGS.has(arg))) {
+        printHelp4();
+        return;
+      }
+      const parsed = parseArgv(args, [
+        { key: "json", names: ["--json"], kind: "boolean" }
+      ]);
+      const taskId = requiredTaskId(parsed.positionals, "brainbase task get <task-id> [--json]");
+      await runTaskGet(taskId, { json: booleanOption(parsed, "json") });
+      return;
+    }
+    case "logs": {
+      if (args.some((arg) => HELP_FLAGS.has(arg))) {
+        printHelp4();
+        return;
+      }
+      const parsed = parseArgv(args, [
+        { key: "limit", names: ["--limit"], kind: "value" },
+        { key: "json", names: ["--json"], kind: "boolean" },
+        { key: "follow", names: ["--follow", "-f"], kind: "boolean" }
+      ]);
+      const taskId = requiredTaskId(parsed.positionals, "brainbase task logs <task-id> [--limit <n>] [--json] [--follow]");
+      await runTaskLogs(taskId, {
+        limit: positiveInteger(stringOption(parsed, "limit"), "--limit"),
+        json: booleanOption(parsed, "json"),
+        follow: booleanOption(parsed, "follow")
+      });
+      return;
+    }
     case undefined:
     case "help":
     case "-h":
@@ -79355,18 +80992,220 @@ async function runTask(cwd2, sub, args) {
 function printHelp4() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors52.default.bold("brainbase task")} ${import_picocolors52.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors56.default.bold("brainbase task")} ${import_picocolors56.default.dim("<sub> [options]")}`);
+  out.push("");
+  out.push(`  ${import_picocolors56.default.cyan("create")} ${import_picocolors56.default.dim("--message <text>")}   ${import_picocolors56.default.dim("create a task and start its first run")}`);
+  out.push(`  ${import_picocolors56.default.cyan("list")}                     ${import_picocolors56.default.dim("recent tasks you can reach (--json for scripts)")}`);
+  out.push(`  ${import_picocolors56.default.cyan("get")} ${import_picocolors56.default.dim("<task-id>")}            ${import_picocolors56.default.dim("one task: status, agent, machine, eval verdicts")}`);
+  out.push(`  ${import_picocolors56.default.cyan("logs")} ${import_picocolors56.default.dim("<task-id> [--follow]")} ${import_picocolors56.default.dim("one line per event in the task's transcript, or tail it live")}`);
+  out.push("");
+  out.push(`  ${import_picocolors56.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors56.default.dim("--message <text>")}   required first user message`);
+  out.push(`  ${import_picocolors56.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
+  out.push(`  ${import_picocolors56.default.dim("--title <text>")}     optional task title`);
+  out.push(`  ${import_picocolors56.default.dim("--model <id>")}       optional model override`);
+  out.push(`  ${import_picocolors56.default.dim("--wait")}             block until the task finishes; exit 1 unless it succeeded`);
+  out.push(`  ${import_picocolors56.default.dim("--timeout <secs>")}   give up waiting after <secs> and exit 1 (needs --wait)`);
+  out.push("");
+  out.push(`  ${import_picocolors56.default.bold("list flags")}`);
+  out.push(`  ${import_picocolors56.default.dim("--agent <id>")}       only this agent's tasks`);
+  out.push(`  ${import_picocolors56.default.dim("--limit <n>")}        cap the page (1-200, server default 50)`);
   out.push("");
-  out.push(`  ${import_picocolors52.default.cyan("create")} ${import_picocolors52.default.dim("--message <text>")}   ${import_picocolors52.default.dim("create a task and start its first run")}`);
+  out.push(`  ${import_picocolors56.default.bold("logs flags")}`);
+  out.push(`  ${import_picocolors56.default.dim("--limit <n>")}        stop after <n> events instead of the whole transcript; with --follow, the first page size`);
+  out.push(`  ${import_picocolors56.default.dim("--follow, -f")}       stay attached and print events as they land, until the task finishes`);
   out.push("");
-  out.push(`  ${import_picocolors52.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors52.default.dim("--message <text>")}   required first user message`);
-  out.push(`  ${import_picocolors52.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
-  out.push(`  ${import_picocolors52.default.dim("--title <text>")}     optional task title`);
-  out.push(`  ${import_picocolors52.default.dim("--model <id>")}       optional model override`);
-  out.push(`  ${import_picocolors52.default.dim("--json")}             print task_id, agent_id, and status as JSON`);
+  out.push(`  ${import_picocolors56.default.bold("every subcommand")}`);
+  out.push(`  ${import_picocolors56.default.dim("--json")}             machine-readable output — create prints task_id, agent_id and status; list, get and logs print the raw records`);
+  out.push(`  ${import_picocolors56.default.dim("                    logs --follow --json prints one record per line, since a live stream has no end to close on")}`);
   out.push("");
-  out.push(`  ${import_picocolors52.default.dim("Flag-like values:")} use ${import_picocolors52.default.cyan("--flag=value")} or ${import_picocolors52.default.cyan("--flag -- <value>")}`);
+  out.push(`  ${import_picocolors56.default.dim("Exit codes with --wait:")} ${import_picocolors56.default.dim("0 succeeded · 1 failed, needs input, or timed out · 130 interrupted")}`);
+  out.push(`  ${import_picocolors56.default.dim("Exit codes with --follow:")} ${import_picocolors56.default.dim("0 task reached a terminal state · 1 stream refused, or unreachable for 60s · 130 interrupted (Ctrl-C) · 143 terminated")}`);
+  out.push("");
+  out.push(`  ${import_picocolors56.default.dim("Flag-like values:")} use ${import_picocolors56.default.cyan("--flag=value")} or ${import_picocolors56.default.cyan("--flag -- <value>")}`);
+  out.push("");
+  console.log(out.join(`
+`));
+}
+
+// src/cli/machine.ts
+var import_picocolors59 = __toESM(require_picocolors(), 1);
+
+// src/cli/machine-list.ts
+var import_picocolors57 = __toESM(require_picocolors(), 1);
+async function runMachineList(args = {}) {
+  if (!args.json)
+    banner("machine list — sandboxes you can reach");
+  const machines = await masApi.listMachines({
+    includeDead: Boolean(args.all),
+    limit: args.limit
+  });
+  if (args.json) {
+    console.log(JSON.stringify(machines, null, 2));
+    return;
+  }
+  console.log(formatMachineList(machines, Boolean(args.all)));
+}
+function formatMachineList(machines, includedDead) {
+  const lines = [""];
+  if (machines.length === 0) {
+    lines.push(`  ${import_picocolors57.default.dim(includedDead ? "No machines." : "No live machines. Pass --all to include torn-down ones.")}`, "");
+    return lines.join(`
+`);
+  }
+  const rows = machines.map((machine) => ({
+    id: machine.id,
+    kind: machine.kind,
+    status: machine.destroyed_at ? "dead" : machine.status,
+    size: machine.machine_size ?? "",
+    age: age(machine.created_at),
+    dead: Boolean(machine.destroyed_at)
+  }));
+  const width = (pick3) => Math.max(...rows.map((row) => pick3(row).length), 0);
+  const idWidth = width((row) => row.id);
+  const kindWidth = width((row) => row.kind);
+  const statusWidth = width((row) => row.status);
+  const sizeWidth = width((row) => row.size);
+  for (const row of rows) {
+    const status = row.status.padEnd(statusWidth);
+    const cells = [
+      row.id.padEnd(idWidth),
+      row.kind.padEnd(kindWidth),
+      row.dead ? status : statusTint(row.status, status),
+      row.size.padEnd(sizeWidth),
+      import_picocolors57.default.dim(row.age)
+    ].join("  ");
+    lines.push(`  ${row.dead ? import_picocolors57.default.dim(cells) : cells}`);
+  }
+  lines.push("", `  ${import_picocolors57.default.dim("tear one down with")} ${import_picocolors57.default.cyan("brainbase machine rm <id>")}`, "");
+  return lines.join(`
+`);
+}
+function statusTint(status, padded) {
+  switch (status) {
+    case "running":
+      return import_picocolors57.default.green(padded);
+    case "stopped":
+    case "starting":
+      return import_picocolors57.default.yellow(padded);
+    default:
+      return padded;
+  }
+}
+function age(createdAt) {
+  if (!createdAt)
+    return "";
+  const started = new Date(createdAt).getTime();
+  if (Number.isNaN(started))
+    return "";
+  const minutes = Math.floor((Date.now() - started) / 60000);
+  if (minutes < 1)
+    return "just now";
+  if (minutes < 60)
+    return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24)
+    return `${hours}h`;
+  return `${Math.floor(hours / 24)}d`;
+}
+
+// src/cli/machine-rm.ts
+var import_picocolors58 = __toESM(require_picocolors(), 1);
+async function runMachineRm(args, dependencies = {}) {
+  const setExitCode = dependencies.setExitCode ?? ((code) => process.exitCode = code);
+  const machineId = args.machineId?.trim();
+  if (!machineId) {
+    throw new Error("A machine id is required: `brainbase machine rm <id>`. List them with `brainbase machine ls`.");
+  }
+  if (!args.json)
+    banner(`machine rm — ${machineId}`);
+  const confirmTeardown = dependencies.confirmTeardown ?? promptForTeardown;
+  if (!await confirmTeardown({ ...args, machineId })) {
+    if (args.json) {
+      console.log(JSON.stringify({ id: machineId, torn_down: false, outcome: "declined" }, null, 2));
+    } else {
+      console.log(`  ${import_picocolors58.default.dim("Left alone.")}`);
+    }
+    return;
+  }
+  const machine = await masApi.deleteMachine(machineId);
+  if (!machine.destroyed_at)
+    setExitCode(1);
+  if (args.json) {
+    console.log(JSON.stringify(machine, null, 2));
+    return;
+  }
+  console.log(formatMachineRm(machine));
+}
+async function promptForTeardown(args) {
+  if (autoProceed(args.yes))
+    return true;
+  if (!args.json) {
+    console.log(`
+  ${import_picocolors58.default.red("This destroys the sandbox.")} ${import_picocolors58.default.dim("Anything not committed out of it is lost. The machine row is kept for cost history.")}
+`);
+  }
+  const answer = await se({
+    message: `Tear down ${args.machineId}?`,
+    initialValue: false
+  });
+  return ensureNotCancelled(answer);
+}
+function formatMachineRm(machine) {
+  const lines = [""];
+  if (machine.destroyed_at) {
+    lines.push(`  ${import_picocolors58.default.green("✓")} ${machine.kind} sandbox ${machine.id} is torn down.`, `  ${import_picocolors58.default.dim(`destroyed_at ${machine.destroyed_at}`)}`);
+  } else {
+    lines.push(`  ${import_picocolors58.default.yellow("!")} ${machine.id} came back without a teardown timestamp (status ${machine.status}).`, `  ${import_picocolors58.default.dim("Re-check with `brainbase machine ls --all` before assuming it stopped billing.")}`);
+  }
+  lines.push("");
+  return lines.join(`
+`);
+}
+
+// src/cli/machine.ts
+async function runMachine(sub, args, opts) {
+  if (args.some((arg) => arg === "--help" || arg === "-h")) {
+    printHelp5();
+    return;
+  }
+  switch (sub) {
+    case "ls":
+    case "list":
+      await runMachineList({ all: opts.all, limit: opts.limit, json: opts.json });
+      return;
+    case "rm":
+      await runMachineRm({
+        machineId: args[0],
+        yes: opts.yes,
+        json: opts.json
+      });
+      return;
+    case undefined:
+    case "help":
+    case "-h":
+    case "--help":
+      printHelp5();
+      return;
+    default:
+      console.error(`Unknown machine subcommand: ${sub}
+`);
+      printHelp5();
+      process.exit(1);
+  }
+}
+function printHelp5() {
+  const out = [];
+  out.push("");
+  out.push(`  ${import_picocolors59.default.bold("brainbase machine")} ${import_picocolors59.default.dim("<sub> [options]")}`);
+  out.push("");
+  out.push(`  ${import_picocolors59.default.cyan("ls")}          ${import_picocolors59.default.dim("list your sandboxes — live ones only unless --all")}`);
+  out.push(`  ${import_picocolors59.default.cyan("rm")} ${import_picocolors59.default.dim("<id>")}    ${import_picocolors59.default.dim("tear a sandbox down (terminal; the row is kept for cost history)")}`);
+  out.push("");
+  out.push(`  ${import_picocolors59.default.dim("--all")}     ${import_picocolors59.default.dim("for ls: include machines already torn down")}`);
+  out.push(`  ${import_picocolors59.default.dim("--limit <n>")} ${import_picocolors59.default.dim("for ls: how many to fetch (1-200, default 50)")}`);
+  out.push(`  ${import_picocolors59.default.dim("--yes, -y")} ${import_picocolors59.default.dim("for rm: skip the confirmation")}`);
+  out.push(`  ${import_picocolors59.default.dim("--json")}    ${import_picocolors59.default.dim("machine-readable output")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -79377,7 +81216,7 @@ import {
   execFileSync as execFileSync3,
   spawn as spawn5
 } from "node:child_process";
-import crypto10 from "node:crypto";
+import crypto11 from "node:crypto";
 import fs86 from "node:fs";
 import os19 from "node:os";
 import path94 from "node:path";
@@ -79387,7 +81226,7 @@ import {
   execFileSync as execFileSync2,
   spawn as spawn4
 } from "node:child_process";
-import crypto6 from "node:crypto";
+import crypto7 from "node:crypto";
 import fs81 from "node:fs";
 import os16 from "node:os";
 import path89 from "node:path";
@@ -79976,7 +81815,7 @@ function openRegularFileNoFollow(filePath, label, root) {
   return { fd, stat };
 }
 async function sha256OfDescriptor(fd) {
-  const hash = crypto6.createHash("sha256");
+  const hash = crypto7.createHash("sha256");
   const stream = fs81.createReadStream("", {
     fd,
     autoClose: false,
@@ -80224,7 +82063,7 @@ async function downloadInputReference(stagingRoot, input, context) {
   fs81.mkdirSync(path89.dirname(destination), { recursive: true, mode: 448 });
   assertNoSymlinkTraversal(stagingRoot, relative);
   assertWritableDestination(stagingRoot, relative);
-  const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.download`;
+  const temporary = `${destination}.${process.pid}.${crypto7.randomBytes(6).toString("hex")}.download`;
   const controller = new AbortController;
   const timer = setTimeout(() => controller.abort(), remainingMs);
   let descriptor;
@@ -80256,7 +82095,7 @@ async function downloadInputReference(stagingRoot, input, context) {
     let actual;
     let size2 = 0;
     try {
-      const hash = crypto6.createHash("sha256");
+      const hash = crypto7.createHash("sha256");
       while (true) {
         const { done, value } = await reader.read();
         if (done)
@@ -80441,9 +82280,9 @@ function findZipMembers(archivePath, requested, context) {
 }
 async function writeVerifiedArchiveMember(source, destination, material, context) {
   fs81.mkdirSync(path89.dirname(destination), { recursive: true, mode: 448 });
-  const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
+  const temporary = `${destination}.${process.pid}.${crypto7.randomBytes(6).toString("hex")}.tmp`;
   const descriptor = fs81.openSync(temporary, "wx", 384);
-  const hash = crypto6.createHash("sha256");
+  const hash = crypto7.createHash("sha256");
   let size2 = 0;
   try {
     for await (const value of source) {
@@ -80632,7 +82471,7 @@ async function extractArchiveMembers(archivePath, outputRoot, materials, context
 }
 async function atomicCopy(source, destination, mode, sourceRoot) {
   fs81.mkdirSync(path89.dirname(destination), { recursive: true });
-  const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
+  const temporary = `${destination}.${process.pid}.${crypto7.randomBytes(6).toString("hex")}.tmp`;
   const opened = openRegularFileNoFollow(source, `copy source ${source}`, sourceRoot);
   try {
     await pipeline2(fs81.createReadStream("", {
@@ -81040,7 +82879,7 @@ async function runCommand(command, root, spec, context, options = {}) {
   const reachesPhaseDeadline = command.timeout_ms === undefined || command.timeout_ms >= remainingMs;
   const timeoutMs2 = reachesPhaseDeadline ? remainingMs : command.timeout_ms;
   const started = Date.now();
-  const commandMarker = crypto6.randomBytes(32).toString("hex");
+  const commandMarker = crypto7.randomBytes(32).toString("hex");
   return await new Promise((resolve, reject2) => {
     const child = spawn4(command.argv[0], command.argv.slice(1), {
       cwd: cwd2,
@@ -81077,7 +82916,7 @@ async function runCommand(command, root, spec, context, options = {}) {
         return error2;
       return new BenchmarkCommandExecutionError(error2.code, error2.message, sanitizedOutput(stdout), sanitizedOutput(stderr), error2.durationMs);
     };
-    const fail = (error2) => {
+    const fail2 = (error2) => {
       if (settled)
         return;
       settled = true;
@@ -81096,7 +82935,7 @@ async function runCommand(command, root, spec, context, options = {}) {
       captured += chunk2.length;
       context.remainingOutputBytes -= chunk2.length;
       if (captured > spec.budget.max_output_bytes || context.remainingOutputBytes < 0) {
-        fail(new BenchmarkPhaseError("output_limit_exceeded", `command output exceeded budget: ${command.id}`));
+        fail2(new BenchmarkPhaseError("output_limit_exceeded", `command output exceeded budget: ${command.id}`));
         return;
       }
       target.push(chunk2);
@@ -81119,14 +82958,14 @@ async function runCommand(command, root, spec, context, options = {}) {
     child.stdout?.on("data", (chunk2) => capture(stdout, chunk2));
     child.stderr?.on("data", (chunk2) => capture(stderr, chunk2));
     child.on("error", (error2) => {
-      fail(new BenchmarkCommandExecutionError("command_start_failed", `failed to start ${command.id}: ${error2.message}`, Buffer.concat(stdout), Buffer.concat(stderr), Date.now() - started));
+      fail2(new BenchmarkCommandExecutionError("command_start_failed", `failed to start ${command.id}: ${error2.message}`, Buffer.concat(stdout), Buffer.concat(stderr), Date.now() - started));
     });
     timer = setTimeout(() => {
       if (reachesPhaseDeadline) {
-        fail(new BenchmarkPhaseError("phase_timeout", "phase budget expired"));
+        fail2(new BenchmarkPhaseError("phase_timeout", "phase budget expired"));
         return;
       }
-      fail(new BenchmarkCommandExecutionError("command_timeout", `command timed out: ${command.id}`, Buffer.concat(stdout), Buffer.concat(stderr), Date.now() - started));
+      fail2(new BenchmarkCommandExecutionError("command_timeout", `command timed out: ${command.id}`, Buffer.concat(stdout), Buffer.concat(stderr), Date.now() - started));
     }, timeoutMs2);
     child.on("exit", (code, signal) => {
       if (settled)
@@ -81149,7 +82988,7 @@ async function runCommand(command, root, spec, context, options = {}) {
 async function writeLog(root, name, data, spec) {
   const destination = path89.join(root, name);
   fs81.mkdirSync(path89.dirname(destination), { recursive: true });
-  const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
+  const temporary = `${destination}.${process.pid}.${crypto7.randomBytes(6).toString("hex")}.tmp`;
   try {
     fs81.writeFileSync(temporary, redactCommandOutput(data, spec), {
       flag: "wx",
@@ -81163,7 +83002,7 @@ async function writeLog(root, name, data, spec) {
 }
 function writeBufferAtomic(destination, data) {
   fs81.mkdirSync(path89.dirname(destination), { recursive: true });
-  const temporary = `${destination}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
+  const temporary = `${destination}.${process.pid}.${crypto7.randomBytes(6).toString("hex")}.tmp`;
   try {
     fs81.writeFileSync(temporary, data, { flag: "wx", mode: 384 });
     fs81.renameSync(temporary, destination);
@@ -82006,7 +83845,7 @@ async function executeEvaluate(spec, context) {
   if (spec.capture_workspace_archive) {
     const regularFiles = manifest.filter((entry) => entry.kind !== "symlink").map((entry) => entry.path);
     const archive = path89.join(spec.logs_root, "candidate-workspace.tar.gz");
-    const temporary = `${archive}.${process.pid}.${crypto6.randomBytes(6).toString("hex")}.tmp`;
+    const temporary = `${archive}.${process.pid}.${crypto7.randomBytes(6).toString("hex")}.tmp`;
     try {
       await pack({ rootDir: spec.workspace_root, outFile: temporary, files: regularFiles });
       fs81.renameSync(temporary, archive);
@@ -82459,7 +84298,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
 }
 
 // src/cli/benchmark-control.ts
-var import_picocolors53 = __toESM(require_picocolors(), 1);
+var import_picocolors60 = __toESM(require_picocolors(), 1);
 import fs85 from "node:fs";
 import path93 from "node:path";
 
@@ -82957,10 +84796,10 @@ class BenchmarkApiClient {
       }
     });
   }
-  exportManifest(benchmarkId, format, revisionId) {
+  exportManifest(benchmarkId, format2, revisionId) {
     return this.request(`/${encodeURIComponent(benchmarkId)}/export`, {
       mode: "binary",
-      query: { format, revision_id: revisionId }
+      query: { format: format2, revision_id: revisionId }
     });
   }
   exportBundle(benchmarkId, revisionId) {
@@ -83158,7 +84997,7 @@ class BenchmarkApiClient {
 
 // src/core/benchmark-authoring.ts
 var import_yaml7 = __toESM(require_dist(), 1);
-import crypto7 from "node:crypto";
+import crypto8 from "node:crypto";
 import fs82 from "node:fs";
 import path90 from "node:path";
 
@@ -83957,7 +85796,7 @@ function renderYaml(value) {
   return import_yaml7.default.stringify(stableValue(value), { indent: 2, lineWidth: 0 });
 }
 function digest(data) {
-  return crypto7.createHash("sha256").update(data).digest("hex");
+  return crypto8.createHash("sha256").update(data).digest("hex");
 }
 function assertRegularFile(filePath, label) {
   let stat;
@@ -84327,7 +86166,7 @@ function sameDestinationObjectIdentity(target, identity2) {
   }
 }
 function acquireDestinationWriteLock(root) {
-  const digest2 = crypto7.createHash("sha256").update(root).digest("hex").slice(0, 20);
+  const digest2 = crypto8.createHash("sha256").update(root).digest("hex").slice(0, 20);
   const lockPath = path90.join(path90.dirname(root), `.brainbase-benchmark-write-lock-${digest2}`);
   let descriptor;
   try {
@@ -84413,7 +86252,7 @@ function closeDestinationIdentity(identity2) {
     throw cleanupError;
 }
 function createDirectoryClaim(target, identity2) {
-  const claimPath = path90.join(target, `.brainbase-benchmark-write-${crypto7.randomUUID()}`);
+  const claimPath = path90.join(target, `.brainbase-benchmark-write-${crypto8.randomUUID()}`);
   try {
     fs82.writeFileSync(claimPath, "", { flag: "wx", mode: 384 });
   } catch (error2) {
@@ -84797,145 +86636,6 @@ function scaffoldBenchmarkDirectory(rootDir, options) {
   return writeBenchmarkDirectory(rootDir, project);
 }
 
-// src/core/argv.ts
-class ArgvParseError extends Error {
-  code = "invalid_arguments";
-  constructor(message) {
-    super(message);
-    this.name = "ArgvParseError";
-  }
-}
-function parseBoolean(value, name) {
-  switch (value.trim().toLowerCase()) {
-    case "":
-    case "0":
-    case "false":
-    case "no":
-    case "off":
-      return false;
-    case "1":
-    case "true":
-    case "yes":
-    case "on":
-      return true;
-    default:
-      throw new ArgvParseError(`Unrecognised value for ${name}: ${value}`);
-  }
-}
-function validateDefinitions(definitions) {
-  const names = new Map;
-  const keys2 = new Set;
-  for (const definition of definitions) {
-    if (!definition.key) {
-      throw new Error("argv option keys must not be empty");
-    }
-    if (keys2.has(definition.key)) {
-      throw new Error(`duplicate argv option key: ${definition.key}`);
-    }
-    keys2.add(definition.key);
-    for (const name of definition.names) {
-      if (!name.startsWith("-") || name === "-") {
-        throw new Error(`invalid argv option name: ${name}`);
-      }
-      if (name.includes("=")) {
-        throw new Error(`argv option names must not contain "=": ${name}`);
-      }
-      if (names.has(name)) {
-        throw new Error(`duplicate argv option name: ${name}`);
-      }
-      names.set(name, definition);
-    }
-  }
-  return names;
-}
-function findDefinition(token, definitions) {
-  const exact = definitions.get(token);
-  if (exact)
-    return { definition: exact, name: token };
-  const equals = token.indexOf("=");
-  if (equals < 1)
-    return null;
-  const name = token.slice(0, equals);
-  const definition = definitions.get(name);
-  return definition ? { definition, name, joined: token.slice(equals + 1) } : null;
-}
-function assignOption(options, definition, value, name) {
-  const current = options[definition.key];
-  if (definition.multiple) {
-    if (typeof value !== "string") {
-      throw new Error(`boolean argv option cannot be repeated: ${name}`);
-    }
-    options[definition.key] = [
-      ...Array.isArray(current) ? current : [],
-      value
-    ];
-    return;
-  }
-  if (current !== undefined) {
-    throw new ArgvParseError(`Option ${name} may only be provided once`);
-  }
-  options[definition.key] = value;
-}
-function parseArgv(argv, definitions) {
-  const byName = validateDefinitions(definitions);
-  const options = Object.create(null);
-  const positionals = [];
-  let optionsEnabled = true;
-  for (let index = 0;index < argv.length; index += 1) {
-    const token = argv[index];
-    if (!optionsEnabled) {
-      positionals.push(token);
-      continue;
-    }
-    if (token === "--") {
-      optionsEnabled = false;
-      continue;
-    }
-    if (!token.startsWith("-") || token === "-") {
-      positionals.push(token);
-      continue;
-    }
-    const hit = findDefinition(token, byName);
-    if (!hit) {
-      throw new ArgvParseError(`Unknown option: ${token.split("=", 1)[0]}`);
-    }
-    if (hit.definition.kind === "boolean") {
-      assignOption(options, hit.definition, hit.joined === undefined ? true : parseBoolean(hit.joined, hit.name), hit.name);
-      continue;
-    }
-    let value = hit.joined;
-    if (value === undefined) {
-      const next = argv[index + 1];
-      if (next === "--") {
-        value = argv[index + 2];
-        if (value === undefined) {
-          throw new ArgvParseError(`Option ${hit.name} requires a value`);
-        }
-        index += 2;
-      } else {
-        if (next === undefined || next.startsWith("-")) {
-          throw new ArgvParseError(`Option ${hit.name} requires a value; use ${hit.name}=<value> for values beginning with "-"`);
-        }
-        value = next;
-        index += 1;
-      }
-    }
-    assignOption(options, hit.definition, value, hit.name);
-  }
-  return { options, positionals };
-}
-function stringOption(parsed, key2) {
-  const value = parsed.options[key2];
-  return typeof value === "string" ? value : undefined;
-}
-function stringOptions(parsed, key2) {
-  const value = parsed.options[key2];
-  return Array.isArray(value) ? value : [];
-}
-function booleanOption(parsed, key2) {
-  return parsed.options[key2] === true;
-}
-
 // src/cli/benchmark-control-options.ts
 var DEFINITIONS = [
   { key: "agent", names: ["--agent", "-a"], kind: "value" },
@@ -85112,13 +86812,13 @@ function kebab(value) {
 }
 
 // src/cli/benchmark-control-io.ts
-import crypto9 from "node:crypto";
+import crypto10 from "node:crypto";
 import fs84 from "node:fs";
 import os18 from "node:os";
 import path92 from "node:path";
 
 // src/core/benchmark-bundle.ts
-import crypto8 from "node:crypto";
+import crypto9 from "node:crypto";
 import fs83 from "node:fs";
 import os17 from "node:os";
 import path91 from "node:path";
@@ -85136,7 +86836,7 @@ var MANIFEST_NAMES = [
 ];
 var MANIFEST_NAME_SET = new Set(MANIFEST_NAMES);
 function sha2562(data) {
-  return crypto8.createHash("sha256").update(data).digest("hex");
+  return crypto9.createHash("sha256").update(data).digest("hex");
 }
 function normalizeArchivePath(raw, directory) {
   const candidate = directory ? raw.replace(/\/+$/, "") : raw;
@@ -85267,7 +86967,7 @@ async function writeBenchmarkBundle(outputPath, input) {
   validateMemberTree(portableMembers);
   const output = path91.resolve(outputPath);
   const staging = fs83.mkdtempSync(path91.join(os17.tmpdir(), "brainbase-benchmark-bundle-"));
-  const temporaryOutput = `${output}.${process.pid}.${crypto8.randomUUID()}.tmp`;
+  const temporaryOutput = `${output}.${process.pid}.${crypto9.randomUUID()}.tmp`;
   try {
     const manifestData = Buffer.from(`${canonicalBenchmarkJson(project.manifest)}
 `, "utf8");
@@ -85530,7 +87230,7 @@ function writeBinaryOutput(cwd2, output, bytes, fallbackName, force) {
   const target = path92.resolve(cwd2, output ?? safeExportFilename(undefined, fallbackName));
   fs84.mkdirSync(path92.dirname(target), { recursive: true });
   assertSafeOutputDestination(target, force);
-  const temporary = `${target}.${process.pid}.${crypto9.randomUUID()}.tmp`;
+  const temporary = `${target}.${process.pid}.${crypto10.randomUUID()}.tmp`;
   const descriptor = fs84.openSync(temporary, "wx", 384);
   let closed = false;
   try {
@@ -85804,20 +87504,20 @@ async function emitCursorPages(output, fetchPage, options) {
 function commandHelp() {
   return [
     "",
-    `  ${import_picocolors53.default.bold("brainbase benchmark")} ${import_picocolors53.default.dim("<command> [options]")}`,
+    `  ${import_picocolors60.default.bold("brainbase benchmark")} ${import_picocolors60.default.dim("<command> [options]")}`,
     "",
-    `  ${import_picocolors53.default.cyan("init | list | show | create | validate | pull | push")}`,
-    `  ${import_picocolors53.default.cyan("publish | revisions | import | export | archive | restore")}`,
-    `  ${import_picocolors53.default.cyan("run plan|start|watch|list|show|cancel")}`,
-    `  ${import_picocolors53.default.cyan("results | diagnoses | attempt | artifacts | export-results")}`,
-    `  ${import_picocolors53.default.cyan("history | baseline show|set|clear")}`,
+    `  ${import_picocolors60.default.cyan("init | list | show | create | validate | pull | push")}`,
+    `  ${import_picocolors60.default.cyan("publish | revisions | import | export | archive | restore")}`,
+    `  ${import_picocolors60.default.cyan("run plan|start|watch|list|show|cancel")}`,
+    `  ${import_picocolors60.default.cyan("results | diagnoses | attempt | artifacts | export-results")}`,
+    `  ${import_picocolors60.default.cyan("history | baseline show|set|clear")}`,
     "",
-    `  ${import_picocolors53.default.dim("Use --agent to override brainbase.agent.yaml, and --json or --jsonl for automation.")}`,
+    `  ${import_picocolors60.default.dim("Use --agent to override brainbase.agent.yaml, and --json or --jsonl for automation.")}`,
     "",
-    `  ${import_picocolors53.default.bold("benchmark runtime (machine-only)")}`,
-    `  ${import_picocolors53.default.cyan("hydrate")} ${import_picocolors53.default.dim("--spec <path> --result <path> --json")}`,
-    `  ${import_picocolors53.default.cyan("evaluate")} ${import_picocolors53.default.dim("--spec <path> --result <path> --json")}`,
-    `  ${import_picocolors53.default.cyan("capabilities")} ${import_picocolors53.default.dim("--json")}`,
+    `  ${import_picocolors60.default.bold("benchmark runtime (machine-only)")}`,
+    `  ${import_picocolors60.default.cyan("hydrate")} ${import_picocolors60.default.dim("--spec <path> --result <path> --json")}`,
+    `  ${import_picocolors60.default.cyan("evaluate")} ${import_picocolors60.default.dim("--spec <path> --result <path> --json")}`,
+    `  ${import_picocolors60.default.cyan("capabilities")} ${import_picocolors60.default.dim("--json")}`,
     ""
   ].join(`
 `);
@@ -86149,19 +87849,19 @@ async function runExport(cwd2, argv, deps) {
   ]);
   expectPositionals(options.positionals, 1, 1, "brainbase benchmark export <benchmark-id> --format <yaml|json|bundle>");
   const benchmarkId = options.positionals[0];
-  const format = optionalNonblank(options.parsed, "format") ?? "yaml";
-  if (!["yaml", "json", "bundle"].includes(format)) {
+  const format2 = optionalNonblank(options.parsed, "format") ?? "yaml";
+  if (!["yaml", "json", "bundle"].includes(format2)) {
     throw usageError("--format must be yaml, json, or bundle");
   }
   const { client, output } = context(cwd2, "benchmark export", options, deps);
   const revision = optionalNonblank(options.parsed, "revision");
-  const response = format === "bundle" ? await client.exportBundle(benchmarkId, revision) : await client.exportManifest(benchmarkId, format, revision);
-  const extension2 = format === "bundle" ? "tar.gz" : format;
+  const response = format2 === "bundle" ? await client.exportBundle(benchmarkId, revision) : await client.exportManifest(benchmarkId, format2, revision);
+  const extension2 = format2 === "bundle" ? "tar.gz" : format2;
   const fallback = safeExportFilename(response.filename, `benchmark-${benchmarkId}.${extension2}`);
   const written = writeBinaryOutput(cwd2, optionalNonblank(options.parsed, "output"), response.bytes, fallback, bool(options.parsed, "force"));
   output.result({
     benchmark_id: benchmarkId,
-    format,
+    format: format2,
     path: written,
     size_bytes: response.bytes.byteLength
   });
@@ -86971,7 +88671,7 @@ function terminatePhase(child) {
   }
 }
 function createAnonymousSpecFd(bytes) {
-  const temporary = path94.join(os19.tmpdir(), `brainbase-benchmark-spec-${process.pid}-${crypto10.randomBytes(12).toString("hex")}`);
+  const temporary = path94.join(os19.tmpdir(), `brainbase-benchmark-spec-${process.pid}-${crypto11.randomBytes(12).toString("hex")}`);
   fs86.writeFileSync(temporary, bytes, { flag: "wx", mode: 384 });
   try {
     const fd = fs86.openSync(temporary, "r");
@@ -87015,7 +88715,7 @@ async function runSupervisedPhase(phase, parsed, write) {
 `);
     return 1;
   }
-  const childToken = crypto10.randomBytes(32).toString("hex");
+  const childToken = crypto11.randomBytes(32).toString("hex");
   let specFd;
   try {
     specFd = createAnonymousSpecFd(specBytes);
@@ -87200,148 +88900,161 @@ var SUBCOMMAND_OWNED_FLAGS = {
 function help() {
   const out = [];
   out.push("");
-  out.push(`  ${brandTint("◆")}  ${import_picocolors54.default.bold("brainbase")}  ${import_picocolors54.default.dim(`v${VERSION}`)}`);
-  out.push(`     ${import_picocolors54.default.dim("connect your local agent to the brainbase platform")}`);
+  out.push(`  ${brandTint("◆")}  ${import_picocolors61.default.bold("brainbase")}  ${import_picocolors61.default.dim(`v${VERSION}`)}`);
+  out.push(`     ${import_picocolors61.default.dim("connect your local agent to the brainbase platform")}`);
   out.push("");
   out.push(divider("USAGE"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.bold("brainbase")} ${import_picocolors54.default.dim("<command> [options]")}`);
+  out.push(`  ${import_picocolors61.default.bold("brainbase")} ${import_picocolors61.default.dim("<command> [options]")}`);
   out.push("");
   out.push(divider("AUTH"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("login")}     ${import_picocolors54.default.dim("  open the web app and connect this device")}`);
-  out.push(`  ${import_picocolors54.default.cyan("logout")}    ${import_picocolors54.default.dim("  clear the local session")}`);
-  out.push(`  ${import_picocolors54.default.cyan("whoami")} ${import_picocolors54.default.dim("[--json]")} ${import_picocolors54.default.dim(" show which credential is in use and what it covers")}`);
+  out.push(`  ${import_picocolors61.default.cyan("login")}     ${import_picocolors61.default.dim("  open the web app and connect this device")}`);
+  out.push(`  ${import_picocolors61.default.cyan("logout")}    ${import_picocolors61.default.dim("  clear the local session")}`);
+  out.push(`  ${import_picocolors61.default.cyan("whoami")} ${import_picocolors61.default.dim("[--json]")} ${import_picocolors61.default.dim(" show which credential is in use and what it covers")}`);
   out.push("");
   out.push(divider("DISCOVERY"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("team list")}                  ${import_picocolors54.default.dim("show the teams you can create agents in")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent list")}                 ${import_picocolors54.default.dim("show a team's agents and their ids")}`);
+  out.push(`  ${import_picocolors61.default.cyan("team list")}                  ${import_picocolors61.default.dim("show the teams you can create agents in")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent list")}                 ${import_picocolors61.default.dim("show a team's agents and their ids")}`);
   out.push("");
   out.push(divider("LINKED AGENT"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("agent init")}                 ${import_picocolors54.default.dim("write a starter brainbase.agent.yaml here — offline, no login needed")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent create")}               ${import_picocolors54.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent pull")} ${import_picocolors54.default.dim("[<id>]")}          ${import_picocolors54.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent push")}                 ${import_picocolors54.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent unpack")}               ${import_picocolors54.default.dim("install the claimed agent into a harness layout")}`);
-  out.push(`  ${import_picocolors54.default.cyan("link")}                       ${import_picocolors54.default.dim("attach this folder to an existing agent")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent status")}               ${import_picocolors54.default.dim("show what would pull and what would push")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent connections")}          ${import_picocolors54.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent connect")} ${import_picocolors54.default.dim("<name>")}       ${import_picocolors54.default.dim("connect slack or meeting from the terminal")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent disconnect")} ${import_picocolors54.default.dim("<name>")}    ${import_picocolors54.default.dim("revoke a slack or meeting install")}`);
-  out.push(`  ${import_picocolors54.default.cyan("agent env")}                  ${import_picocolors54.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
-  out.push(`  ${import_picocolors54.default.cyan("run")} ${import_picocolors54.default.dim("<cmd> [args...]")}         ${import_picocolors54.default.dim("run <cmd> with secrets.env loaded into env")}`);
-  out.push(`  ${import_picocolors54.default.cyan("status")}                     ${import_picocolors54.default.dim("show what this folder is linked to")}`);
-  out.push(`  ${import_picocolors54.default.cyan("unlink")}                     ${import_picocolors54.default.dim("disconnect this folder")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent init")}                 ${import_picocolors61.default.dim("write a starter brainbase.agent.yaml here — offline, no login needed")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent create")}               ${import_picocolors61.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent pull")} ${import_picocolors61.default.dim("[<id>]")}          ${import_picocolors61.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint)")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent push")}                 ${import_picocolors61.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent unpack")}               ${import_picocolors61.default.dim("install the claimed agent into a harness layout")}`);
+  out.push(`  ${import_picocolors61.default.cyan("link")}                       ${import_picocolors61.default.dim("attach this folder to an existing agent")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent status")}               ${import_picocolors61.default.dim("show what would pull and what would push")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent connections")}          ${import_picocolors61.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent connect")} ${import_picocolors61.default.dim("<name>")}       ${import_picocolors61.default.dim("connect slack or meeting from the terminal")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent disconnect")} ${import_picocolors61.default.dim("<name>")}    ${import_picocolors61.default.dim("revoke a slack or meeting install")}`);
+  out.push(`  ${import_picocolors61.default.cyan("agent env")}                  ${import_picocolors61.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
+  out.push(`  ${import_picocolors61.default.cyan("run")} ${import_picocolors61.default.dim("<cmd> [args...]")}         ${import_picocolors61.default.dim("run <cmd> with secrets.env loaded into env")}`);
+  out.push(`  ${import_picocolors61.default.cyan("status")}                     ${import_picocolors61.default.dim("show what this folder is linked to")}`);
+  out.push(`  ${import_picocolors61.default.cyan("unlink")}                     ${import_picocolors61.default.dim("disconnect this folder")}`);
   out.push("");
   out.push(divider("TASKS"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("task create")} ${import_picocolors54.default.dim("--message <text>")}   ${import_picocolors54.default.dim("create a managed task and start its first run")}`);
+  out.push(`  ${import_picocolors61.default.cyan("task create")} ${import_picocolors61.default.dim("--message <text>")}   ${import_picocolors61.default.dim("create a managed task and start its first run (--wait to block on it)")}`);
+  out.push(`  ${import_picocolors61.default.cyan("task list")}                       ${import_picocolors61.default.dim("recent tasks you can reach")}`);
+  out.push(`  ${import_picocolors61.default.cyan("task get")} ${import_picocolors61.default.dim("<task-id>")}              ${import_picocolors61.default.dim("one task: status, agent, machine, eval verdicts")}`);
+  out.push(`  ${import_picocolors61.default.cyan("task logs")} ${import_picocolors61.default.dim("<task-id> [--follow]")}  ${import_picocolors61.default.dim("one line per event in the task's transcript, or tail it live")}`);
+  out.push("");
+  out.push(divider("SANDBOXES"));
+  out.push("");
+  out.push(`  ${import_picocolors61.default.cyan("machine ls")} ${import_picocolors61.default.dim("[--all]")}            ${import_picocolors61.default.dim("list your sandboxes — live ones only unless --all")}`);
+  out.push(`  ${import_picocolors61.default.cyan("machine rm")} ${import_picocolors61.default.dim("<id>")}               ${import_picocolors61.default.dim("tear a sandbox down (it bills until you do)")}`);
   out.push("");
   out.push(divider("BENCHMARKS"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("benchmark list")}                    ${import_picocolors54.default.dim("list benchmarks for the linked agent")}`);
-  out.push(`  ${import_picocolors54.default.cyan("benchmark init")} ${import_picocolors54.default.dim("[directory]")}        ${import_picocolors54.default.dim("scaffold a local benchmark")}`);
-  out.push(`  ${import_picocolors54.default.cyan("benchmark create")} ${import_picocolors54.default.dim("[path|-]")}         ${import_picocolors54.default.dim("create a benchmark draft")}`);
-  out.push(`  ${import_picocolors54.default.cyan("benchmark run")} ${import_picocolors54.default.dim("<benchmark> --yes")}   ${import_picocolors54.default.dim("plan and start a benchmark run")}`);
-  out.push(`  ${import_picocolors54.default.cyan("benchmark results")} ${import_picocolors54.default.dim("<run>")}           ${import_picocolors54.default.dim("inspect normalized benchmark results")}`);
+  out.push(`  ${import_picocolors61.default.cyan("benchmark list")}                    ${import_picocolors61.default.dim("list benchmarks for the linked agent")}`);
+  out.push(`  ${import_picocolors61.default.cyan("benchmark init")} ${import_picocolors61.default.dim("[directory]")}        ${import_picocolors61.default.dim("scaffold a local benchmark")}`);
+  out.push(`  ${import_picocolors61.default.cyan("benchmark create")} ${import_picocolors61.default.dim("[path|-]")}         ${import_picocolors61.default.dim("create a benchmark draft")}`);
+  out.push(`  ${import_picocolors61.default.cyan("benchmark run")} ${import_picocolors61.default.dim("<benchmark> --yes")}   ${import_picocolors61.default.dim("plan and start a benchmark run")}`);
+  out.push(`  ${import_picocolors61.default.cyan("benchmark results")} ${import_picocolors61.default.dim("<run>")}           ${import_picocolors61.default.dim("inspect normalized benchmark results")}`);
   out.push("");
   out.push(divider("BENCHMARK RUNTIME"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("benchmark hydrate")} ${import_picocolors54.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors54.default.cyan("benchmark evaluate")} ${import_picocolors54.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors54.default.cyan("benchmark capabilities")} ${import_picocolors54.default.dim("--json")}`);
+  out.push(`  ${import_picocolors61.default.cyan("benchmark hydrate")} ${import_picocolors61.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors61.default.cyan("benchmark evaluate")} ${import_picocolors61.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors61.default.cyan("benchmark capabilities")} ${import_picocolors61.default.dim("--json")}`);
   out.push("");
   out.push(divider("ORCHESTRATIONS"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("orchestration create")}           ${import_picocolors54.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
-  out.push(`  ${import_picocolors54.default.cyan("orchestration list")}             ${import_picocolors54.default.dim("list orchestrations under a team")}`);
-  out.push(`  ${import_picocolors54.default.cyan("orchestration pull")} ${import_picocolors54.default.dim("<id>")}        ${import_picocolors54.default.dim("recursively fetch an orchestration + every member agent")}`);
-  out.push(`  ${import_picocolors54.default.cyan("orchestration push")}             ${import_picocolors54.default.dim("recursively push each member, then update the graph")}`);
-  out.push(`  ${import_picocolors54.default.cyan("orchestration status")}           ${import_picocolors54.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors61.default.cyan("orchestration create")}           ${import_picocolors61.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors61.default.cyan("orchestration list")}             ${import_picocolors61.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors61.default.cyan("orchestration pull")} ${import_picocolors61.default.dim("<id>")}        ${import_picocolors61.default.dim("recursively fetch an orchestration + every member agent")}`);
+  out.push(`  ${import_picocolors61.default.cyan("orchestration push")}             ${import_picocolors61.default.dim("recursively push each member, then update the graph")}`);
+  out.push(`  ${import_picocolors61.default.cyan("orchestration status")}           ${import_picocolors61.default.dim("show what would push and what would pull")}`);
   out.push("");
   out.push(divider("TEMPLATES"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("template pack")}                       ${import_picocolors54.default.dim("bundle the current agent into a template")}`);
-  out.push(`  ${import_picocolors54.default.cyan("template publish")}                    ${import_picocolors54.default.dim("upload a template to the registry")}`);
-  out.push(`  ${import_picocolors54.default.cyan("template search")} ${import_picocolors54.default.dim("[query]")}             ${import_picocolors54.default.dim("search the registry")}`);
-  out.push(`  ${import_picocolors54.default.cyan("template info")}    ${import_picocolors54.default.dim("<creator/slug>")}     ${import_picocolors54.default.dim("show registry details for a template")}`);
-  out.push(`  ${import_picocolors54.default.cyan("template onboard")} ${import_picocolors54.default.dim("<creator/slug>")}     ${import_picocolors54.default.dim("install (or refresh) a template")}`);
-  out.push(`  ${import_picocolors54.default.cyan("template list")}                       ${import_picocolors54.default.dim("show installed templates")}`);
-  out.push(`  ${import_picocolors54.default.cyan("template remove")}  ${import_picocolors54.default.dim("<creator/slug>")}     ${import_picocolors54.default.dim("uninstall a template")}`);
+  out.push(`  ${import_picocolors61.default.cyan("template pack")}                       ${import_picocolors61.default.dim("bundle the current agent into a template")}`);
+  out.push(`  ${import_picocolors61.default.cyan("template publish")}                    ${import_picocolors61.default.dim("upload a template to the registry")}`);
+  out.push(`  ${import_picocolors61.default.cyan("template search")} ${import_picocolors61.default.dim("[query]")}             ${import_picocolors61.default.dim("search the registry")}`);
+  out.push(`  ${import_picocolors61.default.cyan("template info")}    ${import_picocolors61.default.dim("<creator/slug>")}     ${import_picocolors61.default.dim("show registry details for a template")}`);
+  out.push(`  ${import_picocolors61.default.cyan("template onboard")} ${import_picocolors61.default.dim("<creator/slug>")}     ${import_picocolors61.default.dim("install (or refresh) a template")}`);
+  out.push(`  ${import_picocolors61.default.cyan("template list")}                       ${import_picocolors61.default.dim("show installed templates")}`);
+  out.push(`  ${import_picocolors61.default.cyan("template remove")}  ${import_picocolors61.default.dim("<creator/slug>")}     ${import_picocolors61.default.dim("uninstall a template")}`);
   out.push("");
   out.push(divider("SKILLS"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("skill add")} ${import_picocolors54.default.dim("<source>")}                  ${import_picocolors54.default.dim("install a skill (github / git / brainbase)")}`);
-  out.push(`  ${import_picocolors54.default.cyan("skill list")}                            ${import_picocolors54.default.dim("show locally installed skills + their source")}`);
-  out.push(`  ${import_picocolors54.default.cyan("skill update")} ${import_picocolors54.default.dim("<slug>")}                  ${import_picocolors54.default.dim("re-fetch a skill from its recorded source")}`);
-  out.push(`  ${import_picocolors54.default.cyan("skill remove")} ${import_picocolors54.default.dim("<slug>")}                  ${import_picocolors54.default.dim("uninstall a skill")}`);
-  out.push(`  ${import_picocolors54.default.cyan("skill search")} ${import_picocolors54.default.dim("[query]")}                 ${import_picocolors54.default.dim("search the brainbase skill registry")}`);
-  out.push(`  ${import_picocolors54.default.cyan("skill info")} ${import_picocolors54.default.dim("<creator/slug>")}            ${import_picocolors54.default.dim("show registry details for a skill")}`);
-  out.push(`  ${import_picocolors54.default.cyan("skill publish")} ${import_picocolors54.default.dim("[dir]")}                  ${import_picocolors54.default.dim("publish a SKILL.md folder (defaults to .)")}`);
+  out.push(`  ${import_picocolors61.default.cyan("skill add")} ${import_picocolors61.default.dim("<source>")}                  ${import_picocolors61.default.dim("install a skill (github / git / brainbase)")}`);
+  out.push(`  ${import_picocolors61.default.cyan("skill list")}                            ${import_picocolors61.default.dim("show locally installed skills + their source")}`);
+  out.push(`  ${import_picocolors61.default.cyan("skill update")} ${import_picocolors61.default.dim("<slug>")}                  ${import_picocolors61.default.dim("re-fetch a skill from its recorded source")}`);
+  out.push(`  ${import_picocolors61.default.cyan("skill remove")} ${import_picocolors61.default.dim("<slug>")}                  ${import_picocolors61.default.dim("uninstall a skill")}`);
+  out.push(`  ${import_picocolors61.default.cyan("skill search")} ${import_picocolors61.default.dim("[query]")}                 ${import_picocolors61.default.dim("search the brainbase skill registry")}`);
+  out.push(`  ${import_picocolors61.default.cyan("skill info")} ${import_picocolors61.default.dim("<creator/slug>")}            ${import_picocolors61.default.dim("show registry details for a skill")}`);
+  out.push(`  ${import_picocolors61.default.cyan("skill publish")} ${import_picocolors61.default.dim("[dir]")}                  ${import_picocolors61.default.dim("publish a SKILL.md folder (defaults to .)")}`);
   out.push("");
   out.push(divider("CLI TOKENS"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("token create")}                        ${import_picocolors54.default.dim("issue a long-lived CLI key for CI / scripts")}`);
-  out.push(`  ${import_picocolors54.default.cyan("token list")}                          ${import_picocolors54.default.dim("show your tokens")}`);
-  out.push(`  ${import_picocolors54.default.cyan("token rename")} ${import_picocolors54.default.dim("<id>")}                  ${import_picocolors54.default.dim("relabel a token")}`);
-  out.push(`  ${import_picocolors54.default.cyan("token revoke")} ${import_picocolors54.default.dim("<id>")}                  ${import_picocolors54.default.dim("revoke a token")}`);
+  out.push(`  ${import_picocolors61.default.cyan("token create")}                        ${import_picocolors61.default.dim("issue a long-lived CLI key for CI / scripts")}`);
+  out.push(`  ${import_picocolors61.default.cyan("token list")}                          ${import_picocolors61.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors61.default.cyan("token rename")} ${import_picocolors61.default.dim("<id>")}                  ${import_picocolors61.default.dim("relabel a token")}`);
+  out.push(`  ${import_picocolors61.default.cyan("token revoke")} ${import_picocolors61.default.dim("<id>")}                  ${import_picocolors61.default.dim("revoke a token")}`);
   out.push("");
   out.push(divider("MCP"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.cyan("mcp check")} ${import_picocolors54.default.dim("[--json]")}              ${import_picocolors54.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
-  out.push(`  ${import_picocolors54.default.cyan("mcp list")} ${import_picocolors54.default.dim("[--json]")}               ${import_picocolors54.default.dim("show configured servers with OAuth state and expiry")}`);
+  out.push(`  ${import_picocolors61.default.cyan("mcp check")} ${import_picocolors61.default.dim("[--json]")}              ${import_picocolors61.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
+  out.push(`  ${import_picocolors61.default.cyan("mcp list")} ${import_picocolors61.default.dim("[--json]")}               ${import_picocolors61.default.dim("show configured servers with OAuth state and expiry")}`);
   out.push("");
   out.push(divider("FLAGS"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
-  out.push(`  ${import_picocolors54.default.dim("--scope <s>")}        force scope: global | project`);
-  out.push(`  ${import_picocolors54.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
-  out.push(`  ${import_picocolors54.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly`);
-  out.push(`  ${import_picocolors54.default.dim("--message <text>")}   for task create: required first user message`);
-  out.push(`  ${import_picocolors54.default.dim("--title <text>")}     for task create: optional task title`);
-  out.push(`  ${import_picocolors54.default.dim("--model <id>")}       for task create: optional model override`);
-  out.push(`  ${import_picocolors54.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
-  out.push(`  ${import_picocolors54.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
-  out.push(`  ${import_picocolors54.default.dim("--json")}             machine-readable output for supported commands`);
-  out.push(`  ${import_picocolors54.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
-  out.push(`  ${import_picocolors54.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
-  out.push(`  ${import_picocolors54.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
-  out.push(`  ${import_picocolors54.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
-  out.push(`  ${import_picocolors54.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
-  out.push(`  ${import_picocolors54.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
-  out.push(`  ${import_picocolors54.default.dim("--full")}             for agent init: write a commented template covering every block`);
-  out.push(`  ${import_picocolors54.default.dim("--minimal")}          for agent init: write the starter manifest (the default)`);
-  out.push(`  ${import_picocolors54.default.dim("--all")}              for template list: include installs from other folders`);
-  out.push(`  ${import_picocolors54.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors61.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
+  out.push(`  ${import_picocolors61.default.dim("--scope <s>")}        force scope: global | project`);
+  out.push(`  ${import_picocolors61.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
+  out.push(`  ${" ".repeat("--yes, -y".length)}          required for destructive commands with no terminal (pipes, CI)`);
+  out.push(`  ${import_picocolors61.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly (task list: filter to it)`);
+  out.push(`  ${import_picocolors61.default.dim("--message <text>")}   for task create: required first user message`);
+  out.push(`  ${import_picocolors61.default.dim("--title <text>")}     for task create: optional task title`);
+  out.push(`  ${import_picocolors61.default.dim("--model <id>")}       for task create: optional model override`);
+  out.push(`  ${import_picocolors61.default.dim("--wait")}             for task create: block until the task finishes; exit 1 unless it succeeded`);
+  out.push(`  ${import_picocolors61.default.dim("--timeout <secs>")}   for task create --wait: give up after <secs> and exit 1`);
+  out.push(`  ${import_picocolors61.default.dim("--limit <n>")}        for task list (1-200), task logs (events to print; with --follow, the first page size) and machine ls`);
+  out.push(`  ${import_picocolors61.default.dim("--follow, -f")}       for task logs: stay attached and print events as they land`);
+  out.push(`  ${import_picocolors61.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
+  out.push(`  ${import_picocolors61.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
+  out.push(`  ${import_picocolors61.default.dim("--json")}             machine-readable output for supported commands`);
+  out.push(`  ${import_picocolors61.default.dim("--no-tracking")}      for link: skip routing LLM traffic through brainbase`);
+  out.push(`  ${import_picocolors61.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
+  out.push(`  ${import_picocolors61.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
+  out.push(`  ${import_picocolors61.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
+  out.push(`  ${import_picocolors61.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
+  out.push(`  ${import_picocolors61.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
+  out.push(`  ${import_picocolors61.default.dim("--full")}             for agent init: write a commented template covering every block`);
+  out.push(`  ${import_picocolors61.default.dim("--minimal")}          for agent init: write the starter manifest (the default)`);
+  out.push(`  ${import_picocolors61.default.dim("--all")}              for template list: include installs from other folders; for machine ls: include torn-down machines`);
+  out.push(`  ${import_picocolors61.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
   out.push("");
   out.push(divider("ENV"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task create uses /v2/tasks)`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT; the only PAT control-plane commands accept (token.json is not read there)`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task create uses /v2/tasks)`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT; the only PAT control-plane commands accept (token.json is not read there)`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
   out.push("");
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
-  out.push(`  ${import_picocolors54.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
+  out.push(`  ${import_picocolors61.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
   out.push("");
   out.push(divider("HARNESSES"));
   out.push("");
-  out.push(`  ${import_picocolors54.default.dim("•")} ${import_picocolors54.default.bold("claude-code")}  ${import_picocolors54.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors54.default.dim("•")} ${import_picocolors54.default.bold("codex")}        ${import_picocolors54.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors54.default.dim("•")} ${import_picocolors54.default.bold("kafka")}        ${import_picocolors54.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors61.default.dim("•")} ${import_picocolors61.default.bold("claude-code")}  ${import_picocolors61.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors61.default.dim("•")} ${import_picocolors61.default.bold("codex")}        ${import_picocolors61.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors61.default.dim("•")} ${import_picocolors61.default.bold("kafka")}        ${import_picocolors61.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -87495,13 +89208,13 @@ async function requireAuth(cmd) {
   if (STORED_PAT_COMMANDS.has(cmd) && readToken())
     return;
   console.error("");
-  console.error(`  ${brandTint("◆")}  ${import_picocolors54.default.bold("brainbase")}`);
+  console.error(`  ${brandTint("◆")}  ${import_picocolors61.default.bold("brainbase")}`);
   console.error("");
-  console.error(`  ${import_picocolors54.default.red("✗")}  You need to sign in to use ${import_picocolors54.default.bold("brainbase " + cmd)}.`);
+  console.error(`  ${import_picocolors61.default.red("✗")}  You need to sign in to use ${import_picocolors61.default.bold("brainbase " + cmd)}.`);
   if (status.reason)
-    console.error(`     ${import_picocolors54.default.dim(status.reason)}`);
+    console.error(`     ${import_picocolors61.default.dim(status.reason)}`);
   console.error("");
-  console.error(`     Run ${import_picocolors54.default.cyan("brainbase login")} to connect this device.`);
+  console.error(`     Run ${import_picocolors61.default.cyan("brainbase login")} to connect this device.`);
   console.error("");
   process14.exit(1);
 }
@@ -87574,8 +89287,8 @@ async function main() {
   const limitFlag = Number.isInteger(limitParsed) && limitParsed >= 1 && limitParsed <= 200 ? limitParsed : undefined;
   const archivedFlag = hasFlag2(sharedArgs, "--archived");
   ensureSkillResolversRegistered();
-  await requireAuth(cmd);
   try {
+    await requireAuth(cmd);
     switch (cmd) {
       case "login": {
         await runLogin(cwd2, { web });
@@ -87682,6 +89395,17 @@ async function main() {
         await runTask(cwd2, sub, argv);
         break;
       }
+      case "machine":
+      case "machines": {
+        const sub = argv.shift();
+        await runMachine(sub, argv, {
+          all,
+          limit: limitFlag,
+          yes,
+          json: jsonFlag
+        });
+        break;
+      }
       case "benchmark": {
         const sub = argv.shift();
         process14.exitCode = await runBenchmark(sub, argv, undefined, cwd2);
@@ -87696,6 +89420,7 @@ async function main() {
           orgId: orgIdFlag,
           teamId: teamIdFlag,
           graphOnly: graphOnlyFlag,
+          force: forceFlag,
           name: nameFlag,
           from: fromFlags,
           to: toFlags,
@@ -87726,10 +89451,10 @@ async function main() {
         process14.exit(1);
     }
   } catch (err) {
-    console.error(import_picocolors54.default.red(`
+    console.error(import_picocolors61.default.red(`
 ${err.message}`));
     if (err instanceof ApiError && err.status === 401) {
-      console.error(`  Run ${import_picocolors54.default.cyan("brainbase login")} to connect this device.`);
+      console.error(`  Run ${import_picocolors61.default.cyan("brainbase login")} to connect this device.`);
     }
     if (process14.env.BRAINBASE_DEBUG)
       console.error(err.stack);