@brainbase-labs/cli 0.41.1 → 0.43.0

package/dist/index.js

@@ -35182,7 +35182,7 @@ var require_dist2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-var import_picocolors68 = __toESM(require_picocolors(), 1);
+var import_picocolors71 = __toESM(require_picocolors(), 1);
 import process14 from "node:process";
 import fs91 from "node:fs";
 
@@ -36059,7 +36059,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.41.1",
+  version: "0.43.0",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -55172,6 +55172,8 @@ async function request(pathname, init = {}) {
   let res;
   let text2;
   for (let attempt2 = 0;; attempt2 += 1) {
+    if (init.signal?.aborted)
+      throw init.signal.reason;
     try {
       res = await sendWithAuthRetry(refreshSessionAvailable ? currentSession : null, async (refreshed) => {
         if (refreshed) {
@@ -55187,7 +55189,7 @@ async function request(pathname, init = {}) {
       }
       break;
     } catch (error) {
-      if (method2 !== "GET" || !(error instanceof NetworkApiError) || attempt2 >= GET_NETWORK_RETRY_DELAYS_MS.length) {
+      if (init.signal?.aborted || method2 !== "GET" || !(error instanceof NetworkApiError) || attempt2 >= GET_NETWORK_RETRY_DELAYS_MS.length) {
         throw error;
       }
       await new Promise((resolve) => setTimeout(resolve, GET_NETWORK_RETRY_DELAYS_MS[attempt2]));
@@ -55591,10 +55593,33 @@ async function connectionsRequest(pathname, init) {
     throw err;
   }
 }
+async function mcpConnectLinkRequest(pathname, init) {
+  try {
+    return await request(pathname, init);
+  } catch (err) {
+    if (!(err instanceof ApiError))
+      throw err;
+    if (err.status === 404 && isUnroutedPath(err.body)) {
+      throw new ApiError("This control plane does not support `brainbase mcp connect` yet. Update the server, or authorize the server in the web app.", 404, err.body);
+    }
+    const detail = err.body && typeof err.body === "object" ? err.body.detail : undefined;
+    const message = detail && typeof detail === "object" && !Array.isArray(detail) ? detail.message : undefined;
+    if (typeof message === "string" && message.trim()) {
+      throw new ApiError(message.trim(), err.status, err.body);
+    }
+    throw err;
+  }
+}
 var api = {
   listOrgs() {
     return request("/orgs");
   },
+  listOrgMembersPage(orgId, cursor2) {
+    const query = new URLSearchParams({ limit: "200" });
+    if (cursor2)
+      query.set("cursor", cursor2);
+    return request(`/orgs/${encodeURIComponent(orgId)}/members?${query.toString()}`);
+  },
   listTeams(orgId) {
     return request(`/orgs/${encodeURIComponent(orgId)}/teams`);
   },
@@ -55736,6 +55761,12 @@ var api = {
   listAgentMcpServers(agentId) {
     return connectionsRequest(`/agents/${encodeURIComponent(agentId)}/mcp-servers`);
   },
+  createMcpConnectLink(agentId, server) {
+    return mcpConnectLinkRequest(`/agents/${encodeURIComponent(agentId)}/mcp-connect-links`, { method: "POST", body: JSON.stringify({ server }) });
+  },
+  getMcpConnectLink(linkId, options = {}) {
+    return mcpConnectLinkRequest(`/mcp-connect-links/${encodeURIComponent(linkId)}`, { signal: options.signal });
+  },
   listOrchestrations(orgId, teamId) {
     return request(`/orgs/${encodeURIComponent(orgId)}/teams/${encodeURIComponent(teamId)}/orchestrations`);
   },
@@ -62743,7 +62774,6 @@ function printSkillHelp() {
 }
 
 // src/cli/login.ts
-import { spawn } from "node:child_process";
 var import_picocolors21 = __toESM(require_picocolors(), 1);
 
 // src/core/login-poll.ts
@@ -62920,6 +62950,22 @@ async function awaitDeviceSession(options) {
   throw new LoginTimeoutError(timeoutMs, lastError);
 }
 
+// src/core/open-browser.ts
+import { spawn } from "node:child_process";
+function openInBrowser(url) {
+  if (process.env.BRAINBASE_NON_INTERACTIVE)
+    return;
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(cmd, args, {
+      stdio: "ignore",
+      detached: true
+    });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+
 // src/ui/ink/WelcomeCard.tsx
 var jsx_dev_runtime14 = __toESM(require_jsx_dev_runtime(), 1);
 function WelcomeCard(props) {
@@ -63013,19 +63059,6 @@ function isInsecureWebBase(webBase) {
     return false;
   return !["127.0.0.1", "localhost", "[::1]", "::1"].includes(url.hostname);
 }
-function openInBrowser(url) {
-  if (process.env.BRAINBASE_NON_INTERACTIVE)
-    return;
-  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
-  try {
-    const child = spawn(cmd, args, {
-      stdio: "ignore",
-      detached: true
-    });
-    child.on("error", () => {});
-    child.unref();
-  } catch {}
-}
 function displayUserCode(code) {
   return code.replace(/[^A-Za-z0-9-]/g, "");
 }
@@ -72976,7 +73009,7 @@ function printTokenHelp() {
 }
 
 // src/cli/mcp.ts
-var import_picocolors52 = __toESM(require_picocolors(), 1);
+var import_picocolors53 = __toESM(require_picocolors(), 1);
 
 // src/core/mcp-check/collect-servers.ts
 import path96 from "node:path";
@@ -81294,6 +81327,47 @@ function probeServer(server, opts = { timeoutMs: DEFAULT_TIMEOUT_MS }) {
   return probeWithConnector(server, sdkConnector, opts);
 }
 
+// src/ui/wait-spinner.ts
+var import_picocolors52 = __toESM(require_picocolors(), 1);
+function waitSpinner(output = process.stdout) {
+  const unicode = process.platform !== "win32" ? process.env.TERM !== "linux" : Boolean(process.env.WT_SESSION) || process.env.TERM_PROGRAM === "vscode";
+  const frames = unicode ? ["◒", "◐", "◓", "◑"] : ["•", "o", "O", "0"];
+  const delay2 = unicode ? 80 : 120;
+  const bar = unicode ? "│" : "|";
+  const symbols = unicode ? ["◇", "■", "▲"] : ["o", "x", "x"];
+  const showCursor = () => output.write("\x1B[?25h");
+  let timer;
+  let message = "";
+  return {
+    start(text2) {
+      message = text2.replace(/\.+$/, "");
+      output.write(`${import_picocolors52.default.gray(bar)}
+\x1B[?25l`);
+      process.once("exit", showCursor);
+      let frame = 0;
+      let dots = 0;
+      const draw = () => {
+        output.write(`\r\x1B[J${import_picocolors52.default.magenta(frames[frame])}  ${message}${".".repeat(Math.floor(dots)).slice(0, 3)}`);
+        frame = (frame + 1) % frames.length;
+        dots = dots < frames.length ? dots + 0.125 : 0;
+      };
+      draw();
+      timer = setInterval(draw, delay2);
+    },
+    stop(text2, code = 0) {
+      if (timer === undefined)
+        return;
+      clearInterval(timer);
+      timer = undefined;
+      const symbol = code === 0 ? import_picocolors52.default.green(symbols[0]) : import_picocolors52.default.red(code === 1 ? symbols[1] : symbols[2]);
+      output.write(`\r\x1B[J${symbol}  ${text2}
+`);
+      showCursor();
+      process.removeListener("exit", showCursor);
+    }
+  };
+}
+
 // src/cli/mcp.ts
 function timeoutMs(env3) {
   const raw = env3.BRAINBASE_MCP_CHECK_TIMEOUT_MS;
@@ -81340,17 +81414,17 @@ async function runMcpCheck(cwd2, options) {
 function renderHuman(report2) {
   const lines = [];
   if (report2.check_status === "skipped") {
-    lines.push(import_picocolors52.default.dim("No MCP servers configured — nothing to check."));
+    lines.push(import_picocolors53.default.dim("No MCP servers configured — nothing to check."));
     return lines.join(`
 `) + `
 `;
   }
   for (const s3 of report2.servers) {
-    const mark = s3.status === "ok" ? import_picocolors52.default.green("✓") : s3.status === "auth_failed" ? import_picocolors52.default.red("✗") : import_picocolors52.default.yellow("⚠");
-    const detail = s3.status === "ok" ? import_picocolors52.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors52.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
+    const mark = s3.status === "ok" ? import_picocolors53.default.green("✓") : s3.status === "auth_failed" ? import_picocolors53.default.red("✗") : import_picocolors53.default.yellow("⚠");
+    const detail = s3.status === "ok" ? import_picocolors53.default.dim(`${s3.tool_count} tool${s3.tool_count === 1 ? "" : "s"}`) : import_picocolors53.default.dim(s3.status + (s3.error ? ` — ${s3.error}` : ""));
     lines.push(`  ${mark} ${s3.name}  ${detail}`);
   }
-  const summary = report2.check_status === "ok" ? import_picocolors52.default.green("All MCP servers connected.") : import_picocolors52.default.yellow("Some MCP servers are unhealthy.");
+  const summary = report2.check_status === "ok" ? import_picocolors53.default.green("All MCP servers connected.") : import_picocolors53.default.yellow("Some MCP servers are unhealthy.");
   lines.push("", summary);
   return lines.join(`
 `) + `
@@ -81446,12 +81520,12 @@ function isUnhealthy(server) {
 }
 function renderServerList(servers) {
   if (servers.length === 0) {
-    return import_picocolors52.default.dim("No MCP servers configured for this agent.") + `
+    return import_picocolors53.default.dim("No MCP servers configured for this agent.") + `
 `;
   }
   const lines = [""];
   for (const s3 of servers) {
-    const mark = s3.auth === "oauth_expired" ? import_picocolors52.default.red("✗") : s3.auth === "oauth_required" || isUnhealthy(s3) ? import_picocolors52.default.yellow("!") : !s3.is_enabled ? import_picocolors52.default.dim("·") : import_picocolors52.default.green("✓");
+    const mark = s3.auth === "oauth_expired" ? import_picocolors53.default.red("✗") : s3.auth === "oauth_required" || isUnhealthy(s3) ? import_picocolors53.default.yellow("!") : !s3.is_enabled ? import_picocolors53.default.dim("·") : import_picocolors53.default.green("✓");
     const bits = [sanitizeLabel(s3.transport)];
     if (!s3.is_enabled)
       bits.push("disabled");
@@ -81467,10 +81541,10 @@ function renderServerList(servers) {
     const expiry = describeExpiry(s3);
     if (expiry)
       bits.push(expiry);
-    lines.push(`  ${mark} ${import_picocolors52.default.bold(sanitizeLabel(s3.name))}  ${import_picocolors52.default.dim(bits.join(" · "))}`);
+    lines.push(`  ${mark} ${import_picocolors53.default.bold(sanitizeLabel(s3.name))}  ${import_picocolors53.default.dim(bits.join(" · "))}`);
   }
   if (servers.some((s3) => s3.auth === "oauth_required" || s3.auth === "oauth_expired")) {
-    lines.push("", import_picocolors52.default.dim("Authorize OAuth-backed servers in the web app; the CLI cannot run that flow yet."));
+    lines.push("", import_picocolors53.default.dim("Run `brainbase mcp connect <name>` to authorize a server."));
   }
   lines.push("");
   return lines.join(`
@@ -81494,7 +81568,255 @@ function describeExpiry(server, now2 = Date.now()) {
   const days = Math.round(hours / 24);
   return days > MAX_EXPIRY_DAYS ? `expires in >${MAX_EXPIRY_DAYS}d` : `expires in ${days}d`;
 }
-async function runMcp(cwd2, sub, _argv, options) {
+var CONNECT_USAGE = `Usage: brainbase mcp connect <name> [--json] [--no-open] [--no-wait]
+`;
+var POLL_INTERVAL_MS = 1000;
+function connectUsageError(options) {
+  if (options.json) {
+    (options.write ?? ((s3) => process.stdout.write(s3)))(JSON.stringify({ error: CONNECT_USAGE.trim() }) + `
+`);
+  } else {
+    (options.writeErr ?? ((s3) => process.stderr.write(s3)))(CONNECT_USAGE);
+  }
+  return 1;
+}
+var MAX_CONSECUTIVE_POLL_FAILURES = 5;
+var WAITING_MESSAGE = "Waiting for you to approve in the browser (Ctrl-C to cancel)";
+async function runMcpConnect(cwd2, name, options) {
+  const write = options.write ?? ((s3) => process.stdout.write(s3));
+  const writeErr = options.writeErr ?? ((s3) => process.stderr.write(s3));
+  const fetchServers = options.fetchServers ?? ((id) => api.listAgentMcpServers(id));
+  const resolveAgentId = options.resolveAgentId ?? ((dir) => readLink(dir)?.agent_id ?? null);
+  const createLink = options.createLink ?? ((id, server) => api.createMcpConnectLink(id, server));
+  const getLink = options.getLink ?? ((id, signal2) => api.getMcpConnectLink(id, { signal: signal2 }));
+  const openUrl = options.openUrl ?? openInBrowser;
+  const interactive = options.interactive ?? isInteractive();
+  const fail2 = (message) => {
+    if (options.json)
+      write(JSON.stringify({ error: message }) + `
+`);
+    else
+      writeErr(message + `
+`);
+    return 1;
+  };
+  if (!name || name.startsWith("-"))
+    return connectUsageError(options);
+  const agentId = resolveAgentId(cwd2);
+  if (!agentId) {
+    return fail2("This folder is not linked to any agent. Run `brainbase link` first.");
+  }
+  let servers;
+  try {
+    servers = (await fetchServers(agentId)).servers;
+  } catch (err) {
+    return fail2(`brainbase mcp connect failed: ${sanitizeLabel(err.message)}`);
+  }
+  const label = sanitizeLabel(name);
+  const matches2 = servers.filter((s3) => s3.name === name);
+  const own = matches2.find((s3) => s3.source_kind !== "orchestration");
+  if (!own) {
+    const inherited = matches2[0];
+    if (inherited) {
+      const source = sanitizeLabel(String(inherited.source_name ?? inherited.source_id ?? "an orchestration"));
+      return fail2(`${label} is inherited from ${source}. Connecting an orchestration's MCP server from the CLI is not supported yet; authorize it in the web app.`);
+    }
+    const known = [...new Set(servers.map((s3) => sanitizeLabel(s3.name)))];
+    return fail2(known.length > 0 ? `No MCP server named "${label}" on this agent. Known servers: ${known.join(", ")}.` : `No MCP server named "${label}" on this agent. It has no MCP servers.`);
+  }
+  if (own.auth === "none")
+    return fail2(`${label} does not use OAuth.`);
+  let link2;
+  try {
+    link2 = await createLink(agentId, own.name);
+  } catch (err) {
+    return fail2(`Could not create a connect link for ${label}: ${sanitizeLabel(err.message)}`);
+  }
+  const url2 = safeLinkUrl(link2?.url);
+  if (!url2 || typeof link2.link_id !== "string" || !link2.link_id) {
+    return fail2("The server returned an unusable connect link.");
+  }
+  if (options.json) {
+    write(JSON.stringify({
+      link_id: link2.link_id,
+      url: url2,
+      expires_at: link2.expires_at,
+      server: link2.server
+    }) + `
+`);
+    return 0;
+  }
+  write(`Open this link to authorize ${import_picocolors53.default.bold(label)}:
+
+  ${import_picocolors53.default.cyan(url2)}
+
+`);
+  write(import_picocolors53.default.dim(`${describeLinkLifetime(link2.expires_at)}
+`));
+  if (!options.noOpen && interactive) {
+    write(import_picocolors53.default.dim(`Opening your browser…
+`));
+    openUrl(url2);
+  }
+  if (options.noWait) {
+    write(import_picocolors53.default.dim("Not waiting. Run `brainbase mcp list` to see when it is authorized.\n"));
+    return 0;
+  }
+  const controller = new AbortController;
+  const onInterrupt = () => controller.abort();
+  const signal = options.signal ?? controller.signal;
+  const stdoutIsTTY = options.stdoutIsTTY ?? process.stdout.isTTY === true;
+  const spinner = interactive && stdoutIsTTY ? (options.spinner ?? (() => waitSpinner()))() : null;
+  if (spinner)
+    spinner.start(WAITING_MESSAGE);
+  else
+    write(`${WAITING_MESSAGE}
+`);
+  if (!options.signal)
+    process.on("SIGINT", onInterrupt);
+  let outcome;
+  try {
+    outcome = await waitForConnectLink(link2.link_id, {
+      getLink,
+      intervalMs: options.pollIntervalMs ?? POLL_INTERVAL_MS,
+      signal
+    });
+  } finally {
+    if (!options.signal)
+      process.removeListener("SIGINT", onInterrupt);
+  }
+  const finish = (ok, message) => {
+    if (spinner) {
+      spinner.stop(message, ok ? 0 : 2);
+    } else if (ok) {
+      write(`${import_picocolors53.default.green("✔")} ${message}
+`);
+    } else {
+      writeErr(`${message}
+`);
+    }
+  };
+  switch (outcome.kind) {
+    case "connected":
+      finish(true, `${label} authorized. Your agent can use it on its next turn.`);
+      return 0;
+    case "failed":
+      finish(false, describeConnectFailure(label, outcome.errorCode));
+      return 1;
+    case "expired":
+      finish(false, `The link expired. Run brainbase mcp connect ${label} again.`);
+      return 1;
+    case "cancelled":
+      spinner?.stop("Cancelled.", 1);
+      writeErr(`Stopped waiting. The link still works until it expires, and finishing in the browser will still authorize ${label}.
+`);
+      return 130;
+    case "error":
+      finish(false, sanitizeLabel(outcome.message));
+      return 1;
+  }
+}
+function safeLinkUrl(raw) {
+  if (typeof raw !== "string")
+    return null;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+    return null;
+  return parsed.toString();
+}
+function describeLinkLifetime(expiresAt, now2 = Date.now()) {
+  const at3 = expiresAt ? Date.parse(expiresAt) : NaN;
+  const minutes = Math.round((at3 - now2) / 60000);
+  if (!Number.isFinite(minutes) || minutes < 1 || minutes > 120) {
+    return "The link works once.";
+  }
+  return `The link works once and expires in ${minutes} minute${minutes === 1 ? "" : "s"}.`;
+}
+function describeConnectFailure(label, errorCode) {
+  switch (errorCode) {
+    case "superseded":
+      return `Another authorization for ${label} started, so this one was cancelled.`;
+    case "access_denied":
+    case "authorization_cancelled":
+      return `Authorization for ${label} was declined in the browser. Run brainbase mcp connect ${label} to try again.`;
+    default: {
+      const code = errorCode ? ` (${sanitizeLabel(errorCode)})` : "";
+      return `Authorization for ${label} did not complete${code}. Run brainbase mcp connect ${label} to try again.`;
+    }
+  }
+}
+function isTransientPollError(err) {
+  if (!(err instanceof ApiError))
+    return true;
+  const status = err.status;
+  return status === undefined || status >= 500 || status === 408 || status === 429;
+}
+function abortableSleep(ms2, signal) {
+  return new Promise((resolve) => {
+    if (signal.aborted)
+      return resolve();
+    const done = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve();
+    };
+    const timer = setTimeout(done, ms2);
+    signal.addEventListener("abort", done, { once: true });
+  });
+}
+async function waitForConnectLink(linkId, options) {
+  const { getLink, intervalMs, signal } = options;
+  const maxFailures = options.maxConsecutiveFailures ?? MAX_CONSECUTIVE_POLL_FAILURES;
+  const aborted2 = new Promise((resolve) => {
+    if (signal.aborted)
+      resolve("aborted");
+    else
+      signal.addEventListener("abort", () => resolve("aborted"), { once: true });
+  });
+  let failures = 0;
+  while (true) {
+    await abortableSleep(intervalMs, signal);
+    if (signal.aborted)
+      return { kind: "cancelled" };
+    const result2 = await Promise.race([
+      getLink(linkId, signal).then((state) => ({ ok: true, state }), (error2) => ({ ok: false, error: error2 })),
+      aborted2
+    ]);
+    if (result2 === "aborted")
+      return { kind: "cancelled" };
+    if (!result2.ok) {
+      const message = result2.error?.message ?? String(result2.error);
+      if (!isTransientPollError(result2.error)) {
+        return { kind: "error", message: `Could not check the link: ${message}` };
+      }
+      failures += 1;
+      if (failures >= maxFailures) {
+        return {
+          kind: "error",
+          message: `Lost contact with Brainbase while waiting (${message}). If you finished in the browser, check with \`brainbase mcp list\`.`
+        };
+      }
+      continue;
+    }
+    failures = 0;
+    switch (result2.state?.status) {
+      case "connected":
+        return { kind: "connected" };
+      case "failed":
+        return { kind: "failed", errorCode: result2.state.error_code ?? null };
+      case "expired":
+        return { kind: "expired" };
+      default:
+        break;
+    }
+  }
+}
+async function runMcp(cwd2, sub, argv, options) {
   const writeErr = options.writeErr ?? ((s3) => process.stderr.write(s3));
   switch (sub) {
     case "check": {
@@ -81503,20 +81825,25 @@ async function runMcp(cwd2, sub, _argv, options) {
     }
     case "list":
       return runMcpList(cwd2, options);
+    case "connect": {
+      if (argv.length > 1)
+        return connectUsageError(options);
+      return runMcpConnect(cwd2, argv[0], options);
+    }
     default:
       writeErr(`Unknown mcp subcommand: ${sub ?? "(none)"}
 `);
-      writeErr(`Usage: brainbase mcp <check|list> [--json]
+      writeErr(`Usage: brainbase mcp <check|list|connect <name>> [--json]
 `);
       return 1;
   }
 }
 
 // src/cli/task.ts
-var import_picocolors57 = __toESM(require_picocolors(), 1);
+var import_picocolors58 = __toESM(require_picocolors(), 1);
 
 // src/cli/task-create.ts
-var import_picocolors53 = __toESM(require_picocolors(), 1);
+var import_picocolors54 = __toESM(require_picocolors(), 1);
 import { randomUUID as randomUUID3 } from "node:crypto";
 
 // src/core/interfaces-api.ts
@@ -81807,7 +82134,7 @@ var REASON_HINTS = {
   build_already_live: "That build is already live.",
   nothing_live: "Nothing is live yet, so there is nothing to roll back from.",
   release_already_live: "That release is already live.",
-  audience_empty: "Nobody can open it yet. Set the audience with `brainbase interface access <id> --everyone` or `--people <ids>`.",
+  audience_empty: "Nobody can open it yet. Set the audience with `brainbase interface access <id> --everyone` or `--people <emails>`.",
   slug_unavailable: "Pick another address."
 };
 function usesPat() {
@@ -82035,6 +82362,14 @@ var interfacesApi = {
   },
   getOperation(operationId, signal) {
     return read(`/operations/${encodeURIComponent(operationId)}`, signal);
+  },
+  startPreview(taskId, interfaceId) {
+    return write(`/tasks/${encodeURIComponent(taskId)}/interface-preview`, "POST", {
+      interface_id: interfaceId
+    });
+  },
+  probePreview(machineId, port, signal) {
+    return read(`/machines/${encodeURIComponent(machineId)}/preview/probe?port=${encodeURIComponent(String(port))}`, signal);
   }
 };
 function isTransientReadError(error2) {
@@ -82425,24 +82760,24 @@ async function waitForCreatedTask(created, options, dependencies) {
       return;
     }
     if (outcome.kind === "timeout") {
-      console.log(import_picocolors53.default.yellow(`Timed out after ${options.timeoutSeconds}s with the task still ${status}.`));
+      console.log(import_picocolors54.default.yellow(`Timed out after ${options.timeoutSeconds}s with the task still ${status}.`));
       return;
     }
     if (outcome.kind === "interrupted") {
-      console.log(import_picocolors53.default.yellow("Interrupted. The task is still running."));
+      console.log(import_picocolors54.default.yellow("Interrupted. The task is still running."));
       return;
     }
-    console.log(code === 0 ? import_picocolors53.default.green("Task completed.") : import_picocolors53.default.red(`Task finished as ${status}.`));
+    console.log(code === 0 ? import_picocolors54.default.green("Task completed.") : import_picocolors54.default.red(`Task finished as ${status}.`));
   } finally {
     process.removeListener("SIGINT", onSigint);
   }
 }
 
 // src/cli/task-get.ts
-var import_picocolors55 = __toESM(require_picocolors(), 1);
+var import_picocolors56 = __toESM(require_picocolors(), 1);
 
 // src/cli/task-list.ts
-var import_picocolors54 = __toESM(require_picocolors(), 1);
+var import_picocolors55 = __toESM(require_picocolors(), 1);
 var INTERFACE_THREAD_METADATA_KEY = "brainbase_interface_id";
 async function runTaskList(options) {
   if (!options.json)
@@ -82462,23 +82797,23 @@ function formatTaskList(tasks, agentId, interfaceId) {
   const lines = [""];
   if (tasks.length === 0 && interfaceId) {
     const id = sanitizeLabel(interfaceId);
-    lines.push(`  ${import_picocolors54.default.dim(`No build conversations for interface ${id}.`)}`, "", `  ${import_picocolors54.default.dim("start one with")} ${import_picocolors54.default.cyan(`brainbase interface build ${id} "..."`)}`, "");
+    lines.push(`  ${import_picocolors55.default.dim(`No build conversations for interface ${id}.`)}`, "", `  ${import_picocolors55.default.dim("start one with")} ${import_picocolors55.default.cyan(`brainbase interface build ${id} "..."`)}`, "");
     return lines.join(`
 `);
   }
   if (tasks.length === 0) {
-    lines.push(`  ${import_picocolors54.default.dim(agentId ? `No tasks for agent ${agentId}.` : "No tasks yet.")}`, "", `  ${import_picocolors54.default.dim("start one with")} ${import_picocolors54.default.cyan('brainbase task create --message "..."')}`, "");
+    lines.push(`  ${import_picocolors55.default.dim(agentId ? `No tasks for agent ${agentId}.` : "No tasks yet.")}`, "", `  ${import_picocolors55.default.dim("start one with")} ${import_picocolors55.default.cyan('brainbase task create --message "..."')}`, "");
     return lines.join(`
 `);
   }
   for (const task of tasks) {
-    const title = sanitizeLabel(task.title ?? "").trim() || import_picocolors54.default.dim("(untitled)");
-    lines.push(`  ${statusLabel(task.status)}  ${import_picocolors54.default.bold(title)}`);
-    lines.push(`    ${import_picocolors54.default.dim(task.id)}`);
-    lines.push(`    ${import_picocolors54.default.dim(`agent ${task.agent_id} · created ${task.created_at}`)}`);
+    const title = sanitizeLabel(task.title ?? "").trim() || import_picocolors55.default.dim("(untitled)");
+    lines.push(`  ${statusLabel(task.status)}  ${import_picocolors55.default.bold(title)}`);
+    lines.push(`    ${import_picocolors55.default.dim(task.id)}`);
+    lines.push(`    ${import_picocolors55.default.dim(`agent ${task.agent_id} · created ${task.created_at}`)}`);
     lines.push("");
   }
-  lines.push(`  ${import_picocolors54.default.dim("inspect one with")} ${import_picocolors54.default.cyan("brainbase task get <id>")}`, "");
+  lines.push(`  ${import_picocolors55.default.dim("inspect one with")} ${import_picocolors55.default.cyan("brainbase task get <id>")}`, "");
   return lines.join(`
 `);
 }
@@ -82486,16 +82821,16 @@ function statusLabel(status) {
   const padded = status.padEnd(14);
   switch (status) {
     case "success":
-      return import_picocolors54.default.green(padded);
+      return import_picocolors55.default.green(padded);
     case "fail":
-      return import_picocolors54.default.red(padded);
+      return import_picocolors55.default.red(padded);
     case "need_more_info":
-      return import_picocolors54.default.yellow(padded);
+      return import_picocolors55.default.yellow(padded);
     case "running":
     case "initializing":
-      return import_picocolors54.default.cyan(padded);
+      return import_picocolors55.default.cyan(padded);
     default:
-      return import_picocolors54.default.dim(padded);
+      return import_picocolors55.default.dim(padded);
   }
 }
 
@@ -82529,49 +82864,49 @@ async function readEvalRuns(task) {
 }
 function format(task, evals) {
   const lines = [""];
-  const title = task.title?.trim() || import_picocolors55.default.dim("(untitled)");
-  lines.push(`  ${statusLabel(task.status)}  ${import_picocolors55.default.bold(title)}`);
+  const title = task.title?.trim() || import_picocolors56.default.dim("(untitled)");
+  lines.push(`  ${statusLabel(task.status)}  ${import_picocolors56.default.bold(title)}`);
   lines.push("");
-  lines.push(`  ${import_picocolors55.default.dim("task")}     ${task.id}`);
-  lines.push(`  ${import_picocolors55.default.dim("agent")}    ${task.agent_id}`);
-  lines.push(`  ${import_picocolors55.default.dim("created")}  ${task.created_at}`);
+  lines.push(`  ${import_picocolors56.default.dim("task")}     ${task.id}`);
+  lines.push(`  ${import_picocolors56.default.dim("agent")}    ${task.agent_id}`);
+  lines.push(`  ${import_picocolors56.default.dim("created")}  ${task.created_at}`);
   if (task.parent_task_id) {
-    lines.push(`  ${import_picocolors55.default.dim("parent")}   ${task.parent_task_id}`);
+    lines.push(`  ${import_picocolors56.default.dim("parent")}   ${task.parent_task_id}`);
   }
   if (task.machine_id) {
-    lines.push(`  ${import_picocolors55.default.dim("machine")}  ${task.machine_id}${task.machine_size ? ` (${task.machine_size})` : ""}`);
+    lines.push(`  ${import_picocolors56.default.dim("machine")}  ${task.machine_id}${task.machine_size ? ` (${task.machine_size})` : ""}`);
   }
   if (task.sandbox_id)
-    lines.push(`  ${import_picocolors55.default.dim("sandbox")}  ${task.sandbox_id}`);
+    lines.push(`  ${import_picocolors56.default.dim("sandbox")}  ${task.sandbox_id}`);
   const failure = failureSummary(task);
   if (failure) {
     lines.push("");
-    lines.push(`  ${import_picocolors55.default.red("failure")}  ${failure}`);
+    lines.push(`  ${import_picocolors56.default.red("failure")}  ${failure}`);
   }
   const metadata = Object.entries(task.metadata ?? {});
   if (metadata.length > 0) {
     lines.push("");
-    lines.push(`  ${import_picocolors55.default.bold(import_picocolors55.default.dim("METADATA"))}`);
+    lines.push(`  ${import_picocolors56.default.bold(import_picocolors56.default.dim("METADATA"))}`);
     for (const [key2, value] of metadata) {
-      lines.push(`  ${import_picocolors55.default.dim(key2)}  ${value}`);
+      lines.push(`  ${import_picocolors56.default.dim(key2)}  ${value}`);
     }
   }
   lines.push("");
-  lines.push(`  ${import_picocolors55.default.bold(import_picocolors55.default.dim("EVAL VERDICTS"))}`);
+  lines.push(`  ${import_picocolors56.default.bold(import_picocolors56.default.dim("EVAL VERDICTS"))}`);
   if (evals.unavailable) {
-    lines.push(`  ${import_picocolors55.default.dim(evals.unavailable)}`);
+    lines.push(`  ${import_picocolors56.default.dim(evals.unavailable)}`);
   } else if (evals.runs.length === 0) {
-    lines.push(`  ${import_picocolors55.default.dim("none")}`);
+    lines.push(`  ${import_picocolors56.default.dim("none")}`);
   } else {
     for (const run of evals.runs) {
-      const verdict = run.passed === true ? import_picocolors55.default.green("pass") : run.passed === false ? import_picocolors55.default.red("fail") : import_picocolors55.default.dim(run.status);
+      const verdict = run.passed === true ? import_picocolors56.default.green("pass") : run.passed === false ? import_picocolors56.default.red("fail") : import_picocolors56.default.dim(run.status);
       lines.push(`  ${verdict}  ${run.eval_slug ?? run.eval_id}`);
       if (run.reasoning)
-        lines.push(`    ${import_picocolors55.default.dim(run.reasoning)}`);
+        lines.push(`    ${import_picocolors56.default.dim(run.reasoning)}`);
     }
   }
   lines.push("");
-  lines.push(`  ${import_picocolors55.default.dim("read its transcript with")} ${import_picocolors55.default.cyan(`brainbase task logs ${task.id}`)}`, "");
+  lines.push(`  ${import_picocolors56.default.dim("read its transcript with")} ${import_picocolors56.default.cyan(`brainbase task logs ${task.id}`)}`, "");
   return lines.join(`
 `);
 }
@@ -82588,7 +82923,7 @@ function failureSummary(task) {
 }
 
 // src/cli/task-logs.ts
-var import_picocolors56 = __toESM(require_picocolors(), 1);
+var import_picocolors57 = __toESM(require_picocolors(), 1);
 
 // src/core/task-events.ts
 var DEFAULT_RETRY_BUDGET_MS = 60000;
@@ -82724,14 +83059,14 @@ async function runTaskLogs(taskId, options = {}, dependencies = {}) {
     console.log(renderEvent(event));
   }
   if (ordered.length === 0) {
-    console.log(import_picocolors56.default.dim("No events for this task yet."));
+    console.log(import_picocolors57.default.dim("No events for this task yet."));
   }
 }
 async function followTranscript(taskId, options, dependencies) {
   const backfill = options.limit === undefined ? "" : `?backfill=${options.limit}`;
   const { url: url2, resolveBearer } = await masStreamTarget(`/tasks/${encodeURIComponent(taskId)}/events/stream${backfill}`);
   if (!options.json) {
-    console.log(import_picocolors56.default.dim(`Following task ${taskId} — Ctrl-C to stop.`));
+    console.log(import_picocolors57.default.dim(`Following task ${taskId} — Ctrl-C to stop.`));
   }
   const setExitCode = dependencies.setExitCode ?? ((code) => process.exitCode = code);
   const controller = new AbortController;
@@ -82759,10 +83094,10 @@ async function followTranscript(taskId, options, dependencies) {
         } else if (options.json) {
           console.log(JSON.stringify(frame));
         } else {
-          console.log(import_picocolors56.default.dim(frame.type));
+          console.log(import_picocolors57.default.dim(frame.type));
         }
       },
-      onReconnect: (reason) => console.error(import_picocolors56.default.dim(`reconnecting — ${reason}`))
+      onReconnect: (reason) => console.error(import_picocolors57.default.dim(`reconnecting — ${reason}`))
     });
     if (interruptCode !== undefined)
       setExitCode(interruptCode);
@@ -83446,64 +83781,64 @@ async function runTask(cwd2, sub, args) {
 function printHelp4() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors57.default.bold("brainbase task")} ${import_picocolors57.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors58.default.bold("brainbase task")} ${import_picocolors58.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors57.default.cyan("create")} ${import_picocolors57.default.dim("--message <text>")}   ${import_picocolors57.default.dim("create a task and start its first run")}`);
-  out.push(`  ${import_picocolors57.default.cyan("list | ls")}                ${import_picocolors57.default.dim("recent tasks you can reach (--json for scripts)")}`);
-  out.push(`  ${import_picocolors57.default.cyan("get")} ${import_picocolors57.default.dim("<task-id>")}            ${import_picocolors57.default.dim("one task: status, agent, machine, eval verdicts")}`);
-  out.push(`  ${import_picocolors57.default.cyan("logs")} ${import_picocolors57.default.dim("<task-id> [--follow]")} ${import_picocolors57.default.dim("one line per event in the task's transcript, or tail it live")}`);
-  out.push(`  ${import_picocolors57.default.cyan("send")} ${import_picocolors57.default.dim("<task-id> <message>")} ${import_picocolors57.default.dim("send a follow-up, including while the agent is running")}`);
-  out.push(`  ${import_picocolors57.default.cyan("stop")} ${import_picocolors57.default.dim("<task-id>")}           ${import_picocolors57.default.dim("stop execution and cancel pending follow-ups, retaining their text")}`);
-  out.push(`  ${import_picocolors57.default.cyan("delete")} ${import_picocolors57.default.dim("<task-id>")}         ${import_picocolors57.default.dim("permanently delete a stopped task and tear down its sandbox (--yes to skip the prompt)")}`);
+  out.push(`  ${import_picocolors58.default.cyan("create")} ${import_picocolors58.default.dim("--message <text>")}   ${import_picocolors58.default.dim("create a task and start its first run")}`);
+  out.push(`  ${import_picocolors58.default.cyan("list | ls")}                ${import_picocolors58.default.dim("recent tasks you can reach (--json for scripts)")}`);
+  out.push(`  ${import_picocolors58.default.cyan("get")} ${import_picocolors58.default.dim("<task-id>")}            ${import_picocolors58.default.dim("one task: status, agent, machine, eval verdicts")}`);
+  out.push(`  ${import_picocolors58.default.cyan("logs")} ${import_picocolors58.default.dim("<task-id> [--follow]")} ${import_picocolors58.default.dim("one line per event in the task's transcript, or tail it live")}`);
+  out.push(`  ${import_picocolors58.default.cyan("send")} ${import_picocolors58.default.dim("<task-id> <message>")} ${import_picocolors58.default.dim("send a follow-up, including while the agent is running")}`);
+  out.push(`  ${import_picocolors58.default.cyan("stop")} ${import_picocolors58.default.dim("<task-id>")}           ${import_picocolors58.default.dim("stop execution and cancel pending follow-ups, retaining their text")}`);
+  out.push(`  ${import_picocolors58.default.cyan("delete")} ${import_picocolors58.default.dim("<task-id>")}         ${import_picocolors58.default.dim("permanently delete a stopped task and tear down its sandbox (--yes to skip the prompt)")}`);
   out.push("");
-  out.push(`  ${import_picocolors57.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors57.default.dim("--message <text>")}   required first user message`);
-  out.push(`  ${import_picocolors57.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
-  out.push(`  ${import_picocolors57.default.dim("--interface <id>")}   open it as a build conversation for this interface (agent defaults to the interface's)`);
-  out.push(`  ${import_picocolors57.default.dim("--title <text>")}     optional task title`);
-  out.push(`  ${import_picocolors57.default.dim("--model <id>")}       optional model override`);
-  out.push(`  ${import_picocolors57.default.dim("--wait")}             block until the task finishes; exit 1 unless it succeeded`);
-  out.push(`  ${import_picocolors57.default.dim("--timeout <secs>")}   give up waiting after <secs> and exit 1 (needs --wait)`);
+  out.push(`  ${import_picocolors58.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors58.default.dim("--message <text>")}   required first user message`);
+  out.push(`  ${import_picocolors58.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
+  out.push(`  ${import_picocolors58.default.dim("--interface <id>")}   open it as a build conversation for this interface (agent defaults to the interface's)`);
+  out.push(`  ${import_picocolors58.default.dim("--title <text>")}     optional task title`);
+  out.push(`  ${import_picocolors58.default.dim("--model <id>")}       optional model override`);
+  out.push(`  ${import_picocolors58.default.dim("--wait")}             block until the task finishes; exit 1 unless it succeeded`);
+  out.push(`  ${import_picocolors58.default.dim("--timeout <secs>")}   give up waiting after <secs> and exit 1 (needs --wait)`);
   out.push("");
-  out.push(`  ${import_picocolors57.default.bold("list flags")}`);
-  out.push(`  ${import_picocolors57.default.dim("--agent <id>")}       only this agent's tasks`);
-  out.push(`  ${import_picocolors57.default.dim("--interface <id>")}   only this interface's build conversations (hidden from a plain list)`);
-  out.push(`  ${import_picocolors57.default.dim("--limit <n>")}        cap the page (1-200, server default 50)`);
+  out.push(`  ${import_picocolors58.default.bold("list flags")}`);
+  out.push(`  ${import_picocolors58.default.dim("--agent <id>")}       only this agent's tasks`);
+  out.push(`  ${import_picocolors58.default.dim("--interface <id>")}   only this interface's build conversations (hidden from a plain list)`);
+  out.push(`  ${import_picocolors58.default.dim("--limit <n>")}        cap the page (1-200, server default 50)`);
   out.push("");
-  out.push(`  ${import_picocolors57.default.bold("logs flags")}`);
-  out.push(`  ${import_picocolors57.default.dim("--limit <n>")}        stop after <n> events instead of the whole transcript; with --follow, the first page size`);
-  out.push(`  ${import_picocolors57.default.dim("--follow, -f")}       stay attached and print events as they land, until the task finishes`);
+  out.push(`  ${import_picocolors58.default.bold("logs flags")}`);
+  out.push(`  ${import_picocolors58.default.dim("--limit <n>")}        stop after <n> events instead of the whole transcript; with --follow, the first page size`);
+  out.push(`  ${import_picocolors58.default.dim("--follow, -f")}       stay attached and print events as they land, until the task finishes`);
   out.push("");
-  out.push(`  ${import_picocolors57.default.bold("send flags")}`);
-  out.push(`  ${import_picocolors57.default.dim("--input-id <uuid>")}  recover the same request using its original ID and identical message`);
-  out.push(`  ${import_picocolors57.default.dim("                    omit it to send a new follow-up; an unconfirmed receipt is never automatically replayed")}`);
-  out.push(`  ${import_picocolors57.default.dim("                    admission disabled/recovery unavailable means no input was admitted; retry the same ID after recovery")}`);
+  out.push(`  ${import_picocolors58.default.bold("send flags")}`);
+  out.push(`  ${import_picocolors58.default.dim("--input-id <uuid>")}  recover the same request using its original ID and identical message`);
+  out.push(`  ${import_picocolors58.default.dim("                    omit it to send a new follow-up; an unconfirmed receipt is never automatically replayed")}`);
+  out.push(`  ${import_picocolors58.default.dim("                    admission disabled/recovery unavailable means no input was admitted; retry the same ID after recovery")}`);
   out.push("");
-  out.push(`  ${import_picocolors57.default.bold("send and stop flags")}`);
-  out.push(`  ${import_picocolors57.default.dim("--generation <n>")}   retain the printed generation when retrying; defaults to a fresh snapshot for a new operation`);
-  out.push(`  ${import_picocolors57.default.dim("                    Stop errors may follow queued-input cancellation; retry the printed command to avoid stopping newer work")}`);
+  out.push(`  ${import_picocolors58.default.bold("send and stop flags")}`);
+  out.push(`  ${import_picocolors58.default.dim("--generation <n>")}   retain the printed generation when retrying; defaults to a fresh snapshot for a new operation`);
+  out.push(`  ${import_picocolors58.default.dim("                    Stop errors may follow queued-input cancellation; retry the printed command to avoid stopping newer work")}`);
   out.push("");
-  out.push(`  ${import_picocolors57.default.bold("every subcommand")}`);
-  out.push(`  ${import_picocolors57.default.dim("--json")}             machine-readable output — create prints task_id, agent_id and status; list, get, logs, send and stop print the raw records; delete prints id and deleted`);
-  out.push(`  ${import_picocolors57.default.dim("                    send and stop include expected_generation for safe retries; send also reports idempotency_replayed when present")}`);
-  out.push(`  ${import_picocolors57.default.dim("                    logs --follow --json prints one record per line, since a live stream has no end to close on")}`);
+  out.push(`  ${import_picocolors58.default.bold("every subcommand")}`);
+  out.push(`  ${import_picocolors58.default.dim("--json")}             machine-readable output — create prints task_id, agent_id and status; list, get, logs, send and stop print the raw records; delete prints id and deleted`);
+  out.push(`  ${import_picocolors58.default.dim("                    send and stop include expected_generation for safe retries; send also reports idempotency_replayed when present")}`);
+  out.push(`  ${import_picocolors58.default.dim("                    logs --follow --json prints one record per line, since a live stream has no end to close on")}`);
   out.push("");
-  out.push(`  ${import_picocolors57.default.dim("Exit codes with --wait:")} ${import_picocolors57.default.dim("0 succeeded · 1 failed, needs input, or timed out · 130 interrupted")}`);
-  out.push(`  ${import_picocolors57.default.dim("Exit codes with --follow:")} ${import_picocolors57.default.dim("0 task reached a terminal state · 1 stream refused, or unreachable for 60s · 130 interrupted (Ctrl-C) · 143 terminated")}`);
-  out.push(`  ${import_picocolors57.default.dim("Exit codes with send:")} ${import_picocolors57.default.dim("0 queued, dispatching, submitted or completed · 1 unconfirmed, cancelled, failed or request error")}`);
-  out.push(`  ${import_picocolors57.default.dim("Ctrl-C while waiting or following logs detaches; use task stop to cancel remote work.")}`);
+  out.push(`  ${import_picocolors58.default.dim("Exit codes with --wait:")} ${import_picocolors58.default.dim("0 succeeded · 1 failed, needs input, or timed out · 130 interrupted")}`);
+  out.push(`  ${import_picocolors58.default.dim("Exit codes with --follow:")} ${import_picocolors58.default.dim("0 task reached a terminal state · 1 stream refused, or unreachable for 60s · 130 interrupted (Ctrl-C) · 143 terminated")}`);
+  out.push(`  ${import_picocolors58.default.dim("Exit codes with send:")} ${import_picocolors58.default.dim("0 queued, dispatching, submitted or completed · 1 unconfirmed, cancelled, failed or request error")}`);
+  out.push(`  ${import_picocolors58.default.dim("Ctrl-C while waiting or following logs detaches; use task stop to cancel remote work.")}`);
   out.push("");
-  out.push(`  ${import_picocolors57.default.dim("Flag-like values:")} use ${import_picocolors57.default.cyan("--flag=value")} or ${import_picocolors57.default.cyan("--flag -- <value>")}`);
+  out.push(`  ${import_picocolors58.default.dim("Flag-like values:")} use ${import_picocolors58.default.cyan("--flag=value")} or ${import_picocolors58.default.cyan("--flag -- <value>")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/machine.ts
-var import_picocolors60 = __toESM(require_picocolors(), 1);
+var import_picocolors61 = __toESM(require_picocolors(), 1);
 
 // src/cli/machine-list.ts
-var import_picocolors58 = __toESM(require_picocolors(), 1);
+var import_picocolors59 = __toESM(require_picocolors(), 1);
 async function runMachineList(args = {}) {
   if (!args.json)
     banner("machine list — sandboxes you can reach");
@@ -83520,7 +83855,7 @@ async function runMachineList(args = {}) {
 function formatMachineList(machines, includedDead) {
   const lines = [""];
   if (machines.length === 0) {
-    lines.push(`  ${import_picocolors58.default.dim(includedDead ? "No machines." : "No live machines. Pass --all to include torn-down ones.")}`, "");
+    lines.push(`  ${import_picocolors59.default.dim(includedDead ? "No machines." : "No live machines. Pass --all to include torn-down ones.")}`, "");
     return lines.join(`
 `);
   }
@@ -83544,21 +83879,21 @@ function formatMachineList(machines, includedDead) {
       row.kind.padEnd(kindWidth),
       row.dead ? status : statusTint(row.status, status),
       row.size.padEnd(sizeWidth),
-      import_picocolors58.default.dim(row.age)
+      import_picocolors59.default.dim(row.age)
     ].join("  ");
-    lines.push(`  ${row.dead ? import_picocolors58.default.dim(cells) : cells}`);
+    lines.push(`  ${row.dead ? import_picocolors59.default.dim(cells) : cells}`);
   }
-  lines.push("", `  ${import_picocolors58.default.dim("tear one down with")} ${import_picocolors58.default.cyan("brainbase machine rm <id>")}`, "");
+  lines.push("", `  ${import_picocolors59.default.dim("tear one down with")} ${import_picocolors59.default.cyan("brainbase machine rm <id>")}`, "");
   return lines.join(`
 `);
 }
 function statusTint(status, padded) {
   switch (status) {
     case "running":
-      return import_picocolors58.default.green(padded);
+      return import_picocolors59.default.green(padded);
     case "stopped":
     case "starting":
-      return import_picocolors58.default.yellow(padded);
+      return import_picocolors59.default.yellow(padded);
     default:
       return padded;
   }
@@ -83581,7 +83916,7 @@ function age(createdAt) {
 }
 
 // src/cli/machine-rm.ts
-var import_picocolors59 = __toESM(require_picocolors(), 1);
+var import_picocolors60 = __toESM(require_picocolors(), 1);
 async function runMachineRm(args, dependencies = {}) {
   const setExitCode = dependencies.setExitCode ?? ((code) => process.exitCode = code);
   const machineId = args.machineId?.trim();
@@ -83595,7 +83930,7 @@ async function runMachineRm(args, dependencies = {}) {
     if (args.json) {
       console.log(JSON.stringify({ id: machineId, torn_down: false, outcome: "declined" }, null, 2));
     } else {
-      console.log(`  ${import_picocolors59.default.dim("Left alone.")}`);
+      console.log(`  ${import_picocolors60.default.dim("Left alone.")}`);
     }
     return;
   }
@@ -83613,7 +83948,7 @@ async function promptForTeardown(args) {
     return true;
   if (!args.json) {
     console.log(`
-  ${import_picocolors59.default.red("This destroys the sandbox.")} ${import_picocolors59.default.dim("Anything not committed out of it is lost. The machine row is kept for cost history.")}
+  ${import_picocolors60.default.red("This destroys the sandbox.")} ${import_picocolors60.default.dim("Anything not committed out of it is lost. The machine row is kept for cost history.")}
 `);
   }
   const answer = await se({
@@ -83625,9 +83960,9 @@ async function promptForTeardown(args) {
 function formatMachineRm(machine) {
   const lines = [""];
   if (machine.destroyed_at) {
-    lines.push(`  ${import_picocolors59.default.green("✓")} ${machine.kind} sandbox ${machine.id} is torn down.`, `  ${import_picocolors59.default.dim(`destroyed_at ${machine.destroyed_at}`)}`);
+    lines.push(`  ${import_picocolors60.default.green("✓")} ${machine.kind} sandbox ${machine.id} is torn down.`, `  ${import_picocolors60.default.dim(`destroyed_at ${machine.destroyed_at}`)}`);
   } else {
-    lines.push(`  ${import_picocolors59.default.yellow("!")} ${machine.id} came back without a teardown timestamp (status ${machine.status}).`, `  ${import_picocolors59.default.dim("Re-check with `brainbase machine ls --all` before assuming it stopped billing.")}`);
+    lines.push(`  ${import_picocolors60.default.yellow("!")} ${machine.id} came back without a teardown timestamp (status ${machine.status}).`, `  ${import_picocolors60.default.dim("Re-check with `brainbase machine ls --all` before assuming it stopped billing.")}`);
   }
   lines.push("");
   return lines.join(`
@@ -83668,28 +84003,28 @@ async function runMachine(sub, args, opts) {
 function printHelp5() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors60.default.bold("brainbase machine")} ${import_picocolors60.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors61.default.bold("brainbase machine")} ${import_picocolors61.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors60.default.cyan("ls")}          ${import_picocolors60.default.dim("list your sandboxes — live ones only unless --all")}`);
-  out.push(`  ${import_picocolors60.default.cyan("rm")} ${import_picocolors60.default.dim("<id>")}    ${import_picocolors60.default.dim("tear a sandbox down (terminal; the row is kept for cost history)")}`);
+  out.push(`  ${import_picocolors61.default.cyan("ls")}          ${import_picocolors61.default.dim("list your sandboxes — live ones only unless --all")}`);
+  out.push(`  ${import_picocolors61.default.cyan("rm")} ${import_picocolors61.default.dim("<id>")}    ${import_picocolors61.default.dim("tear a sandbox down (terminal; the row is kept for cost history)")}`);
   out.push("");
-  out.push(`  ${import_picocolors60.default.dim("--all")}     ${import_picocolors60.default.dim("for ls: include machines already torn down")}`);
-  out.push(`  ${import_picocolors60.default.dim("--limit <n>")} ${import_picocolors60.default.dim("for ls: how many to fetch (1-200, default 50)")}`);
-  out.push(`  ${import_picocolors60.default.dim("--yes, -y")} ${import_picocolors60.default.dim("for rm: skip the confirmation")}`);
-  out.push(`  ${import_picocolors60.default.dim("--json")}    ${import_picocolors60.default.dim("machine-readable output")}`);
+  out.push(`  ${import_picocolors61.default.dim("--all")}     ${import_picocolors61.default.dim("for ls: include machines already torn down")}`);
+  out.push(`  ${import_picocolors61.default.dim("--limit <n>")} ${import_picocolors61.default.dim("for ls: how many to fetch (1-200, default 50)")}`);
+  out.push(`  ${import_picocolors61.default.dim("--yes, -y")} ${import_picocolors61.default.dim("for rm: skip the confirmation")}`);
+  out.push(`  ${import_picocolors61.default.dim("--json")}    ${import_picocolors61.default.dim("machine-readable output")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/interface.ts
-var import_picocolors66 = __toESM(require_picocolors(), 1);
+var import_picocolors68 = __toESM(require_picocolors(), 1);
 
 // src/cli/interface-build.ts
-var import_picocolors62 = __toESM(require_picocolors(), 1);
+var import_picocolors63 = __toESM(require_picocolors(), 1);
 
 // src/cli/interface-common.ts
-var import_picocolors61 = __toESM(require_picocolors(), 1);
+var import_picocolors62 = __toESM(require_picocolors(), 1);
 var JSON_FLAG = { key: "json", names: ["--json"], kind: "boolean" };
 var YES_FLAG = { key: "yes", names: ["--yes", "-y"], kind: "boolean" };
 var KEY_FLAG = {
@@ -83751,7 +84086,7 @@ function progress(json) {
   return json ? (line) => console.error(line) : (line) => console.log(line);
 }
 function field(label, value) {
-  return `  ${import_picocolors61.default.dim(label.padEnd(12))}${value}`;
+  return `  ${import_picocolors62.default.dim(label.padEnd(12))}${value}`;
 }
 function interruption(deps) {
   if (deps.signal)
@@ -83785,7 +84120,7 @@ async function confirmChange(options) {
   const confirm = options.deps.confirm ?? promptConfirm;
   const accepted = await confirm(options.question);
   if (!accepted)
-    console.log(`  ${import_picocolors61.default.dim("Left alone.")}`);
+    console.log(`  ${import_picocolors62.default.dim("Left alone.")}`);
   return accepted;
 }
 async function promptConfirm(message) {
@@ -83927,28 +84262,28 @@ function buildExitCode(outcome) {
 function reportBuild(say, interfaceId, outcome, timeoutSeconds) {
   switch (outcome.kind) {
     case "built":
-      say(`  ${import_picocolors62.default.dim("build")}    ${safe(outcome.build.id)} ${import_picocolors62.default.green("succeeded")}`);
+      say(`  ${import_picocolors63.default.dim("build")}    ${safe(outcome.build.id)} ${import_picocolors63.default.green("succeeded")}`);
       say("");
-      say(`  ${import_picocolors62.default.dim("Next:")} ${import_picocolors62.default.cyan(`brainbase interface publish ${safe(interfaceId)}`)}`);
+      say(`  ${import_picocolors63.default.dim("Next:")} ${import_picocolors63.default.cyan(`brainbase interface publish ${safe(interfaceId)}`)}`);
       return;
     case "failed": {
       const reason = outcome.build?.error_summary ?? outcome.operation?.error ?? outcome.operation?.reason ?? null;
-      say(`  ${import_picocolors62.default.dim("build")}    ${outcome.build ? safe(outcome.build.id) : import_picocolors62.default.dim("none")} ${import_picocolors62.default.red("failed")}`);
+      say(`  ${import_picocolors63.default.dim("build")}    ${outcome.build ? safe(outcome.build.id) : import_picocolors63.default.dim("none")} ${import_picocolors63.default.red("failed")}`);
       if (reason)
         say(`  ${safeBlock(reason).split(`
 `).join(`
   `)}`);
-      say(`  ${import_picocolors62.default.dim("Try again with")} ${import_picocolors62.default.cyan(`brainbase interface rebuild ${safe(interfaceId)}`)}`);
+      say(`  ${import_picocolors63.default.dim("Try again with")} ${import_picocolors63.default.cyan(`brainbase interface rebuild ${safe(interfaceId)}`)}`);
       return;
     }
     case "busy":
-      say(`  ${import_picocolors62.default.yellow(safe(outcome.message))}`);
+      say(`  ${import_picocolors63.default.yellow(safe(outcome.message))}`);
       return;
     case "timeout":
-      say(`  ${import_picocolors62.default.yellow(`Still building after ${timeoutSeconds}s.`)} ${import_picocolors62.default.dim(`It keeps going; check \`brainbase interface builds ${safe(interfaceId)}\`.`)}`);
+      say(`  ${import_picocolors63.default.yellow(`Still building after ${timeoutSeconds}s.`)} ${import_picocolors63.default.dim(`It keeps going; check \`brainbase interface builds ${safe(interfaceId)}\`.`)}`);
       return;
     case "interrupted":
-      say(`  ${import_picocolors62.default.yellow("Stopped waiting.")} ${import_picocolors62.default.dim(`The build keeps going; check \`brainbase interface builds ${safe(interfaceId)}\`.`)}`);
+      say(`  ${import_picocolors63.default.yellow("Stopped waiting.")} ${import_picocolors63.default.dim(`The build keeps going; check \`brainbase interface builds ${safe(interfaceId)}\`.`)}`);
       return;
     default: {
       const unreachable = outcome;
@@ -83995,8 +84330,8 @@ async function build(ctx) {
         throw held;
     }
     const reattach = `brainbase task logs ${safe(taskId)} --follow`;
-    say(`  ${import_picocolors62.default.dim("Build conversation")} ${import_picocolors62.default.bold(safe(taskId))} ${import_picocolors62.default.dim(`on ${safe(before2.name)}`)}`);
-    say(`  ${import_picocolors62.default.dim(`If this stops early, reattach with \`${reattach}\`.`)}`);
+    say(`  ${import_picocolors63.default.dim("Build conversation")} ${import_picocolors63.default.bold(safe(taskId))} ${import_picocolors63.default.dim(`on ${safe(before2.name)}`)}`);
+    say(`  ${import_picocolors63.default.dim(`If this stops early, reattach with \`${reattach}\`.`)}`);
     const finish = (result2, exitCode) => {
       if (json)
         console.log(JSON.stringify({ type: "result", task_id: taskId, ...result2 }));
@@ -84013,13 +84348,13 @@ async function build(ctx) {
       });
     } catch (error2) {
       say("");
-      say(`  ${import_picocolors62.default.red(`Lost the conversation's event stream: ${safe(error2.message)}`)}`);
-      say(`  ${import_picocolors62.default.dim(`Conversation ${safe(taskId)} may still be running. Reattach with`)} ${import_picocolors62.default.cyan(reattach)}`);
+      say(`  ${import_picocolors63.default.red(`Lost the conversation's event stream: ${safe(error2.message)}`)}`);
+      say(`  ${import_picocolors63.default.dim(`Conversation ${safe(taskId)} may still be running. Reattach with`)} ${import_picocolors63.default.cyan(reattach)}`);
       finish({ version_id: null, build_id: null, status: "stream_lost", task_status: null }, 1);
       return;
     }
     if (followExit !== undefined) {
-      say(`  ${import_picocolors62.default.yellow("Stopped following.")} ${import_picocolors62.default.dim(`The conversation keeps running. Reattach with \`${reattach}\`.`)}`);
+      say(`  ${import_picocolors63.default.yellow("Stopped following.")} ${import_picocolors63.default.dim(`The conversation keeps running. Reattach with \`${reattach}\`.`)}`);
       finish({ version_id: null, build_id: null, status: "interrupted", task_status: null }, followExit);
       return;
     }
@@ -84034,7 +84369,7 @@ async function build(ctx) {
       if (settled.kind !== "terminal") {
         const interrupted = settled.kind === "interrupted";
         const status2 = settled.task?.status ?? null;
-        say(`  ${import_picocolors62.default.yellow(interrupted ? "Stopped." : `The conversation is still ${safe(status2 ?? "running")}.`)} ${import_picocolors62.default.dim(`Check it with \`brainbase task get ${safe(taskId)}\`.`)}`);
+        say(`  ${import_picocolors63.default.yellow(interrupted ? "Stopped." : `The conversation is still ${safe(status2 ?? "running")}.`)} ${import_picocolors63.default.dim(`Check it with \`brainbase task get ${safe(taskId)}\`.`)}`);
         finish({ version_id: null, build_id: null, status: interrupted ? "interrupted" : "task_unsettled", task_status: status2 }, interrupted ? SIGINT_EXIT_CODE : 1);
         return;
       }
@@ -84054,36 +84389,36 @@ async function build(ctx) {
       }
       const codes = [exitCodeForTaskStatus(task.status)];
       say("");
-      say(`  ${import_picocolors62.default.dim("conversation")} ${safe(taskId)} ${import_picocolors62.default.dim("ended")} ${safe(task.status)}`);
+      say(`  ${import_picocolors63.default.dim("conversation")} ${safe(taskId)} ${import_picocolors63.default.dim("ended")} ${safe(task.status)}`);
       if (mine?.status === "failed") {
         codes.push(1);
         const why = [mine.reason, mine.error].filter(Boolean).map((part) => safe(part)).join(": ");
-        say(`  ${import_picocolors62.default.red(`This conversation's build work failed${why ? ` (${why})` : ""}.`)}`);
+        say(`  ${import_picocolors63.default.red(`This conversation's build work failed${why ? ` (${why})` : ""}.`)}`);
       } else if (task.status !== "success" && task.status !== "need_more_info") {
-        say(`  ${import_picocolors62.default.red(`The conversation finished as ${safe(task.status)}.`)} ${import_picocolors62.default.dim(`See \`brainbase task logs ${safe(taskId)}\`.`)}`);
+        say(`  ${import_picocolors63.default.red(`The conversation finished as ${safe(task.status)}.`)} ${import_picocolors63.default.dim(`See \`brainbase task logs ${safe(taskId)}\`.`)}`);
       }
       if (task.status === "need_more_info") {
         const question = await lastAgentMessage(taskId);
         say("");
         if (question) {
-          say(`  ${import_picocolors62.default.bold("The agent asks:")}`);
+          say(`  ${import_picocolors63.default.bold("The agent asks:")}`);
           say(`  ${safeBlock(question).split(`
 `).join(`
   `)}`);
         } else {
-          say(`  ${import_picocolors62.default.bold("The agent needs more from you before it can go on.")}`);
+          say(`  ${import_picocolors63.default.bold("The agent needs more from you before it can go on.")}`);
         }
         say("");
-        say(`  ${import_picocolors62.default.dim("Reply with")} ${import_picocolors62.default.cyan(`brainbase task send ${safe(taskId)} "<reply>"`)}`);
-        say(`  ${import_picocolors62.default.dim("then follow it with")} ${import_picocolors62.default.cyan(reattach)}`);
+        say(`  ${import_picocolors63.default.dim("Reply with")} ${import_picocolors63.default.cyan(`brainbase task send ${safe(taskId)} "<reply>"`)}`);
+        say(`  ${import_picocolors63.default.dim("then follow it with")} ${import_picocolors63.default.cyan(reattach)}`);
       }
       let status;
       let buildId = null;
       if (versionId) {
         say("");
-        say(`  ${import_picocolors62.default.dim("version")}  ${safe(versionId)}`);
+        say(`  ${import_picocolors63.default.dim("version")}  ${safe(versionId)}`);
         if (!json)
-          say(`  ${import_picocolors62.default.dim("Waiting for its build...")}`);
+          say(`  ${import_picocolors63.default.dim("Waiting for its build...")}`);
         const buildKey = `${key2}-build`;
         let outcome;
         try {
@@ -84093,7 +84428,7 @@ async function build(ctx) {
             signal: stop.signal,
             now: deps.now,
             idempotencyKey: buildKey,
-            onStall: () => say(`  ${import_picocolors62.default.yellow("The build looks stalled; still waiting in case another worker picks it up.")}`)
+            onStall: () => say(`  ${import_picocolors63.default.yellow("The build looks stalled; still waiting in case another worker picks it up.")}`)
           });
         } catch (error2) {
           if (error2 instanceof LostResponseError) {
@@ -84109,9 +84444,9 @@ async function build(ctx) {
         status = noVersionStatus(mine?.status === "failed", task.status);
         if (status === "no_version") {
           codes.push(1);
-          say(`  ${import_picocolors62.default.red("The conversation finished without committing a version, so there is nothing to build.")}`);
+          say(`  ${import_picocolors63.default.red("The conversation finished without committing a version, so there is nothing to build.")}`);
         } else if (task.status !== "need_more_info") {
-          say(`  ${import_picocolors62.default.dim("This conversation produced no version, so there is nothing to build.")}`);
+          say(`  ${import_picocolors63.default.dim("This conversation produced no version, so there is nothing to build.")}`);
         }
       }
       if (!json)
@@ -84126,10 +84461,61 @@ async function build(ctx) {
 var buildCommands = { build };
 
 // src/cli/interface-lifecycle.ts
-var import_picocolors64 = __toESM(require_picocolors(), 1);
+var import_picocolors65 = __toESM(require_picocolors(), 1);
+
+// src/core/org-members.ts
+async function listAllOrgMembers(orgId) {
+  const members = [];
+  let cursor2;
+  for (;; ) {
+    let page;
+    try {
+      page = await api.listOrgMembersPage(orgId, cursor2);
+    } catch (error2) {
+      if (error2 instanceof ApiError && error2.status === 404) {
+        throw new Error("This Brainbase server cannot list organization members, so people can only be named by user id.");
+      }
+      throw error2;
+    }
+    members.push(...page.members);
+    if (!page.next_cursor)
+      return members;
+    if (page.next_cursor === cursor2) {
+      throw new Error("Could not read the member list: the page cursor stopped advancing.");
+    }
+    cursor2 = page.next_cursor;
+  }
+}
+function isEmail(entry) {
+  return entry.includes("@");
+}
+function resolveEmails(entries, members, flag) {
+  const ids = entries.map((entry) => {
+    if (!isEmail(entry))
+      return entry;
+    const wanted = entry.toLowerCase();
+    const matches2 = members.filter((member) => member.email?.toLowerCase() === wanted);
+    if (matches2.length === 1)
+      return matches2[0].id;
+    if (matches2.length === 0) {
+      throw new Error(`${flag}: nobody you can see in this organization has the email ${entry}. ` + "`brainbase member ls` lists the people you can share with.");
+    }
+    throw new Error(`${flag}: more than one member has the email ${entry} (${matches2.map((m3) => m3.id).join(", ")}). Pass the user id instead.`);
+  });
+  return [...new Set(ids)];
+}
+function personLabel(id, members) {
+  const member = members?.get(id);
+  if (!member?.email)
+    return id;
+  return member.name ? `${member.email} (${member.name})` : member.email;
+}
+function membersById(members) {
+  return new Map(members.map((member) => [member.id, member]));
+}
 
 // src/cli/interface-read.ts
-var import_picocolors63 = __toESM(require_picocolors(), 1);
+var import_picocolors64 = __toESM(require_picocolors(), 1);
 function interfaceState(row) {
   if (row.archived_at)
     return "archived";
@@ -84148,11 +84534,11 @@ function threadsLabel(shared) {
 function stateTint(state) {
   switch (state) {
     case "live":
-      return import_picocolors63.default.green;
+      return import_picocolors64.default.green;
     case "building":
-      return import_picocolors63.default.yellow;
+      return import_picocolors64.default.yellow;
     case "archived":
-      return import_picocolors63.default.dim;
+      return import_picocolors64.default.dim;
     case "draft":
       return (cell) => cell;
     default: {
@@ -84185,7 +84571,7 @@ async function list(ctx) {
     banner("interface list — dashboards you can see");
     if (shown.length === 0) {
       console.log(`
-  ${import_picocolors63.default.dim(onlyArchived ? "No archived interfaces." : "No interfaces. Create one with `brainbase interface create`.")}
+  ${import_picocolors64.default.dim(onlyArchived ? "No archived interfaces." : "No interfaces. Create one with `brainbase interface create`.")}
 `);
       return;
     }
@@ -84198,7 +84584,7 @@ async function list(ctx) {
       row.audience_mode === "org" ? "everyone" : "chosen",
       ago(row.last_edited_at ?? row.created_at, now2)
     ]);
-    console.log(["", ...table(cells, [null, import_picocolors63.default.bold, null, null, null, import_picocolors63.default.dim]), ""].join(`
+    console.log(["", ...table(cells, [null, import_picocolors64.default.bold, null, null, null, import_picocolors64.default.dim]), ""].join(`
 `));
   });
 }
@@ -84219,13 +84605,13 @@ async function get2(ctx) {
     out.push(field("id", safe(row.id)));
     out.push(field("agent", safe(row.agent_id)));
     out.push(field("state", stateTint(state)(state)));
-    out.push(field("address", row.live_release ? safe(row.live_release.url) : `${safe(row.slug)} ${import_picocolors63.default.dim("(nothing live yet)")}`));
+    out.push(field("address", row.live_release ? safe(row.live_release.url) : `${safe(row.slug)} ${import_picocolors64.default.dim("(nothing live yet)")}`));
     out.push(field("audience", audienceLabel(row)));
     out.push(field("threads", threadsLabel(row.share_agent_threads)));
-    out.push(field("live", row.live_release ? `${safe(row.live_release.id)} ${import_picocolors63.default.dim(`published ${ago(row.live_release.published_at)}`)}` : import_picocolors63.default.dim("none")));
-    out.push(field("draft", row.draft_version_id ? safe(row.draft_version_id) : import_picocolors63.default.dim("none yet")));
+    out.push(field("live", row.live_release ? `${safe(row.live_release.id)} ${import_picocolors64.default.dim(`published ${ago(row.live_release.published_at)}`)}` : import_picocolors64.default.dim("none")));
+    out.push(field("draft", row.draft_version_id ? safe(row.draft_version_id) : import_picocolors64.default.dim("none yet")));
     if (row.running_generation) {
-      out.push(field("building", `conversation ${safe(row.running_generation.thread_id ?? "")} ${import_picocolors63.default.dim(`(follow it with \`brainbase task logs ${safe(row.running_generation.thread_id ?? "")} --follow\`)`)}`));
+      out.push(field("building", `conversation ${safe(row.running_generation.thread_id ?? "")} ${import_picocolors64.default.dim(`(follow it with \`brainbase task logs ${safe(row.running_generation.thread_id ?? "")} --follow\`)`)}`));
     }
     if (row.archived_at)
       out.push(field("archived", ago(row.archived_at)));
@@ -84254,7 +84640,7 @@ async function open(ctx) {
     }
     console.log(safe(url2));
     if (new URL(url2).hostname.endsWith("vercel.app")) {
-      console.error(import_picocolors63.default.yellow("This is the raw Vercel deployment address, which sits behind Vercel protection and will not open for viewers. The control plane has no public interfaces domain configured."));
+      console.error(import_picocolors64.default.yellow("This is the raw Vercel deployment address, which sits behind Vercel protection and will not open for viewers. The control plane has no public interfaces domain configured."));
     }
   });
 }
@@ -84292,7 +84678,7 @@ async function history(ctx, name) {
     banner(`interface ${name} — ${safe(id)}`);
     if (rows.length === 0) {
       console.log(`
-  ${import_picocolors63.default.dim(`No ${name} yet.`)}
+  ${import_picocolors64.default.dim(`No ${name} yet.`)}
 `);
       return;
     }
@@ -84318,7 +84704,7 @@ function sessionUserId() {
 function parseIds(raw, flag) {
   const ids = [...new Set(raw.split(",").map((id) => id.trim()).filter(Boolean))];
   if (ids.length === 0)
-    throw new Error(`${flag} takes user ids separated by commas, or \`me\`.`);
+    throw new Error(`${flag} takes emails or user ids separated by commas, or \`me\`.`);
   return ids;
 }
 function withMe(ids, self) {
@@ -84336,6 +84722,30 @@ function resolveMeForAccess(ids, flag) {
 function grantIds(access) {
   return access.grants.map((grant) => grant.subject_id);
 }
+async function resolvePeople(entries, orgId, flag) {
+  if (!entries.some(isEmail))
+    return { ids: entries, members: null };
+  const members = await listAllOrgMembers(await orgId());
+  return { ids: resolveEmails(entries, members, flag), members: membersById(members) };
+}
+async function membersForDisplay(orgId, known) {
+  if (known)
+    return known;
+  try {
+    return membersById(await listAllOrgMembers(orgId));
+  } catch {
+    return null;
+  }
+}
+function peopleJson(access, members) {
+  return grantIds(access).map((id) => {
+    const member = members?.get(id);
+    return { id, email: member?.email ?? null, name: member?.name ?? null };
+  });
+}
+function namesOf(ids, members) {
+  return ids.map((id) => safe(personLabel(id, members))).join(", ");
+}
 function exactlyOne(parsed, flags) {
   const given = flags.filter(([key2]) => parsed.options[key2] !== undefined && parsed.options[key2] !== false);
   if (given.length > 1) {
@@ -84343,15 +84753,15 @@ function exactlyOne(parsed, flags) {
   }
   return given[0]?.[0] ?? null;
 }
-function peopleLine(access) {
+function peopleLine(access, members) {
   const ids = grantIds(access);
-  return ids.length ? ids.map(safe).join(", ") : import_picocolors64.default.dim("nobody named");
+  return ids.length ? namesOf(ids, members) : import_picocolors65.default.dim("nobody named");
 }
-function printAccess(row, access) {
+function printAccess(row, access, members) {
   console.log([
     "",
     field("audience", audienceLabel(access)),
-    field("people", peopleLine(access)),
+    field("people", peopleLine(access, members)),
     field("threads", threadsLabel(row.share_agent_threads)),
     ""
   ].join(`
@@ -84385,6 +84795,12 @@ async function create3(ctx) {
     const self = sessionUserId();
     if (audience && self)
       audience.ids = withMe(audience.ids, self);
+    let members = null;
+    if (audience) {
+      const resolved = await resolvePeople(audience.ids, async () => (await api.getAgent(agentId)).org_id, "--people");
+      audience.ids = resolved.ids;
+      members = resolved.members;
+    }
     const replayKey = stringOption(parsed, "idempotencyKey")?.trim();
     const created = await interfacesApi.create({ agentId, name, slug: stringOption(parsed, "address")?.trim() || undefined }, { idempotencyKey: replayKey || newIdempotencyKey() });
     let access = null;
@@ -84418,10 +84834,13 @@ async function create3(ctx) {
         accessError = error2;
       }
     }
+    if (access?.audience_mode === "users")
+      members = await membersForDisplay(created.team_id, members);
     if (json) {
       printJson({
         interface: created,
         access,
+        ...access ? { people: peopleJson(access, members) } : {},
         ...note ? { note } : {},
         ...accessError ? { error: errorShape(accessError) } : {}
       });
@@ -84432,27 +84851,27 @@ async function create3(ctx) {
     const id = safe(created.id);
     const out = [
       "",
-      `  ${import_picocolors64.default.green("Created")} ${import_picocolors64.default.bold(safe(created.name))}`,
+      `  ${import_picocolors65.default.green("Created")} ${import_picocolors65.default.bold(safe(created.name))}`,
       "",
       field("id", id),
       field("agent", safe(created.agent_id)),
-      field("address", `${safe(created.slug)} ${import_picocolors64.default.dim("(nothing live yet)")}`),
+      field("address", `${safe(created.slug)} ${import_picocolors65.default.dim("(nothing live yet)")}`),
       field("threads", threadsLabel(created.share_agent_threads))
     ];
     if (access) {
       out.push(field("audience", audienceLabel(access)));
       if (access.audience_mode === "users")
-        out.push(field("people", peopleLine(access)));
+        out.push(field("people", peopleLine(access, members)));
     }
     if (!audience) {
-      out.push("", `  Nobody can open it until you choose who can: \`brainbase interface access ${id} --everyone\` or \`--people <ids>\`.`);
+      out.push("", `  Nobody can open it until you choose who can: \`brainbase interface access ${id} --everyone\` or \`--people <emails>\`.`);
     }
     if (created.share_agent_threads) {
-      out.push(`  ${import_picocolors64.default.dim(`To show viewers only their own conversations: \`brainbase interface threads ${id} --private\`.`)}`);
+      out.push(`  ${import_picocolors65.default.dim(`To show viewers only their own conversations: \`brainbase interface threads ${id} --private\`.`)}`);
     }
     if (note)
       out.push("", `  ${safe(note)}`);
-    out.push("", `  ${import_picocolors64.default.dim(`Next: \`brainbase interface build ${id} "<what to build>"\``)}`, "");
+    out.push("", `  ${import_picocolors65.default.dim(`Next: \`brainbase interface build ${id} "<what to build>"\``)}`, "");
     console.log(out.join(`
 `));
     if (readFailed) {
@@ -84460,7 +84879,7 @@ async function create3(ctx) {
     } else if (accessError && isUnanswered(accessError)) {
       fail(`Created ${id}, but the answer to setting who can open it was lost, so whether it was saved could not be confirmed. ` + `Check with \`brainbase interface access ${id}\`.`);
     } else if (accessError) {
-      fail(`Created ${id}, but setting who can open it failed, so nobody can open it yet: ${safe(errorShape(accessError).message)} ` + `Set it with \`brainbase interface access ${id} --everyone\` or \`--people <ids>\`.`);
+      fail(`Created ${id}, but setting who can open it failed, so nobody can open it yet: ${safe(errorShape(accessError).message)} ` + `Set it with \`brainbase interface access ${id} --everyone\` or \`--people <emails>\`.`);
     }
   });
 }
@@ -84479,27 +84898,36 @@ async function access(ctx) {
       { key: "remove", names: ["--remove"], kind: "value" }
     ]);
     json = booleanOption(parsed, "json");
-    const [id] = expectPositionals(parsed, ["id"], "brainbase interface access <id> [--everyone | --people <ids> | --add <ids> | --remove <ids>]");
+    const [id] = expectPositionals(parsed, ["id"], "brainbase interface access <id> [--everyone | --people <emails> | --add <emails> | --remove <emails>]");
     const change = exactlyOne(parsed, [
       ["everyone", "--everyone"],
       ["people", "--people"],
       ["add", "--add"],
       ["remove", "--remove"]
     ]);
-    const ids = change && change !== "everyone" ? resolveMeForAccess(parseIds(stringOption(parsed, change) ?? "", `--${change}`), `--${change}`) : [];
+    const entries = change && change !== "everyone" ? resolveMeForAccess(parseIds(stringOption(parsed, change) ?? "", `--${change}`), `--${change}`) : [];
     if (!change) {
       const [row2, current2] = await Promise.all([interfacesApi.get(id), interfacesApi.getAccess(id)]);
+      const members2 = current2.grants.length ? await membersForDisplay(row2.team_id, null) : null;
       if (json) {
-        printJson({ id: row2.id, ...current2, share_agent_threads: row2.share_agent_threads });
+        printJson({
+          id: row2.id,
+          ...current2,
+          people: peopleJson(current2, members2),
+          share_agent_threads: row2.share_agent_threads
+        });
         return;
       }
-      printAccess(row2, current2);
+      printAccess(row2, current2, members2);
       return;
     }
     const [row, current] = await Promise.all([
       interfacesApi.get(id),
       change === "add" || change === "remove" ? interfacesApi.getAccess(id) : null
     ]);
+    const resolved = await resolvePeople(entries, async () => row.team_id, `--${change}`);
+    const ids = resolved.ids;
+    let members = resolved.members;
     const label = safe(row.name);
     let summary;
     switch (change) {
@@ -84507,13 +84935,13 @@ async function access(ctx) {
         summary = `Everyone in the organisation will be able to open ${label}.`;
         break;
       case "people":
-        summary = `Only these people will be able to open ${label}: ${ids.map(safe).join(", ")}.`;
+        summary = `Only these people will be able to open ${label}: ${namesOf(ids, members)}.`;
         break;
       case "add":
-        summary = `${ids.map(safe).join(", ")} will be able to open ${label}.`;
+        summary = `${namesOf(ids, members)} will be able to open ${label}.`;
         break;
       case "remove":
-        summary = `${ids.map(safe).join(", ")} will no longer be able to open ${label}.`;
+        summary = `${namesOf(ids, members)} will no longer be able to open ${label}.`;
         break;
       default: {
         const unreachable = change;
@@ -84548,11 +84976,13 @@ async function access(ctx) {
         saved = await interfacesApi.setAccess(id, "users", fresh.filter((subject) => !ids.includes(subject)));
       }
     }
+    if (saved.grants.length)
+      members = await membersForDisplay(row.team_id, members);
     if (json) {
-      printJson(saved);
+      printJson({ ...saved, people: peopleJson(saved, members) });
       return;
     }
-    printAccess(row, saved);
+    printAccess(row, saved, members);
   });
 }
 async function threads(ctx) {
@@ -84577,7 +85007,7 @@ async function threads(ctx) {
         printJson({ id: row.id, share_agent_threads: row.share_agent_threads });
         return;
       }
-      const already = wanted === null ? "" : ` ${import_picocolors64.default.dim("(already set; nothing changed)")}`;
+      const already = wanted === null ? "" : ` ${import_picocolors65.default.dim("(already set; nothing changed)")}`;
       console.log(`
 ${field("threads", `${threadsLabel(row.share_agent_threads)}${already}`)}
 `);
@@ -84616,7 +85046,7 @@ async function rename(ctx) {
       return;
     }
     console.log(`
-  Renamed ${safe(updated.id)} to ${import_picocolors64.default.bold(safe(updated.name))}.
+  Renamed ${safe(updated.id)} to ${import_picocolors65.default.bold(safe(updated.name))}.
 `);
   });
 }
@@ -84652,7 +85082,7 @@ async function address(ctx) {
     }
     const where = updated.live_release ? safe(updated.live_release.url) : safe(updated.slug);
     console.log(`
-  ${safe(updated.name)} is now at ${import_picocolors64.default.bold(where)}.
+  ${safe(updated.name)} is now at ${import_picocolors65.default.bold(where)}.
 `);
   });
 }
@@ -84743,14 +85173,145 @@ var lifecycleCommands = {
   unarchive
 };
 
+// src/cli/interface-preview.ts
+var import_picocolors66 = __toESM(require_picocolors(), 1);
+function warn(line) {
+  console.error(import_picocolors66.default.yellow(line));
+}
+var PREVIEW_TIMEOUT_SECONDS = 300;
+var PROBE_INTERVAL_MS = 2000;
+async function pickConversation(row, named) {
+  if (named)
+    return { taskId: named, why: "the conversation you named" };
+  const running = row.running_generation?.thread_id;
+  if (running)
+    return { taskId: running, why: "the build conversation running now" };
+  const tasks = await masApi.listTasks({ metadata: { [INTERFACE_THREAD_METADATA_KEY]: row.id }, limit: 200 });
+  const newest = [...tasks].sort((a3, b4) => Date.parse(b4.created_at) - Date.parse(a3.created_at))[0];
+  if (!newest) {
+    throw new Error(`No build conversation has been opened for ${safe(row.name)} yet, so there is nothing to preview. ` + `Start one with \`brainbase interface build ${safe(row.id)} "<what to build>"\`.`);
+  }
+  return { taskId: newest.id, why: "the most recent build conversation" };
+}
+function previewAddress(started, row) {
+  if (started.preview_url !== undefined)
+    return started.preview_url;
+  const live = row.live_release?.url;
+  if (!live)
+    return null;
+  const host = new URL(live).hostname;
+  const prefix = `${started.slug}.`;
+  return host.startsWith(prefix) ? `https://${started.slug}-preview.${host.slice(prefix.length)}` : null;
+}
+function missingAddress(started) {
+  return started.preview_url === null ? "none: this Brainbase server has no public domain for interfaces" : "unknown: this Brainbase server does not report it, and nothing is live to work it out from";
+}
+async function waitUntilServing(started, options) {
+  const now2 = options.deps.now ?? Date.now;
+  const interval = options.deps.pollIntervalMs ?? PROBE_INTERVAL_MS;
+  const deadline = now2() + options.timeoutMs;
+  const stop = interruption(options.deps);
+  try {
+    for (;; ) {
+      if (stop.signal.aborted)
+        return "interrupted";
+      const left = deadline - now2();
+      if (left <= 0)
+        return "timeout";
+      const probeStop = new AbortController;
+      const onStop = () => probeStop.abort(stop.signal.reason);
+      stop.signal.addEventListener("abort", onStop, { once: true });
+      const timer = setTimeout(() => probeStop.abort(), left);
+      try {
+        const probe = await interfacesApi.probePreview(started.machine_id, started.port, probeStop.signal);
+        if (probe.serving)
+          return "serving";
+      } catch (error2) {
+        if (stop.signal.aborted)
+          return "interrupted";
+        if (probeStop.signal.aborted)
+          return "timeout";
+        if (!isTransientReadError(error2))
+          throw error2;
+      } finally {
+        clearTimeout(timer);
+        stop.signal.removeEventListener("abort", onStop);
+      }
+      const remaining = deadline - now2();
+      if (remaining <= 0)
+        return "timeout";
+      if (await pause(Math.min(interval, remaining), stop.signal))
+        return "interrupted";
+    }
+  } finally {
+    stop.dispose();
+  }
+}
+function showing(started, taskId) {
+  return started.source === "working_copy" ? `the working copy of conversation ${safe(taskId)}, unsaved edits included` : `the last saved version${started.commit ? ` (${safe(started.commit)})` : ""}`;
+}
+async function preview(ctx) {
+  let json = wantsJson(ctx.args);
+  await runReportingErrors(() => json, async () => {
+    const parsed = parseArgv(ctx.args, [
+      JSON_FLAG,
+      TIMEOUT_FLAG,
+      NO_WAIT_FLAG,
+      { key: "task", names: ["--task"], kind: "value" }
+    ]);
+    json = booleanOption(parsed, "json");
+    const [id] = expectPositionals(parsed, ["id"], "brainbase interface preview <id> [--task <task id>]");
+    const waitMs = timeoutMs2(stringOption(parsed, "timeout"), PREVIEW_TIMEOUT_SECONDS);
+    const noWait = booleanOption(parsed, "noWait");
+    const say = progress(json);
+    const row = await interfacesApi.get(id);
+    const { taskId, why } = await pickConversation(row, stringOption(parsed, "task")?.trim() || undefined);
+    say(import_picocolors66.default.dim(`  Previewing ${why}, ${safe(taskId)}.`));
+    const started = await interfacesApi.startPreview(taskId, row.id);
+    const address2 = previewAddress(started, row);
+    let outcome = started.state === "serving" ? "serving" : "not_waited";
+    if (outcome !== "serving" && !noWait) {
+      say(import_picocolors66.default.dim("  Starting the dev server in the sandbox…"));
+      outcome = await waitUntilServing(started, { timeoutMs: waitMs, deps: ctx.deps });
+    }
+    if (json) {
+      printJson({ task_id: taskId, ...started, preview_url: address2, serving: outcome === "serving" });
+    } else {
+      const out = [
+        "",
+        `  ${outcome === "serving" ? import_picocolors66.default.green("Preview ready") : import_picocolors66.default.yellow("Preview starting")} ${import_picocolors66.default.bold(safe(started.name))}`,
+        "",
+        field("address", address2 ? safe(address2) : import_picocolors66.default.dim(missingAddress(started))),
+        field("showing", showing(started, taskId)),
+        "",
+        `  ${import_picocolors66.default.dim("Opens for people who can edit the agent, after signing in. Nothing is published.")}`,
+        ""
+      ];
+      console.log(out.join(`
+`));
+      if (started.restored) {
+        warn("The conversation's working copy was no longer in the sandbox, so its last saved version is shown and edits that were never saved are gone.");
+      }
+    }
+    if (outcome === "timeout") {
+      if (!json)
+        warn(`Still starting after ${Math.round(waitMs / 1000)}s. It may come up shortly: open the address, or run this again.`);
+      process.exitCode = 1;
+    } else if (outcome === "interrupted") {
+      process.exitCode = SIGINT_EXIT_CODE;
+    }
+  });
+}
+var previewCommands = { preview };
+
 // src/cli/interface-release.ts
-var import_picocolors65 = __toESM(require_picocolors(), 1);
+var import_picocolors67 = __toESM(require_picocolors(), 1);
 var PUBLISH_TIMEOUT_SECONDS = 300;
 var REBUILD_USAGE = "brainbase interface rebuild <id> [--version <version id>]";
 var PUBLISH_USAGE = "brainbase interface publish <id> [--build <build id>]";
 var ROLLBACK_USAGE = "brainbase interface rollback <id> --release <release id>";
-function warn(line) {
-  console.error(import_picocolors65.default.yellow(line));
+function warn2(line) {
+  console.error(import_picocolors67.default.yellow(line));
 }
 function text3(value) {
   return typeof value === "string" && value.trim() ? value : null;
@@ -84767,8 +85328,8 @@ async function follow(operationId, what, options) {
       intervalMs: options.deps.pollIntervalMs,
       signal: stop.signal,
       now: options.deps.now,
-      onStatus: (operation) => say(import_picocolors65.default.dim(`  ${what} ${operation.status}`)),
-      onStall: () => warn(`The ${what} looks stalled: its worker stopped checking in. Still waiting, in case another worker picks it up.`)
+      onStatus: (operation) => say(import_picocolors67.default.dim(`  ${what} ${operation.status}`)),
+      onStall: () => warn2(`The ${what} looks stalled: its worker stopped checking in. Still waiting, in case another worker picks it up.`)
     });
     if (outcome.kind === "settled") {
       const operation = outcome.operation;
@@ -84786,12 +85347,12 @@ function reportUnsuccessful(result2, what, options) {
   if (options.json) {
     printJson({ outcome: result2.outcome, operation_id: result2.operationId, operation: result2.operation });
   } else if (result2.outcome === "failed") {
-    console.error(import_picocolors65.default.red(`The ${what} failed (operation ${id}):`));
+    console.error(import_picocolors67.default.red(`The ${what} failed (operation ${id}):`));
     console.error(safeBlock(result2.operation?.error ?? "Brainbase gave no reason."));
   } else if (result2.outcome === "timeout") {
-    warn(`Stopped waiting after ${Math.round(options.timeoutMs / 1000)}s. The ${what} keeps running on the server (operation ${id}).`);
+    warn2(`Stopped waiting after ${Math.round(options.timeoutMs / 1000)}s. The ${what} keeps running on the server (operation ${id}).`);
   } else {
-    warn(`Stopped waiting. The ${what} keeps running on the server (operation ${id}).`);
+    warn2(`Stopped waiting. The ${what} keeps running on the server (operation ${id}).`);
   }
   process.exitCode = result2.outcome === "interrupted" ? SIGINT_EXIT_CODE : 1;
   return true;
@@ -84845,7 +85406,7 @@ async function rebuild(ctx) {
       if (json)
         printJson({ outcome: "started", operation_id: operationId, operation });
       else
-        console.log(import_picocolors65.default.dim(`  Follow it with \`brainbase interface builds ${safe(id)}\`.`));
+        console.log(import_picocolors67.default.dim(`  Follow it with \`brainbase interface builds ${safe(id)}\`.`));
       return;
     }
     const result2 = await follow(operationId, "build", { json, timeoutMs: waitMs, deps: ctx.deps });
@@ -84857,8 +85418,8 @@ async function rebuild(ctx) {
     }
     const buildId = safe(result2.operation?.build_id ?? "");
     const version2 = safe(result2.operation?.source_version_id ?? "");
-    console.log(import_picocolors65.default.green(`✓ Build ${buildId} succeeded${version2 ? ` (version ${version2})` : ""}.`));
-    console.log(import_picocolors65.default.dim(`  Publish it with \`brainbase interface publish ${safe(id)} --build ${buildId}\`.`));
+    console.log(import_picocolors67.default.green(`✓ Build ${buildId} succeeded${version2 ? ` (version ${version2})` : ""}.`));
+    console.log(import_picocolors67.default.dim(`  Publish it with \`brainbase interface publish ${safe(id)} --build ${buildId}\`.`));
   });
 }
 function liveBuildOf(row, releases) {
@@ -84916,7 +85477,7 @@ function describeBuild(buildId, builds) {
   const build2 = builds.find((candidate) => candidate.id === buildId);
   if (!build2)
     return `build ${safe(buildId)}`;
-  return `build ${safe(build2.id)} ${import_picocolors65.default.dim(`(version ${safe(build2.source_version_id)}, built ${ago(build2.created_at)})`)}`;
+  return `build ${safe(build2.id)} ${import_picocolors67.default.dim(`(version ${safe(build2.source_version_id)}, built ${ago(build2.created_at)})`)}`;
 }
 function reportAlreadyLive(json, buildId, releaseId, url2) {
   if (json) {
@@ -84961,7 +85522,7 @@ async function publish(ctx) {
     } else {
       const picked = await pickBuild(id, row, builds, releases, liveBuildId);
       if (picked.warning)
-        warn(picked.warning);
+        warn2(picked.warning);
       buildId = picked.build.id;
     }
     if (buildId === liveBuildId) {
@@ -84970,8 +85531,8 @@ async function publish(ctx) {
     }
     if (!json) {
       console.log("");
-      console.log(`  ${import_picocolors65.default.dim("Live now".padEnd(14))}${liveBuildId ? `${describeBuild(liveBuildId, builds)} at ${safe(row.live_release?.url)}` : row.live_release ? `release ${safe(row.live_release.id)} at ${safe(row.live_release.url)}` : import_picocolors65.default.dim("nothing")}`);
-      console.log(`  ${import_picocolors65.default.dim("Will publish".padEnd(14))}${describeBuild(buildId, builds)}`);
+      console.log(`  ${import_picocolors67.default.dim("Live now".padEnd(14))}${liveBuildId ? `${describeBuild(liveBuildId, builds)} at ${safe(row.live_release?.url)}` : row.live_release ? `release ${safe(row.live_release.id)} at ${safe(row.live_release.url)}` : import_picocolors67.default.dim("nothing")}`);
+      console.log(`  ${import_picocolors67.default.dim("Will publish".padEnd(14))}${describeBuild(buildId, builds)}`);
       console.log("");
     }
     const proceed = await confirmChange({
@@ -85003,7 +85564,7 @@ async function publish(ctx) {
         return;
       }
       if (error2.reason === "audience_empty") {
-        throw reword(error2, `Nobody can open this interface yet, so it was not published. Choose who can with \`brainbase interface access ${safe(id)} --everyone\` or \`--people <user ids>\`, then publish again.`);
+        throw reword(error2, `Nobody can open this interface yet, so it was not published. Choose who can with \`brainbase interface access ${safe(id)} --everyone\` or \`--people <emails>\`, then publish again.`);
       }
       if (error2.reason !== "operation_in_flight")
         throw error2;
@@ -85014,7 +85575,7 @@ async function publish(ctx) {
       if (json)
         printJson({ outcome: "started", operation_id: operationId, operation });
       else
-        console.log(import_picocolors65.default.dim(`  Check it with \`brainbase interface get ${safe(id)}\`.`));
+        console.log(import_picocolors67.default.dim(`  Check it with \`brainbase interface get ${safe(id)}\`.`));
       return;
     }
     const result2 = await follow(operationId, "publish", { json, timeoutMs: waitMs, deps: ctx.deps });
@@ -85031,11 +85592,11 @@ async function publish(ctx) {
       printJson({ outcome: "succeeded", operation_id: operationId, operation: result2.operation, url: url2 });
       return;
     }
-    console.log(import_picocolors65.default.green(`✓ Build ${safe(buildId)} is live.`));
+    console.log(import_picocolors67.default.green(`✓ Build ${safe(buildId)} is live.`));
     if (url2)
       console.log(`  ${safe(url2)}`);
     if (urlUnread) {
-      console.log(import_picocolors65.default.dim(`  Its address could not be read just now; see it with \`brainbase interface open ${safe(id)}\`.`));
+      console.log(import_picocolors67.default.dim(`  Its address could not be read just now; see it with \`brainbase interface open ${safe(id)}\`.`));
     }
   });
 }
@@ -85071,8 +85632,8 @@ async function rollback(ctx) {
     }
     if (!json) {
       console.log("");
-      console.log(`  ${import_picocolors65.default.dim("Live now".padEnd(20))}release ${safe(row.live_release.id)} at ${safe(row.live_release.url)}`);
-      console.log(`  ${import_picocolors65.default.dim("Will be live again".padEnd(20))}release ${safe(releaseId)}`);
+      console.log(`  ${import_picocolors67.default.dim("Live now".padEnd(20))}release ${safe(row.live_release.id)} at ${safe(row.live_release.url)}`);
+      console.log(`  ${import_picocolors67.default.dim("Will be live again".padEnd(20))}release ${safe(releaseId)}`);
       console.log("");
     }
     const proceed = await confirmChange({
@@ -85105,7 +85666,7 @@ async function rollback(ctx) {
       printJson(release);
       return;
     }
-    console.log(import_picocolors65.default.green(`✓ Release ${safe(release.id)} is live again (build ${safe(release.build_id)}).`));
+    console.log(import_picocolors67.default.green(`✓ Release ${safe(release.id)} is live again (build ${safe(release.build_id)}).`));
     console.log(`  ${safe(release.url)}`);
   });
 }
@@ -85116,7 +85677,8 @@ var COMMANDS = {
   ...readCommands,
   ...lifecycleCommands,
   ...releaseCommands,
-  ...buildCommands
+  ...buildCommands,
+  ...previewCommands
 };
 var ALIASES = { list: "ls", show: "get" };
 async function runInterface(cwd2, sub, args, deps = {}) {
@@ -85139,22 +85701,22 @@ async function runInterface(cwd2, sub, args, deps = {}) {
   await command({ cwd: cwd2, args, deps });
 }
 function line(command, args, description) {
-  return `  ${import_picocolors66.default.cyan(command)}${args ? ` ${import_picocolors66.default.dim(args)}` : ""}
-      ${import_picocolors66.default.dim(description)}`;
+  return `  ${import_picocolors68.default.cyan(command)}${args ? ` ${import_picocolors68.default.dim(args)}` : ""}
+      ${import_picocolors68.default.dim(description)}`;
 }
 function printHelp6() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors66.default.bold("brainbase interface")} ${import_picocolors66.default.dim("<sub> [options]")}`);
-  out.push(`  ${import_picocolors66.default.dim("Dashboards for an agent: build them in a conversation, publish them, choose who can open them.")}`);
+  out.push(`  ${import_picocolors68.default.bold("brainbase interface")} ${import_picocolors68.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors68.default.dim("Dashboards for an agent: build them in a conversation, publish them, choose who can open them.")}`);
   out.push("");
   out.push(line("ls", "[--agent <id>] [--archived | --only-archived]", "list interfaces you can see"));
   out.push(line("get", "<id>", "one interface: address, audience, live release, draft, running build conversation"));
   out.push(line("open", "<id>", "print the live address"));
   out.push(line("versions | builds | releases", "<id>", "history, newest first"));
   out.push("");
-  out.push(line("create", "[--agent <id>] --name <name> [--address <slug>] [--everyone | --people <ids>]", "create an interface on an agent"));
-  out.push(line("access", "<id> [--everyone | --people <ids> | --add <ids> | --remove <ids>]", "show or set who can open it"));
+  out.push(line("create", "[--agent <id>] --name <name> [--address <slug>] [--everyone | --people <emails>]", "create an interface on an agent"));
+  out.push(line("access", "<id> [--everyone | --people <emails> | --add <emails> | --remove <emails>]", "show or set who can open it"));
   out.push(line("threads", "<id> [--shared | --private]", "show or set whether viewers see every conversation on the agent"));
   out.push(line("rename", "<id> <name>", "change the name"));
   out.push(line("address", "<id> <slug>", "change the address (viewers sign in again)"));
@@ -85164,15 +85726,97 @@ function printHelp6() {
   out.push(line("rebuild", "<id> [--version <id>]", "build the draft version again, or a named one"));
   out.push(line("publish", "<id> [--build <id>]", "make a build live (default: the newest succeeded build)"));
   out.push(line("rollback", "<id> --release <id>", "make an earlier release live again"));
+  out.push(line("preview", "<id> [--task <id>] [--no-wait]", "serve the unpublished draft from its build conversation and print the preview address"));
   out.push("");
-  out.push(`  ${import_picocolors66.default.dim("--json")}                   machine-readable output; never prompts`);
-  out.push(`  ${import_picocolors66.default.dim("--yes, -y")}                skip confirmation (required without a terminal)`);
-  out.push(`  ${import_picocolors66.default.dim("--no-wait")}                for rebuild and publish: return the operation at once`);
-  out.push(`  ${import_picocolors66.default.dim("--timeout <seconds>")}      for build, rebuild and publish: how long to wait (builds 900, publish 300)`);
-  out.push(`  ${import_picocolors66.default.dim("--idempotency-key <key>")}  replay a create, build, rebuild, publish or rollback whose answer was lost`);
+  out.push(`  ${import_picocolors68.default.dim("--json")}                   machine-readable output; never prompts`);
+  out.push(`  ${import_picocolors68.default.dim("--yes, -y")}                skip confirmation (required without a terminal)`);
+  out.push(`  ${import_picocolors68.default.dim("--no-wait")}                for rebuild and publish: return the operation at once; for preview: do not wait for the dev server`);
+  out.push(`  ${import_picocolors68.default.dim("--timeout <seconds>")}      for build, rebuild, publish and preview: how long to wait (builds 900, publish and preview 300)`);
+  out.push(`  ${import_picocolors68.default.dim("--idempotency-key <key>")}  replay a create, build, rebuild, publish or rollback whose answer was lost`);
   out.push("");
-  out.push(`  ${import_picocolors66.default.dim("People are user ids, or `me`. Audience members also need access to the agent.")}`);
-  out.push(`  ${import_picocolors66.default.dim("Exit codes: 0 done, 1 refused or failed, 130 interrupted (the server keeps working).")}`);
+  out.push(`  ${import_picocolors68.default.dim("People are emails (see `brainbase member ls`), user ids, or `me`. Audience members also need access to the agent.")}`);
+  out.push(`  ${import_picocolors68.default.dim("Exit codes: 0 done, 1 refused or failed, 130 interrupted (the server keeps working).")}`);
+  out.push("");
+  console.log(out.join(`
+`));
+}
+
+// src/cli/member.ts
+var import_picocolors69 = __toESM(require_picocolors(), 1);
+async function runMember(sub, args, opts) {
+  if (args.some((arg) => arg === "--help" || arg === "-h")) {
+    printHelp7();
+    return;
+  }
+  switch (sub) {
+    case "ls":
+    case "list":
+      if (args.length > 0) {
+        console.error(`Unexpected argument: ${args[0]}
+`);
+        printHelp7();
+        process.exit(1);
+      }
+      await runMemberList(opts);
+      return;
+    case undefined:
+    case "help":
+    case "-h":
+    case "--help":
+      printHelp7();
+      return;
+    default:
+      console.error(`Unknown member subcommand: ${sub}
+`);
+      printHelp7();
+      process.exit(1);
+  }
+}
+async function runMemberList(opts) {
+  const org = await resolveOrg(opts.orgId, { allowPrompt: !opts.json, announce: !opts.json });
+  const members = await listAllOrgMembers(org.id);
+  if (opts.json) {
+    console.log(JSON.stringify({ org, members }, null, 2));
+    return;
+  }
+  banner(`member ls — ${sanitizeLabel(org.name)}`);
+  console.log(formatMemberList(members));
+}
+function formatMemberList(members) {
+  if (members.length === 0)
+    return `
+  ${import_picocolors69.default.dim("Nobody here you can see.")}
+`;
+  const sorted = [...members].sort((a3, b4) => (a3.email ?? a3.id).localeCompare(b4.email ?? b4.id));
+  const rows = sorted.map((member) => ({
+    email: sanitizeLabel(member.email ?? "(no sign-in account)"),
+    name: sanitizeLabel(member.name ?? ""),
+    role: sanitizeLabel(member.role),
+    teams: member.teams.map((team) => sanitizeLabel(team.name)).join(", ")
+  }));
+  const emailWidth = Math.max(...rows.map((row) => row.email.length));
+  const nameWidth = Math.max(...rows.map((row) => row.name.length));
+  const roleWidth = Math.max(...rows.map((row) => row.role.length));
+  const lines = [""];
+  for (const row of rows) {
+    lines.push(`  ${row.email.padEnd(emailWidth)}  ${row.name.padEnd(nameWidth)}  ${import_picocolors69.default.dim(row.role.padEnd(roleWidth))}  ${import_picocolors69.default.dim(row.teams)}`.trimEnd());
+  }
+  lines.push("", `  ${import_picocolors69.default.dim("share a dashboard with one of them:")} ${import_picocolors69.default.cyan("brainbase interface access <id> --add <email>")}`, "");
+  return lines.join(`
+`);
+}
+function printHelp7() {
+  const out = [];
+  out.push("");
+  out.push(`  ${import_picocolors69.default.bold("brainbase member")} ${import_picocolors69.default.dim("<sub> [options]")}`);
+  out.push("");
+  out.push(`  ${import_picocolors69.default.cyan("ls")}   ${import_picocolors69.default.dim("the people in an organization you can see, with their emails, roles and teams")}`);
+  out.push("");
+  out.push(`  ${import_picocolors69.default.dim("--org <id-or-slug>")}  ${import_picocolors69.default.dim("which organization (picked automatically when you are in one)")}`);
+  out.push(`  ${import_picocolors69.default.dim("--json")}              ${import_picocolors69.default.dim("machine-readable output")}`);
+  out.push("");
+  out.push(`  ${import_picocolors69.default.dim("Owners and admins see everyone. Anyone else sees the owners, the admins, themselves")}`);
+  out.push(`  ${import_picocolors69.default.dim("and the people who share a team with them, as in the web app.")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -88265,7 +88909,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
 }
 
 // src/cli/benchmark-control.ts
-var import_picocolors67 = __toESM(require_picocolors(), 1);
+var import_picocolors70 = __toESM(require_picocolors(), 1);
 import fs89 from "node:fs";
 import path101 from "node:path";
 
@@ -91279,20 +91923,20 @@ async function emitCursorPages(output, fetchPage, options) {
 function commandHelp() {
   return [
     "",
-    `  ${import_picocolors67.default.bold("brainbase benchmark")} ${import_picocolors67.default.dim("<command> [options]")}`,
+    `  ${import_picocolors70.default.bold("brainbase benchmark")} ${import_picocolors70.default.dim("<command> [options]")}`,
     "",
-    `  ${import_picocolors67.default.cyan("init | list | show | create | validate | pull | push")}`,
-    `  ${import_picocolors67.default.cyan("publish | revisions | import | export | archive | restore")}`,
-    `  ${import_picocolors67.default.cyan("run plan|start|watch|list|show|cancel|resume")}`,
-    `  ${import_picocolors67.default.cyan("results | diagnoses | attempt | artifacts | export-results")}`,
-    `  ${import_picocolors67.default.cyan("history | baseline show|set|clear")}`,
+    `  ${import_picocolors70.default.cyan("init | list | show | create | validate | pull | push")}`,
+    `  ${import_picocolors70.default.cyan("publish | revisions | import | export | archive | restore")}`,
+    `  ${import_picocolors70.default.cyan("run plan|start|watch|list|show|cancel|resume")}`,
+    `  ${import_picocolors70.default.cyan("results | diagnoses | attempt | artifacts | export-results")}`,
+    `  ${import_picocolors70.default.cyan("history | baseline show|set|clear")}`,
     "",
-    `  ${import_picocolors67.default.dim("Use --agent to override brainbase.agent.yaml, and --json or --jsonl for automation.")}`,
+    `  ${import_picocolors70.default.dim("Use --agent to override brainbase.agent.yaml, and --json or --jsonl for automation.")}`,
     "",
-    `  ${import_picocolors67.default.bold("benchmark runtime (machine-only)")}`,
-    `  ${import_picocolors67.default.cyan("hydrate")} ${import_picocolors67.default.dim("--spec <path> --result <path> --json")}`,
-    `  ${import_picocolors67.default.cyan("evaluate")} ${import_picocolors67.default.dim("--spec <path> --result <path> --json")}`,
-    `  ${import_picocolors67.default.cyan("capabilities")} ${import_picocolors67.default.dim("--json")}`,
+    `  ${import_picocolors70.default.bold("benchmark runtime (machine-only)")}`,
+    `  ${import_picocolors70.default.cyan("hydrate")} ${import_picocolors70.default.dim("--spec <path> --result <path> --json")}`,
+    `  ${import_picocolors70.default.cyan("evaluate")} ${import_picocolors70.default.dim("--spec <path> --result <path> --json")}`,
+    `  ${import_picocolors70.default.cyan("capabilities")} ${import_picocolors70.default.dim("--json")}`,
     ""
   ].join(`
 `);
@@ -91539,17 +92183,17 @@ async function runImport(cwd2, argv, deps) {
     const primary = optionalNonblank(options.parsed, "primaryEvaluator");
     if (primary)
       request2.primary_evaluator_key = primary;
-    const preview = await client.previewHuggingFaceImport(request2);
+    const preview2 = await client.previewHuggingFaceImport(request2);
     if (bool(options.parsed, "preview")) {
-      output.result(preview);
+      output.result(preview2);
       return;
     }
-    const provenance = requireObject(preview.provenance ?? {}, "preview provenance");
+    const provenance = requireObject(preview2.provenance ?? {}, "preview provenance");
     const materialize = {
       ...request2,
       expected_commit: stringField(provenance, "commit"),
-      expected_materialization_digest: stringField(preview, "materialization_digest"),
-      expected_content_digest: stringField(preview, "content_digest")
+      expected_materialization_digest: stringField(preview2, "materialization_digest"),
+      expected_content_digest: stringField(preview2, "content_digest")
     };
     output.result(json(await client.materializeHuggingFaceImport(materialize, {
       idempotencyKey: idempotencyKey(options)
@@ -92711,178 +93355,182 @@ var SUBCOMMAND_OWNED_FLAGS = {
 function help() {
   const out = [];
   out.push("");
-  out.push(`  ${brandTint("◆")}  ${import_picocolors68.default.bold("brainbase")}  ${import_picocolors68.default.dim(`v${VERSION}`)}`);
-  out.push(`     ${import_picocolors68.default.dim("connect your local agent to the brainbase platform")}`);
+  out.push(`  ${brandTint("◆")}  ${import_picocolors71.default.bold("brainbase")}  ${import_picocolors71.default.dim(`v${VERSION}`)}`);
+  out.push(`     ${import_picocolors71.default.dim("connect your local agent to the brainbase platform")}`);
   out.push("");
   out.push(divider("USAGE"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.bold("brainbase")} ${import_picocolors68.default.dim("<command> [options]")}`);
+  out.push(`  ${import_picocolors71.default.bold("brainbase")} ${import_picocolors71.default.dim("<command> [options]")}`);
   out.push("");
   out.push(divider("AUTH"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("login")}     ${import_picocolors68.default.dim("  open the web app and connect this device")}`);
-  out.push(`  ${import_picocolors68.default.cyan("logout")}    ${import_picocolors68.default.dim("  clear the local session")}`);
-  out.push(`  ${import_picocolors68.default.cyan("whoami")} ${import_picocolors68.default.dim("[--json]")} ${import_picocolors68.default.dim(" show which credential is in use and what it covers")}`);
+  out.push(`  ${import_picocolors71.default.cyan("login")}     ${import_picocolors71.default.dim("  open the web app and connect this device")}`);
+  out.push(`  ${import_picocolors71.default.cyan("logout")}    ${import_picocolors71.default.dim("  clear the local session")}`);
+  out.push(`  ${import_picocolors71.default.cyan("whoami")} ${import_picocolors71.default.dim("[--json]")} ${import_picocolors71.default.dim(" show which credential is in use and what it covers")}`);
   out.push("");
   out.push(divider("DISCOVERY"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("team list")}                  ${import_picocolors68.default.dim("show the teams you can create agents in")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent list")}                 ${import_picocolors68.default.dim("show a team's agents and their ids")}`);
+  out.push(`  ${import_picocolors71.default.cyan("team list")}                  ${import_picocolors71.default.dim("show the teams you can create agents in")}`);
+  out.push(`  ${import_picocolors71.default.cyan("member ls")}                  ${import_picocolors71.default.dim("show the people in an organization, with the emails interface access takes")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent list")}                 ${import_picocolors71.default.dim("show a team's agents and their ids")}`);
   out.push("");
   out.push(divider("LINKED AGENT"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("agent init")}                 ${import_picocolors68.default.dim("write a starter brainbase.agent.yaml here — offline, no login needed")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent create")}               ${import_picocolors68.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent pull")} ${import_picocolors68.default.dim("[<id>]")}          ${import_picocolors68.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint; --link to link first)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent push")}                 ${import_picocolors68.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent delete")} ${import_picocolors68.default.dim("<id>")}          ${import_picocolors68.default.dim("permanently delete a cloud agent and every task it has run")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent unpack")}               ${import_picocolors68.default.dim("install the claimed agent into a harness layout")}`);
-  out.push(`  ${import_picocolors68.default.cyan("link")}                       ${import_picocolors68.default.dim("attach this folder to an existing agent")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent status")}               ${import_picocolors68.default.dim("show what would pull and what would push")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent connections")}          ${import_picocolors68.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent connect")} ${import_picocolors68.default.dim("<name>")}       ${import_picocolors68.default.dim("connect slack or meeting from the terminal")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent disconnect")} ${import_picocolors68.default.dim("<name>")}    ${import_picocolors68.default.dim("revoke a slack or meeting install")}`);
-  out.push(`  ${import_picocolors68.default.cyan("agent env")}                  ${import_picocolors68.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
-  out.push(`  ${import_picocolors68.default.cyan("run")} ${import_picocolors68.default.dim("<cmd> [args...]")}         ${import_picocolors68.default.dim("run <cmd> with secrets.env loaded into env")}`);
-  out.push(`  ${import_picocolors68.default.cyan("status")}                     ${import_picocolors68.default.dim("show what this folder is linked to")}`);
-  out.push(`  ${import_picocolors68.default.cyan("unlink")}                     ${import_picocolors68.default.dim("disconnect this folder")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent init")}                 ${import_picocolors71.default.dim("write a starter brainbase.agent.yaml here — offline, no login needed")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent create")}               ${import_picocolors71.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent pull")} ${import_picocolors71.default.dim("[<id>]")}          ${import_picocolors71.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint; --link to link first)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent push")}                 ${import_picocolors71.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent delete")} ${import_picocolors71.default.dim("<id>")}          ${import_picocolors71.default.dim("permanently delete a cloud agent and every task it has run")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent unpack")}               ${import_picocolors71.default.dim("install the claimed agent into a harness layout")}`);
+  out.push(`  ${import_picocolors71.default.cyan("link")}                       ${import_picocolors71.default.dim("attach this folder to an existing agent")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent status")}               ${import_picocolors71.default.dim("show what would pull and what would push")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent connections")}          ${import_picocolors71.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent connect")} ${import_picocolors71.default.dim("<name>")}       ${import_picocolors71.default.dim("connect slack or meeting from the terminal")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent disconnect")} ${import_picocolors71.default.dim("<name>")}    ${import_picocolors71.default.dim("revoke a slack or meeting install")}`);
+  out.push(`  ${import_picocolors71.default.cyan("agent env")}                  ${import_picocolors71.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
+  out.push(`  ${import_picocolors71.default.cyan("run")} ${import_picocolors71.default.dim("<cmd> [args...]")}         ${import_picocolors71.default.dim("run <cmd> with secrets.env loaded into env")}`);
+  out.push(`  ${import_picocolors71.default.cyan("status")}                     ${import_picocolors71.default.dim("show what this folder is linked to")}`);
+  out.push(`  ${import_picocolors71.default.cyan("unlink")}                     ${import_picocolors71.default.dim("disconnect this folder")}`);
   out.push("");
   out.push(divider("TASKS"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("task create")} ${import_picocolors68.default.dim("--message <text>")}   ${import_picocolors68.default.dim("create a managed task and start its first run (--wait to block on it; --interface <id> for a build conversation)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("task list")}                       ${import_picocolors68.default.dim("recent tasks you can reach (--interface <id> for its build conversations)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("task get")} ${import_picocolors68.default.dim("<task-id>")}              ${import_picocolors68.default.dim("one task: status, agent, machine, eval verdicts")}`);
-  out.push(`  ${import_picocolors68.default.cyan("task logs")} ${import_picocolors68.default.dim("<task-id> [--follow]")}  ${import_picocolors68.default.dim("one line per event in the task's transcript, or tail it live")}`);
-  out.push(`  ${import_picocolors68.default.cyan("task send")} ${import_picocolors68.default.dim("<task-id> <message>")}  ${import_picocolors68.default.dim("send a follow-up during execution, or queue it for the next turn")}`);
-  out.push(`  ${import_picocolors68.default.cyan("task stop")} ${import_picocolors68.default.dim("<task-id>")}             ${import_picocolors68.default.dim("stop execution and cancel pending follow-ups, retaining their text")}`);
-  out.push(`  ${import_picocolors68.default.cyan("task delete")} ${import_picocolors68.default.dim("<task-id>")}           ${import_picocolors68.default.dim("permanently delete a stopped task and tear down its sandbox")}`);
+  out.push(`  ${import_picocolors71.default.cyan("task create")} ${import_picocolors71.default.dim("--message <text>")}   ${import_picocolors71.default.dim("create a managed task and start its first run (--wait to block on it; --interface <id> for a build conversation)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("task list")}                       ${import_picocolors71.default.dim("recent tasks you can reach (--interface <id> for its build conversations)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("task get")} ${import_picocolors71.default.dim("<task-id>")}              ${import_picocolors71.default.dim("one task: status, agent, machine, eval verdicts")}`);
+  out.push(`  ${import_picocolors71.default.cyan("task logs")} ${import_picocolors71.default.dim("<task-id> [--follow]")}  ${import_picocolors71.default.dim("one line per event in the task's transcript, or tail it live")}`);
+  out.push(`  ${import_picocolors71.default.cyan("task send")} ${import_picocolors71.default.dim("<task-id> <message>")}  ${import_picocolors71.default.dim("send a follow-up during execution, or queue it for the next turn")}`);
+  out.push(`  ${import_picocolors71.default.cyan("task stop")} ${import_picocolors71.default.dim("<task-id>")}             ${import_picocolors71.default.dim("stop execution and cancel pending follow-ups, retaining their text")}`);
+  out.push(`  ${import_picocolors71.default.cyan("task delete")} ${import_picocolors71.default.dim("<task-id>")}           ${import_picocolors71.default.dim("permanently delete a stopped task and tear down its sandbox")}`);
   out.push("");
   out.push(divider("INTERFACES"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("interface ls")}                    ${import_picocolors68.default.dim("dashboards you can see (--agent to narrow)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("interface create")} ${import_picocolors68.default.dim("--name <n>")}     ${import_picocolors68.default.dim("create one on an agent, with who can open it")}`);
-  out.push(`  ${import_picocolors68.default.cyan("interface build")} ${import_picocolors68.default.dim('<id> "<ask>"')}    ${import_picocolors68.default.dim("describe a change; the agent builds it while you watch")}`);
-  out.push(`  ${import_picocolors68.default.cyan("interface publish")} ${import_picocolors68.default.dim("<id>")}          ${import_picocolors68.default.dim("make the newest succeeded build live")}`);
-  out.push(`  ${import_picocolors68.default.cyan("interface rollback")} ${import_picocolors68.default.dim("<id>")}         ${import_picocolors68.default.dim("make an earlier release live again (--release <id>)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("interface access")} ${import_picocolors68.default.dim("<id>")}           ${import_picocolors68.default.dim("show or set who can open it")}`);
-  out.push(`  ${import_picocolors68.default.cyan("interface --help")}                ${import_picocolors68.default.dim("every interface subcommand")}`);
+  out.push(`  ${import_picocolors71.default.cyan("interface ls")}                    ${import_picocolors71.default.dim("dashboards you can see (--agent to narrow)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("interface create")} ${import_picocolors71.default.dim("--name <n>")}     ${import_picocolors71.default.dim("create one on an agent, with who can open it")}`);
+  out.push(`  ${import_picocolors71.default.cyan("interface build")} ${import_picocolors71.default.dim('<id> "<ask>"')}    ${import_picocolors71.default.dim("describe a change; the agent builds it while you watch")}`);
+  out.push(`  ${import_picocolors71.default.cyan("interface publish")} ${import_picocolors71.default.dim("<id>")}          ${import_picocolors71.default.dim("make the newest succeeded build live")}`);
+  out.push(`  ${import_picocolors71.default.cyan("interface rollback")} ${import_picocolors71.default.dim("<id>")}         ${import_picocolors71.default.dim("make an earlier release live again (--release <id>)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("interface access")} ${import_picocolors71.default.dim("<id>")}           ${import_picocolors71.default.dim("show or set who can open it")}`);
+  out.push(`  ${import_picocolors71.default.cyan("interface --help")}                ${import_picocolors71.default.dim("every interface subcommand")}`);
   out.push("");
   out.push(divider("SANDBOXES"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("machine ls")} ${import_picocolors68.default.dim("[--all]")}            ${import_picocolors68.default.dim("list your sandboxes — live ones only unless --all")}`);
-  out.push(`  ${import_picocolors68.default.cyan("machine rm")} ${import_picocolors68.default.dim("<id>")}               ${import_picocolors68.default.dim("tear a sandbox down (it bills until you do)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("machine ls")} ${import_picocolors71.default.dim("[--all]")}            ${import_picocolors71.default.dim("list your sandboxes — live ones only unless --all")}`);
+  out.push(`  ${import_picocolors71.default.cyan("machine rm")} ${import_picocolors71.default.dim("<id>")}               ${import_picocolors71.default.dim("tear a sandbox down (it bills until you do)")}`);
   out.push("");
   out.push(divider("BENCHMARKS"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("benchmark list")}                    ${import_picocolors68.default.dim("list benchmarks for the linked agent")}`);
-  out.push(`  ${import_picocolors68.default.cyan("benchmark init")} ${import_picocolors68.default.dim("[directory]")}        ${import_picocolors68.default.dim("scaffold a local benchmark")}`);
-  out.push(`  ${import_picocolors68.default.cyan("benchmark create")} ${import_picocolors68.default.dim("[path|-]")}         ${import_picocolors68.default.dim("create a benchmark draft")}`);
-  out.push(`  ${import_picocolors68.default.cyan("benchmark run")} ${import_picocolors68.default.dim("<benchmark> --yes")}   ${import_picocolors68.default.dim("plan and start a benchmark run")}`);
-  out.push(`  ${import_picocolors68.default.cyan("benchmark results")} ${import_picocolors68.default.dim("<run>")}           ${import_picocolors68.default.dim("inspect normalized benchmark results")}`);
+  out.push(`  ${import_picocolors71.default.cyan("benchmark list")}                    ${import_picocolors71.default.dim("list benchmarks for the linked agent")}`);
+  out.push(`  ${import_picocolors71.default.cyan("benchmark init")} ${import_picocolors71.default.dim("[directory]")}        ${import_picocolors71.default.dim("scaffold a local benchmark")}`);
+  out.push(`  ${import_picocolors71.default.cyan("benchmark create")} ${import_picocolors71.default.dim("[path|-]")}         ${import_picocolors71.default.dim("create a benchmark draft")}`);
+  out.push(`  ${import_picocolors71.default.cyan("benchmark run")} ${import_picocolors71.default.dim("<benchmark> --yes")}   ${import_picocolors71.default.dim("plan and start a benchmark run")}`);
+  out.push(`  ${import_picocolors71.default.cyan("benchmark results")} ${import_picocolors71.default.dim("<run>")}           ${import_picocolors71.default.dim("inspect normalized benchmark results")}`);
   out.push("");
   out.push(divider("BENCHMARK RUNTIME"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("benchmark hydrate")} ${import_picocolors68.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors68.default.cyan("benchmark evaluate")} ${import_picocolors68.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors68.default.cyan("benchmark capabilities")} ${import_picocolors68.default.dim("--json")}`);
+  out.push(`  ${import_picocolors71.default.cyan("benchmark hydrate")} ${import_picocolors71.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors71.default.cyan("benchmark evaluate")} ${import_picocolors71.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors71.default.cyan("benchmark capabilities")} ${import_picocolors71.default.dim("--json")}`);
   out.push("");
   out.push(divider("ORCHESTRATIONS"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("orchestration create")}           ${import_picocolors68.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
-  out.push(`  ${import_picocolors68.default.cyan("orchestration list")}             ${import_picocolors68.default.dim("list orchestrations under a team")}`);
-  out.push(`  ${import_picocolors68.default.cyan("orchestration pull")} ${import_picocolors68.default.dim("<id>")}        ${import_picocolors68.default.dim("recursively fetch an orchestration + every member agent")}`);
-  out.push(`  ${import_picocolors68.default.cyan("orchestration push")}             ${import_picocolors68.default.dim("recursively push each member, then update the graph")}`);
-  out.push(`  ${import_picocolors68.default.cyan("orchestration status")}           ${import_picocolors68.default.dim("show what would push and what would pull")}`);
-  out.push(`  ${import_picocolors68.default.cyan("orchestration delete")} ${import_picocolors68.default.dim("<id>")}      ${import_picocolors68.default.dim("permanently delete an orchestration graph (member agents are kept)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("orchestration create")}           ${import_picocolors71.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors71.default.cyan("orchestration list")}             ${import_picocolors71.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors71.default.cyan("orchestration pull")} ${import_picocolors71.default.dim("<id>")}        ${import_picocolors71.default.dim("recursively fetch an orchestration + every member agent")}`);
+  out.push(`  ${import_picocolors71.default.cyan("orchestration push")}             ${import_picocolors71.default.dim("recursively push each member, then update the graph")}`);
+  out.push(`  ${import_picocolors71.default.cyan("orchestration status")}           ${import_picocolors71.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors71.default.cyan("orchestration delete")} ${import_picocolors71.default.dim("<id>")}      ${import_picocolors71.default.dim("permanently delete an orchestration graph (member agents are kept)")}`);
   out.push("");
   out.push(divider("TEMPLATES"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("template pack")}                       ${import_picocolors68.default.dim("bundle the current agent into a template")}`);
-  out.push(`  ${import_picocolors68.default.cyan("template publish")}                    ${import_picocolors68.default.dim("upload a template to the registry")}`);
-  out.push(`  ${import_picocolors68.default.cyan("template search")} ${import_picocolors68.default.dim("[query]")}             ${import_picocolors68.default.dim("search the registry")}`);
-  out.push(`  ${import_picocolors68.default.cyan("template info")}    ${import_picocolors68.default.dim("<creator/slug>")}     ${import_picocolors68.default.dim("show registry details for a template")}`);
-  out.push(`  ${import_picocolors68.default.cyan("template onboard")} ${import_picocolors68.default.dim("<creator/slug>")}     ${import_picocolors68.default.dim("install (or refresh) a template")}`);
-  out.push(`  ${import_picocolors68.default.cyan("template list")}                       ${import_picocolors68.default.dim("show installed templates")}`);
-  out.push(`  ${import_picocolors68.default.cyan("template remove")}  ${import_picocolors68.default.dim("<creator/slug>")}     ${import_picocolors68.default.dim("uninstall a template")}`);
+  out.push(`  ${import_picocolors71.default.cyan("template pack")}                       ${import_picocolors71.default.dim("bundle the current agent into a template")}`);
+  out.push(`  ${import_picocolors71.default.cyan("template publish")}                    ${import_picocolors71.default.dim("upload a template to the registry")}`);
+  out.push(`  ${import_picocolors71.default.cyan("template search")} ${import_picocolors71.default.dim("[query]")}             ${import_picocolors71.default.dim("search the registry")}`);
+  out.push(`  ${import_picocolors71.default.cyan("template info")}    ${import_picocolors71.default.dim("<creator/slug>")}     ${import_picocolors71.default.dim("show registry details for a template")}`);
+  out.push(`  ${import_picocolors71.default.cyan("template onboard")} ${import_picocolors71.default.dim("<creator/slug>")}     ${import_picocolors71.default.dim("install (or refresh) a template")}`);
+  out.push(`  ${import_picocolors71.default.cyan("template list")}                       ${import_picocolors71.default.dim("show installed templates")}`);
+  out.push(`  ${import_picocolors71.default.cyan("template remove")}  ${import_picocolors71.default.dim("<creator/slug>")}     ${import_picocolors71.default.dim("uninstall a template")}`);
   out.push("");
   out.push(divider("SKILLS"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("skill add")} ${import_picocolors68.default.dim("<source>")}                  ${import_picocolors68.default.dim("install a skill (github / git / brainbase)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("skill list")}                            ${import_picocolors68.default.dim("show locally installed skills + their source")}`);
-  out.push(`  ${import_picocolors68.default.cyan("skill update")} ${import_picocolors68.default.dim("<slug>")}                  ${import_picocolors68.default.dim("re-fetch a skill from its recorded source")}`);
-  out.push(`  ${import_picocolors68.default.cyan("skill remove")} ${import_picocolors68.default.dim("<slug>")}                  ${import_picocolors68.default.dim("uninstall a skill")}`);
-  out.push(`  ${import_picocolors68.default.cyan("skill search")} ${import_picocolors68.default.dim("[query]")}                 ${import_picocolors68.default.dim("search the brainbase skill registry")}`);
-  out.push(`  ${import_picocolors68.default.cyan("skill info")} ${import_picocolors68.default.dim("<creator/slug>")}            ${import_picocolors68.default.dim("show registry details for a skill")}`);
-  out.push(`  ${import_picocolors68.default.cyan("skill publish")} ${import_picocolors68.default.dim("[dir]")}                  ${import_picocolors68.default.dim("publish a SKILL.md folder (defaults to .)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("skill add")} ${import_picocolors71.default.dim("<source>")}                  ${import_picocolors71.default.dim("install a skill (github / git / brainbase)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("skill list")}                            ${import_picocolors71.default.dim("show locally installed skills + their source")}`);
+  out.push(`  ${import_picocolors71.default.cyan("skill update")} ${import_picocolors71.default.dim("<slug>")}                  ${import_picocolors71.default.dim("re-fetch a skill from its recorded source")}`);
+  out.push(`  ${import_picocolors71.default.cyan("skill remove")} ${import_picocolors71.default.dim("<slug>")}                  ${import_picocolors71.default.dim("uninstall a skill")}`);
+  out.push(`  ${import_picocolors71.default.cyan("skill search")} ${import_picocolors71.default.dim("[query]")}                 ${import_picocolors71.default.dim("search the brainbase skill registry")}`);
+  out.push(`  ${import_picocolors71.default.cyan("skill info")} ${import_picocolors71.default.dim("<creator/slug>")}            ${import_picocolors71.default.dim("show registry details for a skill")}`);
+  out.push(`  ${import_picocolors71.default.cyan("skill publish")} ${import_picocolors71.default.dim("[dir]")}                  ${import_picocolors71.default.dim("publish a SKILL.md folder (defaults to .)")}`);
   out.push("");
   out.push(divider("CLI TOKENS"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("token create")}                        ${import_picocolors68.default.dim("issue a long-lived CLI key for CI / scripts")}`);
-  out.push(`  ${import_picocolors68.default.cyan("token list")}                          ${import_picocolors68.default.dim("show your tokens")}`);
-  out.push(`  ${import_picocolors68.default.cyan("token rename")} ${import_picocolors68.default.dim("<id>")}                  ${import_picocolors68.default.dim("relabel a token")}`);
-  out.push(`  ${import_picocolors68.default.cyan("token revoke")} ${import_picocolors68.default.dim("<id>")}                  ${import_picocolors68.default.dim("revoke a token")}`);
+  out.push(`  ${import_picocolors71.default.cyan("token create")}                        ${import_picocolors71.default.dim("issue a long-lived CLI key for CI / scripts")}`);
+  out.push(`  ${import_picocolors71.default.cyan("token list")}                          ${import_picocolors71.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors71.default.cyan("token rename")} ${import_picocolors71.default.dim("<id>")}                  ${import_picocolors71.default.dim("relabel a token")}`);
+  out.push(`  ${import_picocolors71.default.cyan("token revoke")} ${import_picocolors71.default.dim("<id>")}                  ${import_picocolors71.default.dim("revoke a token")}`);
   out.push("");
   out.push(divider("MCP"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("mcp check")} ${import_picocolors68.default.dim("[--json]")}              ${import_picocolors68.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("mcp list")} ${import_picocolors68.default.dim("[--json]")}               ${import_picocolors68.default.dim("show configured servers with OAuth state and expiry")}`);
+  out.push(`  ${import_picocolors71.default.cyan("mcp check")} ${import_picocolors71.default.dim("[--json]")}              ${import_picocolors71.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
+  out.push(`  ${import_picocolors71.default.cyan("mcp list")} ${import_picocolors71.default.dim("[--json]")}               ${import_picocolors71.default.dim("show configured servers with OAuth state and expiry")}`);
+  out.push(`  ${import_picocolors71.default.cyan("mcp connect")} ${import_picocolors71.default.dim("<name>")}              ${import_picocolors71.default.dim("authorize an OAuth-backed server: prints a single-use link, opens it, waits for approval")}`);
   out.push("");
   out.push(divider("FLAGS"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
-  out.push(`  ${import_picocolors68.default.dim("--scope <s>")}        force scope: global | project`);
-  out.push(`  ${import_picocolors68.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
+  out.push(`  ${import_picocolors71.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
+  out.push(`  ${import_picocolors71.default.dim("--scope <s>")}        force scope: global | project`);
+  out.push(`  ${import_picocolors71.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
   out.push(`  ${" ".repeat("--yes, -y".length)}          required for destructive commands with no terminal (pipes, CI)`);
-  out.push(`  ${import_picocolors68.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly (task list: filter to it)`);
-  out.push(`  ${import_picocolors68.default.dim("--message <text>")}   for task create: required first user message`);
-  out.push(`  ${import_picocolors68.default.dim("--title <text>")}     for task create: optional task title`);
-  out.push(`  ${import_picocolors68.default.dim("--model <id>")}       for task create: optional model override`);
-  out.push(`  ${import_picocolors68.default.dim("--wait")}             for task create: block until the task finishes; exit 1 unless it succeeded`);
-  out.push(`  ${import_picocolors68.default.dim("--timeout <secs>")}   for task create --wait: give up after <secs> and exit 1`);
-  out.push(`  ${import_picocolors68.default.dim("--limit <n>")}        for task list (1-200), task logs (events to print; with --follow, the first page size) and machine ls`);
-  out.push(`  ${import_picocolors68.default.dim("--follow, -f")}       for task logs: stay attached and print events as they land`);
-  out.push(`  ${import_picocolors68.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
-  out.push(`  ${import_picocolors68.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
-  out.push(`  ${import_picocolors68.default.dim("--json")}             machine-readable output for supported commands`);
-  out.push(`  ${import_picocolors68.default.dim("--no-tracking")}      for link / agent pull --link: skip routing LLM traffic through brainbase`);
-  out.push(`  ${import_picocolors68.default.dim("--link")}             for agent pull: link this folder to the agent first, as \`brainbase link --agent <id> --yes\` would, in one process`);
-  out.push(`  ${import_picocolors68.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
-  out.push(`  ${import_picocolors68.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
-  out.push(`  ${import_picocolors68.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
-  out.push(`  ${import_picocolors68.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
-  out.push(`  ${import_picocolors68.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
-  out.push(`  ${import_picocolors68.default.dim("--full")}             for agent init: write a commented template covering every block`);
-  out.push(`  ${import_picocolors68.default.dim("--minimal")}          for agent init: write the starter manifest (the default)`);
-  out.push(`  ${import_picocolors68.default.dim("--all")}              for template list: include installs from other folders; for machine ls: include torn-down machines`);
-  out.push(`  ${import_picocolors68.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors71.default.dim("--agent <id>")}       for link/task create: use this agent id explicitly (task list: filter to it)`);
+  out.push(`  ${import_picocolors71.default.dim("--message <text>")}   for task create: required first user message`);
+  out.push(`  ${import_picocolors71.default.dim("--title <text>")}     for task create: optional task title`);
+  out.push(`  ${import_picocolors71.default.dim("--model <id>")}       for task create: optional model override`);
+  out.push(`  ${import_picocolors71.default.dim("--wait")}             for task create: block until the task finishes; exit 1 unless it succeeded`);
+  out.push(`  ${import_picocolors71.default.dim("--timeout <secs>")}   for task create --wait: give up after <secs> and exit 1`);
+  out.push(`  ${import_picocolors71.default.dim("--limit <n>")}        for task list (1-200), task logs (events to print; with --follow, the first page size) and machine ls`);
+  out.push(`  ${import_picocolors71.default.dim("--follow, -f")}       for task logs: stay attached and print events as they land`);
+  out.push(`  ${import_picocolors71.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
+  out.push(`  ${import_picocolors71.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
+  out.push(`  ${import_picocolors71.default.dim("--json")}             machine-readable output for supported commands`);
+  out.push(`  ${import_picocolors71.default.dim("--no-tracking")}      for link / agent pull --link: skip routing LLM traffic through brainbase`);
+  out.push(`  ${import_picocolors71.default.dim("--link")}             for agent pull: link this folder to the agent first, as \`brainbase link --agent <id> --yes\` would, in one process`);
+  out.push(`  ${import_picocolors71.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
+  out.push(`  ${import_picocolors71.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
+  out.push(`  ${import_picocolors71.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
+  out.push(`  ${import_picocolors71.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
+  out.push(`  ${import_picocolors71.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
+  out.push(`  ${import_picocolors71.default.dim("--full")}             for agent init: write a commented template covering every block`);
+  out.push(`  ${import_picocolors71.default.dim("--minimal")}          for agent init: write the starter manifest (the default)`);
+  out.push(`  ${import_picocolors71.default.dim("--all")}              for template list: include installs from other folders; for machine ls: include torn-down machines`);
+  out.push(`  ${import_picocolors71.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors71.default.dim("--no-open")}          for mcp connect: print the link without opening a browser (implied with no terminal)`);
+  out.push(`  ${import_picocolors71.default.dim("--no-wait")}          for mcp connect: print the link and exit instead of waiting for approval`);
   out.push("");
   out.push(divider("ENV"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task and interface commands use /v2/tasks and /v2/interfaces)`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT; the only PAT control-plane commands accept (token.json is not read there)`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task and interface commands use /v2/tasks and /v2/interfaces)`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT; the only PAT control-plane commands accept (token.json is not read there)`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_LINEAR_MCP_URL")}        override the built-in Linear MCP host`);
-  out.push(`  ${import_picocolors68.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_LINEAR_MCP_URL")}        override the built-in Linear MCP host`);
+  out.push(`  ${import_picocolors71.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
   out.push("");
   out.push(divider("HARNESSES"));
   out.push("");
-  out.push(`  ${import_picocolors68.default.dim("•")} ${import_picocolors68.default.bold("claude-code")}  ${import_picocolors68.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors68.default.dim("•")} ${import_picocolors68.default.bold("codex")}        ${import_picocolors68.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors68.default.dim("•")} ${import_picocolors68.default.bold("kafka")}        ${import_picocolors68.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors71.default.dim("•")} ${import_picocolors71.default.bold("claude-code")}  ${import_picocolors71.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors71.default.dim("•")} ${import_picocolors71.default.bold("codex")}        ${import_picocolors71.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors71.default.dim("•")} ${import_picocolors71.default.bold("kafka")}        ${import_picocolors71.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -93036,13 +93684,13 @@ async function requireAuth(cmd) {
   if (STORED_PAT_COMMANDS.has(cmd) && readToken())
     return;
   console.error("");
-  console.error(`  ${brandTint("◆")}  ${import_picocolors68.default.bold("brainbase")}`);
+  console.error(`  ${brandTint("◆")}  ${import_picocolors71.default.bold("brainbase")}`);
   console.error("");
-  console.error(`  ${import_picocolors68.default.red("✗")}  You need to sign in to use ${import_picocolors68.default.bold("brainbase " + cmd)}.`);
+  console.error(`  ${import_picocolors71.default.red("✗")}  You need to sign in to use ${import_picocolors71.default.bold("brainbase " + cmd)}.`);
   if (status.reason)
-    console.error(`     ${import_picocolors68.default.dim(status.reason)}`);
+    console.error(`     ${import_picocolors71.default.dim(status.reason)}`);
   console.error("");
-  console.error(`     Run ${import_picocolors68.default.cyan("brainbase login")} to connect this device.`);
+  console.error(`     Run ${import_picocolors71.default.cyan("brainbase login")} to connect this device.`);
   console.error("");
   process14.exit(1);
 }
@@ -93116,6 +93764,8 @@ async function main() {
   const limitParsed = limitRaw === undefined ? NaN : Number(limitRaw);
   const limitFlag = Number.isInteger(limitParsed) && limitParsed >= 1 && limitParsed <= 200 ? limitParsed : undefined;
   const archivedFlag = hasFlag2(sharedArgs, "--archived");
+  const noOpenFlag = hasFlag2(sharedArgs, "--no-open");
+  const noWaitFlag = hasFlag2(sharedArgs, "--no-wait");
   ensureSkillResolversRegistered();
   try {
     await requireAuth(cmd);
@@ -93221,6 +93871,12 @@ async function main() {
         await runTeam(sub, argv, { orgId: orgIdFlag, json: jsonFlag });
         break;
       }
+      case "member":
+      case "members": {
+        const sub = argv.shift();
+        await runMember(sub, argv, { orgId: orgIdFlag, json: jsonFlag });
+        break;
+      }
       case "task": {
         const sub = argv.shift();
         await runTask(cwd2, sub, argv);
@@ -93278,7 +93934,11 @@ async function main() {
       }
       case "mcp": {
         const sub = argv.shift();
-        const code = await runMcp(cwd2, sub, argv, { json: jsonFlag });
+        const code = await runMcp(cwd2, sub, argv, {
+          json: jsonFlag,
+          noOpen: noOpenFlag,
+          noWait: noWaitFlag
+        });
         process14.exitCode = code;
         break;
       }
@@ -93289,10 +93949,10 @@ async function main() {
         process14.exit(1);
     }
   } catch (err) {
-    console.error(import_picocolors68.default.red(`
+    console.error(import_picocolors71.default.red(`
 ${err.message}`));
     if (err instanceof ApiError && err.status === 401) {
-      console.error(`  Run ${import_picocolors68.default.cyan("brainbase login")} to connect this device.`);
+      console.error(`  Run ${import_picocolors71.default.cyan("brainbase login")} to connect this device.`);
     }
     if (process14.env.BRAINBASE_DEBUG)
       console.error(err.stack);