@brainbase-labs/cli 0.53.0 → 0.55.0

package/dist/index.js

@@ -35182,9 +35182,9 @@ var require_dist2 = __commonJS((exports, module) => {
 });
 
 // src/index.ts
-var import_picocolors80 = __toESM(require_picocolors(), 1);
+var import_picocolors81 = __toESM(require_picocolors(), 1);
 import process14 from "node:process";
-import fs94 from "node:fs";
+import fs96 from "node:fs";
 
 // src/cli/template.ts
 var import_picocolors12 = __toESM(require_picocolors(), 1);
@@ -36091,7 +36091,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.53.0",
+  version: "0.55.0",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -67885,6 +67885,14 @@ function automationErrorEnvelope(command, error) {
   };
 }
 
+// src/ui/terminal-safe.ts
+function sanitizeLabel(s3) {
+  return s3.replace(/\u001b\][\s\S]*?(?:\u0007|\u001b\\|$)/g, "").replace(/\u001b\[[\u0030-\u003f]*[\u0020-\u002f]*[\u0040-\u007e]?/g, "").replace(/\u001b[\s\S]?/g, "").replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, "");
+}
+function sanitizeLines(s3) {
+  return s3.split(/\r\n|[\n\r\u2028\u2029]/).map(sanitizeLabel);
+}
+
 // src/core/fastapi-detail.ts
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -67893,22 +67901,22 @@ function fastApiDetails(body) {
   const detail = record(body)?.detail;
   return Array.isArray(detail) ? detail.filter((entry) => !!record(entry)) : [];
 }
+function fastApiValidationMessage(body) {
+  const parts = fastApiDetails(body).map((entry) => {
+    const msg = typeof entry.msg === "string" ? sanitizeLabel(entry.msg.trim()) : "";
+    if (!msg)
+      return null;
+    const loc = Array.isArray(entry.loc) ? sanitizeLabel(entry.loc.filter((part) => part !== "body").map(String).join(".")) : "";
+    return loc ? `${loc}: ${msg}` : msg;
+  }).filter((part) => !!part);
+  return parts.length ? parts.join("; ") : null;
+}
 function rejectsBodyField(body, field) {
   return fastApiDetails(body).some((entry) => entry.type === "extra_forbidden" && Array.isArray(entry.loc) && entry.loc[0] === "body" && entry.loc[1] === field);
 }
 
 // src/core/interfaces-api.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-
-// src/ui/terminal-safe.ts
-function sanitizeLabel(s3) {
-  return s3.replace(/\u001b\][\s\S]*?(?:\u0007|\u001b\\|$)/g, "").replace(/\u001b\[[\u0030-\u003f]*[\u0020-\u002f]*[\u0040-\u007e]?/g, "").replace(/\u001b[\s\S]?/g, "").replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, "");
-}
-function sanitizeLines(s3) {
-  return s3.split(/\r\n|[\n\r\u2028\u2029]/).map(sanitizeLabel);
-}
-
-// src/core/interfaces-api.ts
 function isSettled(status) {
   return status === "succeeded" || status === "failed";
 }
@@ -68022,17 +68030,7 @@ function clean(value) {
 `);
 }
 function fieldMessages(fields) {
-  if (!Array.isArray(fields))
-    return null;
-  const parts = fields.map((entry) => {
-    const item = record2(entry);
-    if (!item)
-      return null;
-    const loc = Array.isArray(item.loc) ? sanitizeLabel(item.loc.filter((part) => part !== "body").map(String).join(".")) : "";
-    const msg = text2(item.msg);
-    return msg ? loc ? `${loc}: ${sanitizeLabel(msg)}` : sanitizeLabel(msg) : null;
-  }).filter((part) => !!part);
-  return parts.length ? parts.join("; ") : null;
+  return fastApiValidationMessage({ detail: fields });
 }
 function toInterfaceError(error, options = {}) {
   if (error instanceof InterfaceApiError || !(error instanceof ApiError))
@@ -68082,9 +68080,8 @@ function toInterfaceError(error, options = {}) {
       break;
     }
     default:
-      if (status === 422 && fastApiDetails(body).length) {
-        message = fieldMessages(record2(body)?.detail) ?? serverMessage;
-      }
+      if (status === 422)
+        message = fastApiValidationMessage(body) ?? serverMessage;
   }
   const rawInterfaceId = text2(details?.interface_id);
   const interfaceId = rawInterfaceId ? sanitizeLabel(rawInterfaceId) : null;
@@ -82448,6 +82445,10 @@ var SyncedScheduleTriggerSchema = exports_external.object({
   node_id: exports_external.string(),
   hash: exports_external.string()
 });
+var SyncedDecisionSchema = exports_external.object({
+  id: exports_external.string(),
+  hash: exports_external.string()
+});
 var SyncedOrchestrationMetaSchema = exports_external.object({
   name: exports_external.string().optional(),
   description: exports_external.string().optional(),
@@ -82463,6 +82464,7 @@ var OrchestrationSyncStateSchema = exports_external.object({
   members: exports_external.array(SyncedMemberSchema),
   edges: exports_external.array(SyncedEdgeSchema),
   triggers: exports_external.array(SyncedScheduleTriggerSchema).optional(),
+  decisions: exports_external.array(SyncedDecisionSchema).optional(),
   meta: SyncedOrchestrationMetaSchema.optional()
 });
 function orchLinkPath(cwd2) {
@@ -82884,6 +82886,9 @@ var TriggerEdgeSchema = exports_external.object({
   payload_schema: exports_external.record(exports_external.unknown()).optional()
 });
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function canonicalUuid2(value2) {
+  return UUID_RE.test(value2) ? value2.toLowerCase() : value2;
+}
 var ScheduleTriggerSchema = exports_external.object({
   type: exports_external.literal("schedule"),
   node_id: exports_external.string().regex(UUID_RE, "must be a UUID"),
@@ -82901,12 +82906,52 @@ var ReadOnlyTriggerSchema = exports_external.object({
   to: exports_external.array(TriggerEdgeSchema).default([])
 });
 var TriggerSchema = exports_external.union([ScheduleTriggerSchema, ReadOnlyTriggerSchema]);
+var DECISION_MODELS = [
+  "jev",
+  "kev-4b",
+  "clef",
+  "clef-flash",
+  "gpt-6-luna"
+];
+var DEFAULT_DECISION_MODEL = "clef-flash";
+var DECISION_LIMITS = {
+  name: 200,
+  model: 100,
+  instructions: 4000,
+  answersMin: 2,
+  answersMax: 20,
+  answer: 200,
+  criterion: 1000
+};
+var DecisionTargetSchema = exports_external.object({
+  agent: exports_external.string().min(1).optional(),
+  decision: exports_external.string().regex(UUID_RE, "must be a UUID").optional(),
+  description: exports_external.string().optional()
+}).refine((t) => t.agent === undefined !== (t.decision === undefined), {
+  message: "set exactly one of agent or decision"
+});
+var DecisionAnswerSchema = exports_external.object({
+  answer: exports_external.string(),
+  criterion: exports_external.string().optional(),
+  to: exports_external.array(DecisionTargetSchema).default([])
+});
+var DecisionSchema = exports_external.object({
+  id: exports_external.string().regex(UUID_RE, "must be a UUID"),
+  name: exports_external.string(),
+  model: exports_external.string().optional(),
+  instructions: exports_external.string().optional(),
+  confidence_threshold: exports_external.number().min(0).max(1).nullable().optional(),
+  from: exports_external.array(exports_external.object({ trigger: exports_external.string().regex(UUID_RE, "must be a UUID") })).default([]),
+  answers: exports_external.array(DecisionAnswerSchema),
+  fallback: exports_external.array(DecisionTargetSchema).default([])
+});
 var OrchestrationManifestSchema = exports_external.object({
   schema: exports_external.literal(1),
   orchestration: OrchMetaSchema,
   members: exports_external.array(MemberSchema).default([]),
   edges: exports_external.array(EdgeSchema).default([]),
-  triggers: exports_external.array(TriggerSchema).optional()
+  triggers: exports_external.array(TriggerSchema).optional(),
+  decisions: exports_external.array(DecisionSchema).optional()
 });
 function orchManifestPath(cwd2) {
   return path96.join(cwd2, ORCH_MANIFEST_FILE);
@@ -83331,6 +83376,132 @@ function syncedScheduleTriggers(triggers) {
     hash: scheduleTriggerHash(t)
   }));
 }
+var DECISION = "decision";
+function manifestDecisions(manifest, slugToAgentId) {
+  const target = (t) => {
+    const agentId = t.agent !== undefined ? slugToAgentId?.get(t.agent) : undefined;
+    return {
+      ...t.agent !== undefined ? { agent: t.agent, ...agentId ? { agent_id: agentId } : {} } : { decision: canonicalUuid2(t.decision) },
+      description: t.description ?? ""
+    };
+  };
+  return (manifest?.decisions ?? []).map((d3) => ({
+    id: canonicalUuid2(d3.id),
+    name: d3.name.trim(),
+    model: (d3.model ?? DEFAULT_DECISION_MODEL).trim(),
+    instructions: d3.instructions ?? "",
+    confidence_threshold: d3.confidence_threshold ?? null,
+    triggers: d3.from.map((f4) => canonicalUuid2(f4.trigger)),
+    answers: d3.answers.map((a3) => ({
+      answer: a3.answer.trim(),
+      criterion: (a3.criterion ?? "").trim(),
+      to: a3.to.map(target)
+    })),
+    fallback: d3.fallback.map(target)
+  }));
+}
+function liveDecisionLinks(cloud) {
+  const agents = new Set(cloud.members.map((m3) => m3.agent_id));
+  const decisions = new Set((cloud.decisions ?? []).map((d3) => canonicalUuid2(d3.id)));
+  const triggers = new Set((cloud.triggers ?? []).map((t) => canonicalUuid2(t.node_id)));
+  return (d3) => {
+    const answers = new Set(d3.answers.map((a3) => a3.answer));
+    return {
+      routes: d3.routes.filter((r2) => (r2.is_fallback || r2.answer != null && answers.has(r2.answer)) && (r2.to_agent_id ? agents.has(r2.to_agent_id) : r2.to_decision_id != null && decisions.has(canonicalUuid2(r2.to_decision_id)))),
+      inputs: d3.inputs.filter((i) => triggers.has(canonicalUuid2(i.from_trigger_node_id)))
+    };
+  };
+}
+function cloudDecisions(cloud, slugForAgent) {
+  if (cloud.decisions == null)
+    return null;
+  const live = liveDecisionLinks(cloud);
+  return cloud.decisions.map((d3) => {
+    const { routes, inputs } = live(d3);
+    const target = (r2) => ({
+      ...r2.to_agent_id ? {
+        agent: slugForAgent(r2.to_agent_id, r2.to_slug ?? r2.to_agent_id),
+        agent_id: r2.to_agent_id
+      } : { decision: canonicalUuid2(r2.to_decision_id) },
+      description: r2.description ?? ""
+    });
+    return {
+      id: canonicalUuid2(d3.id),
+      name: d3.name.trim(),
+      model: d3.model.trim(),
+      instructions: d3.instructions ?? "",
+      confidence_threshold: d3.confidence_threshold ?? null,
+      triggers: inputs.map((i) => canonicalUuid2(i.from_trigger_node_id)),
+      answers: d3.answers.map((a3) => ({
+        answer: a3.answer.trim(),
+        criterion: (a3.criterion ?? "").trim(),
+        to: routes.filter((r2) => !r2.is_fallback && r2.answer === a3.answer).map(target)
+      })),
+      fallback: routes.filter((r2) => r2.is_fallback).map(target)
+    };
+  });
+}
+function deadDecisionLinks(cloud) {
+  const live = liveDecisionLinks(cloud);
+  const out = new Map;
+  for (const d3 of cloud.decisions ?? []) {
+    const { routes, inputs } = live(d3);
+    const dead = d3.routes.length - routes.length + d3.inputs.length - inputs.length;
+    if (dead > 0)
+      out.set(d3.id, dead);
+  }
+  return out;
+}
+function decisionHash(d3) {
+  const targets = (ts2) => ts2.map(({ agent, agent_id, ...rest2 }) => stableJson(agent_id !== undefined ? { agent_id, ...rest2 } : { agent, ...rest2 })).sort();
+  const canonical = {
+    name: d3.name,
+    model: d3.model,
+    instructions: d3.instructions,
+    confidence_threshold: d3.confidence_threshold,
+    triggers: [...d3.triggers].sort(),
+    answers: d3.answers.map((a3) => ({
+      answer: a3.answer,
+      criterion: a3.criterion,
+      to: targets(a3.to)
+    })),
+    fallback: targets(d3.fallback)
+  };
+  return crypto6.createHash("sha256").update(stableJson(canonical)).digest("hex");
+}
+function decisionLabel(d3) {
+  return `decision "${d3.name}" (${d3.id})`;
+}
+function decideDecisionReconcile(input) {
+  const rows = threeWayDiff({
+    local: input.local.map((d3) => ({
+      type: DECISION,
+      slug: d3.id,
+      hash: decisionHash(d3)
+    })),
+    lock: (input.baseline ?? []).map((d3) => ({
+      type: DECISION,
+      slug: d3.id,
+      hash: d3.hash,
+      installedPaths: []
+    })),
+    cloud: input.cloud.map((d3) => ({
+      type: DECISION,
+      slug: d3.id,
+      hash: decisionHash(d3),
+      files: []
+    }))
+  });
+  return decideCollectionReconcile({
+    rows,
+    type: DECISION,
+    claims: input.local.length > 0,
+    force: input.force
+  });
+}
+function syncedDecisions(decisions) {
+  return decisions.map((d3) => ({ id: d3.id, hash: decisionHash(d3) }));
+}
 var ORCH_META_FIELDS = [
   "name",
   "description",
@@ -83413,6 +83584,26 @@ function triggersForManifest(triggers, slugFor) {
     };
   });
 }
+function decisionsForManifest(decisions) {
+  const target = (t) => ({
+    ...t.agent !== undefined ? { agent: t.agent } : { decision: t.decision },
+    ...t.description ? { description: t.description } : {}
+  });
+  return decisions.map((d3) => ({
+    id: d3.id,
+    name: d3.name,
+    model: d3.model,
+    ...d3.instructions ? { instructions: d3.instructions } : {},
+    ...d3.confidence_threshold != null ? { confidence_threshold: d3.confidence_threshold } : {},
+    ...d3.triggers.length ? { from: d3.triggers.map((trigger) => ({ trigger })) } : {},
+    answers: d3.answers.map((a3) => ({
+      answer: a3.answer,
+      ...a3.criterion ? { criterion: a3.criterion } : {},
+      ...a3.to.length ? { to: a3.to.map(target) } : {}
+    })),
+    ...d3.fallback.length ? { fallback: d3.fallback.map(target) } : {}
+  }));
+}
 async function runOrchestrationPull(cwd2, args) {
   banner("orchestration pull — fetch orchestration + all member agents");
   let orchId = null;
@@ -83463,6 +83654,14 @@ async function runOrchestrationPull(cwd2, args) {
       planLines.push(`    ${import_picocolors52.default.cyan(from)} ${import_picocolors52.default.dim("→")} ${import_picocolors52.default.cyan(to2)}${desc}`);
     }
   }
+  const pulledDecisions = cloudDecisions(cloud, (agentId, fallback) => slugByAgent.get(agentId) ?? fallback);
+  if (pulledDecisions?.length) {
+    planLines.push("");
+    planLines.push(`  ${import_picocolors52.default.dim("decisions:")}`);
+    for (const d3 of pulledDecisions) {
+      planLines.push(`    ${import_picocolors52.default.cyan("◆")} ${import_picocolors52.default.bold(d3.name)} ${import_picocolors52.default.dim(`(${d3.model}, ${d3.answers.length} answers)`)}`);
+    }
+  }
   planLines.push("");
   console.log(planLines.join(`
 `));
@@ -83528,6 +83727,19 @@ async function runOrchestrationPull(cwd2, args) {
     }
   }
   const manifestTriggers = triggersForManifest(cloud.triggers ?? [], slugFor);
+  let manifestDecisions2 = pulledDecisions ? decisionsForManifest(pulledDecisions) : undefined;
+  let decisionBaseline = pulledDecisions ? syncedDecisions(pulledDecisions) : undefined;
+  if (!pulledDecisions) {
+    try {
+      manifestDecisions2 = readOrchManifest(cwd2)?.decisions;
+    } catch {}
+    const lock = readOrchSyncState(cwd2);
+    decisionBaseline = lock?.orchestration_id === cloud.id ? lock.decisions : undefined;
+  }
+  for (const [decisionId, count] of deadDecisionLinks(cloud)) {
+    const name = pulledDecisions?.find((d3) => d3.id === decisionId)?.name;
+    f2.warn(`Decision ${import_picocolors52.default.bold(name ?? decisionId)} has ${count} route${count === 1 ? "" : "s"} or input${count === 1 ? "" : "s"} that lead${count === 1 ? "s" : ""} nowhere: on an answer it no longer has, or to an agent, decision or trigger no longer in this orchestration. They never run and are not in ${import_picocolors52.default.bold("brainbase-orchestration.yaml")}; the next push of decisions removes them.`);
+  }
   const manifest = {
     schema: 1,
     orchestration: {
@@ -83551,7 +83763,8 @@ async function runOrchestrationPull(cwd2, args) {
       ...e2.payload_schema && Object.keys(e2.payload_schema).length ? { payload_schema: e2.payload_schema } : {},
       ...e2.settings && Object.keys(e2.settings).length ? { settings: e2.settings } : {}
     })),
-    ...manifestTriggers.length ? { triggers: manifestTriggers } : {}
+    ...manifestTriggers.length ? { triggers: manifestTriggers } : {},
+    ...manifestDecisions2?.length ? { decisions: manifestDecisions2 } : {}
   };
   writeOrchManifest(cwd2, manifest);
   writeOrchLink(cwd2, {
@@ -83577,6 +83790,7 @@ async function runOrchestrationPull(cwd2, args) {
       payload_schema: e2.payload_schema ?? {}
     })),
     triggers: syncedScheduleTriggers(cloudScheduleTriggers(cloud, (agentId, fallback) => slugFor(agentId) || fallback)),
+    ...decisionBaseline ? { decisions: decisionBaseline } : {},
     meta: syncedOrchestrationMeta(cloud)
   });
   if (missingMembers.length > 0) {
@@ -83604,6 +83818,83 @@ function handleApiError5(err) {
 var import_picocolors53 = __toESM(require_picocolors(), 1);
 
 // src/core/orchestration-outgoing.ts
+function charLength(value2) {
+  return Array.from(value2).length;
+}
+function validateDecisions(decisions, memberSlugs, triggerNodeIds) {
+  const ids = new Set;
+  for (const d3 of decisions) {
+    if (ids.has(d3.id))
+      throw new Error(`Decision ${d3.id} is duplicated.`);
+    ids.add(d3.id);
+  }
+  for (const d3 of decisions) {
+    const label2 = `Decision "${d3.name || d3.id}"`;
+    const fail3 = (message) => {
+      throw new Error(`${label2}: ${message}`);
+    };
+    if (!d3.name || charLength(d3.name) > DECISION_LIMITS.name) {
+      fail3(`name must be 1 to ${DECISION_LIMITS.name} characters.`);
+    }
+    if (!d3.model || charLength(d3.model) > DECISION_LIMITS.model) {
+      fail3(`model must be 1 to ${DECISION_LIMITS.model} characters.`);
+    }
+    if (charLength(d3.instructions) > DECISION_LIMITS.instructions) {
+      fail3(`instructions must be ${DECISION_LIMITS.instructions} characters or fewer.`);
+    }
+    const count = d3.answers.length;
+    if (count < DECISION_LIMITS.answersMin || count > DECISION_LIMITS.answersMax) {
+      fail3(`needs ${DECISION_LIMITS.answersMin} to ${DECISION_LIMITS.answersMax} answers (has ${count}).`);
+    }
+    const answers = new Set;
+    for (const a3 of d3.answers) {
+      if (!a3.answer || charLength(a3.answer) > DECISION_LIMITS.answer) {
+        fail3(`each answer must be 1 to ${DECISION_LIMITS.answer} characters.`);
+      }
+      if (answers.has(a3.answer))
+        fail3(`answer "${a3.answer}" appears twice.`);
+      answers.add(a3.answer);
+      if (charLength(a3.criterion) > DECISION_LIMITS.criterion) {
+        fail3(`the criterion for "${a3.answer}" must be ${DECISION_LIMITS.criterion} characters or fewer.`);
+      }
+    }
+    const fed = new Set;
+    for (const nodeId of d3.triggers) {
+      if (!triggerNodeIds.has(nodeId)) {
+        fail3(`from trigger ${nodeId}, which isn't in triggers.`);
+      }
+      if (fed.has(nodeId))
+        fail3(`trigger ${nodeId} is listed twice in from.`);
+      fed.add(nodeId);
+    }
+    const checkTargets = (targets, branch) => {
+      const seen = new Set;
+      for (const t of targets) {
+        if (t.agent !== undefined && !memberSlugs.has(t.agent)) {
+          fail3(`${branch} routes to "${t.agent}", which isn't in members.`);
+        }
+        if (t.decision !== undefined) {
+          if (t.decision === d3.id)
+            fail3(`${branch} routes to the decision itself.`);
+          if (!ids.has(t.decision)) {
+            fail3(`${branch} routes to decision ${t.decision}, which isn't in decisions.`);
+          }
+        }
+        const key2 = t.agent !== undefined ? `agent:${t.agent}` : `decision:${t.decision}`;
+        if (seen.has(key2))
+          fail3(`${branch} routes to ${key2.replace(":", " ")} twice.`);
+        seen.add(key2);
+      }
+    };
+    for (const a3 of d3.answers)
+      checkTargets(a3.to, `answer "${a3.answer}"`);
+    checkTargets(d3.fallback, "fallback");
+  }
+}
+function unknownDecisionModels(manifest) {
+  const known = new Set(DECISION_MODELS);
+  return manifestDecisions(manifest).filter((d3) => !known.has(d3.model)).map((d3) => ({ name: d3.name, model: d3.model }));
+}
 function buildOrchestrationGraphPayload(manifest, slugToAgentId) {
   const memberSlugs = new Set(manifest.members.map((m3) => m3.slug));
   for (const e2 of manifest.edges) {
@@ -83664,6 +83955,32 @@ function buildOrchestrationGraphPayload(manifest, slugToAgentId) {
     }))
   };
 }
+function buildDecisionsPayload(manifest, slugToAgentId) {
+  const decisions = manifestDecisions(manifest, slugToAgentId);
+  validateDecisions(decisions, new Set(manifest.members.map((m3) => m3.slug)), new Set((manifest.triggers ?? []).map((t) => canonicalUuid2(t.node_id))));
+  return decisions.map((d3) => decisionPayload(d3, slugToAgentId));
+}
+function decisionPayload(d3, slugToAgentId) {
+  const route = (answer, t) => ({
+    answer,
+    is_fallback: answer === null,
+    ...t.agent !== undefined ? { to_agent_id: slugToAgentId.get(t.agent) } : { to_decision_id: t.decision },
+    description: t.description
+  });
+  return {
+    id: d3.id,
+    name: d3.name,
+    model: d3.model,
+    instructions: d3.instructions,
+    answers: d3.answers.map((a3) => ({ answer: a3.answer, criterion: a3.criterion })),
+    confidence_threshold: d3.confidence_threshold,
+    inputs: d3.triggers.map((nodeId) => ({ from_trigger_node_id: nodeId })),
+    routes: [
+      ...d3.answers.flatMap((a3) => a3.to.map((t) => route(a3.answer, t))),
+      ...d3.fallback.map((t) => route(null, t))
+    ]
+  };
+}
 
 // src/cli/orchestration-push.ts
 function joinList(items) {
@@ -83791,7 +84108,21 @@ async function runOrchestrationPush(cwd2, args) {
   const metaOverwrites = metaDecisions.filter((d3) => d3.kind === "push");
   const metaKept = metaDecisions.filter((d3) => d3.kind === "keep");
   const blockedTriggers = triggerDecision.kind === "blocked" ? triggerDecision : null;
-  if (blockedTriggers || metaConflicts.length > 0) {
+  const localDecisions = manifestDecisions(manifest, slugToAgentId);
+  const cloudDecisionList = cloudDecisions(cloud, slugForAgent);
+  const decisionPlan = cloudDecisionList ? decideDecisionReconcile({
+    local: localDecisions,
+    cloud: cloudDecisionList,
+    baseline: lock?.decisions,
+    force: !!args.force
+  }) : null;
+  const decisionById = new Map([...cloudDecisionList ?? [], ...localDecisions].map((d3) => [d3.id, d3]));
+  const decisionLabelFor = (id) => {
+    const d3 = decisionById.get(id);
+    return d3 ? decisionLabel(d3) : id;
+  };
+  const blockedDecisions = decisionPlan?.kind === "blocked" ? decisionPlan : null;
+  if (blockedTriggers || blockedDecisions || metaConflicts.length > 0) {
     const pullTargets = [];
     const forceEffects = [];
     if (blockedTriggers) {
@@ -83810,6 +84141,22 @@ async function runOrchestrationPush(cwd2, args) {
       pullTargets.push(`${total} schedule trigger${total === 1 ? "" : "s"}`);
       forceEffects.push("make your local schedule triggers authoritative (deleting the cloud ones above)");
     }
+    if (blockedDecisions) {
+      const { unseen, cloudModified, staleArchives } = blockedDecisions;
+      f2.error(unseen.length > 0 ? "Cannot push: the cloud has decisions this folder has never seen." : "Cannot push: decisions changed both locally and in the cloud.");
+      for (const id of unseen) {
+        console.error(`  ${import_picocolors53.default.red("!")} ${import_picocolors53.default.bold(decisionLabelFor(id))} ${import_picocolors53.default.dim("(only in the cloud — pushing would delete it)")}`);
+      }
+      for (const id of cloudModified) {
+        console.error(`  ${import_picocolors53.default.red("!")} ${import_picocolors53.default.bold(decisionLabelFor(id))} ${import_picocolors53.default.dim("(edited in the cloud — pushing would overwrite that edit)")}`);
+      }
+      for (const id of staleArchives) {
+        console.error(`  ${import_picocolors53.default.red("!")} ${import_picocolors53.default.bold(decisionLabelFor(id))} ${import_picocolors53.default.dim("(deleted here, edited in the cloud since — pushing would delete that edit)")}`);
+      }
+      const total = unseen.length + cloudModified.length + staleArchives.length;
+      pullTargets.push(`${total} decision${total === 1 ? "" : "s"}`);
+      forceEffects.push("make your local decisions authoritative (deleting or overwriting the cloud ones above)");
+    }
     if (metaConflicts.length > 0) {
       f2.error("Cannot push: orchestration metadata changed both locally and in the cloud.");
       for (const d3 of metaConflicts) {
@@ -83842,9 +84189,30 @@ async function runOrchestrationPush(cwd2, args) {
     f2.warn(`${cloudTriggers.length} cloud schedule trigger${cloudTriggers.length === 1 ? "" : "s"} ${cloudTriggers.length === 1 ? "is" : "are"} not in ${import_picocolors53.default.bold(ORCH_MANIFEST_FILE)} and will be left untouched. Run ${import_picocolors53.default.cyan("brainbase orchestration pull")} to manage ${cloudTriggers.length === 1 ? "it" : "them"} from here.`);
   }
   const triggerDeletes = triggerDecision.kind === "reconcile" ? triggerDecision.archives : [];
+  const decisionDeletes = decisionPlan?.kind === "reconcile" ? decisionPlan.archives : [];
+  const sendDecisions = decisionPlan?.kind === "reconcile" && (localDecisions.length > 0 || decisionDeletes.length > 0);
+  if (!cloudDecisionList && localDecisions.length > 0) {
+    f2.warn(`The cloud did not return decision nodes for this account, so the ${localDecisions.length} decision${localDecisions.length === 1 ? "" : "s"} in ${import_picocolors53.default.bold(ORCH_MANIFEST_FILE)} ${localDecisions.length === 1 ? "is" : "are"} left out of this push and the cloud's are left alone.`);
+  } else if (decisionPlan?.kind === "skip") {
+    const left = decisionPlan.unseen.length + decisionPlan.cloudModified.length;
+    f2.warn(`${left} cloud decision${left === 1 ? "" : "s"} ${left === 1 ? "is" : "are"} not in ${import_picocolors53.default.bold(ORCH_MANIFEST_FILE)} and will be left untouched. Run ${import_picocolors53.default.cyan("brainbase orchestration pull")} to manage ${left === 1 ? "it" : "them"} from here.`);
+  }
+  let decisionsPayload = [];
+  if (sendDecisions) {
+    try {
+      decisionsPayload = buildDecisionsPayload(manifest, slugToAgentId);
+    } catch (err) {
+      f2.error(err.message);
+      process.exitCode = 1;
+      return;
+    }
+    for (const { name, model } of unknownDecisionModels(manifest)) {
+      f2.warn(`Decision ${import_picocolors53.default.bold(name)} uses model ${import_picocolors53.default.bold(model)}, which is not one the canvas offers. It is pushed as written; if the gateway does not know it, the decision fails when its trigger fires.`);
+    }
+  }
   const plan = [""];
   plan.push(`  ${import_picocolors53.default.bold(link2.name)} ${import_picocolors53.default.dim(`(${link2.orchestration_id})`)}`);
-  plan.push(`  ${import_picocolors53.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}`)}`);
+  plan.push(`  ${import_picocolors53.default.dim(`${manifest.members.length} member${manifest.members.length === 1 ? "" : "s"}, ${manifest.edges.length} edge${manifest.edges.length === 1 ? "" : "s"}, ${graph.triggers.length} trigger${graph.triggers.length === 1 ? "" : "s"}${sendDecisions ? `, ${decisionsPayload.length} decision${decisionsPayload.length === 1 ? "" : "s"}` : ""}`)}`);
   plan.push("");
   if (!args.graphOnly) {
     plan.push(`  ${import_picocolors53.default.dim("per-member agent push:")}`);
@@ -83860,6 +84228,13 @@ async function runOrchestrationPush(cwd2, args) {
     }
     plan.push("");
   }
+  if (decisionDeletes.length) {
+    plan.push(`  ${import_picocolors53.default.bold("decisions this push will delete")} ${import_picocolors53.default.dim(`(${decisionDeletes.length})`)}`);
+    for (const id of decisionDeletes) {
+      plan.push(`    ${import_picocolors53.default.yellow("⨯")} ${decisionLabelFor(id)}`);
+    }
+    plan.push("");
+  }
   if (metaOverwrites.length) {
     plan.push(`  ${import_picocolors53.default.bold("orchestration metadata this push will overwrite")}`);
     for (const m3 of metaOverwrites) {
@@ -83878,9 +84253,13 @@ async function runOrchestrationPush(cwd2, args) {
   console.log(plan.join(`
 `));
   if (!autoProceed(args.yes)) {
+    const deletions = [
+      ...triggerDeletes.length ? [`${triggerDeletes.length} schedule trigger${triggerDeletes.length === 1 ? "" : "s"}`] : [],
+      ...decisionDeletes.length ? [`${decisionDeletes.length} decision${decisionDeletes.length === 1 ? "" : "s"}`] : []
+    ];
     const ok = await se({
-      message: triggerDeletes.length ? `Push, deleting ${triggerDeletes.length} schedule trigger${triggerDeletes.length === 1 ? "" : "s"}?` : args.graphOnly ? "Push graph (members, edges + triggers) only?" : "Push each member, then update the graph?",
-      initialValue: triggerDeletes.length === 0
+      message: deletions.length ? `Push, deleting ${joinList(deletions)}?` : args.graphOnly ? "Push graph (members, edges + triggers) only?" : "Push each member, then update the graph?",
+      initialValue: deletions.length === 0
     });
     if (!ensureNotCancelled(ok)) {
       $e("Aborted.");
@@ -83926,9 +84305,11 @@ async function runOrchestrationPush(cwd2, args) {
       members: graph.memberIds,
       edges: graph.edges,
       triggers: graph.triggers,
+      ...sendDecisions ? { decisions: decisionsPayload } : {},
       ...lock?.revision != null ? { base_revision: lock.revision } : {}
     });
     sp.stop(`Graph updated. New cloud revision ${updated.revision}.`);
+    const settledDecisions = sendDecisions ? cloudDecisions(updated, slugForAgent) : decisionPlan?.kind === "reconcile" ? cloudDecisionList : null;
     writeOrchSyncState(cwd2, {
       schemaVersion: 1,
       orchestration_id: updated.id,
@@ -83946,6 +84327,7 @@ async function runOrchestrationPush(cwd2, args) {
         payload_schema: e2.payload_schema ?? {}
       })),
       triggers: triggerDecision.kind === "skip" ? lock?.triggers ?? [] : syncedScheduleTriggers(cloudScheduleTriggers(updated, slugForAgent)),
+      ...settledDecisions ? { decisions: syncedDecisions(settledDecisions) } : lock?.decisions ? { decisions: lock.decisions } : {},
       meta: nextOrchestrationMeta({
         applied: updated,
         decisions: metaDecisions,
@@ -84118,6 +84500,64 @@ async function runOrchestrationStatus(cwd2) {
     lines.push(`  ${import_picocolors54.default.dim(`${left.length} cloud schedule trigger${left.length === 1 ? "" : "s"} not managed by this manifest — push leaves ${left.length === 1 ? "it" : "them"} untouched`)}`);
     lines.push("");
   }
+  const localDecisions = manifestDecisions(localManifest, new Map([...localSlugByAgentId].map(([agentId, slug]) => [slug, agentId])));
+  const cloudDecisionList = cloudDecisions(cloud, slugForAgent);
+  let decisionsToPush = [];
+  let decisionsToPull = [];
+  if (!cloudDecisionList) {
+    if (localDecisions.length) {
+      lines.push(`  ${import_picocolors54.default.dim(`${localDecisions.length} decision${localDecisions.length === 1 ? "" : "s"} in yaml, but the cloud does not show decision nodes to this account — push leaves ${localDecisions.length === 1 ? "it" : "them"} alone`)}`);
+      lines.push("");
+    }
+  } else {
+    const decisionPlan = decideDecisionReconcile({
+      local: localDecisions,
+      cloud: cloudDecisionList,
+      baseline: lock?.decisions,
+      force: false
+    });
+    const byId = new Map([...cloudDecisionList, ...localDecisions].map((d3) => [d3.id, d3]));
+    const label2 = (id) => {
+      const d3 = byId.get(id);
+      return d3 ? decisionLabel(d3) : id;
+    };
+    const localIds = new Set(localDecisions.map((d3) => d3.id));
+    const cloudById = new Map(cloudDecisionList.map((d3) => [d3.id, d3]));
+    decisionsToPush = localDecisions.filter((d3) => {
+      const remote = cloudById.get(d3.id);
+      return !remote || decisionHash(remote) !== decisionHash(d3);
+    });
+    decisionsToPull = cloudDecisionList.filter((d3) => !localIds.has(d3.id));
+    const decisionDeletes = decisionPlan.kind === "reconcile" ? decisionPlan.archives : [];
+    if (decisionsToPush.length || decisionsToPull.length) {
+      lines.push(`  ${import_picocolors54.default.bold("decisions")}`);
+      for (const d3 of decisionsToPush) {
+        lines.push(`    ${import_picocolors54.default.yellow("→ push")}  added/changed in yaml: ${decisionLabel(d3)}`);
+      }
+      for (const d3 of decisionsToPull) {
+        lines.push(decisionDeletes.includes(d3.id) ? `    ${import_picocolors54.default.red("⨯ push deletes")}  ${decisionLabel(d3)}` : `    ${import_picocolors54.default.cyan("← pull")}  only on cloud: ${decisionLabel(d3)}`);
+      }
+      lines.push("");
+    }
+    if (decisionPlan.kind === "blocked") {
+      lines.push(`  ${import_picocolors54.default.bold(import_picocolors54.default.red("decisions: push blocked"))}`);
+      for (const id of decisionPlan.unseen) {
+        lines.push(`    ${import_picocolors54.default.red("!")} ${label2(id)} ${import_picocolors54.default.dim("— only in the cloud; pushing would delete it")}`);
+      }
+      for (const id of decisionPlan.cloudModified) {
+        lines.push(`    ${import_picocolors54.default.red("!")} ${label2(id)} ${import_picocolors54.default.dim("— edited in the cloud; pushing would overwrite that edit")}`);
+      }
+      for (const id of decisionPlan.staleArchives) {
+        lines.push(`    ${import_picocolors54.default.red("!")} ${label2(id)} ${import_picocolors54.default.dim("— deleted here, edited in the cloud since; pushing would delete that edit")}`);
+      }
+      lines.push(`    ${import_picocolors54.default.dim("run")} ${import_picocolors54.default.cyan("brainbase orchestration pull")} ${import_picocolors54.default.dim("first")}`);
+      lines.push("");
+    } else if (decisionPlan.kind === "skip") {
+      const left = untouchedRows(decisionPlan);
+      lines.push(`  ${import_picocolors54.default.dim(`${left.length} cloud decision${left.length === 1 ? "" : "s"} not managed by this manifest — push leaves ${left.length === 1 ? "it" : "them"} untouched`)}`);
+      lines.push("");
+    }
+  }
   const lockByAgentId = new Map((lock?.members ?? []).map((m3) => [m3.agent_id, m3]));
   const memberDrift = [];
   for (const m3 of cloud.members) {
@@ -84151,7 +84591,7 @@ async function runOrchestrationStatus(cwd2) {
     lines.push(`    ${import_picocolors54.default.cyan("← pull")}  cloud changed since last pull: ${import_picocolors54.default.dim(`lock ${lock.revision} → cloud ${cloud.revision}`)}`);
     lines.push("");
   }
-  if (!membersAdded.length && !membersRemoved.length && !edgesAdded.length && !edgesRemoved.length && !triggersToPush.length && !triggersToPull.length && !metaDecisions.length && !memberDrift.length && !revisionDrift) {
+  if (!membersAdded.length && !membersRemoved.length && !edgesAdded.length && !edgesRemoved.length && !triggersToPush.length && !triggersToPull.length && !decisionsToPush.length && !decisionsToPull.length && !metaDecisions.length && !memberDrift.length && !revisionDrift) {
     lines.push(`  ${import_picocolors54.default.green("✓")} everything is in sync`);
     lines.push("");
     console.log(lines.join(`
@@ -84506,6 +84946,10 @@ async function runOrchestrationCreate(cwd2, args) {
         payload_schema: e2.payload_schema ?? {}
       }))
     });
+    const decisionCount = manifest.decisions?.length ?? 0;
+    if (decisionCount) {
+      f2.info(`Run ${import_picocolors57.default.cyan("brainbase orchestration push")} to add the ${decisionCount} decision${decisionCount === 1 ? "" : "s"} in this manifest.`);
+    }
     $e(`Created ${created.name} at revision ${created.revision}.`);
   } catch (err) {
     sp.stop("Failed.");
@@ -85764,7 +86208,324 @@ function printTokenHelp() {
 }
 
 // src/cli/integrations.ts
+var import_picocolors63 = __toESM(require_picocolors(), 1);
+
+// src/cli/integration-context.ts
 var import_picocolors62 = __toESM(require_picocolors(), 1);
+
+// src/core/integration-contexts-api.ts
+var REQUEST_TIMEOUT_MS2 = 30000;
+var TOKEN_REFUSED_MESSAGE = "Integration contexts can only be created or ended with your own `brainbase login` session, and BRAINBASE_TOKEN is set. " + "Personal access tokens and task keys cannot create or end them. Unset BRAINBASE_TOKEN and run `brainbase login`.";
+async function resolveHumanSession() {
+  if (process.env.BRAINBASE_TOKEN?.trim()) {
+    throw new ApiError(TOKEN_REFUSED_MESSAGE, 401);
+  }
+  const session = await ensureFreshSession();
+  if (session)
+    return session;
+  const stored = readToken() ? ` The PAT saved in ${TOKEN_FILE} cannot create or end integration contexts.` : "";
+  const problem = readAuth() ? "Your login session has expired and could not be renewed." : "Not logged in.";
+  throw new ApiError(`${problem} Run \`brainbase login\`.${stored}`, 401);
+}
+async function contextRequest(pathname, body, operation) {
+  const session = await resolveHumanSession();
+  const base2 = masControlPlaneBaseUrl(session);
+  const send = async (refreshed) => {
+    const current = refreshed ?? session;
+    try {
+      return await fetch(`${masControlPlaneBaseUrl(current)}/v2${pathname}`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${current.access_token}`,
+          Accept: "application/json",
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2)
+      });
+    } catch (err) {
+      throw new ApiError(`Network error: ${err.message}`);
+    }
+  };
+  const res = await sendWithAuthRetry(session, send);
+  let text3;
+  try {
+    text3 = await res.text();
+  } catch (err) {
+    throw new ApiError(`Network error while reading the response: ${err.message}`);
+  }
+  let parsed = text3;
+  try {
+    parsed = text3 ? JSON.parse(text3) : null;
+  } catch {}
+  if (!res.ok) {
+    throw new ApiError(contextErrorMessage(res.status, parsed, operation, base2), res.status, parsed);
+  }
+  return parsed;
+}
+function nonEmptyString(value2) {
+  return typeof value2 === "string" && value2.length > 0;
+}
+function absentOrString(value2) {
+  return value2 === undefined || typeof value2 === "string";
+}
+function isCreatedContext(value2) {
+  const body = record(value2);
+  return !!body && nonEmptyString(body.context_id) && nonEmptyString(body.renewal_handle) && absentOrString(body.renewal_expires_at) && absentOrString(body.max_expires_at);
+}
+function isEndedContext(value2) {
+  return typeof record(value2)?.state === "string";
+}
+function contextErrorMessage(status, body, operation, base2) {
+  const detail = record(body)?.detail;
+  if (status === 404) {
+    if (detail === "Not Found") {
+      return `Standalone integration contexts are not enabled on this Brainbase deployment (${hostOf(base2)}).`;
+    }
+    if (detail === "agent not found" && operation.kind === "create") {
+      return `Agent ${operation.agentId} was not found, or you cannot manage it. Creating an integration context needs management rights on the agent.`;
+    }
+    if (detail === "integration context not found" && operation.kind === "end") {
+      return `Integration context ${operation.contextId} was not found, or you cannot manage its agent.`;
+    }
+  }
+  if (status === 403 && record(detail)?.code === "human_credential_required") {
+    return "Brainbase refused this credential: integration contexts can only be created or ended with your own `brainbase login` session. Run `brainbase login` and try again.";
+  }
+  if (status === 401) {
+    return `Brainbase did not accept your login session (${sanitizeLabel(masApiErrorMessage(body, status))}). Run \`brainbase login\` to sign in again.`;
+  }
+  if (status === 422) {
+    const fields = fastApiValidationMessage(body);
+    if (fields)
+      return `Brainbase rejected the request: ${fields}`;
+  }
+  return sanitizeLabel(masApiErrorMessage(body, status));
+}
+function hostOf(base2) {
+  try {
+    return new URL(base2).host;
+  } catch {
+    return sanitizeLabel(base2);
+  }
+}
+var integrationContextsApi = {
+  async create(input) {
+    const created = await contextRequest("/integration-contexts", input, {
+      kind: "create",
+      agentId: input.agent_id
+    });
+    if (!isCreatedContext(created)) {
+      throw new ApiError("Brainbase answered without a context id and renewal handle.");
+    }
+    return created;
+  },
+  async end(contextId, reason) {
+    const ended = await contextRequest(`/integration-contexts/${encodeURIComponent(contextId)}/end`, { reason }, { kind: "end", contextId });
+    if (!isEndedContext(ended)) {
+      throw new ApiError("Brainbase answered without the context state.");
+    }
+    return ended;
+  }
+};
+
+// src/cli/integration-context.ts
+var MIN_LIFETIME_S = 60;
+var MAX_LIFETIME_S = 30 * 24 * 60 * 60;
+var DEFAULT_LIFETIME_S = 7 * 24 * 60 * 60;
+var DEFAULT_END_REASON = "ended with brainbase integrations context end";
+var MAX_REASON_LENGTH2 = 200;
+var APPLICATION_PATTERN = /^[a-z0-9][a-z0-9._:/-]{0,119}$/;
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UNIT_SECONDS = { "": 1, s: 1, m: 60, h: 3600, d: 86400 };
+var CONTEXT_USAGE = `Usage: brainbase integrations context <create|end> [--json]
+
+  create [--agent <id>] --application <name> [--max-lifetime <dur>]
+      Let a program outside Brainbase (the Brainbase SDK) use the agent's
+      integrations on your behalf. Prints a renewal handle once: store it in
+      that program's secret store. It rotates on every renewal, so the program
+      must keep the newest one.
+      --agent         the agent's id; defaults to the agent this folder is linked to
+      --application   names the program: up to 120 of a-z 0-9 . _ : / -,
+                      starting with a letter or digit (e.g. billing-sync)
+      --max-lifetime  when the context ends at the latest: 60s to 30d, as
+                      seconds or <n>s, <n>m, <n>h, <n>d. Default 7d.
+
+  end <context-id> [--reason <text>]
+      End a context now. Its renewal handle and access grants stop working.
+      --reason        recorded with the context, 1-200 characters
+                      (default "${DEFAULT_END_REASON}")
+
+Both need your own \`brainbase login\` session and management rights on the
+agent. BRAINBASE_TOKEN and the PAT saved by \`brainbase token create\` are refused.
+`;
+async function runIntegrationContext(cwd2, argv, options) {
+  const { write: write3, fail: fail3 } = options;
+  const [action, ...rest2] = argv;
+  const parsed = parseContextArgs(rest2, "--application", "--max-lifetime", "--reason");
+  if (action === "help" || action === "--help" || action === "-h" || "help" in parsed) {
+    write3(CONTEXT_USAGE);
+    return 0;
+  }
+  if (action !== "create" && action !== "end") {
+    const problem = action ? `Unknown integrations context subcommand: ${sanitizeLabel(action)}.` : "Missing integrations context subcommand.";
+    return fail3(`${problem} ${CONTEXT_USAGE.split(`
+`)[0]}`);
+  }
+  if ("error" in parsed)
+    return fail3(parsed.error);
+  const { values: values2, positionals } = parsed;
+  if (action === "create") {
+    if (positionals.length > 0)
+      return fail3(`Unexpected argument: ${sanitizeLabel(positionals[0])}. ${CREATE_USAGE}`);
+    if (values2.has("--reason"))
+      return fail3(`--reason is for \`context end\`. ${CREATE_USAGE}`);
+    const target = cloudTargetAgent(cwd2, options);
+    if (!target)
+      return fail3(NO_AGENT_MESSAGE);
+    if ("error" in target)
+      return fail3(target.error);
+    if (!UUID_PATTERN.test(target.agentId)) {
+      return fail3(`${sanitizeLabel(target.agentId)} is not an agent id. --agent takes the agent's UUID, as \`brainbase agent list\` shows it.`);
+    }
+    const agentId = target.agentId.toLowerCase();
+    const application = values2.get("--application");
+    if (application === undefined)
+      return fail3(`--application is required. ${CREATE_USAGE}`);
+    if (!APPLICATION_PATTERN.test(application)) {
+      return fail3(`--application must be 1-120 characters of lowercase letters, digits and . _ : / -, starting with a letter or digit (e.g. billing-sync); got "${sanitizeLabel(application)}".`);
+    }
+    const rawLifetime = values2.get("--max-lifetime");
+    const lifetime = rawLifetime === undefined ? DEFAULT_LIFETIME_S : parseMaxLifetime(rawLifetime);
+    if (typeof lifetime !== "number")
+      return fail3(lifetime.error);
+    let created;
+    try {
+      created = await integrationContextsApi.create({
+        agent_id: agentId,
+        application,
+        max_lifetime_s: lifetime
+      });
+    } catch (err) {
+      return fail3(`brainbase integrations context create failed: ${message(err)}`);
+    }
+    if (options.json) {
+      write3(JSON.stringify(created) + `
+`);
+      return 0;
+    }
+    write3(renderCreated(created, agentId, application));
+    return 0;
+  }
+  if (values2.has("--application") || values2.has("--max-lifetime")) {
+    return fail3(`--application and --max-lifetime are for \`context create\`. ${END_USAGE}`);
+  }
+  if (positionals.length !== 1)
+    return fail3(END_USAGE);
+  const contextId = positionals[0];
+  if (!UUID_PATTERN.test(contextId)) {
+    return fail3(`${sanitizeLabel(contextId)} is not a context id. Pass the context_id \`context create\` printed.`);
+  }
+  const reason = (values2.get("--reason") ?? DEFAULT_END_REASON).trim();
+  const reasonLength = [...reason].length;
+  if (reasonLength < 1 || reasonLength > MAX_REASON_LENGTH2) {
+    return fail3(`--reason must be 1-${MAX_REASON_LENGTH2} characters; got ${reasonLength}.`);
+  }
+  let ended;
+  try {
+    ended = await integrationContextsApi.end(contextId.toLowerCase(), reason);
+  } catch (err) {
+    return fail3(`brainbase integrations context end failed: ${message(err)}`);
+  }
+  const id = contextId.toLowerCase();
+  if (options.json) {
+    write3(JSON.stringify({ context_id: id, ...ended }) + `
+`);
+    return 0;
+  }
+  const state = sanitizeLabel(ended.state);
+  write3(state === "ended" ? `${import_picocolors62.default.green("✓")} Ended integration context ${id}. Its renewal handle and access grants no longer work.
+` : `Integration context ${id} is ${state}. Its renewal handle and access grants no longer work.
+`);
+  return 0;
+}
+var CREATE_USAGE = "Usage: brainbase integrations context create [--agent <id>] --application <name> [--max-lifetime <dur>]";
+var END_USAGE = "Usage: brainbase integrations context end <context-id> [--reason <text>]";
+function parseContextArgs(rest2, ...valueFlags) {
+  for (let i = 0;i < rest2.length; i++) {
+    if (valueFlags.includes(rest2[i]))
+      i++;
+    else if (rest2[i] === "--help" || rest2[i] === "-h")
+      return { help: true };
+  }
+  const values2 = new Map;
+  const positionals = [];
+  for (let i = 0;i < rest2.length; i++) {
+    const arg = rest2[i];
+    const eq = arg.indexOf("=");
+    const name = arg.startsWith("--") && eq > 0 ? arg.slice(0, eq) : arg;
+    if (valueFlags.includes(name)) {
+      let value2;
+      if (name !== arg) {
+        value2 = arg.slice(eq + 1);
+      } else {
+        value2 = rest2[i + 1];
+        if (value2 === undefined || name !== "--reason" && value2.startsWith("-")) {
+          return { error: `${name} needs a value.` };
+        }
+        i++;
+      }
+      if (values2.has(name))
+        return { error: `${name} was given more than once.` };
+      values2.set(name, value2);
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      return { error: `Unknown option for brainbase integrations context: ${sanitizeLabel(arg)}` };
+    }
+    positionals.push(arg);
+  }
+  return { values: values2, positionals };
+}
+function parseMaxLifetime(raw) {
+  const match = /^(\d+)([smhd]?)$/i.exec(raw.trim());
+  if (!match) {
+    return { error: `--max-lifetime takes seconds or a duration such as 90m, 12h or 7d; got "${sanitizeLabel(raw)}".` };
+  }
+  const seconds = Number(match[1]) * UNIT_SECONDS[match[2].toLowerCase()];
+  if (!Number.isSafeInteger(seconds) || seconds < MIN_LIFETIME_S || seconds > MAX_LIFETIME_S) {
+    return {
+      error: `--max-lifetime must be between 60s and 30d (${MAX_LIFETIME_S} seconds); got "${sanitizeLabel(raw)}".`
+    };
+  }
+  return seconds;
+}
+function renderCreated(created, agentId, application) {
+  const id = sanitizeLabel(created.context_id);
+  const lines = [
+    `${import_picocolors62.default.green("✓")} Created integration context ${id}`,
+    `  ${import_picocolors62.default.dim(`agent ${agentId} · application ${application}`)}`,
+    "",
+    "  Renewal handle:",
+    "",
+    `    ${sanitizeLabel(created.renewal_handle)}`,
+    "",
+    import_picocolors62.default.yellow("  Store it now in the SDK program's secret store: it is shown only this once, and it rotates on every renewal, so the program must save the newest handle each time."),
+    "",
+    `  Handle expires  ${sanitizeLabel(created.renewal_expires_at ?? "unknown")}`,
+    `  Context ends    ${sanitizeLabel(created.max_expires_at ?? "unknown")}  ${import_picocolors62.default.dim("(its maximum lifetime)")}`,
+    "",
+    import_picocolors62.default.dim(`  End it sooner with \`brainbase integrations context end ${id}\`.`),
+    ""
+  ];
+  return lines.join(`
+`);
+}
+function message(err) {
+  return sanitizeLabel(err?.message ?? String(err));
+}
+
+// src/cli/integrations.ts
 var EFFECTS = ["allow", "ask", "deny"];
 var USAGE = `Usage: brainbase integrations <command> [--agent <id>] [--json]
 
@@ -85776,6 +86537,12 @@ var USAGE = `Usage: brainbase integrations <command> [--agent <id>] [--json]
   disconnect <app>              delete the app's connected account [--account <id>] [--yes]
   remove <app>                  uninstall an app that needs no account
   allow|ask|deny <app>[.<action>]  set the permission for an app or one action
+  context create --application <name> [--max-lifetime <dur>]
+                                let a program outside Brainbase (the SDK) use the agent's
+                                integrations; prints a renewal handle once. Lifetime 60s-30d, default 7d
+  context end <context-id> [--reason <text>]
+                                end a standalone integration context now
+                                (\`brainbase integrations context --help\` for details)
 `;
 var POLL_INTERVAL_MS2 = 2000;
 var MAX_CONSECUTIVE_POLL_FAILURES2 = 5;
@@ -85785,12 +86552,12 @@ async function runIntegrations(cwd2, sub, argv, options) {
   const write3 = options.write ?? ((s3) => process.stdout.write(s3));
   const writeErr = options.writeErr ?? ((s3) => process.stderr.write(s3));
   const api4 = { ...integrationsApi, ...options.api };
-  const fail3 = (message) => {
+  const fail3 = (message2) => {
     if (options.json)
-      write3(JSON.stringify({ error: message }) + `
+      write3(JSON.stringify({ error: message2 }) + `
 `);
     else
-      writeErr(message + `
+      writeErr(message2 + `
 `);
     return 1;
   };
@@ -85799,6 +86566,15 @@ async function runIntegrations(cwd2, sub, argv, options) {
 ` : human);
     return 0;
   };
+  if (sub === "context") {
+    return await runIntegrationContext(cwd2, argv, {
+      json: options.json,
+      agentId: options.agentId,
+      resolveAgentId: options.resolveAgentId,
+      write: write3,
+      fail: fail3
+    });
+  }
   const isHelpFlag = (s3) => s3 === "--help" || s3 === "-h";
   if (sub === "help" || isHelpFlag(sub) || argv.some(isHelpFlag)) {
     write3(USAGE);
@@ -85824,7 +86600,7 @@ ${USAGE}`);
       const apps = await api4.searchApps(arg);
       return out({ apps }, renderSearch(apps));
     } catch (err) {
-      return fail3(`brainbase integrations search failed: ${message(err)}`);
+      return fail3(`brainbase integrations search failed: ${message2(err)}`);
     }
   }
   const target = cloudTargetAgent(cwd2, options);
@@ -85851,7 +86627,7 @@ ${USAGE}`);
         return await setEffect(agentId, sub, arg);
     }
   } catch (err) {
-    return fail3(`brainbase integrations ${sub} failed: ${message(err)}`);
+    return fail3(`brainbase integrations ${sub} failed: ${message2(err)}`);
   }
   async function list3(agentId2) {
     const [accounts, noAuthApps, permissions] = await Promise.all([
@@ -85904,7 +86680,7 @@ ${USAGE}`);
     if (needsAccount(app))
       return await connect2(agentId2, slug, app);
     const added = await api4.addNoAuthApp(agentId2, slug);
-    return out({ app: added.appSlug, name: added.name, needs_account: false, added: true }, `${import_picocolors62.default.green("✓")} Added ${import_picocolors62.default.bold(label2(added.name))}. It needs no account; your agent can use it on its next turn.
+    return out({ app: added.appSlug, name: added.name, needs_account: false, added: true }, `${import_picocolors63.default.green("✓")} Added ${import_picocolors63.default.bold(label2(added.name))}. It needs no account; your agent can use it on its next turn.
 `);
   }
   async function connect2(agentId2, slug, known2) {
@@ -85924,20 +86700,20 @@ ${USAGE}`);
       return 0;
     }
     const interactive = options.interactive ?? isInteractive();
-    write3(`Open this link to connect ${import_picocolors62.default.bold(name)}:
+    write3(`Open this link to connect ${import_picocolors63.default.bold(name)}:
 
-  ${import_picocolors62.default.cyan(url2)}
+  ${import_picocolors63.default.cyan(url2)}
 
 `);
-    write3(import_picocolors62.default.dim(`Anyone with this link can connect an account to this agent until it expires, so do not share it.
+    write3(import_picocolors63.default.dim(`Anyone with this link can connect an account to this agent until it expires, so do not share it.
 `));
     if (!options.noOpen && interactive) {
-      write3(import_picocolors62.default.dim(`Opening your browser…
+      write3(import_picocolors63.default.dim(`Opening your browser…
 `));
       (options.openUrl ?? openInBrowser)(url2);
     }
     if (options.noWait) {
-      write3(import_picocolors62.default.dim("Not waiting. Run `brainbase integrations list` to see when it is connected.\n"));
+      write3(import_picocolors63.default.dim("Not waiting. Run `brainbase integrations list` to see when it is connected.\n"));
       return 0;
     }
     const controller = new AbortController;
@@ -85970,7 +86746,7 @@ ${USAGE}`);
       if (spinner2)
         spinner2.stop(text3, ok ? 0 : 2);
       else if (ok)
-        write3(`${import_picocolors62.default.green("✔")} ${text3}
+        write3(`${import_picocolors63.default.green("✔")} ${text3}
 `);
       else
         writeErr(`${text3}
@@ -86010,11 +86786,11 @@ ${USAGE}`);
     const confirm = options.confirmDisconnect ?? promptForDisconnect;
     const accountLabel = account.name ? `${label2(account.name)} (${account.id})` : account.id;
     if (!await confirm(`Disconnect ${label2(slug)} account ${accountLabel}? Everyone using this agent loses it.`, options.yes)) {
-      return out({ app: slug, account_id: account.id, disconnected: false, outcome: "declined" }, `  ${import_picocolors62.default.dim("Left alone.")}
+      return out({ app: slug, account_id: account.id, disconnected: false, outcome: "declined" }, `  ${import_picocolors63.default.dim("Left alone.")}
 `);
     }
     await api4.deleteAccount(agentId2, account.id);
-    return out({ app: slug, account_id: account.id, disconnected: true }, `${import_picocolors62.default.green("✓")} Disconnected ${import_picocolors62.default.bold(label2(slug))} account ${accountLabel}.
+    return out({ app: slug, account_id: account.id, disconnected: true }, `${import_picocolors63.default.green("✓")} Disconnected ${import_picocolors63.default.bold(label2(slug))} account ${accountLabel}.
 `);
   }
   async function remove2(agentId2, slug) {
@@ -86027,7 +86803,7 @@ ${USAGE}`);
       return fail3(`${label2(slug)} is not installed on this agent.`);
     }
     await api4.removeNoAuthApp(agentId2, slug);
-    return out({ app: slug, removed: true }, `${import_picocolors62.default.green("✓")} Removed ${import_picocolors62.default.bold(label2(slug))}.
+    return out({ app: slug, removed: true }, `${import_picocolors63.default.green("✓")} Removed ${import_picocolors63.default.bold(label2(slug))}.
 `);
   }
   async function setEffect(agentId2, effect, raw) {
@@ -86040,7 +86816,7 @@ ${USAGE}`);
     const capability = pattern(appSlug(app), action);
     await api4.setPermission(agentId2, capability, effect);
     const scope = action ? `${label2(action)} on ${label2(app)}` : `every ${label2(app)} action without its own rule`;
-    return out({ capability_pattern: capability, effect }, `${import_picocolors62.default.green("✓")} ${capability} → ${import_picocolors62.default.bold(effect)}  ${import_picocolors62.default.dim(`(${scope})`)}
+    return out({ capability_pattern: capability, effect }, `${import_picocolors63.default.green("✓")} ${capability} → ${import_picocolors63.default.bold(effect)}  ${import_picocolors63.default.dim(`(${scope})`)}
 `);
   }
 }
@@ -86050,7 +86826,7 @@ function appSlug(raw) {
 function label2(s3) {
   return sanitizeLabel(s3);
 }
-function message(err) {
+function message2(err) {
   return sanitizeLabel(err?.message ?? String(err));
 }
 function needsAccount(app) {
@@ -86093,27 +86869,27 @@ async function promptForDisconnect(question, yes) {
   return ensureNotCancelled(answer);
 }
 var EFFECT_COLOR = {
-  allow: import_picocolors62.default.green,
-  ask: import_picocolors62.default.yellow,
-  deny: import_picocolors62.default.red
+  allow: import_picocolors63.default.green,
+  ask: import_picocolors63.default.yellow,
+  deny: import_picocolors63.default.red
 };
 function effectLabel(effect, width = 0) {
-  return (EFFECT_COLOR[effect] ?? import_picocolors62.default.dim)(sanitizeLabel(effect).padEnd(width));
+  return (EFFECT_COLOR[effect] ?? import_picocolors63.default.dim)(sanitizeLabel(effect).padEnd(width));
 }
 function renderList(rows, permissions) {
   const lines = [""];
   if (!permissions.permissionsAvailable) {
-    lines.push(import_picocolors62.default.yellow("  Integrations only work on Kafka agents for now; this agent cannot use them."), "");
+    lines.push(import_picocolors63.default.yellow("  Integrations only work on Kafka agents for now; this agent cannot use them."), "");
   }
   if (rows.length === 0) {
-    lines.push(import_picocolors62.default.dim("  No integrations on this agent."));
-    lines.push(import_picocolors62.default.dim("  Find one with `brainbase integrations search <query>`, then `brainbase integrations add <app>`."), "");
+    lines.push(import_picocolors63.default.dim("  No integrations on this agent."));
+    lines.push(import_picocolors63.default.dim("  Find one with `brainbase integrations search <query>`, then `brainbase integrations add <app>`."), "");
     return lines.join(`
 `);
   }
   for (const row of rows) {
     const healthy = row.accounts.every((a3) => a3.healthy);
-    const mark = healthy ? import_picocolors62.default.green("✓") : import_picocolors62.default.yellow("!");
+    const mark = healthy ? import_picocolors63.default.green("✓") : import_picocolors63.default.yellow("!");
     const bits = [sanitizeLabel(row.name)];
     if (!row.needs_account)
       bits.push("no account needed");
@@ -86121,35 +86897,35 @@ function renderList(rows, permissions) {
       bits.push(`account ${account.name ? sanitizeLabel(account.name) : account.id}${account.healthy ? "" : " (needs reconnecting)"}`);
     }
     const effect = row.effect ?? permissions.defaultEffect;
-    lines.push(`  ${mark} ${import_picocolors62.default.bold(sanitizeLabel(row.app))}  ${import_picocolors62.default.dim(bits.join(" · "))}  ${effectLabel(effect)}${row.effect ? "" : import_picocolors62.default.dim(" (default)")}`);
+    lines.push(`  ${mark} ${import_picocolors63.default.bold(sanitizeLabel(row.app))}  ${import_picocolors63.default.dim(bits.join(" · "))}  ${effectLabel(effect)}${row.effect ? "" : import_picocolors63.default.dim(" (default)")}`);
   }
-  lines.push("", import_picocolors62.default.dim("  Run `brainbase integrations actions <app>` to see and set per-action permissions."), "");
+  lines.push("", import_picocolors63.default.dim("  Run `brainbase integrations actions <app>` to see and set per-action permissions."), "");
   return lines.join(`
 `);
 }
 function renderSearch(apps) {
   if (apps.length === 0)
-    return import_picocolors62.default.dim("No apps match.") + `
+    return import_picocolors63.default.dim("No apps match.") + `
 `;
   const lines = [""];
   for (const app of apps) {
-    const hint = needsAccount(app) ? "" : import_picocolors62.default.dim("  no account needed");
-    lines.push(`  ${import_picocolors62.default.bold(sanitizeLabel(app.nameSlug))}  ${sanitizeLabel(app.name)}${hint}`);
+    const hint = needsAccount(app) ? "" : import_picocolors63.default.dim("  no account needed");
+    lines.push(`  ${import_picocolors63.default.bold(sanitizeLabel(app.nameSlug))}  ${sanitizeLabel(app.name)}${hint}`);
   }
-  lines.push("", import_picocolors62.default.dim("  Add one with `brainbase integrations add <app>`."), "");
+  lines.push("", import_picocolors63.default.dim("  Add one with `brainbase integrations add <app>`."), "");
   return lines.join(`
 `);
 }
 function renderActions(slug, rows) {
   if (rows.length === 0)
-    return import_picocolors62.default.dim(`No actions found for ${sanitizeLabel(slug)}.`) + `
+    return import_picocolors63.default.dim(`No actions found for ${sanitizeLabel(slug)}.`) + `
 `;
   const lines = [""];
   for (const row of rows) {
-    const source = import_picocolors62.default.dim((row.source === "action" ? "" : `(${row.source})`).padEnd(9));
-    lines.push(`  ${effectLabel(row.effect, 5)} ${source} ${import_picocolors62.default.bold(sanitizeLabel(row.key))}  ${import_picocolors62.default.dim(sanitizeLabel(row.name))}`);
+    const source = import_picocolors63.default.dim((row.source === "action" ? "" : `(${row.source})`).padEnd(9));
+    lines.push(`  ${effectLabel(row.effect, 5)} ${source} ${import_picocolors63.default.bold(sanitizeLabel(row.key))}  ${import_picocolors63.default.dim(sanitizeLabel(row.name))}`);
   }
-  lines.push("", import_picocolors62.default.dim(`  Change one with \`brainbase integrations allow|ask|deny ${sanitizeLabel(slug)}.<action>\`, or the whole app with \`… ${sanitizeLabel(slug)}\`.`), "");
+  lines.push("", import_picocolors63.default.dim(`  Change one with \`brainbase integrations allow|ask|deny ${sanitizeLabel(slug)}.<action>\`, or the whole app with \`… ${sanitizeLabel(slug)}\`.`), "");
   return lines.join(`
 `);
 }
@@ -86213,14 +86989,14 @@ async function waitForAccount(agentId, slug, before2, options) {
 }
 
 // src/cli/task.ts
-var import_picocolors68 = __toESM(require_picocolors(), 1);
+var import_picocolors69 = __toESM(require_picocolors(), 1);
 
 // src/cli/task-create.ts
-var import_picocolors64 = __toESM(require_picocolors(), 1);
+var import_picocolors65 = __toESM(require_picocolors(), 1);
 import { randomUUID as randomUUID4 } from "node:crypto";
 
 // src/cli/task-update.ts
-var import_picocolors63 = __toESM(require_picocolors(), 1);
+var import_picocolors64 = __toESM(require_picocolors(), 1);
 var TASK_UPDATE_USAGE = "brainbase task update <task-id> [--title <text> | --clear-title] [--metadata key=value]... [--unset-metadata <key>]... [--clear-metadata] [--model <id> | --clear-model] [--json]";
 var TITLE_MAX = 200;
 var MODEL_UNSUPPORTED = "This control plane does not support changing a task's model yet.";
@@ -86359,25 +87135,25 @@ function applyLabelEdit(current, edit) {
 }
 function format(task) {
   const lines = [""];
-  const title = task.title?.trim() ? sanitizeLabel(task.title) : import_picocolors63.default.dim("(untitled)");
-  lines.push(`  ${import_picocolors63.default.green("updated")}  ${import_picocolors63.default.bold(title)}`);
+  const title = task.title?.trim() ? sanitizeLabel(task.title) : import_picocolors64.default.dim("(untitled)");
+  lines.push(`  ${import_picocolors64.default.green("updated")}  ${import_picocolors64.default.bold(title)}`);
   lines.push("");
-  lines.push(`  ${import_picocolors63.default.dim("task")}     ${sanitizeLabel(task.id)}`);
+  lines.push(`  ${import_picocolors64.default.dim("task")}     ${sanitizeLabel(task.id)}`);
   if (task.model !== undefined) {
-    const model = task.model?.trim() ? sanitizeLabel(task.model) : import_picocolors63.default.dim("agent default");
-    lines.push(`  ${import_picocolors63.default.dim("model")}    ${model}`);
+    const model = task.model?.trim() ? sanitizeLabel(task.model) : import_picocolors64.default.dim("agent default");
+    lines.push(`  ${import_picocolors64.default.dim("model")}    ${model}`);
   }
   const metadata = Object.entries(task.metadata ?? {});
   lines.push("");
-  lines.push(`  ${import_picocolors63.default.bold(import_picocolors63.default.dim("METADATA"))}`);
+  lines.push(`  ${import_picocolors64.default.bold(import_picocolors64.default.dim("METADATA"))}`);
   if (metadata.length === 0) {
-    lines.push(`  ${import_picocolors63.default.dim("none")}`);
+    lines.push(`  ${import_picocolors64.default.dim("none")}`);
   }
   for (const [key2, value2] of metadata) {
-    lines.push(`  ${import_picocolors63.default.dim(sanitizeLabel(key2))}  ${sanitizeLabel(value2)}`);
+    lines.push(`  ${import_picocolors64.default.dim(sanitizeLabel(key2))}  ${sanitizeLabel(value2)}`);
   }
   lines.push("");
-  lines.push(`  ${import_picocolors63.default.dim("read it with")} ${import_picocolors63.default.cyan(`brainbase task get ${sanitizeLabel(task.id)}`)}`, "");
+  lines.push(`  ${import_picocolors64.default.dim("read it with")} ${import_picocolors64.default.cyan(`brainbase task get ${sanitizeLabel(task.id)}`)}`, "");
   return lines.join(`
 `);
 }
@@ -86423,13 +87199,13 @@ async function resolveAgentId2(cwd2, agentId, interfaceId, readLocalManifest) {
   return manifest.id;
 }
 function isPublishScopeError(error2) {
-  const message2 = error2 instanceof Error ? error2.message : String(error2);
+  const message3 = error2 instanceof Error ? error2.message : String(error2);
   const body = error2 && typeof error2 === "object" && "body" in error2 ? JSON.stringify(error2.body) : "";
-  return /PAT lacks required scope:\s*publish/i.test(`${message2} ${body}`);
+  return /PAT lacks required scope:\s*publish/i.test(`${message3} ${body}`);
 }
 async function runTaskCreate(cwd2, options, dependencies = {}) {
   const idempotencyKey = (dependencies.randomUUID ?? randomUUID4)();
-  const message2 = requiredValue(options.message, "--message");
+  const message3 = requiredValue(options.message, "--message");
   const interfaceId = optionalValue(options.interfaceId, "--interface");
   const agentId = await resolveAgentId2(cwd2, options.agentId, interfaceId, dependencies.readManifest ?? readManifest);
   const title = optionalValue(options.title, "--title");
@@ -86439,7 +87215,7 @@ async function runTaskCreate(cwd2, options, dependencies = {}) {
   const version2 = versionRef ? (await agentVersionsApi.resolve(agentId, versionRef)).version : undefined;
   const input = {
     agent_id: agentId,
-    initial_messages: [{ role: "user", content: message2 }],
+    initial_messages: [{ role: "user", content: message3 }],
     auto_run: true,
     ...title ? { title } : {},
     ...model ? { default_model: model } : {},
@@ -86515,24 +87291,24 @@ async function waitForCreatedTask(created, options, dependencies, version2) {
       return;
     }
     if (outcome.kind === "timeout") {
-      console.log(import_picocolors64.default.yellow(`Timed out after ${options.timeoutSeconds}s with the task still ${status}.`));
+      console.log(import_picocolors65.default.yellow(`Timed out after ${options.timeoutSeconds}s with the task still ${status}.`));
       return;
     }
     if (outcome.kind === "interrupted") {
-      console.log(import_picocolors64.default.yellow("Interrupted. The task is still running."));
+      console.log(import_picocolors65.default.yellow("Interrupted. The task is still running."));
       return;
     }
-    console.log(code === 0 ? import_picocolors64.default.green("Task completed.") : import_picocolors64.default.red(`Task finished as ${status}.`));
+    console.log(code === 0 ? import_picocolors65.default.green("Task completed.") : import_picocolors65.default.red(`Task finished as ${status}.`));
   } finally {
     process.removeListener("SIGINT", onSigint);
   }
 }
 
 // src/cli/task-get.ts
-var import_picocolors66 = __toESM(require_picocolors(), 1);
+var import_picocolors67 = __toESM(require_picocolors(), 1);
 
 // src/cli/task-list.ts
-var import_picocolors65 = __toESM(require_picocolors(), 1);
+var import_picocolors66 = __toESM(require_picocolors(), 1);
 
 // src/core/agent-names.ts
 async function agentNames(ids) {
@@ -86597,29 +87373,29 @@ function labelFilter(options) {
 function formatTaskList(tasks, names, agentId, interfaceId, labelFiltered = false) {
   const lines = [""];
   if (tasks.length === 0 && labelFiltered) {
-    lines.push(`  ${import_picocolors65.default.dim("No tasks carry every label given with --metadata.")}`, "");
+    lines.push(`  ${import_picocolors66.default.dim("No tasks carry every label given with --metadata.")}`, "");
     return lines.join(`
 `);
   }
   if (tasks.length === 0 && interfaceId) {
     const id = sanitizeLabel(interfaceId);
-    lines.push(`  ${import_picocolors65.default.dim(`No build conversations for interface ${id}.`)}`, "", `  ${import_picocolors65.default.dim("start one with")} ${import_picocolors65.default.cyan(`brainbase interface build ${id} "..."`)}`, "");
+    lines.push(`  ${import_picocolors66.default.dim(`No build conversations for interface ${id}.`)}`, "", `  ${import_picocolors66.default.dim("start one with")} ${import_picocolors66.default.cyan(`brainbase interface build ${id} "..."`)}`, "");
     return lines.join(`
 `);
   }
   if (tasks.length === 0) {
-    lines.push(`  ${import_picocolors65.default.dim(agentId ? `No tasks for agent ${agentId}.` : "No tasks yet.")}`, "", `  ${import_picocolors65.default.dim("start one with")} ${import_picocolors65.default.cyan('brainbase task create --message "..."')}`, "");
+    lines.push(`  ${import_picocolors66.default.dim(agentId ? `No tasks for agent ${agentId}.` : "No tasks yet.")}`, "", `  ${import_picocolors66.default.dim("start one with")} ${import_picocolors66.default.cyan('brainbase task create --message "..."')}`, "");
     return lines.join(`
 `);
   }
   for (const task of tasks) {
-    const title = sanitizeLabel(task.title ?? "").trim() || import_picocolors65.default.dim("(untitled)");
-    lines.push(`  ${statusLabel(task.status)}  ${import_picocolors65.default.bold(title)}`);
-    lines.push(`    ${import_picocolors65.default.dim(sanitizeLabel(task.id))}`);
-    lines.push(`    ${import_picocolors65.default.dim(`agent ${agentLabel(task.agent_id, names)} · created ${sanitizeLabel(task.created_at)}`)}`);
+    const title = sanitizeLabel(task.title ?? "").trim() || import_picocolors66.default.dim("(untitled)");
+    lines.push(`  ${statusLabel(task.status)}  ${import_picocolors66.default.bold(title)}`);
+    lines.push(`    ${import_picocolors66.default.dim(sanitizeLabel(task.id))}`);
+    lines.push(`    ${import_picocolors66.default.dim(`agent ${agentLabel(task.agent_id, names)} · created ${sanitizeLabel(task.created_at)}`)}`);
     lines.push("");
   }
-  lines.push(`  ${import_picocolors65.default.dim("inspect one with")} ${import_picocolors65.default.cyan("brainbase task get <id>")}`, "");
+  lines.push(`  ${import_picocolors66.default.dim("inspect one with")} ${import_picocolors66.default.cyan("brainbase task get <id>")}`, "");
   return lines.join(`
 `);
 }
@@ -86627,16 +87403,16 @@ function statusLabel(status) {
   const padded = sanitizeLabel(status).padEnd(14);
   switch (status) {
     case "success":
-      return import_picocolors65.default.green(padded);
+      return import_picocolors66.default.green(padded);
     case "fail":
-      return import_picocolors65.default.red(padded);
+      return import_picocolors66.default.red(padded);
     case "need_more_info":
-      return import_picocolors65.default.yellow(padded);
+      return import_picocolors66.default.yellow(padded);
     case "running":
     case "initializing":
-      return import_picocolors65.default.cyan(padded);
+      return import_picocolors66.default.cyan(padded);
     default:
-      return import_picocolors65.default.dim(padded);
+      return import_picocolors66.default.dim(padded);
   }
 }
 
@@ -86670,60 +87446,60 @@ async function readEvalRuns(task) {
 }
 function format2(task, evals, names) {
   const lines = [""];
-  const title = sanitizeLabel(task.title ?? "").trim() || import_picocolors66.default.dim("(untitled)");
+  const title = sanitizeLabel(task.title ?? "").trim() || import_picocolors67.default.dim("(untitled)");
   const id = sanitizeLabel(task.id);
-  lines.push(`  ${statusLabel(task.status)}  ${import_picocolors66.default.bold(title)}`);
+  lines.push(`  ${statusLabel(task.status)}  ${import_picocolors67.default.bold(title)}`);
   lines.push("");
-  lines.push(`  ${import_picocolors66.default.dim("task")}     ${id}`);
-  lines.push(`  ${import_picocolors66.default.dim("agent")}    ${agentLabel(task.agent_id, names)}`);
+  lines.push(`  ${import_picocolors67.default.dim("task")}     ${id}`);
+  lines.push(`  ${import_picocolors67.default.dim("agent")}    ${agentLabel(task.agent_id, names)}`);
   if (task.model !== undefined) {
-    const model = task.model?.trim() ? sanitizeLabel(task.model) : import_picocolors66.default.dim("agent default");
-    lines.push(`  ${import_picocolors66.default.dim("model")}    ${model}`);
+    const model = task.model?.trim() ? sanitizeLabel(task.model) : import_picocolors67.default.dim("agent default");
+    lines.push(`  ${import_picocolors67.default.dim("model")}    ${model}`);
   }
-  lines.push(`  ${import_picocolors66.default.dim("created")}  ${sanitizeLabel(task.created_at)}`);
+  lines.push(`  ${import_picocolors67.default.dim("created")}  ${sanitizeLabel(task.created_at)}`);
   if (task.parent_task_id) {
-    lines.push(`  ${import_picocolors66.default.dim("parent")}   ${sanitizeLabel(task.parent_task_id)}`);
+    lines.push(`  ${import_picocolors67.default.dim("parent")}   ${sanitizeLabel(task.parent_task_id)}`);
   }
   if (task.machine_id) {
     const size2 = task.machine_size ? ` (size ${sanitizeLabel(task.machine_size)})` : "";
-    lines.push(`  ${import_picocolors66.default.dim("machine")}  ${sanitizeLabel(task.machine_id)}${size2}`);
+    lines.push(`  ${import_picocolors67.default.dim("machine")}  ${sanitizeLabel(task.machine_id)}${size2}`);
   }
   if (task.sandbox_id)
-    lines.push(`  ${import_picocolors66.default.dim("sandbox")}  ${sanitizeLabel(task.sandbox_id)}`);
+    lines.push(`  ${import_picocolors67.default.dim("sandbox")}  ${sanitizeLabel(task.sandbox_id)}`);
   const [failure, ...failureRest] = sanitizeLines(failureSummary(task) ?? "").filter((line2) => line2.trim());
   if (failure) {
     const label3 = "  failure  ";
     lines.push("");
-    lines.push(`  ${import_picocolors66.default.red("failure")}  ${failure}`);
+    lines.push(`  ${import_picocolors67.default.red("failure")}  ${failure}`);
     for (const line2 of failureRest)
       lines.push(`${" ".repeat(label3.length)}${line2}`);
   }
   const metadata = Object.entries(task.metadata ?? {});
   if (metadata.length > 0) {
     lines.push("");
-    lines.push(`  ${import_picocolors66.default.bold(import_picocolors66.default.dim("METADATA"))}`);
+    lines.push(`  ${import_picocolors67.default.bold(import_picocolors67.default.dim("METADATA"))}`);
     for (const [key2, value2] of metadata) {
-      lines.push(`  ${import_picocolors66.default.dim(sanitizeLabel(key2))}  ${sanitizeLabel(String(value2))}`);
+      lines.push(`  ${import_picocolors67.default.dim(sanitizeLabel(key2))}  ${sanitizeLabel(String(value2))}`);
     }
   }
   lines.push("");
-  lines.push(`  ${import_picocolors66.default.bold(import_picocolors66.default.dim("EVAL VERDICTS"))}`);
+  lines.push(`  ${import_picocolors67.default.bold(import_picocolors67.default.dim("EVAL VERDICTS"))}`);
   if (evals.unavailable) {
-    lines.push(`  ${import_picocolors66.default.dim(sanitizeLabel(evals.unavailable))}`);
+    lines.push(`  ${import_picocolors67.default.dim(sanitizeLabel(evals.unavailable))}`);
   } else if (evals.runs.length === 0) {
-    lines.push(`  ${import_picocolors66.default.dim("none")}`);
+    lines.push(`  ${import_picocolors67.default.dim("none")}`);
   } else {
     for (const run of evals.runs) {
-      const verdict = run.passed === true ? import_picocolors66.default.green("pass") : run.passed === false ? import_picocolors66.default.red("fail") : import_picocolors66.default.dim(sanitizeLabel(run.status));
+      const verdict = run.passed === true ? import_picocolors67.default.green("pass") : run.passed === false ? import_picocolors67.default.red("fail") : import_picocolors67.default.dim(sanitizeLabel(run.status));
       lines.push(`  ${verdict}  ${sanitizeLabel(run.eval_slug ?? run.eval_id)}`);
       for (const line2 of sanitizeLines(run.reasoning ?? "")) {
         if (line2.trim())
-          lines.push(`    ${import_picocolors66.default.dim(line2)}`);
+          lines.push(`    ${import_picocolors67.default.dim(line2)}`);
       }
     }
   }
   lines.push("");
-  lines.push(`  ${import_picocolors66.default.dim("read its transcript with")} ${import_picocolors66.default.cyan(`brainbase task logs ${id}`)}`, "");
+  lines.push(`  ${import_picocolors67.default.dim("read its transcript with")} ${import_picocolors67.default.cyan(`brainbase task logs ${id}`)}`, "");
   return lines.join(`
 `);
 }
@@ -86740,7 +87516,7 @@ function failureSummary(task) {
 }
 
 // src/cli/task-logs.ts
-var import_picocolors67 = __toESM(require_picocolors(), 1);
+var import_picocolors68 = __toESM(require_picocolors(), 1);
 
 // src/core/task-events.ts
 var DEFAULT_RETRY_BUDGET_MS = 60000;
@@ -86816,12 +87592,12 @@ function followTaskEvents(options) {
       onOpen?.();
     });
     source.addEventListener("error", (event) => {
-      const { message: message2, code } = event;
+      const { message: message3, code } = event;
       if (source.readyState === source.CLOSED) {
-        finish(streamError(message2, code));
+        finish(streamError(message3, code));
         return;
       }
-      lastReason = message2?.trim() || "connection lost";
+      lastReason = message3?.trim() || "connection lost";
       onReconnect?.(lastReason);
       if (downTimer === undefined) {
         downTimer = setTimeout(() => {
@@ -86841,8 +87617,8 @@ function parseFrameData(raw) {
     return raw;
   }
 }
-function streamError(message2, code) {
-  const detail = message2?.trim() || "the log stream closed";
+function streamError(message3, code) {
+  const detail = message3?.trim() || "the log stream closed";
   switch (code) {
     case 401:
       return new ApiError(`Not authorized to read this task's events: ${detail}`, 401);
@@ -87023,14 +87799,14 @@ async function runTaskLogs(taskId, options = {}, dependencies = {}) {
     console.log(renderEvent(event, messages));
   }
   if (ordered.length === 0) {
-    console.log(import_picocolors67.default.dim("No events for this task yet."));
+    console.log(import_picocolors68.default.dim("No events for this task yet."));
   }
 }
 async function followTranscript(taskId, options, dependencies) {
   const backfill = options.limit === undefined ? "" : `?backfill=${options.limit}`;
   const { url: url2, resolveBearer } = await masStreamTarget(`/tasks/${encodeURIComponent(taskId)}/events/stream${backfill}`);
   if (!options.json) {
-    console.log(import_picocolors67.default.dim(`Following task ${taskId} — Ctrl-C to stop.`));
+    console.log(import_picocolors68.default.dim(`Following task ${taskId} — Ctrl-C to stop.`));
   }
   const setExitCode = dependencies.setExitCode ?? ((code) => process.exitCode = code);
   const controller = new AbortController;
@@ -87072,13 +87848,13 @@ async function followTranscript(taskId, options, dependencies) {
         } else if (options.json) {
           console.log(JSON.stringify(frame));
         } else {
-          console.log(import_picocolors67.default.dim(frame.type));
+          console.log(import_picocolors68.default.dim(frame.type));
         }
       },
       onOpen: () => settle.noteFrame(),
       onReconnect: (reason) => {
         settle.noteDisconnected();
-        console.error(import_picocolors67.default.dim(`reconnecting — ${reason}`));
+        console.error(import_picocolors68.default.dim(`reconnecting — ${reason}`));
       }
     });
     if (interruptCode !== undefined)
@@ -87234,8 +88010,8 @@ function errorCode(error2) {
   const code = detail.code;
   return typeof code === "string" ? code : undefined;
 }
-function jsonError(error2, message2, status, code) {
-  return { ...errorShape(error2), message: message2, status, ...code ? { code } : {} };
+function jsonError(error2, message3, status, code) {
+  return { ...errorShape(error2), message: message3, status, ...code ? { code } : {} };
 }
 function stopRetryCommand(taskId, generation) {
   const argument = /^[A-Za-z0-9_-]+$/.test(taskId) ? taskId : `'${sanitizeLabel(taskId).replaceAll("'", "'\\''")}'`;
@@ -87285,8 +88061,8 @@ function onInterrupt(handler) {
       process.off(name, listener);
   };
 }
-async function runTaskSend(taskId, message2, options = {}) {
-  if (!message2.trim())
+async function runTaskSend(taskId, message3, options = {}) {
+  if (!message3.trim())
     throw new Error("The follow-up message must not be blank.");
   const inputId = options.inputId?.trim().toLowerCase() ?? randomUUID5();
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(inputId)) {
@@ -87305,7 +88081,7 @@ async function runTaskSend(taskId, message2, options = {}) {
     attempted = true;
     result2 = await masApi.sendTaskInput(taskId, {
       input_id: inputId,
-      messages: [{ role: "user", content: message2 }],
+      messages: [{ role: "user", content: message3 }],
       expected_generation: expectedGeneration
     });
   } catch (error2) {
@@ -87384,17 +88160,17 @@ async function runTaskStop(taskId, options = {}) {
 ${retry}
 Omit --generation only for a deliberately new Stop.`;
     }
-    const message2 = `${detail}${guidance}`;
+    const message3 = `${detail}${guidance}`;
     if (options.json) {
       console.log(JSON.stringify({
         task_id: taskId,
         expected_generation: expectedGeneration,
-        error: jsonError(error2, message2, status, code)
+        error: jsonError(error2, message3, status, code)
       }));
       process.exitCode = 1;
       return;
     }
-    throw new ApiError(message2, status, error2 instanceof ApiError ? error2.body : undefined);
+    throw new ApiError(message3, status, error2 instanceof ApiError ? error2.body : undefined);
   }
   if (options.json) {
     console.log(JSON.stringify({ ...task, expected_generation: expectedGeneration }, null, 2));
@@ -87756,78 +88532,78 @@ ${didYouMean(sub, ["create", "list", "get", "logs", "send", "stop", "update", "d
 function printHelp5() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors68.default.bold("brainbase task")} ${import_picocolors68.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors69.default.bold("brainbase task")} ${import_picocolors69.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.cyan("create")} ${import_picocolors68.default.dim("--message <text>")}   ${import_picocolors68.default.dim("create a task and start its first run")}`);
-  out.push(`  ${import_picocolors68.default.cyan("list | ls")}                ${import_picocolors68.default.dim("recent tasks you can reach (--json for scripts)")}`);
-  out.push(`  ${import_picocolors68.default.cyan("get")} ${import_picocolors68.default.dim("<task-id>")}            ${import_picocolors68.default.dim("one task: status, agent, machine, eval verdicts")}`);
-  out.push(`  ${import_picocolors68.default.cyan("logs")} ${import_picocolors68.default.dim("<task-id> [--follow]")} ${import_picocolors68.default.dim("one line per event in the task's transcript, or tail it live")}`);
-  out.push(`  ${import_picocolors68.default.cyan("send")} ${import_picocolors68.default.dim("<task-id> <message>")} ${import_picocolors68.default.dim("send a follow-up, including while the agent is running")}`);
-  out.push(`  ${import_picocolors68.default.cyan("stop")} ${import_picocolors68.default.dim("<task-id>")}           ${import_picocolors68.default.dim("stop execution and cancel pending follow-ups, retaining their text")}`);
-  out.push(`  ${import_picocolors68.default.cyan("update")} ${import_picocolors68.default.dim("<task-id>")}         ${import_picocolors68.default.dim("rename a task, change its metadata labels, switch its model or reset it to the agent default, including while it runs")}`);
-  out.push(`  ${import_picocolors68.default.cyan("delete")} ${import_picocolors68.default.dim("<task-id>")}         ${import_picocolors68.default.dim("permanently delete a stopped task and tear down its sandbox (--yes to skip the prompt)")}`);
+  out.push(`  ${import_picocolors69.default.cyan("create")} ${import_picocolors69.default.dim("--message <text>")}   ${import_picocolors69.default.dim("create a task and start its first run")}`);
+  out.push(`  ${import_picocolors69.default.cyan("list | ls")}                ${import_picocolors69.default.dim("recent tasks you can reach (--json for scripts)")}`);
+  out.push(`  ${import_picocolors69.default.cyan("get")} ${import_picocolors69.default.dim("<task-id>")}            ${import_picocolors69.default.dim("one task: status, agent, machine, eval verdicts")}`);
+  out.push(`  ${import_picocolors69.default.cyan("logs")} ${import_picocolors69.default.dim("<task-id> [--follow]")} ${import_picocolors69.default.dim("one line per event in the task's transcript, or tail it live")}`);
+  out.push(`  ${import_picocolors69.default.cyan("send")} ${import_picocolors69.default.dim("<task-id> <message>")} ${import_picocolors69.default.dim("send a follow-up, including while the agent is running")}`);
+  out.push(`  ${import_picocolors69.default.cyan("stop")} ${import_picocolors69.default.dim("<task-id>")}           ${import_picocolors69.default.dim("stop execution and cancel pending follow-ups, retaining their text")}`);
+  out.push(`  ${import_picocolors69.default.cyan("update")} ${import_picocolors69.default.dim("<task-id>")}         ${import_picocolors69.default.dim("rename a task, change its metadata labels, switch its model or reset it to the agent default, including while it runs")}`);
+  out.push(`  ${import_picocolors69.default.cyan("delete")} ${import_picocolors69.default.dim("<task-id>")}         ${import_picocolors69.default.dim("permanently delete a stopped task and tear down its sandbox (--yes to skip the prompt)")}`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.bold("create flags")}`);
-  out.push(`  ${import_picocolors68.default.dim("--message <text>")}   required first user message`);
-  out.push(`  ${import_picocolors68.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
-  out.push(`  ${import_picocolors68.default.dim("--interface <id>")}   open it as a build conversation for this interface (agent defaults to the interface's)`);
-  out.push(`  ${import_picocolors68.default.dim("--title <text>")}     optional task title`);
-  out.push(`  ${import_picocolors68.default.dim("--model <id>")}       optional model override`);
-  out.push(`  ${import_picocolors68.default.dim("--version <v>")}      run a saved version of the agent: 12, v12 or a version id (\`agent versions list\`)`);
-  out.push(`  ${import_picocolors68.default.dim("--metadata key=value")} label the task (repeatable)`);
-  out.push(`  ${import_picocolors68.default.dim("--wait")}             block until the task finishes; exit 1 unless it succeeded`);
-  out.push(`  ${import_picocolors68.default.dim("--timeout <secs>")}   give up waiting after <secs> and exit 1 (needs --wait)`);
+  out.push(`  ${import_picocolors69.default.bold("create flags")}`);
+  out.push(`  ${import_picocolors69.default.dim("--message <text>")}   required first user message`);
+  out.push(`  ${import_picocolors69.default.dim("--agent <id>")}       override the claimed agent in brainbase.agent.yaml`);
+  out.push(`  ${import_picocolors69.default.dim("--interface <id>")}   open it as a build conversation for this interface (agent defaults to the interface's)`);
+  out.push(`  ${import_picocolors69.default.dim("--title <text>")}     optional task title`);
+  out.push(`  ${import_picocolors69.default.dim("--model <id>")}       optional model override`);
+  out.push(`  ${import_picocolors69.default.dim("--version <v>")}      run a saved version of the agent: 12, v12 or a version id (\`agent versions list\`)`);
+  out.push(`  ${import_picocolors69.default.dim("--metadata key=value")} label the task (repeatable)`);
+  out.push(`  ${import_picocolors69.default.dim("--wait")}             block until the task finishes; exit 1 unless it succeeded`);
+  out.push(`  ${import_picocolors69.default.dim("--timeout <secs>")}   give up waiting after <secs> and exit 1 (needs --wait)`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.bold("list flags")}`);
-  out.push(`  ${import_picocolors68.default.dim("--agent <id>")}       only this agent's tasks`);
-  out.push(`  ${import_picocolors68.default.dim("--interface <id>")}   only this interface's build conversations (hidden from a plain list)`);
-  out.push(`  ${import_picocolors68.default.dim("--metadata key=value")} only tasks carrying this label (repeatable; all must match)`);
-  out.push(`  ${import_picocolors68.default.dim("--limit <n>")}        cap the page (1-200, server default 50)`);
+  out.push(`  ${import_picocolors69.default.bold("list flags")}`);
+  out.push(`  ${import_picocolors69.default.dim("--agent <id>")}       only this agent's tasks`);
+  out.push(`  ${import_picocolors69.default.dim("--interface <id>")}   only this interface's build conversations (hidden from a plain list)`);
+  out.push(`  ${import_picocolors69.default.dim("--metadata key=value")} only tasks carrying this label (repeatable; all must match)`);
+  out.push(`  ${import_picocolors69.default.dim("--limit <n>")}        cap the page (1-200, server default 50)`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.bold("logs flags")}`);
-  out.push(`  ${import_picocolors68.default.dim("--limit <n>")}        stop after <n> events instead of the whole transcript; with --follow, the first page size`);
-  out.push(`  ${import_picocolors68.default.dim("--follow, -f")}       stay attached and print events as they land, until the task finishes and any queued follow-ups have run`);
+  out.push(`  ${import_picocolors69.default.bold("logs flags")}`);
+  out.push(`  ${import_picocolors69.default.dim("--limit <n>")}        stop after <n> events instead of the whole transcript; with --follow, the first page size`);
+  out.push(`  ${import_picocolors69.default.dim("--follow, -f")}       stay attached and print events as they land, until the task finishes and any queued follow-ups have run`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.bold("update flags")}`);
-  out.push(`  ${import_picocolors68.default.dim("--title <text>")}          new title`);
-  out.push(`  ${import_picocolors68.default.dim("--clear-title")}           remove the title; automatic titling may name the task again on a later turn`);
-  out.push(`  ${import_picocolors68.default.dim("--metadata key=value")}    set one label, keeping the others (repeatable)`);
-  out.push(`  ${import_picocolors68.default.dim("--unset-metadata <key>")}  remove one label (repeatable)`);
-  out.push(`  ${import_picocolors68.default.dim("                         the server applies label edits in one step, so concurrent edits from other clients are kept")}`);
-  out.push(`  ${import_picocolors68.default.dim("--clear-metadata")}        remove every label; with --metadata, the labels become exactly those given`);
-  out.push(`  ${import_picocolors68.default.dim("--model <id>")}            switch the model the task's next turn runs on (the running turn keeps its model)`);
-  out.push(`  ${import_picocolors68.default.dim("--clear-model")}           go back to the agent's default model from the next turn`);
+  out.push(`  ${import_picocolors69.default.bold("update flags")}`);
+  out.push(`  ${import_picocolors69.default.dim("--title <text>")}          new title`);
+  out.push(`  ${import_picocolors69.default.dim("--clear-title")}           remove the title; automatic titling may name the task again on a later turn`);
+  out.push(`  ${import_picocolors69.default.dim("--metadata key=value")}    set one label, keeping the others (repeatable)`);
+  out.push(`  ${import_picocolors69.default.dim("--unset-metadata <key>")}  remove one label (repeatable)`);
+  out.push(`  ${import_picocolors69.default.dim("                         the server applies label edits in one step, so concurrent edits from other clients are kept")}`);
+  out.push(`  ${import_picocolors69.default.dim("--clear-metadata")}        remove every label; with --metadata, the labels become exactly those given`);
+  out.push(`  ${import_picocolors69.default.dim("--model <id>")}            switch the model the task's next turn runs on (the running turn keeps its model)`);
+  out.push(`  ${import_picocolors69.default.dim("--clear-model")}           go back to the agent's default model from the next turn`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.bold("send flags")}`);
-  out.push(`  ${import_picocolors68.default.dim("--input-id <uuid>")}  recover the same request using its original ID and identical message`);
-  out.push(`  ${import_picocolors68.default.dim("                    omit it to send a new follow-up; an unconfirmed receipt is never automatically replayed")}`);
-  out.push(`  ${import_picocolors68.default.dim("                    admission disabled/recovery unavailable means no input was admitted; retry the same ID after recovery")}`);
+  out.push(`  ${import_picocolors69.default.bold("send flags")}`);
+  out.push(`  ${import_picocolors69.default.dim("--input-id <uuid>")}  recover the same request using its original ID and identical message`);
+  out.push(`  ${import_picocolors69.default.dim("                    omit it to send a new follow-up; an unconfirmed receipt is never automatically replayed")}`);
+  out.push(`  ${import_picocolors69.default.dim("                    admission disabled/recovery unavailable means no input was admitted; retry the same ID after recovery")}`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.bold("send and stop flags")}`);
-  out.push(`  ${import_picocolors68.default.dim("--generation <n>")}   retain the printed generation when retrying; defaults to a fresh snapshot for a new operation`);
-  out.push(`  ${import_picocolors68.default.dim("                    Stop errors may follow queued-input cancellation; retry the printed command to avoid stopping newer work")}`);
+  out.push(`  ${import_picocolors69.default.bold("send and stop flags")}`);
+  out.push(`  ${import_picocolors69.default.dim("--generation <n>")}   retain the printed generation when retrying; defaults to a fresh snapshot for a new operation`);
+  out.push(`  ${import_picocolors69.default.dim("                    Stop errors may follow queued-input cancellation; retry the printed command to avoid stopping newer work")}`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.bold("every subcommand")}`);
-  out.push(`  ${import_picocolors68.default.dim("--json")}             machine-readable output — create prints task_id, agent_id and status (with --version, also agent_version_id and version_number); list, get, logs, send, stop and update print the raw records; delete prints id and deleted`);
-  out.push(`  ${import_picocolors68.default.dim("                    send and stop include expected_generation for safe retries; send also reports idempotency_replayed when present")}`);
-  out.push(`  ${import_picocolors68.default.dim("                    logs --follow --json prints one record per line, since a live stream has no end to close on")}`);
+  out.push(`  ${import_picocolors69.default.bold("every subcommand")}`);
+  out.push(`  ${import_picocolors69.default.dim("--json")}             machine-readable output — create prints task_id, agent_id and status (with --version, also agent_version_id and version_number); list, get, logs, send, stop and update print the raw records; delete prints id and deleted`);
+  out.push(`  ${import_picocolors69.default.dim("                    send and stop include expected_generation for safe retries; send also reports idempotency_replayed when present")}`);
+  out.push(`  ${import_picocolors69.default.dim("                    logs --follow --json prints one record per line, since a live stream has no end to close on")}`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.dim("Exit codes with --wait:")} ${import_picocolors68.default.dim("0 succeeded · 1 failed, needs input, or timed out · 130 interrupted")}`);
-  out.push(`  ${import_picocolors68.default.dim("Exit codes with --follow:")} ${import_picocolors68.default.dim("0 task reached a terminal state · 1 stream refused, or unreachable for 60s · 130 interrupted (Ctrl-C) · 143 terminated")}`);
-  out.push(`  ${import_picocolors68.default.dim("Exit codes with send:")} ${import_picocolors68.default.dim("0 queued, dispatching, submitted or completed · 1 unconfirmed, cancelled, failed or request error")}`);
-  out.push(`  ${import_picocolors68.default.dim("Ctrl-C while waiting or following logs detaches; use task stop to cancel remote work.")}`);
+  out.push(`  ${import_picocolors69.default.dim("Exit codes with --wait:")} ${import_picocolors69.default.dim("0 succeeded · 1 failed, needs input, or timed out · 130 interrupted")}`);
+  out.push(`  ${import_picocolors69.default.dim("Exit codes with --follow:")} ${import_picocolors69.default.dim("0 task reached a terminal state · 1 stream refused, or unreachable for 60s · 130 interrupted (Ctrl-C) · 143 terminated")}`);
+  out.push(`  ${import_picocolors69.default.dim("Exit codes with send:")} ${import_picocolors69.default.dim("0 queued, dispatching, submitted or completed · 1 unconfirmed, cancelled, failed or request error")}`);
+  out.push(`  ${import_picocolors69.default.dim("Ctrl-C while waiting or following logs detaches; use task stop to cancel remote work.")}`);
   out.push("");
-  out.push(`  ${import_picocolors68.default.dim("Flag-like values:")} use ${import_picocolors68.default.cyan("--flag=value")} or ${import_picocolors68.default.cyan("--flag -- <value>")}`);
+  out.push(`  ${import_picocolors69.default.dim("Flag-like values:")} use ${import_picocolors69.default.cyan("--flag=value")} or ${import_picocolors69.default.cyan("--flag -- <value>")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/machine.ts
-var import_picocolors71 = __toESM(require_picocolors(), 1);
+var import_picocolors72 = __toESM(require_picocolors(), 1);
 
 // src/cli/machine-list.ts
-var import_picocolors69 = __toESM(require_picocolors(), 1);
+var import_picocolors70 = __toESM(require_picocolors(), 1);
 async function runMachineList(args = {}) {
   if (!args.json)
     banner("machine list — sandboxes you can reach");
@@ -87845,7 +88621,7 @@ async function runMachineList(args = {}) {
 function formatMachineList(machines, includedDead, names = new Map) {
   const lines = [""];
   if (machines.length === 0) {
-    lines.push(`  ${import_picocolors69.default.dim(includedDead ? "No machines." : "No live machines. Pass --all to include torn-down ones.")}`, "");
+    lines.push(`  ${import_picocolors70.default.dim(includedDead ? "No machines." : "No live machines. Pass --all to include torn-down ones.")}`, "");
     return lines.join(`
 `);
   }
@@ -87865,7 +88641,7 @@ function formatMachineList(machines, includedDead, names = new Map) {
   const statusWidth = width((row) => row.status);
   const sizeWidth = width((row) => row.size);
   const agentWidth = width((row) => row.agent);
-  lines.push(`  ${import_picocolors69.default.dim([
+  lines.push(`  ${import_picocolors70.default.dim([
     header.id.padEnd(idWidth),
     header.kind.padEnd(kindWidth),
     header.status.padEnd(statusWidth),
@@ -87881,21 +88657,21 @@ function formatMachineList(machines, includedDead, names = new Map) {
       row.dead ? status : statusTint(row.status, status),
       row.size.padEnd(sizeWidth),
       row.agent.padEnd(agentWidth),
-      import_picocolors69.default.dim(row.age)
+      import_picocolors70.default.dim(row.age)
     ].join("  ");
-    lines.push(`  ${row.dead ? import_picocolors69.default.dim(cells) : cells}`);
+    lines.push(`  ${row.dead ? import_picocolors70.default.dim(cells) : cells}`);
   }
-  lines.push("", `  ${import_picocolors69.default.dim("tear one down with")} ${import_picocolors69.default.cyan("brainbase machine rm <id>")}`, "");
+  lines.push("", `  ${import_picocolors70.default.dim("tear one down with")} ${import_picocolors70.default.cyan("brainbase machine rm <id>")}`, "");
   return lines.join(`
 `);
 }
 function statusTint(status, padded) {
   switch (status) {
     case "running":
-      return import_picocolors69.default.green(padded);
+      return import_picocolors70.default.green(padded);
     case "stopped":
     case "starting":
-      return import_picocolors69.default.yellow(padded);
+      return import_picocolors70.default.yellow(padded);
     default:
       return padded;
   }
@@ -87918,7 +88694,7 @@ function age(createdAt) {
 }
 
 // src/cli/machine-rm.ts
-var import_picocolors70 = __toESM(require_picocolors(), 1);
+var import_picocolors71 = __toESM(require_picocolors(), 1);
 async function runMachineRm(args, dependencies = {}) {
   const setExitCode = dependencies.setExitCode ?? ((code) => process.exitCode = code);
   const machineId = args.machineId?.trim();
@@ -87932,7 +88708,7 @@ async function runMachineRm(args, dependencies = {}) {
     if (args.json) {
       console.log(JSON.stringify({ id: machineId, torn_down: false, outcome: "declined" }, null, 2));
     } else {
-      console.log(`  ${import_picocolors70.default.dim("Left alone.")}`);
+      console.log(`  ${import_picocolors71.default.dim("Left alone.")}`);
     }
     return;
   }
@@ -87950,7 +88726,7 @@ async function promptForTeardown(args) {
     return true;
   if (!args.json) {
     console.log(`
-  ${import_picocolors70.default.red("This destroys the sandbox.")} ${import_picocolors70.default.dim("Anything not committed out of it is lost. The machine row is kept for cost history.")}
+  ${import_picocolors71.default.red("This destroys the sandbox.")} ${import_picocolors71.default.dim("Anything not committed out of it is lost. The machine row is kept for cost history.")}
 `);
   }
   const answer = await se({
@@ -87962,9 +88738,9 @@ async function promptForTeardown(args) {
 function formatMachineRm(machine) {
   const lines = [""];
   if (machine.destroyed_at) {
-    lines.push(`  ${import_picocolors70.default.green("✓")} ${machine.kind} sandbox ${machine.id} is torn down.`, `  ${import_picocolors70.default.dim(`destroyed_at ${machine.destroyed_at}`)}`);
+    lines.push(`  ${import_picocolors71.default.green("✓")} ${machine.kind} sandbox ${machine.id} is torn down.`, `  ${import_picocolors71.default.dim(`destroyed_at ${machine.destroyed_at}`)}`);
   } else {
-    lines.push(`  ${import_picocolors70.default.yellow("!")} ${machine.id} came back without a teardown timestamp (status ${machine.status}).`, `  ${import_picocolors70.default.dim("Re-check with `brainbase machine ls --all` before assuming it stopped billing.")}`);
+    lines.push(`  ${import_picocolors71.default.yellow("!")} ${machine.id} came back without a teardown timestamp (status ${machine.status}).`, `  ${import_picocolors71.default.dim("Re-check with `brainbase machine ls --all` before assuming it stopped billing.")}`);
   }
   lines.push("");
   return lines.join(`
@@ -88005,25 +88781,25 @@ ${didYouMean(sub, ["ls", "rm"], "brainbase machine")}`);
 function printHelp6() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors71.default.bold("brainbase machine")} ${import_picocolors71.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors72.default.bold("brainbase machine")} ${import_picocolors72.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors71.default.cyan("ls")}          ${import_picocolors71.default.dim("list your sandboxes — live ones only unless --all")}`);
-  out.push(`  ${import_picocolors71.default.cyan("rm")} ${import_picocolors71.default.dim("<id>")}    ${import_picocolors71.default.dim("tear a sandbox down (terminal; the row is kept for cost history)")}`);
+  out.push(`  ${import_picocolors72.default.cyan("ls")}          ${import_picocolors72.default.dim("list your sandboxes — live ones only unless --all")}`);
+  out.push(`  ${import_picocolors72.default.cyan("rm")} ${import_picocolors72.default.dim("<id>")}    ${import_picocolors72.default.dim("tear a sandbox down (terminal; the row is kept for cost history)")}`);
   out.push("");
-  out.push(`  ${import_picocolors71.default.dim("--all")}     ${import_picocolors71.default.dim("for ls: include machines already torn down")}`);
-  out.push(`  ${import_picocolors71.default.dim("--limit <n>")} ${import_picocolors71.default.dim("for ls: how many to fetch (1-200, default 50)")}`);
-  out.push(`  ${import_picocolors71.default.dim("--yes, -y")} ${import_picocolors71.default.dim("for rm: skip the confirmation")}`);
-  out.push(`  ${import_picocolors71.default.dim("--json")}    ${import_picocolors71.default.dim("machine-readable output")}`);
+  out.push(`  ${import_picocolors72.default.dim("--all")}     ${import_picocolors72.default.dim("for ls: include machines already torn down")}`);
+  out.push(`  ${import_picocolors72.default.dim("--limit <n>")} ${import_picocolors72.default.dim("for ls: how many to fetch (1-200, default 50)")}`);
+  out.push(`  ${import_picocolors72.default.dim("--yes, -y")} ${import_picocolors72.default.dim("for rm: skip the confirmation")}`);
+  out.push(`  ${import_picocolors72.default.dim("--json")}    ${import_picocolors72.default.dim("machine-readable output")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/interface.ts
-var import_picocolors77 = __toESM(require_picocolors(), 1);
+var import_picocolors78 = __toESM(require_picocolors(), 1);
 
 // src/cli/interface-build.ts
-var import_picocolors72 = __toESM(require_picocolors(), 1);
+var import_picocolors73 = __toESM(require_picocolors(), 1);
 var USAGE2 = 'brainbase interface build <id> "<request>" [--timeout <seconds>] [--idempotency-key <key>] [--json]';
 var SETTLE_TIMEOUT_MS = 120000;
 async function reportingErrors(json3, work) {
@@ -88050,8 +88826,8 @@ function heldBy(row, ownTaskId) {
   const taskId = held.thread_id;
   if (ownTaskId !== undefined && taskId === ownTaskId)
     return null;
-  const message2 = taskId ? `Another build conversation (${safe(taskId)}) is working on this interface. Follow it with \`brainbase task logs ${safe(taskId)} --follow\`, or wait for it to finish and run this again.` : `A build conversation is working on this interface (operation ${safe(held.operation_id)}). Wait for it to finish and run this again.`;
-  return cliRefusal("conflict", "generation_running", message2, {
+  const message3 = taskId ? `Another build conversation (${safe(taskId)}) is working on this interface. Follow it with \`brainbase task logs ${safe(taskId)} --follow\`, or wait for it to finish and run this again.` : `A build conversation is working on this interface (operation ${safe(held.operation_id)}). Wait for it to finish and run this again.`;
+  return cliRefusal("conflict", "generation_running", message3, {
     operation_id: held.operation_id,
     task_id: taskId
   });
@@ -88122,28 +88898,28 @@ function buildExitCode(outcome) {
 function reportBuild(say, interfaceId, outcome, timeoutSeconds) {
   switch (outcome.kind) {
     case "built":
-      say(`  ${import_picocolors72.default.dim("build")}    ${safe(outcome.build.id)} ${import_picocolors72.default.green("succeeded")}`);
+      say(`  ${import_picocolors73.default.dim("build")}    ${safe(outcome.build.id)} ${import_picocolors73.default.green("succeeded")}`);
       say("");
-      say(`  ${import_picocolors72.default.dim("Next:")} ${import_picocolors72.default.cyan(`brainbase interface publish ${safe(interfaceId)}`)}`);
+      say(`  ${import_picocolors73.default.dim("Next:")} ${import_picocolors73.default.cyan(`brainbase interface publish ${safe(interfaceId)}`)}`);
       return;
     case "failed": {
       const reason = outcome.build?.error_summary ?? outcome.operation?.error ?? outcome.operation?.reason ?? null;
-      say(`  ${import_picocolors72.default.dim("build")}    ${outcome.build ? safe(outcome.build.id) : import_picocolors72.default.dim("none")} ${import_picocolors72.default.red("failed")}`);
+      say(`  ${import_picocolors73.default.dim("build")}    ${outcome.build ? safe(outcome.build.id) : import_picocolors73.default.dim("none")} ${import_picocolors73.default.red("failed")}`);
       if (reason)
         say(`  ${safeBlock(reason).split(`
 `).join(`
   `)}`);
-      say(`  ${import_picocolors72.default.dim("Try again with")} ${import_picocolors72.default.cyan(`brainbase interface rebuild ${safe(interfaceId)}`)}`);
+      say(`  ${import_picocolors73.default.dim("Try again with")} ${import_picocolors73.default.cyan(`brainbase interface rebuild ${safe(interfaceId)}`)}`);
       return;
     }
     case "busy":
-      say(`  ${import_picocolors72.default.yellow(safe(outcome.message))}`);
+      say(`  ${import_picocolors73.default.yellow(safe(outcome.message))}`);
       return;
     case "timeout":
-      say(`  ${import_picocolors72.default.yellow(`Still building after ${timeoutSeconds}s.`)} ${import_picocolors72.default.dim(`It keeps going; check \`brainbase interface builds ${safe(interfaceId)}\`.`)}`);
+      say(`  ${import_picocolors73.default.yellow(`Still building after ${timeoutSeconds}s.`)} ${import_picocolors73.default.dim(`It keeps going; check \`brainbase interface builds ${safe(interfaceId)}\`.`)}`);
       return;
     case "interrupted":
-      say(`  ${import_picocolors72.default.yellow("Stopped waiting.")} ${import_picocolors72.default.dim(`The build keeps going; check \`brainbase interface builds ${safe(interfaceId)}\`.`)}`);
+      say(`  ${import_picocolors73.default.yellow("Stopped waiting.")} ${import_picocolors73.default.dim(`The build keeps going; check \`brainbase interface builds ${safe(interfaceId)}\`.`)}`);
       return;
     default: {
       const unreachable = outcome;
@@ -88190,8 +88966,8 @@ async function build(ctx) {
         throw held;
     }
     const reattach = `brainbase task logs ${safe(taskId)} --follow`;
-    say(`  ${import_picocolors72.default.dim("Build conversation")} ${import_picocolors72.default.bold(safe(taskId))} ${import_picocolors72.default.dim(`on ${safe(before2.name)}`)}`);
-    say(`  ${import_picocolors72.default.dim(`If this stops early, reattach with \`${reattach}\`.`)}`);
+    say(`  ${import_picocolors73.default.dim("Build conversation")} ${import_picocolors73.default.bold(safe(taskId))} ${import_picocolors73.default.dim(`on ${safe(before2.name)}`)}`);
+    say(`  ${import_picocolors73.default.dim(`If this stops early, reattach with \`${reattach}\`.`)}`);
     const finish = (result2, exitCode) => {
       if (json3)
         console.log(JSON.stringify({ type: "result", task_id: taskId, ...result2 }));
@@ -88208,13 +88984,13 @@ async function build(ctx) {
       });
     } catch (error2) {
       say("");
-      say(`  ${import_picocolors72.default.red(`Lost the conversation's event stream: ${safe(error2.message)}`)}`);
-      say(`  ${import_picocolors72.default.dim(`Conversation ${safe(taskId)} may still be running. Reattach with`)} ${import_picocolors72.default.cyan(reattach)}`);
+      say(`  ${import_picocolors73.default.red(`Lost the conversation's event stream: ${safe(error2.message)}`)}`);
+      say(`  ${import_picocolors73.default.dim(`Conversation ${safe(taskId)} may still be running. Reattach with`)} ${import_picocolors73.default.cyan(reattach)}`);
       finish({ version_id: null, build_id: null, status: "stream_lost", task_status: null }, 1);
       return;
     }
     if (followExit !== undefined) {
-      say(`  ${import_picocolors72.default.yellow("Stopped following.")} ${import_picocolors72.default.dim(`The conversation keeps running. Reattach with \`${reattach}\`.`)}`);
+      say(`  ${import_picocolors73.default.yellow("Stopped following.")} ${import_picocolors73.default.dim(`The conversation keeps running. Reattach with \`${reattach}\`.`)}`);
       finish({ version_id: null, build_id: null, status: "interrupted", task_status: null }, followExit);
       return;
     }
@@ -88229,7 +89005,7 @@ async function build(ctx) {
       if (settled.kind !== "terminal") {
         const interrupted = settled.kind === "interrupted";
         const status2 = settled.task?.status ?? null;
-        say(`  ${import_picocolors72.default.yellow(interrupted ? "Stopped." : `The conversation is still ${safe(status2 ?? "running")}.`)} ${import_picocolors72.default.dim(`Check it with \`brainbase task get ${safe(taskId)}\`.`)}`);
+        say(`  ${import_picocolors73.default.yellow(interrupted ? "Stopped." : `The conversation is still ${safe(status2 ?? "running")}.`)} ${import_picocolors73.default.dim(`Check it with \`brainbase task get ${safe(taskId)}\`.`)}`);
         finish({ version_id: null, build_id: null, status: interrupted ? "interrupted" : "task_unsettled", task_status: status2 }, interrupted ? SIGINT_EXIT_CODE : 1);
         return;
       }
@@ -88249,36 +89025,36 @@ async function build(ctx) {
       }
       const codes = [exitCodeForTaskStatus(task.status)];
       say("");
-      say(`  ${import_picocolors72.default.dim("conversation")} ${safe(taskId)} ${import_picocolors72.default.dim("ended")} ${safe(task.status)}`);
+      say(`  ${import_picocolors73.default.dim("conversation")} ${safe(taskId)} ${import_picocolors73.default.dim("ended")} ${safe(task.status)}`);
       if (mine?.status === "failed") {
         codes.push(1);
         const why = [mine.reason, mine.error].filter(Boolean).map((part) => safe(part)).join(": ");
-        say(`  ${import_picocolors72.default.red(`This conversation's build work failed${why ? ` (${why})` : ""}.`)}`);
+        say(`  ${import_picocolors73.default.red(`This conversation's build work failed${why ? ` (${why})` : ""}.`)}`);
       } else if (task.status !== "success" && task.status !== "need_more_info") {
-        say(`  ${import_picocolors72.default.red(`The conversation finished as ${safe(task.status)}.`)} ${import_picocolors72.default.dim(`See \`brainbase task logs ${safe(taskId)}\`.`)}`);
+        say(`  ${import_picocolors73.default.red(`The conversation finished as ${safe(task.status)}.`)} ${import_picocolors73.default.dim(`See \`brainbase task logs ${safe(taskId)}\`.`)}`);
       }
       if (task.status === "need_more_info") {
         const question = await lastAgentMessage(taskId);
         say("");
         if (question) {
-          say(`  ${import_picocolors72.default.bold("The agent asks:")}`);
+          say(`  ${import_picocolors73.default.bold("The agent asks:")}`);
           say(`  ${safeBlock(question).split(`
 `).join(`
   `)}`);
         } else {
-          say(`  ${import_picocolors72.default.bold("The agent needs more from you before it can go on.")}`);
+          say(`  ${import_picocolors73.default.bold("The agent needs more from you before it can go on.")}`);
         }
         say("");
-        say(`  ${import_picocolors72.default.dim("Reply with")} ${import_picocolors72.default.cyan(`brainbase task send ${safe(taskId)} "<reply>"`)}`);
-        say(`  ${import_picocolors72.default.dim("then follow it with")} ${import_picocolors72.default.cyan(reattach)}`);
+        say(`  ${import_picocolors73.default.dim("Reply with")} ${import_picocolors73.default.cyan(`brainbase task send ${safe(taskId)} "<reply>"`)}`);
+        say(`  ${import_picocolors73.default.dim("then follow it with")} ${import_picocolors73.default.cyan(reattach)}`);
       }
       let status;
       let buildId = null;
       if (versionId) {
         say("");
-        say(`  ${import_picocolors72.default.dim("version")}  ${safe(versionId)}`);
+        say(`  ${import_picocolors73.default.dim("version")}  ${safe(versionId)}`);
         if (!json3)
-          say(`  ${import_picocolors72.default.dim("Waiting for its build...")}`);
+          say(`  ${import_picocolors73.default.dim("Waiting for its build...")}`);
         const buildKey = `${key2}-build`;
         let outcome;
         try {
@@ -88288,7 +89064,7 @@ async function build(ctx) {
             signal: stop.signal,
             now: deps.now,
             idempotencyKey: buildKey,
-            onStall: () => say(`  ${import_picocolors72.default.yellow("The build looks stalled; still waiting in case another worker picks it up.")}`)
+            onStall: () => say(`  ${import_picocolors73.default.yellow("The build looks stalled; still waiting in case another worker picks it up.")}`)
           });
         } catch (error2) {
           if (error2 instanceof LostResponseError) {
@@ -88304,9 +89080,9 @@ async function build(ctx) {
         status = noVersionStatus(mine?.status === "failed", task.status);
         if (status === "no_version") {
           codes.push(1);
-          say(`  ${import_picocolors72.default.red("The conversation finished without committing a version, so there is nothing to build.")}`);
+          say(`  ${import_picocolors73.default.red("The conversation finished without committing a version, so there is nothing to build.")}`);
         } else if (task.status !== "need_more_info") {
-          say(`  ${import_picocolors72.default.dim("This conversation produced no version, so there is nothing to build.")}`);
+          say(`  ${import_picocolors73.default.dim("This conversation produced no version, so there is nothing to build.")}`);
         }
       }
       if (!json3)
@@ -88321,7 +89097,7 @@ async function build(ctx) {
 var buildCommands = { build };
 
 // src/cli/interface-lifecycle.ts
-var import_picocolors74 = __toESM(require_picocolors(), 1);
+var import_picocolors75 = __toESM(require_picocolors(), 1);
 
 // src/core/org-members.ts
 async function listAllOrgMembers(orgId) {
@@ -88375,7 +89151,7 @@ function membersById(members) {
 }
 
 // src/cli/interface-read.ts
-var import_picocolors73 = __toESM(require_picocolors(), 1);
+var import_picocolors74 = __toESM(require_picocolors(), 1);
 function interfaceState(row) {
   if (row.archived_at)
     return "archived";
@@ -88397,11 +89173,11 @@ function threadsLabel(shared) {
 function stateTint(state) {
   switch (state) {
     case "live":
-      return import_picocolors73.default.green;
+      return import_picocolors74.default.green;
     case "building":
-      return import_picocolors73.default.yellow;
+      return import_picocolors74.default.yellow;
     case "archived":
-      return import_picocolors73.default.dim;
+      return import_picocolors74.default.dim;
     case "draft":
       return (cell) => cell;
     default: {
@@ -88434,7 +89210,7 @@ async function list3(ctx) {
     if (shown.length === 0) {
       const empty = onlyArchived ? "No archived interfaces." : includeArchived ? "No interfaces. Create one with `brainbase interface create`." : await emptyWithoutArchived(agentId);
       console.log(`
-  ${import_picocolors73.default.dim(empty)}
+  ${import_picocolors74.default.dim(empty)}
 `);
       return;
     }
@@ -88447,7 +89223,7 @@ async function list3(ctx) {
       audienceWord(row),
       ago(row.last_edited_at ?? row.created_at, now2)
     ]);
-    console.log(["", ...table(cells, [null, import_picocolors73.default.bold, null, null, null, import_picocolors73.default.dim]), ""].join(`
+    console.log(["", ...table(cells, [null, import_picocolors74.default.bold, null, null, null, import_picocolors74.default.dim]), ""].join(`
 `));
   });
 }
@@ -88481,13 +89257,13 @@ async function get2(ctx) {
     out.push(field("id", safe(row.id)));
     out.push(field("agent", agentLabel(safe(row.agent_id), await agentNames([row.agent_id]))));
     out.push(field("state", stateTint(state)(state)));
-    out.push(field("address", row.live_release ? safe(row.live_release.url) : `${safe(row.slug)} ${import_picocolors73.default.dim("(nothing live yet)")}`));
+    out.push(field("address", row.live_release ? safe(row.live_release.url) : `${safe(row.slug)} ${import_picocolors74.default.dim("(nothing live yet)")}`));
     out.push(field("audience", audienceLabel(row)));
     out.push(field("threads", threadsLabel(row.share_agent_threads)));
-    out.push(field("live", row.live_release ? `${safe(row.live_release.id)} ${import_picocolors73.default.dim(`published ${ago(row.live_release.published_at)}`)}` : import_picocolors73.default.dim("none")));
-    out.push(field("draft", row.draft_version_id ? safe(row.draft_version_id) : import_picocolors73.default.dim("none yet")));
+    out.push(field("live", row.live_release ? `${safe(row.live_release.id)} ${import_picocolors74.default.dim(`published ${ago(row.live_release.published_at)}`)}` : import_picocolors74.default.dim("none")));
+    out.push(field("draft", row.draft_version_id ? safe(row.draft_version_id) : import_picocolors74.default.dim("none yet")));
     if (row.running_generation) {
-      out.push(field("building", `conversation ${safe(row.running_generation.thread_id ?? "")} ${import_picocolors73.default.dim(`(follow it with \`brainbase task logs ${safe(row.running_generation.thread_id ?? "")} --follow\`)`)}`));
+      out.push(field("building", `conversation ${safe(row.running_generation.thread_id ?? "")} ${import_picocolors74.default.dim(`(follow it with \`brainbase task logs ${safe(row.running_generation.thread_id ?? "")} --follow\`)`)}`));
     }
     if (row.archived_at)
       out.push(field("archived", ago(row.archived_at)));
@@ -88516,7 +89292,7 @@ async function open(ctx) {
     }
     console.log(safe(url2));
     if (new URL(url2).hostname.endsWith("vercel.app")) {
-      console.error(import_picocolors73.default.yellow("This is the raw Vercel deployment address, which sits behind Vercel protection and will not open for viewers. The control plane has no public interfaces domain configured."));
+      console.error(import_picocolors74.default.yellow("This is the raw Vercel deployment address, which sits behind Vercel protection and will not open for viewers. The control plane has no public interfaces domain configured."));
     }
   });
 }
@@ -88554,7 +89330,7 @@ async function history(ctx, name) {
     banner(`interface ${name} — ${safe(id)}`);
     if (rows.length === 0) {
       console.log(`
-  ${import_picocolors73.default.dim(`No ${name} yet.`)}
+  ${import_picocolors74.default.dim(`No ${name} yet.`)}
 `);
       return;
     }
@@ -88631,7 +89407,7 @@ function exactlyOne(parsed, flags) {
 }
 function peopleLine(access, members) {
   const ids = grantIds(access);
-  return ids.length ? namesOf(ids, members) : import_picocolors74.default.dim("nobody named");
+  return ids.length ? namesOf(ids, members) : import_picocolors75.default.dim("nobody named");
 }
 function printAccess(row, access, members) {
   console.log([
@@ -88692,8 +89468,8 @@ async function create3(ctx) {
         }
       } catch (error2) {
         readFailed = true;
-        const message2 = `Created ${created.id}, but its audience could not be read, so it was not changed. ` + `Check it with \`brainbase interface access ${created.id}\`. (${error2.message})`;
-        accessError = error2 instanceof InterfaceApiError ? new InterfaceApiError(message2, error2.code, error2.reason, error2.details, error2.status, error2.body) : new Error(message2);
+        const message3 = `Created ${created.id}, but its audience could not be read, so it was not changed. ` + `Check it with \`brainbase interface access ${created.id}\`. (${error2.message})`;
+        accessError = error2 instanceof InterfaceApiError ? new InterfaceApiError(message3, error2.code, error2.reason, error2.details, error2.status, error2.body) : new Error(message3);
       }
     }
     if (audience && !note && !readFailed) {
@@ -88727,11 +89503,11 @@ async function create3(ctx) {
     const id = safe(created.id);
     const out = [
       "",
-      `  ${import_picocolors74.default.green("Created")} ${import_picocolors74.default.bold(safe(created.name))}`,
+      `  ${import_picocolors75.default.green("Created")} ${import_picocolors75.default.bold(safe(created.name))}`,
       "",
       field("id", id),
       field("agent", safe(created.agent_id)),
-      field("address", `${safe(created.slug)} ${import_picocolors74.default.dim("(nothing live yet)")}`),
+      field("address", `${safe(created.slug)} ${import_picocolors75.default.dim("(nothing live yet)")}`),
       field("threads", threadsLabel(created.share_agent_threads))
     ];
     if (access) {
@@ -88743,11 +89519,11 @@ async function create3(ctx) {
       out.push("", `  Nobody can open it until you choose who can: \`brainbase interface access ${id} --everyone\` or \`--people <emails>\`.`);
     }
     if (created.share_agent_threads) {
-      out.push(`  ${import_picocolors74.default.dim(`To show viewers only their own conversations: \`brainbase interface threads ${id} --private\`.`)}`);
+      out.push(`  ${import_picocolors75.default.dim(`To show viewers only their own conversations: \`brainbase interface threads ${id} --private\`.`)}`);
     }
     if (note)
       out.push("", `  ${safe(note)}`);
-    out.push("", `  ${import_picocolors74.default.dim(`Next: \`brainbase interface build ${id} "<what to build>"\``)}`, "");
+    out.push("", `  ${import_picocolors75.default.dim(`Next: \`brainbase interface build ${id} "<what to build>"\``)}`, "");
     console.log(out.join(`
 `));
     if (readFailed) {
@@ -88883,7 +89659,7 @@ async function threads(ctx) {
         printJson({ id: row.id, share_agent_threads: row.share_agent_threads });
         return;
       }
-      const already = wanted === null ? "" : ` ${import_picocolors74.default.dim("(already set; nothing changed)")}`;
+      const already = wanted === null ? "" : ` ${import_picocolors75.default.dim("(already set; nothing changed)")}`;
       console.log(`
 ${field("threads", `${threadsLabel(row.share_agent_threads)}${already}`)}
 `);
@@ -88922,7 +89698,7 @@ async function rename(ctx) {
       return;
     }
     console.log(`
-  Renamed ${safe(updated.id)} to ${import_picocolors74.default.bold(safe(updated.name))}.
+  Renamed ${safe(updated.id)} to ${import_picocolors75.default.bold(safe(updated.name))}.
 `);
   });
 }
@@ -88958,7 +89734,7 @@ async function address(ctx) {
     }
     const where = updated.live_release ? safe(updated.live_release.url) : safe(updated.slug);
     console.log(`
-  ${safe(updated.name)} is now at ${import_picocolors74.default.bold(where)}.
+  ${safe(updated.name)} is now at ${import_picocolors75.default.bold(where)}.
 `);
   });
 }
@@ -89050,9 +89826,9 @@ var lifecycleCommands = {
 };
 
 // src/cli/interface-preview.ts
-var import_picocolors75 = __toESM(require_picocolors(), 1);
+var import_picocolors76 = __toESM(require_picocolors(), 1);
 function warn(line2) {
-  console.error(import_picocolors75.default.yellow(line2));
+  console.error(import_picocolors76.default.yellow(line2));
 }
 var PREVIEW_TIMEOUT_SECONDS = 300;
 var PROBE_INTERVAL_MS = 2000;
@@ -89142,12 +89918,12 @@ async function preview(ctx) {
     const say = progress(json3);
     const row = await interfacesApi.get(id);
     const { taskId, why } = await pickConversation(row, stringOption(parsed, "task")?.trim() || undefined);
-    say(import_picocolors75.default.dim(`  Previewing ${why}, ${safe(taskId)}.`));
+    say(import_picocolors76.default.dim(`  Previewing ${why}, ${safe(taskId)}.`));
     const started = await interfacesApi.startPreview(taskId, row.id);
     const address2 = previewAddress(started, row);
     let outcome = started.state === "serving" ? "serving" : "not_waited";
     if (outcome !== "serving" && !noWait) {
-      say(import_picocolors75.default.dim("  Starting the dev server in the sandbox…"));
+      say(import_picocolors76.default.dim("  Starting the dev server in the sandbox…"));
       outcome = await waitUntilServing(started, { timeoutMs: waitMs, deps: ctx.deps });
     }
     if (json3) {
@@ -89155,12 +89931,12 @@ async function preview(ctx) {
     } else {
       const out = [
         "",
-        `  ${outcome === "serving" ? import_picocolors75.default.green("Preview ready") : import_picocolors75.default.yellow("Preview starting")} ${import_picocolors75.default.bold(safe(started.name))}`,
+        `  ${outcome === "serving" ? import_picocolors76.default.green("Preview ready") : import_picocolors76.default.yellow("Preview starting")} ${import_picocolors76.default.bold(safe(started.name))}`,
         "",
-        field("address", address2 ? safe(address2) : import_picocolors75.default.dim(missingAddress(started))),
+        field("address", address2 ? safe(address2) : import_picocolors76.default.dim(missingAddress(started))),
         field("showing", showing(started, taskId)),
         "",
-        `  ${import_picocolors75.default.dim("Opens for people who can edit the agent, after signing in. Nothing is published.")}`,
+        `  ${import_picocolors76.default.dim("Opens for people who can edit the agent, after signing in. Nothing is published.")}`,
         ""
       ];
       console.log(out.join(`
@@ -89181,19 +89957,19 @@ async function preview(ctx) {
 var previewCommands = { preview };
 
 // src/cli/interface-release.ts
-var import_picocolors76 = __toESM(require_picocolors(), 1);
+var import_picocolors77 = __toESM(require_picocolors(), 1);
 var PUBLISH_TIMEOUT_SECONDS = 300;
 var REBUILD_USAGE = "brainbase interface rebuild <id> [--version <version id>] [--yes]";
 var PUBLISH_USAGE = "brainbase interface publish <id> [--build <build id>]";
 var ROLLBACK_USAGE = "brainbase interface rollback <id> --release <release id>";
 function warn2(line2) {
-  console.error(import_picocolors76.default.yellow(line2));
+  console.error(import_picocolors77.default.yellow(line2));
 }
 function text3(value2) {
   return typeof value2 === "string" && value2.trim() ? value2 : null;
 }
-function reword(error2, message2) {
-  return new InterfaceApiError(message2, error2.code, error2.reason, error2.details, error2.status, error2.body);
+function reword(error2, message3) {
+  return new InterfaceApiError(message3, error2.code, error2.reason, error2.details, error2.status, error2.body);
 }
 async function follow(operationId, what, options) {
   const stop = interruption(options.deps);
@@ -89204,7 +89980,7 @@ async function follow(operationId, what, options) {
       intervalMs: options.deps.pollIntervalMs,
       signal: stop.signal,
       now: options.deps.now,
-      onStatus: (operation) => say(import_picocolors76.default.dim(`  ${what} ${operation.status}`)),
+      onStatus: (operation) => say(import_picocolors77.default.dim(`  ${what} ${operation.status}`)),
       onStall: () => warn2(`The ${what} looks stalled: its worker stopped checking in. Still waiting, in case another worker picks it up.`)
     });
     if (outcome.kind === "settled") {
@@ -89223,7 +89999,7 @@ function reportUnsuccessful(result2, what, options) {
   if (options.json) {
     printJson({ outcome: result2.outcome, operation_id: result2.operationId, operation: result2.operation });
   } else if (result2.outcome === "failed") {
-    console.error(import_picocolors76.default.red(`The ${what} failed (operation ${id}):`));
+    console.error(import_picocolors77.default.red(`The ${what} failed (operation ${id}):`));
     console.error(safeBlock(result2.operation?.error ?? "Brainbase gave no reason."));
   } else if (result2.outcome === "timeout") {
     warn2(`Stopped waiting after ${Math.round(options.timeoutMs / 1000)}s. The ${what} keeps running on the server (operation ${id}).`);
@@ -89283,7 +90059,7 @@ async function rebuild(ctx) {
       if (json3)
         printJson({ outcome: "started", operation_id: operationId, operation });
       else
-        console.log(import_picocolors76.default.dim(`  Follow it with \`brainbase interface builds ${safe(id)}\`.`));
+        console.log(import_picocolors77.default.dim(`  Follow it with \`brainbase interface builds ${safe(id)}\`.`));
       return;
     }
     const result2 = await follow(operationId, "build", { json: json3, timeoutMs: waitMs, deps: ctx.deps });
@@ -89295,8 +90071,8 @@ async function rebuild(ctx) {
     }
     const buildId = safe(result2.operation?.build_id ?? "");
     const version2 = safe(result2.operation?.source_version_id ?? "");
-    console.log(import_picocolors76.default.green(`✓ Build ${buildId} succeeded${version2 ? ` (version ${version2})` : ""}.`));
-    console.log(import_picocolors76.default.dim(`  Publish it with \`brainbase interface publish ${safe(id)} --build ${buildId}\`.`));
+    console.log(import_picocolors77.default.green(`✓ Build ${buildId} succeeded${version2 ? ` (version ${version2})` : ""}.`));
+    console.log(import_picocolors77.default.dim(`  Publish it with \`brainbase interface publish ${safe(id)} --build ${buildId}\`.`));
   });
 }
 function liveBuildOf(row, releases) {
@@ -89354,7 +90130,7 @@ function describeBuild(buildId, builds) {
   const build2 = builds.find((candidate) => candidate.id === buildId);
   if (!build2)
     return `build ${safe(buildId)}`;
-  return `build ${safe(build2.id)} ${import_picocolors76.default.dim(`(version ${safe(build2.source_version_id)}, built ${ago(build2.created_at)})`)}`;
+  return `build ${safe(build2.id)} ${import_picocolors77.default.dim(`(version ${safe(build2.source_version_id)}, built ${ago(build2.created_at)})`)}`;
 }
 function reportAlreadyLive(json3, buildId, releaseId, url2) {
   if (json3) {
@@ -89408,8 +90184,8 @@ async function publish(ctx) {
     }
     if (!json3) {
       console.log("");
-      console.log(`  ${import_picocolors76.default.dim("Live now".padEnd(14))}${liveBuildId ? `${describeBuild(liveBuildId, builds)} at ${safe(row.live_release?.url)}` : row.live_release ? `release ${safe(row.live_release.id)} at ${safe(row.live_release.url)}` : import_picocolors76.default.dim("nothing")}`);
-      console.log(`  ${import_picocolors76.default.dim("Will publish".padEnd(14))}${describeBuild(buildId, builds)}`);
+      console.log(`  ${import_picocolors77.default.dim("Live now".padEnd(14))}${liveBuildId ? `${describeBuild(liveBuildId, builds)} at ${safe(row.live_release?.url)}` : row.live_release ? `release ${safe(row.live_release.id)} at ${safe(row.live_release.url)}` : import_picocolors77.default.dim("nothing")}`);
+      console.log(`  ${import_picocolors77.default.dim("Will publish".padEnd(14))}${describeBuild(buildId, builds)}`);
       console.log("");
     }
     const proceed = await confirmChange({
@@ -89452,7 +90228,7 @@ async function publish(ctx) {
       if (json3)
         printJson({ outcome: "started", operation_id: operationId, operation });
       else
-        console.log(import_picocolors76.default.dim(`  Check it with \`brainbase interface get ${safe(id)}\`.`));
+        console.log(import_picocolors77.default.dim(`  Check it with \`brainbase interface get ${safe(id)}\`.`));
       return;
     }
     const result2 = await follow(operationId, "publish", { json: json3, timeoutMs: waitMs, deps: ctx.deps });
@@ -89469,11 +90245,11 @@ async function publish(ctx) {
       printJson({ outcome: "succeeded", operation_id: operationId, operation: result2.operation, url: url2 });
       return;
     }
-    console.log(import_picocolors76.default.green(`✓ Build ${safe(buildId)} is live.`));
+    console.log(import_picocolors77.default.green(`✓ Build ${safe(buildId)} is live.`));
     if (url2)
       console.log(`  ${safe(url2)}`);
     if (urlUnread) {
-      console.log(import_picocolors76.default.dim(`  Its address could not be read just now; see it with \`brainbase interface open ${safe(id)}\`.`));
+      console.log(import_picocolors77.default.dim(`  Its address could not be read just now; see it with \`brainbase interface open ${safe(id)}\`.`));
     }
   });
 }
@@ -89509,8 +90285,8 @@ async function rollback(ctx) {
     }
     if (!json3) {
       console.log("");
-      console.log(`  ${import_picocolors76.default.dim("Live now".padEnd(16))}release ${safe(row.live_release.id)} at ${safe(row.live_release.url)}`);
-      console.log(`  ${import_picocolors76.default.dim("Will republish".padEnd(16))}release ${safe(releaseId)} ${import_picocolors76.default.dim("as a new release, with a new id")}`);
+      console.log(`  ${import_picocolors77.default.dim("Live now".padEnd(16))}release ${safe(row.live_release.id)} at ${safe(row.live_release.url)}`);
+      console.log(`  ${import_picocolors77.default.dim("Will republish".padEnd(16))}release ${safe(releaseId)} ${import_picocolors77.default.dim("as a new release, with a new id")}`);
       console.log("");
     }
     const proceed = await confirmChange({
@@ -89543,7 +90319,7 @@ async function rollback(ctx) {
       printJson(release);
       return;
     }
-    console.log(import_picocolors76.default.green(release.id === releaseId ? `✓ Release ${safe(releaseId)} is live (build ${safe(release.build_id)}).` : `✓ Republished release ${safe(releaseId)} as new release ${safe(release.id)} (build ${safe(release.build_id)}). It is live.`));
+    console.log(import_picocolors77.default.green(release.id === releaseId ? `✓ Release ${safe(releaseId)} is live (build ${safe(release.build_id)}).` : `✓ Republished release ${safe(releaseId)} as new release ${safe(release.id)} (build ${safe(release.build_id)}). It is live.`));
     console.log(`  ${safe(release.url)}`);
   });
 }
@@ -89578,14 +90354,14 @@ ${didYouMean(sub, Object.keys(COMMANDS2), "brainbase interface")}`);
   await command({ cwd: cwd2, args, deps });
 }
 function line2(command, args, description) {
-  return `  ${import_picocolors77.default.cyan(command)}${args ? ` ${import_picocolors77.default.dim(args)}` : ""}
-      ${import_picocolors77.default.dim(description)}`;
+  return `  ${import_picocolors78.default.cyan(command)}${args ? ` ${import_picocolors78.default.dim(args)}` : ""}
+      ${import_picocolors78.default.dim(description)}`;
 }
 function printHelp7() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors77.default.bold("brainbase interface")} ${import_picocolors77.default.dim("<sub> [options]")}`);
-  out.push(`  ${import_picocolors77.default.dim("Dashboards for an agent: build them in a conversation, publish them, choose who can open them.")}`);
+  out.push(`  ${import_picocolors78.default.bold("brainbase interface")} ${import_picocolors78.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors78.default.dim("Dashboards for an agent: build them in a conversation, publish them, choose who can open them.")}`);
   out.push("");
   out.push(line2("ls", "[--agent <id>] [--archived | --only-archived]", "list interfaces you can see"));
   out.push(line2("get", "<id>", "one interface: address, audience, live release, draft, running build conversation"));
@@ -89605,22 +90381,22 @@ function printHelp7() {
   out.push(line2("rollback", "<id> --release <id>", "republish an earlier release; it goes live under a new release id"));
   out.push(line2("preview", "<id> [--task <id>] [--no-wait]", "serve the unpublished draft from its build conversation and print the preview address"));
   out.push("");
-  out.push(`  ${import_picocolors77.default.dim("--json")}                   machine-readable output; never prompts`);
-  out.push(`  ${import_picocolors77.default.dim("--yes, -y")}                skip confirmation (required without a terminal)`);
-  out.push(`  ${import_picocolors77.default.dim("--no-wait")}                for rebuild and publish: return the operation at once; for preview: do not wait for the dev server`);
-  out.push(`  ${import_picocolors77.default.dim("--timeout <seconds>")}      for build, rebuild, publish and preview: how long to wait (builds 900, publish and preview 300)`);
-  out.push(`  ${import_picocolors77.default.dim("--idempotency-key <key>")}  replay a create, build, rebuild, publish or rollback whose answer was lost`);
+  out.push(`  ${import_picocolors78.default.dim("--json")}                   machine-readable output; never prompts`);
+  out.push(`  ${import_picocolors78.default.dim("--yes, -y")}                skip confirmation (required without a terminal)`);
+  out.push(`  ${import_picocolors78.default.dim("--no-wait")}                for rebuild and publish: return the operation at once; for preview: do not wait for the dev server`);
+  out.push(`  ${import_picocolors78.default.dim("--timeout <seconds>")}      for build, rebuild, publish and preview: how long to wait (builds 900, publish and preview 300)`);
+  out.push(`  ${import_picocolors78.default.dim("--idempotency-key <key>")}  replay a create, build, rebuild, publish or rollback whose answer was lost`);
   out.push("");
-  out.push(`  ${import_picocolors77.default.dim("People are emails (see `brainbase member ls`), user ids, or `me`. Audience members also need access to the agent.")}`);
-  out.push(`  ${import_picocolors77.default.dim("Audience: everyone (--everyone, `org` under --json) or chosen people (--people, `users` under --json).")}`);
-  out.push(`  ${import_picocolors77.default.dim("Exit codes: 0 done, 1 refused or failed, 130 interrupted (the server keeps working).")}`);
+  out.push(`  ${import_picocolors78.default.dim("People are emails (see `brainbase member ls`), user ids, or `me`. Audience members also need access to the agent.")}`);
+  out.push(`  ${import_picocolors78.default.dim("Audience: everyone (--everyone, `org` under --json) or chosen people (--people, `users` under --json).")}`);
+  out.push(`  ${import_picocolors78.default.dim("Exit codes: 0 done, 1 refused or failed, 130 interrupted (the server keeps working).")}`);
   out.push("");
   console.log(out.join(`
 `));
 }
 
 // src/cli/member.ts
-var import_picocolors78 = __toESM(require_picocolors(), 1);
+var import_picocolors79 = __toESM(require_picocolors(), 1);
 async function runMember(sub, args, opts) {
   if (args.some((arg) => arg === "--help" || arg === "-h")) {
     printHelp8();
@@ -89663,7 +90439,7 @@ async function runMemberList(opts) {
 function formatMemberList(members) {
   if (members.length === 0)
     return `
-  ${import_picocolors78.default.dim("Nobody here you can see.")}
+  ${import_picocolors79.default.dim("Nobody here you can see.")}
 `;
   const sorted = [...members].sort((a3, b4) => (a3.email ?? a3.id).localeCompare(b4.email ?? b4.id));
   const rows = sorted.map((member) => ({
@@ -89677,24 +90453,24 @@ function formatMemberList(members) {
   const roleWidth = Math.max(...rows.map((row) => row.role.length));
   const lines = [""];
   for (const row of rows) {
-    lines.push(`  ${row.email.padEnd(emailWidth)}  ${row.name.padEnd(nameWidth)}  ${import_picocolors78.default.dim(row.role.padEnd(roleWidth))}  ${import_picocolors78.default.dim(row.teams)}`.trimEnd());
+    lines.push(`  ${row.email.padEnd(emailWidth)}  ${row.name.padEnd(nameWidth)}  ${import_picocolors79.default.dim(row.role.padEnd(roleWidth))}  ${import_picocolors79.default.dim(row.teams)}`.trimEnd());
   }
-  lines.push("", `  ${import_picocolors78.default.dim("share a dashboard with one of them:")} ${import_picocolors78.default.cyan("brainbase interface access <id> --add <email>")}`, "");
+  lines.push("", `  ${import_picocolors79.default.dim("share a dashboard with one of them:")} ${import_picocolors79.default.cyan("brainbase interface access <id> --add <email>")}`, "");
   return lines.join(`
 `);
 }
 function printHelp8() {
   const out = [];
   out.push("");
-  out.push(`  ${import_picocolors78.default.bold("brainbase member")} ${import_picocolors78.default.dim("<sub> [options]")}`);
+  out.push(`  ${import_picocolors79.default.bold("brainbase member")} ${import_picocolors79.default.dim("<sub> [options]")}`);
   out.push("");
-  out.push(`  ${import_picocolors78.default.cyan("ls")}   ${import_picocolors78.default.dim("the people in an organization you can see, with their emails, roles and teams")}`);
+  out.push(`  ${import_picocolors79.default.cyan("ls")}   ${import_picocolors79.default.dim("the people in an organization you can see, with their emails, roles and teams")}`);
   out.push("");
-  out.push(`  ${import_picocolors78.default.dim("--org <id-or-slug>")}  ${import_picocolors78.default.dim("which organization (picked automatically when you are in one)")}`);
-  out.push(`  ${import_picocolors78.default.dim("--json")}              ${import_picocolors78.default.dim("machine-readable output")}`);
+  out.push(`  ${import_picocolors79.default.dim("--org <id-or-slug>")}  ${import_picocolors79.default.dim("which organization (picked automatically when you are in one)")}`);
+  out.push(`  ${import_picocolors79.default.dim("--json")}              ${import_picocolors79.default.dim("machine-readable output")}`);
   out.push("");
-  out.push(`  ${import_picocolors78.default.dim("Owners and admins see everyone. Anyone else sees the owners, the admins, themselves")}`);
-  out.push(`  ${import_picocolors78.default.dim("and the people who share a team with them, as in the web app.")}`);
+  out.push(`  ${import_picocolors79.default.dim("Owners and admins see everyone. Anyone else sees the owners, the admins, themselves")}`);
+  out.push(`  ${import_picocolors79.default.dim("and the people who share a team with them, as in the web app.")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -90146,8 +90922,8 @@ var BENCHMARK_CAPABILITIES = {
 class BenchmarkPhaseError extends Error {
   code;
   details;
-  constructor(code, message2, details) {
-    super(message2);
+  constructor(code, message3, details) {
+    super(message3);
     this.code = code;
     this.details = details;
     this.name = "BenchmarkPhaseError";
@@ -90158,8 +90934,8 @@ class BenchmarkCommandExecutionError extends BenchmarkPhaseError {
   stdout;
   stderr;
   durationMs;
-  constructor(code, message2, stdout, stderr, durationMs) {
-    super(code, message2);
+  constructor(code, message3, stdout, stderr, durationMs) {
+    super(code, message3);
     this.stdout = stdout;
     this.stderr = stderr;
     this.durationMs = durationMs;
@@ -92787,7 +93563,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
 }
 
 // src/cli/benchmark-control.ts
-var import_picocolors79 = __toESM(require_picocolors(), 1);
+var import_picocolors80 = __toESM(require_picocolors(), 1);
 import fs92 from "node:fs";
 import path103 from "node:path";
 
@@ -92799,8 +93575,8 @@ var BENCHMARK_UPLOAD_MIN_BYTES_PER_SECOND = 256 * 1024;
 class BenchmarkClientUsageError extends Error {
   code = "invalid_arguments";
   retryable = false;
-  constructor(message2) {
-    super(message2);
+  constructor(message3) {
+    super(message3);
     this.name = "BenchmarkClientUsageError";
   }
 }
@@ -92809,8 +93585,8 @@ class BenchmarkApiError extends ApiError {
   code;
   requestId;
   retryable;
-  constructor(message2, status, body, code, requestId, retryable) {
-    super(message2, status, body);
+  constructor(message3, status, body, code, requestId, retryable) {
+    super(message3, status, body);
     this.code = code;
     this.requestId = requestId;
     this.name = "BenchmarkApiError";
@@ -95091,8 +95867,8 @@ function expectPositionals2(positionals, minimum, maximum, usage) {
     throw usageError(`Usage: ${usage}`);
   }
 }
-function usageError(message2) {
-  return Object.assign(new Error(message2), {
+function usageError(message3) {
+  return Object.assign(new Error(message3), {
     code: "invalid_arguments",
     retryable: false
   });
@@ -95801,20 +96577,20 @@ async function emitCursorPages(output, fetchPage, options) {
 function commandHelp() {
   return [
     "",
-    `  ${import_picocolors79.default.bold("brainbase benchmark")} ${import_picocolors79.default.dim("<command> [options]")}`,
+    `  ${import_picocolors80.default.bold("brainbase benchmark")} ${import_picocolors80.default.dim("<command> [options]")}`,
     "",
-    `  ${import_picocolors79.default.cyan("init | list | show | create | validate | pull | push")}`,
-    `  ${import_picocolors79.default.cyan("publish | revisions | import | export | archive | restore")}`,
-    `  ${import_picocolors79.default.cyan("run plan|start|watch|list|show|cancel|resume")}`,
-    `  ${import_picocolors79.default.cyan("results | diagnoses | attempt | artifacts | export-results")}`,
-    `  ${import_picocolors79.default.cyan("history | baseline show|set|clear")}`,
+    `  ${import_picocolors80.default.cyan("init | list | show | create | validate | pull | push")}`,
+    `  ${import_picocolors80.default.cyan("publish | revisions | import | export | archive | restore")}`,
+    `  ${import_picocolors80.default.cyan("run plan|start|watch|list|show|cancel|resume")}`,
+    `  ${import_picocolors80.default.cyan("results | diagnoses | attempt | artifacts | export-results")}`,
+    `  ${import_picocolors80.default.cyan("history | baseline show|set|clear")}`,
     "",
-    `  ${import_picocolors79.default.dim("Use --agent to override brainbase.agent.yaml, and --json or --jsonl for automation.")}`,
+    `  ${import_picocolors80.default.dim("Use --agent to override brainbase.agent.yaml, and --json or --jsonl for automation.")}`,
     "",
-    `  ${import_picocolors79.default.bold("benchmark runtime (machine-only)")}`,
-    `  ${import_picocolors79.default.cyan("hydrate")} ${import_picocolors79.default.dim("--spec <path> --result <path> --json")}`,
-    `  ${import_picocolors79.default.cyan("evaluate")} ${import_picocolors79.default.dim("--spec <path> --result <path> --json")}`,
-    `  ${import_picocolors79.default.cyan("capabilities")} ${import_picocolors79.default.dim("--json")}`,
+    `  ${import_picocolors80.default.bold("benchmark runtime (machine-only)")}`,
+    `  ${import_picocolors80.default.cyan("hydrate")} ${import_picocolors80.default.dim("--spec <path> --result <path> --json")}`,
+    `  ${import_picocolors80.default.cyan("evaluate")} ${import_picocolors80.default.dim("--spec <path> --result <path> --json")}`,
+    `  ${import_picocolors80.default.cyan("capabilities")} ${import_picocolors80.default.dim("--json")}`,
     ""
   ].join(`
 `);
@@ -96260,8 +97036,8 @@ async function runStart(cwd2, argv, deps) {
 }
 function pausedRunHint(runId, run, agentId) {
   const reason = run.paused_reason;
-  const message2 = reason && typeof reason === "object" && !Array.isArray(reason) ? reason.message : undefined;
-  const first = typeof message2 === "string" && message2.trim() ? `Run paused: ${message2.trim()}` : "Run paused.";
+  const message3 = reason && typeof reason === "object" && !Array.isArray(reason) ? reason.message : undefined;
+  const first = typeof message3 === "string" && message3.trim() ? `Run paused: ${message3.trim()}` : "Run paused.";
   const agent = agentId ? ` --agent ${agentId}` : "";
   return `${first}
 Resume with: brainbase benchmark run resume ${runId} --yes${agent}`;
@@ -96917,7 +97693,7 @@ function parsePhaseArgs(args) {
     throw new Error("--json is required for benchmark phase commands");
   return { spec, result: result2, json: true };
 }
-function argumentFailure(phase, message2) {
+function argumentFailure(phase, message3) {
   const timestamp = new Date().toISOString();
   return {
     schema_version: "1",
@@ -96935,11 +97711,11 @@ function argumentFailure(phase, message2) {
     outputs: [],
     error: {
       code: "invalid_arguments",
-      message: message2
+      message: message3
     }
   };
 }
-function phaseFailure(invocation, startedAt, started, code, message2) {
+function phaseFailure(invocation, startedAt, started, code, message3) {
   return {
     schema_version: "1",
     cli_version: VERSION,
@@ -96954,7 +97730,7 @@ function phaseFailure(invocation, startedAt, started, code, message2) {
     steps: [],
     inputs: [],
     outputs: [],
-    error: { code, message: message2 }
+    error: { code, message: message3 }
   };
 }
 function descendantPids2(parentPid) {
@@ -97215,6 +97991,806 @@ async function runBenchmark(sub, args, write3 = (value2) => process.stdout.write
   }
 }
 
+// src/cli/decide.ts
+import fs95 from "node:fs";
+import path107 from "node:path";
+
+// src/core/decide-api.ts
+import path105 from "node:path";
+function decideKeysFile() {
+  return path105.join(process.env.BRAINBASE_HOME ?? BRAINBASE_HOME, "decide-keys.json");
+}
+var ATTEMPTS = 3;
+var RETRY_STATUSES = new Set([429, 502, 503, 504]);
+var MAX_RETRY_DELAY_MS = 30000;
+var REQUEST_TIMEOUT_MS3 = 5 * 60000;
+
+class DecideHttpError extends Error {
+  status;
+  constructor(message3, status) {
+    super(message3);
+    this.status = status;
+    this.name = "DecideHttpError";
+  }
+}
+function cacheKey(base2, agentId) {
+  return `${base2}|${agentId}`;
+}
+async function resolveDecideCredential(cwd2, agentFlag) {
+  const base2 = proxyBaseUrl(authStatus().session ?? null);
+  const taskKey = process.env.BB_TASK_KEY?.trim();
+  if (taskKey)
+    return { key: taskKey, base: base2, source: "task_key" };
+  const agentId = agentFlag?.trim() || readLink(cwd2)?.agent_id;
+  if (!agentId) {
+    throw new DecideHttpError("No agent to bill. Run inside a linked folder, or pass --agent <id> (see `brainbase agent list`).", null);
+  }
+  const cached2 = readJsonOr(decideKeysFile(), {})[cacheKey(base2, agentId)];
+  if (cached2?.key)
+    return { key: cached2.key, base: base2, source: "agent_key", agentId };
+  return mintAgentKey(base2, agentId);
+}
+async function mintAgentKey(base2, agentId) {
+  const created = await api.createCliKey(agentId, { name: "brainbase decide" });
+  const cache3 = readJsonOr(decideKeysFile(), {});
+  cache3[cacheKey(base2, agentId)] = { key: created.key, key_id: created.id };
+  writeJsonAtomic(decideKeysFile(), cache3);
+  return { key: created.key, base: base2, source: "agent_key", agentId };
+}
+async function replaceAgentKey(credential) {
+  if (credential.source !== "agent_key" || !credential.agentId)
+    return credential;
+  const cache3 = readJsonOr(decideKeysFile(), {});
+  delete cache3[cacheKey(credential.base, credential.agentId)];
+  writeJsonAtomic(decideKeysFile(), cache3);
+  return mintAgentKey(credential.base, credential.agentId);
+}
+function retryDelayMs(attempt2, retryAfter) {
+  const seconds = retryAfter === null ? Number.NaN : Number(retryAfter);
+  const base2 = Number.isFinite(seconds) ? seconds * 1000 : 1000 * 2 ** attempt2;
+  return Math.min(Math.max(base2, 0), MAX_RETRY_DELAY_MS) + Math.random() * 500;
+}
+function errorMessage2(status, text4) {
+  try {
+    const body = JSON.parse(text4);
+    const message3 = body.error?.message ?? body.detail;
+    if (typeof message3 === "string" && message3)
+      return message3;
+  } catch {}
+  return `HTTP ${status}`;
+}
+async function postDecide(credential, body, options = {}) {
+  const sleep3 = options.sleep ?? ((ms2) => new Promise((resolve) => setTimeout(resolve, ms2)));
+  const payload = JSON.stringify(body);
+  let failure = new DecideHttpError("The decide request failed", null);
+  for (let attempt2 = 0;attempt2 < ATTEMPTS; attempt2 += 1) {
+    let retryAfter = null;
+    try {
+      const response = await fetch(`${credential.base}/v1/decide`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${credential.key}`,
+          "Content-Type": "application/json"
+        },
+        body: payload,
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
+      });
+      const text4 = await response.text();
+      if (response.ok) {
+        try {
+          return JSON.parse(text4);
+        } catch {
+          throw new DecideHttpError("The server sent an unreadable response", response.status);
+        }
+      }
+      failure = new DecideHttpError(errorMessage2(response.status, text4), response.status);
+      if (!RETRY_STATUSES.has(response.status))
+        throw failure;
+      retryAfter = response.headers.get("retry-after");
+    } catch (error2) {
+      if (error2 instanceof DecideHttpError)
+        throw error2;
+      failure = new DecideHttpError(`Network error: ${error2.message}`, null);
+    }
+    if (attempt2 + 1 < ATTEMPTS)
+      await sleep3(retryDelayMs(attempt2, retryAfter));
+  }
+  throw failure;
+}
+
+// src/core/decide-items.ts
+import fs94 from "node:fs";
+import path106 from "node:path";
+
+class DecideInputError extends Error {
+  constructor(message3) {
+    super(message3);
+    this.name = "DecideInputError";
+  }
+}
+var GLOB_CHARS = /[*?[{]/;
+function fileId(cwd2, file) {
+  return path106.relative(cwd2, file).split(path106.sep).join("/") || path106.basename(file);
+}
+function isHidden2(name) {
+  return name.startsWith(".") || name === "node_modules";
+}
+function appendAll(into, from) {
+  for (const value2 of from)
+    into.push(value2);
+}
+function walk(dir, out = []) {
+  for (const entry of fs94.readdirSync(dir, { withFileTypes: true })) {
+    if (isHidden2(entry.name))
+      continue;
+    const full = path106.join(dir, entry.name);
+    if (entry.isDirectory())
+      walk(full, out);
+    else if (entry.isFile())
+      out.push(full);
+    else if (entry.isSymbolicLink()) {
+      try {
+        if (fs94.statSync(full).isFile())
+          out.push(full);
+      } catch {}
+    }
+  }
+  return out;
+}
+function walkSorted(dir) {
+  return walk(dir).sort();
+}
+function globToRegExp(pattern2) {
+  let source = "";
+  for (let i = 0;i < pattern2.length; i += 1) {
+    const char = pattern2[i];
+    if (char === "*") {
+      if (pattern2[i + 1] === "*") {
+        const slashFollows = pattern2[i + 2] === "/";
+        source += slashFollows ? "(?:.*/)?" : ".*";
+        i += slashFollows ? 2 : 1;
+      } else {
+        source += "[^/]*";
+      }
+    } else if (char === "?") {
+      source += "[^/]";
+    } else if (char === "{") {
+      const close = pattern2.indexOf("}", i);
+      if (close === -1) {
+        source += "\\{";
+        continue;
+      }
+      const choices = pattern2.slice(i + 1, close).split(",");
+      source += `(?:${choices.map((choice) => globToRegExp(choice).source.slice(1, -1)).join("|")})`;
+      i = close;
+    } else if (char === "[") {
+      const close = pattern2.indexOf("]", i + 1);
+      if (close === -1) {
+        source += "\\[";
+        continue;
+      }
+      let body = pattern2.slice(i + 1, close);
+      if (body.startsWith("!"))
+        body = `^${body.slice(1)}`;
+      source += `[${body.replace(/\\/g, "\\\\")}]`;
+      i = close;
+    } else {
+      source += char.replace(/[.+^$()|\\/]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${source}$`);
+}
+function expandGlob(cwd2, pattern2) {
+  const absolute = path106.isAbsolute(pattern2);
+  const segments = pattern2.split("/");
+  const fixed = [];
+  for (const segment of segments) {
+    if (GLOB_CHARS.test(segment))
+      break;
+    fixed.push(segment);
+  }
+  if (fixed.length === segments.length) {
+    return [path106.resolve(cwd2, pattern2)];
+  }
+  const root = path106.resolve(cwd2, fixed.join("/") || ".");
+  if (!fs94.existsSync(root) || !fs94.statSync(root).isDirectory())
+    return [];
+  const matcher = globToRegExp(absolute ? pattern2 : path106.posix.normalize(segments.join("/")));
+  return walkSorted(root).filter((file) => {
+    const candidate = absolute ? file.split(path106.sep).join("/") : fileId(cwd2, file);
+    return matcher.test(candidate);
+  });
+}
+function readFileItem(cwd2, file) {
+  const id = fileId(cwd2, file);
+  let bytes;
+  try {
+    bytes = fs94.readFileSync(file);
+  } catch (error2) {
+    return { id, error: `Could not read the file: ${error2.message}` };
+  }
+  if (bytes.includes(0))
+    return { id, error: "Not a text file" };
+  let text4;
+  try {
+    text4 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return { id, error: "Not UTF-8 text" };
+  }
+  if (!text4.trim())
+    return { id, error: "Empty file" };
+  return { id, text: text4 };
+}
+function fileItems(cwd2, paths, globs) {
+  const files = [];
+  for (const entry of paths) {
+    const full = path106.resolve(cwd2, entry);
+    let stat;
+    try {
+      stat = fs94.statSync(full);
+    } catch {
+      throw new DecideInputError(`No such file or directory: ${entry}`);
+    }
+    if (stat.isDirectory())
+      appendAll(files, walkSorted(full));
+    else
+      files.push(full);
+  }
+  for (const pattern2 of globs) {
+    const matched = expandGlob(cwd2, pattern2);
+    if (matched.length === 0 || !matched.some((file) => fs94.existsSync(file))) {
+      throw new DecideInputError(`No files match ${pattern2}`);
+    }
+    appendAll(files, matched);
+  }
+  return [...new Set(files)];
+}
+function readFileItems(cwd2, files) {
+  const set3 = { items: [], failures: [] };
+  for (const file of files) {
+    const item = readFileItem(cwd2, file);
+    if ("error" in item)
+      set3.failures.push(item);
+    else
+      set3.items.push(item);
+  }
+  return set3;
+}
+function isRecord2(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function rowItem(row, options, fallbackId) {
+  const idField = options.idField ?? "id";
+  const rawId = isRecord2(row) ? row[idField] : undefined;
+  let id = fallbackId;
+  if (rawId !== undefined && rawId !== null && rawId !== "")
+    id = String(rawId);
+  else if (options.idField)
+    return { id: fallbackId, error: `Missing ${options.idField}` };
+  if (options.textFields.length === 0)
+    return { id, json: row };
+  if (!isRecord2(row))
+    return { id, error: "Not an object, so --text-field has nothing to select" };
+  if (options.textFields.length === 1) {
+    const field2 = options.textFields[0];
+    const value2 = row[field2];
+    if (value2 === undefined || value2 === null || value2 === "")
+      return { id, error: `Empty ${field2}` };
+    return { id, text: typeof value2 === "string" ? value2 : JSON.stringify(value2) };
+  }
+  const missing = options.textFields.filter((field2) => row[field2] === undefined);
+  if (missing.length)
+    return { id, error: `Missing ${missing.join(", ")}` };
+  const picked = {};
+  for (const field2 of options.textFields)
+    picked[field2] = row[field2];
+  return { id, json: picked };
+}
+function sourceLabel(cwd2, file) {
+  return fileId(cwd2, path106.resolve(cwd2, file));
+}
+function readSource(cwd2, file) {
+  try {
+    return fs94.readFileSync(path106.resolve(cwd2, file), "utf8");
+  } catch (error2) {
+    throw new DecideInputError(`Could not read ${file}: ${error2.message}`);
+  }
+}
+function jsonlItems(cwd2, file, options) {
+  const set3 = { items: [], failures: [] };
+  const label3 = sourceLabel(cwd2, file);
+  readSource(cwd2, file).split(`
+`).forEach((line3, index) => {
+    if (!line3.trim())
+      return;
+    const fallbackId = `${label3}:${index + 1}`;
+    let row;
+    try {
+      row = JSON.parse(line3);
+    } catch {
+      set3.failures.push({ id: fallbackId, error: "Not valid JSON" });
+      return;
+    }
+    const item = rowItem(row, options, fallbackId);
+    if ("error" in item)
+      set3.failures.push(item);
+    else
+      set3.items.push(item);
+  });
+  return set3;
+}
+function parseCsv(text4) {
+  const rows = [];
+  let row = [];
+  let field2 = "";
+  let quoted = false;
+  for (let i = 0;i < text4.length; i += 1) {
+    const char = text4[i];
+    if (quoted) {
+      if (char === '"' && text4[i + 1] === '"') {
+        field2 += '"';
+        i += 1;
+      } else if (char === '"') {
+        quoted = false;
+      } else {
+        field2 += char;
+      }
+    } else if (char === '"' && field2 === "") {
+      quoted = true;
+    } else if (char === ",") {
+      row.push(field2);
+      field2 = "";
+    } else if (char === `
+` || char === "\r") {
+      if (char === "\r" && text4[i + 1] === `
+`)
+        i += 1;
+      row.push(field2);
+      rows.push(row);
+      row = [];
+      field2 = "";
+    } else {
+      field2 += char;
+    }
+  }
+  if (field2 !== "" || row.length > 0) {
+    row.push(field2);
+    rows.push(row);
+  }
+  return rows.filter((cells) => cells.some((cell) => cell !== ""));
+}
+function csvItems(cwd2, file, options) {
+  const set3 = { items: [], failures: [] };
+  const label3 = sourceLabel(cwd2, file);
+  const [header, ...rows] = parseCsv(readSource(cwd2, file).replace(/^/, ""));
+  if (!header)
+    return set3;
+  rows.forEach((cells, index) => {
+    const row = {};
+    header.forEach((name, column) => {
+      row[name] = cells[column] ?? "";
+    });
+    const item = rowItem(row, options, `${label3}:${index + 2}`);
+    if ("error" in item)
+      set3.failures.push(item);
+    else
+      set3.items.push(item);
+  });
+  return set3;
+}
+function readResults(file) {
+  const rows = new Map;
+  if (!fs94.existsSync(file))
+    return rows;
+  for (const line3 of fs94.readFileSync(file, "utf8").split(`
+`)) {
+    if (!line3.trim())
+      continue;
+    try {
+      const row = JSON.parse(line3);
+      if (row && typeof row.id === "string")
+        rows.set(row.id, row);
+    } catch {}
+  }
+  return rows;
+}
+function repairResultsTail(file) {
+  if (!fs94.existsSync(file))
+    return;
+  const text4 = fs94.readFileSync(file, "utf8");
+  if (!text4 || text4.endsWith(`
+`))
+    return;
+  const cut = text4.lastIndexOf(`
+`) + 1;
+  const tail2 = text4.slice(cut);
+  let complete = false;
+  try {
+    const row = JSON.parse(tail2);
+    complete = Boolean(row) && typeof row.id === "string";
+  } catch {
+    complete = false;
+  }
+  if (complete)
+    fs94.appendFileSync(file, `
+`);
+  else
+    fs94.truncateSync(file, Buffer.byteLength(text4.slice(0, cut)));
+}
+function parseWhere(value2) {
+  if (value2 === "failed")
+    return { kind: "failed" };
+  if (value2 === "uncertain")
+    return { kind: "uncertain" };
+  const split2 = value2.indexOf("=");
+  if (split2 > 0 && split2 < value2.length - 1) {
+    return { kind: "answer", question: value2.slice(0, split2), answer: value2.slice(split2 + 1) };
+  }
+  throw new DecideInputError(`--where takes failed, uncertain or <question>=<answer>, not ${value2}`);
+}
+function rowMatches(row, where) {
+  switch (where.kind) {
+    case "failed":
+      return row.error !== undefined;
+    case "uncertain":
+      return row.error === undefined && row.uncertain === true;
+    case "answer":
+      return row.error === undefined && row.answers?.[where.question]?.choice === where.answer;
+  }
+}
+
+// src/cli/decide.ts
+var DEFAULT_OUT = "decide-results.jsonl";
+var MAX_ITEMS_PER_REQUEST = 200;
+var MAX_REQUEST_BYTES = 6 * 1024 * 1024;
+var DEFAULT_CONCURRENCY = 4;
+var MAX_CONCURRENCY = 16;
+var SUMMARY_UNCERTAIN_IDS = 20;
+var SUMMARY_FAILED = 10;
+var STOP_STATUSES = new Set([401, 402, 403, 404]);
+var OPTIONS = [
+  { key: "questions", names: ["--questions", "-q"], kind: "value" },
+  { key: "items", names: ["--items"], kind: "value", multiple: true },
+  { key: "jsonl", names: ["--jsonl"], kind: "value", multiple: true },
+  { key: "csv", names: ["--csv"], kind: "value", multiple: true },
+  { key: "idField", names: ["--id-field"], kind: "value" },
+  { key: "textField", names: ["--text-field"], kind: "value", multiple: true },
+  { key: "model", names: ["--model"], kind: "value" },
+  { key: "minConfidence", names: ["--min-confidence"], kind: "value" },
+  { key: "out", names: ["--out", "-o"], kind: "value" },
+  { key: "resume", names: ["--resume"], kind: "boolean" },
+  { key: "overwrite", names: ["--overwrite"], kind: "boolean" },
+  { key: "selectFrom", names: ["--select-from"], kind: "value" },
+  { key: "where", names: ["--where"], kind: "value" },
+  { key: "agent", names: ["--agent"], kind: "value" },
+  { key: "concurrency", names: ["--concurrency"], kind: "value" },
+  { key: "help", names: ["--help", "-h"], kind: "boolean" }
+];
+var DECIDE_USAGE = `Usage: brainbase decide --questions <file.json> <sources...> [options]
+
+Answer the same decision-model questions over many items. Items are read on
+this machine and never pass through your agent's context.
+
+Sources (at least one):
+  <path>...                 files, or directories (every file under them)
+  --items <glob>            files matching a glob; quote it ('docs/**/*.md')
+  --jsonl <file>            one item per line
+  --csv <file>              one item per row; the first row names the fields
+  --id-field <name>         JSONL/CSV field holding each item's id
+                            (default: id when present, else file:line)
+  --text-field <name>       field to judge; repeat for several (a row
+                            missing any of them fails without being sent)
+                            (default: the whole row)
+
+Questions:
+  --questions, -q <file>    JSON object of System One questions, e.g.
+                            {"team": {"type": "choice", "instructions": "Which team?",
+                                      "criteria": {"billing": "...", "infra": "..."}}}
+  --model <slug>            jev, kev-4b, clef, clef-flash or gpt-6-luna
+                            (default: the server's default)
+  --min-confidence <0-1>    mark answers below this confidence as uncertain
+
+Results:
+  --out, -o <file>          one JSON line per item (default: ${DEFAULT_OUT})
+  --resume                  skip ids already answered in --out; append the rest
+  --overwrite               replace an existing --out
+  --select-from <file>      only items whose row in this earlier results file
+  --where <filter>            matches: failed, uncertain or <question>=<answer>
+
+Other:
+  --agent <id>              agent to bill outside a Brainbase task
+                            (default: this folder's linked agent)
+  --concurrency <n>         requests in flight, 1-${MAX_CONCURRENCY} (default: ${DEFAULT_CONCURRENCY})
+
+Prints one JSON summary on stdout. Exits 0 when every item was sent (check
+counts.failed), 1 when the run stopped early (rerun with --resume), 2 for a
+usage error.
+`;
+function usageError2(stderr, message3) {
+  stderr(`brainbase decide: ${message3}
+Run \`brainbase decide --help\` for usage.
+`);
+  return 2;
+}
+function readQuestions(cwd2, file) {
+  let parsed;
+  try {
+    parsed = JSON.parse(fs95.readFileSync(path107.resolve(cwd2, file), "utf8"));
+  } catch (error2) {
+    throw new DecideInputError(`Could not read questions from ${file}: ${error2.message}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || !Object.keys(parsed).length) {
+    throw new DecideInputError(`${file} must hold a JSON object of questions`);
+  }
+  return parsed;
+}
+function mergeSets(sets) {
+  const merged = { items: [], failures: [] };
+  for (const set3 of sets) {
+    appendAll(merged.items, set3.items);
+    appendAll(merged.failures, set3.failures);
+  }
+  const seen = new Set;
+  for (const { id } of [...merged.items, ...merged.failures]) {
+    if (seen.has(id)) {
+      throw new DecideInputError(`Two items share the id ${JSON.stringify(id)}; pass --id-field naming a unique field`);
+    }
+    seen.add(id);
+  }
+  return merged;
+}
+function chunk2(items, failures) {
+  const chunks = [];
+  let current = [];
+  let bytes = 0;
+  for (const item of items) {
+    const size2 = Buffer.byteLength(JSON.stringify(item));
+    if (size2 > MAX_REQUEST_BYTES) {
+      failures.push({ id: item.id, error: "Larger than one request can carry (6 MB)" });
+      continue;
+    }
+    if (current.length === MAX_ITEMS_PER_REQUEST || bytes + size2 > MAX_REQUEST_BYTES) {
+      chunks.push(current);
+      current = [];
+      bytes = 0;
+    }
+    current.push(item);
+    bytes += size2;
+  }
+  if (current.length)
+    chunks.push(current);
+  return chunks;
+}
+
+class Tally {
+  done = 0;
+  uncertainIds = [];
+  failed = [];
+  answers = {};
+  credits = 0;
+  model = null;
+  addRow(row) {
+    if (row.error !== undefined) {
+      this.failed.push({ id: row.id, reason: row.error });
+      return;
+    }
+    this.done += 1;
+    if (row.uncertain)
+      this.uncertainIds.push(row.id);
+  }
+  addResponse(response) {
+    this.model ??= response.model;
+    this.credits += response.credits;
+    for (const [question, counts] of Object.entries(response.answers)) {
+      const into = this.answers[question] ??= {};
+      for (const [answer, count] of Object.entries(counts)) {
+        into[answer] = (into[answer] ?? 0) + count;
+      }
+    }
+  }
+}
+async function runDecide(cwd2, argv, deps = {}) {
+  const stdout = deps.stdout ?? ((text4) => void process.stdout.write(text4));
+  const stderr = deps.stderr ?? ((text4) => void process.stderr.write(text4));
+  const started = Date.now();
+  let parsed;
+  try {
+    parsed = parseArgv(argv, OPTIONS);
+  } catch (error2) {
+    if (error2 instanceof ArgvParseError)
+      return usageError2(stderr, error2.message);
+    throw error2;
+  }
+  if (booleanOption(parsed, "help")) {
+    stdout(DECIDE_USAGE);
+    return 0;
+  }
+  const questionsFile = stringOption(parsed, "questions");
+  if (!questionsFile)
+    return usageError2(stderr, "--questions <file.json> is required");
+  const paths = parsed.positionals;
+  const globs = stringOptions(parsed, "items");
+  const jsonlFiles = stringOptions(parsed, "jsonl");
+  const csvFiles = stringOptions(parsed, "csv");
+  if (!paths.length && !globs.length && !jsonlFiles.length && !csvFiles.length) {
+    return usageError2(stderr, "name at least one source: paths, --items, --jsonl or --csv");
+  }
+  const minConfidenceRaw = stringOption(parsed, "minConfidence");
+  const minConfidence = minConfidenceRaw === undefined ? undefined : Number(minConfidenceRaw);
+  if (minConfidence !== undefined && !(minConfidence >= 0 && minConfidence <= 1)) {
+    return usageError2(stderr, "--min-confidence takes a number from 0 to 1");
+  }
+  const concurrencyRaw = stringOption(parsed, "concurrency");
+  const concurrency = concurrencyRaw === undefined ? DEFAULT_CONCURRENCY : Number(concurrencyRaw);
+  if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > MAX_CONCURRENCY) {
+    return usageError2(stderr, `--concurrency takes a whole number from 1 to ${MAX_CONCURRENCY}`);
+  }
+  const selectFrom = stringOption(parsed, "selectFrom");
+  const whereRaw = stringOption(parsed, "where");
+  if (Boolean(selectFrom) !== Boolean(whereRaw)) {
+    return usageError2(stderr, "--select-from and --where go together");
+  }
+  const resume = booleanOption(parsed, "resume");
+  const overwrite = booleanOption(parsed, "overwrite");
+  if (resume && overwrite)
+    return usageError2(stderr, "--resume and --overwrite cannot be combined");
+  const outArg = stringOption(parsed, "out") ?? DEFAULT_OUT;
+  const outPath = path107.resolve(cwd2, outArg);
+  let questions;
+  let set3;
+  let skipped = 0;
+  try {
+    questions = readQuestions(cwd2, questionsFile);
+    const rowOptions = {
+      idField: stringOption(parsed, "idField"),
+      textFields: stringOptions(parsed, "textField")
+    };
+    set3 = mergeSets([
+      readFileItems(cwd2, fileItems(cwd2, paths, globs)),
+      ...jsonlFiles.map((file) => jsonlItems(cwd2, file, rowOptions)),
+      ...csvFiles.map((file) => csvItems(cwd2, file, rowOptions))
+    ]);
+    if (selectFrom && whereRaw) {
+      const where = parseWhere(whereRaw);
+      const earlier = path107.resolve(cwd2, selectFrom);
+      if (!fs95.existsSync(earlier))
+        throw new DecideInputError(`No such results file: ${selectFrom}`);
+      const rows = readResults(earlier);
+      const keep = (id) => {
+        const row = rows.get(id);
+        return row !== undefined && rowMatches(row, where);
+      };
+      set3 = { items: set3.items.filter((item) => keep(item.id)), failures: set3.failures.filter((f4) => keep(f4.id)) };
+    }
+    const outHasRows = fs95.existsSync(outPath) && fs95.statSync(outPath).size > 0;
+    if (outHasRows && !resume && !overwrite) {
+      throw new DecideInputError(`${outArg} already has results; pass --resume to continue it or --overwrite to replace it`);
+    }
+    if (resume) {
+      const answered = new Set([...readResults(outPath).values()].filter((row) => row.error === undefined).map((row) => row.id));
+      const before2 = set3.items.length + set3.failures.length;
+      set3 = {
+        items: set3.items.filter((item) => !answered.has(item.id)),
+        failures: set3.failures.filter((failure) => !answered.has(failure.id))
+      };
+      skipped = before2 - set3.items.length - set3.failures.length;
+    }
+  } catch (error2) {
+    if (error2 instanceof DecideInputError)
+      return usageError2(stderr, error2.message);
+    throw error2;
+  }
+  fs95.mkdirSync(path107.dirname(outPath), { recursive: true });
+  if (resume)
+    repairResultsTail(outPath);
+  else
+    fs95.writeFileSync(outPath, "");
+  const append = (rows) => {
+    if (rows.length)
+      fs95.appendFileSync(outPath, rows.map((row) => JSON.stringify(row)).join(`
+`) + `
+`);
+  };
+  const tally = new Tally;
+  const localFailures = [...set3.failures];
+  const chunks = chunk2(set3.items, localFailures);
+  const localRows = localFailures.map((failure) => ({ id: failure.id, error: failure.error }));
+  append(localRows);
+  localRows.forEach((row) => tally.addRow(row));
+  const total = set3.items.length + set3.failures.length;
+  let stopError;
+  let unsent = 0;
+  let next = 0;
+  if (chunks.length) {
+    let credential;
+    try {
+      credential = await resolveDecideCredential(cwd2, stringOption(parsed, "agent"));
+    } catch (error2) {
+      stopError = error2.message;
+    }
+    if (credential) {
+      const modelFlag = stringOption(parsed, "model");
+      const body = (items) => ({
+        questions,
+        items,
+        ...modelFlag ? { model: modelFlag } : {},
+        ...minConfidence !== undefined ? { min_confidence: minConfidence } : {},
+        output: "full"
+      });
+      const progress2 = process.stderr.isTTY && !deps.stderr;
+      let answeredSoFar = localRows.length;
+      let replacement;
+      const send = async (items) => {
+        const used = credential;
+        try {
+          return await postDecide(used, body(items), deps);
+        } catch (error2) {
+          if (!(error2 instanceof DecideHttpError && error2.status === 401 && used.source === "agent_key")) {
+            throw error2;
+          }
+          replacement ??= replaceAgentKey(used).then((fresh2) => credential = fresh2);
+          const fresh = await replacement;
+          if (fresh.key === used.key)
+            throw error2;
+          return postDecide(fresh, body(items), deps);
+        }
+      };
+      const worker = async () => {
+        while (next < chunks.length && stopError === undefined) {
+          const items = chunks[next++];
+          let rows;
+          try {
+            const response = await send(items);
+            tally.addResponse(response);
+            rows = response.rows;
+          } catch (error2) {
+            const message3 = error2.message;
+            const refusal = error2 instanceof DecideHttpError;
+            if (!refusal || error2.status !== null && STOP_STATUSES.has(error2.status)) {
+              stopError ??= refusal && error2.status === 404 ? `/v1/decide is not available on ${credential.base} (${message3})` : message3;
+              unsent += items.length;
+              continue;
+            }
+            rows = items.map((item) => ({ id: item.id, error: `Request failed: ${message3}` }));
+          }
+          append(rows);
+          rows.forEach((row) => tally.addRow(row));
+          answeredSoFar += rows.length;
+          if (progress2)
+            process.stderr.write(`\rdecided ${answeredSoFar}/${total}`);
+        }
+      };
+      await Promise.all(Array.from({ length: Math.min(concurrency, chunks.length) }, worker));
+      if (progress2)
+        process.stderr.write(`
+`);
+    }
+    unsent += chunks.slice(next).reduce((count, items) => count + items.length, 0);
+  }
+  const summary = {
+    status: stopError === undefined ? "done" : "stopped",
+    model: tally.model ?? stringOption(parsed, "model") ?? null,
+    counts: {
+      total,
+      done: tally.done,
+      uncertain: tally.uncertainIds.length,
+      failed: tally.failed.length,
+      skipped,
+      unsent
+    },
+    answers: tally.answers,
+    uncertain_ids: tally.uncertainIds.slice(0, SUMMARY_UNCERTAIN_IDS),
+    failed: tally.failed.slice(0, SUMMARY_FAILED),
+    credits: tally.credits,
+    elapsed_ms: Date.now() - started,
+    out: path107.relative(cwd2, outPath) || outArg,
+    ...stopError !== undefined ? { error: `${stopError}. Answers so far are in ${outArg}; rerun with --resume to continue.` } : {}
+  };
+  stdout(JSON.stringify(summary, null, 2) + `
+`);
+  return stopError === undefined ? 0 : 1;
+}
+
 // src/ui/console-streams.ts
 import { format as format3 } from "node:util";
 function routeConsoleThroughStreams() {
@@ -97272,6 +98848,7 @@ var COMMANDS3 = [
   "status",
   "mcp",
   "integrations",
+  "decide",
   "run",
   "help",
   "version"
@@ -97282,208 +98859,217 @@ var SUBCOMMAND_OWNED_FLAGS = {
 function help() {
   const out = [];
   out.push("");
-  out.push(`  ${brandTint("◆")}  ${import_picocolors80.default.bold("brainbase")}  ${import_picocolors80.default.dim(`v${VERSION}`)}`);
-  out.push(`     ${import_picocolors80.default.dim("connect your local agent to the brainbase platform")}`);
+  out.push(`  ${brandTint("◆")}  ${import_picocolors81.default.bold("brainbase")}  ${import_picocolors81.default.dim(`v${VERSION}`)}`);
+  out.push(`     ${import_picocolors81.default.dim("connect your local agent to the brainbase platform")}`);
   out.push("");
   out.push(divider("USAGE"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.bold("brainbase")} ${import_picocolors80.default.dim("<command> [options]")}`);
+  out.push(`  ${import_picocolors81.default.bold("brainbase")} ${import_picocolors81.default.dim("<command> [options]")}`);
   out.push("");
   out.push(divider("AUTH"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("login")}     ${import_picocolors80.default.dim("  open the web app and connect this device")}`);
-  out.push(`  ${import_picocolors80.default.cyan("logout")}    ${import_picocolors80.default.dim("  clear the local session")}`);
-  out.push(`  ${import_picocolors80.default.cyan("whoami")} ${import_picocolors80.default.dim("[--json]")} ${import_picocolors80.default.dim(" show which credential is in use and what it covers")}`);
+  out.push(`  ${import_picocolors81.default.cyan("login")}     ${import_picocolors81.default.dim("  open the web app and connect this device")}`);
+  out.push(`  ${import_picocolors81.default.cyan("logout")}    ${import_picocolors81.default.dim("  clear the local session")}`);
+  out.push(`  ${import_picocolors81.default.cyan("whoami")} ${import_picocolors81.default.dim("[--json]")} ${import_picocolors81.default.dim(" show which credential is in use and what it covers")}`);
   out.push("");
   out.push(divider("DISCOVERY"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("team list")}                  ${import_picocolors80.default.dim("show the teams you can create agents in")}`);
-  out.push(`  ${import_picocolors80.default.cyan("member ls")}                  ${import_picocolors80.default.dim("show the people in an organization, with the emails interface access takes")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent list")}                 ${import_picocolors80.default.dim("show a team's agents and their ids")}`);
+  out.push(`  ${import_picocolors81.default.cyan("team list")}                  ${import_picocolors81.default.dim("show the teams you can create agents in")}`);
+  out.push(`  ${import_picocolors81.default.cyan("member ls")}                  ${import_picocolors81.default.dim("show the people in an organization, with the emails interface access takes")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent list")}                 ${import_picocolors81.default.dim("show a team's agents and their ids")}`);
   out.push("");
   out.push(divider("LINKED AGENT"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("agent init")}                 ${import_picocolors80.default.dim("write a starter brainbase.agent.yaml here — offline, no login needed")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent create")}               ${import_picocolors80.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent pull")} ${import_picocolors80.default.dim("[<id>]")}          ${import_picocolors80.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint; --link to link first)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent push")}                 ${import_picocolors80.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent delete")} ${import_picocolors80.default.dim("<id>")}          ${import_picocolors80.default.dim("permanently delete a cloud agent and every task it has run")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent unpack")}               ${import_picocolors80.default.dim("install the claimed agent into a harness layout")}`);
-  out.push(`  ${import_picocolors80.default.cyan("link")}                       ${import_picocolors80.default.dim("attach this folder to an existing agent")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent status")}               ${import_picocolors80.default.dim("show what would pull and what would push")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent connections")}          ${import_picocolors80.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent connect")} ${import_picocolors80.default.dim("<name>")}       ${import_picocolors80.default.dim("connect chat, slack, meeting, github, linear or phone")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent disconnect")} ${import_picocolors80.default.dim("<name>")}    ${import_picocolors80.default.dim("disable or disconnect an agent surface")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent surface")} ${import_picocolors80.default.dim("<name>")}       ${import_picocolors80.default.dim("status, settings and setup for all six surfaces (--help)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent versions")}             ${import_picocolors80.default.dim("saved versions: list, show, diff, label, restore, pin and unpin (`agent versions --help`)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent eval")} ${import_picocolors80.default.dim("<list|runs>")}     ${import_picocolors80.default.dim("read eval definitions and judge verdicts (`agent eval --help`)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("agent env")}                  ${import_picocolors80.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
-  out.push(`  ${import_picocolors80.default.cyan("run")} ${import_picocolors80.default.dim("<cmd> [args...]")}         ${import_picocolors80.default.dim("run <cmd> with secrets.env loaded into env")}`);
-  out.push(`  ${import_picocolors80.default.cyan("status")}                     ${import_picocolors80.default.dim("show what this folder is linked to")}`);
-  out.push(`  ${import_picocolors80.default.cyan("unlink")}                     ${import_picocolors80.default.dim("disconnect this folder")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent init")}                 ${import_picocolors81.default.dim("write a starter brainbase.agent.yaml here — offline, no login needed")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent create")}               ${import_picocolors81.default.dim("claim an unclaimed brainbase.agent.yaml and create the cloud agent")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent pull")} ${import_picocolors81.default.dim("[<id>]")}          ${import_picocolors81.default.dim("bring cloud changes into this folder (--force to override; --run-entrypoint to also execute the agent entrypoint; --link to link first)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent push")}                 ${import_picocolors81.default.dim("send local changes to the cloud (--force to overwrite cloud-side conflicts with local)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent delete")} ${import_picocolors81.default.dim("<id>")}          ${import_picocolors81.default.dim("permanently delete a cloud agent and every task it has run")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent unpack")}               ${import_picocolors81.default.dim("install the claimed agent into a harness layout")}`);
+  out.push(`  ${import_picocolors81.default.cyan("link")}                       ${import_picocolors81.default.dim("attach this folder to an existing agent")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent status")}               ${import_picocolors81.default.dim("show what would pull and what would push")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent connections")}          ${import_picocolors81.default.dim("show which integrations this agent is wired to (--json for CI)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent connect")} ${import_picocolors81.default.dim("<name>")}       ${import_picocolors81.default.dim("connect chat, slack, meeting, github, linear or phone")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent disconnect")} ${import_picocolors81.default.dim("<name>")}    ${import_picocolors81.default.dim("disable or disconnect an agent surface")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent surface")} ${import_picocolors81.default.dim("<name>")}       ${import_picocolors81.default.dim("status, settings and setup for all six surfaces (--help)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent versions")}             ${import_picocolors81.default.dim("saved versions: list, show, diff, label, restore, pin and unpin (`agent versions --help`)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent eval")} ${import_picocolors81.default.dim("<list|runs>")}     ${import_picocolors81.default.dim("read eval definitions and judge verdicts (`agent eval --help`)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("agent env")}                  ${import_picocolors81.default.dim("print export lines for `eval $(brainbase agent env)`")}`);
+  out.push(`  ${import_picocolors81.default.cyan("run")} ${import_picocolors81.default.dim("<cmd> [args...]")}         ${import_picocolors81.default.dim("run <cmd> with secrets.env loaded into env")}`);
+  out.push(`  ${import_picocolors81.default.cyan("status")}                     ${import_picocolors81.default.dim("show what this folder is linked to")}`);
+  out.push(`  ${import_picocolors81.default.cyan("unlink")}                     ${import_picocolors81.default.dim("disconnect this folder")}`);
   out.push("");
   out.push(divider("TASKS"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("task create")} ${import_picocolors80.default.dim("--message <text>")}   ${import_picocolors80.default.dim("create a managed task and start its first run (--wait to block on it; --interface <id> for a build conversation)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("task list")}                       ${import_picocolors80.default.dim("recent tasks you can reach (--metadata k=v to filter by label; --interface <id> for its build conversations)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("task get")} ${import_picocolors80.default.dim("<task-id>")}              ${import_picocolors80.default.dim("one task: status, agent, machine, eval verdicts")}`);
-  out.push(`  ${import_picocolors80.default.cyan("task logs")} ${import_picocolors80.default.dim("<task-id> [--follow]")}  ${import_picocolors80.default.dim("one line per event in the task's transcript, or tail it live")}`);
-  out.push(`  ${import_picocolors80.default.cyan("task send")} ${import_picocolors80.default.dim("<task-id> <message>")}  ${import_picocolors80.default.dim("send a follow-up during execution, or queue it for the next turn")}`);
-  out.push(`  ${import_picocolors80.default.cyan("task stop")} ${import_picocolors80.default.dim("<task-id>")}             ${import_picocolors80.default.dim("stop execution and cancel pending follow-ups, retaining their text")}`);
-  out.push(`  ${import_picocolors80.default.cyan("task update")} ${import_picocolors80.default.dim("<task-id>")}           ${import_picocolors80.default.dim("rename a task, change its metadata labels, switch its model or reset it to the agent default, including while it runs")}`);
-  out.push(`  ${import_picocolors80.default.cyan("task delete")} ${import_picocolors80.default.dim("<task-id>")}           ${import_picocolors80.default.dim("permanently delete a stopped task and tear down its sandbox")}`);
+  out.push(`  ${import_picocolors81.default.cyan("task create")} ${import_picocolors81.default.dim("--message <text>")}   ${import_picocolors81.default.dim("create a managed task and start its first run (--wait to block on it; --interface <id> for a build conversation)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("task list")}                       ${import_picocolors81.default.dim("recent tasks you can reach (--metadata k=v to filter by label; --interface <id> for its build conversations)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("task get")} ${import_picocolors81.default.dim("<task-id>")}              ${import_picocolors81.default.dim("one task: status, agent, machine, eval verdicts")}`);
+  out.push(`  ${import_picocolors81.default.cyan("task logs")} ${import_picocolors81.default.dim("<task-id> [--follow]")}  ${import_picocolors81.default.dim("one line per event in the task's transcript, or tail it live")}`);
+  out.push(`  ${import_picocolors81.default.cyan("task send")} ${import_picocolors81.default.dim("<task-id> <message>")}  ${import_picocolors81.default.dim("send a follow-up during execution, or queue it for the next turn")}`);
+  out.push(`  ${import_picocolors81.default.cyan("task stop")} ${import_picocolors81.default.dim("<task-id>")}             ${import_picocolors81.default.dim("stop execution and cancel pending follow-ups, retaining their text")}`);
+  out.push(`  ${import_picocolors81.default.cyan("task update")} ${import_picocolors81.default.dim("<task-id>")}           ${import_picocolors81.default.dim("rename a task, change its metadata labels, switch its model or reset it to the agent default, including while it runs")}`);
+  out.push(`  ${import_picocolors81.default.cyan("task delete")} ${import_picocolors81.default.dim("<task-id>")}           ${import_picocolors81.default.dim("permanently delete a stopped task and tear down its sandbox")}`);
   out.push("");
   out.push(divider("INTERFACES"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("interface ls")}                    ${import_picocolors80.default.dim("dashboards you can see (--agent to narrow)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("interface create")} ${import_picocolors80.default.dim("--name <n>")}     ${import_picocolors80.default.dim("create one on an agent, with who can open it")}`);
-  out.push(`  ${import_picocolors80.default.cyan("interface build")} ${import_picocolors80.default.dim('<id> "<ask>"')}    ${import_picocolors80.default.dim("describe a change; the agent builds it while you watch")}`);
-  out.push(`  ${import_picocolors80.default.cyan("interface publish")} ${import_picocolors80.default.dim("<id>")}          ${import_picocolors80.default.dim("make the newest succeeded build live")}`);
-  out.push(`  ${import_picocolors80.default.cyan("interface rollback")} ${import_picocolors80.default.dim("<id>")}         ${import_picocolors80.default.dim("republish an earlier release under a new id (--release <id>)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("interface access")} ${import_picocolors80.default.dim("<id>")}           ${import_picocolors80.default.dim("show or set who can open it")}`);
-  out.push(`  ${import_picocolors80.default.cyan("interface --help")}                ${import_picocolors80.default.dim("every interface subcommand")}`);
+  out.push(`  ${import_picocolors81.default.cyan("interface ls")}                    ${import_picocolors81.default.dim("dashboards you can see (--agent to narrow)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("interface create")} ${import_picocolors81.default.dim("--name <n>")}     ${import_picocolors81.default.dim("create one on an agent, with who can open it")}`);
+  out.push(`  ${import_picocolors81.default.cyan("interface build")} ${import_picocolors81.default.dim('<id> "<ask>"')}    ${import_picocolors81.default.dim("describe a change; the agent builds it while you watch")}`);
+  out.push(`  ${import_picocolors81.default.cyan("interface publish")} ${import_picocolors81.default.dim("<id>")}          ${import_picocolors81.default.dim("make the newest succeeded build live")}`);
+  out.push(`  ${import_picocolors81.default.cyan("interface rollback")} ${import_picocolors81.default.dim("<id>")}         ${import_picocolors81.default.dim("republish an earlier release under a new id (--release <id>)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("interface access")} ${import_picocolors81.default.dim("<id>")}           ${import_picocolors81.default.dim("show or set who can open it")}`);
+  out.push(`  ${import_picocolors81.default.cyan("interface --help")}                ${import_picocolors81.default.dim("every interface subcommand")}`);
   out.push("");
   out.push(divider("SANDBOXES"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("machine ls")} ${import_picocolors80.default.dim("[--all]")}            ${import_picocolors80.default.dim("list your sandboxes — live ones only unless --all")}`);
-  out.push(`  ${import_picocolors80.default.cyan("machine rm")} ${import_picocolors80.default.dim("<id>")}               ${import_picocolors80.default.dim("tear a sandbox down (it bills until you do)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("machine ls")} ${import_picocolors81.default.dim("[--all]")}            ${import_picocolors81.default.dim("list your sandboxes — live ones only unless --all")}`);
+  out.push(`  ${import_picocolors81.default.cyan("machine rm")} ${import_picocolors81.default.dim("<id>")}               ${import_picocolors81.default.dim("tear a sandbox down (it bills until you do)")}`);
   out.push("");
   out.push(divider("BENCHMARKS"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("benchmark list")}                    ${import_picocolors80.default.dim("list benchmarks for the linked agent")}`);
-  out.push(`  ${import_picocolors80.default.cyan("benchmark init")} ${import_picocolors80.default.dim("[directory]")}        ${import_picocolors80.default.dim("scaffold a local benchmark")}`);
-  out.push(`  ${import_picocolors80.default.cyan("benchmark create")} ${import_picocolors80.default.dim("[path|-]")}         ${import_picocolors80.default.dim("create a benchmark draft")}`);
-  out.push(`  ${import_picocolors80.default.cyan("benchmark run")} ${import_picocolors80.default.dim("<benchmark> --yes")}   ${import_picocolors80.default.dim("plan and start a benchmark run")}`);
-  out.push(`  ${import_picocolors80.default.cyan("benchmark results")} ${import_picocolors80.default.dim("<run>")}           ${import_picocolors80.default.dim("inspect normalized benchmark results")}`);
+  out.push(`  ${import_picocolors81.default.cyan("benchmark list")}                    ${import_picocolors81.default.dim("list benchmarks for the linked agent")}`);
+  out.push(`  ${import_picocolors81.default.cyan("benchmark init")} ${import_picocolors81.default.dim("[directory]")}        ${import_picocolors81.default.dim("scaffold a local benchmark")}`);
+  out.push(`  ${import_picocolors81.default.cyan("benchmark create")} ${import_picocolors81.default.dim("[path|-]")}         ${import_picocolors81.default.dim("create a benchmark draft")}`);
+  out.push(`  ${import_picocolors81.default.cyan("benchmark run")} ${import_picocolors81.default.dim("<benchmark> --yes")}   ${import_picocolors81.default.dim("plan and start a benchmark run")}`);
+  out.push(`  ${import_picocolors81.default.cyan("benchmark results")} ${import_picocolors81.default.dim("<run>")}           ${import_picocolors81.default.dim("inspect normalized benchmark results")}`);
   out.push("");
   out.push(divider("BENCHMARK RUNTIME"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("benchmark hydrate")} ${import_picocolors80.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors80.default.cyan("benchmark evaluate")} ${import_picocolors80.default.dim("--spec <path> --result <path> --json")}`);
-  out.push(`  ${import_picocolors80.default.cyan("benchmark capabilities")} ${import_picocolors80.default.dim("--json")}`);
+  out.push(`  ${import_picocolors81.default.cyan("benchmark hydrate")} ${import_picocolors81.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors81.default.cyan("benchmark evaluate")} ${import_picocolors81.default.dim("--spec <path> --result <path> --json")}`);
+  out.push(`  ${import_picocolors81.default.cyan("benchmark capabilities")} ${import_picocolors81.default.dim("--json")}`);
   out.push("");
   out.push(divider("ORCHESTRATIONS"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("orchestration init")}             ${import_picocolors80.default.dim("write a starter brainbase-orchestration.yaml here (offline, no login)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("orchestration create")}           ${import_picocolors80.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
-  out.push(`  ${import_picocolors80.default.cyan("orchestration list")}             ${import_picocolors80.default.dim("list orchestrations under a team")}`);
-  out.push(`  ${import_picocolors80.default.cyan("orchestration pull")} ${import_picocolors80.default.dim("<id>")}        ${import_picocolors80.default.dim("recursively fetch an orchestration + every member agent")}`);
-  out.push(`  ${import_picocolors80.default.cyan("orchestration push")}             ${import_picocolors80.default.dim("recursively push each member, then update the graph")}`);
-  out.push(`  ${import_picocolors80.default.cyan("orchestration status")}           ${import_picocolors80.default.dim("show what would push and what would pull")}`);
-  out.push(`  ${import_picocolors80.default.cyan("orchestration delete")} ${import_picocolors80.default.dim("<id>")}      ${import_picocolors80.default.dim("permanently delete an orchestration graph (member agents are kept)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("orchestration init")}             ${import_picocolors81.default.dim("write a starter brainbase-orchestration.yaml here (offline, no login)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("orchestration create")}           ${import_picocolors81.default.dim("claim a local orchestration manifest and create it in the cloud")}`);
+  out.push(`  ${import_picocolors81.default.cyan("orchestration list")}             ${import_picocolors81.default.dim("list orchestrations under a team")}`);
+  out.push(`  ${import_picocolors81.default.cyan("orchestration pull")} ${import_picocolors81.default.dim("<id>")}        ${import_picocolors81.default.dim("recursively fetch an orchestration + every member agent")}`);
+  out.push(`  ${import_picocolors81.default.cyan("orchestration push")}             ${import_picocolors81.default.dim("recursively push each member, then update the graph")}`);
+  out.push(`  ${import_picocolors81.default.cyan("orchestration status")}           ${import_picocolors81.default.dim("show what would push and what would pull")}`);
+  out.push(`  ${import_picocolors81.default.cyan("orchestration delete")} ${import_picocolors81.default.dim("<id>")}      ${import_picocolors81.default.dim("permanently delete an orchestration graph (member agents are kept)")}`);
   out.push("");
   out.push(divider("TEMPLATES"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("template pack")}                       ${import_picocolors80.default.dim("bundle the current agent into a template")}`);
-  out.push(`  ${import_picocolors80.default.cyan("template publish")}                    ${import_picocolors80.default.dim("upload a template to the registry")}`);
-  out.push(`  ${import_picocolors80.default.cyan("template search")} ${import_picocolors80.default.dim("[query]")}             ${import_picocolors80.default.dim("search the registry")}`);
-  out.push(`  ${import_picocolors80.default.cyan("template info")}    ${import_picocolors80.default.dim("<creator/slug>")}     ${import_picocolors80.default.dim("show registry details for a template")}`);
-  out.push(`  ${import_picocolors80.default.cyan("template onboard")} ${import_picocolors80.default.dim("<creator/slug>")}     ${import_picocolors80.default.dim("install (or refresh) a template")}`);
-  out.push(`  ${import_picocolors80.default.cyan("template list")}                       ${import_picocolors80.default.dim("show installed templates")}`);
-  out.push(`  ${import_picocolors80.default.cyan("template remove")}  ${import_picocolors80.default.dim("<creator/slug>")}     ${import_picocolors80.default.dim("uninstall a template")}`);
+  out.push(`  ${import_picocolors81.default.cyan("template pack")}                       ${import_picocolors81.default.dim("bundle the current agent into a template")}`);
+  out.push(`  ${import_picocolors81.default.cyan("template publish")}                    ${import_picocolors81.default.dim("upload a template to the registry")}`);
+  out.push(`  ${import_picocolors81.default.cyan("template search")} ${import_picocolors81.default.dim("[query]")}             ${import_picocolors81.default.dim("search the registry")}`);
+  out.push(`  ${import_picocolors81.default.cyan("template info")}    ${import_picocolors81.default.dim("<creator/slug>")}     ${import_picocolors81.default.dim("show registry details for a template")}`);
+  out.push(`  ${import_picocolors81.default.cyan("template onboard")} ${import_picocolors81.default.dim("<creator/slug>")}     ${import_picocolors81.default.dim("install (or refresh) a template")}`);
+  out.push(`  ${import_picocolors81.default.cyan("template list")}                       ${import_picocolors81.default.dim("show installed templates")}`);
+  out.push(`  ${import_picocolors81.default.cyan("template remove")}  ${import_picocolors81.default.dim("<creator/slug>")}     ${import_picocolors81.default.dim("uninstall a template")}`);
   out.push("");
   out.push(divider("SKILLS"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("skill add")} ${import_picocolors80.default.dim("<source>")}                  ${import_picocolors80.default.dim("install a skill (github / git / brainbase)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("skill list")}                            ${import_picocolors80.default.dim("show locally installed skills + their source")}`);
-  out.push(`  ${import_picocolors80.default.cyan("skill update")} ${import_picocolors80.default.dim("<slug>")}                  ${import_picocolors80.default.dim("re-fetch a skill from its recorded source")}`);
-  out.push(`  ${import_picocolors80.default.cyan("skill remove")} ${import_picocolors80.default.dim("<slug>")}                  ${import_picocolors80.default.dim("uninstall a skill")}`);
-  out.push(`  ${import_picocolors80.default.cyan("skill search")} ${import_picocolors80.default.dim("[query]")}                 ${import_picocolors80.default.dim("search the brainbase skill registry")}`);
-  out.push(`  ${import_picocolors80.default.cyan("skill info")} ${import_picocolors80.default.dim("<creator/slug>")}            ${import_picocolors80.default.dim("show registry details for a skill")}`);
-  out.push(`  ${import_picocolors80.default.cyan("skill publish")} ${import_picocolors80.default.dim("[dir]")}                  ${import_picocolors80.default.dim("publish a SKILL.md folder (defaults to .)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("skill add")} ${import_picocolors81.default.dim("<source>")}                  ${import_picocolors81.default.dim("install a skill (github / git / brainbase)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("skill list")}                            ${import_picocolors81.default.dim("show locally installed skills + their source")}`);
+  out.push(`  ${import_picocolors81.default.cyan("skill update")} ${import_picocolors81.default.dim("<slug>")}                  ${import_picocolors81.default.dim("re-fetch a skill from its recorded source")}`);
+  out.push(`  ${import_picocolors81.default.cyan("skill remove")} ${import_picocolors81.default.dim("<slug>")}                  ${import_picocolors81.default.dim("uninstall a skill")}`);
+  out.push(`  ${import_picocolors81.default.cyan("skill search")} ${import_picocolors81.default.dim("[query]")}                 ${import_picocolors81.default.dim("search the brainbase skill registry")}`);
+  out.push(`  ${import_picocolors81.default.cyan("skill info")} ${import_picocolors81.default.dim("<creator/slug>")}            ${import_picocolors81.default.dim("show registry details for a skill")}`);
+  out.push(`  ${import_picocolors81.default.cyan("skill publish")} ${import_picocolors81.default.dim("[dir]")}                  ${import_picocolors81.default.dim("publish a SKILL.md folder (defaults to .)")}`);
   out.push("");
   out.push(divider("CLI TOKENS"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("token create")}                        ${import_picocolors80.default.dim("issue a long-lived CLI key for CI / scripts")}`);
-  out.push(`  ${import_picocolors80.default.cyan("token list")}                          ${import_picocolors80.default.dim("show your tokens")}`);
-  out.push(`  ${import_picocolors80.default.cyan("token rename")} ${import_picocolors80.default.dim("<id>")}                  ${import_picocolors80.default.dim("relabel a token")}`);
-  out.push(`  ${import_picocolors80.default.cyan("token revoke")} ${import_picocolors80.default.dim("<id>")}                  ${import_picocolors80.default.dim("revoke a token")}`);
+  out.push(`  ${import_picocolors81.default.cyan("token create")}                        ${import_picocolors81.default.dim("issue a long-lived CLI key for CI / scripts")}`);
+  out.push(`  ${import_picocolors81.default.cyan("token list")}                          ${import_picocolors81.default.dim("show your tokens")}`);
+  out.push(`  ${import_picocolors81.default.cyan("token rename")} ${import_picocolors81.default.dim("<id>")}                  ${import_picocolors81.default.dim("relabel a token")}`);
+  out.push(`  ${import_picocolors81.default.cyan("token revoke")} ${import_picocolors81.default.dim("<id>")}                  ${import_picocolors81.default.dim("revoke a token")}`);
+  out.push("");
+  out.push(divider("DECISIONS"));
+  out.push("");
+  out.push(`  ${import_picocolors81.default.cyan("decide")} ${import_picocolors81.default.dim("-q <questions.json> <sources...>")}  ${import_picocolors81.default.dim("answer decision-model questions over many files or rows in a few requests (`decide --help`)")}`);
   out.push("");
   out.push(divider("MCP"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("mcp check")} ${import_picocolors80.default.dim("[--json]")}              ${import_picocolors80.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
-  out.push(`  ${import_picocolors80.default.cyan("mcp list")} ${import_picocolors80.default.dim("[--json]")}               ${import_picocolors80.default.dim("show configured servers with OAuth state and expiry")}`);
-  out.push(`  ${import_picocolors80.default.cyan("mcp connect")} ${import_picocolors80.default.dim("<name>")}              ${import_picocolors80.default.dim("authorize an OAuth-backed server: prints a single-use link, opens it, waits for approval")}`);
+  out.push(`  ${import_picocolors81.default.cyan("mcp check")} ${import_picocolors81.default.dim("[--json]")}              ${import_picocolors81.default.dim("verify MCP server connectivity through the brainbase proxy (runs at sandbox bootstrap)")}`);
+  out.push(`  ${import_picocolors81.default.cyan("mcp list")} ${import_picocolors81.default.dim("[--json]")}               ${import_picocolors81.default.dim("show configured servers with OAuth state and expiry")}`);
+  out.push(`  ${import_picocolors81.default.cyan("mcp connect")} ${import_picocolors81.default.dim("<name>")}              ${import_picocolors81.default.dim("authorize an OAuth-backed server: prints a single-use link, opens it, waits for approval")}`);
   out.push("");
   out.push(divider("INTEGRATIONS"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.cyan("integrations list")}                 ${import_picocolors80.default.dim("show the agent's Pipedream apps, accounts and app-level permission")}`);
-  out.push(`  ${import_picocolors80.default.cyan("integrations search")} ${import_picocolors80.default.dim("<query>")}       ${import_picocolors80.default.dim("find apps in the Pipedream catalog")}`);
-  out.push(`  ${import_picocolors80.default.cyan("integrations actions")} ${import_picocolors80.default.dim("<app>")}        ${import_picocolors80.default.dim("list an app's actions and whether each is allowed")}`);
-  out.push(`  ${import_picocolors80.default.cyan("integrations add")} ${import_picocolors80.default.dim("<app>")}            ${import_picocolors80.default.dim("install an app; one that needs an account runs connect")}`);
-  out.push(`  ${import_picocolors80.default.cyan("integrations connect")} ${import_picocolors80.default.dim("<app>")}        ${import_picocolors80.default.dim("open Pipedream's connect page for the app and wait for the account")}`);
-  out.push(`  ${import_picocolors80.default.cyan("integrations disconnect")} ${import_picocolors80.default.dim("<app>")}     ${import_picocolors80.default.dim("delete the app's connected account")}`);
-  out.push(`  ${import_picocolors80.default.cyan("integrations remove")} ${import_picocolors80.default.dim("<app>")}         ${import_picocolors80.default.dim("uninstall an app that needs no account")}`);
-  out.push(`  ${import_picocolors80.default.cyan("integrations allow|ask|deny")} ${import_picocolors80.default.dim("<app>[.<action>]")} ${import_picocolors80.default.dim("set the permission for an app or one of its actions")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations list")}                 ${import_picocolors81.default.dim("show the agent's Pipedream apps, accounts and app-level permission")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations search")} ${import_picocolors81.default.dim("<query>")}       ${import_picocolors81.default.dim("find apps in the Pipedream catalog")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations actions")} ${import_picocolors81.default.dim("<app>")}        ${import_picocolors81.default.dim("list an app's actions and whether each is allowed")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations add")} ${import_picocolors81.default.dim("<app>")}            ${import_picocolors81.default.dim("install an app; one that needs an account runs connect")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations connect")} ${import_picocolors81.default.dim("<app>")}        ${import_picocolors81.default.dim("open Pipedream's connect page for the app and wait for the account")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations disconnect")} ${import_picocolors81.default.dim("<app>")}     ${import_picocolors81.default.dim("delete the app's connected account")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations remove")} ${import_picocolors81.default.dim("<app>")}         ${import_picocolors81.default.dim("uninstall an app that needs no account")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations allow|ask|deny")} ${import_picocolors81.default.dim("<app>[.<action>]")} ${import_picocolors81.default.dim("set the permission for an app or one of its actions")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations context create")} ${import_picocolors81.default.dim("--application <name>")} ${import_picocolors81.default.dim("let a program outside Brainbase (the SDK) use the agent's integrations; prints a renewal handle once")}`);
+  out.push(`  ${import_picocolors81.default.cyan("integrations context end")} ${import_picocolors81.default.dim("<context-id>")}  ${import_picocolors81.default.dim("end a standalone integration context now")}`);
   out.push("");
   out.push(divider("FLAGS"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
-  out.push(`  ${import_picocolors80.default.dim("--scope <s>")}        force scope: global | project`);
-  out.push(`  ${import_picocolors80.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
+  out.push(`  ${import_picocolors81.default.dim("--harness <id>")}     force harness for onboard / sync (e.g. claude-code)`);
+  out.push(`  ${import_picocolors81.default.dim("--scope <s>")}        force scope: global | project`);
+  out.push(`  ${import_picocolors81.default.dim("--yes, -y")}          skip confirmations / auto-overwrite`);
   out.push(`  ${" ".repeat("--yes, -y".length)}          required for destructive commands with no terminal (pipes, CI)`);
-  out.push(`  ${import_picocolors80.default.dim("--agent <id>")}       for link/task create/mcp list/mcp connect/integrations: use this agent id explicitly instead of the linked folder's (task list: filter to it)`);
-  out.push(`  ${import_picocolors80.default.dim("--message <text>")}   for task create: required first user message`);
-  out.push(`  ${import_picocolors80.default.dim("--title <text>")}     for task create: optional task title; for task update: the new title`);
-  out.push(`  ${import_picocolors80.default.dim("--clear-title")}      for task update: remove the title (automatic titling may name it again later)`);
-  out.push(`  ${import_picocolors80.default.dim("--metadata k=v")}     for task create: label the task; for task list: only tasks with this label; for task update: set one label, keeping the others (all repeatable)`);
-  out.push(`  ${import_picocolors80.default.dim("--unset-metadata <k>")} for task update: remove one label (repeatable)`);
-  out.push(`  ${import_picocolors80.default.dim("--clear-metadata")}   for task update: remove every label; with --metadata, keep only those given`);
-  out.push(`  ${import_picocolors80.default.dim("--model <id>")}       for task create: optional model override; for task update: switch the model the task's next turn runs on (the running turn keeps its model)`);
-  out.push(`  ${import_picocolors80.default.dim("--clear-model")}      for task update: go back to the agent's default model from the next turn`);
-  out.push(`  ${import_picocolors80.default.dim("--version <v>")}      for task create: run a saved version of the agent (12, v12 or a version id)`);
-  out.push(`  ${import_picocolors80.default.dim("--wait")}             for task create: block until the task finishes; exit 1 unless it succeeded`);
-  out.push(`  ${import_picocolors80.default.dim("--timeout <secs>")}   for task create --wait: give up after <secs> and exit 1`);
-  out.push(`  ${import_picocolors80.default.dim("--limit <n>")}        for task list (1-200), task logs (events to print; with --follow, the first page size) and machine ls`);
-  out.push(`  ${import_picocolors80.default.dim("--follow, -f")}       for task logs: stay attached and print events as they land`);
-  out.push(`  ${import_picocolors80.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
-  out.push(`  ${import_picocolors80.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
-  out.push(`  ${import_picocolors80.default.dim("--all-teams")}        for agent list: every team in the org (the default with no terminal)`);
-  out.push(`  ${import_picocolors80.default.dim("--json")}             machine-readable output for supported commands`);
-  out.push(`  ${import_picocolors80.default.dim("--no-tracking")}      for link / agent pull --link: skip routing LLM traffic through brainbase`);
-  out.push(`  ${import_picocolors80.default.dim("--link")}             for agent pull: link this folder to the agent first, as \`brainbase link --agent <id> --yes\` would, in one process`);
-  out.push(`  ${import_picocolors80.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
-  out.push(`  ${import_picocolors80.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
-  out.push(`  ${import_picocolors80.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
-  out.push(`  ${import_picocolors80.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
-  out.push(`  ${import_picocolors80.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
-  out.push(`  ${import_picocolors80.default.dim("--app-id <id> / --app-name <name>")}  optional Slack app identity`);
-  out.push(`  ${import_picocolors80.default.dim("--bot-image-url <url>")}  optional meeting bot image`);
-  out.push(`  ${import_picocolors80.default.dim("--full")}             for agent/orchestration init: write a commented template covering every block`);
-  out.push(`  ${import_picocolors80.default.dim("--minimal")}          for agent init: write the starter manifest (the default)`);
-  out.push(`  ${import_picocolors80.default.dim("--all")}              for template list: include installs from other folders; for machine ls: include torn-down machines`);
-  out.push(`  ${import_picocolors80.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors80.default.dim("--no-open")}          for mcp/integrations connect: print the link without opening a browser (implied with no terminal)`);
-  out.push(`  ${import_picocolors80.default.dim("--no-wait")}          for mcp/integrations connect: print the link and exit instead of waiting`);
-  out.push(`  ${import_picocolors80.default.dim("--account <id>")}     for integrations disconnect: which account, when the app has more than one`);
+  out.push(`  ${import_picocolors81.default.dim("--agent <id>")}       for link/task create/mcp list/mcp connect/integrations: use this agent id explicitly instead of the linked folder's (task list: filter to it)`);
+  out.push(`  ${import_picocolors81.default.dim("--message <text>")}   for task create: required first user message`);
+  out.push(`  ${import_picocolors81.default.dim("--title <text>")}     for task create: optional task title; for task update: the new title`);
+  out.push(`  ${import_picocolors81.default.dim("--clear-title")}      for task update: remove the title (automatic titling may name it again later)`);
+  out.push(`  ${import_picocolors81.default.dim("--metadata k=v")}     for task create: label the task; for task list: only tasks with this label; for task update: set one label, keeping the others (all repeatable)`);
+  out.push(`  ${import_picocolors81.default.dim("--unset-metadata <k>")} for task update: remove one label (repeatable)`);
+  out.push(`  ${import_picocolors81.default.dim("--clear-metadata")}   for task update: remove every label; with --metadata, keep only those given`);
+  out.push(`  ${import_picocolors81.default.dim("--model <id>")}       for task create: optional model override; for task update: switch the model the task's next turn runs on (the running turn keeps its model)`);
+  out.push(`  ${import_picocolors81.default.dim("--clear-model")}      for task update: go back to the agent's default model from the next turn`);
+  out.push(`  ${import_picocolors81.default.dim("--version <v>")}      for task create: run a saved version of the agent (12, v12 or a version id)`);
+  out.push(`  ${import_picocolors81.default.dim("--wait")}             for task create: block until the task finishes; exit 1 unless it succeeded`);
+  out.push(`  ${import_picocolors81.default.dim("--timeout <secs>")}   for task create --wait: give up after <secs> and exit 1`);
+  out.push(`  ${import_picocolors81.default.dim("--limit <n>")}        for task list (1-200), task logs (events to print; with --follow, the first page size) and machine ls`);
+  out.push(`  ${import_picocolors81.default.dim("--follow, -f")}       for task logs: stay attached and print events as they land`);
+  out.push(`  ${import_picocolors81.default.dim("--org <id-or-slug>")} pick the organization (team/agent list, agent create, orchestration create/list)`);
+  out.push(`  ${import_picocolors81.default.dim("--team <id>")}        pick the team, same commands (works without --org)`);
+  out.push(`  ${import_picocolors81.default.dim("--all-teams")}        for agent list: every team in the org (the default with no terminal)`);
+  out.push(`  ${import_picocolors81.default.dim("--json")}             machine-readable output for supported commands`);
+  out.push(`  ${import_picocolors81.default.dim("--no-tracking")}      for link / agent pull --link: skip routing LLM traffic through brainbase`);
+  out.push(`  ${import_picocolors81.default.dim("--link")}             for agent pull: link this folder to the agent first, as \`brainbase link --agent <id> --yes\` would, in one process`);
+  out.push(`  ${import_picocolors81.default.dim("--track")}            for agent create: enable tracking non-interactively (off without a TTY)`);
+  out.push(`  ${import_picocolors81.default.dim("--shell <sh|fish>")}  for agent env: pick output format (auto-detected from $SHELL)`);
+  out.push(`  ${import_picocolors81.default.dim("--bot-token <t>")}    for agent connect slack (or BRAINBASE_SLACK_BOT_TOKEN, or stdin)`);
+  out.push(`  ${import_picocolors81.default.dim("--signing-secret <s>")} for agent connect slack (or BRAINBASE_SLACK_SIGNING_SECRET, or stdin)`);
+  out.push(`  ${import_picocolors81.default.dim("--bot-name <name>")}  for agent connect meeting: the bot's display name`);
+  out.push(`  ${import_picocolors81.default.dim("--app-id <id> / --app-name <name>")}  optional Slack app identity`);
+  out.push(`  ${import_picocolors81.default.dim("--bot-image-url <url>")}  optional meeting bot image`);
+  out.push(`  ${import_picocolors81.default.dim("--full")}             for agent/orchestration init: write a commented template covering every block`);
+  out.push(`  ${import_picocolors81.default.dim("--minimal")}          for agent init: write the starter manifest (the default)`);
+  out.push(`  ${import_picocolors81.default.dim("--all")}              for template list: include installs from other folders; for machine ls: include torn-down machines`);
+  out.push(`  ${import_picocolors81.default.dim("--web <url>")}        for login: web app URL (default https://app.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors81.default.dim("--no-open")}          for mcp/integrations connect: print the link without opening a browser (implied with no terminal)`);
+  out.push(`  ${import_picocolors81.default.dim("--no-wait")}          for mcp/integrations connect: print the link and exit instead of waiting`);
+  out.push(`  ${import_picocolors81.default.dim("--account <id>")}     for integrations disconnect: which account, when the app has more than one`);
+  out.push(`  ${import_picocolors81.default.dim("--application <name>")} for integrations context create: names the program the context is for`);
+  out.push(`  ${import_picocolors81.default.dim("--max-lifetime <dur>")} for integrations context create: when the context ends at the latest, 60s-30d (default 7d)`);
+  out.push(`  ${import_picocolors81.default.dim("--reason <text>")}    for integrations context end: recorded with the context`);
   out.push("");
   out.push(divider("ENV"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login, console links and integrations`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task and interface commands use /v2/tasks and /v2/interfaces)`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT; outranks the login session and the PAT saved in token.json`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login, console links and integrations`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task and interface commands use /v2/tasks and /v2/interfaces)`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_PROXY_URL")}    override the model-proxy URL used by harness traffic (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_REGISTRY_URL")} override the registry API URL (default https://api.v1.brainbaselabs.com)`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_TOKEN")}        long-lived CLI PAT; outranks the login session and the PAT saved in token.json`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_SKIP_AUTH")}    bypass the auth gate for development`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_NON_INTERACTIVE")} force non-interactive mode — skip/auto-default prompts (CI & agents)`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_RUN_ENTRYPOINT")} =1 → agent pull executes the agent entrypoint (sandbox boots; or pass --run-entrypoint)`);
   out.push("");
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_LINEAR_MCP_URL")}        override the built-in Linear MCP host`);
-  out.push(`  ${import_picocolors80.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_MEMORY_MCP_URL")}        override the built-in memory MCP host`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_BROWSER_MCP_URL")}       override the built-in browser MCP host`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_SLACK_MCP_URL")}         override the built-in Slack MCP host`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_MEETING_MCP_URL")}       override the built-in meeting MCP host`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_GITHUB_MCP_URL")}        override the built-in GitHub MCP host`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_LINEAR_MCP_URL")}        override the built-in Linear MCP host`);
+  out.push(`  ${import_picocolors81.default.dim("BRAINBASE_ORCHESTRATION_MCP_URL")} override the built-in orchestration MCP host`);
   out.push("");
   out.push(divider("HARNESSES"));
   out.push("");
-  out.push(`  ${import_picocolors80.default.dim("•")} ${import_picocolors80.default.bold("claude-code")}  ${import_picocolors80.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors80.default.dim("•")} ${import_picocolors80.default.bold("codex")}        ${import_picocolors80.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
-  out.push(`  ${import_picocolors80.default.dim("•")} ${import_picocolors80.default.bold("kafka")}        ${import_picocolors80.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors81.default.dim("•")} ${import_picocolors81.default.bold("claude-code")}  ${import_picocolors81.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors81.default.dim("•")} ${import_picocolors81.default.bold("codex")}        ${import_picocolors81.default.dim("skills, mcps, commands, playbooks, instructions, files")}`);
+  out.push(`  ${import_picocolors81.default.dim("•")} ${import_picocolors81.default.bold("kafka")}        ${import_picocolors81.default.dim("skills, mcps, agents, commands, playbooks, instructions, files")}`);
   out.push("");
   console.log(out.join(`
 `));
@@ -97517,7 +99103,10 @@ var VALUE_TAKING_FLAGS = new Set([
   "--bot-image-url",
   "--task-id",
   "--limit",
-  "--file"
+  "--file",
+  "--application",
+  "--max-lifetime",
+  "--reason"
 ]);
 function isValueOfPriorFlag2(args, index) {
   return index > 0 && VALUE_TAKING_FLAGS.has(args[index - 1]);
@@ -97638,10 +99227,10 @@ async function requireAuth(cmd) {
   if (storedPatFor(status.session))
     return;
   console.error("");
-  console.error(`  ${brandTint("◆")}  ${import_picocolors80.default.bold("brainbase")}`);
+  console.error(`  ${brandTint("◆")}  ${import_picocolors81.default.bold("brainbase")}`);
   console.error("");
-  console.error(`  ${import_picocolors80.default.red("✗")}  You need to sign in to use ${import_picocolors80.default.bold("brainbase " + cmd)}.`);
-  console.error(`     ${import_picocolors80.default.dim(noUsableCredentialMessage())}`);
+  console.error(`  ${import_picocolors81.default.red("✗")}  You need to sign in to use ${import_picocolors81.default.bold("brainbase " + cmd)}.`);
+  console.error(`     ${import_picocolors81.default.dim(noUsableCredentialMessage())}`);
   console.error("");
   process14.exit(1);
 }
@@ -97651,7 +99240,7 @@ async function main() {
   const rawCwd = process14.cwd();
   const cwd2 = (() => {
     try {
-      return fs94.realpathSync(rawCwd);
+      return fs96.realpathSync(rawCwd);
     } catch {
       return rawCwd;
     }
@@ -97668,7 +99257,7 @@ async function main() {
     await runRun(cwd2, argv);
     return;
   }
-  const ownsArgs = new Set(["task", "benchmark", "interface", "interfaces"]);
+  const ownsArgs = new Set(["task", "benchmark", "interface", "interfaces", "decide"]);
   if (cmd === "agent")
     argv.splice(0, argv.length, ...routeAgentSurfaceArgs(argv));
   const sharedArgs = ownsArgs.has(cmd) || cmd === "agent" && ["versions", "surface", "connect", "disconnect", "connections"].includes(argv[0] ?? "") ? [] : argv;
@@ -97905,6 +99494,10 @@ async function main() {
         process14.exitCode = code;
         break;
       }
+      case "decide": {
+        process14.exitCode = await runDecide(cwd2, argv);
+        break;
+      }
       case "integration":
       case "integrations": {
         const sub = argv.shift();
@@ -97925,12 +99518,12 @@ ${didYouMean(cmd, COMMANDS3, "brainbase")}`);
         process14.exit(1);
     }
   } catch (err) {
-    const message2 = sanitizeLines(err.message).join(`
+    const message3 = sanitizeLines(err.message).join(`
 `);
-    console.error(import_picocolors80.default.red(`
-${message2}`));
+    console.error(import_picocolors81.default.red(`
+${message3}`));
     if (err instanceof ApiError && err.status === 401 && !err.message.includes("brainbase login")) {
-      console.error(`  Run ${import_picocolors80.default.cyan("brainbase login")} to connect this device.`);
+      console.error(`  Run ${import_picocolors81.default.cyan("brainbase login")} to connect this device.`);
     }
     if (process14.env.BRAINBASE_DEBUG)
       console.error(err.stack);