@brainbase-labs/cli 0.58.0 → 0.59.0-rc.1

package/dist/index.js

@@ -36091,7 +36091,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.58.0",
+  version: "0.59.0-rc.1",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -40975,6 +40975,245 @@ import fs7 from "node:fs";
 import path8 from "node:path";
 import fs6 from "node:fs";
 import { randomUUID } from "node:crypto";
+
+// src/core/http-retry.ts
+var HTTP_RETRY_DEADLINE_MS = 30000;
+var HTTP_RETRY_MAX_ATTEMPTS = 3;
+var DEFAULT_RETRY_BUDGET_MS = 300000;
+var IDLE_WATCHDOG_MS = 45000;
+var REFRESH_RETRY_WINDOW_MS = 8000;
+var FULL_JITTER_BASE_MS = 100;
+var FULL_JITTER_FACTOR = 2;
+var FULL_JITTER_MAX_MS = 30000;
+var STREAM_RETRY_MAX_DELAY_MS = 30000;
+function httpRetryEnabled(env = process.env) {
+  return env.BRAINBASE_HTTP_RETRY?.trim() !== "0";
+}
+function parseRetryAfterMs(header, nowMs = Date.now()) {
+  const raw = header?.trim();
+  if (!raw)
+    return null;
+  if (/^\d+$/.test(raw)) {
+    const delayMs = Number(raw) * 1000;
+    return Number.isFinite(delayMs) ? delayMs : null;
+  }
+  const weekday = "(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)";
+  const month = "(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)";
+  const time = "\\d{2}:\\d{2}:\\d{2}";
+  const httpDateForms = [
+    `${weekday}, \\d{2} ${month} \\d{4} ${time} GMT`,
+    `(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), \\d{2}-${month}-\\d{2} ${time} GMT`,
+    `${weekday} ${month} (?: \\d|\\d{2}) ${time} \\d{4}`
+  ];
+  if (!httpDateForms.some((form) => new RegExp(`^${form}$`).test(raw)))
+    return null;
+  const date = Date.parse(raw.endsWith("GMT") ? raw : `${raw} GMT`);
+  if (Number.isNaN(date))
+    return null;
+  return Math.max(0, date - nowMs);
+}
+function fullJitterDelayMs(attempt, opts = {}) {
+  const { baseMs = FULL_JITTER_BASE_MS, factor = FULL_JITTER_FACTOR, maxMs = FULL_JITTER_MAX_MS } = opts;
+  const draw = opts.rng ?? Math.random;
+  const exponent = Math.max(0, Math.floor(attempt));
+  const cap = Math.min(maxMs, baseMs * factor ** exponent);
+  return Math.floor(draw() * cap);
+}
+function createRetryBudget(totalMs, startedAtMs = Date.now()) {
+  const deadlineMs = startedAtMs + totalMs;
+  return {
+    totalMs,
+    remainingMs(nowMs = Date.now()) {
+      return Math.max(0, deadlineMs - nowMs);
+    },
+    fits(delayMs, nowMs = Date.now()) {
+      return delayMs < this.remainingMs(nowMs);
+    }
+  };
+}
+function retryDelayMs(attempt, budget, retryAfterHeader, opts = {}, nowMs = Date.now()) {
+  const parsed = parseRetryAfterMs(retryAfterHeader, nowMs);
+  const delayMs = parsed ?? fullJitterDelayMs(attempt, opts);
+  return budget.fits(delayMs, nowMs) ? delayMs : null;
+}
+var UNSENT_CODES = new Set([
+  "ConnectionRefused",
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "FailedToOpenSocket",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_POOL_TIMEOUT",
+  "UND_ERR_QUEUE_TIMEOUT",
+  "ConnectError",
+  "CERT_HAS_EXPIRED",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+var AMBIGUOUS_CODES = new Set([
+  "ECONNRESET",
+  "EPIPE",
+  "UND_ERR_SOCKET",
+  "UND_ERR_BODY_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "SocketError"
+]);
+function networkFailureCode(error) {
+  const seen = new Set;
+  while (error && typeof error === "object" && !seen.has(error)) {
+    seen.add(error);
+    const record = error;
+    if (typeof record.code === "string")
+      return record.code;
+    error = record.cause;
+  }
+  return;
+}
+function isHttpTimeout(error) {
+  const seen = new Set;
+  while (error && typeof error === "object" && !seen.has(error)) {
+    seen.add(error);
+    const record = error;
+    if (record.name === "TimeoutError" || record.name === "TimeoutDOMException" || record.code === "request_timeout" || record.code === "UND_ERR_BODY_TIMEOUT" || record.code === "UND_ERR_HEADERS_TIMEOUT")
+      return true;
+    error = record.cause;
+  }
+  return false;
+}
+function classifyHttpFailure(error, keyed = false) {
+  if (!error || typeof error !== "object")
+    return "permanent";
+  const record = error;
+  const code = record.body?.code ?? record.body?.detail?.code ?? record.body?.error?.code ?? record.code;
+  if (code === "invalid_grant" || code === "idempotency_key_reused" || code === "idempotency_resource_deleted")
+    return "permanent";
+  const networkCode = networkFailureCode(record.cause) ?? networkFailureCode(error);
+  if (networkCode === "ERR_INVALID_URL" || record.cause?.message === "bad port")
+    return "permanent";
+  if (record.definitelyUnsent === true)
+    return "unsent";
+  if (["ConnectError", "ConnectTimeoutError", "PoolTimeoutError"].includes(record.name ?? ""))
+    return "unsent";
+  if (record.definitelyUnsent === false)
+    return "ambiguous";
+  if (UNSENT_CODES.has(networkCode ?? ""))
+    return "unsent";
+  if (AMBIGUOUS_CODES.has(networkCode ?? "") || isHttpTimeout(error))
+    return "ambiguous";
+  if (record.status === 409)
+    return keyed && code === "idempotency_request_in_progress" ? "retryable_status" : "permanent";
+  if ([408, 425, 429, 500, 502, 503, 504, 520, 521, 522, 523, 524].includes(record.status ?? 0))
+    return "retryable_status";
+  if (/^(PGRST00[0-3]|08\w*|53300|57P0\w)$/.test(code ?? ""))
+    return "retryable_status";
+  if (record.name === "TypeError" && /fetch failed|terminated|socket|disconnected/i.test(record.message ?? ""))
+    return "ambiguous";
+  return "permanent";
+}
+function retrySleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason);
+      return;
+    }
+    const abort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", abort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", abort, { once: true });
+  });
+}
+function logRetryEvent(event) {
+  const logger = {
+    warn: console.warn,
+    error: console.error,
+    info: (record) => {
+      process.stderr.write(`${record}
+`);
+    }
+  };
+  const log = event.event === "retry_attempt" ? logger.warn : event.event === "retry_exhausted" ? logger.error : logger.info;
+  log(JSON.stringify(event));
+}
+async function retryHttpRequest(operation, options) {
+  if (!httpRetryEnabled())
+    return operation(options.signal, 1);
+  const now = options.now ?? Date.now;
+  const started = now();
+  const budget = createRetryBudget(options.budgetMs ?? HTTP_RETRY_DEADLINE_MS, started);
+  const emit = options.onRetryEvent ?? logRetryEvent;
+  const sleep = options.sleep ?? retrySleep;
+  const maxAttempts = options.maxAttempts ?? HTTP_RETRY_MAX_ATTEMPTS;
+  let lastError;
+  for (let attempt = 1;; attempt++) {
+    if (options.signal?.aborted)
+      throw options.signal.reason;
+    const remaining = budget.remainingMs(now());
+    if (remaining <= 0)
+      throw lastError ?? new DOMException("HTTP retry budget exhausted", "TimeoutError");
+    const controller = new AbortController;
+    const abort = () => controller.abort(options.signal?.reason);
+    options.signal?.addEventListener("abort", abort, { once: true });
+    const timeout = setTimeout(() => controller.abort(new DOMException("HTTP request deadline exceeded", "TimeoutError")), Math.max(1, Math.floor(Math.min(remaining, options.timeoutMs ?? remaining))));
+    let rejectAbort;
+    try {
+      const aborted = new Promise((_resolve, reject) => {
+        rejectAbort = () => reject(controller.signal.reason);
+        controller.signal.addEventListener("abort", rejectAbort, { once: true });
+      });
+      const result = await Promise.race([operation(controller.signal, attempt), aborted]);
+      if (budget.remainingMs(now()) <= 0)
+        throw new DOMException("HTTP request deadline exceeded", "TimeoutError");
+      return result;
+    } catch (error) {
+      lastError = error;
+    } finally {
+      clearTimeout(timeout);
+      options.signal?.removeEventListener("abort", abort);
+      if (rejectAbort)
+        controller.signal.removeEventListener("abort", rejectAbort);
+    }
+    if (options.signal?.aborted)
+      throw options.signal.reason;
+    const failureClass = classifyHttpFailure(lastError, options.keyed);
+    const attemptsUsed = Math.max(attempt, options.attemptsUsed?.() ?? attempt);
+    const record = lastError;
+    const event = {
+      layer: options.layer ?? "http",
+      op: options.op ?? "request",
+      attempt: attemptsUsed,
+      class: failureClass,
+      status: record?.status ?? null,
+      elapsed_ms: Math.max(0, Math.floor(now() - started)),
+      budget_ms: budget.totalMs,
+      error: record?.name ?? "Error"
+    };
+    const retryable = failureClass === "unsent" || (failureClass === "ambiguous" || failureClass === "retryable_status") && (options.idempotent || options.keyed);
+    if (!retryable || failureClass === "ambiguous" && options.retryTimeouts === false && isHttpTimeout(lastError)) {
+      if (failureClass !== "permanent")
+        emit({ ...event, event: "retry_deferred" });
+      throw lastError;
+    }
+    const delay = retryDelayMs(attemptsUsed - 1, budget, record?.retryAfter, { rng: options.rng }, now());
+    if (attemptsUsed >= maxAttempts || delay === null) {
+      emit({ ...event, event: "retry_exhausted" });
+      throw lastError;
+    }
+    emit({ ...event, event: "retry_attempt", delay_ms: delay });
+    await sleep(delay, options.signal);
+    if (budget.remainingMs(now()) <= 0) {
+      emit({ ...event, event: "retry_exhausted", elapsed_ms: Math.max(0, Math.floor(now() - started)) });
+      throw lastError;
+    }
+  }
+}
+
+// src/core/auth.ts
 var AUTH_FILE = path8.join(BRAINBASE_HOME, "auth.json");
 var AUTH_LOCK_FILE = `${AUTH_FILE}.lock`;
 var AUTH_LOCK_TIMEOUT_MS = 5000;
@@ -41038,15 +41277,15 @@ function acquireLock(lockFile, timeoutMs) {
     }
   }
 }
-function acquireAuthLock() {
-  const release = acquireLock(AUTH_LOCK_FILE, AUTH_LOCK_TIMEOUT_MS);
+function acquireAuthLock(timeoutMs = AUTH_LOCK_TIMEOUT_MS) {
+  const release = acquireLock(AUTH_LOCK_FILE, timeoutMs);
   if (!release) {
     throw new Error(`Timed out waiting to update CLI authentication.${lockHolderState(AUTH_LOCK_FILE)} Retry, or remove ${AUTH_LOCK_FILE}`);
   }
   return release;
 }
-function withAuthLock(operation) {
-  const release = acquireAuthLock();
+function withAuthLock(operation, timeoutMs = AUTH_LOCK_TIMEOUT_MS) {
+  const release = acquireAuthLock(timeoutMs);
   try {
     return operation();
   } finally {
@@ -41183,6 +41422,163 @@ function markRefreshRejected(session, code) {
     });
   });
 }
+function isUnsentAuthRequest(cause) {
+  const seen = new Set;
+  while (cause && typeof cause === "object" && !seen.has(cause)) {
+    seen.add(cause);
+    const value = cause;
+    if (value.code && [
+      "ConnectionRefused",
+      "ECONNREFUSED",
+      "ENOTFOUND",
+      "EAI_AGAIN",
+      "FailedToOpenSocket",
+      "UND_ERR_CONNECT_TIMEOUT"
+    ].includes(value.code))
+      return true;
+    cause = value.cause;
+  }
+  return false;
+}
+async function exchangeRefresh(session, timeoutMs) {
+  let res;
+  try {
+    res = await fetch(`${session.supabase_url.replace(/\/+$/, "")}/auth/v1/token?grant_type=refresh_token`, {
+      method: "POST",
+      signal: AbortSignal.timeout(Math.max(1, Math.floor(timeoutMs))),
+      headers: {
+        "Content-Type": "application/json",
+        apikey: session.supabase_anon_key,
+        Authorization: `Bearer ${session.supabase_anon_key}`
+      },
+      body: JSON.stringify({ refresh_token: session.refresh_token })
+    });
+  } catch (cause) {
+    return {
+      kind: "transient",
+      failure: {
+        kind: "transient",
+        class: isUnsentAuthRequest(cause) ? "unsent" : "ambiguous",
+        status: null,
+        detail: "couldn't reach the auth server",
+        cause
+      }
+    };
+  }
+  if (!res.ok) {
+    const code = await rejectionCode(res);
+    if (code)
+      return { kind: "failure", failure: { kind: "rejected", detail: code } };
+    if ([408, 425, 429, 500, 502, 503, 504, 520, 521, 522, 523, 524].includes(res.status)) {
+      await res.body?.cancel().catch(() => {});
+      return {
+        kind: "transient",
+        failure: {
+          kind: "transient",
+          class: "retryable_status",
+          status: res.status,
+          retryAfter: res.headers.get("Retry-After"),
+          detail: "couldn't reach the auth server"
+        }
+      };
+    }
+    return {
+      kind: "failure",
+      failure: {
+        kind: "unavailable",
+        detail: `the auth server answered HTTP ${res.status}`
+      }
+    };
+  }
+  try {
+    const data = await res.json();
+    if (!data || typeof data.access_token !== "string" || !data.access_token) {
+      throw new Error("Missing access token");
+    }
+    return { kind: "success", data };
+  } catch (cause) {
+    return {
+      kind: "transient",
+      failure: {
+        kind: "transient",
+        class: "ambiguous",
+        status: res.status,
+        detail: "couldn't reach the auth server",
+        cause
+      }
+    };
+  }
+}
+function saveRefreshResult(session, data) {
+  const now = Math.floor(Date.now() / 1000);
+  const updated = {
+    ...session,
+    access_token: data.access_token,
+    refresh_token: data.refresh_token ?? session.refresh_token,
+    expires_at: data.expires_at ?? (data.expires_in ? now + data.expires_in : undefined),
+    user_id: data.user?.id ?? session.user_id,
+    email: data.user?.email ?? session.email,
+    authedAt: new Date().toISOString()
+  };
+  if (!isSameAuthIdentity(updated, session))
+    throw new AuthSessionChangedError;
+  return withAuthLock(() => {
+    const adopted = adoptRefreshedLineage(session);
+    if (adopted !== undefined)
+      return adopted;
+    writeAuthUnlocked(updated);
+    lastRefreshFailure = null;
+    return updated;
+  });
+}
+async function refreshWithRetry(session) {
+  const started = Date.now();
+  const budget = createRetryBudget(REFRESH_RETRY_WINDOW_MS, started);
+  for (let attempt = 1;attempt <= HTTP_RETRY_MAX_ATTEMPTS; attempt++) {
+    const adopted = adoptRefreshedLineage(session);
+    if (adopted !== undefined)
+      return adopted;
+    const current = readAuth();
+    if (current.refresh_rejected)
+      return null;
+    if (!budget.remainingMs())
+      break;
+    const result = await exchangeRefresh(session, Math.min(REFRESH_REQUEST_TIMEOUT_MS, budget.remainingMs()));
+    if (result.kind === "success") {
+      return saveRefreshResult(session, result.data);
+    }
+    const latest = adoptRefreshedLineage(session);
+    if (latest !== undefined)
+      return latest;
+    noteRefreshFailure(session, result.failure);
+    if (result.kind === "failure") {
+      if (result.failure.kind === "rejected") {
+        markRefreshRejected(session, result.failure.detail);
+      }
+      return null;
+    }
+    const delay = attempt < HTTP_RETRY_MAX_ATTEMPTS ? retryDelayMs(attempt - 1, budget, result.failure.retryAfter) : null;
+    const event = {
+      event: delay === null ? "retry_exhausted" : "retry_attempt",
+      layer: "supabase",
+      op: "refresh_session",
+      attempt,
+      class: result.failure.class,
+      status: result.failure.status,
+      elapsed_ms: Date.now() - started,
+      budget_ms: REFRESH_RETRY_WINDOW_MS,
+      error: result.failure.cause instanceof Error ? result.failure.cause.name : "HttpError",
+      ...delay === null ? {} : { delay_ms: delay }
+    };
+    if (delay === null) {
+      console.error(JSON.stringify(event));
+      return null;
+    }
+    console.warn(JSON.stringify(event));
+    await new Promise((resolve) => setTimeout(resolve, delay));
+  }
+  return null;
+}
 var refreshInFlight = null;
 function validatedRefreshResult(expectedSession, result) {
   const current = readAuth();
@@ -41234,6 +41630,8 @@ async function refreshSession(session) {
       });
       return null;
     }
+    if (httpRetryEnabled())
+      return await refreshWithRetry(session);
     const url = `${session.supabase_url.replace(/\/+$/, "")}/auth/v1/token?grant_type=refresh_token`;
     let res;
     try {
@@ -41284,28 +41682,7 @@ async function refreshSession(session) {
       });
       return null;
     }
-    const now = Math.floor(Date.now() / 1000);
-    const expires_at = data.expires_at ?? (data.expires_in ? now + data.expires_in : undefined);
-    const updated = {
-      ...session,
-      access_token: data.access_token,
-      refresh_token: data.refresh_token ?? session.refresh_token,
-      expires_at,
-      user_id: data.user?.id ?? session.user_id,
-      email: data.user?.email ?? session.email,
-      authedAt: new Date().toISOString()
-    };
-    if (!isSameAuthIdentity(updated, session)) {
-      throw new AuthSessionChangedError;
-    }
-    return withAuthLock(() => {
-      const adopted2 = adoptRefreshedLineage(session);
-      if (adopted2 !== undefined)
-        return adopted2;
-      writeAuthUnlocked(updated);
-      lastRefreshFailure = null;
-      return updated;
-    });
+    return saveRefreshResult(session, data);
   } finally {
     releaseRefreshLock();
   }
@@ -41356,7 +41733,9 @@ async function refreshSessionAfterUnauthorized(rejectedSession) {
   if (latest.access_token !== rejectedSession.access_token && isAuthValid(latest)) {
     return latest;
   }
-  expireRejectedAccessToken(rejectedSession);
+  if (!httpRetryEnabled() || refreshFailureFor(rejectedSession)?.kind !== "transient") {
+    expireRejectedAccessToken(rejectedSession);
+  }
   return null;
 }
 function expireRejectedAccessToken(session) {
@@ -55061,10 +55440,14 @@ function announceStoredPatFallback(session, stored) {
   if (!session || announcedFallback)
     return;
   announcedFallback = true;
-  console.error(`Login session ${sessionProblem(session)}; using the PAT saved in ${TOKEN_FILE} ` + `(${stored.prefix}…). Run \`brainbase login\` to switch back.`);
+  const nextStep = refreshFailureFor(session)?.kind === "transient" ? "Retry when the auth server is reachable to use your login session again." : "Run `brainbase login` to switch back.";
+  console.error(`Login session ${sessionProblem(session)}; using the PAT saved in ${TOKEN_FILE} ` + `(${stored.prefix}…). ${nextStep}`);
 }
 function sessionProblem(session) {
   const failure = refreshFailureFor(session);
+  if (failure?.kind === "transient") {
+    return "couldn't reach the auth server to renew it";
+  }
   if (failure?.kind === "rejected") {
     return `expired and could not be renewed (the auth server rejected its refresh token: ${failure.detail})`;
   }
@@ -55082,6 +55465,9 @@ function noUsableCredentialMessage() {
     return "Not logged in. Run `brainbase login` to connect this device.";
   }
   const failure = refreshFailureFor(session);
+  if (failure?.kind === "transient") {
+    return "We couldn't reach the auth server to renew your login session. Check your connection and retry.";
+  }
   const retry = failure?.kind === "unavailable" ? " Check your connection and retry, or run `brainbase login`." : " Run `brainbase login` to sign in again.";
   const stored = readToken();
   const mismatch = stored && !storedPatFor(session) ? ` The PAT saved in ${TOKEN_FILE} belongs to a different account, so it was not used.` : "";
@@ -55093,6 +55479,9 @@ function withRejectedSessionHint(message, source) {
   const trimmed = message.trimEnd();
   const separator = /[.!?:]$/.test(trimmed) ? " " : ". ";
   const session = readAuth();
+  if (session && refreshFailureFor(session)?.kind === "transient") {
+    return `${trimmed}${separator}We couldn't reach the auth server to renew your login session. Check your connection and retry.`;
+  }
   const renewable = session ? isSessionRefreshable(session) : false;
   if (session && !renewable && storedPatFor(session)) {
     return `${trimmed}${separator}The login session could not be renewed; ` + `retry to use the PAT saved in ${TOKEN_FILE}, or run \`brainbase login\`.`;
@@ -55139,7 +55528,7 @@ var DEFAULT_PROXY_BASE = "https://api.v1.brainbaselabs.com";
 var MAS_IN_PROGRESS_MAX_WAIT_MS = 15000;
 var MAS_REQUEST_TIMEOUT_MS = 30000;
 var MAS_MIN_RETRY_DELAY_MS = 100;
-var MAS_MAX_RETRY_DELAY_MS = 2000;
+var AUTH_REFRESH_RESERVE_MS = 1e4 + REFRESH_RETRY_WINDOW_MS + 5000;
 var DEFINITELY_UNSENT_NETWORK_CODES = new Set([
   "ConnectionRefused",
   "ECONNREFUSED",
@@ -55156,8 +55545,8 @@ class ApiError extends Error {
   status;
   body;
   retryAfter;
-  constructor(message, status, body) {
-    super(message);
+  constructor(message, status, body, cause) {
+    super(message, cause === undefined ? undefined : { cause });
     this.status = status;
     this.body = body;
     this.name = "ApiError";
@@ -55166,13 +55555,13 @@ class ApiError extends Error {
 
 class NetworkApiError extends ApiError {
   definitelyUnsent;
-  constructor(message, definitelyUnsent) {
-    super(message);
+  constructor(message, definitelyUnsent, cause) {
+    super(message, undefined, undefined, httpRetryEnabled() ? cause : undefined);
     this.definitelyUnsent = definitelyUnsent;
   }
 }
 function isLostResponseError(error) {
-  return error instanceof NetworkApiError && !error.definitelyUnsent;
+  return error instanceof ApiError && (error.outcomeUnknown === true || error instanceof NetworkApiError && !error.definitelyUnsent);
 }
 function isUnsentRequestError(error) {
   return error instanceof NetworkApiError && error.definitelyUnsent;
@@ -55275,6 +55664,8 @@ function networkErrorCode(error) {
   return typeof causeCode === "string" ? causeCode : undefined;
 }
 function isDefinitelyUnsentNetworkError(error) {
+  if (httpRetryEnabled())
+    return classifyHttpFailure(error) === "unsent";
   const code = networkErrorCode(error);
   if (DEFINITELY_UNSENT_NETWORK_CODES.has(code ?? ""))
     return true;
@@ -55296,7 +55687,7 @@ async function sendRequest(url, init, bearer) {
   try {
     return await fetch(url, { ...init, headers });
   } catch (err) {
-    throw new NetworkApiError(`Network error: ${err.message}`, isDefinitelyUnsentNetworkError(err));
+    throw new NetworkApiError(`Network error: ${err.message}`, isDefinitelyUnsentNetworkError(err), err);
   }
 }
 async function sendWithAuthRetry(session, send) {
@@ -55311,7 +55702,106 @@ async function sendWithAuthRetry(session, send) {
     res.body.cancel().catch(() => {});
   return await send(refreshed);
 }
-async function request(pathname, init = {}) {
+function controlPlaneApiErrorMessage(body, status) {
+  const detail = body && typeof body === "object" ? body.detail : undefined;
+  return detail && ["self_edge_disabled", "runtime_auto_disabled"].includes(detail.code ?? "") && typeof detail.message === "string" ? `${detail.code}: ${detail.message}` : apiErrorMessage(body, status);
+}
+async function resilientApiRequest(pathname, init, resource, onHeaders, options = {}) {
+  const credential = await resolveCredential();
+  let currentSession = credential.session;
+  let refreshAvailable = credential.source === "session" && !new Headers(init.headers).has("Authorization");
+  const method2 = (init.method ?? "GET").toUpperCase();
+  const keyed = !!new Headers(init.headers).get("Idempotency-Key")?.trim();
+  const singleAttempt = options.singleAttempt === true || resource && method2 === "DELETE" && !keyed || options.timeoutMs !== undefined;
+  let sends = 0;
+  let lastResponse;
+  let ambiguousWrite = false;
+  const read = method2 === "GET" || method2 === "HEAD";
+  const budget = createRetryBudget(options.timeoutMs ?? HTTP_RETRY_DEADLINE_MS);
+  try {
+    return await retryHttpRequest(async (signal) => {
+      const send = async (refreshed) => {
+        if (refreshed) {
+          currentSession = refreshed;
+          refreshAvailable = false;
+        }
+        if (signal?.aborted)
+          throw signal.reason;
+        if (sends >= HTTP_RETRY_MAX_ATTEMPTS)
+          throw new ApiError("HTTP request attempt budget exhausted", lastResponse?.status);
+        sends++;
+        try {
+          lastResponse = await sendRequest(`${resource ? masApiBase(currentSession) : apiBase(currentSession)}${pathname}`, { ...init, signal }, currentSession?.access_token ?? credential.bearer);
+        } catch (error) {
+          if (!read && isLostResponseError(error))
+            ambiguousWrite = true;
+          throw error;
+        }
+        return lastResponse;
+      };
+      const first = await send();
+      const res = first.status === 401 && refreshAvailable && !signal?.aborted && sends < HTTP_RETRY_MAX_ATTEMPTS && budget.fits(AUTH_REFRESH_RESERVE_MS) ? await sendWithAuthRetry(currentSession, (refreshed) => refreshed ? send(refreshed) : Promise.resolve(first)) : first;
+      let text2;
+      try {
+        text2 = await res.text();
+      } catch (error) {
+        if (resource && read && !res.ok && !signal?.aborted) {
+          const message = `MAS returned HTTP ${res.status}, but its response body was interrupted`;
+          const failure = new ApiError(res.status === 401 ? withRejectedSessionHint(message, credential.source) : message, res.status);
+          failure.retryAfter = res.headers.get("Retry-After") ?? undefined;
+          throw failure;
+        }
+        if (!read)
+          ambiguousWrite = true;
+        throw new NetworkApiError(`Network error while reading response: ${error.message}`, false, error);
+      }
+      let body = text2;
+      try {
+        body = text2 ? JSON.parse(text2) : null;
+      } catch {}
+      if (!res.ok) {
+        const message = resource ? masApiErrorMessage(body, res.status) : controlPlaneApiErrorMessage(body, res.status);
+        const failure = new ApiError(res.status === 401 ? withRejectedSessionHint(message, credential.source) : resource && res.status === 404 && isUnroutedPath(body) ? `This control plane does not serve ${pathname} yet. Update the server, or use the web app.` : message, res.status, body);
+        failure.retryAfter = res.headers.get("Retry-After") ?? undefined;
+        if (!read && res.status !== 429 && res.status !== 425 && classifyHttpFailure(failure, keyed) === "retryable_status")
+          ambiguousWrite = true;
+        throw failure;
+      }
+      onHeaders?.(res.headers);
+      return body;
+    }, {
+      idempotent: read || options.idempotent === true,
+      keyed,
+      signal: init.signal ?? undefined,
+      budgetMs: options.timeoutMs ?? HTTP_RETRY_DEADLINE_MS,
+      maxAttempts: singleAttempt ? 1 : HTTP_RETRY_MAX_ATTEMPTS,
+      attemptsUsed: () => sends,
+      retryTimeouts: false,
+      onRetryEvent: options.singleAttempt ? () => {} : undefined,
+      op: options.op ?? (resource ? `${method2} /v2` : `${method2} /v2/cli`)
+    });
+  } catch (error) {
+    if (init.signal?.aborted)
+      throw init.signal.reason;
+    if (ambiguousWrite && isUnsentRequestError(error)) {
+      throw new NetworkApiError(error.message, false, error);
+    }
+    if (ambiguousWrite && error instanceof ApiError) {
+      const body = error.body;
+      const code = body?.code ?? body?.detail?.code ?? body?.error?.code;
+      const settled = error.status === 409 && (code === "idempotency_key_reused" || code === "idempotency_resource_deleted");
+      if (!settled)
+        error.outcomeUnknown = true;
+    }
+    if (isHttpTimeout(error) && !(error instanceof NetworkApiError)) {
+      throw new NetworkApiError(`Network error: ${error.message}`, false, error);
+    }
+    throw error;
+  }
+}
+async function request(pathname, init = {}, options = { idempotent: false }) {
+  if (httpRetryEnabled())
+    return resilientApiRequest(pathname, init, false, undefined, options);
   const credential = await resolveCredential();
   let currentSession = credential.session;
   let refreshSessionAvailable = credential.source === "session" && !new Headers(init.headers).has("Authorization");
@@ -55332,7 +55822,7 @@ async function request(pathname, init = {}) {
       try {
         text2 = await res.text();
       } catch (error) {
-        throw new NetworkApiError(`Network error while reading response: ${error.message}`, false);
+        throw new NetworkApiError(`Network error while reading response: ${error.message}`, false, error);
       }
       break;
     } catch (error) {
@@ -55347,8 +55837,7 @@ async function request(pathname, init = {}) {
     body = text2 ? JSON.parse(text2) : null;
   } catch {}
   if (!res.ok) {
-    const detail = body && typeof body === "object" ? body.detail : undefined;
-    const message = detail && ["self_edge_disabled", "runtime_auto_disabled"].includes(detail.code ?? "") && typeof detail.message === "string" ? `${detail.code}: ${detail.message}` : apiErrorMessage(body, res.status);
+    const message = controlPlaneApiErrorMessage(body, res.status);
     throw new ApiError(res.status === 401 ? withRejectedSessionHint(message, credential.source) : message, res.status, body);
   }
   return body;
@@ -55384,7 +55873,7 @@ function masRetryDelayMs(retryAfterHeader, fallbackMs) {
   if (!Number.isFinite(retryAfterSeconds) || retryAfterSeconds < 0) {
     return fallbackMs;
   }
-  return Math.min(MAS_MAX_RETRY_DELAY_MS, Math.max(MAS_MIN_RETRY_DELAY_MS, retryAfterSeconds * 1000));
+  return Math.min(2000, Math.max(MAS_MIN_RETRY_DELAY_MS, retryAfterSeconds * 1000));
 }
 function parseMasTaskCreateResponse(body) {
   if (!body || typeof body !== "object") {
@@ -55402,6 +55891,21 @@ function parseMasTaskCreateResponse(body) {
   };
 }
 async function masRequest(pathname, init) {
+  if (httpRetryEnabled()) {
+    try {
+      return await resilientApiRequest(pathname, init, true);
+    } catch (error) {
+      const failure = error;
+      const detail = failure.body?.detail;
+      if (detail?.code === "idempotency_request_in_progress") {
+        throw new ApiError(detail.task_id ? `Task ${detail.task_id} is still being processed. Check its status before starting another task.` : failure.message, failure.status, failure.body, error);
+      }
+      if (isLostResponseError(error) || failure.status !== undefined && failure.status >= 500) {
+        throw new ApiError(`${failure.message} Task creation may still be processing; check your tasks before running this command again.`, failure.status, failure.body, error);
+      }
+      throw error;
+    }
+  }
   const credential = await resolveCredential();
   let currentSession = credential.session;
   let ambiguousNetworkRetriesRemaining = 1;
@@ -55506,7 +56010,9 @@ function masNamedRecord(body, what, nameField) {
   }
   return { id: record.id, name };
 }
-async function masReadRequest(pathname, callerSignal) {
+async function masReadRequest(pathname, callerSignal, options = {}) {
+  if (httpRetryEnabled())
+    return resilientApiRequest(pathname, { signal: callerSignal }, true, undefined, options);
   const credential = await resolveCredential();
   let currentSession = credential.session;
   let refreshSessionAvailable = credential.source === "session";
@@ -55529,7 +56035,7 @@ async function masReadRequest(pathname, callerSignal) {
       try {
         text2 = await res.text();
       } catch (error) {
-        throw new NetworkApiError(`Network error while reading response: ${error.message}`, false);
+        throw new NetworkApiError(`Network error while reading response: ${error.message}`, false, error);
       }
       break;
     } catch (error) {
@@ -55545,7 +56051,9 @@ async function masReadRequest(pathname, callerSignal) {
   } catch {}
   if (!res.ok) {
     const message = masApiErrorMessage(body, res.status);
-    throw new ApiError(res.status === 401 ? withRejectedSessionHint(message, credential.source) : res.status === 404 && isUnroutedPath(body) ? `This control plane does not serve ${pathname} yet. Update the server, or use the web app.` : message, res.status, body);
+    const error = new ApiError(res.status === 401 ? withRejectedSessionHint(message, credential.source) : res.status === 404 && isUnroutedPath(body) ? `This control plane does not serve ${pathname} yet. Update the server, or use the web app.` : message, res.status, body);
+    error.retryAfter = res.headers.get("retry-after") ?? undefined;
+    throw error;
   }
   return body;
 }
@@ -55564,6 +56072,8 @@ function withRequestDeadline(callerSignal, timeoutMs) {
   return combined.signal;
 }
 async function masResourceRequest(pathname, init = {}, onHeaders, options = {}) {
+  if (httpRetryEnabled())
+    return resilientApiRequest(pathname, init, true, onHeaders, options);
   const credential = await resolveCredential();
   let currentSession = credential.session;
   const res = await sendWithAuthRetry(credential.source === "session" ? currentSession : null, async (refreshed) => {
@@ -55578,7 +56088,7 @@ async function masResourceRequest(pathname, init = {}, onHeaders, options = {})
   try {
     text2 = await res.text();
   } catch (error) {
-    throw new NetworkApiError(`Network error while reading response: ${error.message}`, false);
+    throw new NetworkApiError(`Network error while reading response: ${error.message}`, false, error);
   }
   let body = text2;
   try {
@@ -55603,8 +56113,12 @@ async function masStreamTarget(pathname) {
   const base2 = masApiBase(credential.session);
   return {
     url: `${base2}${pathname}`,
-    resolveBearer: async () => {
-      const fresh = await resolveCredential();
+    resolveBearer: async (rejectedBearer) => {
+      let fresh = await resolveCredential();
+      if (rejectedBearer && fresh.source === "session" && fresh.session?.access_token === rejectedBearer) {
+        await refreshSessionAfterUnauthorized(fresh.session);
+        fresh = await resolveCredential();
+      }
       const freshBase = masApiBase(fresh.session);
       if (freshBase !== base2) {
         throw new StreamHostMovedError(`The control plane moved from ${base2} to ${freshBase} while this stream was open, so the current credential was not sent. Re-run the command to follow against the new host.`);
@@ -55701,7 +56215,7 @@ var masApi = {
     return masItems(await masReadRequest(`/tasks${qs}`), "task list");
   },
   async getTask(taskId, options = {}) {
-    const body = await masReadRequest(`/tasks/${encodeURIComponent(taskId)}`, options.signal);
+    const body = await masReadRequest(`/tasks/${encodeURIComponent(taskId)}`, options.signal, { singleAttempt: options.singleAttempt });
     return parseMasTask(body);
   },
   async listTaskEvents(taskId, options = {}) {
@@ -55714,7 +56228,7 @@ var masApi = {
     }
     if (options.desc !== undefined)
       params.set("desc", String(options.desc));
-    const body = await masReadRequest(`/tasks/${encodeURIComponent(taskId)}/events?${params.toString()}`);
+    const body = await masReadRequest(`/tasks/${encodeURIComponent(taskId)}/events?${params.toString()}`, options.signal);
     return masItems(body, "task events");
   },
   async listMachines(options = {}) {
@@ -55899,26 +56413,29 @@ var api = {
       body: JSON.stringify(input)
     });
   },
-  getAgent(agentId) {
-    return request(`/agents/${encodeURIComponent(agentId)}`);
+  getAgent(agentId, options) {
+    return request(`/agents/${encodeURIComponent(agentId)}`, options);
   },
   getAgentRevision(agentId) {
     return request(`/agents/${encodeURIComponent(agentId)}/revision`);
   },
-  getAgentManifest(agentId) {
-    return request(`/agents/${encodeURIComponent(agentId)}/manifest`);
+  getAgentManifest(agentId, options) {
+    return request(`/agents/${encodeURIComponent(agentId)}/manifest`, options);
   },
-  updateAgent(agentId, input) {
+  updateAgent(agentId, input, options) {
     if (usesLegacyControlPlane() && (input.machine_kind !== undefined || input.default_model !== undefined || input.runtime_mode !== undefined)) {
       return Promise.reject(legacyAgentConfigError());
     }
+    const { idempotent = false, ...transport } = options ?? {};
     return request(`/agents/${encodeURIComponent(agentId)}`, {
+      ...transport,
       method: "PUT",
       body: JSON.stringify(input)
-    });
+    }, { idempotent, op: idempotent ? "update_agent" : undefined });
   },
-  pushAgentManifest(agentId, input) {
+  pushAgentManifest(agentId, input, options) {
     return request(`/agents/${encodeURIComponent(agentId)}/manifest`, {
+      ...options,
       method: "PUT",
       body: JSON.stringify(input)
     });
@@ -55946,11 +56463,13 @@ var api = {
     }
     return { secrets };
   },
-  putAgentSecrets(agentId, secrets) {
+  putAgentSecrets(agentId, secrets, options) {
+    const { idempotent = false, ...transport } = options ?? {};
     return request(`/agents/${encodeURIComponent(agentId)}/secrets`, {
+      ...transport,
       method: "PUT",
       body: JSON.stringify({ secrets })
-    });
+    }, { idempotent, op: idempotent ? "put_agent_secrets" : undefined });
   },
   createCliKey(agentId, input) {
     return request(`/agents/${encodeURIComponent(agentId)}/keys`, {
@@ -56002,8 +56521,8 @@ var api = {
       body: JSON.stringify(input)
     });
   },
-  getOrchestration(orchId) {
-    return request(`/orchestrations/${encodeURIComponent(orchId)}`);
+  getOrchestration(orchId, options) {
+    return request(`/orchestrations/${encodeURIComponent(orchId)}`, options);
   },
   fireOrchestrationTrigger(orchId, triggerId, payload, idempotencyKey) {
     return masResourceRequest(`/orchestrations/${encodeURIComponent(orchId)}/triggers/${encodeURIComponent(triggerId)}/fire`, {
@@ -56015,7 +56534,7 @@ var api = {
   getOrchestrationManifest(orchId) {
     return request(`/orchestrations/${encodeURIComponent(orchId)}/manifest`);
   },
-  async updateOrchestration(orchId, input) {
+  async updateOrchestration(orchId, input, options) {
     let payload = input;
     if (usesLegacyControlPlane() && input.triggers !== undefined) {
       if (input.triggers.length > 0)
@@ -56028,6 +56547,7 @@ var api = {
       payload = legacyPayload;
     }
     return request(`/orchestrations/${encodeURIComponent(orchId)}`, {
+      ...options,
       method: "PUT",
       body: JSON.stringify(payload)
     });
@@ -56046,6 +56566,7 @@ function proxyBaseUrl(session) {
 }
 
 // src/core/registry-client.ts
+import { setTimeout as sleep } from "node:timers/promises";
 var DEFAULT_BASE = "https://api.v1.brainbaselabs.com";
 function baseUrl(session) {
   const env3 = process.env.BRAINBASE_REGISTRY_URL || process.env.BRAINBASE_API_URL;
@@ -56120,27 +56641,256 @@ function mergeHeaders(auth, overrides) {
   new Headers(overrides).forEach((value, key2) => headers.set(key2, value));
   return headers;
 }
-async function sendRequest2(pathname, init, session) {
+var RETRYABLE_GET_STATUSES = new Set([
+  408,
+  425,
+  429,
+  500,
+  502,
+  503,
+  504,
+  520,
+  521,
+  522,
+  523,
+  524
+]);
+var AUTH_REFRESH_RESERVE_MS2 = 1e4 + REFRESH_RETRY_WINDOW_MS + 5000;
+var DEFINITELY_UNSENT_NETWORK_CODES2 = new Set([
+  "ConnectionRefused",
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ERR_INVALID_URL",
+  "FailedToOpenSocket",
+  "UND_ERR_CONNECT_TIMEOUT"
+]);
+function networkErrorCode2(error) {
+  if (!error || typeof error !== "object")
+    return;
+  const code = error.code;
+  if (typeof code === "string")
+    return code;
+  const cause = error.cause;
+  if (!cause || typeof cause !== "object")
+    return;
+  const causeCode = cause.code;
+  return typeof causeCode === "string" ? causeCode : undefined;
+}
+function isDefinitelyUnsentNetworkError2(error) {
+  return DEFINITELY_UNSENT_NETWORK_CODES2.has(networkErrorCode2(error) ?? "");
+}
+
+class RegistryLocalBodyError extends Error {
+  original;
+  constructor(original) {
+    super(original instanceof Error ? original.message : String(original));
+    this.original = original;
+    this.name = "RegistryLocalBodyError";
+  }
+}
+function toNetworkApiError(err) {
+  const apiError = new ApiError(`Network error: ${err.message}`);
+  apiError.cause = err;
+  return apiError;
+}
+function attemptSignal(external2, timeoutMs) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const onAbort = () => controller.abort(external2?.reason);
+  if (external2?.aborted)
+    onAbort();
+  else
+    external2?.addEventListener("abort", onAbort, { once: true });
+  return {
+    signal: controller.signal,
+    cleanup: () => {
+      clearTimeout(timer);
+      external2?.removeEventListener("abort", onAbort);
+    }
+  };
+}
+function responseWithCleanup(res, cleanup) {
+  const reader = res.body.getReader();
+  reader.closed.then(cleanup, cleanup);
+  const body = new ReadableStream({
+    async pull(controller) {
+      try {
+        const { value, done } = await reader.read();
+        if (done)
+          controller.close();
+        else
+          controller.enqueue(value);
+      } catch (error) {
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      try {
+        await reader.cancel(reason);
+      } finally {
+        cleanup();
+      }
+    }
+  });
+  const wrapped = new Response(body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers: res.headers
+  });
+  Object.defineProperties(wrapped, {
+    url: { value: res.url },
+    redirected: { value: res.redirected },
+    type: { value: res.type }
+  });
+  return wrapped;
+}
+async function consumeBody(res, opts) {
+  if (!opts.readBody || !res.body)
+    return;
+  try {
+    await opts.readBody(res);
+  } catch (err) {
+    if (res.ok)
+      throw err;
+    const refusal = new ApiError(`HTTP ${res.status}`, res.status);
+    refusal.cause = err;
+    throw refusal;
+  }
+}
+function logRetry(state, failureClass, status, error, delayMs) {
+  const record = {
+    event: delayMs === null ? "retry_exhausted" : "retry_attempt",
+    layer: "http",
+    op: "registry_get",
+    attempt: state.attempts,
+    class: failureClass,
+    status,
+    elapsed_ms: state.budget.totalMs - state.budget.remainingMs(),
+    budget_ms: state.budget.totalMs,
+    error,
+    ...delayMs === null ? {} : { delay_ms: delayMs }
+  };
+  if (delayMs === null)
+    console.error(JSON.stringify(record));
+  else
+    console.warn(JSON.stringify(record));
+}
+async function retryingGetRequest(url, init, opts, state) {
+  const { budget, signal } = state;
+  let lastNetworkError = null;
+  while (state.attempts < HTTP_RETRY_MAX_ATTEMPTS && budget.remainingMs() > 0) {
+    state.attempts += 1;
+    try {
+      const res = await fetch(url, { ...init, signal });
+      if (RETRYABLE_GET_STATUSES.has(res.status)) {
+        const delayMs = state.attempts < HTTP_RETRY_MAX_ATTEMPTS ? retryDelayMs(state.attempts - 1, budget, res.headers.get("Retry-After")) : null;
+        logRetry(state, "retryable_status", res.status, "ApiError", delayMs);
+        if (delayMs !== null) {
+          if (res.body)
+            res.body.cancel().catch(() => {});
+          await sleep(delayMs, undefined, { signal });
+          continue;
+        }
+      }
+      if (res.status !== 401)
+        await consumeBody(res, opts);
+      return res;
+    } catch (err) {
+      if (err instanceof RegistryLocalBodyError)
+        throw err;
+      if (err instanceof ApiError && err.status !== undefined)
+        throw err;
+      if (init.signal?.aborted)
+        throw toNetworkApiError(err);
+      lastNetworkError = toNetworkApiError(err);
+      const delayMs = state.attempts < HTTP_RETRY_MAX_ATTEMPTS && !signal.aborted ? retryDelayMs(state.attempts - 1, budget, null) : null;
+      logRetry(state, isDefinitelyUnsentNetworkError2(err) ? "unsent" : "ambiguous", null, err instanceof Error ? err.name : "Error", delayMs);
+      if (delayMs === null)
+        break;
+      try {
+        await sleep(delayMs, undefined, { signal });
+      } catch (abort) {
+        throw toNetworkApiError(abort);
+      }
+    }
+  }
+  throw lastNetworkError ?? new ApiError("Network error: request timed out");
+}
+async function sendRequest2(pathname, init, session, opts = {}, state) {
   const url = `${baseUrl(session)}${pathname}`;
+  if (!state) {
+    try {
+      return await fetch(url, init);
+    } catch (err) {
+      throw new ApiError(`Network error: ${err.message}`);
+    }
+  }
+  state.signal.throwIfAborted();
+  if ((init.method ?? "GET").toUpperCase() === "GET") {
+    return await retryingGetRequest(url, init, opts, state);
+  }
   try {
-    return await fetch(url, init);
+    const res = await fetch(url, { ...init, signal: state.signal });
+    if (res.status !== 401)
+      await consumeBody(res, opts);
+    return res;
   } catch (err) {
-    throw new ApiError(`Network error: ${err.message}`);
+    if (err instanceof ApiError)
+      throw err;
+    throw toNetworkApiError(err);
   }
 }
-async function sendAuthenticatedRequest(pathname, init, auth) {
+async function sendAuthenticatedRequest(pathname, init, auth, opts = {}, state) {
   return await sendRequest2(pathname, {
     ...init,
     headers: mergeHeaders(auth.headers, init.headers)
-  }, auth.session);
+  }, auth.session, opts, state);
+}
+async function registryFetch(pathname, init = {}, opts = {}) {
+  if (httpRetryEnabled()) {
+    const budget = createRetryBudget(HTTP_RETRY_DEADLINE_MS);
+    const { signal, cleanup } = attemptSignal(init.signal, budget.remainingMs());
+    const state = { budget, attempts: 0, signal };
+    let bodyOwnsCleanup = false;
+    try {
+      const res = await fetchWithAuth(pathname, init, opts, state);
+      if (!res.bodyUsed)
+        await consumeBody(res, opts);
+      if (!opts.readBody && res.body && !res.bodyUsed) {
+        const wrapped = responseWithCleanup(res, cleanup);
+        bodyOwnsCleanup = true;
+        return wrapped;
+      }
+      return res;
+    } catch (err) {
+      if (err instanceof RegistryLocalBodyError)
+        throw err.original;
+      if (err instanceof ApiError)
+        throw err;
+      throw toNetworkApiError(err);
+    } finally {
+      if (!bodyOwnsCleanup)
+        cleanup();
+    }
+  }
+  return await fetchWithAuth(pathname, init);
 }
-async function registryFetch(pathname, init = {}) {
+async function fetchWithAuth(pathname, init, opts = {}, state) {
+  state?.signal.throwIfAborted();
   if (new Headers(init.headers).has("Authorization")) {
-    return await sendRequest2(pathname, init, readAuth());
+    return await sendRequest2(pathname, init, readAuth(), opts, state);
   }
   const auth = await resolveAuth();
   const retrySession = auth.headers["X-Auth-Source"] === "jwt" ? auth.session : null;
-  return await sendWithAuthRetry(retrySession, (refreshed) => sendAuthenticatedRequest(pathname, init, refreshed ? jwtAuth(refreshed) : auth));
+  const send = (refreshed) => sendAuthenticatedRequest(pathname, init, refreshed ? jwtAuth(refreshed) : auth, opts, state);
+  if (!state)
+    return await sendWithAuthRetry(retrySession, send);
+  const res = await send();
+  if (res.status !== 401 || !retrySession || state.signal.aborted || state.attempts >= HTTP_RETRY_MAX_ATTEMPTS || !state.budget.fits(AUTH_REFRESH_RESERVE_MS2)) {
+    return res;
+  }
+  return await sendWithAuthRetry(retrySession, (refreshed) => refreshed ? send(refreshed) : Promise.resolve(res));
 }
 async function jsonRequest(pathname, init = {}) {
   const headers = new Headers(init.headers);
@@ -56149,8 +56899,15 @@ async function jsonRequest(pathname, init = {}) {
   if (init.body && !headers.has("Content-Type") && typeof init.body === "string") {
     headers.set("Content-Type", "application/json");
   }
-  const res = await registryFetch(pathname, { ...init, headers });
-  const text2 = await res.text();
+  let bodyText = null;
+  let bodyFrom = null;
+  const res = await registryFetch(pathname, { ...init, headers }, {
+    readBody: async (response) => {
+      bodyText = await response.text();
+      bodyFrom = response;
+    }
+  });
+  const text2 = bodyFrom === res && bodyText !== null ? bodyText : await res.text();
   let body = text2;
   try {
     body = text2 ? JSON.parse(text2) : null;
@@ -56208,32 +56965,58 @@ var registryApi = {
   },
   async getFile(creator, slug, version, relPath) {
     const pathname = `/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/files/${relPath}`;
-    const res = await registryFetch(pathname);
+    let buffer = null;
+    let bufferFrom = null;
+    const res = await registryFetch(pathname, {}, {
+      readBody: async (response) => {
+        if (!response.ok)
+          return;
+        buffer = Buffer.from(await response.arrayBuffer());
+        bufferFrom = response;
+      }
+    });
     if (!res.ok) {
       throw new ApiError(`HTTP ${res.status} reading file ${relPath}`, res.status);
     }
+    if (bufferFrom === res && buffer !== null)
+      return buffer;
     const ab = await res.arrayBuffer();
     return Buffer.from(ab);
   },
   async downloadTarball(creator, slug, version, destPath) {
     const pathname = `/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/tarball`;
-    const res = await registryFetch(pathname);
-    if (!res.ok || !res.body) {
-      throw new ApiError(`HTTP ${res.status} downloading tarball`, res.status);
-    }
-    const out = fs54.createWriteStream(destPath);
-    const reader = res.body.getReader();
-    try {
-      while (true) {
-        const { value, done } = await reader.read();
-        if (done)
-          break;
-        if (value) {
-          await new Promise((resolve, reject2) => out.write(value, (err) => err ? reject2(err) : resolve()));
+    if (!httpRetryEnabled()) {
+      const res2 = await registryFetch(pathname);
+      if (!res2.ok || !res2.body) {
+        throw new ApiError(`HTTP ${res2.status} downloading tarball`, res2.status);
+      }
+      const out = fs54.createWriteStream(destPath);
+      const reader = res2.body.getReader();
+      try {
+        while (true) {
+          const { value, done } = await reader.read();
+          if (done)
+            break;
+          if (value) {
+            await new Promise((resolve, reject2) => out.write(value, (err) => err ? reject2(err) : resolve()));
+          }
         }
+      } finally {
+        out.end();
       }
-    } finally {
-      out.end();
+      return;
+    }
+    let downloadedFrom = null;
+    const res = await registryFetch(pathname, {}, {
+      readBody: async (response) => {
+        if (!response.ok || !response.body)
+          return;
+        await streamResponseToFile(response.body, destPath);
+        downloadedFrom = response;
+      }
+    });
+    if (!res.ok || !res.body || downloadedFrom !== res) {
+      throw new ApiError(`HTTP ${res.status} downloading tarball`, res.status);
     }
   },
   createPackage(input) {
@@ -56251,20 +57034,24 @@ var registryApi = {
     form.set("manifest", new Blob([input.manifestJson], { type: "application/json" }), "manifest.json");
     const bytes = fs54.readFileSync(input.bundlePath);
     form.set("bundle", new Blob([bytes], { type: "application/gzip" }), "bundle.tgz");
-    const res = await registryFetch(pathname, {
+    const init = {
       method: "POST",
       headers: { Accept: "application/json" },
       body: form
-    });
-    const text2 = await res.text();
-    let body = text2;
-    try {
-      body = text2 ? JSON.parse(text2) : null;
-    } catch {}
-    if (!res.ok) {
-      throw new ApiError(`Publish failed: HTTP ${res.status}`, res.status, body);
+    };
+    if (!httpRetryEnabled()) {
+      const res = await registryFetch(pathname, init);
+      const text2 = await res.text();
+      let body = text2;
+      try {
+        body = text2 ? JSON.parse(text2) : null;
+      } catch {}
+      if (!res.ok) {
+        throw new ApiError(`Publish failed: HTTP ${res.status}`, res.status, body);
+      }
+      return body;
     }
-    return body;
+    return await publishVersionVerified(creator, slug, input, pathname, init);
   },
   yankVersion(creator, slug, version, reason) {
     return jsonRequest(`/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/yank`, {
@@ -56297,6 +57084,97 @@ var registryApi = {
     return jsonRequest(`/v1/registry/cli-tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
   }
 };
+async function readBackPublishedVersion(creator, slug, version, bundleSha256) {
+  try {
+    const readBack = await registryApi.getVersion(creator, slug, version);
+    if (readBack.version === version && readBack.bundle_sha256 === bundleSha256) {
+      return readBack;
+    }
+  } catch {}
+  return null;
+}
+async function publishVersionVerified(creator, slug, input, pathname, init) {
+  let res;
+  let text2 = "";
+  try {
+    res = await registryFetch(pathname, init, {
+      readBody: async (response) => {
+        text2 = await response.text();
+      }
+    });
+  } catch (err) {
+    if (!(err instanceof ApiError) || err.status !== undefined || isDefinitelyUnsentNetworkError2(err.cause)) {
+      throw err;
+    }
+    const adopted = await readBackPublishedVersion(creator, slug, input.version, input.bundleSha256);
+    if (adopted)
+      return adopted;
+    const failure = new ApiError(`Publish status undetermined: ${err.message}; could not confirm ${input.version} with the expected bundle checksum. Check the registry before publishing again.`);
+    failure.cause = err;
+    throw failure;
+  }
+  let body = text2;
+  try {
+    body = text2 ? JSON.parse(text2) : null;
+  } catch {}
+  if (!res.ok) {
+    throw new ApiError(`Publish failed: HTTP ${res.status}`, res.status, body);
+  }
+  let readBack;
+  try {
+    readBack = await registryApi.getVersion(creator, slug, input.version);
+  } catch (err) {
+    const failure = new ApiError(`Publish status undetermined: version ${input.version} was submitted but reading it back failed (${err.message}). Check the registry before publishing again.`);
+    failure.cause = err;
+    throw failure;
+  }
+  if (readBack.version !== input.version || readBack.bundle_sha256 !== input.bundleSha256) {
+    throw new ApiError(`Publish verification failed: reading ${input.version} back returned version ${readBack.version} with bundle_sha256 ${readBack.bundle_sha256}, expected ${input.version} with ${input.bundleSha256}.`);
+  }
+  return readBack;
+}
+async function streamResponseToFile(body, destPath) {
+  let out;
+  try {
+    out = fs54.createWriteStream(destPath);
+  } catch (err) {
+    throw new RegistryLocalBodyError(err);
+  }
+  const closed = new Promise((resolve) => out.once("close", () => resolve()));
+  let writeError = null;
+  out.on("error", (err) => {
+    writeError ??= err;
+  });
+  const reader = body.getReader();
+  let failure = null;
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done)
+        break;
+      if (value) {
+        try {
+          await new Promise((resolve, reject2) => out.write(value, (err) => err ? reject2(err) : resolve()));
+        } catch (err) {
+          throw new RegistryLocalBodyError(err);
+        }
+      }
+    }
+  } catch (err) {
+    failure = err;
+    reader.cancel().catch(() => {});
+  }
+  if (failure === null) {
+    out.end();
+  } else {
+    out.destroy();
+  }
+  await closed;
+  if (failure !== null)
+    throw failure;
+  if (writeError !== null)
+    throw new RegistryLocalBodyError(writeError);
+}
 
 // src/core/tarball.ts
 import fs57 from "node:fs";
@@ -63055,6 +63933,12 @@ var DEFAULT_POLL_INTERVAL_MS = 2000;
 var MIN_POLL_INTERVAL_MS = 500;
 var REQUEST_TIMEOUT_MS = 1e4;
 var MAX_CONSECUTIVE_FAILURES = 20;
+var retryDiagnostics = {
+  info(message) {
+    process.stderr.write(`${message}
+`);
+  }
+};
 
 class LoginTimeoutError extends Error {
   constructor(timeoutMs, lastError) {
@@ -63062,7 +63946,7 @@ class LoginTimeoutError extends Error {
     this.name = "LoginTimeoutError";
   }
 }
-function sleep(ms2) {
+function sleep2(ms2) {
   return new Promise((resolve) => setTimeout(resolve, ms2));
 }
 var MAX_POLL_INTERVAL_MS = 60000;
@@ -63112,6 +63996,49 @@ async function readJson2(res) {
     return null;
   }
 }
+function interruptedLogin() {
+  return new Error("The auth server sent an unreadable or interrupted login response. Run `brainbase login` again.");
+}
+async function startWithRetry(url, fetchImpl) {
+  const started = Date.now();
+  const budget = createRetryBudget(HTTP_RETRY_DEADLINE_MS, started);
+  for (let attempt2 = 1;; attempt2++) {
+    try {
+      return await fetchImpl(url, {
+        method: "POST",
+        headers: JSON_HEADERS,
+        body: "{}",
+        signal: AbortSignal.timeout(Math.max(1, Math.floor(Math.min(REQUEST_TIMEOUT_MS, budget.remainingMs()))))
+      });
+    } catch (cause) {
+      const unsent = isUnsentAuthRequest(cause);
+      const delay2 = unsent && attempt2 < HTTP_RETRY_MAX_ATTEMPTS ? retryDelayMs(attempt2 - 1, budget) : null;
+      const event = {
+        event: delay2 === null ? unsent ? "retry_exhausted" : "retry_deferred" : "retry_attempt",
+        layer: "http",
+        op: "device_authorization_start",
+        attempt: attempt2,
+        class: unsent ? "unsent" : "ambiguous",
+        status: null,
+        elapsed_ms: Date.now() - started,
+        budget_ms: HTTP_RETRY_DEADLINE_MS,
+        error: cause instanceof Error ? cause.name : "Error",
+        ...delay2 === null ? {} : { delay_ms: delay2 }
+      };
+      if (delay2 === null) {
+        if (unsent)
+          console.error(JSON.stringify(event));
+        else
+          retryDiagnostics.info(JSON.stringify(event));
+        throw new Error(`Could not reach ${url}: ${cause.message}`, {
+          cause
+        });
+      }
+      console.warn(JSON.stringify(event));
+      await sleep2(delay2);
+    }
+  }
+}
 var JSON_HEADERS = {
   "Content-Type": "application/json",
   Accept: "application/json"
@@ -63121,13 +64048,15 @@ async function startDeviceAuthorization(options) {
   const url = `${webBase}/api/cli/auth/device`;
   let res;
   try {
-    res = await fetchImpl(url, {
+    res = httpRetryEnabled() ? await startWithRetry(url, fetchImpl) : await fetchImpl(url, {
       method: "POST",
       headers: JSON_HEADERS,
       body: "{}",
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
     });
   } catch (err) {
+    if (httpRetryEnabled())
+      throw err;
     throw new Error(`Could not reach ${url}: ${err.message}`);
   }
   if (res.status === 404)
@@ -63137,6 +64066,8 @@ async function startDeviceAuthorization(options) {
   }
   const body = await readJson2(res);
   if (!body?.device_code || !body.user_code) {
+    if (httpRetryEnabled())
+      throw interruptedLogin();
     throw unsupportedDeployment(webBase);
   }
   return {
@@ -63148,12 +64079,14 @@ async function startDeviceAuthorization(options) {
   };
 }
 async function awaitDeviceSession(options) {
+  if (httpRetryEnabled())
+    return await pollWithBackoff(options);
   const {
     webBase,
     authorization,
     timeoutMs = Math.min(authorization.expiresInMs, DEFAULT_LOGIN_TIMEOUT_MS),
     now: now2 = Date.now,
-    wait = sleep,
+    wait = sleep2,
     fetchImpl = fetch
   } = options;
   const url = `${webBase}/api/cli/auth/device/token`;
@@ -63221,6 +64154,108 @@ async function awaitDeviceSession(options) {
   }
   throw new LoginTimeoutError(timeoutMs, lastError);
 }
+async function pollWithBackoff(options) {
+  const {
+    webBase,
+    authorization,
+    now: now2 = Date.now,
+    wait = sleep2,
+    fetchImpl = fetch
+  } = options;
+  const timeoutMs = Math.min(options.timeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS, authorization.expiresInMs);
+  const started = now2();
+  const budget = createRetryBudget(timeoutMs, started);
+  const url = `${webBase}/api/cli/auth/device/token`;
+  let intervalMs = authorization.intervalMs;
+  let failures = 0;
+  let attempt2 = 0;
+  let lastError;
+  async function backoff(status, retryAfter, slowDown = false) {
+    if (slowDown)
+      intervalMs = Math.min(intervalMs + 5000, MAX_POLL_INTERVAL_MS);
+    const delay2 = Math.max(intervalMs, parseRetryAfterMs(retryAfter, now2()) ?? 0) + fullJitterDelayMs(Math.max(0, failures - 1));
+    const exhausted = !budget.fits(delay2, now2());
+    const event = {
+      event: exhausted ? "retry_exhausted" : "retry_attempt",
+      layer: "http",
+      op: "device_authorization_poll",
+      attempt: attempt2,
+      class: status === null ? "unsent" : "retryable_status",
+      status,
+      elapsed_ms: now2() - started,
+      budget_ms: timeoutMs,
+      error: status === null ? "NetworkError" : "HttpError",
+      ...exhausted ? {} : { delay_ms: delay2 }
+    };
+    if (exhausted) {
+      console.error(JSON.stringify(event));
+      throw new LoginTimeoutError(timeoutMs, lastError);
+    }
+    console.warn(JSON.stringify(event));
+    await wait(delay2);
+  }
+  while (budget.remainingMs(now2()) > 0) {
+    attempt2++;
+    let res;
+    try {
+      res = await fetchImpl(url, {
+        method: "POST",
+        headers: JSON_HEADERS,
+        body: JSON.stringify({ device_code: authorization.deviceCode }),
+        signal: AbortSignal.timeout(Math.max(1, Math.floor(Math.min(REQUEST_TIMEOUT_MS, budget.remainingMs(now2())))))
+      });
+    } catch (cause) {
+      if (!isUnsentAuthRequest(cause))
+        throw interruptedLogin();
+      lastError = cause.message;
+      if (++failures >= MAX_CONSECUTIVE_FAILURES)
+        throw new Error(`Could not reach ${url}: ${lastError}`, { cause });
+      await backoff(null);
+      continue;
+    }
+    if (res.status === 404)
+      throw unsupportedDeployment(webBase);
+    if (res.status === 410)
+      throw new Error("This login expired. Run `brainbase login` again.");
+    if (res.status === 409)
+      throw new Error("This login was already completed on another device. Run `brainbase login` again.");
+    if (res.status === 429) {
+      failures = 0;
+      lastError = "the server asked us to slow down";
+      await res.body?.cancel().catch(() => {});
+      await backoff(res.status, res.headers.get("Retry-After"), true);
+      continue;
+    }
+    if (!res.ok && res.status >= 500) {
+      lastError = `poll returned ${res.status}`;
+      await res.body?.cancel().catch(() => {});
+      if (++failures >= MAX_CONSECUTIVE_FAILURES)
+        throw new Error(`Could not reach ${url}: ${lastError}`);
+      await backoff(res.status, res.headers.get("Retry-After"));
+      continue;
+    }
+    const body = await readJson2(res);
+    if (body?.status === "slow_down" || body?.error === "slow_down") {
+      failures = 0;
+      lastError = "the server asked us to slow down";
+      await backoff(res.status, res.headers.get("Retry-After"), true);
+      continue;
+    }
+    if (!res.ok) {
+      throw new Error(typeof body?.error === "string" ? body.error : `The server rejected this login (${res.status}). Run \`brainbase login\` again.`);
+    }
+    if (!body)
+      throw interruptedLogin();
+    failures = 0;
+    if (body.status === "ready") {
+      if (!body.session)
+        throw new Error("The server said the login was ready but sent no session. Run `brainbase login` again.");
+      return body.session;
+    }
+    await wait(Math.min(intervalMs, budget.remainingMs(now2())));
+  }
+  throw new LoginTimeoutError(timeoutMs, lastError);
+}
 
 // src/core/open-browser.ts
 import { spawn } from "node:child_process";
@@ -67522,6 +68557,7 @@ function handleApiError2(err) {
 }
 
 // src/cli/agent-push.ts
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 var import_picocolors30 = __toESM(require_picocolors(), 1);
 
 // src/core/collection-reconcile.ts
@@ -68072,8 +69108,8 @@ class LostResponseError extends ApiError {
   idempotencyKey;
   action;
   retryCommand;
-  constructor(idempotencyKey, action, retryCommand) {
-    super(`The connection dropped before Brainbase answered, so ${action} may or may not have happened. ` + (retryCommand ? `Run \`${retryCommand}\` to finish it without doing it twice.` : `Re-run the same command with --idempotency-key ${idempotencyKey} to finish it without doing it twice.`));
+  constructor(idempotencyKey, action, retryCommand, cause) {
+    super(`The connection dropped before Brainbase answered, so ${action} may or may not have happened. ` + (retryCommand ? `Run \`${retryCommand}\` to finish it without doing it twice.` : `Re-run the same command with --idempotency-key ${idempotencyKey} to finish it without doing it twice.`), undefined, undefined, cause);
     this.idempotencyKey = idempotencyKey;
     this.action = action;
     this.retryCommand = retryCommand;
@@ -68159,7 +69195,7 @@ function fieldMessages(fields) {
   return fastApiValidationMessage({ detail: fields });
 }
 function toInterfaceError(error, options = {}) {
-  if (error instanceof InterfaceApiError || !(error instanceof ApiError))
+  if (isLostResponseError(error) || error instanceof InterfaceApiError || !(error instanceof ApiError))
     return error;
   const status = error.status;
   const body = error.body;
@@ -68239,6 +69275,8 @@ async function keyedWrite(action, pathname, init, key2) {
   } catch (error) {
     if (!isLostResponseError(error) || init.signal?.aborted)
       throw error;
+    if (httpRetryEnabled())
+      throw new LostResponseError(key2, action, undefined, error);
   }
   try {
     return await guard(send());
@@ -69276,7 +70314,7 @@ async function runAgentPush(cwd2, args) {
       if (config.browser.localChanged) {
         update2.browser_enabled = manifest.capabilities?.browser;
       }
-      cloudAgent = await api.updateAgent(agentId, update2);
+      cloudAgent = await api.updateAgent(agentId, update2, httpRetryEnabled() ? { idempotent: true } : undefined);
       if (update2.runtime_mode !== undefined && cloudAgent.runtime_mode !== update2.runtime_mode) {
         throw new Error("This control plane did not apply runtime_mode. Upgrade it before retrying; the sync baseline is unchanged.");
       }
@@ -69311,16 +70349,27 @@ async function runAgentPush(cwd2, args) {
   const pushSpinner = spinner();
   pushSpinner.start("Pushing…");
   let updatedCloud;
+  const pushStartedAt = Date.now();
   try {
     const reconcileEvals = evalDecision.kind !== "skip";
     const reconcilePlaybooks = playbookDecision.kind !== "skip";
     const components = outgoing.filter((c2) => (reconcileEvals || c2.type !== "eval") && (reconcilePlaybooks || c2.type !== "playbook"));
-    updatedCloud = await api.pushAgentManifest(agentId, {
-      components,
-      base_revision: cloud.revision,
-      reconcile_playbooks: reconcilePlaybooks,
-      reconcile_evals: reconcileEvals
-    });
+    try {
+      updatedCloud = await api.pushAgentManifest(agentId, {
+        components,
+        base_revision: cloud.revision,
+        reconcile_playbooks: reconcilePlaybooks,
+        reconcile_evals: reconcileEvals
+      }, httpRetryEnabled() ? { keepalive: false } : undefined);
+    } catch (err) {
+      if (!httpRetryEnabled() || !isLostResponseError(err))
+        throw err;
+      pushSpinner.stop("Connection lost after the manifest was sent — reading the cloud manifest back…");
+      updatedCloud = await reconcilePushedManifest(agentId, components, {
+        reconcileEvals,
+        reconcilePlaybooks
+      }, pushStartedAt);
+    }
     pushSpinner.stop(`Pushed. New revision ${updatedCloud.revision}.`);
   } catch (err) {
     pushSpinner.stop("Failed.");
@@ -69464,7 +70513,7 @@ async function pushSecrets(cwd2, agentId, plan) {
   const sp = spinner();
   sp.start("Pushing secrets…");
   try {
-    await api.putAgentSecrets(agentId, plan.secrets);
+    await api.putAgentSecrets(agentId, plan.secrets, httpRetryEnabled() ? { idempotent: true } : undefined);
     sp.stop(`Secrets pushed (${secretDiffSummary(plan.diff)}).`);
   } catch (err) {
     sp.stop("Failed.");
@@ -69504,6 +70553,126 @@ function describeArchiveSet(evals, playbooks) {
   }
   return parts.join(" and ");
 }
+function logRetryEvent2(event) {
+  const line = JSON.stringify(event);
+  if (event.event !== "retry_deferred")
+    console.error(line);
+  else
+    console.log(line);
+}
+function pushRecoverySignal(startedAt) {
+  const remaining = HTTP_RETRY_DEADLINE_MS - (Date.now() - startedAt);
+  if (remaining <= 0)
+    throw new Error("Push confirmation deadline exceeded");
+  return AbortSignal.timeout(remaining);
+}
+async function reconcilePushedManifest(agentId, sent, claimed, startedAt) {
+  logRetryEvent2({
+    event: "retry_deferred",
+    layer: "http",
+    op: "push_agent_manifest",
+    attempt: 1,
+    class: "ambiguous",
+    status: null,
+    elapsed_ms: Date.now() - startedAt,
+    budget_ms: HTTP_RETRY_DEADLINE_MS,
+    error: "NetworkApiError"
+  });
+  let reread;
+  let divergence;
+  try {
+    const signal = pushRecoverySignal(startedAt);
+    reread = await api.getAgentManifest(agentId, { signal });
+    divergence = await manifestDivergence(reread.components, sent, claimed, signal);
+  } catch (err) {
+    throw new ApiError(`The manifest push may have succeeded, but the CLI could not read the agent back to confirm it (${err.message}). Run brainbase agent pull before pushing again.`);
+  }
+  if (divergence) {
+    throw new ApiError(`Cannot confirm the push: the cloud manifest at revision ${reread.revision} does not match what was sent (${divergence}).`, 409);
+  }
+  return reread;
+}
+async function manifestDivergence(cloud, sent, claimed, signal) {
+  const cloudByType = new Map;
+  for (const c2 of cloud) {
+    if (c2.type === "skill" && c2.meta?.source && !sent.some((s3) => s3.type === c2.type && s3.slug === c2.slug))
+      continue;
+    const slugs = cloudByType.get(c2.type) ?? new Set;
+    slugs.add(c2.slug);
+    cloudByType.set(c2.type, slugs);
+  }
+  const sentByType = new Map;
+  for (const c2 of sent) {
+    const slugs = sentByType.get(c2.type) ?? new Set;
+    slugs.add(c2.slug);
+    sentByType.set(c2.type, slugs);
+  }
+  const claimedTypes = new Set(["instruction", "skill", "mcp"]);
+  if (claimed.reconcileEvals)
+    claimedTypes.add("eval");
+  if (claimed.reconcilePlaybooks)
+    claimedTypes.add("playbook");
+  const diffs = [];
+  for (const type of claimedTypes) {
+    const sentSlugs = sentByType.get(type) ?? new Set;
+    const cloudSlugs = cloudByType.get(type) ?? new Set;
+    const missing = [...sentSlugs].filter((s3) => !cloudSlugs.has(s3));
+    const unexpected = [...cloudSlugs].filter((s3) => !sentSlugs.has(s3));
+    if (missing.length === 0 && unexpected.length === 0)
+      continue;
+    const parts = [];
+    if (missing.length)
+      parts.push(`missing ${missing.join(", ")}`);
+    if (unexpected.length)
+      parts.push(`unexpected ${unexpected.join(", ")}`);
+    diffs.push(`${type}: ${parts.join(", ")}`);
+  }
+  for (const component of sent) {
+    const other = cloud.find((c2) => c2.type === component.type && c2.slug === component.slug);
+    if (other && !await componentContentsMatch(component, other, signal)) {
+      diffs.push(`${component.type}: ${component.slug} contents differ`);
+    }
+  }
+  return diffs.length ? diffs.join("; ") : null;
+}
+async function componentContentsMatch(sent, cloud, signal) {
+  switch (sent.type) {
+    case "instruction":
+      return sent.files[0]?.content.trim() === cloud.files[0]?.content.trim();
+    case "playbook":
+      return sent.files[0]?.content === cloud.files[0]?.content;
+    case "skill":
+      return sent.meta?.version === undefined || sent.meta.version === cloud.meta?.version;
+    case "mcp": {
+      const config = (component) => {
+        const m3 = component.meta?.mcp;
+        return m3 && {
+          url: m3.url ?? null,
+          command: m3.command ?? null,
+          args: m3.args ?? [],
+          env: m3.env ?? {},
+          headers: m3.headers ?? {},
+          is_enabled: m3.is_enabled ?? true
+        };
+      };
+      return isDeepStrictEqual3(config(sent), config(cloud));
+    }
+    case "eval": {
+      const expected = { ...sent.meta?.eval };
+      const actual = cloud.meta?.eval;
+      if (expected.judge_type === "agent" && typeof expected.judge_agent === "string" && typeof actual?.judge_agent === "string" && expected.judge_agent !== actual.judge_agent) {
+        const judge = await api.getAgent(actual.judge_agent, { signal });
+        const slug = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+        if (expected.judge_agent === judge.slug || expected.judge_agent === slug(judge.name)) {
+          expected.judge_agent = actual.judge_agent;
+        }
+      }
+      return isDeepStrictEqual3(expected, actual);
+    }
+    default:
+      return false;
+  }
+}
 function secretDiffSummary(diff2) {
   return `${diff2.localOnly.length} added, ${diff2.changed.length} updated, ${diff2.cloudOnly.length} removed`;
 }
@@ -82571,6 +83740,32 @@ var import_picocolors46 = __toESM(require_picocolors(), 1);
 
 // src/cli/interface-common.ts
 var import_picocolors45 = __toESM(require_picocolors(), 1);
+
+// src/ui/error-causes.ts
+var explicitDebug = false;
+function enableDebugOutput() {
+  explicitDebug = true;
+}
+function debugOutputEnabled() {
+  return httpRetryEnabled() && (explicitDebug || !!process.env.BRAINBASE_DEBUG);
+}
+function formatErrorCauseChain(error2) {
+  const lines = [];
+  const seen = new Set;
+  while (error2 !== undefined && error2 !== null && !seen.has(error2)) {
+    seen.add(error2);
+    const record5 = error2;
+    const prefix = lines.length ? "Caused by: " : "";
+    lines.push(...sanitizeLines(prefix + (record5.stack ?? `${record5.name ?? "Error"}: ${record5.message ?? String(error2)}`)).map(redactSensitiveText));
+    if (record5.code !== undefined)
+      lines.push(...sanitizeLines(`code: ${String(record5.code)}`).map(redactSensitiveText));
+    error2 = record5.cause;
+  }
+  return lines.join(`
+`);
+}
+
+// src/cli/interface-common.ts
 var JSON_FLAG = { key: "json", names: ["--json"], kind: "boolean" };
 var YES_FLAG = { key: "yes", names: ["--yes", "-y"], kind: "boolean" };
 var KEY_FLAG = {
@@ -82679,6 +83874,8 @@ async function runReportingErrors(json4, work) {
     if (!(typeof json4 === "function" ? json4() : json4))
       throw error2;
     printJson({ error: errorShape(error2) });
+    if (debugOutputEnabled())
+      console.error(formatErrorCauseChain(error2));
     process.exitCode = 1;
   }
 }
@@ -83194,6 +84391,584 @@ async function unpin(ctx) {
 }
 var writeCommands = { label, restore, pin, unpin };
 
+// src/core/idempotency.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+function runPlanIdempotencyKey(explicitKey) {
+  return explicitKey ?? (httpRetryEnabled() ? randomUUID4() : undefined);
+}
+function runPlanRetryHint(key2, uncertain = true) {
+  const uncertainty = uncertain ? "Plan creation may have reached Brainbase. " : "";
+  if (!key2)
+    return `${uncertainty}Check existing runs before creating another plan.`;
+  if (redactSensitiveText(key2) !== key2 || !/^[A-Za-z0-9._:-]+$/.test(key2)) {
+    return `${uncertainty}For a retry of the same request, use the original --idempotency-key value, not a new key.`;
+  }
+  return uncertain ? `${uncertainty}Re-run the same command with --idempotency-key=${key2} to recover it without creating another plan.` : `For a retry of the same request, reuse --idempotency-key=${key2}.`;
+}
+
+// src/core/benchmark-api.ts
+var DEFAULT_BENCHMARK_REQUEST_TIMEOUT_MS = 30000;
+var BENCHMARK_UPLOAD_PROCESSING_ALLOWANCE_MS = 30000;
+var BENCHMARK_UPLOAD_MIN_BYTES_PER_SECOND = 256 * 1024;
+
+class BenchmarkClientUsageError extends Error {
+  code = "invalid_arguments";
+  retryable = false;
+  constructor(message) {
+    super(message);
+    this.name = "BenchmarkClientUsageError";
+  }
+}
+
+class BenchmarkApiError extends ApiError {
+  code;
+  requestId;
+  retryable;
+  constructor(message, status, body, code, requestId, retryable) {
+    super(message, status, body);
+    this.code = code;
+    this.requestId = requestId;
+    this.name = "BenchmarkApiError";
+    this.retryable = retryable ?? (status === undefined || status === 408 || status === 425 || status === 429 || status !== undefined && status >= 500);
+  }
+}
+function safeCode(body) {
+  if (!body || typeof body !== "object")
+    return;
+  const object4 = body;
+  const nested = object4.error && typeof object4.error === "object" ? object4.error.code : object4.detail && typeof object4.detail === "object" ? object4.detail.code : undefined;
+  const code = object4.code ?? nested;
+  return typeof code === "string" && /^[a-z][a-z0-9_]{0,99}$/.test(code) ? code : undefined;
+}
+function queryString(query) {
+  if (!query)
+    return "";
+  const params = new URLSearchParams;
+  for (const key2 of Object.keys(query).sort()) {
+    const value3 = query[key2];
+    if (value3 === undefined)
+      continue;
+    for (const item of Array.isArray(value3) ? value3 : [value3]) {
+      params.append(key2, String(item));
+    }
+  }
+  const encoded = params.toString();
+  return encoded ? `?${encoded}` : "";
+}
+function filenameFromHeaders(headers) {
+  const disposition = headers.get("Content-Disposition");
+  if (!disposition)
+    return null;
+  const utf8 = disposition.match(/filename\*=UTF-8''([^;]+)/i)?.[1];
+  if (utf8) {
+    try {
+      return decodeURIComponent(utf8);
+    } catch {
+      return utf8;
+    }
+  }
+  return disposition.match(/filename="?([^";]+)"?/i)?.[1] ?? null;
+}
+function uploadBlob(upload) {
+  if (upload.data instanceof Blob)
+    return upload.data;
+  return new Blob([upload.data], {
+    type: upload.contentType ?? "application/octet-stream"
+  });
+}
+function requestAbortContext(callerSignal, timeoutMs3) {
+  const controller = new AbortController;
+  let source;
+  const abortFromCaller = () => {
+    if (source !== undefined)
+      return;
+    source = "caller";
+    controller.abort(callerSignal?.reason);
+  };
+  if (callerSignal?.aborted) {
+    abortFromCaller();
+  } else {
+    callerSignal?.addEventListener("abort", abortFromCaller, { once: true });
+  }
+  const timer = setTimeout(() => {
+    if (source !== undefined)
+      return;
+    source = "timeout";
+    controller.abort(new DOMException(`Benchmark request timed out after ${timeoutMs3} ms`, "TimeoutError"));
+  }, timeoutMs3);
+  timer.unref?.();
+  return {
+    signal: controller.signal,
+    source: () => source,
+    dispose: () => {
+      clearTimeout(timer);
+      callerSignal?.removeEventListener("abort", abortFromCaller);
+    }
+  };
+}
+function callerAbortError(signal) {
+  return signal?.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted", "AbortError");
+}
+function idempotencyHeaders(key2) {
+  const headers = new Headers;
+  if (key2 === undefined)
+    return headers;
+  if (key2.length < 8 || key2.length > 200 || /[^\x21-\x7e]/.test(key2)) {
+    throw new BenchmarkClientUsageError("Idempotency keys must be 8-200 visible ASCII characters");
+  }
+  headers.set("Idempotency-Key", key2);
+  return headers;
+}
+
+class BenchmarkApiClient {
+  agentId;
+  fixedBaseUrl;
+  fetchImpl;
+  credentialResolver;
+  authRetry;
+  requestTimeoutMs;
+  uploadTimeoutMs;
+  constructor(options) {
+    this.agentId = options.agentId;
+    this.fixedBaseUrl = options.baseUrl?.replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? globalThis.fetch;
+    this.credentialResolver = options.resolveCredential ?? (async () => await resolveCredential());
+    this.authRetry = options.authRetry ?? sendWithAuthRetry;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_BENCHMARK_REQUEST_TIMEOUT_MS;
+    if (!Number.isSafeInteger(this.requestTimeoutMs) || this.requestTimeoutMs < 1) {
+      throw new BenchmarkClientUsageError("Benchmark request timeout must be a positive safe integer");
+    }
+    this.uploadTimeoutMs = options.uploadTimeoutMs;
+    if (this.uploadTimeoutMs !== undefined && (!Number.isSafeInteger(this.uploadTimeoutMs) || this.uploadTimeoutMs < 1)) {
+      throw new BenchmarkClientUsageError("Benchmark upload timeout must be a positive safe integer");
+    }
+  }
+  root(session) {
+    const base2 = this.fixedBaseUrl ?? masControlPlaneBaseUrl(session);
+    return `${base2}/v2/agents/${encodeURIComponent(this.agentId)}/benchmarks`;
+  }
+  async request(pathname, options = {}) {
+    const credential = await this.credentialResolver();
+    let session = credential.session;
+    const headers = new Headers(options.headers);
+    const idempotency = idempotencyHeaders(options.idempotencyKey);
+    idempotency.forEach((value3, key2) => headers.set(key2, value3));
+    if (!headers.has("Accept")) {
+      headers.set("Accept", options.mode === "binary" ? "application/octet-stream, application/gzip, application/zip, application/yaml, application/json" : "application/json");
+    }
+    let body = options.body;
+    if (body !== undefined && !(body instanceof FormData) && !(body instanceof Blob) && !(body instanceof ArrayBuffer) && !(body instanceof Uint8Array) && typeof body !== "string") {
+      body = stableJsonStringify(body);
+      if (!headers.has("Content-Type")) {
+        headers.set("Content-Type", "application/json");
+      }
+    }
+    const method2 = (options.method ?? "GET").toUpperCase();
+    const timeoutMs3 = options.timeoutMs ?? this.requestTimeoutMs;
+    const abort = requestAbortContext(options.signal, timeoutMs3);
+    const send = async (refreshed) => {
+      if (refreshed)
+        session = refreshed;
+      if (options.sendBudget && options.sendBudget.remaining <= 0) {
+        throw new BenchmarkApiError("HTTP request attempt budget exhausted", undefined, null, "retry_exhausted", undefined, false);
+      }
+      if (options.sendBudget) {
+        options.sendBudget.remaining--;
+        options.sendBudget.lastStatus = undefined;
+      }
+      const requestHeaders = new Headers(headers);
+      requestHeaders.set("Authorization", `Bearer ${session?.access_token ?? credential.bearer}`);
+      const response2 = await this.fetchImpl(`${this.root(session)}${pathname}${queryString(options.query)}`, { method: method2, headers: requestHeaders, body, signal: abort.signal });
+      if (options.sendBudget)
+        options.sendBudget.lastStatus = response2.status;
+      return response2;
+    };
+    let response;
+    try {
+      try {
+        response = await this.authRetry(credential.source === "session" ? session : null, send);
+      } catch (error2) {
+        if (abort.source() === "caller") {
+          throw callerAbortError(options.signal);
+        }
+        if (abort.source() === "timeout") {
+          throw new BenchmarkApiError(`Benchmark request timed out after ${timeoutMs3} ms`, 408, null, "request_timeout");
+        }
+        const failure = new BenchmarkApiError(redactSensitiveText(`Network error: ${error2 instanceof Error ? error2.message : String(error2)}`), undefined, null, "network_error");
+        if (httpRetryEnabled())
+          failure.cause = error2;
+        throw failure;
+      }
+      if (!response.ok) {
+        const text4 = await response.text();
+        let responseBody = text4;
+        try {
+          responseBody = text4 ? JSON.parse(text4) : null;
+        } catch {}
+        const failure = new BenchmarkApiError(redactSensitiveText(masApiErrorMessage(responseBody, response.status)), response.status, responseBody, safeCode(responseBody), response.headers.get("x-request-id") ?? response.headers.get("x-correlation-id") ?? undefined);
+        if (httpRetryEnabled())
+          failure.retryAfter = response.headers.get("Retry-After") ?? undefined;
+        throw failure;
+      }
+      if (options.mode === "binary") {
+        return {
+          bytes: new Uint8Array(await response.arrayBuffer()),
+          contentType: response.headers.get("Content-Type"),
+          filename: filenameFromHeaders(response.headers)
+        };
+      }
+      if (response.status === 204)
+        return;
+      const text3 = await response.text();
+      if (!text3)
+        return null;
+      try {
+        return JSON.parse(text3);
+      } catch {
+        throw new BenchmarkApiError("Benchmark API returned an invalid JSON response", response.status, null, "invalid_response", response.headers.get("x-request-id") ?? response.headers.get("x-correlation-id") ?? undefined, false);
+      }
+    } catch (error2) {
+      if (abort.source() === "caller") {
+        throw callerAbortError(options.signal);
+      }
+      if (abort.source() === "timeout") {
+        throw new BenchmarkApiError(`Benchmark request timed out after ${timeoutMs3} ms`, 408, null, "request_timeout");
+      }
+      if (httpRetryEnabled() && !(error2 instanceof ApiError)) {
+        const status = response && !response.ok ? response.status : undefined;
+        const failure = new BenchmarkApiError(status === undefined ? redactSensitiveText(`Network error while reading response: ${error2 instanceof Error ? error2.message : String(error2)}`) : `Benchmark API returned HTTP ${status}, but its response body was interrupted`, status, null, status === undefined ? "network_error" : undefined, response?.headers.get("x-request-id") ?? response?.headers.get("x-correlation-id") ?? undefined);
+        if (status !== undefined)
+          failure.retryAfter = response?.headers.get("Retry-After") ?? undefined;
+        else
+          failure.cause = error2;
+        throw failure;
+      }
+      throw error2;
+    } finally {
+      abort.dispose();
+    }
+  }
+  validateManifest(manifest) {
+    return this.request("/validate", {
+      method: "POST",
+      body: { manifest }
+    });
+  }
+  createBenchmark(manifest, options) {
+    return this.request("", {
+      method: "POST",
+      body: { manifest },
+      ...options
+    });
+  }
+  listBenchmarks(query = {}) {
+    return this.request("", {
+      query: {
+        limit: query.limit,
+        cursor: query.cursor,
+        archived: query.archived
+      }
+    });
+  }
+  getBenchmark(benchmarkId) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}`);
+  }
+  updateBenchmark(benchmarkId, input) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}`, {
+      method: "PATCH",
+      body: input
+    });
+  }
+  archiveBenchmark(benchmarkId, expectedVersion) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}/archive`, {
+      method: "POST",
+      body: { expected_version: expectedVersion }
+    });
+  }
+  restoreBenchmark(benchmarkId, expectedVersion) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}/restore`, {
+      method: "POST",
+      body: { expected_version: expectedVersion }
+    });
+  }
+  async purgeBenchmark(benchmarkId, input) {
+    await this.request(`/${encodeURIComponent(benchmarkId)}/purge`, {
+      method: "POST",
+      body: input
+    });
+  }
+  createRevision(benchmarkId, expectedVersion, options) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}/revisions`, {
+      method: "POST",
+      body: { expected_version: expectedVersion },
+      ...options
+    });
+  }
+  listRevisions(benchmarkId, query = {}) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}/revisions`, {
+      query: {
+        limit: query.limit,
+        before_revision_number: query.beforeRevisionNumber
+      }
+    });
+  }
+  exportManifest(benchmarkId, format, revisionId) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}/export`, {
+      mode: "binary",
+      query: { format, revision_id: revisionId }
+    });
+  }
+  exportBundle(benchmarkId, revisionId) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}/export`, {
+      mode: "binary",
+      query: { format: "bundle", revision_id: revisionId }
+    });
+  }
+  signBenchmarkObject(benchmarkId, objectId, query = {}) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}/objects/${encodeURIComponent(objectId)}/signed-url`, {
+      query: {
+        expires_in_seconds: query.expiresInSeconds,
+        download_name: query.downloadName
+      }
+    });
+  }
+  upload(pathname, upload, fields, options) {
+    const form = new FormData;
+    const blob = uploadBlob(upload);
+    form.append("file", blob, upload.filename);
+    for (const [key2, value3] of Object.entries(fields)) {
+      if (value3 !== undefined)
+        form.append(key2, value3);
+    }
+    const scaledTimeoutMs = BENCHMARK_UPLOAD_PROCESSING_ALLOWANCE_MS + Math.ceil(blob.size / BENCHMARK_UPLOAD_MIN_BYTES_PER_SECOND * 1000);
+    return this.request(pathname, {
+      method: "POST",
+      body: form,
+      timeoutMs: this.uploadTimeoutMs ?? Math.max(this.requestTimeoutMs, scaledTimeoutMs),
+      ...options
+    });
+  }
+  importManifest(upload, options) {
+    return this.upload("/imports/manifest", upload, {}, options);
+  }
+  importCsv(upload, fields, options) {
+    return this.upload("/imports/csv", upload, {
+      mapping_json: stableJsonStringify(fields.mapping),
+      metadata_json: stableJsonStringify(fields.metadata),
+      environment_json: fields.environment === undefined ? undefined : stableJsonStringify(fields.environment),
+      evaluators_json: fields.evaluators === undefined ? undefined : stableJsonStringify(fields.evaluators),
+      primary_evaluator_key: fields.primaryEvaluatorKey
+    }, options);
+  }
+  importBundle(upload, options) {
+    return this.upload("/imports/bundle", upload, {}, options);
+  }
+  previewTaskImport(input) {
+    return this.request("/imports/task/preview", {
+      method: "POST",
+      body: input
+    });
+  }
+  materializeTaskImport(input) {
+    return this.request("/imports/task/materialize", {
+      method: "POST",
+      body: input
+    });
+  }
+  previewHuggingFaceImport(input) {
+    return this.request("/imports/hugging-face/preview", {
+      method: "POST",
+      body: input
+    });
+  }
+  materializeHuggingFaceImport(input, options) {
+    return this.request("/imports/hugging-face/materialize", {
+      method: "POST",
+      body: input,
+      ...options
+    });
+  }
+  createRunPlan(benchmarkId, input, options) {
+    const sendBudget = httpRetryEnabled() ? { remaining: HTTP_RETRY_MAX_ATTEMPTS } : undefined;
+    const send = (signal, fixedOptions2 = options) => this.request(`/${encodeURIComponent(benchmarkId)}/runs/plan`, {
+      method: "POST",
+      body: input,
+      ...fixedOptions2,
+      signal,
+      sendBudget
+    });
+    if (!httpRetryEnabled())
+      return send();
+    const fixedOptions = { ...options };
+    const key2 = fixedOptions.idempotencyKey?.trim();
+    fixedOptions.idempotencyKey = key2;
+    let uncertain = false;
+    const mayHaveApplied = (error2) => {
+      const status = sendBudget?.lastStatus;
+      if (status === 401)
+        return false;
+      if (status !== undefined && status >= 200 && status < 300)
+        return true;
+      const kind = classifyHttpFailure(error2, !!key2);
+      return kind === "ambiguous" || kind === "retryable_status" && status !== 429 && status !== 425;
+    };
+    const request2 = async (signal) => {
+      try {
+        return await send(signal, fixedOptions);
+      } catch (error2) {
+        if ((sendBudget?.remaining ?? HTTP_RETRY_MAX_ATTEMPTS) < HTTP_RETRY_MAX_ATTEMPTS && mayHaveApplied(error2))
+          uncertain = true;
+        throw error2;
+      }
+    };
+    return retryHttpRequest(request2, {
+      idempotent: false,
+      keyed: !!key2,
+      budgetMs: this.requestTimeoutMs,
+      attemptsUsed: () => HTTP_RETRY_MAX_ATTEMPTS - (sendBudget?.remaining ?? 0),
+      retryTimeouts: false,
+      op: "benchmark_run_plan"
+    }).catch((error2) => {
+      const original = error2 instanceof BenchmarkApiError ? error2 : undefined;
+      if (original && key2)
+        original.idempotencyKey = key2;
+      const code = original ? safeCode(original.body) : undefined;
+      const settled = original?.status === 409 && (code === "idempotency_key_reused" || code === "idempotency_resource_deleted");
+      const dispatched = (sendBudget?.remaining ?? HTTP_RETRY_MAX_ATTEMPTS) < HTTP_RETRY_MAX_ATTEMPTS;
+      const unknown3 = uncertain || dispatched && mayHaveApplied(error2);
+      if (settled || !dispatched || !uncertain && sendBudget?.lastStatus === 401 || !unknown3 && !key2)
+        throw error2;
+      const failure = new BenchmarkApiError(`${runPlanRetryHint(key2, unknown3)} ${redactSensitiveText(error2 instanceof Error ? error2.message : String(error2))}`, original?.status, original?.body ?? null, original?.code ?? (original ? undefined : isHttpTimeout(error2) ? "request_timeout" : "network_error"), original?.requestId, original?.retryable);
+      failure.cause = error2;
+      if (key2)
+        failure.idempotencyKey = key2;
+      throw failure;
+    });
+  }
+  getRunPlan(planId) {
+    return this.request(`/run-plans/${encodeURIComponent(planId)}`);
+  }
+  confirmRunPlan(planId) {
+    return this.request(`/run-plans/${encodeURIComponent(planId)}/confirm`, {
+      method: "POST"
+    });
+  }
+  confirmRun(runId) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/confirm`, {
+      method: "POST"
+    });
+  }
+  listRuns(query = {}) {
+    return this.request("/runs", {
+      query: {
+        benchmark_id: query.benchmarkId,
+        status: query.status,
+        limit: query.limit,
+        cursor: query.cursor
+      }
+    });
+  }
+  getRun(runId, options = {}) {
+    return this.request(`/runs/${encodeURIComponent(runId)}`, options);
+  }
+  updateRunAnnotation(runId, input) {
+    return this.request(`/runs/${encodeURIComponent(runId)}`, {
+      method: "PATCH",
+      body: input
+    });
+  }
+  cancelRun(runId) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/cancel`, {
+      method: "POST"
+    });
+  }
+  resumeRun(runId) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/resume`, {
+      method: "POST"
+    });
+  }
+  listDiagnoses(runId, query = {}) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/diagnoses`, {
+      query: {
+        limit: query.limit,
+        cursor: query.cursor
+      }
+    });
+  }
+  getRunResults(runId, baselineTargetId) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/results`, {
+      query: { baseline_target_id: baselineTargetId }
+    });
+  }
+  exportRunResults(runId, query = {}) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/results/export`, {
+      mode: "binary",
+      query: {
+        include_billing_receipts: query.includeBillingReceipts || undefined
+      }
+    });
+  }
+  listTrials(runId, query = {}) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/trials`, {
+      query: {
+        status: query.status,
+        limit: query.limit,
+        cursor: query.cursor
+      }
+    });
+  }
+  listAttempts(runId, query = {}) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/attempts`, {
+      query: {
+        trial_id: query.trialId,
+        status: query.status,
+        limit: query.limit,
+        cursor: query.cursor
+      }
+    });
+  }
+  getAttempt(runId, attemptId, query = {}) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/attempts/${encodeURIComponent(attemptId)}`, {
+      query: {
+        evaluator_limit: query.evaluatorLimit,
+        evaluator_cursor: query.evaluatorCursor,
+        artifact_limit: query.artifactLimit,
+        artifact_cursor: query.artifactCursor
+      }
+    });
+  }
+  signAttemptArtifact(runId, attemptId, artifactId, query = {}) {
+    return this.request(`/runs/${encodeURIComponent(runId)}/attempts/${encodeURIComponent(attemptId)}/artifacts/${encodeURIComponent(artifactId)}/signed-url`, {
+      query: {
+        expires_in_seconds: query.expiresInSeconds,
+        download_name: query.downloadName
+      }
+    });
+  }
+  getSummaries(benchmarkIds, historyLimit) {
+    return this.request("/analytics/summaries", {
+      query: {
+        benchmark_id: benchmarkIds,
+        history_limit: historyLimit
+      }
+    });
+  }
+  getAnalytics(benchmarkId, historyLimit) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}/analytics`, {
+      query: { history_limit: historyLimit }
+    });
+  }
+  setBaseline(benchmarkId, targetKey, baselineTargetId) {
+    return this.request(`/${encodeURIComponent(benchmarkId)}/baselines/${encodeURIComponent(targetKey)}`, {
+      method: "PUT",
+      body: { baseline_target_id: baselineTargetId }
+    });
+  }
+  async clearBaseline(benchmarkId, targetKey) {
+    await this.request(`/${encodeURIComponent(benchmarkId)}/baselines/${encodeURIComponent(targetKey)}`, { method: "DELETE" });
+  }
+}
+
 // src/cli/task-status.ts
 var TERMINAL_TASK_STATUSES = new Set([
   "success",
@@ -83208,6 +84983,65 @@ function exitCodeForTaskStatus(status) {
   return status === SUCCESS_STATUS ? 0 : 1;
 }
 var SIGINT_EXIT_CODE = 130;
+var EX_TEMPFAIL_EXIT_CODE = 75;
+function isRetryablePollError(error2) {
+  if (!(error2 instanceof ApiError))
+    return false;
+  if (error2 instanceof BenchmarkApiError && error2.code === "request_timeout")
+    return false;
+  const status = error2.status;
+  return status === undefined && (isUnsentRequestError(error2) || isLostResponseError(error2) || error2 instanceof BenchmarkApiError && error2.code === "network_error") || status === 408 || status === 425 || status === 429 || status === 500 || status === 502 || status === 503 || status === 504 || status !== undefined && status >= 520 && status <= 524;
+}
+function retryAfterHeaderOf(error2) {
+  if (!(error2 instanceof ApiError))
+    return null;
+  const retryAfter = error2.retryAfter;
+  return typeof retryAfter === "string" && retryAfter.trim() ? retryAfter : null;
+}
+function logWaitRetryEvent(record5) {
+  const line = JSON.stringify(record5);
+  if (record5.event === "retry_exhausted")
+    console.error(line);
+  else
+    console.warn(line);
+}
+function pollFailureClass(error2) {
+  if (isUnsentRequestError(error2))
+    return "unsent";
+  if (error2 instanceof ApiError && error2.status !== undefined) {
+    return "retryable_status";
+  }
+  return "ambiguous";
+}
+function pollRetryTelemetry(event, op, error2, attempt2, startedAtMs, budgetMs, delayMs, nowMs = Date.now()) {
+  return {
+    event,
+    layer: "http",
+    op,
+    attempt: attempt2,
+    class: pollFailureClass(error2),
+    status: error2 instanceof ApiError && error2.status !== undefined ? error2.status : null,
+    elapsed_ms: nowMs - startedAtMs,
+    budget_ms: budgetMs,
+    error: error2 instanceof Error ? error2.name : String(error2),
+    ...delayMs !== undefined ? { delay_ms: delayMs } : {}
+  };
+}
+function waitUnreachableNotice(what, resumeHint, budgetMs) {
+  return `${what} is unreachable; the ${Math.round(budgetMs / 1000)}s downtime retry budget is exhausted. ` + `It may still be running; ${resumeHint}.`;
+}
+function exitCodeForWaitOutcome(outcome) {
+  switch (outcome.kind) {
+    case "terminal":
+      return exitCodeForTaskStatus(outcome.task.status);
+    case "interrupted":
+      return SIGINT_EXIT_CODE;
+    case "unreachable":
+      return EX_TEMPFAIL_EXIT_CODE;
+    case "timeout":
+      return 1;
+  }
+}
 async function waitForTask(taskId, options) {
   const stop = new AbortController;
   const onExternalAbort = () => stop.abort();
@@ -83217,23 +85051,92 @@ async function waitForTask(taskId, options) {
   const deadlineTimer = options.timeoutMs === undefined ? null : setTimeout(() => stop.abort(), options.timeoutMs);
   let latest = null;
   let lastStatus = null;
-  const givenUp = () => options.signal?.aborted ? { kind: "interrupted", task: latest } : { kind: "timeout", task: latest };
+  const retry = httpRetryEnabled();
+  const downtimeBudgetMs = options.downtimeBudgetMs ?? DEFAULT_RETRY_BUDGET_MS;
+  let downtime;
+  let downtimeTimer;
+  let downtimeExpired = false;
+  let lastPollError;
+  let failedPolls = 0;
+  const now2 = options.now ?? Date.now;
+  const pause2 = options.sleep ?? sleep3;
+  let outageStartedAt = now2();
+  const unreachable = () => {
+    logWaitRetryEvent(pollRetryTelemetry("retry_exhausted", "task_status_wait", lastPollError, failedPolls, outageStartedAt, downtimeBudgetMs, undefined, now2()));
+    return { kind: "unreachable", task: latest, budgetMs: downtimeBudgetMs };
+  };
+  const givenUp = () => {
+    if (options.signal?.aborted)
+      return { kind: "interrupted", task: latest };
+    if (downtimeExpired || downtime && downtime.remainingMs(now2()) === 0)
+      return unreachable();
+    return { kind: "timeout", task: latest };
+  };
   try {
     while (true) {
       if (stop.signal.aborted)
         return givenUp();
-      const polled = await raceAbort(masApi.getTask(taskId, { signal: stop.signal }), stop.signal);
-      if (polled.kind === "aborted")
-        return givenUp();
+      if (downtime && downtime.remainingMs(now2()) === 0)
+        return unreachable();
+      const pollStartedAt = now2();
+      const pollStop = retry ? new AbortController : stop;
+      const onStop = () => pollStop.abort(stop.signal.reason);
+      const requestTimer = retry ? setTimeout(() => {
+        pollStop.abort(new DOMException(`Task status request timed out after ${HTTP_RETRY_DEADLINE_MS} ms`, "TimeoutError"));
+      }, HTTP_RETRY_DEADLINE_MS) : undefined;
+      if (retry)
+        stop.signal.addEventListener("abort", onStop, { once: true });
+      let polled;
+      try {
+        polled = await raceAbort(masApi.getTask(taskId, { signal: pollStop.signal, singleAttempt: retry }), pollStop.signal);
+      } finally {
+        if (requestTimer !== undefined)
+          clearTimeout(requestTimer);
+        if (retry)
+          stop.signal.removeEventListener("abort", onStop);
+      }
+      if (polled.kind === "aborted") {
+        if (stop.signal.aborted)
+          return givenUp();
+        throw pollStop.signal.reason;
+      }
       if (polled.kind === "failed") {
         if (stop.signal.aborted)
           return givenUp();
-        if (!options.retryRead?.(polled.error))
+        if (!retry) {
+          if (!options.retryRead?.(polled.error))
+            throw polled.error;
+          if (await pause2(options.intervalMs, stop.signal))
+            return givenUp();
+          continue;
+        }
+        const retryable = options.retryRead ? options.retryRead(polled.error) : isRetryablePollError(polled.error);
+        if (!retryable)
           throw polled.error;
-        if (await sleep2(options.intervalMs, stop.signal))
+        lastPollError = polled.error;
+        if (!downtime) {
+          outageStartedAt = pollStartedAt;
+          downtime = createRetryBudget(downtimeBudgetMs, outageStartedAt);
+          downtimeTimer = setTimeout(() => {
+            downtimeExpired = true;
+            stop.abort();
+          }, downtime.remainingMs(now2()));
+        }
+        failedPolls += 1;
+        const delayMs = retryDelayMs(failedPolls - 1, downtime, retryAfterHeaderOf(polled.error), { maxMs: Math.min(STREAM_RETRY_MAX_DELAY_MS, Math.max(0, downtime.remainingMs(now2()) - 1)), rng: options.jitter }, now2());
+        if (delayMs === null) {
+          return unreachable();
+        }
+        logWaitRetryEvent(pollRetryTelemetry("retry_attempt", "task_status_wait", polled.error, failedPolls, outageStartedAt, downtimeBudgetMs, delayMs, now2()));
+        if (await pause2(delayMs, stop.signal))
           return givenUp();
         continue;
       }
+      downtime = undefined;
+      if (downtimeTimer !== undefined)
+        clearTimeout(downtimeTimer);
+      downtimeTimer = undefined;
+      failedPolls = 0;
       latest = polled.value;
       if (latest.status !== lastStatus) {
         lastStatus = latest.status;
@@ -83242,13 +85145,15 @@ async function waitForTask(taskId, options) {
       if (isTerminalTaskStatus(latest.status)) {
         return { kind: "terminal", task: latest };
       }
-      const cutShort = await sleep2(options.intervalMs, stop.signal);
+      const cutShort = await pause2(options.intervalMs, stop.signal);
       if (cutShort)
         return givenUp();
     }
   } finally {
     if (deadlineTimer !== null)
       clearTimeout(deadlineTimer);
+    if (downtimeTimer !== undefined)
+      clearTimeout(downtimeTimer);
     options.signal?.removeEventListener("abort", onExternalAbort);
   }
 }
@@ -83267,7 +85172,7 @@ function raceAbort(work, signal) {
     });
   });
 }
-function sleep2(ms2, signal) {
+function sleep3(ms2, signal) {
   if (signal.aborted)
     return Promise.resolve(true);
   return new Promise((resolve) => {
@@ -83353,7 +85258,7 @@ async function pollCapture(agentId, limitMs, deps, say, interrupted) {
       say(import_picocolors49.default.dim("  Waiting for the latest edit to be saved as a version..."));
       announced = true;
     }
-    if (await sleep2(Math.min(deps.pollIntervalMs ?? 2000, remaining), interrupted))
+    if (await sleep3(Math.min(deps.pollIntervalMs ?? 2000, remaining), interrupted))
       return false;
   }
 }
@@ -84044,7 +85949,10 @@ var DECISION_MODELS = [
   "pplx-decider-v1.2",
   "d1-ultra",
   "jev-1.14",
-  "classify-1"
+  "classify-1",
+  "microsoft-decision-1",
+  "clef-omni",
+  "d1"
 ];
 var DEFAULT_DECISION_MODEL = "clef-flash";
 var DECISION_LIMITS = {
@@ -85650,7 +87558,7 @@ async function runOrchestrationPush(cwd2, args) {
   const sp = spinner();
   sp.start("Updating orchestration graph…");
   try {
-    const updated = await api.updateOrchestration(link2.orchestration_id, {
+    const updateInput = {
       ...metaField("name"),
       ...metaField("description"),
       ...metaField("icon"),
@@ -85662,7 +87570,17 @@ async function runOrchestrationPush(cwd2, args) {
       ...sendWebhooks ? { replace_webhook_triggers: true } : {},
       ...sendDecisions ? { decisions: decisionsPayload } : {},
       ...lock?.revision != null ? { base_revision: lock.revision } : {}
-    });
+    };
+    let updated;
+    const pushStartedAt = Date.now();
+    try {
+      updated = await api.updateOrchestration(link2.orchestration_id, updateInput, httpRetryEnabled() ? { keepalive: false } : undefined);
+    } catch (err) {
+      if (!httpRetryEnabled() || !isLostResponseError(err))
+        throw err;
+      sp.stop("Connection lost after the graph was sent — reading the cloud graph back…");
+      updated = await reconcileOrchestrationUpdate(link2.orchestration_id, updateInput, sendDecisions ? localDecisions : null, slugForAgent, pushStartedAt);
+    }
     sp.stop(`Graph updated. New cloud revision ${updated.revision}.`);
     const settledDecisions = sendDecisions ? cloudDecisions(updated, slugForAgent) : decisionPlan?.kind === "reconcile" ? cloudDecisionList : null;
     writeOrchSyncState(cwd2, {
@@ -85698,6 +87616,192 @@ async function runOrchestrationPush(cwd2, args) {
     process.exitCode = 1;
   }
 }
+async function reconcileOrchestrationUpdate(orchestrationId, sent, sentDecisions, slugForAgent, startedAt) {
+  logRetryEvent2({
+    event: "retry_deferred",
+    layer: "http",
+    op: "update_orchestration",
+    attempt: 1,
+    class: "ambiguous",
+    status: null,
+    elapsed_ms: Date.now() - startedAt,
+    budget_ms: HTTP_RETRY_DEADLINE_MS,
+    error: "NetworkApiError"
+  });
+  let reread;
+  try {
+    reread = await api.getOrchestration(orchestrationId, {
+      signal: pushRecoverySignal(startedAt)
+    });
+  } catch (err) {
+    throw new ApiError(`The graph update may have succeeded, but the CLI could not read the orchestration back to confirm it (${err.message}). Run brainbase orchestration pull before pushing again.`);
+  }
+  const divergence = [
+    ...graphDivergence(reread, sent),
+    ...sentDecisions ? decisionsDivergence(sentDecisions, reread, slugForAgent) : []
+  ];
+  if (divergence.length) {
+    throw new ApiError(`Cannot confirm the push: the cloud graph at revision ${reread.revision} does not match what was sent (${divergence.join("; ")}).`, 409);
+  }
+  return reread;
+}
+function graphDivergence(cloud, sent) {
+  const diffs = [];
+  if (sent.members) {
+    const sentMembers = new Set(sent.members);
+    const cloudMembers = new Set(cloud.members.map((m3) => m3.agent_id));
+    diffs.push(...setDivergence("members", sentMembers, cloudMembers));
+  }
+  if (sent.edges) {
+    const sentEdges = sent.edges.map((e2) => JSON.stringify(canonical({
+      from: e2.from_agent_id,
+      to: e2.to_agent_id,
+      description: e2.description ?? "",
+      payload_schema: e2.payload_schema ?? {},
+      settings: e2.settings ?? {}
+    }))).sort();
+    const cloudEdges = cloud.edges.map((e2) => JSON.stringify(canonical({
+      from: e2.from_agent_id,
+      to: e2.to_agent_id,
+      description: e2.description ?? "",
+      payload_schema: e2.payload_schema ?? {},
+      settings: e2.settings ?? {}
+    }))).sort();
+    if (JSON.stringify(sentEdges) !== JSON.stringify(cloudEdges)) {
+      diffs.push(`edges: sent ${sent.edges.length}, cloud has ${cloud.edges.length} or contents differ`);
+    }
+  }
+  if (sent.triggers) {
+    const kindOf = (t) => t.trigger_type ?? t.type ?? "schedule";
+    const sentSchedules = sent.triggers.filter((t) => kindOf(t) === "schedule");
+    const sentWebhooks = sent.triggers.filter((t) => kindOf(t) === "webhook");
+    const cloudSchedules = (cloud.triggers ?? []).filter((t) => t.trigger_type === "schedule");
+    const cloudWebhooks = (cloud.triggers ?? []).filter((t) => t.trigger_type === "webhook");
+    const scheduleDiffs = triggerDivergence("schedule triggers", sentSchedules.map((t) => ({
+      node_id: t.node_id,
+      is_active: t.is_active ?? false,
+      cron: cronOf(t.config) ?? t.cron_expression,
+      props: t.config?.configured_props ?? {},
+      targets: (t.edges ?? []).map(triggerEdgeProjection)
+    })), cloudSchedules.map((t) => ({
+      node_id: t.node_id,
+      is_active: t.is_active ?? false,
+      cron: cronOf(t.config),
+      props: t.config?.configured_props ?? {},
+      targets: t.edges.map(triggerEdgeProjection)
+    })));
+    diffs.push(...scheduleDiffs);
+    if (sent.replace_webhook_triggers) {
+      diffs.push(...triggerDivergence("webhook triggers", sentWebhooks.map((t) => ({
+        node_id: t.node_id,
+        is_active: t.is_active ?? false,
+        public: typeof t.public === "boolean" ? t.public : webhookPublicFromConfig(t.config),
+        targets: (t.edges ?? []).map(triggerEdgeProjection)
+      })), cloudWebhooks.map((t) => ({
+        node_id: t.node_id,
+        is_active: t.is_active ?? false,
+        public: typeof t.public === "boolean" ? t.public : webhookPublicFromConfig(t.config),
+        targets: t.edges.map(triggerEdgeProjection)
+      }))));
+    }
+  }
+  for (const field2 of [
+    "name",
+    "description",
+    "icon",
+    "icon_color",
+    "credit_limit"
+  ]) {
+    let expected = sent[field2];
+    if (field2 === "name" && typeof expected === "string")
+      expected = expected.trim();
+    if ((field2 === "icon" || field2 === "icon_color") && expected === "")
+      expected = null;
+    if (expected !== undefined && cloud[field2] !== expected) {
+      diffs.push(`${field2}: cloud has "${String(cloud[field2])}", sent "${String(expected)}"`);
+    }
+  }
+  return diffs;
+}
+function triggerDivergence(label2, sent, cloud) {
+  const diffs = setDivergence(label2, new Set(sent.map((t) => canonicalUuid2(t.node_id))), new Set(cloud.map((t) => canonicalUuid2(t.node_id))));
+  const cloudById = new Map(cloud.map((t) => [canonicalUuid2(t.node_id), t]));
+  for (const t of sent) {
+    const other = cloudById.get(canonicalUuid2(t.node_id));
+    if (!other)
+      continue;
+    if (t.cron !== undefined && t.cron !== other.cron) {
+      diffs.push(`${label2}: ${t.node_id} cron "${other.cron ?? ""}", sent "${t.cron}"`);
+    }
+    if (JSON.stringify(canonical(t.props)) !== JSON.stringify(canonical(other.props))) {
+      diffs.push(`${label2}: ${t.node_id} configured properties differ`);
+    }
+    if (t.is_active !== other.is_active) {
+      diffs.push(`${label2}: ${t.node_id} is_active ${other.is_active}, sent ${t.is_active}`);
+    }
+    if (t.public !== undefined && (t.public ?? null) !== (other.public ?? null)) {
+      diffs.push(`${label2}: ${t.node_id} public ${other.public ?? null}, sent ${t.public ?? null}`);
+    }
+    if (JSON.stringify([...t.targets].sort()) !== JSON.stringify([...other.targets].sort())) {
+      diffs.push(`${label2}: ${t.node_id} targets differ`);
+    }
+  }
+  return diffs;
+}
+function decisionsDivergence(sent, cloud, slugForAgent) {
+  const cloudDecisionsList = cloudDecisions(cloud, slugForAgent);
+  if (!cloudDecisionsList) {
+    return [
+      `decisions: the re-read shows none, but this push sent ${sent.length}`
+    ];
+  }
+  const diffs = setDivergence("decisions", new Set(sent.map((d3) => d3.id)), new Set(cloudDecisionsList.map((d3) => d3.id)));
+  if ([...deadDecisionLinks(cloud).values()].some((count) => count > 0)) {
+    diffs.push("decisions: cloud still has dangling inputs or routes");
+  }
+  const cloudById = new Map(cloudDecisionsList.map((d3) => [d3.id, d3]));
+  for (const d3 of sent) {
+    const other = cloudById.get(d3.id);
+    if (!other)
+      continue;
+    if (decisionHash(d3) !== decisionHash(other)) {
+      diffs.push(`decisions: ${d3.name} (${d3.id}) contents differ`);
+    }
+  }
+  return diffs;
+}
+function triggerEdgeProjection(edge) {
+  return JSON.stringify(canonical({
+    to_agent_id: edge.to_agent_id,
+    description: edge.description ?? "",
+    payload_schema: edge.payload_schema ?? {}
+  }));
+}
+function cronOf(config2) {
+  const cron = config2?.cron_expression;
+  return typeof cron === "string" ? cron : undefined;
+}
+function canonical(value3) {
+  if (Array.isArray(value3))
+    return value3.map(canonical);
+  if (value3 && typeof value3 === "object") {
+    return Object.fromEntries(Object.entries(value3).sort(([a3], [b4]) => a3 < b4 ? -1 : a3 > b4 ? 1 : 0).map(([key2, v3]) => [key2, canonical(v3)]));
+  }
+  return value3;
+}
+function setDivergence(label2, sent, cloud) {
+  const missing = [...sent].filter((v3) => !cloud.has(v3));
+  const unexpected = [...cloud].filter((v3) => !sent.has(v3));
+  if (missing.length === 0 && unexpected.length === 0)
+    return [];
+  const parts = [];
+  if (missing.length)
+    parts.push(`missing ${missing.join(", ")}`);
+  if (unexpected.length) {
+    parts.push(`unexpected ${unexpected.join(", ")}`);
+  }
+  return [`${label2}: ${parts.join(", ")}`];
+}
 function handleApiError6(err) {
   if (err instanceof ApiError) {
     if (err.status === 401) {
@@ -88680,7 +90784,7 @@ var import_picocolors74 = __toESM(require_picocolors(), 1);
 
 // src/cli/task-create.ts
 var import_picocolors70 = __toESM(require_picocolors(), 1);
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 
 // src/cli/task-update.ts
 var import_picocolors69 = __toESM(require_picocolors(), 1);
@@ -88891,7 +90995,7 @@ function isPublishScopeError(error2) {
   return /PAT lacks required scope:\s*publish/i.test(`${message3} ${body}`);
 }
 async function runTaskCreate(cwd2, options, dependencies = {}) {
-  const idempotencyKey = (dependencies.randomUUID ?? randomUUID4)();
+  const idempotencyKey = (dependencies.randomUUID ?? randomUUID5)();
   const message3 = requiredValue(options.message, "--message");
   const interfaceId = optionalValue(options.interfaceId, "--interface");
   const agentId = await resolveAgentId2(cwd2, options.agentId, interfaceId, dependencies.readManifest ?? readManifest);
@@ -88963,8 +91067,11 @@ async function waitForCreatedTask(created, options, dependencies, version2) {
       onStatus: options.json ? undefined : (task) => console.log(`Status: ${task.status}`)
     });
     const status = outcome.task?.status ?? created.status;
-    const code = outcome.kind === "terminal" ? exitCodeForTaskStatus(status) : outcome.kind === "interrupted" ? SIGINT_EXIT_CODE : 1;
+    const code = exitCodeForWaitOutcome(outcome);
     setExitCode(code);
+    if (outcome.kind === "unreachable") {
+      console.error(waitUnreachableNotice(`Task ${created.id}'s status`, `check with \`brainbase task get ${created.id}\``, outcome.budgetMs));
+    }
     if (options.json) {
       console.log(JSON.stringify({
         task_id: created.id,
@@ -88977,6 +91084,9 @@ async function waitForCreatedTask(created, options, dependencies, version2) {
       }));
       return;
     }
+    if (outcome.kind === "unreachable") {
+      return;
+    }
     if (outcome.kind === "timeout") {
       console.log(import_picocolors70.default.yellow(`Timed out after ${options.timeoutSeconds}s with the task still ${status}.`));
       return;
@@ -89206,7 +91316,46 @@ function failureSummary(task) {
 var import_picocolors73 = __toESM(require_picocolors(), 1);
 
 // src/core/task-events.ts
-var DEFAULT_RETRY_BUDGET_MS = 60000;
+var LEGACY_RETRY_BUDGET_MS = 60000;
+var DEFAULT_RETRY_BUDGET_MS2 = httpRetryEnabled() ? DEFAULT_RETRY_BUDGET_MS : LEGACY_RETRY_BUDGET_MS;
+var RECONNECT_FIRST_DELAY_MS = 5000;
+var RECONNECT_MAX_DELAY_MS = 30000;
+
+class FollowBudgetExhaustedError extends ApiError {
+  lastEventId;
+  budgetMs;
+  constructor(message3, lastEventId, budgetMs) {
+    super(message3);
+    this.lastEventId = lastEventId;
+    this.budgetMs = budgetMs;
+    this.name = "FollowBudgetExhaustedError";
+  }
+}
+var RETRYABLE_HTTP_STATUSES = new Set([
+  408,
+  425,
+  429,
+  500,
+  502,
+  503,
+  504,
+  520,
+  521,
+  522,
+  523,
+  524
+]);
+var EXHAUSTED = Symbol("exhausted");
+function isRetryableHttpStatus(status) {
+  return status !== undefined && RETRYABLE_HTTP_STATUSES.has(status);
+}
+function logRetryEvent3(record5) {
+  const line2 = JSON.stringify(record5);
+  if (record5.event === "retry_exhausted")
+    console.error(line2);
+  else
+    console.warn(line2);
+}
 function followTaskEvents(options) {
   const {
     url: url2,
@@ -89215,22 +91364,124 @@ function followTaskEvents(options) {
     onOpen,
     onReconnect,
     signal,
-    retryBudgetMs = DEFAULT_RETRY_BUDGET_MS
+    reconnectFirstDelayMs = RECONNECT_FIRST_DELAY_MS,
+    reconnectMaxDelayMs = RECONNECT_MAX_DELAY_MS,
+    now: now2 = Date.now
   } = options;
+  const retry = httpRetryEnabled();
+  const retryBudgetMs = options.retryBudgetMs ?? (retry ? DEFAULT_RETRY_BUDGET_MS : LEGACY_RETRY_BUDGET_MS);
+  const idleWatchdogMs = options.idleWatchdogMs ?? IDLE_WATCHDOG_MS;
   return new Promise((resolve, reject2) => {
     if (signal?.aborted) {
       resolve();
       return;
     }
     let source;
+    let sourceStop;
     let settled = false;
     let closeRequested = false;
     let downTimer;
+    let downSince;
+    let watchdogTimer;
+    let reopenTimer;
     let lastReason = "connection lost";
+    let lastEventId = null;
+    let lastByteAt = now2();
+    let rejectedBearer;
+    let attemptBearer;
+    let retryAfterMs;
+    let reconnectAttempt = 0;
+    let unauthorizedRetries = 0;
+    const startedAt = now2();
+    let lastFailureClass = "ambiguous";
+    let lastFailureStatus = null;
     const clearBudget = () => {
       if (downTimer !== undefined)
         clearTimeout(downTimer);
       downTimer = undefined;
+      downSince = undefined;
+    };
+    const armBudget = (since = now2()) => {
+      if (downSince !== undefined) {
+        if (now2() - downSince >= retryBudgetMs) {
+          emitExhausted();
+          finish(exhaustedError());
+          return false;
+        }
+        return true;
+      }
+      downSince = since;
+      const remaining = Math.max(0, retryBudgetMs - (now2() - since));
+      downTimer = setTimeout(() => {
+        downTimer = undefined;
+        emitExhausted();
+        finish(exhaustedError());
+      }, remaining);
+      return true;
+    };
+    const emitExhausted = (status = lastFailureStatus) => {
+      if (!retry)
+        return;
+      logRetryEvent3({
+        event: "retry_exhausted",
+        layer: "http",
+        op: "task_events_follow",
+        attempt: Math.max(1, reconnectAttempt),
+        class: lastFailureClass,
+        status,
+        elapsed_ms: now2() - startedAt,
+        budget_ms: retryBudgetMs,
+        error: "FollowBudgetExhaustedError"
+      });
+    };
+    const exhaustedError = () => {
+      const message3 = `The log stream has been unreachable for ${Math.round(retryBudgetMs / 1000)}s (${lastReason}). ` + `Giving up — the task may still be running; re-run to reattach.` + (retry ? ` Last event id: ${lastEventId ?? "(none)"}.` : "");
+      if (!retry)
+        return new ApiError(message3);
+      return new FollowBudgetExhaustedError(message3, lastEventId, retryBudgetMs);
+    };
+    const clearWatchdog = () => {
+      if (watchdogTimer !== undefined)
+        clearTimeout(watchdogTimer);
+      watchdogTimer = undefined;
+    };
+    const armWatchdog = () => {
+      if (!retry)
+        return;
+      clearWatchdog();
+      watchdogTimer = setTimeout(() => {
+        watchdogTimer = undefined;
+        if (settled || closeRequested || source === undefined)
+          return;
+        reconnectAttempt += 1;
+        lastReason = `no data for ${Math.round(idleWatchdogMs / 1000)}s (idle watchdog)`;
+        onReconnect?.(lastReason);
+        const delay2 = jitterDelayMs();
+        emitRetry("ambiguous", null, "IdleWatchdog", delay2);
+        if (!armBudget(lastByteAt))
+          return;
+        closeSource();
+        scheduleReopen(delay2);
+      }, idleWatchdogMs);
+    };
+    const noteByte = () => {
+      lastByteAt = now2();
+      armWatchdog();
+    };
+    const clearReopen = () => {
+      if (reopenTimer !== undefined)
+        clearTimeout(reopenTimer);
+      reopenTimer = undefined;
+    };
+    const closeSource = () => {
+      clearWatchdog();
+      const current = source;
+      source = undefined;
+      sourceStop?.abort();
+      sourceStop = undefined;
+      current?.close();
+      if (retry && current)
+        queueMicrotask(() => current.close());
     };
     const finish = (error2) => {
       if (settled)
@@ -89238,60 +91489,198 @@ function followTaskEvents(options) {
       settled = true;
       closeRequested = true;
       clearBudget();
-      source?.close();
+      clearWatchdog();
+      clearReopen();
+      closeSource();
       if (error2)
         reject2(error2);
       else
         resolve();
     };
-    source = new EventSource(url2, {
-      fetch: async (input, init) => {
-        let bearer;
-        try {
-          bearer = await resolveBearer();
-        } catch (error2) {
-          if (error2 instanceof StreamHostMovedError) {
-            finish(error2);
+    const emitRetry = (failureClass, status, errorName, delayMs) => {
+      if (!retry)
+        return;
+      lastFailureClass = failureClass;
+      lastFailureStatus = status;
+      logRetryEvent3({
+        event: "retry_attempt",
+        layer: "http",
+        op: "task_events_follow",
+        attempt: reconnectAttempt,
+        class: failureClass,
+        status,
+        elapsed_ms: now2() - startedAt,
+        budget_ms: retryBudgetMs,
+        error: errorName,
+        delay_ms: delayMs
+      });
+    };
+    const jitterDelayMs = () => {
+      const cap = Math.min(reconnectMaxDelayMs, reconnectFirstDelayMs * 2 ** Math.max(0, reconnectAttempt - 1), downSince === undefined ? retryBudgetMs : Math.max(0, retryBudgetMs - (now2() - downSince)));
+      return Math.floor(Math.random() * cap);
+    };
+    const reconnectDelayMs = () => {
+      if (retryAfterMs === undefined)
+        return jitterDelayMs();
+      const remaining = retryBudgetMs - (now2() - (downSince ?? now2()));
+      if (retryAfterMs > remaining)
+        return EXHAUSTED;
+      return retryAfterMs;
+    };
+    const scheduleReopen = (delayMs) => {
+      if (settled || closeRequested)
+        return;
+      if (!armBudget())
+        return;
+      reopenTimer = setTimeout(() => {
+        reopenTimer = undefined;
+        if (!settled && !closeRequested)
+          openSource();
+      }, Math.max(0, delayMs));
+    };
+    const openSource = () => {
+      if (settled || closeRequested)
+        return;
+      const stop = retry ? new AbortController : undefined;
+      sourceStop = stop;
+      const es2 = new EventSource(url2, {
+        fetch: async (input, init) => {
+          retryAfterMs = undefined;
+          let bearer;
+          try {
+            bearer = await resolveBearer(retry ? rejectedBearer : undefined);
+            rejectedBearer = undefined;
+            attemptBearer = bearer;
+          } catch (error2) {
+            if (error2 instanceof StreamHostMovedError) {
+              finish(error2);
+              throw error2;
+            }
             throw error2;
           }
-          throw error2;
+          const headers = new Headers(init?.headers);
+          headers.set("Authorization", `Bearer ${bearer}`);
+          if (retry && lastEventId && !headers.has("Last-Event-ID")) {
+            headers.set("Last-Event-ID", lastEventId);
+          }
+          const response = await fetch(input, { ...init, headers, signal: stop?.signal ?? init?.signal });
+          if (!retry || response.status !== 200) {
+            if (response.status !== 200) {
+              retryAfterMs = parseRetryAfterMs(response.headers.get("retry-after")) ?? undefined;
+              if (retry)
+                await response.body?.cancel().catch(() => {});
+            }
+            return response;
+          }
+          if (!response.body)
+            return response;
+          const observed = response.body.pipeThrough(new TransformStream({
+            transform(chunk2, controller) {
+              if (source === es2)
+                noteByte();
+              controller.enqueue(chunk2);
+            }
+          }));
+          return new Response(observed, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: response.headers
+          });
         }
-        const headers = new Headers(init?.headers);
-        headers.set("Authorization", `Bearer ${bearer}`);
-        return await fetch(input, { ...init, headers });
-      }
-    });
-    if (closeRequested)
-      source.close();
-    const dispatch = source.dispatchEvent.bind(source);
-    source.dispatchEvent = (event) => {
-      if (event instanceof MessageEvent) {
-        onFrame({
-          id: event.lastEventId,
-          type: event.type,
-          data: parseFrameData(event.data)
-        });
-      }
-      return dispatch(event);
+      });
+      source = es2;
+      if (retry) {
+        lastByteAt = now2();
+        armWatchdog();
+      }
+      if (closeRequested)
+        es2.close();
+      const dispatch = es2.dispatchEvent.bind(es2);
+      es2.dispatchEvent = (event) => {
+        if (source !== es2)
+          return dispatch(event);
+        if (event instanceof MessageEvent) {
+          if (retry) {
+            clearBudget();
+            reconnectAttempt = 0;
+          }
+          if (event.lastEventId)
+            lastEventId = event.lastEventId;
+          onFrame({
+            id: event.lastEventId,
+            type: event.type,
+            data: parseFrameData(event.data)
+          });
+        }
+        return dispatch(event);
+      };
+      es2.addEventListener("open", () => {
+        if (source !== es2)
+          return;
+        unauthorizedRetries = 0;
+        if (retry) {
+          lastByteAt = now2();
+          armWatchdog();
+        } else {
+          clearBudget();
+        }
+        onOpen?.();
+      });
+      es2.addEventListener("error", (event) => {
+        if (source !== es2)
+          return;
+        const { message: message3, code } = event;
+        const status = typeof code === "number" ? code : undefined;
+        if (es2.readyState === es2.CLOSED) {
+          clearWatchdog();
+          if (retry && status === 401 && unauthorizedRetries < 1) {
+            unauthorizedRetries += 1;
+            rejectedBearer = attemptBearer;
+            lastReason = message3?.trim() || "unauthorized";
+            onReconnect?.(lastReason);
+            closeSource();
+            scheduleReopen(0);
+            return;
+          }
+          if (retry && isRetryableHttpStatus(status)) {
+            reconnectAttempt += 1;
+            lastFailureClass = "retryable_status";
+            lastFailureStatus = status ?? null;
+            lastReason = message3?.trim() || `HTTP ${status}`;
+            onReconnect?.(lastReason);
+            if (!armBudget())
+              return;
+            const delay2 = reconnectDelayMs();
+            if (delay2 === EXHAUSTED) {
+              emitExhausted(status ?? null);
+              finish(exhaustedError());
+              return;
+            }
+            emitRetry("retryable_status", status ?? null, "ErrorEvent", delay2);
+            closeSource();
+            scheduleReopen(delay2);
+            return;
+          }
+          finish(streamError(message3, code));
+          return;
+        }
+        clearWatchdog();
+        lastReason = message3?.trim() || "connection lost";
+        onReconnect?.(lastReason);
+        lastFailureClass = "ambiguous";
+        lastFailureStatus = null;
+        if (!armBudget())
+          return;
+        if (retry) {
+          reconnectAttempt += 1;
+          const delay2 = jitterDelayMs();
+          emitRetry("ambiguous", null, "ErrorEvent", delay2);
+          closeSource();
+          scheduleReopen(delay2);
+        }
+      });
     };
-    source.addEventListener("open", () => {
-      clearBudget();
-      onOpen?.();
-    });
-    source.addEventListener("error", (event) => {
-      const { message: message3, code } = event;
-      if (source.readyState === source.CLOSED) {
-        finish(streamError(message3, code));
-        return;
-      }
-      lastReason = message3?.trim() || "connection lost";
-      onReconnect?.(lastReason);
-      if (downTimer === undefined) {
-        downTimer = setTimeout(() => {
-          finish(new ApiError(`The log stream has been unreachable for ${Math.round(retryBudgetMs / 1000)}s (${lastReason}). Giving up — the task may still be running; re-run to reattach.`));
-        }, retryBudgetMs);
-      }
-    });
+    openSource();
     signal?.addEventListener("abort", () => finish(), { once: true });
   });
 }
@@ -89465,12 +91854,55 @@ function isPermanentRefusal(error2) {
 // src/cli/task-logs.ts
 var MAX_PAGE = 1000;
 var PAGE_SIZE2 = 500;
+var STREAM_EXHAUSTED_EXIT_CODE = 75;
+var PAGE_RETRY_BASE_DELAY_MS = 250;
+var PAGE_RETRY_MAX_DELAY_MS = 30000;
+
+class TranscriptPageBudgetExhaustedError extends ApiError {
+  collected;
+  budgetMs;
+  constructor(message3, collected, budgetMs) {
+    super(message3);
+    this.collected = collected;
+    this.budgetMs = budgetMs;
+    this.name = "TranscriptPageBudgetExhaustedError";
+  }
+}
+
+class TranscriptPageTimeoutError extends ApiError {
+  collected;
+  constructor(collected) {
+    super("The task transcript request timed out. Collected events are shown; re-run to read the rest.");
+    this.collected = collected;
+    this.name = "TranscriptPageTimeoutError";
+  }
+}
 async function runTaskLogs(taskId, options = {}, dependencies = {}) {
   if (options.follow) {
     await followTranscript(taskId, options, dependencies);
     return;
   }
-  const events = await readTranscript(taskId, options.limit);
+  let events;
+  try {
+    events = await readTranscript(taskId, options.limit, {
+      budgetMs: dependencies.pageBudgetMs,
+      requestTimeoutMs: dependencies.pageRequestTimeoutMs,
+      now: dependencies.now
+    });
+  } catch (error2) {
+    if (error2 instanceof TranscriptPageBudgetExhaustedError || error2 instanceof TranscriptPageTimeoutError) {
+      const setExitCode = dependencies.setExitCode ?? ((code) => process.exitCode = code);
+      events = error2.collected;
+      renderTranscript(events, options);
+      console.error(import_picocolors73.default.dim(error2.message));
+      setExitCode(error2 instanceof TranscriptPageBudgetExhaustedError ? STREAM_EXHAUSTED_EXIT_CODE : 1);
+      return;
+    }
+    throw error2;
+  }
+  renderTranscript(events, options);
+}
+function renderTranscript(events, options) {
   if (options.json) {
     console.log(JSON.stringify({ items: events }, null, 2));
     return;
@@ -89518,6 +91950,9 @@ async function followTranscript(taskId, options, dependencies) {
       resolveBearer,
       signal: controller.signal,
       retryBudgetMs: dependencies.retryBudgetMs,
+      idleWatchdogMs: dependencies.idleWatchdogMs,
+      reconnectFirstDelayMs: dependencies.reconnectFirstDelayMs,
+      now: dependencies.now,
       onFrame: (frame) => {
         settle.noteFrame();
         const event = frame.data;
@@ -89546,6 +91981,13 @@ async function followTranscript(taskId, options, dependencies) {
     });
     if (interruptCode !== undefined)
       setExitCode(interruptCode);
+  } catch (error2) {
+    if (error2 instanceof FollowBudgetExhaustedError) {
+      console.error(import_picocolors73.default.red(error2.message));
+      setExitCode(STREAM_EXHAUSTED_EXIT_CODE);
+      return;
+    }
+    throw error2;
   } finally {
     settle.stop();
     process.off("SIGINT", onSigint);
@@ -89576,15 +92018,79 @@ function isSupersededChunk(event, rolledUp) {
 function laneOf(event) {
   return `${event.subagent_id ?? ""}\x00${event.turn_id ?? ""}`;
 }
-async function readTranscript(taskId, limit) {
+async function readTranscript(taskId, limit, options = {}) {
+  const retry = httpRetryEnabled();
+  const budgetMs = options.budgetMs ?? DEFAULT_RETRY_BUDGET_MS;
+  const now2 = options.now ?? Date.now;
+  let startedAt = now2();
   const collected = [];
   let after2;
+  let attempt2 = 0;
+  let deadline = startedAt + budgetMs;
   while (true) {
     const remaining = limit === undefined ? PAGE_SIZE2 : limit - collected.length;
     if (remaining <= 0)
       break;
     const pageSize = Math.min(MAX_PAGE, remaining === PAGE_SIZE2 ? PAGE_SIZE2 : remaining);
-    const page = await masApi.listTaskEvents(taskId, { limit: pageSize, after: after2 });
+    let page;
+    if (retry && now2() >= deadline) {
+      throw pageBudgetExhausted(collected, budgetMs, now2() - startedAt, attempt2, "ambiguous");
+    }
+    attempt2 += 1;
+    const stop = new AbortController;
+    const request2 = masApi.listTaskEvents(taskId, {
+      limit: pageSize,
+      after: after2,
+      ...retry ? { signal: stop.signal } : {}
+    });
+    request2.catch(() => {});
+    let pageTimer;
+    try {
+      page = !retry ? await request2 : await Promise.race([
+        request2,
+        new Promise((_4, reject2) => {
+          const left = deadline - now2();
+          if (left <= 0) {
+            const error2 = new PageDeadlineError;
+            reject2(error2);
+            stop.abort(error2);
+            return;
+          }
+          pageTimer = setTimeout(() => {
+            const error2 = left <= (options.requestTimeoutMs ?? HTTP_RETRY_DEADLINE_MS) ? new PageDeadlineError : new TranscriptPageTimeoutError(collected);
+            reject2(error2);
+            stop.abort(error2);
+          }, Math.min(left, options.requestTimeoutMs ?? HTTP_RETRY_DEADLINE_MS));
+        })
+      ]);
+    } catch (error2) {
+      if (pageTimer !== undefined)
+        clearTimeout(pageTimer);
+      if (error2 instanceof PageDeadlineError) {
+        throw pageBudgetExhausted(collected, budgetMs, now2() - startedAt, attempt2, "ambiguous");
+      }
+      const failureClass = classifyPageFailure(error2);
+      if (!retry || failureClass === undefined)
+        throw error2;
+      if (now2() >= deadline) {
+        throw pageBudgetExhausted(collected, budgetMs, now2() - startedAt, attempt2, failureClass, error2 instanceof ApiError ? error2.status ?? null : null);
+      }
+      const cap = Math.min(PAGE_RETRY_MAX_DELAY_MS, PAGE_RETRY_BASE_DELAY_MS * 2 ** (attempt2 - 1), Math.max(0, deadline - now2()));
+      const delay2 = Math.floor(Math.random() * cap);
+      const retryAfter = error2 instanceof ApiError ? parseRetryAfterMs(error2.retryAfter) : undefined;
+      if (retryAfter != null && retryAfter > deadline - now2()) {
+        throw pageBudgetExhausted(collected, budgetMs, now2() - startedAt, attempt2, failureClass, error2 instanceof ApiError ? error2.status : undefined);
+      }
+      const wait = retryAfter ?? delay2;
+      logPageRetry(attempt2, failureClass, error2, budgetMs, now2() - startedAt, wait);
+      await new Promise((resolve) => setTimeout(resolve, wait));
+      continue;
+    }
+    if (pageTimer !== undefined)
+      clearTimeout(pageTimer);
+    attempt2 = 0;
+    startedAt = now2();
+    deadline = startedAt + budgetMs;
     if (page.length < pageSize) {
       collected.push(...page);
       break;
@@ -89599,6 +92105,51 @@ async function readTranscript(taskId, limit) {
   }
   return collected;
 }
+function classifyPageFailure(error2) {
+  if (isUnsentRequestError(error2))
+    return "unsent";
+  if (isLostResponseError(error2))
+    return "ambiguous";
+  if (error2 instanceof ApiError && isRetryableHttpStatus(error2.status)) {
+    return "retryable_status";
+  }
+  return;
+}
+
+class PageDeadlineError extends Error {
+  constructor() {
+    super("page budget elapsed");
+    this.name = "PageDeadlineError";
+  }
+}
+function pageBudgetExhausted(collected, budgetMs, elapsedMs, attempt2, failureClass, status = null) {
+  logRetryEvent3({
+    event: "retry_exhausted",
+    layer: "http",
+    op: "task_logs_page",
+    attempt: attempt2,
+    class: failureClass,
+    status,
+    elapsed_ms: elapsedMs,
+    budget_ms: budgetMs,
+    error: "TranscriptPageBudgetExhaustedError"
+  });
+  return new TranscriptPageBudgetExhaustedError(`The task transcript has been unreadable for ${Math.round(budgetMs / 1000)}s. ` + `${collected.length} event${collected.length === 1 ? "" : "s"} collected before the failure ` + "are shown; the task may still be running — re-run to read the rest.", collected, budgetMs);
+}
+function logPageRetry(attempt2, failureClass, error2, budgetMs, elapsedMs, delayCapMs) {
+  logRetryEvent3({
+    event: "retry_attempt",
+    layer: "http",
+    op: "task_logs_page",
+    attempt: attempt2,
+    class: failureClass,
+    status: error2 instanceof ApiError ? error2.status ?? null : null,
+    elapsed_ms: elapsedMs,
+    budget_ms: budgetMs,
+    error: error2 instanceof Error ? error2.name : String(error2),
+    delay_ms: delayCapMs
+  });
+}
 function eventTimestamp(event) {
   return event.ended_at || event.ts;
 }
@@ -89687,7 +92238,7 @@ function oneLine2(value3) {
 }
 
 // src/cli/task-input.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 function errorCode(error2) {
   if (!(error2 instanceof ApiError) || !error2.body || typeof error2.body !== "object")
     return;
@@ -89751,7 +92302,7 @@ function onInterrupt(handler) {
 async function runTaskSend(taskId, message3, options = {}) {
   if (!message3.trim())
     throw new Error("The follow-up message must not be blank.");
-  const inputId = options.inputId?.trim().toLowerCase() ?? randomUUID5();
+  const inputId = options.inputId?.trim().toLowerCase() ?? randomUUID6();
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(inputId)) {
     throw new Error("--input-id must be a UUID.");
   }
@@ -90689,6 +93240,11 @@ async function build(ctx) {
         signal: stop.signal,
         retryRead: isTransientReadError
       });
+      if (settled.kind === "unreachable") {
+        console.error(waitUnreachableNotice(`Conversation ${taskId}'s status`, `check with \`brainbase task get ${taskId}\``, settled.budgetMs));
+        finish({ version_id: null, build_id: null, status: "task_unsettled", task_status: settled.task?.status ?? null }, EX_TEMPFAIL_EXIT_CODE);
+        return;
+      }
       if (settled.kind !== "terminal") {
         const interrupted = settled.kind === "interrupted";
         const status2 = settled.task?.status ?? null;
@@ -95254,494 +97810,6 @@ var import_picocolors85 = __toESM(require_picocolors(), 1);
 import fs93 from "node:fs";
 import path104 from "node:path";
 
-// src/core/benchmark-api.ts
-var DEFAULT_BENCHMARK_REQUEST_TIMEOUT_MS = 30000;
-var BENCHMARK_UPLOAD_PROCESSING_ALLOWANCE_MS = 30000;
-var BENCHMARK_UPLOAD_MIN_BYTES_PER_SECOND = 256 * 1024;
-
-class BenchmarkClientUsageError extends Error {
-  code = "invalid_arguments";
-  retryable = false;
-  constructor(message3) {
-    super(message3);
-    this.name = "BenchmarkClientUsageError";
-  }
-}
-
-class BenchmarkApiError extends ApiError {
-  code;
-  requestId;
-  retryable;
-  constructor(message3, status, body, code, requestId, retryable) {
-    super(message3, status, body);
-    this.code = code;
-    this.requestId = requestId;
-    this.name = "BenchmarkApiError";
-    this.retryable = retryable ?? (status === undefined || status === 408 || status === 425 || status === 429 || status !== undefined && status >= 500);
-  }
-}
-function safeCode(body) {
-  if (!body || typeof body !== "object")
-    return;
-  const object4 = body;
-  const nested = object4.error && typeof object4.error === "object" ? object4.error.code : object4.detail && typeof object4.detail === "object" ? object4.detail.code : undefined;
-  const code = object4.code ?? nested;
-  return typeof code === "string" && /^[a-z][a-z0-9_]{0,99}$/.test(code) ? code : undefined;
-}
-function queryString(query) {
-  if (!query)
-    return "";
-  const params = new URLSearchParams;
-  for (const key2 of Object.keys(query).sort()) {
-    const value3 = query[key2];
-    if (value3 === undefined)
-      continue;
-    for (const item of Array.isArray(value3) ? value3 : [value3]) {
-      params.append(key2, String(item));
-    }
-  }
-  const encoded = params.toString();
-  return encoded ? `?${encoded}` : "";
-}
-function filenameFromHeaders(headers) {
-  const disposition = headers.get("Content-Disposition");
-  if (!disposition)
-    return null;
-  const utf8 = disposition.match(/filename\*=UTF-8''([^;]+)/i)?.[1];
-  if (utf8) {
-    try {
-      return decodeURIComponent(utf8);
-    } catch {
-      return utf8;
-    }
-  }
-  return disposition.match(/filename="?([^";]+)"?/i)?.[1] ?? null;
-}
-function uploadBlob(upload) {
-  if (upload.data instanceof Blob)
-    return upload.data;
-  return new Blob([upload.data], {
-    type: upload.contentType ?? "application/octet-stream"
-  });
-}
-function requestAbortContext(callerSignal, timeoutMs3) {
-  const controller = new AbortController;
-  let source;
-  const abortFromCaller = () => {
-    if (source !== undefined)
-      return;
-    source = "caller";
-    controller.abort(callerSignal?.reason);
-  };
-  if (callerSignal?.aborted) {
-    abortFromCaller();
-  } else {
-    callerSignal?.addEventListener("abort", abortFromCaller, { once: true });
-  }
-  const timer = setTimeout(() => {
-    if (source !== undefined)
-      return;
-    source = "timeout";
-    controller.abort(new DOMException(`Benchmark request timed out after ${timeoutMs3} ms`, "TimeoutError"));
-  }, timeoutMs3);
-  timer.unref?.();
-  return {
-    signal: controller.signal,
-    source: () => source,
-    dispose: () => {
-      clearTimeout(timer);
-      callerSignal?.removeEventListener("abort", abortFromCaller);
-    }
-  };
-}
-function callerAbortError(signal) {
-  return signal?.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted", "AbortError");
-}
-function idempotencyHeaders(key2) {
-  const headers = new Headers;
-  if (key2 === undefined)
-    return headers;
-  if (key2.length < 8 || key2.length > 200 || /[^\x21-\x7e]/.test(key2)) {
-    throw new BenchmarkClientUsageError("Idempotency keys must be 8-200 visible ASCII characters");
-  }
-  headers.set("Idempotency-Key", key2);
-  return headers;
-}
-
-class BenchmarkApiClient {
-  agentId;
-  fixedBaseUrl;
-  fetchImpl;
-  credentialResolver;
-  authRetry;
-  requestTimeoutMs;
-  uploadTimeoutMs;
-  constructor(options) {
-    this.agentId = options.agentId;
-    this.fixedBaseUrl = options.baseUrl?.replace(/\/+$/, "");
-    this.fetchImpl = options.fetch ?? globalThis.fetch;
-    this.credentialResolver = options.resolveCredential ?? (async () => await resolveCredential());
-    this.authRetry = options.authRetry ?? sendWithAuthRetry;
-    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_BENCHMARK_REQUEST_TIMEOUT_MS;
-    if (!Number.isSafeInteger(this.requestTimeoutMs) || this.requestTimeoutMs < 1) {
-      throw new BenchmarkClientUsageError("Benchmark request timeout must be a positive safe integer");
-    }
-    this.uploadTimeoutMs = options.uploadTimeoutMs;
-    if (this.uploadTimeoutMs !== undefined && (!Number.isSafeInteger(this.uploadTimeoutMs) || this.uploadTimeoutMs < 1)) {
-      throw new BenchmarkClientUsageError("Benchmark upload timeout must be a positive safe integer");
-    }
-  }
-  root(session) {
-    const base2 = this.fixedBaseUrl ?? masControlPlaneBaseUrl(session);
-    return `${base2}/v2/agents/${encodeURIComponent(this.agentId)}/benchmarks`;
-  }
-  async request(pathname, options = {}) {
-    const credential = await this.credentialResolver();
-    let session = credential.session;
-    const headers = new Headers(options.headers);
-    const idempotency = idempotencyHeaders(options.idempotencyKey);
-    idempotency.forEach((value3, key2) => headers.set(key2, value3));
-    if (!headers.has("Accept")) {
-      headers.set("Accept", options.mode === "binary" ? "application/octet-stream, application/gzip, application/zip, application/yaml, application/json" : "application/json");
-    }
-    let body = options.body;
-    if (body !== undefined && !(body instanceof FormData) && !(body instanceof Blob) && !(body instanceof ArrayBuffer) && !(body instanceof Uint8Array) && typeof body !== "string") {
-      body = stableJsonStringify(body);
-      if (!headers.has("Content-Type")) {
-        headers.set("Content-Type", "application/json");
-      }
-    }
-    const method2 = (options.method ?? "GET").toUpperCase();
-    const timeoutMs3 = options.timeoutMs ?? this.requestTimeoutMs;
-    const abort = requestAbortContext(options.signal, timeoutMs3);
-    const send = async (refreshed) => {
-      if (refreshed)
-        session = refreshed;
-      const requestHeaders = new Headers(headers);
-      requestHeaders.set("Authorization", `Bearer ${session?.access_token ?? credential.bearer}`);
-      return await this.fetchImpl(`${this.root(session)}${pathname}${queryString(options.query)}`, { method: method2, headers: requestHeaders, body, signal: abort.signal });
-    };
-    try {
-      let response;
-      try {
-        response = await this.authRetry(credential.source === "session" ? session : null, send);
-      } catch (error2) {
-        if (abort.source() === "caller") {
-          throw callerAbortError(options.signal);
-        }
-        if (abort.source() === "timeout") {
-          throw new BenchmarkApiError(`Benchmark request timed out after ${timeoutMs3} ms`, 408, null, "request_timeout");
-        }
-        throw new BenchmarkApiError(redactSensitiveText(`Network error: ${error2 instanceof Error ? error2.message : String(error2)}`), undefined, null, "network_error");
-      }
-      if (!response.ok) {
-        const text5 = await response.text();
-        let responseBody = text5;
-        try {
-          responseBody = text5 ? JSON.parse(text5) : null;
-        } catch {}
-        throw new BenchmarkApiError(redactSensitiveText(masApiErrorMessage(responseBody, response.status)), response.status, responseBody, safeCode(responseBody), response.headers.get("x-request-id") ?? response.headers.get("x-correlation-id") ?? undefined);
-      }
-      if (options.mode === "binary") {
-        return {
-          bytes: new Uint8Array(await response.arrayBuffer()),
-          contentType: response.headers.get("Content-Type"),
-          filename: filenameFromHeaders(response.headers)
-        };
-      }
-      if (response.status === 204)
-        return;
-      const text4 = await response.text();
-      if (!text4)
-        return null;
-      try {
-        return JSON.parse(text4);
-      } catch {
-        throw new BenchmarkApiError("Benchmark API returned an invalid JSON response", response.status, null, "invalid_response", response.headers.get("x-request-id") ?? response.headers.get("x-correlation-id") ?? undefined, false);
-      }
-    } catch (error2) {
-      if (abort.source() === "caller") {
-        throw callerAbortError(options.signal);
-      }
-      if (abort.source() === "timeout") {
-        throw new BenchmarkApiError(`Benchmark request timed out after ${timeoutMs3} ms`, 408, null, "request_timeout");
-      }
-      throw error2;
-    } finally {
-      abort.dispose();
-    }
-  }
-  validateManifest(manifest) {
-    return this.request("/validate", {
-      method: "POST",
-      body: { manifest }
-    });
-  }
-  createBenchmark(manifest, options) {
-    return this.request("", {
-      method: "POST",
-      body: { manifest },
-      ...options
-    });
-  }
-  listBenchmarks(query = {}) {
-    return this.request("", {
-      query: {
-        limit: query.limit,
-        cursor: query.cursor,
-        archived: query.archived
-      }
-    });
-  }
-  getBenchmark(benchmarkId) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}`);
-  }
-  updateBenchmark(benchmarkId, input) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}`, {
-      method: "PATCH",
-      body: input
-    });
-  }
-  archiveBenchmark(benchmarkId, expectedVersion) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/archive`, {
-      method: "POST",
-      body: { expected_version: expectedVersion }
-    });
-  }
-  restoreBenchmark(benchmarkId, expectedVersion) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/restore`, {
-      method: "POST",
-      body: { expected_version: expectedVersion }
-    });
-  }
-  async purgeBenchmark(benchmarkId, input) {
-    await this.request(`/${encodeURIComponent(benchmarkId)}/purge`, {
-      method: "POST",
-      body: input
-    });
-  }
-  createRevision(benchmarkId, expectedVersion, options) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/revisions`, {
-      method: "POST",
-      body: { expected_version: expectedVersion },
-      ...options
-    });
-  }
-  listRevisions(benchmarkId, query = {}) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/revisions`, {
-      query: {
-        limit: query.limit,
-        before_revision_number: query.beforeRevisionNumber
-      }
-    });
-  }
-  exportManifest(benchmarkId, format3, revisionId) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/export`, {
-      mode: "binary",
-      query: { format: format3, revision_id: revisionId }
-    });
-  }
-  exportBundle(benchmarkId, revisionId) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/export`, {
-      mode: "binary",
-      query: { format: "bundle", revision_id: revisionId }
-    });
-  }
-  signBenchmarkObject(benchmarkId, objectId, query = {}) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/objects/${encodeURIComponent(objectId)}/signed-url`, {
-      query: {
-        expires_in_seconds: query.expiresInSeconds,
-        download_name: query.downloadName
-      }
-    });
-  }
-  upload(pathname, upload, fields, options) {
-    const form = new FormData;
-    const blob = uploadBlob(upload);
-    form.append("file", blob, upload.filename);
-    for (const [key2, value3] of Object.entries(fields)) {
-      if (value3 !== undefined)
-        form.append(key2, value3);
-    }
-    const scaledTimeoutMs = BENCHMARK_UPLOAD_PROCESSING_ALLOWANCE_MS + Math.ceil(blob.size / BENCHMARK_UPLOAD_MIN_BYTES_PER_SECOND * 1000);
-    return this.request(pathname, {
-      method: "POST",
-      body: form,
-      timeoutMs: this.uploadTimeoutMs ?? Math.max(this.requestTimeoutMs, scaledTimeoutMs),
-      ...options
-    });
-  }
-  importManifest(upload, options) {
-    return this.upload("/imports/manifest", upload, {}, options);
-  }
-  importCsv(upload, fields, options) {
-    return this.upload("/imports/csv", upload, {
-      mapping_json: stableJsonStringify(fields.mapping),
-      metadata_json: stableJsonStringify(fields.metadata),
-      environment_json: fields.environment === undefined ? undefined : stableJsonStringify(fields.environment),
-      evaluators_json: fields.evaluators === undefined ? undefined : stableJsonStringify(fields.evaluators),
-      primary_evaluator_key: fields.primaryEvaluatorKey
-    }, options);
-  }
-  importBundle(upload, options) {
-    return this.upload("/imports/bundle", upload, {}, options);
-  }
-  previewTaskImport(input) {
-    return this.request("/imports/task/preview", {
-      method: "POST",
-      body: input
-    });
-  }
-  materializeTaskImport(input) {
-    return this.request("/imports/task/materialize", {
-      method: "POST",
-      body: input
-    });
-  }
-  previewHuggingFaceImport(input) {
-    return this.request("/imports/hugging-face/preview", {
-      method: "POST",
-      body: input
-    });
-  }
-  materializeHuggingFaceImport(input, options) {
-    return this.request("/imports/hugging-face/materialize", {
-      method: "POST",
-      body: input,
-      ...options
-    });
-  }
-  createRunPlan(benchmarkId, input, options) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/runs/plan`, {
-      method: "POST",
-      body: input,
-      ...options
-    });
-  }
-  getRunPlan(planId) {
-    return this.request(`/run-plans/${encodeURIComponent(planId)}`);
-  }
-  confirmRunPlan(planId) {
-    return this.request(`/run-plans/${encodeURIComponent(planId)}/confirm`, {
-      method: "POST"
-    });
-  }
-  confirmRun(runId) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/confirm`, {
-      method: "POST"
-    });
-  }
-  listRuns(query = {}) {
-    return this.request("/runs", {
-      query: {
-        benchmark_id: query.benchmarkId,
-        status: query.status,
-        limit: query.limit,
-        cursor: query.cursor
-      }
-    });
-  }
-  getRun(runId, options = {}) {
-    return this.request(`/runs/${encodeURIComponent(runId)}`, options);
-  }
-  updateRunAnnotation(runId, input) {
-    return this.request(`/runs/${encodeURIComponent(runId)}`, {
-      method: "PATCH",
-      body: input
-    });
-  }
-  cancelRun(runId) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/cancel`, {
-      method: "POST"
-    });
-  }
-  resumeRun(runId) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/resume`, {
-      method: "POST"
-    });
-  }
-  listDiagnoses(runId, query = {}) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/diagnoses`, {
-      query: {
-        limit: query.limit,
-        cursor: query.cursor
-      }
-    });
-  }
-  getRunResults(runId, baselineTargetId) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/results`, {
-      query: { baseline_target_id: baselineTargetId }
-    });
-  }
-  exportRunResults(runId, query = {}) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/results/export`, {
-      mode: "binary",
-      query: {
-        include_billing_receipts: query.includeBillingReceipts || undefined
-      }
-    });
-  }
-  listTrials(runId, query = {}) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/trials`, {
-      query: {
-        status: query.status,
-        limit: query.limit,
-        cursor: query.cursor
-      }
-    });
-  }
-  listAttempts(runId, query = {}) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/attempts`, {
-      query: {
-        trial_id: query.trialId,
-        status: query.status,
-        limit: query.limit,
-        cursor: query.cursor
-      }
-    });
-  }
-  getAttempt(runId, attemptId, query = {}) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/attempts/${encodeURIComponent(attemptId)}`, {
-      query: {
-        evaluator_limit: query.evaluatorLimit,
-        evaluator_cursor: query.evaluatorCursor,
-        artifact_limit: query.artifactLimit,
-        artifact_cursor: query.artifactCursor
-      }
-    });
-  }
-  signAttemptArtifact(runId, attemptId, artifactId, query = {}) {
-    return this.request(`/runs/${encodeURIComponent(runId)}/attempts/${encodeURIComponent(attemptId)}/artifacts/${encodeURIComponent(artifactId)}/signed-url`, {
-      query: {
-        expires_in_seconds: query.expiresInSeconds,
-        download_name: query.downloadName
-      }
-    });
-  }
-  getSummaries(benchmarkIds, historyLimit) {
-    return this.request("/analytics/summaries", {
-      query: {
-        benchmark_id: benchmarkIds,
-        history_limit: historyLimit
-      }
-    });
-  }
-  getAnalytics(benchmarkId, historyLimit) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/analytics`, {
-      query: { history_limit: historyLimit }
-    });
-  }
-  setBaseline(benchmarkId, targetKey, baselineTargetId) {
-    return this.request(`/${encodeURIComponent(benchmarkId)}/baselines/${encodeURIComponent(targetKey)}`, {
-      method: "PUT",
-      body: { baseline_target_id: baselineTargetId }
-    });
-  }
-  async clearBaseline(benchmarkId, targetKey) {
-    await this.request(`/${encodeURIComponent(benchmarkId)}/baselines/${encodeURIComponent(targetKey)}`, { method: "DELETE" });
-  }
-}
-
 // src/core/benchmark-authoring.ts
 var import_yaml9 = __toESM(require_dist(), 1);
 import crypto8 from "node:crypto";
@@ -98075,6 +100143,9 @@ class BenchmarkControlOutput {
     this.result({ items: [...page.items] }, all ? undefined : page.next_cursor);
   }
   error(error2) {
+    if (debugOutputEnabled())
+      this.writer.stderr(`${formatErrorCauseChain(error2)}
+`);
     if (this.mode.json || this.mode.jsonl) {
       const encoded = this.mode.jsonl ? formatJsonLine : formatJson;
       this.writer.stderr(encoded(automationErrorEnvelope(this.command, error2)));
@@ -98708,7 +100779,7 @@ async function runPlan(cwd2, argv, deps) {
   const input = runPlanInput(options, requiredOption(options.parsed, "revision"));
   const { client, output } = context(cwd2, "benchmark run plan", options, deps);
   output.result(json4(await client.createRunPlan(benchmarkId, input, {
-    idempotencyKey: idempotencyKey(options)
+    idempotencyKey: runPlanIdempotencyKey(idempotencyKey(options))
   })));
 }
 async function runStart(cwd2, argv, deps) {
@@ -98739,14 +100810,73 @@ async function watchRun(client, output, runId, interval, agentId, deps) {
   deps.addSigintListener(onInterrupt2);
   let previous = "";
   let latest = {};
+  const retry = httpRetryEnabled();
+  const downtimeBudgetMs = deps.watchDowntimeBudgetMs ?? DEFAULT_RETRY_BUDGET_MS;
+  let downtime;
+  let downtimeTimer;
+  let lastPollError;
+  let downtimeExpired = false;
+  let failedPolls = 0;
+  const now2 = deps.now ?? Date.now;
+  let outageStartedAt = now2();
+  const telemetry = (event, error2, delayMs) => pollRetryTelemetry(event, "benchmark_run_watch", error2, failedPolls, outageStartedAt, downtimeBudgetMs, delayMs, now2());
+  const unreachable = () => {
+    logWaitRetryEvent(telemetry("retry_exhausted", lastPollError));
+    deps.writer.stderr(`${waitUnreachableNotice(`The benchmark run's status (run ${runId})`, `check with \`brainbase benchmark run show ${runId}${agentId ? ` --agent ${agentId}` : ""}\``, downtimeBudgetMs)}
+`);
+    deps.setExitCode(EX_TEMPFAIL_EXIT_CODE);
+    return { run: latest, interrupted: false, unreachable: true };
+  };
   try {
     while (!interrupted) {
+      if (downtime && downtime.remainingMs(now2()) === 0)
+        return unreachable();
+      const pollStartedAt = now2();
       try {
-        latest = await client.getRun(runId, { signal: controller.signal });
+        if (retry) {
+          const polled = await raceAbort(client.getRun(runId, { signal: controller.signal }), controller.signal);
+          if (polled.kind === "aborted") {
+            if (downtimeExpired)
+              return unreachable();
+            break;
+          }
+          if (polled.kind === "failed")
+            throw polled.error;
+          latest = polled.value;
+        } else {
+          latest = await client.getRun(runId, { signal: controller.signal });
+        }
+        if (downtimeExpired)
+          return unreachable();
+        downtime = undefined;
+        if (downtimeTimer !== undefined)
+          clearTimeout(downtimeTimer);
+        downtimeTimer = undefined;
+        failedPolls = 0;
       } catch (error2) {
         if (interrupted)
           break;
-        throw error2;
+        if (downtimeExpired)
+          return unreachable();
+        if (!retry || !isRetryablePollError(error2))
+          throw error2;
+        lastPollError = error2;
+        if (!downtime) {
+          outageStartedAt = pollStartedAt;
+          downtime = createRetryBudget(downtimeBudgetMs, outageStartedAt);
+          downtimeTimer = setTimeout(() => {
+            downtimeExpired = true;
+            controller.abort();
+          }, downtime.remainingMs(now2()));
+        }
+        failedPolls += 1;
+        const delayMs = retryDelayMs(failedPolls - 1, downtime, retryAfterHeaderOf(error2), { maxMs: Math.min(STREAM_RETRY_MAX_DELAY_MS, Math.max(0, downtime.remainingMs(now2()) - 1)) }, now2());
+        if (delayMs === null) {
+          return unreachable();
+        }
+        logWaitRetryEvent(telemetry("retry_attempt", error2, delayMs));
+        await deps.sleep(delayMs, controller.signal);
+        continue;
       }
       const digest2 = output.digest(latest);
       if (digest2 !== previous) {
@@ -98769,6 +100899,8 @@ async function watchRun(client, output, runId, interval, agentId, deps) {
       await deps.sleep(interval, controller.signal);
     }
   } finally {
+    if (downtimeTimer !== undefined)
+      clearTimeout(downtimeTimer);
     deps.removeSigintListener(onInterrupt2);
   }
   output.event("watch.interrupted", { run_id: runId });
@@ -98786,7 +100918,8 @@ async function runWatch(cwd2, argv, deps) {
   if (options.json) {
     output.result({
       run: watched.run,
-      interrupted: watched.interrupted
+      interrupted: watched.interrupted,
+      ...watched.unreachable ? { unreachable: true } : {}
     });
   }
 }
@@ -98875,7 +101008,8 @@ async function runOneShot(cwd2, argv, deps) {
     output.result({
       plan,
       run: watched.run,
-      interrupted: watched.interrupted
+      interrupted: watched.interrupted,
+      ...watched.unreachable ? { unreachable: true } : {}
     });
   }
 }
@@ -99732,7 +101866,7 @@ async function replaceAgentKey(credential) {
   writeJsonAtomic(decideKeysFile(), cache3);
   return mintAgentKey(credential.base, credential.agentId);
 }
-function retryDelayMs(attempt2, retryAfter) {
+function retryDelayMs2(attempt2, retryAfter) {
   const seconds = retryAfter === null ? Number.NaN : Number(retryAfter);
   const base2 = Number.isFinite(seconds) ? seconds * 1000 : 1000 * 2 ** attempt2;
   return Math.min(Math.max(base2, 0), MAX_RETRY_DELAY_MS) + Math.random() * 500;
@@ -99747,7 +101881,7 @@ function errorMessage3(status, text4) {
   return `HTTP ${status}`;
 }
 async function postDecide(credential, body, options = {}) {
-  const sleep3 = options.sleep ?? ((ms2) => new Promise((resolve) => setTimeout(resolve, ms2)));
+  const sleep4 = options.sleep ?? ((ms2) => new Promise((resolve) => setTimeout(resolve, ms2)));
   const payload = JSON.stringify(body);
   let failure = new DecideHttpError("The decide request failed", null);
   for (let attempt2 = 0;attempt2 < ATTEMPTS; attempt2 += 1) {
@@ -99780,7 +101914,7 @@ async function postDecide(credential, body, options = {}) {
       failure = new DecideHttpError(`Network error: ${error2.message}`, null);
     }
     if (attempt2 + 1 < ATTEMPTS)
-      await sleep3(retryDelayMs(attempt2, retryAfter));
+      await sleep4(retryDelayMs2(attempt2, retryAfter));
   }
   throw failure;
 }
@@ -100176,7 +102310,8 @@ Questions:
   --model <slug>            jev, kev-4b, clef, clef-flash, gpt-6-luna, reflex,
                             joey-1, d1.1, mammoth-1, elephant-1, drex-max,
                             pplx-decider-flash-v1.2, pplx-decider-v1.2,
-                            d1-ultra, jev-1.14 or classify-1
+                            d1-ultra, jev-1.14, classify-1,
+                            microsoft-decision-1, clef-omni or d1
                             (default: the server's default)
   --min-confidence <0-1>    mark answers below this confidence as uncertain
 
@@ -100742,6 +102877,8 @@ function help() {
   out.push("");
   out.push(`  ${import_picocolors86.default.dim("BRAINBASE_HOME")}         override the local config dir (default ~/.brainbase)`);
   out.push(`  ${import_picocolors86.default.dim("BRAINBASE_DEBUG")}        print full stack traces on error (any value; unset to disable)`);
+  if (httpRetryEnabled())
+    out.push(`  ${import_picocolors86.default.dim("--debug")}               print stack traces and the full error cause chain`);
   out.push(`  ${import_picocolors86.default.dim("BRAINBASE_WEB_URL")}      override the web app URL used by login, console links and integrations`);
   out.push(`  ${import_picocolors86.default.dim("BRAINBASE_CONTROL_PLANE_URL")} override the MAS host (/v2/cli; task and interface commands use /v2/tasks and /v2/interfaces)`);
   out.push(`  ${import_picocolors86.default.dim("BRAINBASE_API_URL")}      legacy KLS host override (uses /api/cli; proxy/registry fallback)`);
@@ -100931,6 +103068,13 @@ async function requireAuth(cmd) {
 }
 async function main() {
   const argv = process14.argv.slice(2);
+  const separator = argv.indexOf("--");
+  const debugIndex = argv.findIndex((arg, index) => arg === "--debug" && !isValueOfPriorFlag2(argv, index) && (separator < 0 || index < separator));
+  const debug = httpRetryEnabled() && argv[0] !== "run" && debugIndex >= 0;
+  if (debug) {
+    argv.splice(debugIndex, 1);
+    enableDebugOutput();
+  }
   const cmd = argv.shift();
   const rawCwd = process14.cwd();
   const cwd2 = (() => {
@@ -101220,8 +103364,9 @@ ${message3}`));
     if (err instanceof ApiError && err.status === 401 && !err.message.includes("brainbase login")) {
       console.error(`  Run ${import_picocolors86.default.cyan("brainbase login")} to connect this device.`);
     }
-    if (process14.env.BRAINBASE_DEBUG)
-      console.error(err.stack);
+    if (debug || process14.env.BRAINBASE_DEBUG) {
+      console.error(debug || httpRetryEnabled() ? formatErrorCauseChain(err) : err.stack);
+    }
     process14.exit(1);
   }
 }