@evalops/maestro 0.10.10 → 0.10.12

package/dist/cli.js

@@ -36841,6 +36841,10 @@ import { dirname as dirname20, join as join33 } from "node:path";
 import { realpathSync as realpathSync5 } from "node:fs";
 import { isAbsolute as isAbsolute8, relative as relative3, resolve as resolve21, sep as sep5 } from "node:path";
 import { minimatch as minimatch6 } from "minimatch";
+import { createRequire as createRequire4 } from "node:module";
+import { hostname } from "node:os";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { z } from "zod";
 import { readFileSync as readFileSync30, statSync as statSync13 } from "node:fs";
 import { join as join34, resolve as resolve22 } from "node:path";
@@ -36849,10 +36853,10 @@ import { resolve as resolve23 } from "node:path";
 import { execFile } from "node:child_process";
 import { EventEmitter as EventEmitter4 } from "node:events";
 import { promisify as promisify2 } from "node:util";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import {
   ElicitRequestSchema,
   LoggingMessageNotificationSchema,
@@ -36999,7 +37003,7 @@ import {
   existsSync as existsSync56,
   writeFileSync as writeFileSync20
 } from "node:fs";
-import { createRequire as createRequire4 } from "node:module";
+import { createRequire as createRequire5 } from "node:module";
 import { basename as basename11 } from "node:path";
 import { createInterface } from "node:readline";
 import { existsSync as existsSync57, mkdirSync as mkdirSync22, writeFileSync as writeFileSync21 } from "node:fs";
@@ -37086,7 +37090,6 @@ import {
   writeFileSync as writeFileSync23
 } from "node:fs";
 import { dirname as dirname34 } from "node:path";
-import { createRequire as createRequire5 } from "node:module";
 import { Spacer as Spacer24, Text as Text25 } from "@evalops/tui";
 import chalk34 from "chalk";
 import { Spacer as Spacer25, Text as Text26 } from "@evalops/tui";
@@ -37570,12 +37573,13 @@ import {
 import { URL as URL2 } from "node:url";
 import chalk61 from "chalk";
 import chalk62 from "chalk";
-import { createInterface as createInterface2 } from "node:readline/promises";
 import chalk63 from "chalk";
+import { createInterface as createInterface2 } from "node:readline/promises";
 import chalk64 from "chalk";
-import { resolve as resolve59 } from "node:path";
 import chalk65 from "chalk";
+import { resolve as resolve59 } from "node:path";
 import chalk66 from "chalk";
+import chalk67 from "chalk";
 import { clearLine, cursorTo } from "node:readline";
 import { createInterface as createInterface3 } from "node:readline/promises";
 import {
@@ -37584,17 +37588,17 @@ import {
   assertHeadlessRuntimeSubscriptionSnapshot as assertHeadlessRuntimeSubscriptionSnapshot2,
   headlessProtocolVersion as headlessProtocolVersion2
 } from "@evalops/contracts";
-import chalk67 from "chalk";
+import chalk68 from "chalk";
 import { randomUUID as randomUUID17 } from "node:crypto";
 import { headlessProtocolVersion as headlessProtocolVersion3 } from "@evalops/contracts";
-import chalk68 from "chalk";
+import chalk69 from "chalk";
 import { stdin, stdout } from "node:process";
 import { createInterface as createInterface4 } from "node:readline/promises";
-import chalk69 from "chalk";
 import chalk70 from "chalk";
 import chalk71 from "chalk";
 import chalk72 from "chalk";
 import chalk73 from "chalk";
+import chalk74 from "chalk";
 import { exec as exec3 } from "node:child_process";
 import { randomUUID as randomUUID18 } from "node:crypto";
 import { promisify as promisify6 } from "node:util";
@@ -37623,12 +37627,12 @@ import { spawn as spawn20 } from "node:child_process";
 import { existsSync as existsSync106, readFileSync as readFileSync78 } from "node:fs";
 import { join as join85, resolve as resolve60 } from "node:path";
 import { Type as Type46 } from "@sinclair/typebox";
-import chalk74 from "chalk";
 import chalk75 from "chalk";
 import chalk76 from "chalk";
 import chalk77 from "chalk";
-import { createRequire as createRequire7 } from "node:module";
 import chalk78 from "chalk";
+import { createRequire as createRequire7 } from "node:module";
+import chalk79 from "chalk";
 var __defProp2 = Object.defineProperty;
 var __getOwnPropNames2 = Object.getOwnPropertyNames;
 var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
@@ -48365,6 +48369,7 @@ function assertEvalOpsManagedGatewayEnabled() {
   }
   throw new Error("EvalOps managed gateway access is currently disabled by dynamic config.");
 }
+var DEFAULT_EVALOPS_MANAGED_GATEWAY_BASE_URL = "https://llm-gateway.evalops.dev/v1";
 var ALL_EVALOPS_MANAGED_PROVIDER_DEFINITIONS;
 var managedProvidersByID;
 var init_evalops_managed = __esm2(() => {
@@ -49288,6 +49293,7 @@ var init_core_services = __esm2(() => {
   };
   PLATFORM_HTTP_ROUTES = {
     identity: {
+      apiKeys: "/v1/api-keys",
       authGoogleStart: "/v1/auth/google/start",
       deviceChallenges: "/v1/device-challenges",
       devices: "/v1/devices",
@@ -51189,7 +51195,8 @@ async function loginEvalOps(onAuthUrl, onStatus) {
     const result = await Promise.race([
       getResult(),
       new Promise((_, reject) => {
-        setTimeout(() => reject(new Error("EvalOps login timed out after 5 minutes")), 5 * 60 * 1e3);
+        const timeout = setTimeout(() => reject(new Error("EvalOps login timed out after 5 minutes")), 5 * 60 * 1e3);
+        timeout.unref?.();
       })
     ]);
     const deviceId = await enrollDesktopDeviceIdentity(identityBaseUrl, result.accessToken, process.env.npm_package_version);
@@ -51281,7 +51288,7 @@ var CALLBACK_PORT = 1460;
 var CALLBACK_PATH = "/auth/callback/evalops";
 var CALLBACK_ORIGIN;
 var CALLBACK_URI;
-var DEFAULT_IDENTITY_URL = "http://127.0.0.1:8080";
+var DEFAULT_IDENTITY_URL = "https://identity.evalops.dev";
 var IDENTITY_BASE_URL_ENV_VARS;
 var SHARED_PLATFORM_BASE_URL_ENV_VARS;
 var DEFAULT_PROVIDER_REF_PROVIDER = "openai";
@@ -53647,8 +53654,8 @@ function isPrivateIP(ip) {
   }
   return false;
 }
-function isLocalhostAlias(hostname) {
-  const lower2 = hostname.toLowerCase();
+function isLocalhostAlias(hostname2) {
+  const lower2 = hostname2.toLowerCase();
   return lower2 === "localhost" || lower2 === "localhost.localdomain" || lower2 === "0.0.0.0";
 }
 function extractUrlsFromValue(value) {
@@ -58830,8 +58837,8 @@ function isLocalBaseUrl(url) {
   }
   try {
     const parsed = new URL(url);
-    const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
-    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "0.0.0.0";
+    const hostname2 = parsed.hostname.replace(/^\[|\]$/g, "");
+    return hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1" || hostname2 === "0.0.0.0";
   } catch {
     return false;
   }
@@ -70078,7 +70085,7 @@ var init_models_generated = __esm2(() => {
 });
 function getManagedGatewayBaseUrl() {
   const configured2 = process.env.MAESTRO_LLM_GATEWAY_URL?.trim();
-  return configured2 || DEFAULT_MANAGED_GATEWAY_BASE_URL;
+  return configured2 || DEFAULT_EVALOPS_MANAGED_GATEWAY_BASE_URL;
 }
 function getManagedGatewayBaseUrlForApi(api) {
   const managedBaseUrl = getManagedGatewayBaseUrl();
@@ -70196,7 +70203,6 @@ function getProviders() {
 function getModels(provider) {
   return getBuiltinModels()[provider] || [];
 }
-var DEFAULT_MANAGED_GATEWAY_BASE_URL = "http://127.0.0.1:8081/v1";
 var ANTHROPIC_OPUS_46_OVERLAY;
 var OPENROUTER_RESPONSES_OVERLAY;
 var GROQ_RESPONSES_OVERLAY;
@@ -85988,6 +85994,25 @@ function isRecord8(value) {
 function getNonEmptyString(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 }
+function getStringArray2(value) {
+  return Array.isArray(value) ? value.map((entry2) => typeof entry2 === "string" ? entry2.trim() : "").filter((entry2) => entry2.length > 0) : [];
+}
+function isFutureTimestamp(value) {
+  const timestamp3 = getNonEmptyString(value);
+  return !timestamp3 || Date.parse(timestamp3) > Date.now();
+}
+function resolveEvalOpsAgentMcpAPIKey(metadata) {
+  const agentMcp = isRecord8(metadata?.agentMcp) ? metadata.agentMcp : void 0;
+  const apiKey = getNonEmptyString(agentMcp?.apiKey);
+  if (!apiKey || !isFutureTimestamp(agentMcp?.expiresAt)) {
+    return;
+  }
+  const scopes = getStringArray2(agentMcp?.scopes);
+  if (scopes.length > 0 && !scopes.includes("llm_gateway:invoke")) {
+    return;
+  }
+  return apiKey;
+}
 function resolveEvalOpsOrganizationId(metadata) {
   const candidate = getNonEmptyString(metadata?.organizationId);
   if (candidate && candidate.trim().length > 0) {
@@ -86069,10 +86094,15 @@ function createAuthResolver(options) {
       };
     }
     if (isEvalOpsManagedProvider(provider) && options.mode !== "api-key") {
+      const credentials = loadOAuthCredentials("evalops");
+      const agentAPIKey = resolveEvalOpsAgentMcpAPIKey(credentials?.metadata);
+      if (agentAPIKey) {
+        return buildEvalOpsCredential(provider, agentAPIKey, "evalops_agent_key_file", credentials?.metadata);
+      }
       const oauthToken = await getOAuthToken("evalops");
       if (oauthToken) {
-        const credentials = loadOAuthCredentials("evalops");
-        return buildEvalOpsCredential(provider, oauthToken, "evalops_oauth_file", credentials?.metadata);
+        const refreshedCredentials = loadOAuthCredentials("evalops");
+        return buildEvalOpsCredential(provider, oauthToken, "evalops_oauth_file", refreshedCredentials?.metadata ?? credentials?.metadata);
       }
     }
     if (isOpenAICodexProvider(provider) && options.mode !== "api-key") {
@@ -87024,6 +87054,457 @@ var init_env_limits = __esm2(() => {
     }
   ];
 });
+function loadPackageMetadata() {
+  if (cachedPackageMetadata) {
+    return cachedPackageMetadata;
+  }
+  try {
+    const packageJson4 = createRequire4(import.meta.url)("../package.json");
+    cachedPackageMetadata = packageJson4;
+    return packageJson4;
+  } catch {
+    cachedPackageMetadata = {};
+    return cachedPackageMetadata;
+  }
+}
+function getPackageVersion() {
+  return process.env.MAESTRO_VERSION ?? loadPackageMetadata().version ?? "unknown";
+}
+function getPackageName() {
+  const metadata = loadPackageMetadata();
+  return process.env.MAESTRO_PACKAGE_NAME ?? metadata.name ?? metadata.maestro?.canonicalPackageName ?? "@evalops/maestro";
+}
+function getGlobalInstallCommand(packageManager = "npm", packageName = getPackageName()) {
+  return `${packageManager} install -g ${packageName}`;
+}
+var cachedPackageMetadata = null;
+var init_package_metadata = () => {
+};
+function isRecord9(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function stringArray(value) {
+  if (!Array.isArray(value)) {
+    return;
+  }
+  const values = value.map((entry2) => nonEmptyString(entry2)).filter((entry2) => Boolean(entry2));
+  return values.length > 0 ? values : void 0;
+}
+function positiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
+function getStoredAgentMcpMetadata(credentials) {
+  const metadata = credentials?.metadata;
+  const agentMcp = isRecord9(metadata?.agentMcp) ? metadata.agentMcp : void 0;
+  const apiKey = nonEmptyString(agentMcp?.apiKey);
+  const endpoint = nonEmptyString(agentMcp?.endpoint);
+  const registeredAt = nonEmptyString(agentMcp?.registeredAt);
+  const createdAt = nonEmptyString(agentMcp?.createdAt);
+  const surface = nonEmptyString(agentMcp?.surface);
+  if (!apiKey || !endpoint || !registeredAt || !createdAt || !surface) {
+    return;
+  }
+  return {
+    type: "agent-mcp",
+    apiKey,
+    createdAt,
+    endpoint,
+    registeredAt,
+    surface,
+    agentId: nonEmptyString(agentMcp?.agentId),
+    expiresAt: nonEmptyString(agentMcp?.expiresAt),
+    keyId: nonEmptyString(agentMcp?.keyId),
+    keyName: nonEmptyString(agentMcp?.keyName),
+    keyPrefix: nonEmptyString(agentMcp?.keyPrefix),
+    manifestUrl: nonEmptyString(agentMcp?.manifestUrl),
+    registryVisible: typeof agentMcp?.registryVisible === "boolean" ? agentMcp.registryVisible : void 0,
+    runId: nonEmptyString(agentMcp?.runId),
+    scopes: stringArray(agentMcp?.scopes),
+    sessionExpiresAt: nonEmptyString(agentMcp?.sessionExpiresAt),
+    workspaceId: nonEmptyString(agentMcp?.workspaceId)
+  };
+}
+function getStoredEvalOpsAgentMcpMetadata() {
+  return getStoredAgentMcpMetadata(loadOAuthCredentials("evalops"));
+}
+function normalizeMcpEndpoint(url) {
+  const normalized = normalizeBaseUrl2(url);
+  const parsed = new URL(normalized);
+  if (parsed.pathname === "" || parsed.pathname === "/" || parsed.pathname === AGENT_MCP_MANIFEST_PATH) {
+    parsed.pathname = AGENT_MCP_PATH;
+    parsed.search = "";
+    parsed.hash = "";
+  }
+  return normalizeBaseUrl2(parsed.toString());
+}
+function normalizeManifestUrl(url) {
+  const normalized = normalizeBaseUrl2(url);
+  const parsed = new URL(normalized);
+  if (parsed.pathname === "" || parsed.pathname === "/") {
+    parsed.pathname = AGENT_MCP_MANIFEST_PATH;
+  }
+  return parsed.toString();
+}
+function resolveIdentityBaseUrl(credentials, endpoint) {
+  const configured2 = getEnvValue3([
+    "MAESTRO_IDENTITY_URL",
+    "EVALOPS_IDENTITY_URL",
+    "MAESTRO_PLATFORM_BASE_URL",
+    "MAESTRO_EVALOPS_BASE_URL",
+    "EVALOPS_BASE_URL"
+  ]);
+  const stored = typeof credentials?.metadata?.identityBaseUrl === "string" ? credentials.metadata.identityBaseUrl : void 0;
+  const derived = identityBaseUrlFromMcpEndpoint(endpoint?.endpoint);
+  const storedBeforeDerived = endpoint ? !endpoint.preferDerivedIdentity && isCustomMcpEndpoint(endpoint.endpoint) : false;
+  return normalizeBaseUrl2(configured2 ?? endpoint?.identityBaseUrl ?? (endpoint?.preferDerivedIdentity ? derived : void 0) ?? (storedBeforeDerived ? stored : void 0) ?? derived ?? stored ?? DEFAULT_IDENTITY_BASE_URL, Object.values(PLATFORM_HTTP_ROUTES.identity));
+}
+function isCustomMcpEndpoint(endpoint) {
+  const parsed = new URL(normalizeBaseUrl2(endpoint));
+  return parsed.hostname !== "app.evalops.dev" && parsed.hostname !== "staging.evalops.dev";
+}
+function identityBaseUrlFromMcpEndpoint(endpoint) {
+  if (!endpoint) {
+    return;
+  }
+  const parsed = new URL(normalizeBaseUrl2(endpoint));
+  if (parsed.hostname === "app.evalops.dev") {
+    return DEFAULT_IDENTITY_BASE_URL;
+  }
+  if (parsed.hostname === "staging.evalops.dev") {
+    return "https://api.staging.evalops.dev";
+  }
+  if (parsed.hostname.startsWith("app.")) {
+    parsed.hostname = `identity.${parsed.hostname.slice("app.".length)}`;
+  }
+  parsed.pathname = "";
+  parsed.search = "";
+  parsed.hash = "";
+  return normalizeBaseUrl2(parsed.toString());
+}
+async function resolveEndpointFromManifest(manifestUrl, fetchImpl) {
+  const response = await fetchImpl(manifestUrl, {
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) {
+    throw new Error(`Failed to fetch EvalOps MCP manifest (${response.status} ${response.statusText})`);
+  }
+  const payload = await response.json();
+  const payloadRecord = isRecord9(payload) ? payload : void 0;
+  const protocol = payloadRecord && isRecord9(payloadRecord.protocol) ? payloadRecord.protocol : void 0;
+  const endpoint = nonEmptyString(protocol?.endpoint);
+  if (!endpoint) {
+    throw new Error("EvalOps MCP manifest did not include protocol.endpoint");
+  }
+  const identity = payloadRecord?.identity;
+  const identityBaseUrl = nonEmptyString(isRecord9(identity) ? identity.base_url : void 0) ?? nonEmptyString(isRecord9(identity) ? identity.baseUrl : void 0) ?? nonEmptyString(isRecord9(identity) ? identity.url : void 0) ?? nonEmptyString(payloadRecord?.identity_base_url) ?? nonEmptyString(payloadRecord?.identityBaseUrl);
+  return {
+    endpoint: normalizeMcpEndpoint(endpoint),
+    identityBaseUrl,
+    manifestUrl,
+    preferDerivedIdentity: true
+  };
+}
+async function resolveAgentMcpEndpoint(options, deps) {
+  if (options.mcpUrl) {
+    return {
+      endpoint: normalizeMcpEndpoint(options.mcpUrl),
+      preferDerivedIdentity: true
+    };
+  }
+  if (options.manifestUrl) {
+    return resolveEndpointFromManifest(normalizeManifestUrl(options.manifestUrl), deps.fetch);
+  }
+  const configuredMcpUrl = getEnvValue3([
+    "MAESTRO_PLATFORM_MCP_URL",
+    "MAESTRO_AGENT_MCP_URL",
+    "MAESTRO_EVALOPS_AGENT_MCP_URL"
+  ]);
+  if (configuredMcpUrl) {
+    return {
+      endpoint: normalizeMcpEndpoint(configuredMcpUrl),
+      preferDerivedIdentity: true
+    };
+  }
+  const configuredManifestUrl = getEnvValue3([
+    "MAESTRO_PLATFORM_MCP_MANIFEST_URL",
+    "MAESTRO_AGENT_MCP_MANIFEST_URL",
+    "MAESTRO_EVALOPS_AGENT_MCP_MANIFEST_URL"
+  ]);
+  if (configuredManifestUrl) {
+    return resolveEndpointFromManifest(normalizeManifestUrl(configuredManifestUrl), deps.fetch);
+  }
+  const stored = getStoredAgentMcpMetadata(deps.loadCredentials("evalops"));
+  if (stored?.endpoint) {
+    return {
+      endpoint: normalizeMcpEndpoint(stored.endpoint),
+      manifestUrl: stored.manifestUrl
+    };
+  }
+  return resolveEndpointFromManifest(`${DEFAULT_AGENT_MCP_BASE_URL}${AGENT_MCP_MANIFEST_PATH}`, deps.fetch);
+}
+function createDefaultMcpClient(endpoint, bearerToken) {
+  const client = new Client({
+    name: "maestro",
+    version: getPackageVersion()
+  }, {
+    capabilities: {}
+  });
+  const headers = {
+    accept: "application/json, text/event-stream",
+    "content-type": "application/json",
+    ...bearerToken ? { authorization: `Bearer ${bearerToken}` } : {}
+  };
+  const transport = new StreamableHTTPClientTransport(new URL(endpoint), {
+    requestInit: {
+      headers
+    }
+  });
+  return {
+    callTool: (name, args) => client.callTool({
+      name,
+      arguments: args
+    }),
+    close: () => client.close(),
+    connect: () => client.connect(transport)
+  };
+}
+async function callMcpTool(createClient, endpoint, token, toolName, args) {
+  const client = createClient(endpoint, token);
+  await client.connect();
+  try {
+    const result = await client.callTool(toolName, args);
+    if (result.isError) {
+      throw new Error(`${toolName} returned an MCP error`);
+    }
+    return parseToolOutput(toolName, result);
+  } finally {
+    await client.close().catch(() => {
+      return;
+    });
+  }
+}
+function parseToolOutput(toolName, result) {
+  const structuredContent = isRecord9(result.structuredContent) ? result.structuredContent : void 0;
+  if (structuredContent) {
+    return structuredContent;
+  }
+  const text2 = Array.isArray(result.content) ? result.content.map((entry2) => entry2.type === "text" && typeof entry2.text === "string" ? entry2.text : void 0).find((entry2) => Boolean(entry2)) : void 0;
+  if (text2) {
+    const parsed = JSON.parse(text2);
+    if (isRecord9(parsed)) {
+      return parsed;
+    }
+  }
+  throw new Error(`${toolName} did not return structured JSON output`);
+}
+async function ensureEvalOpsLogin(options, deps) {
+  if (options.forceLogin || !deps.hasOAuthCredentials("evalops")) {
+    deps.onStatus({ message: "Opening EvalOps login" });
+    await deps.login("evalops", {
+      onAuthUrl: deps.onAuthUrl,
+      onStatus: (message) => deps.onStatus({ message })
+    });
+  }
+  let token = await deps.getOAuthToken("evalops");
+  if (!token) {
+    deps.onStatus({ message: "Refreshing EvalOps login" });
+    await deps.login("evalops", {
+      onAuthUrl: deps.onAuthUrl,
+      onStatus: (message) => deps.onStatus({ message })
+    });
+    token = await deps.getOAuthToken("evalops");
+  }
+  if (!token) {
+    throw new Error("EvalOps login did not produce an access token");
+  }
+  return token;
+}
+function buildKeyName(options, now2) {
+  if (options.keyName?.trim()) {
+    return options.keyName.trim();
+  }
+  const host = hostname().replace(/[^a-zA-Z0-9._-]+/gu, "-").slice(0, 48);
+  return `maestro-init-${host || "local"}-${now2.toISOString().slice(0, 10)}`;
+}
+async function createAgentAPIKey(options, identityBaseUrl, oauthToken, fetchImpl, now2) {
+  const expiresInDays = positiveInteger(options.expiresInDays);
+  const expiresAt = expiresInDays ? new Date(now2.getTime() + expiresInDays * 24 * 60 * 60 * 1e3).toISOString() : void 0;
+  const response = await fetchImpl(`${identityBaseUrl}${PLATFORM_HTTP_ROUTES.identity.apiKeys}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${oauthToken}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      name: buildKeyName(options, now2),
+      scopes: options.apiKeyScopes ?? DEFAULT_API_KEY_SCOPES,
+      ...expiresAt ? { expires_at: expiresAt } : {}
+    })
+  });
+  const output = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new Error(typeof output.error === "string" && output.error.trim() ? output.error : `EvalOps API key creation failed (${response.status})`);
+  }
+  const key = isRecord9(output.key) ? output.key : void 0;
+  const normalized = {
+    api_key: nonEmptyString(output.api_key) ?? "",
+    expires_at: nonEmptyString(output.expires_at) ?? nonEmptyString(key?.expires_at),
+    key_id: nonEmptyString(output.key_id) ?? nonEmptyString(key?.id),
+    name: nonEmptyString(output.name) ?? nonEmptyString(key?.name),
+    prefix: nonEmptyString(output.prefix) ?? nonEmptyString(key?.prefix),
+    scopes: stringArray(output.scopes) ?? stringArray(key?.scopes) ?? stringArray(output.scopes_granted)
+  };
+  if (!nonEmptyString(normalized.api_key)) {
+    throw new Error("EvalOps API key creation did not return api_key");
+  }
+  return normalized;
+}
+async function registerAgent(options, endpoint, apiKey, createClient) {
+  const output = await callMcpTool(createClient, endpoint, apiKey, "evalops_register", {
+    agent_type: options.agentType ?? DEFAULT_AGENT_TYPE,
+    capabilities: ["maestro:init", "maestro:cli"],
+    ...options.registerScopes?.length ? { scopes: options.registerScopes } : {},
+    surface: options.surface ?? DEFAULT_SURFACE2,
+    ...positiveInteger(options.ttlSeconds) ? { ttl_seconds: options.ttlSeconds } : {},
+    ...options.workspaceId ? { workspace_id: options.workspaceId } : {}
+  });
+  if (output.registered !== true || !nonEmptyString(output.agent_id)) {
+    throw new Error("EvalOps agent registration did not return an agent_id");
+  }
+  return output;
+}
+function organizationIdFromCredentials(credentials) {
+  return nonEmptyString(credentials?.metadata?.organizationId) ?? nonEmptyString(credentials?.metadata?.organization_id);
+}
+function saveBootstrapMetadata(credentials, agentMcp, saveCredentials) {
+  saveCredentials("evalops", {
+    ...credentials,
+    metadata: {
+      ...credentials.metadata,
+      agentId: agentMcp.agentId ?? credentials.metadata?.agentId,
+      runId: agentMcp.runId ?? credentials.metadata?.runId,
+      surface: agentMcp.surface,
+      agentMcp
+    }
+  });
+}
+async function bootstrapEvalOpsAgent(options = {}, dependencies = {}) {
+  const deps = {
+    createMcpClient: dependencies.createMcpClient ?? createDefaultMcpClient,
+    fetch: dependencies.fetch ?? fetch,
+    getOAuthToken: dependencies.getOAuthToken ?? getOAuthToken,
+    hasOAuthCredentials: dependencies.hasOAuthCredentials ?? hasOAuthCredentials,
+    loadCredentials: dependencies.loadCredentials ?? loadOAuthCredentials,
+    login: dependencies.login ?? login,
+    now: dependencies.now ?? (() => /* @__PURE__ */ new Date()),
+    onAuthUrl: dependencies.onAuthUrl ?? ((url) => {
+      process.stdout.write(`${url}
+`);
+    }),
+    onStatus: dependencies.onStatus ?? (() => {
+      return;
+    }),
+    saveCredentials: dependencies.saveCredentials ?? saveOAuthCredentials
+  };
+  const oauthToken = await ensureEvalOpsLogin(options, deps);
+  const endpoint = await resolveAgentMcpEndpoint(options, deps);
+  const credentialsBeforeKey = deps.loadCredentials("evalops");
+  const stored = getStoredAgentMcpMetadata(credentialsBeforeKey);
+  const identityBaseUrl = resolveIdentityBaseUrl(credentialsBeforeKey, endpoint);
+  const now2 = deps.now();
+  let apiKey = stored && !options.rotateKey ? stored.apiKey : void 0;
+  let keyOutput;
+  let apiKeyCreated = false;
+  if (!apiKey) {
+    deps.onStatus({ message: "Creating EvalOps agent API key" });
+    keyOutput = await createAgentAPIKey(options, identityBaseUrl, oauthToken, deps.fetch, now2);
+    apiKey = keyOutput.api_key;
+    apiKeyCreated = true;
+  } else {
+    deps.onStatus({ message: "Reusing stored EvalOps agent API key" });
+  }
+  deps.onStatus({ message: "Registering Maestro with EvalOps agent MCP" });
+  let registerOutput;
+  try {
+    registerOutput = await registerAgent(options, endpoint.endpoint, apiKey, deps.createMcpClient);
+  } catch (error) {
+    if (apiKeyCreated) {
+      throw error;
+    }
+    deps.onStatus({
+      message: "Stored EvalOps agent API key failed; rotating and retrying"
+    });
+    keyOutput = await createAgentAPIKey({ ...options, rotateKey: true }, identityBaseUrl, oauthToken, deps.fetch, now2);
+    apiKey = keyOutput.api_key;
+    apiKeyCreated = true;
+    registerOutput = await registerAgent(options, endpoint.endpoint, apiKey, deps.createMcpClient);
+  }
+  const credentials = deps.loadCredentials("evalops");
+  if (!credentials) {
+    throw new Error("EvalOps OAuth credentials disappeared during init");
+  }
+  const keyPrefix = nonEmptyString(keyOutput?.prefix) ?? stored?.keyPrefix;
+  const scopes = keyOutput?.scopes ?? stored?.scopes;
+  const agentMcp = {
+    type: "agent-mcp",
+    apiKey,
+    createdAt: (apiKeyCreated ? now2 : new Date(stored?.createdAt ?? now2)).toISOString(),
+    endpoint: endpoint.endpoint,
+    registeredAt: deps.now().toISOString(),
+    surface: options.surface ?? DEFAULT_SURFACE2,
+    agentId: registerOutput.agent_id,
+    expiresAt: nonEmptyString(keyOutput?.expires_at) ?? stored?.expiresAt,
+    keyId: nonEmptyString(keyOutput?.key_id) ?? stored?.keyId,
+    keyName: nonEmptyString(keyOutput?.name) ?? stored?.keyName,
+    keyPrefix,
+    manifestUrl: endpoint.manifestUrl,
+    registryVisible: registerOutput.registry_visible,
+    runId: registerOutput.run_id,
+    scopes,
+    sessionExpiresAt: registerOutput.expires_at,
+    workspaceId: options.workspaceId ?? organizationIdFromCredentials(credentials)
+  };
+  saveBootstrapMetadata(credentials, agentMcp, deps.saveCredentials);
+  return {
+    agentId: registerOutput.agent_id,
+    apiKeyCreated,
+    endpoint: endpoint.endpoint,
+    keyPrefix,
+    manifestUrl: endpoint.manifestUrl,
+    organizationId: organizationIdFromCredentials(credentials),
+    registryVisible: registerOutput.registry_visible,
+    runId: registerOutput.run_id,
+    scopesGranted: registerOutput.scopes_granted,
+    sessionExpiresAt: registerOutput.expires_at,
+    stored: true
+  };
+}
+var DEFAULT_AGENT_MCP_BASE_URL = "https://app.evalops.dev";
+var DEFAULT_IDENTITY_BASE_URL = "https://identity.evalops.dev";
+var AGENT_MCP_MANIFEST_PATH = "/.well-known/evalops/agent-mcp.json";
+var AGENT_MCP_PATH = "/mcp";
+var DEFAULT_AGENT_TYPE = "maestro";
+var DEFAULT_SURFACE2 = "cli";
+var DEFAULT_API_KEY_SCOPES;
+var init_agent_bootstrap = __esm2(() => {
+  init_oauth();
+  init_storage();
+  init_package_metadata();
+  init_client();
+  init_core_services();
+  DEFAULT_API_KEY_SCOPES = [
+    "agent:register",
+    "agent:heartbeat",
+    "governance:evaluate",
+    "llm_gateway:invoke",
+    "memories:read",
+    "memories:write",
+    "meter:record"
+  ];
+});
 function isPlatformMcpExplicitlyDisabled() {
   const enabled = getEnvValue3(PLATFORM_MCP_ENABLED_ENV_VARS);
   if (!enabled) {
@@ -87032,15 +87513,16 @@ function isPlatformMcpExplicitlyDisabled() {
   return PLATFORM_MCP_DISABLED_VALUES.has(enabled.trim().toLowerCase());
 }
 function buildPlatformMcpHeaders() {
-  const token = resolveConfiguredToken(PLATFORM_MCP_TOKEN_ENV_VARS);
-  const workspaceId = resolveWorkspaceId2(PLATFORM_MCP_WORKSPACE_ENV_VARS);
+  const stored = getStoredEvalOpsAgentMcpMetadata();
+  const token = getEnvValue3(PLATFORM_MCP_TOKEN_ENV_VARS) ?? stored?.apiKey ?? resolveConfiguredToken(PLATFORM_MCP_TOKEN_ENV_VARS);
+  const workspaceId = resolveWorkspaceId2(PLATFORM_MCP_WORKSPACE_ENV_VARS) ?? stored?.workspaceId;
   const headers = Object.fromEntries(Object.entries({
     ...token ? { Authorization: `Bearer ${token}` } : {},
     "Mcp-Session-Id": getEnvValue3(["MAESTRO_SESSION_ID"]),
     "X-EvalOps-Workspace-Id": workspaceId,
     "X-EvalOps-Session-Id": getEnvValue3(["MAESTRO_SESSION_ID"]),
-    "X-EvalOps-Agent-Id": getEnvValue3(PLATFORM_MCP_AGENT_ID_ENV_VARS),
-    "X-EvalOps-Agent-Run-Id": getEnvValue3(["MAESTRO_AGENT_RUN_ID"]),
+    "X-EvalOps-Agent-Id": getEnvValue3(PLATFORM_MCP_AGENT_ID_ENV_VARS) ?? stored?.agentId,
+    "X-EvalOps-Agent-Run-Id": getEnvValue3(["MAESTRO_AGENT_RUN_ID"]) ?? stored?.runId,
     "X-EvalOps-Scopes": getEnvValue3(PLATFORM_MCP_SCOPES_ENV_VARS),
     "X-EvalOps-Request-Id": getEnvValue3(["MAESTRO_REQUEST_ID"]),
     "X-EvalOps-Trace-Id": getEnvValue3(["TRACE_ID", "OTEL_TRACE_ID"]),
@@ -87048,11 +87530,28 @@ function buildPlatformMcpHeaders() {
   }).filter((entry2) => typeof entry2[1] === "string" && entry2[1].trim().length > 0));
   return Object.keys(headers).length > 0 ? headers : void 0;
 }
+function normalizePlatformMcpEndpoint(url) {
+  const normalized = normalizeBaseUrl2(url);
+  try {
+    const parsed = new URL(normalized);
+    if (parsed.pathname === "" || parsed.pathname === "/" || parsed.pathname === AGENT_MCP_MANIFEST_PATH2) {
+      parsed.pathname = AGENT_MCP_PATH2;
+      parsed.search = "";
+      parsed.hash = "";
+      return normalizeBaseUrl2(parsed.toString());
+    }
+  } catch {
+  }
+  return normalized;
+}
+function resolvePlatformMcpURL() {
+  return getEnvValue3(PLATFORM_MCP_URL_ENV_VARS) ?? getEnvValue3(PLATFORM_MCP_MANIFEST_URL_ENV_VARS) ?? getStoredEvalOpsAgentMcpMetadata()?.endpoint;
+}
 function getPlatformMcpPluginServers() {
   if (isPlatformMcpExplicitlyDisabled()) {
     return [];
   }
-  const url = getEnvValue3(PLATFORM_MCP_URL_ENV_VARS);
+  const url = resolvePlatformMcpURL();
   if (!url) {
     return [];
   }
@@ -87060,7 +87559,7 @@ function getPlatformMcpPluginServers() {
     {
       name: getEnvValue3(PLATFORM_MCP_NAME_ENV_VARS) ?? DEFAULT_PLATFORM_MCP_SERVER_NAME,
       transport: "http",
-      url: normalizeBaseUrl2(url),
+      url: normalizePlatformMcpEndpoint(url),
       headers: buildPlatformMcpHeaders(),
       scope: "plugin"
     }
@@ -87070,12 +87569,16 @@ var PLATFORM_MCP_DISABLED_VALUES;
 var PLATFORM_MCP_ENABLED_ENV_VARS;
 var PLATFORM_MCP_NAME_ENV_VARS;
 var PLATFORM_MCP_URL_ENV_VARS;
+var PLATFORM_MCP_MANIFEST_URL_ENV_VARS;
 var PLATFORM_MCP_TOKEN_ENV_VARS;
 var PLATFORM_MCP_WORKSPACE_ENV_VARS;
 var PLATFORM_MCP_AGENT_ID_ENV_VARS;
 var PLATFORM_MCP_SCOPES_ENV_VARS;
 var DEFAULT_PLATFORM_MCP_SERVER_NAME = "evalops";
+var AGENT_MCP_MANIFEST_PATH2 = "/.well-known/evalops/agent-mcp.json";
+var AGENT_MCP_PATH2 = "/mcp";
 var init_platform_plugin = __esm2(() => {
+  init_agent_bootstrap();
   init_client();
   PLATFORM_MCP_DISABLED_VALUES = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
   PLATFORM_MCP_ENABLED_ENV_VARS = [
@@ -87091,6 +87594,11 @@ var init_platform_plugin = __esm2(() => {
     "MAESTRO_AGENT_MCP_URL",
     "MAESTRO_EVALOPS_AGENT_MCP_URL"
   ];
+  PLATFORM_MCP_MANIFEST_URL_ENV_VARS = [
+    "MAESTRO_PLATFORM_MCP_MANIFEST_URL",
+    "MAESTRO_AGENT_MCP_MANIFEST_URL",
+    "MAESTRO_EVALOPS_AGENT_MCP_MANIFEST_URL"
+  ];
   PLATFORM_MCP_TOKEN_ENV_VARS = [
     "MAESTRO_PLATFORM_MCP_TOKEN",
     "MAESTRO_AGENT_MCP_TOKEN",
@@ -87252,9 +87760,9 @@ function addMcpServerToConfig(options) {
     throw new Error(`Invalid MCP config at ${path23}: ${parsed.error.issues.map((issue) => issue.message).join("; ")}`);
   }
   const nextConfig = structuredClone(parsed.data);
-  const hasObjectFormat = isRecord9(nextConfig.mcpServers) || !Array.isArray(nextConfig.servers);
+  const hasObjectFormat = isRecord10(nextConfig.mcpServers) || !Array.isArray(nextConfig.servers);
   if (hasObjectFormat) {
-    const existingServers = isRecord9(nextConfig.mcpServers) ? nextConfig.mcpServers : {};
+    const existingServers = isRecord10(nextConfig.mcpServers) ? nextConfig.mcpServers : {};
     if (Object.prototype.hasOwnProperty.call(existingServers, validatedServer.name)) {
       throw new Error(`MCP server "${validatedServer.name}" already exists in ${path23}`);
     }
@@ -87287,7 +87795,7 @@ function addMcpAuthPresetToConfig(options) {
     throw new Error(`Invalid MCP config at ${path23}: ${parsed.error.issues.map((issue) => issue.message).join("; ")}`);
   }
   const nextConfig = structuredClone(parsed.data);
-  const existingPresets = isRecord9(nextConfig.authPresets) ? nextConfig.authPresets : {};
+  const existingPresets = isRecord10(nextConfig.authPresets) ? nextConfig.authPresets : {};
   if (Object.prototype.hasOwnProperty.call(existingPresets, validatedPreset.name)) {
     throw new Error(`MCP auth preset "${validatedPreset.name}" already exists in ${path23}`);
   }
@@ -87388,7 +87896,7 @@ function parseConfigFile2(path23, scope) {
     }
     if (parsed.data.mcpServers) {
       for (const [name, raw] of Object.entries(parsed.data.mcpServers)) {
-        const merged = isRecord9(raw) ? { ...raw, name } : { name };
+        const merged = isRecord10(raw) ? { ...raw, name } : { name };
         const normalized = normalizeServer(merged, name, scope);
         if (normalized)
           servers.push(normalized);
@@ -87396,7 +87904,7 @@ function parseConfigFile2(path23, scope) {
     }
     if (parsed.data.authPresets) {
       for (const [name, raw] of Object.entries(parsed.data.authPresets)) {
-        const merged = isRecord9(raw) ? { ...raw, name } : { name };
+        const merged = isRecord10(raw) ? { ...raw, name } : { name };
         const normalized = normalizeAuthPreset(merged, name, scope);
         if (normalized)
           authPresets.push(normalized);
@@ -87449,7 +87957,7 @@ function resolveWritableAuthPresetMutationScope(name, scope, projectRoot) {
   return activePreset.scope;
 }
 function mutateWritableMcpConfig(config2, name, mode, options) {
-  if (isRecord9(config2.mcpServers) && Object.prototype.hasOwnProperty.call(config2.mcpServers, name)) {
+  if (isRecord10(config2.mcpServers) && Object.prototype.hasOwnProperty.call(config2.mcpServers, name)) {
     if (mode === "remove") {
       delete config2.mcpServers[name];
     } else {
@@ -87474,7 +87982,7 @@ function mutateWritableMcpConfig(config2, name, mode, options) {
   return false;
 }
 function mutateWritableMcpAuthPresetConfig(config2, name, mode, options) {
-  if (isRecord9(config2.authPresets) && Object.prototype.hasOwnProperty.call(config2.authPresets, name)) {
+  if (isRecord10(config2.authPresets) && Object.prototype.hasOwnProperty.call(config2.authPresets, name)) {
     if (mode === "remove") {
       delete config2.authPresets[name];
     } else {
@@ -87580,7 +88088,7 @@ function buildPersistedAuthPresetConfig(preset) {
     headersHelper: preset.headersHelper
   };
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function isWritableScope(value) {
@@ -87672,7 +88180,7 @@ var init_config3 = __esm2(() => {
   init_schema();
   logger97 = createLogger("mcp:config");
 });
-function isRecord10(value) {
+function isRecord11(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function collectConcreteUrls(entry2) {
@@ -87757,11 +88265,11 @@ function buildCacheFromResponse(data) {
     entries: [],
     status: "ready"
   };
-  if (!isRecord10(data) || !Array.isArray(data.servers)) {
+  if (!isRecord11(data) || !Array.isArray(data.servers)) {
     return next;
   }
   for (const entry2 of data.servers) {
-    if (!isRecord10(entry2))
+    if (!isRecord11(entry2))
       continue;
     const typedEntry = entry2;
     const info = buildRegistryInfo(typedEntry);
@@ -88410,7 +88918,7 @@ var init_manager2 = __esm2(() => {
           const requestInit = await buildRemoteRequestInit(config2, buildAuthPresetMap(this.config.authPresets));
           const transportOptions = requestInit ? { requestInit } : void 0;
           if (transportType === "http") {
-            transport = new StreamableHTTPClientTransport(new URL(config2.url), transportOptions);
+            transport = new StreamableHTTPClientTransport2(new URL(config2.url), transportOptions);
           } else {
             transport = new SSEClientTransport(new URL(config2.url), transportOptions);
           }
@@ -88426,7 +88934,7 @@ var init_manager2 = __esm2(() => {
             cwd: config2.cwd
           });
         }
-        const client = new Client({
+        const client = new Client2({
           name: "composer",
           version: "1.0.0"
         }, {
@@ -90876,11 +91384,11 @@ function collapseRepeatedLinesWithHistory(text2, options = {}) {
   return { text: result.join(`
 `), changed };
 }
-function isRecord11(value) {
+function isRecord12(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isAssistantContentBlock(value) {
-  if (!isRecord11(value)) {
+  if (!isRecord12(value)) {
     return false;
   }
   switch (value.type) {
@@ -90889,7 +91397,7 @@ function isAssistantContentBlock(value) {
     case "thinking":
       return typeof value.thinking === "string";
     case "toolCall":
-      return typeof value.id === "string" && typeof value.name === "string" && isRecord11(value.arguments);
+      return typeof value.id === "string" && typeof value.name === "string" && isRecord12(value.arguments);
     default:
       return false;
   }
@@ -90904,7 +91412,7 @@ function normalizeAssistantContent(content) {
   return content.filter(isAssistantContentBlock);
 }
 function isToolResultContentBlock(value) {
-  if (!isRecord11(value)) {
+  if (!isRecord12(value)) {
     return false;
   }
   if (value.type === "text") {
@@ -101841,7 +102349,7 @@ var init_export_html = __esm2(() => {
   init_context_firewall();
   init_types3();
   init_path_expansion();
-  packageJson = createRequire4(import.meta.url)("../package.json");
+  packageJson = createRequire5(import.meta.url)("../package.json");
   VERSION2 = packageJson.version ?? "unknown";
 });
 function loadFactoryConfigOrThrow() {
@@ -102661,8 +103169,8 @@ function resolveOllamaUrl(path23) {
   }
   return url;
 }
-function isLoopbackHost(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.startsWith("127.");
+function isLoopbackHost(hostname2) {
+  return hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1" || hostname2.startsWith("127.");
 }
 var OllamaView;
 var init_ollama_view = __esm2(() => {
@@ -106210,32 +106718,6 @@ var SlashCycleState = class {
 };
 var init_slash = () => {
 };
-function loadPackageMetadata() {
-  if (cachedPackageMetadata) {
-    return cachedPackageMetadata;
-  }
-  try {
-    const packageJson22 = createRequire5(import.meta.url)("../package.json");
-    cachedPackageMetadata = packageJson22;
-    return packageJson22;
-  } catch {
-    cachedPackageMetadata = {};
-    return cachedPackageMetadata;
-  }
-}
-function getPackageVersion() {
-  return process.env.MAESTRO_VERSION ?? loadPackageMetadata().version ?? "unknown";
-}
-function getPackageName() {
-  const metadata = loadPackageMetadata();
-  return process.env.MAESTRO_PACKAGE_NAME ?? metadata.name ?? metadata.maestro?.canonicalPackageName ?? "@evalops/maestro";
-}
-function getGlobalInstallCommand(packageManager = "npm", packageName = getPackageName()) {
-  return `${packageManager} install -g ${packageName}`;
-}
-var cachedPackageMetadata = null;
-var init_package_metadata = () => {
-};
 function formatLink(url, label) {
   const text2 = label ?? url;
   if (!process.stdout.isTTY)
@@ -122572,7 +123054,7 @@ Reply with option numbers (e.g., '1' or '1, 3' for multi-select), option labels,
     }
   });
 });
-function isRecord12(value) {
+function isRecord13(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function getOptionalNumber(record, key) {
@@ -122590,7 +123072,7 @@ function normalizeOptionEntries(values, labels) {
   }));
 }
 function parseFieldDefinition(key, value) {
-  if (!isRecord12(value) || typeof value.type !== "string") {
+  if (!isRecord13(value) || typeof value.type !== "string") {
     return null;
   }
   const label = getOptionalString(value, "title") ?? key;
@@ -122616,7 +123098,7 @@ function parseFieldDefinition(key, value) {
         options: normalizeOptionEntries(value.enum, enumNames)
       };
     }
-    if (Array.isArray(value.oneOf) && value.oneOf.every((entry2) => isRecord12(entry2) && typeof entry2.const === "string" && typeof entry2.title === "string")) {
+    if (Array.isArray(value.oneOf) && value.oneOf.every((entry2) => isRecord13(entry2) && typeof entry2.const === "string" && typeof entry2.title === "string")) {
       return {
         key,
         kind: "select",
@@ -122652,7 +123134,7 @@ function parseFieldDefinition(key, value) {
       minimum: getOptionalNumber(value, "minimum")
     };
   }
-  if (value.type === "array" && isRecord12(value.items)) {
+  if (value.type === "array" && isRecord13(value.items)) {
     if (Array.isArray(value.items.enum) && value.items.enum.every((entry2) => typeof entry2 === "string")) {
       return {
         key,
@@ -122665,7 +123147,7 @@ function parseFieldDefinition(key, value) {
         options: normalizeOptionEntries(value.items.enum)
       };
     }
-    if (Array.isArray(value.items.anyOf) && value.items.anyOf.every((entry2) => isRecord12(entry2) && typeof entry2.const === "string" && typeof entry2.title === "string")) {
+    if (Array.isArray(value.items.anyOf) && value.items.anyOf.every((entry2) => isRecord13(entry2) && typeof entry2.const === "string" && typeof entry2.title === "string")) {
       return {
         key,
         kind: "multi-select",
@@ -122684,7 +123166,7 @@ function parseFieldDefinition(key, value) {
   return null;
 }
 function parseMcpElicitationRequest(args) {
-  if (!isRecord12(args)) {
+  if (!isRecord13(args)) {
     return {
       kind: "malformed",
       message: "MCP server requested additional input.",
@@ -122722,7 +123204,7 @@ function parseMcpElicitationRequest(args) {
     };
   }
   const requestedSchema = args.requestedSchema;
-  if (!isRecord12(requestedSchema)) {
+  if (!isRecord13(requestedSchema)) {
     return {
       kind: "malformed",
       message,
@@ -122731,7 +123213,7 @@ function parseMcpElicitationRequest(args) {
       error: "Missing requested schema for form elicitation."
     };
   }
-  if (requestedSchema.type !== "object" || !isRecord12(requestedSchema.properties)) {
+  if (requestedSchema.type !== "object" || !isRecord13(requestedSchema.properties)) {
     return {
       kind: "malformed",
       message,
@@ -132015,7 +132497,7 @@ function parseArgs(args) {
           result.subcommand = nextArg;
           i2++;
         }
-        if (arg === "remote" || arg === "hosted-runner") {
+        if (arg === "remote" || arg === "hosted-runner" || arg === "init" || arg === "evalops") {
           result.commandArgs = args.slice(i2 + 1);
           break;
         }
@@ -132038,6 +132520,7 @@ var init_args = __esm2(() => {
     "exec",
     "web",
     "hosted-runner",
+    "init",
     "anthropic",
     "evalops",
     "openai",
@@ -135766,7 +136249,10 @@ function printHelp(version3) {
   # Use Codex subscription models after \`maestro codex login\`
   maestro --provider openai-codex --model gpt-5.5 "Plan this migration"
 
-  # Use EvalOps managed gateway models after \`maestro evalops login\`
+  # Bootstrap EvalOps login, API key, and agent registration in one flow
+  maestro init
+
+  # Use EvalOps managed gateway models after \`maestro init\`
   maestro --provider evalops --model gpt-4o-mini "Say hello in one sentence"
 
   # Export a portable session log
@@ -135845,6 +136331,10 @@ function printHelp(version3) {
   maestro remote attach <session-id> [--verify] [--print-env]
   maestro remote extend <session-id> --ttl 2h
   maestro remote stop <session-id> [--reason <text>]`)}`;
+  const initSection = `${sectionHeading("maestro init")}${muted(`  maestro init                         Login, create or reuse an API key, and register this agent
+  maestro init --rotate-key           Replace the stored agent MCP API key
+  maestro init --mcp-url <url>        Override the EvalOps agent MCP endpoint
+  maestro init --json                 Emit machine-readable bootstrap output`)}`;
   const hostedRunnerSection = `${sectionHeading("maestro hosted-runner")}${muted(`  maestro hosted-runner --runner-session-id <id> --workspace-root <path> [--listen 0.0.0.0:8080]
 
   Env mode:
@@ -135882,6 +136372,7 @@ function printHelp(version3) {
     webSection,
     portabilitySection,
     memorySection,
+    initSection,
     remoteSection,
     hostedRunnerSection,
     sessionsSection,
@@ -140515,7 +141006,7 @@ function getString(value, field) {
   const trimmed = value.trim();
   return trimmed || void 0;
 }
-function getStringArray2(value, field) {
+function getStringArray3(value, field) {
   if (value === void 0 || value === null) {
     return;
   }
@@ -140544,7 +141035,7 @@ function parseHostedRunnerDrainInput(body) {
   return {
     reason: getString(record.reason, "reason") ?? getString(record.stop_reason, "stop_reason"),
     requestedBy: getString(record.requested_by, "requested_by") ?? getString(record.requestedBy, "requestedBy"),
-    exportPaths: getStringArray2(record.export_paths, "export_paths") ?? getStringArray2(record.exportPaths, "exportPaths")
+    exportPaths: getStringArray3(record.export_paths, "export_paths") ?? getStringArray3(record.exportPaths, "exportPaths")
   };
 }
 function isWithinPath(root, target) {
@@ -140814,7 +141305,7 @@ var init_hosted_runner_drain = __esm2(() => {
   init_server_utils();
   execFileAsync2 = promisify5(execFile4);
 });
-function isRecord13(value) {
+function isRecord14(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function cleanRequiredString(value, label) {
@@ -140856,7 +141347,7 @@ function cleanOptionalPositiveInteger(value, label) {
   return Math.floor(value);
 }
 function normalizeModelPreferences(value) {
-  const input = isRecord13(value) ? value : {};
+  const input = isRecord14(value) ? value : {};
   const defaultModel = cleanOptionalString(input.defaultModel);
   const preferredProvider = cleanOptionalString(input.preferredProvider);
   return {
@@ -140867,7 +141358,7 @@ function normalizeModelPreferences(value) {
   };
 }
 function normalizeSafetyRules(value) {
-  const input = isRecord13(value) ? value : {};
+  const input = isRecord14(value) ? value : {};
   const requireApprovals = cleanOptionalBoolean(input.requireApprovals);
   const maxTokensPerSession = cleanOptionalPositiveInteger(input.maxTokensPerSession, "safetyRules.maxTokensPerSession");
   return {
@@ -140880,7 +141371,7 @@ function normalizeSafetyRules(value) {
   };
 }
 function normalizeRateLimits(value) {
-  const input = isRecord13(value) ? value : {};
+  const input = isRecord14(value) ? value : {};
   const requestsPerMinute = cleanOptionalPositiveInteger(input.requestsPerMinute, "rateLimits.requestsPerMinute");
   const tokensPerMinute = cleanOptionalPositiveInteger(input.tokensPerMinute, "rateLimits.tokensPerMinute");
   const maxConcurrentSessions = cleanOptionalPositiveInteger(input.maxConcurrentSessions, "rateLimits.maxConcurrentSessions");
@@ -140893,7 +141384,7 @@ function normalizeRateLimits(value) {
   };
 }
 function normalizeWorkspaceConfigInput(input, now2 = /* @__PURE__ */ new Date()) {
-  if (!isRecord13(input)) {
+  if (!isRecord14(input)) {
     throw new WorkspaceConfigValidationError("Workspace config must be an object.");
   }
   return {
@@ -140906,22 +141397,22 @@ function normalizeWorkspaceConfigInput(input, now2 = /* @__PURE__ */ new Date())
   };
 }
 function normalizeWorkspaceConfigPatchInput(workspaceId, input, existing, now2 = /* @__PURE__ */ new Date()) {
-  if (!isRecord13(input)) {
+  if (!isRecord14(input)) {
     throw new WorkspaceConfigValidationError("Workspace config must be an object.");
   }
   return {
     workspaceId: cleanRequiredString(workspaceId, "workspaceId"),
     modelPreferences: normalizeModelPreferences({
       ...existing?.modelPreferences ?? {},
-      ...isRecord13(input.modelPreferences) ? input.modelPreferences : {}
+      ...isRecord14(input.modelPreferences) ? input.modelPreferences : {}
     }),
     safetyRules: normalizeSafetyRules({
       ...existing?.safetyRules ?? {},
-      ...isRecord13(input.safetyRules) ? input.safetyRules : {}
+      ...isRecord14(input.safetyRules) ? input.safetyRules : {}
     }),
     rateLimits: normalizeRateLimits({
       ...existing?.rateLimits ?? {},
-      ...isRecord13(input.rateLimits) ? input.rateLimits : {}
+      ...isRecord14(input.rateLimits) ? input.rateLimits : {}
     }),
     createdAt: existing?.createdAt ?? now2.toISOString(),
     updatedAt: now2.toISOString()
@@ -149944,7 +150435,7 @@ function safeStringify2(value) {
     return "[unserializable]";
   }
 }
-function isRecord14(value) {
+function isRecord15(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function toComposerAttachments(attachments, options) {
@@ -150187,7 +150678,7 @@ function convertAppMessagesToComposer(messages, options) {
 function normalizeToolCall(tool, messageIndex, contentIndex) {
   const name = tool.name?.trim() || `tool_${messageIndex}_${contentIndex}`;
   const toolCallId = tool.toolCallId || `web-tool-${messageIndex}-${contentIndex}`;
-  const args = isRecord14(tool.args) ? tool.args : {};
+  const args = isRecord15(tool.args) ? tool.args : {};
   return {
     type: "toolCall",
     id: toolCallId,
@@ -151221,7 +151712,7 @@ var init_chat_ws = __esm2(() => {
   init_validation3();
   logger158 = createLogger("web:chat-ws");
 });
-function isRecord15(value) {
+function isRecord16(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function canWrite(ws) {
@@ -151243,7 +151734,7 @@ function toErrorResponse(id, code, message) {
   };
 }
 function parseClientRequest(raw) {
-  if (!isRecord15(raw)) {
+  if (!isRecord16(raw)) {
     throw new Error("Runtime app-server request must be an object");
   }
   if (raw.jsonrpc !== "2.0") {
@@ -151374,7 +151865,7 @@ function handleRuntimeAppServerWebSocket(ws, options = {}) {
       }
       const request = parseClientRequest(parsed);
       if (request.method === "runtime.initialize") {
-        const requestedSessionId = isRecord15(request.params) ? request.params.sessionId : void 0;
+        const requestedSessionId = isRecord16(request.params) ? request.params.sessionId : void 0;
         await bindSessionId(requestedSessionId);
         const result = initializeResult();
         send2(ws, { jsonrpc: "2.0", id: request.id, result });
@@ -151397,7 +151888,7 @@ function handleRuntimeAppServerWebSocket(ws, options = {}) {
       }
       send2(ws, { jsonrpc: "2.0", id: request.id, result: { ok: true } });
     } catch (error) {
-      const id = isRecord15(parsed) && (typeof parsed.id === "string" || typeof parsed.id === "number") ? parsed.id : null;
+      const id = isRecord16(parsed) && (typeof parsed.id === "string" || typeof parsed.id === "number") ? parsed.id : null;
       send2(ws, toErrorResponse(id, error instanceof Error && error.message === "Unsupported runtime app-server method" ? -32601 : -32600, error instanceof Error ? error.message : "Invalid request"));
     }
   });
@@ -151409,11 +151900,11 @@ var init_runtime_app_server_ws = __esm2(() => {
   init_registry();
   init_server_request_manager();
 });
-function isRecord16(value) {
+function isRecord17(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function getToolRetryPayload(args) {
-  return isRecord16(args) ? args : {};
+  return isRecord17(args) ? args : {};
 }
 function pendingRequestArgs(entry2) {
   if (entry2.kind !== "tool_retry") {
@@ -156456,7 +156947,7 @@ var init_types6 = __esm2(() => {
   ];
   TRACE_SPAN_STATUSES = ["unset", "ok", "error"];
 });
-function isRecord17(value) {
+function isRecord18(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function cleanRequiredString3(value, label) {
@@ -156547,7 +157038,7 @@ function sanitizeJsonValue(value, depth = 0) {
   if (Array.isArray(value)) {
     return value.map((item) => sanitizeJsonValue(item, depth + 1)).filter((item) => item !== void 0);
   }
-  if (isRecord17(value)) {
+  if (isRecord18(value)) {
     const result = {};
     for (const [key, nestedValue] of Object.entries(value)) {
       const sanitized = sanitizeJsonValue(nestedValue, depth + 1);
@@ -156578,7 +157069,7 @@ function inferDurationMs(startTime, endTime) {
   return duration >= 0 ? duration : void 0;
 }
 function normalizeSpan(input, parentSpanId) {
-  if (!isRecord17(input)) {
+  if (!isRecord18(input)) {
     throw new TracesValidationError("Each span must be an object.");
   }
   const error = cleanOptionalString3(input.error);
@@ -156642,7 +157133,7 @@ function countTraceSpans(spans) {
   return count2;
 }
 function normalizeExecutionTraceInput(input) {
-  if (!isRecord17(input)) {
+  if (!isRecord18(input)) {
     throw new TracesValidationError("Trace payload must be an object.");
   }
   if (!Array.isArray(input.spans)) {
@@ -157187,7 +157678,7 @@ var COMPLIANCE_FRAMEWORKS;
 var init_types7 = __esm2(() => {
   COMPLIANCE_FRAMEWORKS = ["soc2", "iso27001"];
 });
-function isRecord18(value) {
+function isRecord19(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function cleanOptionalString4(value) {
@@ -157245,7 +157736,7 @@ function sanitizeJsonValue2(value, depth = 0) {
   if (Array.isArray(value)) {
     return value.map((item) => sanitizeJsonValue2(item, depth + 1)).filter((item) => item !== void 0);
   }
-  if (isRecord18(value)) {
+  if (isRecord19(value)) {
     const result = {};
     for (const [key, nestedValue] of Object.entries(value)) {
       const sanitized = sanitizeJsonValue2(nestedValue, depth + 1);
@@ -157261,7 +157752,7 @@ function sanitizeMetadata(value) {
   if (!value)
     return {};
   const sanitized = sanitizeJsonValue2(value);
-  return isRecord18(sanitized) ? sanitized : {};
+  return isRecord19(sanitized) ? sanitized : {};
 }
 function stableActionId(input, timestamp3) {
   const explicit = cleanOptionalString4(input.actionId);
@@ -157291,7 +157782,7 @@ function stableGovernanceEvaluationId(input, timestamp3) {
   return `governance_${digest || randomUUID14()}`;
 }
 function normalizeAgentActionInput(input) {
-  if (!isRecord18(input)) {
+  if (!isRecord19(input)) {
     throw new ComplianceValidationError("Agent action must be an object.");
   }
   const timestamp3 = parseDate2(input.timestamp, "action.timestamp") ?? /* @__PURE__ */ new Date();
@@ -157313,7 +157804,7 @@ function normalizeAgentActionInput(input) {
   };
 }
 function normalizeGovernanceEvaluationInput(input) {
-  if (!isRecord18(input)) {
+  if (!isRecord19(input)) {
     throw new ComplianceValidationError("Governance evaluation must be an object.");
   }
   const timestamp3 = parseDate2(input.timestamp, "governanceEvents[].timestamp") ?? /* @__PURE__ */ new Date();
@@ -157338,7 +157829,7 @@ function normalizeGovernanceEvaluationInput(input) {
   };
 }
 function normalizeComplianceReportRequest(input) {
-  if (!isRecord18(input)) {
+  if (!isRecord19(input)) {
     throw new ComplianceValidationError("Report request must be an object.");
   }
   const reportInput = input;
@@ -157877,7 +158368,7 @@ var init_types8 = __esm2(() => {
     "latency"
   ];
 });
-function isRecord19(value) {
+function isRecord20(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function cleanOptionalString5(value) {
@@ -157949,13 +158440,13 @@ function normalizeAvailableModels(value) {
   if (!Array.isArray(value)) {
     throw new IntelligentRouterValidationError("availableModels must be an array.");
   }
-  return value.filter(isRecord19).map((entry2) => {
+  return value.filter(isRecord20).map((entry2) => {
     const provider = cleanRequiredString5(entry2.provider, "provider");
     const model = cleanRequiredString5(entry2.model, "model");
     const name = cleanOptionalString5(entry2.name);
     const available = typeof entry2.available === "boolean" ? entry2.available : void 0;
     const cost = (() => {
-      if (!isRecord19(entry2.cost))
+      if (!isRecord20(entry2.cost))
         return;
       const input = parseFiniteNumber(entry2.cost.input, "cost.input");
       const output = parseFiniteNumber(entry2.cost.output, "cost.output");
@@ -157978,7 +158469,7 @@ function normalizeAvailableModels(value) {
   });
 }
 function normalizeRoutingRequest(input, defaultAvailableModels) {
-  if (!isRecord19(input)) {
+  if (!isRecord20(input)) {
     throw new IntelligentRouterValidationError("Routing request must be an object.");
   }
   const requestInput = input;
@@ -157995,7 +158486,7 @@ function normalizeRoutingRequest(input, defaultAvailableModels) {
   };
 }
 function normalizePerformanceMetricInput(input) {
-  if (!isRecord19(input)) {
+  if (!isRecord20(input)) {
     throw new IntelligentRouterValidationError("Metric must be an object.");
   }
   const metricInput = input;
@@ -158020,7 +158511,7 @@ function normalizePerformanceMetricInput(input) {
   };
 }
 function normalizeRoutingOverrideInput(input) {
-  if (!isRecord19(input)) {
+  if (!isRecord20(input)) {
     throw new IntelligentRouterValidationError("Override must be an object.");
   }
   const overrideInput = input;
@@ -163627,7 +164118,7 @@ var init_types9 = __esm2(() => {
     "custom"
   ];
 });
-function isRecord20(value) {
+function isRecord21(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function cleanOptionalString6(value) {
@@ -163711,7 +164202,7 @@ function sanitizeJsonValue3(value, depth = 0) {
   if (Array.isArray(value)) {
     return value.map((item) => sanitizeJsonValue3(item, depth + 1)).filter((item) => item !== void 0);
   }
-  if (isRecord20(value)) {
+  if (isRecord21(value)) {
     const result = {};
     for (const [key, nestedValue] of Object.entries(value)) {
       const sanitized = sanitizeJsonValue3(nestedValue, depth + 1);
@@ -163727,10 +164218,10 @@ function sanitizeMetadata2(value) {
   if (!value)
     return {};
   const sanitized = sanitizeJsonValue3(value);
-  return isRecord20(sanitized) ? sanitized : {};
+  return isRecord21(sanitized) ? sanitized : {};
 }
 function normalizeRevenueOutcomeInput(input) {
-  if (!isRecord20(input)) {
+  if (!isRecord21(input)) {
     throw new RevenueAttributionValidationError("Outcome must be an object.");
   }
   const outcomeInput = input;
@@ -169388,7 +169879,7 @@ __export2(exports_config, {
   buildConfigShowSections: () => buildConfigShowSections
 });
 function getManagedGatewayBaseUrl2() {
-  return process.env.MAESTRO_LLM_GATEWAY_URL?.trim() || "http://127.0.0.1:8081/v1";
+  return process.env.MAESTRO_LLM_GATEWAY_URL?.trim() || DEFAULT_EVALOPS_MANAGED_GATEWAY_BASE_URL;
 }
 function getManagedGatewayProviderPresets() {
   return getEvalOpsManagedProviderDefinitions().map((definition) => ({
@@ -170248,12 +170739,185 @@ var init_openai3 = __esm2(() => {
   init_openai_auth();
   CALLBACK_ORIGIN4 = `http://127.0.0.1:${DEFAULT_PORT}`;
 });
+var exports_init = {};
+__export2(exports_init, {
+  parseInitArgs: () => parseInitArgs,
+  handleInitCommand: () => handleInitCommand2,
+  formatInitHelp: () => formatInitHelp
+});
+function formatInitHelp() {
+  return `${sectionHeading("maestro init")}${muted(`  maestro init                         Login, create or reuse an API key, and register this agent
+  maestro init --rotate-key           Replace the stored agent MCP API key
+  maestro init --mcp-url <url>        Override the EvalOps agent MCP endpoint
+  maestro init --json                 Emit machine-readable bootstrap output
+
+Options
+  --agent-type <type>                 Agent type to register, defaults to maestro
+  --surface <surface>                 Surface to register, defaults to cli
+  --workspace, --workspace-id <id>    Workspace to associate with the registration
+  --scope <scope[,scope...]>          Registration scopes to request
+  --key-scope <scope[,scope...]>      API key scopes to request
+  --expires-in-days <days>            API key TTL in days
+  --force-login                       Re-run EvalOps OAuth before bootstrapping
+  --manifest-url <url>                Override the agent MCP manifest URL
+  --ttl-seconds <seconds>             Registration TTL in seconds`)}`;
+}
+function readValue(args, index2, flag) {
+  const value = args[index2 + 1];
+  if (!value || value.startsWith("-")) {
+    throw new Error(`${flag} requires a value`);
+  }
+  return value;
+}
+function parsePositiveInteger(value, flag) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`${flag} must be a positive integer`);
+  }
+  return parsed;
+}
+function appendScopes(existing, value) {
+  return [
+    ...existing ?? [],
+    ...value.split(",").map((entry2) => entry2.trim()).filter((entry2) => entry2.length > 0)
+  ];
+}
+function parseInitArgs(args) {
+  const options = {};
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2];
+    switch (arg) {
+      case "--agent-mcp-url":
+      case "--mcp-url":
+        options.mcpUrl = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--agent-type":
+        options.agentType = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--api-key-scope":
+      case "--key-scope":
+        options.apiKeyScopes = appendScopes(options.apiKeyScopes, readValue(args, i2, arg));
+        i2++;
+        break;
+      case "--expires-in-days":
+        options.expiresInDays = parsePositiveInteger(readValue(args, i2, arg), arg);
+        i2++;
+        break;
+      case "--force-login":
+        options.forceLogin = true;
+        break;
+      case "--json":
+        options.json = true;
+        break;
+      case "--key-name":
+        options.keyName = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--manifest-url":
+        options.manifestUrl = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--register-scope":
+      case "--scope":
+        options.registerScopes = appendScopes(options.registerScopes, readValue(args, i2, arg));
+        i2++;
+        break;
+      case "--rotate-key":
+        options.rotateKey = true;
+        break;
+      case "--surface":
+        options.surface = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--ttl-seconds":
+        options.ttlSeconds = parsePositiveInteger(readValue(args, i2, arg), arg);
+        i2++;
+        break;
+      case "--workspace":
+      case "--workspace-id":
+        options.workspaceId = readValue(args, i2, arg);
+        i2++;
+        break;
+      default:
+        if (arg?.startsWith("-")) {
+          throw new Error(`Unknown maestro init option: ${arg}`);
+        }
+        throw new Error(`Unexpected maestro init argument: ${arg}`);
+    }
+  }
+  return options;
+}
+async function handleInitCommand2(args = []) {
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(formatInitHelp());
+    return;
+  }
+  let options;
+  try {
+    options = parseInitArgs(args);
+  } catch (error) {
+    console.error(chalk62.red(error instanceof Error ? error.message : String(error)));
+    process.exit(1);
+  }
+  if (!options.json) {
+    console.log(chalk62.bold("Maestro EvalOps Init"));
+  }
+  const result = await bootstrapEvalOpsAgent(options, {
+    onAuthUrl: (url) => {
+      if (options.json) {
+        console.error("Open this URL in your browser to authenticate with EvalOps:");
+        console.error(url);
+        return;
+      }
+      console.log(chalk62.yellow("Open this URL in your browser to authenticate with EvalOps:"));
+      console.log(chalk62.underline(url));
+    },
+    onStatus: (status) => {
+      if (options.json) {
+        console.error(status.message);
+        return;
+      }
+      console.log(chalk62.dim(status.message));
+    }
+  });
+  if (options.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log(chalk62.green("EvalOps agent bootstrap complete."));
+  console.log(chalk62.dim(`MCP endpoint: ${result.endpoint}`));
+  if (result.organizationId) {
+    console.log(chalk62.dim(`Organization: ${result.organizationId}`));
+  }
+  if (result.agentId) {
+    console.log(chalk62.dim(`Agent: ${result.agentId}`));
+  }
+  if (result.runId) {
+    console.log(chalk62.dim(`Run: ${result.runId}`));
+  }
+  if (result.keyPrefix) {
+    const keyMode = result.apiKeyCreated ? "created" : "reused";
+    console.log(chalk62.dim(`API key ${keyMode}: ${result.keyPrefix}`));
+  }
+  console.log(chalk62.dim("Stored EvalOps MCP credentials locally for future Maestro sessions."));
+}
+var init_init = __esm2(() => {
+  init_agent_bootstrap();
+  init_theme2();
+});
 var exports_evalops = {};
 __export2(exports_evalops, {
   handleEvalOpsCommand: () => handleEvalOpsCommand
 });
-async function handleEvalOpsCommand(subcommand) {
+async function handleEvalOpsCommand(subcommand, args = []) {
   switch (subcommand) {
+    case "init": {
+      const { handleInitCommand: handleInitCommand3 } = await Promise.resolve().then(() => (init_init(), exports_init));
+      await handleInitCommand3(args);
+      return;
+    }
     case "login":
       await handleLogin3();
       return;
@@ -170264,50 +170928,70 @@ async function handleEvalOpsCommand(subcommand) {
       await handleStatus3();
       return;
     default:
-      console.error(chalk62.red('Unknown evalops subcommand. Try "maestro evalops login", "logout", or "status".'));
+      console.error(chalk63.red('Unknown evalops subcommand. Try "maestro init" for setup, or "maestro evalops login", "logout", or "status".'));
       process.exit(1);
   }
 }
 async function handleLogin3() {
-  console.log(chalk62.bold("Maestro EvalOps Login"));
+  console.log(chalk63.bold("Maestro EvalOps Login"));
   await login("evalops", {
     onAuthUrl: (url) => {
-      console.log(chalk62.yellow("Open this URL in your browser to authenticate with EvalOps:"));
-      console.log(chalk62.underline(url));
+      console.log(chalk63.yellow("Open this URL in your browser to authenticate with EvalOps:"));
+      console.log(chalk63.underline(url));
     },
-    onStatus: (status) => console.log(chalk62.dim(status))
+    onStatus: (status) => console.log(chalk63.dim(status))
   });
-  console.log(chalk62.green("EvalOps credentials saved successfully."));
-  console.log(chalk62.dim('Try "maestro --provider evalops --model gpt-4o-mini".'));
+  console.log(chalk63.green("EvalOps credentials saved successfully."));
+  console.log(chalk63.dim('Try "maestro --provider evalops --model gpt-4o-mini".'));
 }
 async function handleLogout2() {
   await logout("evalops");
-  console.log(chalk62.green("Removed stored EvalOps credentials."));
+  console.log(chalk63.green("Removed stored EvalOps credentials."));
 }
 async function handleStatus3() {
   if (!hasOAuthCredentials("evalops")) {
-    console.log(chalk62.yellow("No stored EvalOps credentials."));
-    console.log(chalk62.dim('Run "maestro evalops login" to authenticate with EvalOps.'));
+    console.log(chalk63.yellow("No stored EvalOps credentials."));
+    console.log(chalk63.dim('Run "maestro evalops login" to authenticate with EvalOps.'));
     return;
   }
   const credentials = loadOAuthCredentials("evalops");
   const remainingMs = Math.max(0, (credentials?.expires ?? Date.now()) - Date.now());
   const minutes = Math.round(remainingMs / 6e4);
   const metadata = credentials?.metadata;
+  const agentMcp = getStoredEvalOpsAgentMcpMetadata();
   const organizationId = typeof metadata?.organizationId === "string" ? metadata.organizationId : void 0;
   const providerRef = metadata?.providerRef && typeof metadata.providerRef === "object" && !Array.isArray(metadata.providerRef) ? metadata.providerRef : void 0;
-  console.log(chalk62.green("Stored EvalOps credentials detected."));
+  console.log(chalk63.green("Stored EvalOps credentials detected."));
   if (organizationId) {
-    console.log(chalk62.dim(`Organization: ${organizationId}`));
+    console.log(chalk63.dim(`Organization: ${organizationId}`));
   }
   if (providerRef) {
     const provider = typeof providerRef.provider === "string" ? providerRef.provider : "openai";
     const environment = typeof providerRef.environment === "string" ? providerRef.environment : "prod";
-    console.log(chalk62.dim(`Provider ref: ${provider}/${environment}`));
+    console.log(chalk63.dim(`Provider ref: ${provider}/${environment}`));
+  }
+  if (agentMcp) {
+    console.log(chalk63.green("EvalOps agent session configured."));
+    console.log(chalk63.dim(`MCP endpoint: ${agentMcp.endpoint}`));
+    if (agentMcp.agentId) {
+      console.log(chalk63.dim(`Agent: ${agentMcp.agentId}`));
+    }
+    if (agentMcp.runId) {
+      console.log(chalk63.dim(`Run: ${agentMcp.runId}`));
+    }
+    if (agentMcp.keyPrefix) {
+      console.log(chalk63.dim(`API key: ${agentMcp.keyPrefix}`));
+    }
+    if (agentMcp.sessionExpiresAt) {
+      console.log(chalk63.dim(`Session expires: ${agentMcp.sessionExpiresAt}`));
+    }
+  } else {
+    console.log(chalk63.yellow('No EvalOps agent session yet. Run "maestro init".'));
   }
-  console.log(chalk62.dim(`Access token expires in ~${minutes} minute${minutes === 1 ? "" : "s"} (auto-refresh enabled).`));
+  console.log(chalk63.dim(`Access token expires in ~${minutes} minute${minutes === 1 ? "" : "s"} (auto-refresh enabled).`));
 }
 var init_evalops2 = __esm2(() => {
+  init_agent_bootstrap();
   init_oauth();
   init_storage();
 });
@@ -170327,7 +171011,7 @@ async function handleCodexCommand(subcommand, _params = []) {
       await handleStatus4();
       return;
     default:
-      console.error(chalk63.red('Unknown codex subcommand. Try "maestro codex login", "logout", or "status".'));
+      console.error(chalk64.red('Unknown codex subcommand. Try "maestro codex login", "logout", or "status".'));
       process.exit(1);
   }
 }
@@ -170340,37 +171024,37 @@ async function promptCode() {
   }
 }
 async function handleLogin4() {
-  console.log(chalk63.bold("Maestro OpenAI Codex Login"));
+  console.log(chalk64.bold("Maestro OpenAI Codex Login"));
   await login("openai-codex", {
     onAuthUrl: (url) => {
-      console.log(chalk63.yellow("Open this URL in your browser to authenticate with OpenAI:"));
-      console.log(chalk63.underline(url));
+      console.log(chalk64.yellow("Open this URL in your browser to authenticate with OpenAI:"));
+      console.log(chalk64.underline(url));
     },
     onPromptCode: promptCode,
-    onStatus: (status) => console.log(chalk63.dim(status))
+    onStatus: (status) => console.log(chalk64.dim(status))
   });
-  console.log(chalk63.green("OpenAI Codex credentials saved successfully."));
-  console.log(chalk63.dim('Select provider "openai-codex" or a model like "openai-codex/gpt-5.5".'));
+  console.log(chalk64.green("OpenAI Codex credentials saved successfully."));
+  console.log(chalk64.dim('Select provider "openai-codex" or a model like "openai-codex/gpt-5.5".'));
 }
 async function handleLogout3() {
   await logout("openai-codex");
-  console.log(chalk63.green("Removed stored OpenAI Codex credentials."));
+  console.log(chalk64.green("Removed stored OpenAI Codex credentials."));
 }
 async function handleStatus4() {
   if (!hasOAuthCredentials("openai-codex")) {
-    console.log(chalk63.yellow("No stored OpenAI Codex credentials."));
-    console.log(chalk63.dim('Run "maestro codex login" to authenticate with OpenAI.'));
+    console.log(chalk64.yellow("No stored OpenAI Codex credentials."));
+    console.log(chalk64.dim('Run "maestro codex login" to authenticate with OpenAI.'));
     return;
   }
   const credentials = loadOAuthCredentials("openai-codex");
   const remainingMs = Math.max(0, (credentials?.expires ?? Date.now()) - Date.now());
   const minutes = Math.round(remainingMs / 6e4);
   const accountId = typeof credentials?.metadata?.accountId === "string" ? credentials.metadata.accountId : void 0;
-  console.log(chalk63.green("Stored OpenAI Codex credentials detected."));
+  console.log(chalk64.green("Stored OpenAI Codex credentials detected."));
   if (accountId) {
-    console.log(chalk63.dim(`ChatGPT account id: ${accountId}`));
+    console.log(chalk64.dim(`ChatGPT account id: ${accountId}`));
   }
-  console.log(chalk63.dim(`Access token expires in ~${minutes} minute${minutes === 1 ? "" : "s"} (auto-refresh enabled).`));
+  console.log(chalk64.dim(`Access token expires in ~${minutes} minute${minutes === 1 ? "" : "s"} (auto-refresh enabled).`));
 }
 var init_codex = __esm2(() => {
   init_oauth();
@@ -170382,8 +171066,8 @@ __export2(exports_hooks, {
 });
 async function handleHooksCommand(subcommand) {
   if (subcommand && subcommand !== "status") {
-    console.error(chalk64.red(`Unknown hooks subcommand: ${subcommand}`));
-    console.error(chalk64.dim("Try: maestro hooks status"));
+    console.error(chalk65.red(`Unknown hooks subcommand: ${subcommand}`));
+    console.error(chalk65.dim("Try: maestro hooks status"));
     process.exit(1);
   }
   cleanupAsyncHooks();
@@ -170395,10 +171079,10 @@ async function handleHooksCommand(subcommand) {
     ["Queued requests", concurrency.queued],
     ["Async in-flight", asyncInFlight]
   ];
-  console.log(chalk64.bold("Hook Status"));
+  console.log(chalk65.bold("Hook Status"));
   for (const [label, value] of rows) {
     const padded = label.padEnd(18);
-    console.log(`${chalk64.cyan(padded)} ${value}`);
+    console.log(`${chalk65.cyan(padded)} ${value}`);
   }
 }
 var init_hooks2 = __esm2(() => {
@@ -170410,8 +171094,8 @@ __export2(exports_session_transfer, {
   handleExportCommand: () => handleExportCommand
 });
 function exitWithUsage(message, usage) {
-  console.error(chalk65.red(message));
-  console.error(chalk65.dim(usage));
+  console.error(chalk66.red(message));
+  console.error(chalk66.dim(usage));
   process.exit(1);
 }
 async function handleExportCommand(sessionId, outputPath, format, options = {}) {
@@ -170429,7 +171113,7 @@ async function handleExportCommand(sessionId, outputPath, format, options = {})
   }
   const exportManager = new SessionManager(false, sessionFile);
   const exportedPath = normalizedFormat === JSON_FORMAT ? await exportSessionToJson(exportManager, outputPath, options) : await exportSessionToJsonl(exportManager, outputPath, options);
-  console.log(chalk65.green(`Exported session ${sessionId} to ${resolve59(exportedPath)} (${normalizedFormat}).`));
+  console.log(chalk66.green(`Exported session ${sessionId} to ${resolve59(exportedPath)} (${normalizedFormat}).`));
 }
 async function handleImportCommand(sourcePath) {
   if (!sourcePath) {
@@ -170437,8 +171121,8 @@ async function handleImportCommand(sourcePath) {
   }
   const sessionManager = new SessionManager(false);
   const imported = sessionManager.importPortableSession(sourcePath);
-  console.log(chalk65.green(imported.importedCount > 1 ? `Imported ${imported.importedCount} sessions from ${resolve59(sourcePath)}. Active session: ${imported.sessionId}.` : `Imported session ${imported.sessionId} from ${resolve59(sourcePath)}.`));
-  console.log(chalk65.dim(`Stored at ${imported.sessionFile}`));
+  console.log(chalk66.green(imported.importedCount > 1 ? `Imported ${imported.importedCount} sessions from ${resolve59(sourcePath)}. Active session: ${imported.sessionId}.` : `Imported session ${imported.sessionId} from ${resolve59(sourcePath)}.`));
+  console.log(chalk66.dim(`Stored at ${imported.sessionFile}`));
 }
 var JSONL_FORMAT = "jsonl";
 var JSON_FORMAT = "json";
@@ -170455,7 +171139,7 @@ __export2(exports_memory, {
 function getConfig() {
   const base = process.env.MAESTRO_SHARED_MEMORY_BASE?.trim();
   if (!base) {
-    console.error(chalk66.red("MAESTRO_SHARED_MEMORY_BASE is not set. Configure shared memory to use this command."));
+    console.error(chalk67.red("MAESTRO_SHARED_MEMORY_BASE is not set. Configure shared memory to use this command."));
     process.exit(1);
   }
   const apiKey = process.env.MAESTRO_SHARED_MEMORY_API_KEY?.trim();
@@ -170519,7 +171203,7 @@ async function printStatus(config2) {
     }
     printCapabilities(metrics.capabilities);
   } catch (error) {
-    console.error(chalk66.red(`Failed to fetch shared memory status: ${error instanceof Error ? error.message : String(error)}`));
+    console.error(chalk67.red(`Failed to fetch shared memory status: ${error instanceof Error ? error.message : String(error)}`));
     process.exit(1);
   }
 }
@@ -170557,7 +171241,7 @@ async function printAudit(config2, sessionId, limit) {
     const mode = entry2.mode ? String(entry2.mode) : "?";
     const events = entry2.event_count ? String(entry2.event_count) : "0";
     const source = entry2.source ? String(entry2.source) : "?";
-    console.log(`${chalk66.cyan(at)} ${separator()}${badge("mode", mode)}${separator()}${badge("events", events)}${separator()}${badge("source", source)}`);
+    console.log(`${chalk67.cyan(at)} ${separator()}${badge("mode", mode)}${separator()}${badge("events", events)}${separator()}${badge("source", source)}`);
   }
 }
 async function exportMetrics(config2, sessionId) {
@@ -170595,7 +171279,7 @@ async function handleMemoryCommand2(subcommand, args) {
     case "session": {
       const sessionId = args[0];
       if (!sessionId) {
-        console.error(chalk66.red("Session id required."));
+        console.error(chalk67.red("Session id required."));
         process.exit(1);
       }
       const config2 = getConfig();
@@ -170605,7 +171289,7 @@ async function handleMemoryCommand2(subcommand, args) {
     case "audit": {
       const sessionId = args[0];
       if (!sessionId) {
-        console.error(chalk66.red("Session id required."));
+        console.error(chalk67.red("Session id required."));
         process.exit(1);
       }
       const config2 = getConfig();
@@ -170616,7 +171300,7 @@ async function handleMemoryCommand2(subcommand, args) {
     case "export": {
       const sessionId = args[0];
       if (!sessionId) {
-        console.error(chalk66.red("Session id required."));
+        console.error(chalk67.red("Session id required."));
         process.exit(1);
       }
       const config2 = getConfig();
@@ -170636,22 +171320,22 @@ async function handleMemoryCommand2(subcommand, args) {
             await printStatus(config2);
           }
         } catch (error) {
-          console.error(chalk66.red(`Shared memory watch error: ${error instanceof Error ? error.message : String(error)}`));
+          console.error(chalk67.red(`Shared memory watch error: ${error instanceof Error ? error.message : String(error)}`));
         }
         await new Promise((resolve602) => setTimeout(resolve602, intervalMs));
       }
       return;
     }
     default:
-      console.error(chalk66.red(`Unknown memory subcommand: ${subcommand}`));
-      console.log(chalk66.dim(`
+      console.error(chalk67.red(`Unknown memory subcommand: ${subcommand}`));
+      console.log(chalk67.dim(`
 Available commands:`));
-      console.log(chalk66.dim("  maestro memory [status]"));
-      console.log(chalk66.dim("  maestro memory capabilities"));
-      console.log(chalk66.dim("  maestro memory session <id>"));
-      console.log(chalk66.dim("  maestro memory audit <id> [limit]"));
-      console.log(chalk66.dim("  maestro memory export <id>"));
-      console.log(chalk66.dim("  maestro memory watch [id] [intervalMs]"));
+      console.log(chalk67.dim("  maestro memory [status]"));
+      console.log(chalk67.dim("  maestro memory capabilities"));
+      console.log(chalk67.dim("  maestro memory session <id>"));
+      console.log(chalk67.dim("  maestro memory audit <id> [limit]"));
+      console.log(chalk67.dim("  maestro memory export <id>"));
+      console.log(chalk67.dim("  maestro memory watch [id] [intervalMs]"));
       process.exit(1);
   }
 }
@@ -171018,7 +171702,7 @@ async function attachToRemoteRunnerSession(input) {
   const beginAssistantOutput = () => {
     if (!visibleResponseOpen) {
       clearPromptLine(stdout2);
-      stdout2.write(chalk67.bold("assistant> "));
+      stdout2.write(chalk68.bold("assistant> "));
       visibleResponseOpen = true;
       responseEndsWithNewline = false;
     }
@@ -171033,7 +171717,7 @@ async function attachToRemoteRunnerSession(input) {
 `);
   };
   const printStatus2 = () => {
-    writeLine(chalk67.bold(`Remote session ${input.sessionId}`));
+    writeLine(chalk68.bold(`Remote session ${input.sessionId}`));
     writeLine(`  role: ${input.role}`);
     writeLine(`  ready: ${state2.is_ready ? "yes" : "no"}`);
     writeLine(`  responding: ${state2.is_responding ? "yes" : "no"}`);
@@ -171048,11 +171732,11 @@ async function attachToRemoteRunnerSession(input) {
   };
   const connection = await connectToRemoteRunnerSession(input);
   state2 = connection.state;
-  writeLine(chalk67.bold(`Attached to ${connection.sessionId} as ${connection.role === "viewer" ? "viewer" : "controller"}`));
+  writeLine(chalk68.bold(`Attached to ${connection.sessionId} as ${connection.role === "viewer" ? "viewer" : "controller"}`));
   if (connection.role === "controller") {
-    writeLine(chalk67.dim("Enter a prompt below. Use /status, /help, or /exit. Press Ctrl+C to interrupt an active response."));
+    writeLine(chalk68.dim("Enter a prompt below. Use /status, /help, or /exit. Press Ctrl+C to interrupt an active response."));
   } else {
-    writeLine(chalk67.dim("Viewer mode is read-only. Use /status or /exit."));
+    writeLine(chalk68.dim("Viewer mode is read-only. Use /status or /exit."));
   }
   const attachContext = {
     gatewayBaseUrl: input.gatewayBaseUrl,
@@ -171083,13 +171767,13 @@ async function attachToRemoteRunnerSession(input) {
           visibleResponseOpen = false;
           break;
         case "status":
-          writeLine(chalk67.dim(message.message));
+          writeLine(chalk68.dim(message.message));
           break;
         case "error":
-          writeLine(chalk67.red(message.message));
+          writeLine(chalk68.red(message.message));
           break;
         case "compaction":
-          writeLine(chalk67.dim(`Compacted remote history: ${message.summary}`));
+          writeLine(chalk68.dim(`Compacted remote history: ${message.summary}`));
           break;
         default:
           break;
@@ -171098,7 +171782,7 @@ async function attachToRemoteRunnerSession(input) {
     },
     onReset: (snapshotState) => {
       state2 = snapshotState;
-      writeLine(chalk67.dim("Remote session state resynced from snapshot."));
+      writeLine(chalk68.dim("Remote session state resynced from snapshot."));
       updates.notify();
     }
   }, streamAbort.signal).catch((error) => {
@@ -171132,15 +171816,15 @@ async function attachToRemoteRunnerSession(input) {
         return true;
       case "/interrupt":
         if (connection.role !== "controller") {
-          writeLine(chalk67.yellow("Viewer mode cannot interrupt the session."));
+          writeLine(chalk68.yellow("Viewer mode cannot interrupt the session."));
           return true;
         }
         if (!state2.is_responding) {
-          writeLine(chalk67.dim("No active response to interrupt."));
+          writeLine(chalk68.dim("No active response to interrupt."));
           return true;
         }
         await sendInteractiveMessage({ type: "interrupt" });
-        writeLine(chalk67.dim("Interrupt sent."));
+        writeLine(chalk68.dim("Interrupt sent."));
         return true;
       case "/exit":
       case "/quit":
@@ -171149,17 +171833,17 @@ async function attachToRemoteRunnerSession(input) {
         return true;
       default:
         if (line.startsWith("/")) {
-          writeLine(chalk67.yellow(`Unknown command: ${line}`));
+          writeLine(chalk68.yellow(`Unknown command: ${line}`));
           return true;
         }
         return false;
     }
   };
   const handleApproval2 = async (request) => {
-    writeLine(chalk67.yellow(`Approval required: ${formatRequestLabel(request)}`));
+    writeLine(chalk68.yellow(`Approval required: ${formatRequestLabel(request)}`));
     const summary2 = summarizeArgs(request.args);
     if (summary2) {
-      writeLine(chalk67.dim(summary2));
+      writeLine(chalk68.dim(summary2));
     }
     while (!closeRequested) {
       const answer = (await rl.question("Approve? [y/N]: ")).trim();
@@ -171201,10 +171885,10 @@ async function attachToRemoteRunnerSession(input) {
     }
   };
   const handleUserInput = async (request) => {
-    writeLine(chalk67.yellow(`Input requested: ${formatRequestLabel(request)}`));
+    writeLine(chalk68.yellow(`Input requested: ${formatRequestLabel(request)}`));
     const summary2 = summarizeArgs(request.args);
     if (summary2) {
-      writeLine(chalk67.dim(summary2));
+      writeLine(chalk68.dim(summary2));
     }
     while (!closeRequested) {
       const answer = await rl.question("Reply: ");
@@ -171231,10 +171915,10 @@ async function attachToRemoteRunnerSession(input) {
     }
   };
   const handleToolRetry2 = async (request) => {
-    writeLine(chalk67.yellow(`Tool retry requested: ${formatRequestLabel(request)}`));
+    writeLine(chalk68.yellow(`Tool retry requested: ${formatRequestLabel(request)}`));
     const summary2 = summarizeArgs(request.args);
     if (summary2) {
-      writeLine(chalk67.dim(summary2));
+      writeLine(chalk68.dim(summary2));
     }
     while (!closeRequested) {
       const answer = (await rl.question("Decision [retry/skip/abort]: ")).trim().toLowerCase();
@@ -171242,7 +171926,7 @@ async function attachToRemoteRunnerSession(input) {
         continue;
       }
       if (!["retry", "skip", "abort"].includes(answer)) {
-        writeLine(chalk67.yellow("Enter retry, skip, or abort."));
+        writeLine(chalk68.yellow("Enter retry, skip, or abort."));
         continue;
       }
       await sendInteractiveMessage({
@@ -171260,7 +171944,7 @@ async function attachToRemoteRunnerSession(input) {
         streamError = error instanceof Error ? error : new Error(String(error));
         updates.notify();
       });
-      writeLine(chalk67.dim("Interrupt sent."));
+      writeLine(chalk68.dim("Interrupt sent."));
       return;
     }
     closeRequested = true;
@@ -171302,7 +171986,7 @@ async function attachToRemoteRunnerSession(input) {
         continue;
       }
       if (connection.role !== "controller") {
-        writeLine(chalk67.yellow("Viewer mode is read-only."));
+        writeLine(chalk68.yellow("Viewer mode is read-only."));
         version3 = updates.current();
         continue;
       }
@@ -172156,7 +172840,7 @@ function printJson(value) {
   console.log(JSON.stringify(value, null, 2));
 }
 function printSession(session) {
-  console.log(chalk68.bold(session.id));
+  console.log(chalk69.bold(session.id));
   console.log(`  state:     ${stateLabel(session.state)}`);
   console.log(`  workspace: ${session.workspaceId ?? "-"}`);
   console.log(`  profile:   ${session.runnerProfile ?? "-"}`);
@@ -172170,7 +172854,7 @@ function printSession(session) {
 }
 function printSessionTable(sessions2) {
   if (!sessions2.length) {
-    console.log(chalk68.dim("No remote runner sessions found."));
+    console.log(chalk69.dim("No remote runner sessions found."));
     return;
   }
   const rows = sessions2.map((session) => ({
@@ -172219,21 +172903,21 @@ function printAttachInstructions(input) {
     });
     return;
   }
-  console.log(chalk68.bold(`Remote runner attach token minted for ${input.sessionId}`));
+  console.log(chalk69.bold(`Remote runner attach token minted for ${input.sessionId}`));
   console.log(`  gateway: ${input.gatewayBaseUrl}`);
   console.log(`  token:   ${input.tokenId}`);
   console.log(`  expires: ${input.expiresAt ?? "-"}`);
   if (input.verified) {
-    console.log(chalk68.green("  headless gateway: verified"));
+    console.log(chalk69.green("  headless gateway: verified"));
   }
   if (input.showSecret || !input.verified) {
     console.log("");
-    console.log(chalk68.dim("Ephemeral remote transport environment:"));
+    console.log(chalk69.dim("Ephemeral remote transport environment:"));
     console.log(`export MAESTRO_REMOTE_BASE_URL=${JSON.stringify(input.gatewayBaseUrl)}`);
     console.log(`export MAESTRO_REMOTE_API_KEY=${JSON.stringify(input.tokenSecret)}`);
     console.log(`export MAESTRO_REMOTE_HEADER_X_EVALOPS_RUNNER_ATTACH_TOKEN_ID=${JSON.stringify(input.tokenId)}`);
   } else {
-    console.log(chalk68.dim("  token secret hidden; rerun with --show-secret or --json when handoff needs it."));
+    console.log(chalk69.dim("  token secret hidden; rerun with --show-secret or --json when handoff needs it."));
   }
 }
 async function handleStart(options) {
@@ -172295,10 +172979,10 @@ async function handleStart(options) {
   }
   printSession(waitResult?.session ?? result.session);
   if (waitResult) {
-    console.log(chalk68.dim(`  ready:     ${formatElapsedMs(waitResult.elapsedMs)} (${waitResult.attempts} checks)`));
+    console.log(chalk69.dim(`  ready:     ${formatElapsedMs(waitResult.elapsedMs)} (${waitResult.attempts} checks)`));
   }
   if (result.replayed) {
-    console.log(chalk68.dim("  replayed:  existing idempotent request"));
+    console.log(chalk69.dim("  replayed:  existing idempotent request"));
   }
   console.log("");
   if (attachResult) {
@@ -172314,7 +172998,7 @@ async function handleStart(options) {
     });
     return;
   }
-  console.log(chalk68.dim(`Attach: maestro remote attach ${result.session.id}`));
+  console.log(chalk69.dim(`Attach: maestro remote attach ${result.session.id}`));
 }
 async function handleList2(options) {
   const result = await listRunnerSessions({
@@ -172329,7 +173013,7 @@ async function handleList2(options) {
   }
   printSessionTable(result.sessions);
   if (result.nextOffset !== void 0 && result.nextOffset > 0) {
-    console.log(chalk68.dim(`next offset: ${result.nextOffset}`));
+    console.log(chalk69.dim(`next offset: ${result.nextOffset}`));
   }
 }
 async function handleStatus5(options) {
@@ -172338,7 +173022,7 @@ async function handleStatus5(options) {
     printJson(status);
     return;
   }
-  console.log(chalk68.bold(status.service ?? "remote-runner"));
+  console.log(chalk69.bold(status.service ?? "remote-runner"));
   console.log(`  workspace: ${status.workspaceId ?? "-"}`);
   console.log(`  policy:    ${status.downstreamPolicy ?? "-"}`);
 }
@@ -172372,7 +173056,7 @@ async function handleEvents(options) {
     console.log(`${String(event.sequence ?? "-").padStart(4)}  ${event.occurredAt ?? "-"}  ${event.eventType ?? "-"}`);
   }
   if (!result.events.length) {
-    console.log(chalk68.dim("No remote runner events found."));
+    console.log(chalk69.dim("No remote runner events found."));
   }
 }
 async function handleStop(options) {
@@ -172471,7 +173155,7 @@ async function handleAttachToken(options) {
     printJson(minted);
     return;
   }
-  console.log(chalk68.bold(`Attach token for ${sessionId}`));
+  console.log(chalk69.bold(`Attach token for ${sessionId}`));
   console.log(`  gateway: ${minted.gatewayBaseUrl}`);
   console.log(`  token:   ${minted.token.id}`);
   console.log(`  secret:  ${minted.tokenSecret}`);
@@ -172488,7 +173172,7 @@ async function handleRevokeToken(options) {
     printJson(result);
     return;
   }
-  console.log(chalk68.bold(`Revoked attach token ${result.token.id}`));
+  console.log(chalk69.bold(`Revoked attach token ${result.token.id}`));
 }
 async function handleTarget(options) {
   const sessionId = options.positionals[0];
@@ -172552,7 +173236,7 @@ async function handleRemoteCommand(subcommand, args = []) {
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    console.error(chalk68.red(message));
+    console.error(chalk69.red(message));
     process.exitCode = 1;
   }
 }
@@ -172604,24 +173288,24 @@ async function handleAnthropicCommand(subcommand, params = []) {
       await handleStatus6();
       return;
     default:
-      console.error(chalk69.red('Unknown anthropic subcommand. Try "maestro anthropic login", "logout", or "status".'));
+      console.error(chalk70.red('Unknown anthropic subcommand. Try "maestro anthropic login", "logout", or "status".'));
       process.exit(1);
   }
 }
 async function handleLogin5(mode) {
-  console.log(chalk69.bold("Maestro Claude Code login"));
+  console.log(chalk70.bold("Maestro Claude Code login"));
   const { url, verifier } = await generateAnthropicLoginUrl(mode);
-  console.log(chalk69.gray(url));
+  console.log(chalk70.gray(url));
   const rl = createInterface4({ input: stdin, output: stdout });
   const code = (await rl.question("2. Paste the code shown in the browser: "))?.trim();
   rl.close();
   if (!code) {
-    console.error(chalk69.red("Authorization code is required."));
+    console.error(chalk70.red("Authorization code is required."));
     process.exit(1);
   }
   const tokens = await exchangeAnthropicAuthorizationCode(code, verifier);
   if (!tokens) {
-    console.error(chalk69.red("Failed to exchange the authorization code. Please try again."));
+    console.error(chalk70.red("Failed to exchange the authorization code. Please try again."));
     process.exit(1);
   }
   await saveAnthropicOAuthCredential({
@@ -172630,27 +173314,27 @@ async function handleLogin5(mode) {
     expiresAt: tokens.expiresAt,
     mode
   });
-  console.log(chalk69.green("Claude Code credentials saved."));
-  console.log(chalk69.dim("Future runs can use --auth claude or set it as default. Credentials refresh automatically."));
+  console.log(chalk70.green("Claude Code credentials saved."));
+  console.log(chalk70.dim("Future runs can use --auth claude or set it as default. Credentials refresh automatically."));
 }
 async function handleLogout4() {
   await deleteAnthropicOAuthCredential();
-  console.log(chalk69.green("Removed stored Claude Code credentials."));
+  console.log(chalk70.green("Removed stored Claude Code credentials."));
 }
 async function handleStatus6() {
   const stored = await getStoredAnthropicOAuthCredential();
   if (!stored) {
-    console.log(chalk69.yellow("No stored Claude Code credentials."));
-    console.log(chalk69.dim('Run "maestro anthropic login" to link a Claude Pro/Max subscription.'));
+    console.log(chalk70.yellow("No stored Claude Code credentials."));
+    console.log(chalk70.dim('Run "maestro anthropic login" to link a Claude Pro/Max subscription.'));
     return;
   }
   const remainingMs = Math.max(0, stored.expiresAt - Date.now());
   const minutes = Math.round(remainingMs / 6e4);
-  console.log(chalk69.green("Stored Claude Code credentials detected."));
-  console.log(chalk69.dim(`Access token expires in ~${minutes} minute${minutes === 1 ? "" : "s"} (auto-refresh enabled).`));
+  console.log(chalk70.green("Stored Claude Code credentials detected."));
+  console.log(chalk70.dim(`Access token expires in ~${minutes} minute${minutes === 1 ? "" : "s"} (auto-refresh enabled).`));
   const fresh = await getFreshAnthropicOAuthCredential();
   if (fresh) {
-    console.log(chalk69.dim(`Beta headers applied: ${CLAUDE_CODE_BETA_HEADER}`));
+    console.log(chalk70.dim(`Beta headers applied: ${CLAUDE_CODE_BETA_HEADER}`));
   }
 }
 var init_anthropic3 = __esm2(() => {
@@ -172718,7 +173402,7 @@ async function handleCostSummary(period) {
         badge("tok", formatTokens(data.tokens), "info"),
         badge("cost", `$${data.cost.toFixed(4)}`, "warn")
       ];
-      console.log(`  ${chalk70.cyan(provider.padEnd(16))} ${metrics.join(separator())}`);
+      console.log(`  ${chalk71.cyan(provider.padEnd(16))} ${metrics.join(separator())}`);
     }
     console.log();
   }
@@ -172730,7 +173414,7 @@ async function handleCostSummary(period) {
         badge("req", data.requests.toString(), "info"),
         badge("cost", `$${data.cost.toFixed(4)}`, "warn")
       ];
-      console.log(`  ${chalk70.dim(model.padEnd(32))} ${detail.join(separator())}`);
+      console.log(`  ${chalk71.dim(model.padEnd(32))} ${detail.join(separator())}`);
     }
     if (Object.keys(summary2.byModel).length > 10) {
       console.log(muted(`  ... and ${Object.keys(summary2.byModel).length - 10} more models`));
@@ -172745,7 +173429,7 @@ async function handleCostClear() {
     input: process.stdin,
     output: process.stdout
   });
-  const confirm = await rl.question(chalk70.yellow("Are you sure you want to clear all usage data? (y/N): "));
+  const confirm = await rl.question(chalk71.yellow("Are you sure you want to clear all usage data? (y/N): "));
   rl.close();
   if (confirm.toLowerCase() === "y") {
     clearUsage();
@@ -172776,7 +173460,7 @@ async function handleCostBreakdown() {
       badge("cost", `$${data.cost.toFixed(4)}`, "warn"),
       contextualBadge("share", share, { warn: 30, danger: 50 })
     ];
-    console.log(`  ${chalk70.cyan(provider.padEnd(16))} ${metrics.join(separator())}`);
+    console.log(`  ${chalk71.cyan(provider.padEnd(16))} ${metrics.join(separator())}`);
   }
   console.log();
   console.log(`  ${badge("Total requests", summary2.totalRequests.toLocaleString(), "info")} ${separator()} ${badge("Total tokens", summary2.totalTokens.toLocaleString(), "info")} ${separator()} ${badge("Total cost", `$${summary2.totalCost.toFixed(4)}`, "warn")}`);
@@ -172884,7 +173568,7 @@ function renderProviderBreakdown(byProvider) {
       badge("tok", formatTokens2(data.tokens), "info"),
       badge("cost", `$${data.cost.toFixed(4)}`, "warn")
     ];
-    console.log(`  ${chalk71.cyan(provider.padEnd(16))} ${metrics.join(separator())}`);
+    console.log(`  ${chalk72.cyan(provider.padEnd(16))} ${metrics.join(separator())}`);
   }
   console.log();
 }
@@ -172899,7 +173583,7 @@ function renderModelBreakdown(byModel) {
       badge("tok", formatTokens2(data.tokens), "info"),
       badge("cost", `$${data.cost.toFixed(4)}`, "warn")
     ];
-    console.log(`  ${chalk71.dim(model.padEnd(32))} ${metrics.join(separator())}`);
+    console.log(`  ${chalk72.dim(model.padEnd(32))} ${metrics.join(separator())}`);
   }
   console.log();
 }
@@ -172914,7 +173598,7 @@ function renderSessionBreakdown(entries) {
       badge("tok", formatTokens2(session.tokens), "info"),
       badge("cost", `$${session.cost.toFixed(4)}`, "warn")
     ];
-    console.log(`  ${chalk71.dim(session.sessionId.padEnd(32))} ${metrics.join(separator())}`);
+    console.log(`  ${chalk72.dim(session.sessionId.padEnd(32))} ${metrics.join(separator())}`);
   }
   console.log();
 }
@@ -172971,7 +173655,7 @@ function formatSource(model) {
 }
 function printModelEntry(model) {
   const localBadge = model.isLocal ? ` ${badge("local", void 0, "warn")}` : "";
-  console.log(`  \u2022 ${chalk72.bold(model.id)} ${separator()} ${muted(model.name)}`);
+  console.log(`  \u2022 ${chalk73.bold(model.id)} ${separator()} ${muted(model.name)}`);
   console.log(`    ${formatReasoning(model)}${separator()}${badge("context", model.contextWindow.toLocaleString())}${separator()}${badge("max", model.maxTokens.toLocaleString())}${separator()}${formatSource(model)}${localBadge}`);
   console.log(muted(`    ${model.baseUrl}`));
 }
@@ -172984,7 +173668,7 @@ function filterModels(providerFilter) {
 }
 function printEmptyState(providerFilter) {
   if (providerFilter) {
-    console.error(chalk72.red(`No models registered for provider "${providerFilter}".`));
+    console.error(chalk73.red(`No models registered for provider "${providerFilter}".`));
   } else {
     console.log(badge("No models registered", void 0, "warn"));
   }
@@ -173017,7 +173701,7 @@ async function handleModelsList(providerFilter) {
       continue;
     entries.sort((a, b) => a.id.localeCompare(b.id));
     const providerLabel = entries[0]?.providerName ?? provider;
-    console.log(`${chalk72.cyan(provider)} ${separator()} ${badge("models", String(entries.length))}`);
+    console.log(`${chalk73.cyan(provider)} ${separator()} ${badge("models", String(entries.length))}`);
     console.log(muted(`  ${providerLabel}`));
     for (const model of entries) {
       printModelEntry(model);
@@ -173076,7 +173760,7 @@ async function handleModelsProviders(providerFilter) {
     if (entry2.custom > 0)
       sourceSummary.push(`${entry2.custom} custom`);
     const localLabel = entry2.localCount ? `${entry2.localCount} local endpoint${entry2.localCount === 1 ? "" : "s"}` : "no local endpoints";
-    console.log(`${chalk72.cyan(provider)} ${separator()} ${badge("models", String(entry2.total))}`);
+    console.log(`${chalk73.cyan(provider)} ${separator()} ${badge("models", String(entry2.total))}`);
     console.log(muted(`  ${entry2.name} (${sourceSummary.join(", ") || "0 models"})`));
     console.log(muted(`  ${localLabel}`));
     const envLabel = envVars.length ? envVars.join(", ") : "(custom or not configured)";
@@ -173116,7 +173800,7 @@ async function resolveModelFromArgs(params) {
     if (maybeProvider && maybeModelId && !maybeProvider.includes(".")) {
       provider = maybeProvider;
       modelId = maybeModelId;
-      console.log(chalk73.dim(`Parsed model: ${parsedModel} \u2192 ${provider}/${modelId}`));
+      console.log(chalk74.dim(`Parsed model: ${parsedModel} \u2192 ${provider}/${modelId}`));
     }
   }
   if (modelId && !provider) {
@@ -173124,14 +173808,14 @@ async function resolveModelFromArgs(params) {
     if (resolved) {
       provider = resolved.provider;
       modelId = resolved.modelId;
-      console.log(chalk73.dim(`Using alias: ${parsedModel} \u2192 ${provider}/${modelId}`));
+      console.log(chalk74.dim(`Using alias: ${parsedModel} \u2192 ${provider}/${modelId}`));
     }
   }
   if (modelId && !provider) {
     const foundModel = findModelById(modelId);
     if (foundModel) {
       provider = foundModel.provider;
-      console.log(chalk73.dim(`Found model: ${modelId} (provider: ${provider})`));
+      console.log(chalk74.dim(`Found model: ${modelId} (provider: ${provider})`));
     }
   }
   if (!provider || !modelId) {
@@ -174169,7 +174853,7 @@ async function createToolsAndSandbox(params) {
       throw new Error(`No valid tools matched --tools filter: ${parsedTools.join(", ")}. Available tools: ${Object.keys(toolRegistry).sort().join(", ")}`);
     }
     baseTools = filteredTools;
-    console.log(chalk74.dim(`Tools restricted to: ${filteredTools.map((t2) => t2.name).join(", ")}`));
+    console.log(chalk75.dim(`Tools restricted to: ${filteredTools.map((t2) => t2.name).join(", ")}`));
   }
   const inlineTools = loadInlineTools();
   const allTools = [...baseTools, ...inlineTools];
@@ -174276,12 +174960,12 @@ function createAgentInstance(params) {
   if (params.readonly) {
     const success = composerManager.activate("explore", cwd);
     if (!success) {
-      console.warn(chalk75.yellow('Warning: Could not activate read-only mode. The "explore" composer may not be available.'));
+      console.warn(chalk76.yellow('Warning: Could not activate read-only mode. The "explore" composer may not be available.'));
     }
   } else if (params.composer) {
     const success = composerManager.activate(params.composer, cwd);
     if (!success) {
-      console.warn(chalk75.yellow(`Warning: Could not activate composer "${params.composer}". Check that it exists.`));
+      console.warn(chalk76.yellow(`Warning: Could not activate composer "${params.composer}". Check that it exists.`));
     }
   }
   return { agent };
@@ -174514,7 +175198,7 @@ async function restoreSessionState(params) {
     const messages = sessionManager.loadMessages();
     if (messages.length > 0) {
       if (shouldPrintMessages) {
-        console.log(chalk76.dim(`Loaded ${messages.length} messages from previous session`));
+        console.log(chalk77.dim(`Loaded ${messages.length} messages from previous session`));
       }
       agent.replaceMessages(messages);
     }
@@ -174528,32 +175212,32 @@ async function restoreSessionState(params) {
             agent.setModel(restoredModel);
           }
           if (shouldPrintMessages) {
-            console.log(chalk76.dim(`Restored model: ${savedModel}`));
+            console.log(chalk77.dim(`Restored model: ${savedModel}`));
           }
         } catch (error) {
           if (shouldPrintMessages) {
             const message = error instanceof Error ? error.message : String(error);
-            console.error(chalk76.yellow(`Warning: Could not restore model ${savedModel}: ${message}`));
+            console.error(chalk77.yellow(`Warning: Could not restore model ${savedModel}: ${message}`));
           }
         }
       } else if (shouldPrintMessages) {
-        console.error(chalk76.yellow(`Warning: Could not restore model ${savedModel}: unknown provider`));
+        console.error(chalk77.yellow(`Warning: Could not restore model ${savedModel}: unknown provider`));
       }
     }
     const thinkingLevel = sessionManager.loadThinkingLevel();
     if (thinkingLevel) {
       agent.setThinkingLevel(thinkingLevel);
       if (shouldPrintMessages) {
-        console.log(chalk76.dim(`Restored thinking level: ${thinkingLevel}`));
+        console.log(chalk77.dim(`Restored thinking level: ${thinkingLevel}`));
       }
     }
   }
   if (shouldPrintMessages && !isContinueOrResume) {
     const contextFiles = loadProjectContextFiles();
     if (contextFiles.length > 0) {
-      console.log(chalk76.dim("Loaded project context from:"));
+      console.log(chalk77.dim("Loaded project context from:"));
       for (const { path: filePath } of contextFiles) {
-        console.log(chalk76.dim(`  - ${filePath}`));
+        console.log(chalk77.dim(`  - ${filePath}`));
       }
     }
   }
@@ -174561,7 +175245,7 @@ async function restoreSessionState(params) {
   if (models && models.length > 0) {
     scopedModels = resolveModelScope(models);
     if (scopedModels.length === 0 && shouldPrintMessages) {
-      console.log(chalk76.yellow(`Warning: --models patterns (${models.join(", ")}) did not match any registered models`));
+      console.log(chalk77.yellow(`Warning: --models patterns (${models.join(", ")}) did not match any registered models`));
     }
   }
   let startupChangelogSummary = null;
@@ -174834,13 +175518,13 @@ function setupEventSubscriptions(params) {
           const sessions2 = sessionManager.loadAllSessions();
           activeCount = sessions2.filter((s2) => Date.now() - s2.modified.getTime() < 60 * 60 * 1e3).length;
         } catch (error) {
-          console.error(chalk77.yellow(`[Policy] Failed to count active sessions: ${error instanceof Error ? error.message : String(error)}`));
+          console.error(chalk78.yellow(`[Policy] Failed to count active sessions: ${error instanceof Error ? error.message : String(error)}`));
         }
         const limitCheck = checkSessionLimits({ startedAt: /* @__PURE__ */ new Date() }, activeCount !== void 0 ? { activeSessionCount: activeCount + 1 } : void 0);
         if (!limitCheck.allowed) {
           const msg = `
 [Policy] ${limitCheck.reason}`;
-          console.error(chalk77.red(msg));
+          console.error(chalk78.red(msg));
           process.exit(1);
         }
         sessionManager.startSession(agent.state);
@@ -175146,7 +175830,7 @@ async function main(args) {
     process.exit(0);
   }
   if (parsed.error) {
-    console.error(chalk78.red(parsed.error));
+    console.error(chalk79.red(parsed.error));
     process.exit(1);
   }
   if (parsed.command === "hosted-runner") {
@@ -175158,7 +175842,7 @@ async function main(args) {
   }
   if (parsed.command === "web") {
     if (parsed.messages.length > 0) {
-      console.error(chalk78.red("`maestro web` does not accept prompt arguments. Use `maestro` (interactive) or `maestro exec` instead."));
+      console.error(chalk79.red("`maestro web` does not accept prompt arguments. Use `maestro` (interactive) or `maestro exec` instead."));
       process.exit(1);
     }
     const { startWebServer: startWebServer2 } = await Promise.resolve().then(() => (init_web_server(), exports_web_server));
@@ -175201,7 +175885,7 @@ async function main(args) {
       process.stderr.write(`${stack ?? message}
 `);
     } else {
-      console.error(chalk78.red(message));
+      console.error(chalk79.red(message));
     }
     process.exit(1);
   };
@@ -175284,7 +175968,7 @@ async function main(args) {
   startupProfiler.checkpoint("runtime:prepared");
   const frameworkWarning = validateFrameworkPreference();
   if (frameworkWarning) {
-    console.warn(chalk78.yellow(`Framework preference warning: ${frameworkWarning}`));
+    console.warn(chalk79.yellow(`Framework preference warning: ${frameworkWarning}`));
   }
   if (parsed.command === "config") {
     const {
@@ -175307,13 +175991,13 @@ async function main(args) {
         await handleConfigLocal2();
         return;
       default:
-        console.error(chalk78.red(`Unknown config subcommand: ${parsed.subcommand || "(none)"}`));
-        console.log(chalk78.dim(`
+        console.error(chalk79.red(`Unknown config subcommand: ${parsed.subcommand || "(none)"}`));
+        console.log(chalk79.dim(`
 Available commands:`));
-        console.log(chalk78.dim("  maestro config validate  - Validate configuration"));
-        console.log(chalk78.dim("  maestro config show      - Show configuration details"));
-        console.log(chalk78.dim("  maestro config init      - Initialize configuration"));
-        console.log(chalk78.dim("  maestro config local     - Manage local providers"));
+        console.log(chalk79.dim("  maestro config validate  - Validate configuration"));
+        console.log(chalk79.dim("  maestro config show      - Show configuration details"));
+        console.log(chalk79.dim("  maestro config init      - Initialize configuration"));
+        console.log(chalk79.dim("  maestro config local     - Manage local providers"));
         process.exit(1);
     }
   }
@@ -175324,7 +176008,12 @@ Available commands:`));
   }
   if (parsed.command === "evalops") {
     const { handleEvalOpsCommand: handleEvalOpsCommand2 } = await Promise.resolve().then(() => (init_evalops2(), exports_evalops));
-    await handleEvalOpsCommand2(parsed.subcommand);
+    await handleEvalOpsCommand2(parsed.subcommand, parsed.commandArgs ?? []);
+    return;
+  }
+  if (parsed.command === "init") {
+    const { handleInitCommand: handleInitCommand3 } = await Promise.resolve().then(() => (init_init(), exports_init));
+    await handleInitCommand3(parsed.commandArgs ?? []);
     return;
   }
   if (parsed.command === "codex") {
@@ -175382,16 +176071,16 @@ Available commands:`));
         await handleCostSummary2("today");
         return;
       default:
-        console.error(chalk78.red(`Unknown cost subcommand: ${parsed.subcommand}`));
-        console.log(chalk78.dim(`
+        console.error(chalk79.red(`Unknown cost subcommand: ${parsed.subcommand}`));
+        console.log(chalk79.dim(`
 Available commands:`));
-        console.log(chalk78.dim("  maestro cost [today]     - Show today's costs (default)"));
-        console.log(chalk78.dim("  maestro cost yesterday   - Show yesterday's costs"));
-        console.log(chalk78.dim("  maestro cost week        - Show last 7 days"));
-        console.log(chalk78.dim("  maestro cost month       - Show last 30 days"));
-        console.log(chalk78.dim("  maestro cost all         - Show all time costs"));
-        console.log(chalk78.dim("  maestro cost breakdown   - Detailed breakdown"));
-        console.log(chalk78.dim("  maestro cost clear       - Clear usage data"));
+        console.log(chalk79.dim("  maestro cost [today]     - Show today's costs (default)"));
+        console.log(chalk79.dim("  maestro cost yesterday   - Show yesterday's costs"));
+        console.log(chalk79.dim("  maestro cost week        - Show last 7 days"));
+        console.log(chalk79.dim("  maestro cost month       - Show last 30 days"));
+        console.log(chalk79.dim("  maestro cost all         - Show all time costs"));
+        console.log(chalk79.dim("  maestro cost breakdown   - Detailed breakdown"));
+        console.log(chalk79.dim("  maestro cost clear       - Clear usage data"));
         process.exit(1);
     }
   }
@@ -175412,15 +176101,15 @@ Available commands:`));
         });
         return;
       default:
-        console.error(chalk78.red(`Unknown stats subcommand: ${parsed.subcommand}`));
-        console.log(chalk78.dim(`
+        console.error(chalk79.red(`Unknown stats subcommand: ${parsed.subcommand}`));
+        console.log(chalk79.dim(`
 Available commands:`));
-        console.log(chalk78.dim("  maestro stats              - Show last 7 days"));
-        console.log(chalk78.dim("  maestro stats --session <id> - Show one session"));
-        console.log(chalk78.dim("  maestro stats today        - Show today"));
-        console.log(chalk78.dim("  maestro stats month        - Show last 30 days"));
-        console.log(chalk78.dim("  maestro stats all          - Show all time"));
-        console.log(chalk78.dim("  maestro stats --format json|csv - Export usage data"));
+        console.log(chalk79.dim("  maestro stats              - Show last 7 days"));
+        console.log(chalk79.dim("  maestro stats --session <id> - Show one session"));
+        console.log(chalk79.dim("  maestro stats today        - Show today"));
+        console.log(chalk79.dim("  maestro stats month        - Show last 30 days"));
+        console.log(chalk79.dim("  maestro stats all          - Show all time"));
+        console.log(chalk79.dim("  maestro stats --format json|csv - Export usage data"));
         process.exit(1);
     }
   }
@@ -175436,11 +176125,11 @@ Available commands:`));
         await handleModelsList2(providerFilter);
         return;
       default:
-        console.error(chalk78.red(`Unknown models subcommand: ${parsed.subcommand || "(none)"}`));
-        console.log(chalk78.dim(`
+        console.error(chalk79.red(`Unknown models subcommand: ${parsed.subcommand || "(none)"}`));
+        console.log(chalk79.dim(`
 Available commands:`));
-        console.log(chalk78.dim("  maestro models list             - List registered models"));
-        console.log(chalk78.dim("  maestro models providers        - Summarize providers"));
+        console.log(chalk79.dim("  maestro models list             - List registered models"));
+        console.log(chalk79.dim("  maestro models providers        - Summarize providers"));
         process.exit(1);
     }
   }
@@ -175449,7 +176138,7 @@ Available commands:`));
   if (parsed.command === "agents") {
     const { buildAgentsInitPrompt: buildAgentsInitPrompt2, handleAgentsInit: handleAgentsInit2 } = await Promise.resolve().then(() => (init_agents(), exports_agents));
     if (parsed.subcommand && parsed.subcommand !== "init") {
-      console.error(chalk78.red(`Unknown agents subcommand: ${parsed.subcommand}. Try "maestro agents init"`));
+      console.error(chalk79.red(`Unknown agents subcommand: ${parsed.subcommand}. Try "maestro agents init"`));
       process.exit(1);
     }
     try {
@@ -175462,7 +176151,7 @@ Available commands:`));
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to initialize AGENTS.md";
-      console.error(chalk78.red(message));
+      console.error(chalk79.red(message));
       process.exit(1);
     }
   }
@@ -175474,14 +176163,14 @@ Available commands:`));
     if (parsed.execResumeId) {
       targetPath = sessionManager.getSessionFileById(parsed.execResumeId);
       if (!targetPath) {
-        console.error(chalk78.red(`No session found with id ${parsed.execResumeId}.`));
+        console.error(chalk79.red(`No session found with id ${parsed.execResumeId}.`));
         process.exit(1);
       }
     } else if (parsed.execUseLast) {
       const sessions2 = sessionManager.loadAllSessions();
       const lastExec = sessions2.find((session) => session.summary?.startsWith(EXEC_SESSION_SUMMARY_PREFIX));
       if (!lastExec) {
-        console.error(chalk78.red("No previous maestro exec sessions were found."));
+        console.error(chalk79.red("No previous maestro exec sessions were found."));
         process.exit(1);
       }
       targetPath = lastExec.path;
@@ -175497,7 +176186,7 @@ Available commands:`));
   if (parsed.resume) {
     const selectedSession = await selectSession(sessionManager);
     if (!selectedSession) {
-      console.log(chalk78.dim("No session selected"));
+      console.log(chalk79.dim("No session selected"));
       return;
     }
     sessionManager.setSessionFile(selectedSession);
@@ -175618,10 +176307,10 @@ Available commands:`));
   const shouldPrintMessages = (isInteractive || mode === "text") && mode !== "headless" && !parsed.headless;
   const isGitRepository = isInsideGitRepository();
   if (sandbox && shouldPrintMessages) {
-    console.log(chalk78.dim(`Sandbox enabled (mode: ${sandboxMode})`));
+    console.log(chalk79.dim(`Sandbox enabled (mode: ${sandboxMode})`));
   }
   if (approvalModeOverride === "auto" && !isGitRepository && shouldPrintMessages) {
-    console.log(chalk78.yellow("Auto approval is enabled outside a git repository. Changes will not be version controlled."));
+    console.log(chalk79.yellow("Auto approval is enabled outside a git repository. Changes will not be version controlled."));
   }
   const shouldRestoreSession = parsed.continue || parsed.resume || execResumeApplied;
   const isFreshInteractiveSession = isInteractive && !shouldRestoreSession && mode !== "rpc";
@@ -175686,9 +176375,9 @@ Available commands:`));
       const targetPath = agentsInitPath ?? "AGENTS.md";
       const displayPath = targetPath.startsWith(cwd) && targetPath !== cwd ? `.${targetPath.slice(cwd.length)}` : targetPath;
       const runMode = mode === "rpc" || mode === "headless" ? "text" : mode;
-      console.log(chalk78.green(`Drafting AGENTS.md at ${displayPath}...`));
+      console.log(chalk79.green(`Drafting AGENTS.md at ${displayPath}...`));
       await runSingleShotMode(agent, sessionManager, [agentsInitPrompt], runMode);
-      console.log(chalk78.dim(`AGENTS.md generated at ${displayPath}`));
+      console.log(chalk79.dim(`AGENTS.md generated at ${displayPath}`));
     } else if (mode === "headless" || parsed.headless) {
       startupProfiler.terminal("headless:ready");
       await runHeadlessMode(agent, sessionManager, approvalService, toolRetryService);