@mutagent/cli 0.1.397 → 0.1.398

package/dist/bin/cli.js

@@ -454,7 +454,7 @@ ${String(data.length)} result(s)`));
   }
 }
 function createSpinner(text, isJson) {
-  if (isJson) {
+  if (isJson || !process.stderr.isTTY || process.env.CI === "true") {
     const noop = () => {
       return;
     };
@@ -583,7 +583,7 @@ var init_errors = __esm(() => {
     notSignedInOrNoWorkspace: 3
   };
   KEY_REJECTED_CODES = new Set(["AUTH_EXPIRED", "INVALID_API_KEY", "FOREIGN_API_KEY", "API_401", "SANDBOX_TOKEN_REFUSED"]);
-  NOT_SIGNED_IN_CODES = new Set(["AUTH_REQUIRED", "WORKSPACE_REQUIRED", "SANDBOX_WORKSPACE_FORBIDDEN"]);
+  NOT_SIGNED_IN_CODES = new Set(["AUTH_REQUIRED", "WORKSPACE_REQUIRED"]);
   MutagentError = class MutagentError extends Error {
     code;
     suggestion;
@@ -673,8 +673,8 @@ var init_errors = __esm(() => {
     }
   };
   NotFoundError = class NotFoundError extends MutagentError {
-    constructor(resource, id) {
-      super("NOT_FOUND", `${resource} not found: ${id}`, `Check the ID and try again. List available ${resource.toLowerCase()}s with the appropriate list command.`);
+    constructor(resource, id, listCommand) {
+      super("NOT_FOUND", `${resource} not found: ${id}`, listCommand === undefined ? `Check the ID and try again. List available ${resource.toLowerCase()}s with the appropriate list command.` : `Run: ${listCommand}`);
     }
   };
 });
@@ -909,6 +909,7 @@ var init_config = __esm(() => {
 // src/lib/organization-scope.ts
 var exports_organization_scope = {};
 __export(exports_organization_scope, {
+  workspaceDenied: () => workspaceDenied,
   unreachableServerError: () => unreachableServerError,
   tenancyHeaders: () => tenancyHeaders,
   tenancyFailure: () => tenancyFailure,
@@ -968,18 +969,20 @@ function parseBody(body) {
 function deadKeyError() {
   return new TenancyError("AUTH_EXPIRED", "Your CLI key expired or was revoked.", "Run: mutagent login");
 }
+function workspaceDenied(ctx) {
+  const shown = ctx.workspaceName ?? ctx.workspaceId ?? "workspace";
+  if (ctx.workspaceOrigin === "selection") {
+    return new TenancyError(TENANCY_DENIED, `Your saved workspace ${shown} is no longer available to you.`, "Run: mutagent workspaces use <name>");
+  }
+  const where = ctx.organizationName ? ` in ${ctx.organizationName}` : "";
+  return new TenancyError(TENANCY_DENIED, `No workspace "${shown}" among your workspaces${where}.`, "See: mutagent workspaces list");
+}
 function tenancyFailure(status, body, ctx) {
   const parsed = parseBody(body);
   if (status === 401)
     return deadKeyError();
-  if (status === 403 && parsed.code === TENANCY_DENIED) {
-    const shown = ctx.workspaceName ?? ctx.workspaceId ?? "workspace";
-    if (ctx.workspaceOrigin === "selection") {
-      return new TenancyError(TENANCY_DENIED, `Your saved workspace ${shown} is no longer available to you.`, "Run: mutagent workspaces use <name>");
-    }
-    const where = ctx.organizationName ? ` in ${ctx.organizationName}` : "";
-    return new TenancyError(TENANCY_DENIED, `No workspace "${shown}" among your workspaces${where}.`, "See: mutagent workspaces list");
-  }
+  if (status === 403 && parsed.code === TENANCY_DENIED)
+    return workspaceDenied(ctx);
   if (status === 403 && ctx.keyScope === "workspace" && ctx.workspaceOrigin === "override") {
     return new TenancyError("WORKSPACE_KEY_MISMATCH", "This API key only works in its own workspace.", "Run: mutagent login (for a key that can switch workspaces)");
   }
@@ -18095,6 +18098,15 @@ async function deployFrozenAgent(api, source2, built, options) {
     };
   }, recovery);
 }
+function listStatus(agent, slots) {
+  if (agent.status === "archived" || agent.archivedAt !== null)
+    return "archived";
+  if (slots.some((slot) => slot.enabled && slot.activeRevision !== null))
+    return "active";
+  if (slots.length > 0 && slots.every((slot) => !slot.enabled))
+    return "retired";
+  return "stored";
+}
 async function listRemoteAgents(api, options) {
   const page = await api.listAgents({
     limit: Number(options.limit ?? 20),
@@ -18105,7 +18117,7 @@ async function listRemoteAgents(api, options) {
     agents: page.data.map((agent) => ({
       slug: agent.slug,
       model: agent.model,
-      status: agent.status,
+      status: listStatus(agent, agent.deployments),
       slots: agent.deployments.map((slot) => `${slot.environment ?? "(default)"}=${slot.enabled ? slot.activeRevision === null ? "none" : `v${String(slot.activeRevision)}` : "retired"}`).join(", ")
     })),
     data: page.data,
@@ -18284,6 +18296,8 @@ this is the only way back from retire. An archived managed agent is refused
 (409 MANAGED_AGENT_ARCHIVED): deploy its agent.md again to bring it back.
 Example: mutagent agent activate invoice-pricing --revision v2 --env prod --json`,
   list: `Lists the workspace's managed agents with each slot's active revision.
+STATUS is what the slots say: active (a slot runs a revision), retired (every
+slot retired), stored (nothing active yet) or archived.
 Archived agents are left out unless --include-archived.
 Example: mutagent agent list --json`,
   inspect: `Shows a managed agent's revisions (newest first), its slots and the sessions
@@ -18316,7 +18330,9 @@ var DIRECTIVES = {
   --idempotency-key; a new key is a new request. A 409 on generation means the slot
   changed: inspect it before retrying.`,
   list: `  Read-only. --json prints { agents, data, nextCursor }; pass nextCursor as --cursor for
-  the next page. Archived agents appear only with --include-archived.`,
+  the next page. agents[].status is derived from the slots (active | retired | stored |
+  archived); data[].status is the agent record's own lifecycle field. Archived agents
+  appear only with --include-archived.`,
   inspect: `  Read-only. --json prints the agent, its revisions (nextCursor for --cursor), its
   slots and the sessions launched from it with their references. --operation <id>
   prints the recorded outcome of one deploy or activate instead.`,
@@ -19255,6 +19271,32 @@ function registerAgentHistoryCommands(group) {
   });
 }
 
+// src/lib/agent/list-table.ts
+init_output();
+import chalk4 from "chalk";
+function activeRevision(slot) {
+  if (!slot.enabled)
+    return "retired";
+  return slot.activeRevision === null ? "none" : `v${String(slot.activeRevision)}`;
+}
+function printAgentList(response) {
+  const agents = Array.isArray(response.data) ? response.data : [];
+  if (agents.length === 0) {
+    console.log(chalk4.gray("No managed agents in this workspace. Deploy one: mutagent agent deploy <agent.md>"));
+    return;
+  }
+  const rows = agents.flatMap((agent) => agent.deployments.length === 0 ? [{ slug: agent.slug, status: agent.status, slot: "-", "active revision": "-" }] : agent.deployments.map((slot) => ({
+    slug: agent.slug,
+    status: agent.status,
+    slot: slot.environment ?? "default",
+    "active revision": activeRevision(slot)
+  })));
+  new OutputFormatter("table").output(rows);
+  if (typeof response.nextCursor === "string" && response.nextCursor !== "") {
+    console.log(`More: mutagent agent list --cursor ${response.nextCursor}`);
+  }
+}
+
 // src/commands/agent/index.ts
 var RUN_TAKES_A_FILE_MESSAGE = "mutagent agent run takes a local agent.md; a managed agent runs with mutagent helix agent @slug";
 function looksLikeSlug(source2) {
@@ -19302,7 +19344,7 @@ function createAgentCommand(injected) {
     await performAgentAction("list", cmd, false, async () => {
       validateLimit(opts.limit, "list");
       return (await services()).list(opts);
-    });
+    }, printAgentList);
   });
   leaf("inspect", "Show a managed agent's revisions, slots and sessions, or one operation").argument("[slug]", "Managed agent slug").option("--env <name>", "Show only the deployment slot of this Environment").option("--operation <id>", "Show the recorded outcome of one deploy or activate instead").option("--limit <count>", "Revisions per page from 1 to 100", "20").option("--cursor <cursor>", "Revision nextCursor from the previous inspect").action(async (slug, opts, cmd) => {
     await performAgentAction("inspect", cmd, false, async () => {
@@ -19335,12 +19377,12 @@ init_key_check();
 init_output();
 init_errors();
 import { Command as Command2 } from "commander";
-import chalk6 from "chalk";
+import chalk7 from "chalk";
 import { existsSync as existsSync8 } from "fs";
 import { join as join13 } from "path";
 
 // src/commands/onboarding.ts
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 
 // src/lib/rc-config.ts
 init_config();
@@ -19686,46 +19728,46 @@ async function runPostOnboarding(deps = {}) {
   const select = deps.selectAction ?? defaultSelectAction;
   const install = deps.installPackage ?? installPackage;
   console.log("");
-  console.log(chalk4.bold.cyan("  You are authenticated."));
+  console.log(chalk5.bold.cyan("  You are authenticated."));
   console.log("");
   const rc = scaffold(cwd);
   if (rc.alreadyPresent) {
-    console.log(`  ${chalk4.green("✓")} .mutagentrc.json already present`);
+    console.log(`  ${chalk5.green("✓")} .mutagentrc.json already present`);
   } else {
-    console.log(`  ${chalk4.green("✓")} Created .mutagentrc.json`);
+    console.log(`  ${chalk5.green("✓")} Created .mutagentrc.json`);
   }
   console.log("");
   const action = await select(ONBOARDING_CHOICES);
   console.log("");
   if (action === "helix") {
-    console.log(chalk4.bold("  Installing Helix…"));
-    console.log(chalk4.dim("  Downloading the helix binary and verifying its checksum"));
+    console.log(chalk5.bold("  Installing Helix…"));
+    console.log(chalk5.dim("  Downloading the helix binary and verifying its checksum"));
     console.log("");
     try {
       const result = await install("helix", {});
-      console.log(`  ${chalk4.green("✓")} Helix ${result.version} installed at ${result.binaryPath}`);
+      console.log(`  ${chalk5.green("✓")} Helix ${result.version} installed at ${result.binaryPath}`);
       if (result.pathLine !== undefined) {
-        console.log(`  ${chalk4.yellow("⚠")} Not on your PATH yet. Add this line to your shell profile:`);
-        console.log(`    ${chalk4.cyan(result.pathLine)}`);
+        console.log(`  ${chalk5.yellow("⚠")} Not on your PATH yet. Add this line to your shell profile:`);
+        console.log(`    ${chalk5.cyan(result.pathLine)}`);
       }
-      console.log(`  ${chalk4.blue("→")} Next: ${result.nextStep}`);
+      console.log(`  ${chalk5.blue("→")} Next: ${result.nextStep}`);
       console.log("");
     } catch (error3) {
       console.log("");
       if (error3 instanceof MutagentError) {
-        console.error(`  ${chalk4.red("✗")} Helix install failed: ${scrubKnown(error3.message)}`);
+        console.error(`  ${chalk5.red("✗")} Helix install failed: ${scrubKnown(error3.message)}`);
         if (error3.suggestion)
-          console.error(`  ${chalk4.yellow("→")} ${scrubKnown(error3.suggestion)}`);
+          console.error(`  ${chalk5.yellow("→")} ${scrubKnown(error3.suggestion)}`);
       } else {
         const message = error3 instanceof Error ? error3.message : String(error3);
-        console.error(`  ${chalk4.red("✗")} Helix install failed: ${scrubKnown(message)}`);
+        console.error(`  ${chalk5.red("✗")} Helix install failed: ${scrubKnown(message)}`);
       }
       console.error("");
       process.exitCode = 1;
     }
   } else {
-    console.log(chalk4.dim(`  Run ${chalk4.cyan("mutagent --help")} to explore the CLI.`));
-    console.log(chalk4.dim('  Hit a snag? Send feedback: mutagent feedback send "what happened"'));
+    console.log(chalk5.dim(`  Run ${chalk5.cyan("mutagent --help")} to explore the CLI.`));
+    console.log(chalk5.dim('  Hit a snag? Send feedback: mutagent feedback send "what happened"'));
     console.log("");
   }
 }
@@ -19737,7 +19779,7 @@ init_organization_scope();
 init_output();
 init_errors();
 import { input, password, select } from "@inquirer/prompts";
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 import ora2 from "ora";
 
 // src/lib/browser-auth.ts
@@ -19910,7 +19952,7 @@ async function performLoginAction(opts) {
   }
   if (!isNonInteractive && wasFirstLogin) {
     console.log(`
-` + chalk5.bold.cyan("  Welcome to Mutagent CLI!") + `
+` + chalk6.bold.cyan("  Welcome to Mutagent CLI!") + `
 `);
     console.log(`  No credentials found. Please authenticate to continue.
 `);
@@ -20085,18 +20127,18 @@ async function loginWithPastedKey(initialEndpoint, output, wasFirstLogin) {
 function createAuthCommand() {
   const auth = new Command2("auth").description("Sign in, show the sign-in state, or sign out on this machine").addHelpText("after", `
 Examples:
-  ${chalk6.dim("$")} mutagent login
-  ${chalk6.dim("$")} mutagent login --browser
-  ${chalk6.dim("$")} mutagent auth status
-  ${chalk6.dim("$")} mutagent auth logout
+  ${chalk7.dim("$")} mutagent login
+  ${chalk7.dim("$")} mutagent login --browser
+  ${chalk7.dim("$")} mutagent auth status
+  ${chalk7.dim("$")} mutagent auth logout
 
-${chalk6.dim("mutagent auth login is the same command as mutagent login.")}
+${chalk7.dim("mutagent auth login is the same command as mutagent login.")}
     `);
   auth.command("login").description("Same as mutagent login: sign in and store the API key on this machine").option("--browser", "Sign in with the browser (skip the method prompt)").option("--non-interactive", "Skip the method prompt and use browser sign-in (with --json it also needs --browser)").option("--endpoint <url>", "API endpoint", "https://api.mutagent.io").addHelpText("after", `
 Examples:
-  ${chalk6.dim("$")} mutagent login                         ${chalk6.dim("# In a terminal, choose browser or API key")}
-  ${chalk6.dim("$")} mutagent login --browser               ${chalk6.dim("# Sign in with the browser")}
-  ${chalk6.dim("$")} mutagent login --non-interactive       ${chalk6.dim("# Browser sign-in without the method prompt (a person approves in the browser)")}
+  ${chalk7.dim("$")} mutagent login                         ${chalk7.dim("# In a terminal, choose browser or API key")}
+  ${chalk7.dim("$")} mutagent login --browser               ${chalk7.dim("# Sign in with the browser")}
+  ${chalk7.dim("$")} mutagent login --non-interactive       ${chalk7.dim("# Browser sign-in without the method prompt (a person approves in the browser)")}
 
 This runs the same sign-in as mutagent login, with the same options and --json output.
 See mutagent login --help for the full description.
@@ -20132,8 +20174,8 @@ See mutagent login --help for the full description.
   });
   auth.command("status").description("Show the sign-in state, endpoint and active workspace").addHelpText("after", `
 Examples:
-  ${chalk6.dim("$")} mutagent auth status
-  ${chalk6.dim("$")} mutagent auth status --json
+  ${chalk7.dim("$")} mutagent auth status
+  ${chalk7.dim("$")} mutagent auth status --json
 
 ${EXIT_CODES_LINE}
     `).action(async () => {
@@ -20179,7 +20221,7 @@ ${EXIT_CODES_LINE}
   });
   auth.command("logout").description("Clear stored credentials").addHelpText("after", `
 Examples:
-  ${chalk6.dim("$")} mutagent auth logout
+  ${chalk7.dim("$")} mutagent auth logout
     `).action(() => {
     const isJson = getJsonFlag(auth);
     const output = new OutputFormatter(isJson ? "json" : "table");
@@ -20193,16 +20235,16 @@ Examples:
 init_output();
 init_errors();
 import { Command as Command3 } from "commander";
-import chalk7 from "chalk";
+import chalk8 from "chalk";
 function createLoginCommand() {
   const login = new Command3("login").description("Sign in to Mutagent and store the API key on this machine").option("--browser", "Sign in with the browser (skip the method prompt)").option("--non-interactive", "Skip the method prompt and use browser sign-in (with --json it also needs --browser)").option("--endpoint <url>", "API endpoint", "https://api.mutagent.io").addHelpText("after", `
 Examples:
-  ${chalk7.dim("$")} mutagent login                          ${chalk7.dim("# In a terminal, choose browser or API key")}
-  ${chalk7.dim("$")} mutagent login --browser                ${chalk7.dim("# Opens a real browser here; sign in or sign up")}
-  ${chalk7.dim("$")} mutagent login --non-interactive        ${chalk7.dim("# Browser sign-in without the method prompt (a person approves in the browser)")}
-  ${chalk7.dim("$")} mutagent login --browser --non-interactive --json  ${chalk7.dim("# Agent path: no browser opens here — see below")}
-  ${chalk7.dim("$")} mutagent login --org <slug>              ${chalk7.dim("# Sign in for another organization (preselected on the approval page)")}
-  ${chalk7.dim("$")} MUTAGENT_API_KEY=mg_live_... mutagent login --json  ${chalk7.dim("# Sign in with a key (CI)")}
+  ${chalk8.dim("$")} mutagent login                          ${chalk8.dim("# In a terminal, choose browser or API key")}
+  ${chalk8.dim("$")} mutagent login --browser                ${chalk8.dim("# Opens a real browser here; sign in or sign up")}
+  ${chalk8.dim("$")} mutagent login --non-interactive        ${chalk8.dim("# Browser sign-in without the method prompt (a person approves in the browser)")}
+  ${chalk8.dim("$")} mutagent login --browser --non-interactive --json  ${chalk8.dim("# Agent path: no browser opens here — see below")}
+  ${chalk8.dim("$")} mutagent login --org <slug>              ${chalk8.dim("# Sign in for another organization (preselected on the approval page)")}
+  ${chalk8.dim("$")} MUTAGENT_API_KEY=mg_live_... mutagent login --json  ${chalk8.dim("# Sign in with a key (CI)")}
 
 Browser sign-in: app.mutagent.io is where you sign in or sign up, finish onboarding
 and approve this CLI. The CLI waits up to 5 minutes and saves the credentials.
@@ -20225,8 +20267,8 @@ Environment:
   CI=true                        Same as --non-interactive
 
 Then:
-  ${chalk7.dim("$")} mutagent workspaces current
-  ${chalk7.dim("$")} mutagent workspaces use <name>
+  ${chalk8.dim("$")} mutagent workspaces current
+  ${chalk8.dim("$")} mutagent workspaces use <name>
 
 mutagent auth login runs the same sign-in.
     `).action(async (options) => {
@@ -20268,7 +20310,7 @@ init_output();
 init_errors();
 init_organization_scope();
 import { Command as Command5 } from "commander";
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 
 // src/commands/workspaces.ts
 init_sdk_client();
@@ -20277,7 +20319,7 @@ init_errors();
 init_config();
 init_organization_scope();
 import { Command as Command4 } from "commander";
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 async function useWorkspace(value2) {
   const apiKey = getApiKey();
   if (!apiKey)
@@ -20302,10 +20344,10 @@ async function useWorkspace(value2) {
 function createWorkspacesCommand() {
   const workspaces = new Command4("workspaces").alias("workspace").description("List, select and inspect workspaces").addHelpText("after", `
 Examples:
-  ${chalk8.dim("$")} mutagent workspaces list
-  ${chalk8.dim("$")} mutagent workspaces use <name|id>       ${chalk8.dim("# Every later command works in this workspace")}
-  ${chalk8.dim("$")} mutagent workspaces current --json
-  ${chalk8.dim("$")} mutagent providers list --workspace <name|id>   ${chalk8.dim("# One command in another workspace")}
+  ${chalk9.dim("$")} mutagent workspaces list
+  ${chalk9.dim("$")} mutagent workspaces use <name|id>       ${chalk9.dim("# Every later command works in this workspace")}
+  ${chalk9.dim("$")} mutagent workspaces current --json
+  ${chalk9.dim("$")} mutagent providers list --workspace <name|id>   ${chalk9.dim("# One command in another workspace")}
 
 The CLI key from \`mutagent login\` works in every workspace you are a member of in its
 organization. Workspace precedence: --workspace, then MUTAGENT_WORKSPACE_ID, then the
@@ -20315,8 +20357,8 @@ Create or change workspaces in the dashboard: ${getAppBaseUrl()}
     `);
   workspaces.command("list").alias("ls").description("List your workspaces in the key's organization (* = selected)").option("-l, --limit <n>", "Limit results", "50").option("-o, --offset <n>", "Offset for pagination").addHelpText("after", `
 Examples:
-  ${chalk8.dim("$")} mutagent workspaces list
-  ${chalk8.dim("$")} mutagent workspaces list --limit 10 --json
+  ${chalk9.dim("$")} mutagent workspaces list
+  ${chalk9.dim("$")} mutagent workspaces list --limit 10 --json
 
 Lists only workspaces you are a member of. Works even when the selected workspace is no
 longer available, so you can pick another with: mutagent workspaces use <name>
@@ -20360,8 +20402,8 @@ longer available, so you can pick another with: mutagent workspaces use <name>
   });
   workspaces.command("use").description("Select the workspace every later command works in").argument("<name|id>", "Workspace name or id").addHelpText("after", `
 Examples:
-  ${chalk8.dim("$")} mutagent workspaces use staging
-  ${chalk8.dim("$")} mutagent workspaces use <workspace-id> --json
+  ${chalk9.dim("$")} mutagent workspaces use staging
+  ${chalk9.dim("$")} mutagent workspaces use <workspace-id> --json
 
 Resolves against your workspaces in the key's organization and saves the choice. No
 browser and no prompt. A workspace in another organization needs a key for that
@@ -20382,8 +20424,8 @@ organization: mutagent login --org <slug>. Two workspaces with the same name: pa
   });
   workspaces.command("current").description("Show the key's scope, organization and the verified workspace").addHelpText("after", `
 Examples:
-  ${chalk8.dim("$")} mutagent workspaces current
-  ${chalk8.dim("$")} mutagent workspaces current --json
+  ${chalk9.dim("$")} mutagent workspaces current
+  ${chalk9.dim("$")} mutagent workspaces current --json
 
 Asks the server (GET /api/api-keys/self) with the workspace this command would use, so
 the answer is verified, not read from local config.
@@ -20430,8 +20472,8 @@ the answer is verified, not read from local config.
   });
   workspaces.command("get").description("Get workspace details").argument("<id>", "Workspace ID").addHelpText("after", `
 Examples:
-  ${chalk8.dim("$")} mutagent workspaces get <workspace-id>
-  ${chalk8.dim("$")} mutagent workspaces get <workspace-id> --json
+  ${chalk9.dim("$")} mutagent workspaces get <workspace-id>
+  ${chalk9.dim("$")} mutagent workspaces get <workspace-id> --json
     `).action(async (id) => {
     const isJson = getJsonFlag(workspaces);
     const output = new OutputFormatter(isJson ? "json" : "table");
@@ -20466,14 +20508,14 @@ var VALID_CONFIG_KEYS = ["apiKey", "endpoint", "format", "timeout", "defaultWork
 function createConfigCommand() {
   const config = new Command5("config").description("Manage CLI configuration").addHelpText("after", `
 Examples:
-  ${chalk9.dim("$")} mutagent config list
-  ${chalk9.dim("$")} mutagent config get endpoint
-  ${chalk9.dim("$")} mutagent config set workspace <name|id>   ${chalk9.dim("# Same as: mutagent workspaces use")}
+  ${chalk10.dim("$")} mutagent config list
+  ${chalk10.dim("$")} mutagent config get endpoint
+  ${chalk10.dim("$")} mutagent config set workspace <name|id>   ${chalk10.dim("# Same as: mutagent workspaces use")}
     `);
   config.command("list").alias("ls").description("List all configuration").addHelpText("after", `
 Examples:
-  ${chalk9.dim("$")} mutagent config list
-  ${chalk9.dim("$")} mutagent config list --json
+  ${chalk10.dim("$")} mutagent config list
+  ${chalk10.dim("$")} mutagent config list --json
     `).action(() => {
     const isJson = getJsonFlag(config);
     const output = new OutputFormatter(isJson ? "json" : "table");
@@ -20486,12 +20528,12 @@ Examples:
   });
   config.command("get").description("Get configuration value").argument("<key>", `Configuration key (${VALID_CONFIG_KEYS.join(", ")})`).addHelpText("after", `
 Examples:
-  ${chalk9.dim("$")} mutagent config get endpoint
-  ${chalk9.dim("$")} mutagent config get defaultWorkspace
-  ${chalk9.dim("$")} mutagent config get apiKey --json
+  ${chalk10.dim("$")} mutagent config get endpoint
+  ${chalk10.dim("$")} mutagent config get defaultWorkspace
+  ${chalk10.dim("$")} mutagent config get apiKey --json
 
-${chalk9.dim(`Keys: ${VALID_CONFIG_KEYS.join(", ")}`)}
-${chalk9.dim("A key with no value set is reported as unknown.")}
+${chalk10.dim(`Keys: ${VALID_CONFIG_KEYS.join(", ")}`)}
+${chalk10.dim("A key with no value set is reported as unknown.")}
     `).action((key) => {
     const isJson = getJsonFlag(config);
     const output = new OutputFormatter(isJson ? "json" : "table");
@@ -20516,10 +20558,10 @@ ${chalk9.dim("A key with no value set is reported as unknown.")}
   const set2 = new Command5("set").description("Set configuration value");
   set2.command("workspace").description("Select the workspace every later command works in (same as: workspaces use)").argument("<name|id>", "Workspace name or id").addHelpText("after", `
 Examples:
-  ${chalk9.dim("$")} mutagent config set workspace staging
-  ${chalk9.dim("$")} mutagent config set workspace <workspace-id>
+  ${chalk10.dim("$")} mutagent config set workspace staging
+  ${chalk10.dim("$")} mutagent config set workspace <workspace-id>
 
-${chalk9.dim("Runs mutagent workspaces use: resolves the name among your workspaces and saves it.")}
+${chalk10.dim("Runs mutagent workspaces use: resolves the name among your workspaces and saves it.")}
     `).action(async (value2) => {
     const isJson = getJsonFlag(config);
     const output = new OutputFormatter(isJson ? "json" : "table");
@@ -20536,10 +20578,10 @@ ${chalk9.dim("Runs mutagent workspaces use: resolves the name among your workspa
   });
   set2.command("org").description("Confirm the key's organization (it comes from the key; nothing is stored)").argument("<id|slug>", "Organization id or slug").addHelpText("after", `
 Examples:
-  ${chalk9.dim("$")} mutagent config set org <org-id|slug>
+  ${chalk10.dim("$")} mutagent config set org <org-id|slug>
 
-${chalk9.dim("The CLI key belongs to one organization. The same organization: nothing to do.")}
-${chalk9.dim("Another organization: sign in for it with mutagent login --org <id|slug>.")}
+${chalk10.dim("The CLI key belongs to one organization. The same organization: nothing to do.")}
+${chalk10.dim("Another organization: sign in for it with mutagent login --org <id|slug>.")}
     `).action(async (value2) => {
     const isJson = getJsonFlag(config);
     const output = new OutputFormatter(isJson ? "json" : "table");
@@ -20573,14 +20615,14 @@ init_sdk_client();
 init_output();
 init_errors();
 import { Command as Command6 } from "commander";
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 import { LlmProviderType as ProviderCatalogId } from "@mutagent/sdk/models";
 
 // src/commands/providers/add.ts
 init_sdk_client();
 init_output();
 init_errors();
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 
 // ../mutagent/src/modules/tenancy/providers/catalog.ts
 var apiKeyField = (description) => ({
@@ -21097,15 +21139,15 @@ function collectCredentialFields(options) {
 function registerAddCommand(parent) {
   parent.command("add").description("Add an LLM provider to the workspace").requiredOption("-p, --provider <type>", "LLM provider type (openai, anthropic, azure, ...)").requiredOption("-n, --name <name>", "Display name").option("--api-key-stdin", "Read the LLM provider API key from stdin, keeping it out of shell history (every type except vertex)").option("-k, --api-key <key>", "LLM provider API key (not your Mutagent key); every type except vertex").option("--service-account-key <json>", "Google Vertex service-account credential JSON").option("--hosted-family <family>", `Model family a gateway (azure, vertex, bedrock) serves: ${HOSTED_FAMILIES.join(", ")}`).option("--base-url <url>", "Base URL of the API").option("--api-format <format>", apiFormatHelpText()).option("--resource-endpoint <url>", "Azure resource endpoint").option("--deployment-name <name>", "Azure deployment name").option("--api-version <version>", "Azure API version (e.g. 2024-08-01-preview)").option("--project-id <id>", "Google Vertex project ID").option("--region <region>", "Region (Vertex location, or AWS Bedrock region)").option("--set-default", "Make it the workspace's default LLM provider of its type").addHelpText("after", `
 Examples:
-  ${chalk10.dim("$")} mutagent providers add --provider openai --name "My OpenAI" --api-key-stdin < openai-key.txt
-  ${chalk10.dim("$")} printf %s "$OPENAI_API_KEY" | mutagent providers add --provider openai --name "My OpenAI" --api-key-stdin
-  ${chalk10.dim("$")} mutagent providers add --provider openai --name "My OpenAI" --api-key $OPENAI_API_KEY
-  ${chalk10.dim("$")} mutagent providers add --provider azure --name "Azure GPT" --api-key $KEY \\
+  ${chalk11.dim("$")} mutagent providers add --provider openai --name "My OpenAI" --api-key-stdin < openai-key.txt
+  ${chalk11.dim("$")} printf %s "$OPENAI_API_KEY" | mutagent providers add --provider openai --name "My OpenAI" --api-key-stdin
+  ${chalk11.dim("$")} mutagent providers add --provider openai --name "My OpenAI" --api-key $OPENAI_API_KEY
+  ${chalk11.dim("$")} mutagent providers add --provider azure --name "Azure GPT" --api-key $KEY \\
       --hosted-family openai --resource-endpoint https://my.openai.azure.com --deployment-name gpt-5
-  ${chalk10.dim("$")} mutagent providers add --provider bedrock --name "Bedrock Claude" --api-key $KEY --region us-east-1
-  ${chalk10.dim("$")} mutagent providers add --provider custom --name "My gateway" --api-key $KEY \\
+  ${chalk11.dim("$")} mutagent providers add --provider bedrock --name "Bedrock Claude" --api-key $KEY --region us-east-1
+  ${chalk11.dim("$")} mutagent providers add --provider custom --name "My gateway" --api-key $KEY \\
       --base-url https://llm.example.com/v1 --api-format anthropic
-  ${chalk10.dim("$")} mutagent providers add --provider zai-coding-plan --name "Z.AI" --api-key $ZAI_API_KEY
+  ${chalk11.dim("$")} mutagent providers add --provider zai-coding-plan --name "Z.AI" --api-key $ZAI_API_KEY
 
 azure and vertex serve another vendor's models and need --hosted-family; bedrock serves
 anthropic and needs none. Other LLM provider types must not set it.
@@ -21199,10 +21241,10 @@ AI Agent Directive:
         console.log(`  Workspace: ${workspaceId}`);
         console.log(`  URL:       ${providerLink(created.id)}`);
         if (options.setDefault) {
-          console.log(chalk10.green("  Set as the default LLM provider"));
+          console.log(chalk11.green("  Set as the default LLM provider"));
         }
         console.log("");
-        console.log(chalk10.dim("API key is encrypted server-side. Use `providers get` to see masked key."));
+        console.log(chalk11.dim("API key is encrypted server-side. Use `providers get` to see masked key."));
       }
     } catch (error3) {
       handleError(error3, isJson);
@@ -21242,15 +21284,15 @@ function buildProviderCreatedDirective(provider, workspaceId) {
 init_sdk_client();
 init_output();
 init_errors();
-import chalk11 from "chalk";
+import chalk12 from "chalk";
 function registerUpdateCommand(parent) {
   parent.command("update").description("Update an LLM provider").argument("<id>", "LLM provider ID (from: mutagent providers list)").option("-n, --name <name>", "Updated display name").option("--api-key-stdin", "Read the new LLM provider API key from stdin, keeping it out of shell history").option("-k, --api-key <key>", "New LLM provider API key (not your Mutagent key); stored encrypted").option("--active <bool>", "Activate or deactivate (true|false)").option("--set-default", "Make it the workspace's default LLM provider of its type").option("--base-url <url>", 'Updated base URL (use "" to clear)').addHelpText("after", `
 Examples:
-  ${chalk11.dim("$")} mutagent providers update <provider-id> --api-key-stdin --json < new-key.txt
-  ${chalk11.dim("$")} mutagent providers update <provider-id> --name "New Name"
-  ${chalk11.dim("$")} mutagent providers update <provider-id> --api-key $NEW_KEY --json
-  ${chalk11.dim("$")} mutagent providers update <provider-id> --active false
-  ${chalk11.dim("$")} mutagent providers update <provider-id> --set-default --json
+  ${chalk12.dim("$")} mutagent providers update <provider-id> --api-key-stdin --json < new-key.txt
+  ${chalk12.dim("$")} mutagent providers update <provider-id> --name "New Name"
+  ${chalk12.dim("$")} mutagent providers update <provider-id> --api-key $NEW_KEY --json
+  ${chalk12.dim("$")} mutagent providers update <provider-id> --active false
+  ${chalk12.dim("$")} mutagent providers update <provider-id> --set-default --json
 
 Only the fields you pass change. An update never sets the workspace default model.
 --api-key-stdin reads the key from stdin and drops one trailing newline; give it or
@@ -21312,7 +21354,7 @@ AI Agent Directive:
         }
         console.log(`  URL:       ${providerLink(updated.id)}`);
         if (apiKey !== undefined) {
-          console.log(chalk11.dim("  API key re-encrypted server-side."));
+          console.log(chalk12.dim("  API key re-encrypted server-side."));
         }
       }
     } catch (error3) {
@@ -21353,12 +21395,12 @@ function buildProviderUpdatedDirective(provider, requestId) {
 init_sdk_client();
 init_output();
 init_errors();
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 function registerDeleteCommand(parent) {
   parent.command("delete").alias("rm").description("Delete an LLM provider").argument("<id>", "LLM provider ID (from: mutagent providers list)").option("-f, --force", "Confirm the delete (required in every mode, --json included)").addHelpText("after", `
 Examples:
-  ${chalk12.dim("$")} mutagent providers delete <provider-id> --force
-  ${chalk12.dim("$")} mutagent providers delete <provider-id> --force --json
+  ${chalk13.dim("$")} mutagent providers delete <provider-id> --force
+  ${chalk13.dim("$")} mutagent providers delete <provider-id> --force --json
 
 Without --force the command refuses (CONFIRMATION_REQUIRED, exit 1) and sends nothing,
 --json included; it never prompts.
@@ -21441,7 +21483,7 @@ init_sdk_client();
 init_config();
 init_output();
 init_errors();
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 import { createInterface } from "readline";
 init_known_secrets();
 init_secret_scrub();
@@ -22085,13 +22127,13 @@ async function askConsent(question) {
 function statusGlyph(result) {
   switch (result.status) {
     case "mirrored":
-      return chalk13.green("mirrored");
+      return chalk14.green("mirrored");
     case "updated":
-      return chalk13.green("updated ");
+      return chalk14.green("updated ");
     case "skipped":
-      return chalk13.yellow("skipped ");
+      return chalk14.yellow("skipped ");
     case "failed":
-      return chalk13.red("failed  ");
+      return chalk14.red("failed  ");
     default:
       return result.status;
   }
@@ -22099,12 +22141,12 @@ function statusGlyph(result) {
 function registerMirrorCommand(parent) {
   parent.command("mirror").description("Copy the API keys from your local Helix login store into the workspace as LLM providers").option("-y, --yes", "Consent without prompting (required when non-interactive)").option("--no-overwrite", "Leave LLM providers the workspace already has untouched").option("--channel <channel>", `Helix channel whose store is read: ${HELIX_CHANNELS2.join(" | ")}`, "stable").option("--provider <id>", "Only this local LLM provider id (repeatable)", (value2, prev = []) => [...prev, value2]).addHelpText("after", `
 Examples:
-  ${chalk13.dim("$")} mutagent providers mirror
-  ${chalk13.dim("$")} mutagent providers mirror --json                 ${chalk13.dim("Show the plan without sending anything")}
-  ${chalk13.dim("$")} mutagent providers mirror --yes --json
-  ${chalk13.dim("$")} mutagent providers mirror --provider zai --provider openrouter
-  ${chalk13.dim("$")} mutagent providers mirror --no-overwrite
-  ${chalk13.dim("$")} mutagent providers mirror --channel rc
+  ${chalk14.dim("$")} mutagent providers mirror
+  ${chalk14.dim("$")} mutagent providers mirror --json                 ${chalk14.dim("Show the plan without sending anything")}
+  ${chalk14.dim("$")} mutagent providers mirror --yes --json
+  ${chalk14.dim("$")} mutagent providers mirror --provider zai --provider openrouter
+  ${chalk14.dim("$")} mutagent providers mirror --no-overwrite
+  ${chalk14.dim("$")} mutagent providers mirror --channel rc
 
 Reads the API keys in your local Helix login store (~/.mutagent/agent, ~/.mutagent/agent-rc
 with --channel rc, or $HELIX_CODING_AGENT_DIR when set) and creates or updates the
@@ -22185,7 +22227,7 @@ AI Agent Directive:
         if (plan.length === 0) {
           output.info("Nothing to mirror.");
         } else {
-          console.log(chalk13.bold(`
+          console.log(chalk14.bold(`
 Plan:`));
           for (const line of describePlan(plan))
             console.log(`  ${scrubSecretsSuccess(line, [apiKey, ...knownSecrets()])}`);
@@ -22235,7 +22277,7 @@ Plan:`));
         });
       } else {
         for (const result of results) {
-          const tail = result.status === "failed" ? chalk13.red(result.error ?? "") : result.status === "skipped" ? chalk13.dim(result.reason ?? "") : chalk13.dim(`${result.rowId ? `row ${result.rowId}` : ""}${result.workspaceDefaultModelSet ? `${result.rowId ? " · " : ""}default set to ${result.workspaceDefaultModelSet}` : ""}`);
+          const tail = result.status === "failed" ? chalk14.red(result.error ?? "") : result.status === "skipped" ? chalk14.dim(result.reason ?? "") : chalk14.dim(`${result.rowId ? `row ${result.rowId}` : ""}${result.workspaceDefaultModelSet ? `${result.rowId ? " · " : ""}default set to ${result.workspaceDefaultModelSet}` : ""}`);
           const lands = result.provider ? ` → ${result.provider === "custom" ? `custom (${result.harnessProvider ?? result.id})` : result.provider}` : "";
           console.log(scrubSecretsSuccess(`  ${statusGlyph(result)}  ${result.id}${lands}  ${tail}`, [
             apiKey,
@@ -22283,13 +22325,13 @@ function validateProviderType(type4) {
 function createProvidersCommand() {
   const providers = new Command6("providers").description("Manage LLM provider configurations (BYOK)").addHelpText("after", `
 Examples:
-  ${chalk14.dim("$")} mutagent providers mirror
-  ${chalk14.dim("$")} mutagent providers list
-  ${chalk14.dim("$")} mutagent providers get <provider-id>
-  ${chalk14.dim("$")} mutagent providers add --provider openai --name "My OpenAI" --api-key $KEY
-  ${chalk14.dim("$")} mutagent providers test <provider-id>
-  ${chalk14.dim("$")} mutagent providers update <provider-id> --name "New Name"
-  ${chalk14.dim("$")} mutagent providers delete <provider-id> --force
+  ${chalk15.dim("$")} mutagent providers mirror
+  ${chalk15.dim("$")} mutagent providers list
+  ${chalk15.dim("$")} mutagent providers get <provider-id>
+  ${chalk15.dim("$")} mutagent providers add --provider openai --name "My OpenAI" --api-key $KEY
+  ${chalk15.dim("$")} mutagent providers test <provider-id>
+  ${chalk15.dim("$")} mutagent providers update <provider-id> --name "New Name"
+  ${chalk15.dim("$")} mutagent providers delete <provider-id> --force
 
 LLM providers hold the keys Helix uses to call models in the cloud. See what they
 unlock with \`mutagent helix models\`.
@@ -22298,10 +22340,10 @@ LLM provider types: ${VALID_PROVIDER_TYPES.join(", ")}
     `);
   providers.command("list").alias("ls").description("List the workspace's LLM providers").option("-l, --limit <n>", "Limit results", "50").option("-o, --offset <n>", "Offset for pagination").option("-t, --type <type>", "Filter by LLM provider type").option("-m, --models", "Show catalogue models for each LLM provider type (for Helix cloud models: mutagent helix models)").addHelpText("after", `
 Examples:
-  ${chalk14.dim("$")} mutagent providers list
-  ${chalk14.dim("$")} mutagent providers list --type openai
-  ${chalk14.dim("$")} mutagent providers list --models
-  ${chalk14.dim("$")} mutagent providers list --json
+  ${chalk15.dim("$")} mutagent providers list
+  ${chalk15.dim("$")} mutagent providers list --type openai
+  ${chalk15.dim("$")} mutagent providers list --models
+  ${chalk15.dim("$")} mutagent providers list --json
     `).action(async (options) => {
     const isJson = getJsonFlag(providers);
     const output = new OutputFormatter(isJson ? "json" : "table");
@@ -22344,6 +22386,7 @@ Examples:
             name: p.name,
             provider: p.provider,
             ...harnessProvider ? { harnessProvider } : {},
+            baseUrl: p.baseUrl ?? null,
             isActive: p.isActive,
             isDefault: p.isDefault ?? false,
             updatedAt: p.updatedAt,
@@ -22377,8 +22420,8 @@ Examples:
   });
   providers.command("get").description("Show one LLM provider").argument("<id>", "LLM provider ID (from: mutagent providers list)").addHelpText("after", `
 Examples:
-  ${chalk14.dim("$")} mutagent providers get <provider-id>
-  ${chalk14.dim("$")} mutagent providers get <provider-id> --json
+  ${chalk15.dim("$")} mutagent providers get <provider-id>
+  ${chalk15.dim("$")} mutagent providers get <provider-id> --json
     `).action(async (id) => {
     const isJson = getJsonFlag(providers);
     const output = new OutputFormatter(isJson ? "json" : "table");
@@ -22407,10 +22450,10 @@ Examples:
   });
   providers.command("test").description("Test an LLM provider's connection").argument("<id>", "LLM provider ID (from: mutagent providers list)").addHelpText("after", `
 Examples:
-  ${chalk14.dim("$")} mutagent providers test <provider-id>
-  ${chalk14.dim("$")} mutagent providers test <provider-id> --json
+  ${chalk15.dim("$")} mutagent providers test <provider-id>
+  ${chalk15.dim("$")} mutagent providers test <provider-id> --json
 
-${chalk14.dim("Tests the connection and lists the models the LLM provider reports.")}
+${chalk15.dim("Tests the connection and lists the models the LLM provider reports.")}
     `).action(async (id) => {
     const isJson = getJsonFlag(providers);
     const output = new OutputFormatter(isJson ? "json" : "table");
@@ -22427,9 +22470,9 @@ ${chalk14.dim("Tests the connection and lists the models the LLM provider report
       } else {
         const latency = typeof result.latencyMs === "number" ? ` (${String(result.latencyMs)}ms)` : "";
         output.success(`LLM provider test passed${latency}`);
-        console.log(chalk14.green(`Message: ${result.message}`));
+        console.log(chalk15.green(`Message: ${result.message}`));
         if (result.models && result.models.length > 0) {
-          console.log(chalk14.bold(`
+          console.log(chalk15.bold(`
 Available Models:`));
           result.models.forEach((model2) => {
             console.log(`  - ${model2}`);
@@ -22452,14 +22495,14 @@ init_config();
 init_output();
 init_errors();
 import { Command as Command8 } from "commander";
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import { readFileSync as readFileSync7 } from "fs";
 import { join as join16 } from "path";
 
 // src/commands/skills.ts
 init_output();
 import { Command as Command7 } from "commander";
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 import { existsSync as existsSync10, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname5, join as join15 } from "path";
 import { execSync } from "child_process";
@@ -23267,7 +23310,7 @@ function createSkillsCommand() {
   const skills = new Command7("skills").description("Manage Mutagent CLI skills for coding agents");
   skills.command("install").description("Install Mutagent CLI skill for Claude Code").addHelpText("after", `
 Examples:
-  ${chalk15.dim("$")} mutagent skills install
+  ${chalk16.dim("$")} mutagent skills install
 
 This creates a Claude Code skill at .claude/skills/mutagent-cli/SKILL.md
 that teaches coding agents how to use the Mutagent CLI effectively.
@@ -23287,7 +23330,7 @@ that teaches coding agents how to use the Mutagent CLI effectively.
       });
     } else {
       output.success(`Installed Mutagent CLI skill`);
-      console.log(`  ${chalk15.dim("Dir:")} ${result.skillDir}`);
+      console.log(`  ${chalk16.dim("Dir:")} ${result.skillDir}`);
       console.log("");
       for (let i = 0;i < result.files.length; i++) {
         const entry = result.files[i];
@@ -23295,12 +23338,12 @@ that teaches coding agents how to use the Mutagent CLI effectively.
           continue;
         const isLast = i === result.files.length - 1;
         const prefix = isLast ? "└─" : "├─";
-        console.log(`  ${chalk15.dim(prefix)} ${entry.relPath} ${chalk15.dim(`(${String(entry.bytes)} bytes)`)}`);
+        console.log(`  ${chalk16.dim(prefix)} ${entry.relPath} ${chalk16.dim(`(${String(entry.bytes)} bytes)`)}`);
       }
       console.log("");
-      console.log(`  ${chalk15.dim(`${String(result.files.length)} file(s), ${String(result.totalBytes)} bytes total.`)}`);
-      console.log(`  ${chalk15.dim("This skill teaches coding agents how to use the Mutagent CLI.")}`);
-      console.log(`  ${chalk15.dim("It will be automatically loaded by Claude Code when relevant triggers match.")}`);
+      console.log(`  ${chalk16.dim(`${String(result.files.length)} file(s), ${String(result.totalBytes)} bytes total.`)}`);
+      console.log(`  ${chalk16.dim("This skill teaches coding agents how to use the Mutagent CLI.")}`);
+      console.log(`  ${chalk16.dim("It will be automatically loaded by Claude Code when relevant triggers match.")}`);
     }
   });
   return skills;
@@ -23311,7 +23354,7 @@ var LOGIN_GUIDANCE = "Run: mutagent login — sign-up happens in the browser. Th
 function createInitCommand(deps = {}) {
   const init = new Command8("init").description("Initialize Mutagent in your project").addHelpText("after", `
 Examples:
-  ${chalk16.dim("$")} mutagent init    # Write .mutagentrc.json + install the CLI skill
+  ${chalk17.dim("$")} mutagent init    # Write .mutagentrc.json + install the CLI skill
 
 What it does:
   1. Writes .mutagentrc.json (endpoint / workspace / org) — skipped if present
@@ -23384,11 +23427,11 @@ It never prompts. Without a sign-in it exits 3 (AUTH_REQUIRED) and names the sig
         });
       } else {
         console.log("");
-        console.log(chalk16.bold(`  What's next:`));
-        console.log(`    ${chalk16.cyan("mutagent install helix".padEnd(30))}${chalk16.dim("# the standalone Helix binary")}`);
+        console.log(chalk17.bold(`  What's next:`));
+        console.log(`    ${chalk17.cyan("mutagent install helix".padEnd(30))}${chalk17.dim("# the standalone Helix binary")}`);
         console.log("");
-        console.log(chalk16.dim("  Your coding agent now knows these workflows — restart it to pick up"));
-        console.log(chalk16.dim('  the skill, then just say "set up Mutagent on this project".'));
+        console.log(chalk17.dim("  Your coding agent now knows these workflows — restart it to pick up"));
+        console.log(chalk17.dim('  the skill, then just say "set up Mutagent on this project".'));
       }
     } catch (error3) {
       handleError(error3, isJson);
@@ -23403,13 +23446,12 @@ init_output();
 init_errors();
 init_sdk_client();
 import { Command as Command9 } from "commander";
-import chalk17 from "chalk";
-var PROVIDERS_URL = "https://app.mutagent.io/settings/providers";
+import chalk18 from "chalk";
 function createUsageCommand() {
   const usage2 = new Command9("usage").description("Count the workspace's LLM providers and the workspaces you can see").addHelpText("after", `
 Examples:
-  ${chalk17.dim("$")} mutagent usage
-  ${chalk17.dim("$")} mutagent usage --json
+  ${chalk18.dim("$")} mutagent usage
+  ${chalk18.dim("$")} mutagent usage --json
     `);
   usage2.action(async () => {
     const isJson = getJsonFlag(usage2);
@@ -23437,20 +23479,20 @@ Examples:
             workspaces: workspaceCount
           },
           _links: {
-            providers: PROVIDERS_URL,
-            dashboard: "https://app.mutagent.io"
+            providers: providerSettingsLink(),
+            dashboard: getAppBaseUrl()
           }
         });
       } else {
         console.log("");
-        console.log(chalk17.bold("\uD83D\uDCCA Mutagent Usage"));
-        console.log(chalk17.dim("─".repeat(45)));
+        console.log(chalk18.bold("\uD83D\uDCCA Mutagent Usage"));
+        console.log(chalk18.dim("─".repeat(45)));
         console.log("");
-        console.log(chalk17.bold("Resources:"));
-        console.log(`  Providers:       ${chalk17.cyan(String(providerCount))}`);
-        console.log(`  Workspaces:      ${chalk17.cyan(String(workspaceCount))}`);
+        console.log(chalk18.bold("Resources:"));
+        console.log(`  Providers:       ${chalk18.cyan(String(providerCount))}`);
+        console.log(`  Workspaces:      ${chalk18.cyan(String(workspaceCount))}`);
         console.log("");
-        console.log(`  Manage providers: ${chalk17.underline(PROVIDERS_URL)}`);
+        console.log(`  Manage providers: ${chalk18.underline(providerSettingsLink())}`);
         console.log("");
       }
     } catch (error3) {
@@ -23464,7 +23506,7 @@ Examples:
 import { readFileSync as readFileSync11 } from "node:fs";
 import { basename as basename4 } from "node:path";
 import { Command as Command10 } from "commander";
-import chalk18 from "chalk";
+import chalk19 from "chalk";
 
 // src/commands/hooks/import-transcript.ts
 var MAX_SPAN_TEXT = 4000;
@@ -24368,7 +24410,7 @@ Claude Code session telemetry:
   Sends session activity (turns, tool calls, subagents, compactions) to the Mutagent
   traces API.
 
-  ${chalk18.dim("$")} mutagent hooks install    ${chalk18.dim("Add the Mutagent hooks to .claude/settings.local.json (11 events)")}
+  ${chalk19.dim("$")} mutagent hooks install    ${chalk19.dim("Add the Mutagent hooks to .claude/settings.local.json (11 events)")}
 
   The claude-code subcommands are what those hooks run; Claude Code calls them.
     `);
@@ -24460,8 +24502,8 @@ unparseable lines without sending anything.
   });
   hooks.command("install").description("Add the Mutagent hooks to .claude/settings.local.json (merges; existing hooks stay)").option("--cwd <dir>", "Target directory", process.cwd()).addHelpText("after", `
 Examples:
-  ${chalk18.dim("$")} mutagent hooks install
-  ${chalk18.dim("$")} mutagent hooks install --cwd ../other-project
+  ${chalk19.dim("$")} mutagent hooks install
+  ${chalk19.dim("$")} mutagent hooks install --cwd ../other-project
 
 Merges the Mutagent hooks into all 11 Claude Code events of
 .claude/settings.local.json (created if missing). Hooks already present are left
@@ -24558,7 +24600,7 @@ init_errors();
 init_config();
 init_organization_scope();
 import { Command as Command11 } from "commander";
-import chalk21 from "chalk";
+import chalk22 from "chalk";
 import { type as osType, release as osRelease } from "os";
 import { readFileSync as readFileSync13 } from "fs";
 import { join as join20, dirname as dirname6 } from "path";
@@ -24577,7 +24619,7 @@ import {
   readSync,
   closeSync
 } from "fs";
-import chalk19 from "chalk";
+import chalk20 from "chalk";
 var TAIL_BYTES = 200000;
 function defaultReadTail(path, tailBytes) {
   const { size } = fsStatSync(path);
@@ -24653,7 +24695,7 @@ Or omit the path to auto-detect the newest coding-agent session.`);
     }
   }
   if (!newest) {
-    warn(chalk19.yellow("⚠ No coding-agent transcript found; sending feedback without one."));
+    warn(chalk20.yellow("⚠ No coding-agent transcript found; sending feedback without one."));
     return null;
   }
   const { content, truncated } = readTail(newest.path, TAIL_BYTES);
@@ -24668,7 +24710,7 @@ Or omit the path to auto-detect the newest coding-agent session.`);
 
 // src/lib/feedback-safety.ts
 init_secret_scan();
-import chalk20 from "chalk";
+import chalk21 from "chalk";
 
 // src/lib/by-design.ts
 var NOT_FOUND = String.raw`404|not\s+found|missing|unavailable|unpublished|doesn'?t\s+exist|does\s+not\s+exist|no\s+such\s+package|cannot\s+install|can'?t\s+install|fails?\s+to\s+install`;
@@ -24739,9 +24781,9 @@ function buildPreview(transcript) {
 function buildTranscriptWarning(preview) {
   const kb = (preview.bytes / 1024).toFixed(1);
   return [
-    chalk20.yellow("⚠ About to upload your coding-agent session transcript."),
-    `  ${chalk20.bold("Source:")}  ${preview.sourcePath}`,
-    `  ${chalk20.bold("Sending:")} ${String(preview.fileCount)} file, ${kb} KB${preview.truncated ? " (tail only)" : ""}`,
+    chalk21.yellow("⚠ About to upload your coding-agent session transcript."),
+    `  ${chalk21.bold("Source:")}  ${preview.sourcePath}`,
+    `  ${chalk21.bold("Sending:")} ${String(preview.fileCount)} file, ${kb} KB${preview.truncated ? " (tail only)" : ""}`,
     "",
     "  A session transcript typically contains:",
     "    • source code and file contents you or the agent opened",
@@ -24750,9 +24792,9 @@ function buildTranscriptWarning(preview) {
     "    • internal hostnames, service names, and URLs",
     "    • business context from your prompts and the agent replies",
     "",
-    `  ${chalk20.dim("Credentials are scanned for and redacted automatically, but detection")}`,
-    `  ${chalk20.dim("is best-effort — review the source file if the session touched secrets.")}`,
-    `  ${chalk20.dim("Omit --attach-transcript to send feedback without it.")}`
+    `  ${chalk21.dim("Credentials are scanned for and redacted automatically, but detection")}`,
+    `  ${chalk21.dim("is best-effort — review the source file if the session touched secrets.")}`,
+    `  ${chalk21.dim("Omit --attach-transcript to send feedback without it.")}`
   ].join(`
 `);
 }
@@ -24764,12 +24806,12 @@ function buildRedactionReport(redactions) {
     byKind.set(match.label, (byKind.get(match.label) ?? 0) + 1);
   }
   const lines = [
-    chalk20.green(`✓ Redacted ${String(redactions.length)} credential${redactions.length === 1 ? "" : "s"} from the transcript before upload:`)
+    chalk21.green(`✓ Redacted ${String(redactions.length)} credential${redactions.length === 1 ? "" : "s"} from the transcript before upload:`)
   ];
   for (const [label, count] of byKind) {
     lines.push(`    • ${label} ×${String(count)}`);
   }
-  lines.push(chalk20.dim("  These were replaced with [REDACTED:…] markers and never left your machine."));
+  lines.push(chalk21.dim("  These were replaced with [REDACTED:…] markers and never left your machine."));
   return lines.join(`
 `);
 }
@@ -24777,17 +24819,17 @@ function buildByDesignNotice(entries) {
   if (entries.length === 0)
     return "";
   const lines = [
-    chalk20.cyan("ℹ Heads up — this may describe intended behaviour:"),
+    chalk21.cyan("ℹ Heads up — this may describe intended behaviour:"),
     ""
   ];
   for (const entry of entries) {
-    lines.push(`  ${chalk20.bold(entry.title)}`);
+    lines.push(`  ${chalk21.bold(entry.title)}`);
     for (const line of wrap(entry.reality, 76)) {
       lines.push(`    ${line}`);
     }
     lines.push("");
   }
-  lines.push(chalk20.dim("  Sending anyway — if this is a regression rather than the design,"), chalk20.dim("  your report is exactly what we need. Nothing was withheld."));
+  lines.push(chalk21.dim("  Sending anyway — if this is a regression rather than the design,"), chalk21.dim("  your report is exactly what we need. Nothing was withheld."));
   return lines.join(`
 `);
 }
@@ -24895,44 +24937,44 @@ function buildPayload(feedback, category, title, session, transcript) {
 }
 function createFeedbackCommand() {
   const feedback = new Command11("feedback").description("Send product feedback to Mutagent").addHelpText("after", `
-${chalk21.bold("Examples:")}
-  ${chalk21.cyan('mutagent feedback send "helix session attach was easy to follow"')}
-  ${chalk21.cyan('mutagent feedback send "Eval gate was confusing" --category stage:evaluate')}
-  ${chalk21.cyan('mutagent feedback send "CLI crashed on export" --category cli --json')}
+${chalk22.bold("Examples:")}
+  ${chalk22.cyan('mutagent feedback send "helix session attach was easy to follow"')}
+  ${chalk22.cyan('mutagent feedback send "Eval gate was confusing" --category stage:evaluate')}
+  ${chalk22.cyan('mutagent feedback send "CLI crashed on export" --category cli --json')}
 
 AI Agent Directive:
   ALWAYS use --json: mutagent feedback send "..." --category cli --json
-  ${chalk21.yellow("Do NOT attach a transcript by default.")} --attach-transcript uploads the
+  ${chalk22.yellow("Do NOT attach a transcript by default.")} --attach-transcript uploads the
   coding-agent SESSION JSONL — source code, absolute paths, branch and repository
   names, internal hostnames, and the business context of the operator's prompts.
   Use it only when the operator explicitly asks for it. See:
-  ${chalk21.dim("mutagent feedback send --help")}
+  ${chalk22.dim("mutagent feedback send --help")}
     `);
   registerFeedbackSend(feedback);
   return feedback;
 }
 function registerFeedbackSend(feedback) {
   feedback.command("send").description("Send product feedback about the Mutagent platform or CLI").argument("<feedback>", "The feedback body (content), max 10000 characters").option("--title <string>", "Short title").option("--category <value>", `Feedback category: 'cli', 'helix', or 'stage:<${VALID_STAGES.join("|")}>'`, "cli").option("--session <id>", "Link the feedback to a session").option("--attach-transcript [path]", "Attach the coding-agent session JSONL. Bare = auto-detect newest; or pass an explicit path.").addHelpText("after", `
-${chalk21.bold("Examples:")}
-  ${chalk21.dim("$")} mutagent feedback send "The setup flow could show progress better"
-  ${chalk21.dim("$")} mutagent feedback send "Eval gate was confusing" --category stage:evaluate --title "eval gate unclear"
-  ${chalk21.dim("$")} mutagent feedback send "Diagnose loop stalled" --category stage:diagnose --session sess_abc123 --json
-  ${chalk21.dim("$")} mutagent feedback send "CLI crashed mid-run" --category cli --attach-transcript --json
-  ${chalk21.dim("$")} mutagent feedback send "Repro attached" --category cli --attach-transcript /tmp/session.jsonl
-
-${chalk21.bold("Category:")}
-  ${chalk21.bold("cli")}            Feedback about the CLI itself (default)
-  ${chalk21.bold("helix")}          Feedback about Helix
-  ${chalk21.bold("stage:<x>")}      Feedback about a lifecycle stage: ${VALID_STAGES.join(", ")}
-
-${chalk21.bold("Transcript (--attach-transcript):")}
+${chalk22.bold("Examples:")}
+  ${chalk22.dim("$")} mutagent feedback send "The setup flow could show progress better"
+  ${chalk22.dim("$")} mutagent feedback send "Eval gate was confusing" --category stage:evaluate --title "eval gate unclear"
+  ${chalk22.dim("$")} mutagent feedback send "Diagnose loop stalled" --category stage:diagnose --session sess_abc123 --json
+  ${chalk22.dim("$")} mutagent feedback send "CLI crashed mid-run" --category cli --attach-transcript --json
+  ${chalk22.dim("$")} mutagent feedback send "Repro attached" --category cli --attach-transcript /tmp/session.jsonl
+
+${chalk22.bold("Category:")}
+  ${chalk22.bold("cli")}            Feedback about the CLI itself (default)
+  ${chalk22.bold("helix")}          Feedback about Helix
+  ${chalk22.bold("stage:<x>")}      Feedback about a lifecycle stage: ${VALID_STAGES.join(", ")}
+
+${chalk22.bold("Transcript (--attach-transcript):")}
   Uploads the last 200 KB of a coding-agent session transcript, separately from the
   feedback text. Without a path it picks the newest session from Claude Code, Codex
   or omp; a path picks that file.
 
-  ${chalk21.yellow("A session transcript contains source code, absolute paths (including your")}
-  ${chalk21.yellow("username), branch and repository names, internal hostnames, and the business")}
-  ${chalk21.yellow("context of your prompts.")} Credentials are scanned for and redacted before
+  ${chalk22.yellow("A session transcript contains source code, absolute paths (including your")}
+  ${chalk22.yellow("username), branch and repository names, internal hostnames, and the business")}
+  ${chalk22.yellow("context of your prompts.")} Credentials are scanned for and redacted before
   upload, and the exact size and source path are printed before anything is sent.
   Detection is best-effort: omit the flag if the session handled secrets.
 
@@ -25015,15 +25057,15 @@ Or with a key: export MUTAGENT_API_KEY=<key>, then: mutagent login --json`);
 init_output();
 init_errors();
 import { Command as Command12 } from "commander";
-import chalk22 from "chalk";
+import chalk23 from "chalk";
 function createInstallCommand(deps) {
   const install = new Command12("install").description("Install the standalone Helix binary on this machine").argument("<package>", `Package to install: ${VALID_PACKAGES.join(", ")}`).option("--channel <channel>", `Release channel: ${HELIX_CHANNELS.join(" or ")} (default: latest)`).addHelpText("after", `
-${chalk22.bold("Examples:")}
-  ${chalk22.dim("$")} mutagent install helix
-  ${chalk22.dim("$")} mutagent install helix --channel candidate
-  ${chalk22.dim("$")} mutagent install helix --json
+${chalk23.bold("Examples:")}
+  ${chalk23.dim("$")} mutagent install helix
+  ${chalk23.dim("$")} mutagent install helix --channel candidate
+  ${chalk23.dim("$")} mutagent install helix --json
 
-${chalk22.bold("helix")}: the standalone Helix binary, the same one
+${chalk23.bold("helix")}: the standalone Helix binary, the same one
 \`curl -fsSL https://install.mutagent.io/helix | bash\` installs. It downloads
 helix-<os>-<arch> for macOS or Linux (x64, arm64), verifies it against
 checksums.txt from the same origin, writes ~/.mutagent/bin/helix and points the
@@ -25034,7 +25076,7 @@ Shell rc files are never changed: when the directory is not on PATH, the line to
 add is printed. This installs Helix on this machine; mutagent helix runs it in
 the cloud.
 
-${chalk22.bold("Environment:")}
+${chalk23.bold("Environment:")}
   MUTAGENT_HELIX_CHANNEL   latest or candidate; --channel wins
   MUTAGENT_INSTALL_HOST    install host (default: https://install.mutagent.io)
   MUTAGENT_INSTALL_DIR     install directory (default: ~/.mutagent/bin)
@@ -25052,7 +25094,7 @@ AI Agent Directive:
     try {
       assertInstallTarget(pkg);
       if (!isJson)
-        console.log(chalk22.dim(`Downloading and verifying ${pkg}…`));
+        console.log(chalk23.dim(`Downloading and verifying ${pkg}…`));
       const result = await installPackage(pkg, { channel: options.channel }, deps);
       if (isJson) {
         output.output({
@@ -25075,15 +25117,15 @@ AI Agent Directive:
         return;
       }
       output.success(`Installed helix ${result.version} (${result.channel}) → ${result.binaryPath}`);
-      console.log(chalk22.dim(`  sha256 ${result.sha256}`));
+      console.log(chalk23.dim(`  sha256 ${result.sha256}`));
       if (result.aliasPath !== undefined) {
-        console.log(chalk22.dim(`  alias  ${result.aliasPath}`));
+        console.log(chalk23.dim(`  alias  ${result.aliasPath}`));
       }
       if (result.pathLine !== undefined) {
-        console.log(`${chalk22.yellow("⚠")} The install directory is not on your PATH. Add this line to your shell profile:`);
-        console.log(`  ${chalk22.cyan(result.pathLine)}`);
+        console.log(`${chalk23.yellow("⚠")} The install directory is not on your PATH. Add this line to your shell profile:`);
+        console.log(`  ${chalk23.cyan(result.pathLine)}`);
       }
-      console.log(`${chalk22.blue("→")} Next: ${result.nextStep}`);
+      console.log(`${chalk23.blue("→")} Next: ${result.nextStep}`);
     } catch (error3) {
       handleError(error3, isJson);
     }
@@ -26412,8 +26454,9 @@ async function exchangeToken(input2, deps = {}) {
   if (response.status === 401)
     throw deadKeyError();
   if (response.status === 403) {
-    const detail = scrubKnown(messageFrom(await response.text().catch(() => "")));
-    throw new MutagentError("SANDBOX_WORKSPACE_FORBIDDEN", detail !== "" ? detail : `Your API key is valid, but this account cannot use workspace "${input2.workspaceId}".`, `Pick a workspace you belong to: mutagent workspaces list, then mutagent workspaces use <name>`);
+    const context = { ...input2.tenancy, workspaceId: input2.workspaceId };
+    const body = await response.text().catch(() => "");
+    throw tenancyFailure(403, body, context) ?? workspaceDenied(context);
   }
   if (!response.ok) {
     const detail = scrubKnown(messageFrom(await response.text().catch(() => "")));
@@ -26500,7 +26543,18 @@ async function resolveConnection() {
     workspaceOrigin: tenancy.workspaceOrigin,
     organizationId: tenancy.organization?.id
   });
-  return { endpoint: tenancy.endpoint, apiKey, workspaceId, headers };
+  return {
+    endpoint: tenancy.endpoint,
+    apiKey,
+    workspaceId,
+    headers,
+    tenancy: {
+      keyScope: tenancy.keyScope,
+      workspaceName: tenancy.workspaceName,
+      workspaceOrigin: tenancy.workspaceOrigin,
+      organizationName: tenancy.organization?.name
+    }
+  };
 }
 function requireWorkspace(workspaceId) {
   if (workspaceId === undefined || workspaceId.trim() === "") {
@@ -26525,7 +26579,12 @@ async function sandboxFetch(path, init, deps = {}) {
   try {
     const response = await fetchWithTokenRetry(`${endpoint}${path}`, init, { ...connection.headers, ...toHeaderRecord(init.headers) }, {
       doFetch: fetch,
-      authorization: async (forceRefresh) => `Bearer ${await getOperatorToken({ endpoint, apiKey: connection.apiKey, workspaceId: connection.workspaceId }, { forceRefresh }, deps)}`,
+      authorization: async (forceRefresh) => `Bearer ${await getOperatorToken({
+        endpoint,
+        apiKey: connection.apiKey,
+        workspaceId: connection.workspaceId,
+        ...connection.tenancy === undefined ? {} : { tenancy: connection.tenancy }
+      }, { forceRefresh }, deps)}`,
       onTokenRejected: () => {
         clearCachedToken(deps);
       }
@@ -27896,7 +27955,7 @@ function planLauncherArgv(argv, deps = defaultPlanDeps()) {
 init_output();
 init_errors();
 import { Command as Command14, Option as Option4 } from "commander";
-import chalk29 from "chalk";
+import chalk30 from "chalk";
 
 // src/lib/sandbox-checkpoints.ts
 async function captureCheckpoint(id, sessionId) {
@@ -27908,7 +27967,7 @@ async function captureCheckpoint(id, sessionId) {
 }
 
 // src/lib/sandbox-session.ts
-import chalk24 from "chalk";
+import chalk25 from "chalk";
 
 // src/lib/tty.ts
 function isPlainOutput() {
@@ -27929,7 +27988,7 @@ init_errors();
 init_known_secrets();
 
 // src/lib/sandbox-frames.ts
-import chalk23 from "chalk";
+import chalk24 from "chalk";
 var SILENT2 = new Set([
   "message_start",
   "message_update",
@@ -28021,7 +28080,7 @@ class FrameFeed {
     const arg = started?.arg ?? identifyingArg(frame.toolName, frame.args);
     const failed = isFailure(frame.result);
     const elapsed = started === undefined ? "" : formatDuration(this.#now() - started.startedAt);
-    const name = this.#plain ? toolName : failed ? chalk23.red(toolName) : chalk23.cyan(toolName);
+    const name = this.#plain ? toolName : failed ? chalk24.red(toolName) : chalk24.cyan(toolName);
     const visible = arg === "" ? toolName.padEnd(TOOL_COL) : `${toolName.padEnd(TOOL_COL)} ${arg}`;
     const head = arg === "" ? pad(name, toolName, TOOL_COL) : `${pad(name, toolName, TOOL_COL)} ${arg}`;
     const gap = " ".repeat(Math.max(2, DURATION_COL - visible.length));
@@ -28038,7 +28097,7 @@ class FrameFeed {
     const method = typeof frame.method === "string" ? frame.method : "request";
     const key = typeof frame.statusKey === "string" ? ` ${frame.statusKey}` : "";
     const body = `hitl ${method}${key}`;
-    return this.#line(this.#sym("◆", "?"), this.#plain ? body : chalk23.yellow(body));
+    return this.#line(this.#sym("◆", "?"), this.#plain ? body : chalk24.yellow(body));
   }
   #response(frame) {
     const command = typeof frame.command === "string" ? frame.command : "command";
@@ -28047,7 +28106,7 @@ class FrameFeed {
     const body = `${command}${id} ${ok ? "accepted" : "rejected"}`;
     if (this.#plain)
       return this.#line(ok ? "+" : "x", body);
-    return this.#line(ok ? "✓" : "✗", ok ? chalk23.green(body) : chalk23.red(body));
+    return this.#line(ok ? "✓" : "✗", ok ? chalk24.green(body) : chalk24.red(body));
   }
   #line(symbol3, body) {
     return `  ${symbol3} ${body}`;
@@ -28056,7 +28115,7 @@ class FrameFeed {
     return this.#plain ? plain : styled;
   }
   #dim(text) {
-    return this.#plain ? text : chalk23.dim(text);
+    return this.#plain ? text : chalk24.dim(text);
   }
   #rule(label) {
     const dash = this.#plain ? "-" : "─";
@@ -28146,7 +28205,7 @@ function formatDuration(ms) {
 
 // src/lib/sandbox-session.ts
 function dim(text) {
-  return isPlainOutput() ? text : chalk24.dim(text);
+  return isPlainOutput() ? text : chalk25.dim(text);
 }
 function reattachHint(id, lastSeq) {
   const since = lastSeq > 0 ? ` --since ${String(lastSeq)}` : "";
@@ -28310,17 +28369,48 @@ function parseSince(raw) {
   return value2;
 }
 
+// src/lib/helix-session-gone.ts
+init_errors();
+var GONE_STATUSES = new Set([404, 410]);
+var CONSEQUENCE = {
+  checkpoints: "its checkpoints can't be listed or restored from here",
+  restore: "it can't be restored from here",
+  stream: "it can't be attached to",
+  input: "it can't take input"
+};
+var NEW_SESSION_COMMANDS = ['mutagent helix -p "<task>"', "mutagent helix --mode rpc"];
+
+class SessionSandboxGoneError extends MutagentError {
+  serverMessage;
+  constructor(code, reference, route, serverMessage) {
+    super(code, `The sandbox of session ${reference} was deleted, so ${CONSEQUENCE[route]}.`, `Start a new session: ${NEW_SESSION_COMMANDS[0]} or ${NEW_SESSION_COMMANDS[1]}`);
+    this.serverMessage = serverMessage;
+    this.name = "SessionSandboxGoneError";
+  }
+  toJSON() {
+    return {
+      ...super.toJSON(),
+      _agentGuidance: { fix: [...NEW_SESSION_COMMANDS], notes: [`The server answered: ${this.serverMessage}`] }
+    };
+  }
+}
+function sessionGoneGuidance(error3, route, reference) {
+  if (!(error3 instanceof ApiError) || !GONE_STATUSES.has(error3.statusCode))
+    return error3;
+  return new SessionSandboxGoneError(error3.code, reference, route, error3.message);
+}
+
 // src/commands/helix/restore-command.ts
 init_output();
 init_errors();
-import chalk25 from "chalk";
+import chalk26 from "chalk";
 var DRIFT_MODES = ["warn", "refuse", "skip"];
 function registerRestore(session, root) {
   session.command("restore").description("Continue a session from a checkpoint in a rebuilt sandbox").argument("<reference>", "Session reference (hs1_...) from 'mutagent helix' or 'session list'; the session may be stopped").option("--snapshot <id>", "Checkpoint to use, from 'session checkpoints' (default: the newest complete one from this session's sandbox)").option("--on-drift <mode>", `If files the conversation names are missing: ${DRIFT_MODES.join(" | ")} (default: warn)`).option("--partial", "Also restore turns saved after the checkpoint (may end mid tool call)").addHelpText("after", `
 Examples:
-  ${chalk25.dim("$")} mutagent helix session restore <reference>
-  ${chalk25.dim("$")} mutagent helix session restore <reference> --snapshot snap_1
-  ${chalk25.dim("$")} mutagent helix session restore <reference> --on-drift refuse --json
+  ${chalk26.dim("$")} mutagent helix session restore <reference>
+  ${chalk26.dim("$")} mutagent helix session restore <reference> --snapshot snap_1
+  ${chalk26.dim("$")} mutagent helix session restore <reference> --on-drift refuse --json
 
 Rebuilds the sandbox (the old one may be stopped or gone), restores the workspace
 and settings where the checkpoint has them, and starts a new session that
@@ -28372,23 +28462,24 @@ AI Agent Directive:
         return;
       }
       output.success(`Sandbox ${result.sandboxId} rebuilt at generation ${String(result.generation)} from snapshot ${result.snapshotId}`);
-      console.error(chalk25.dim(`  New session ${result.reference} · stream continues at seq ${String(result.seq)}`));
+      console.error(chalk26.dim(`  New session ${result.reference} · stream continues at seq ${String(result.seq)}`));
       if (result.workspace !== null) {
-        console.error(chalk25.dim(`  Workspace: ${String(result.workspace.files)} files into ${result.cwd ?? "the default cwd"}`));
+        console.error(chalk26.dim(`  Workspace: ${String(result.workspace.files)} files into ${result.cwd ?? "the default cwd"}`));
       }
       if (result.settingsReplayed.length > 0) {
-        console.error(chalk25.dim(`  Replayed: ${result.settingsReplayed.join(", ")}`));
+        console.error(chalk26.dim(`  Replayed: ${result.settingsReplayed.join(", ")}`));
       }
       if (result.partial) {
-        console.error(chalk25.dim(`  Partial: ${String(result.partialBytes)} bytes beyond the checkpoint`));
+        console.error(chalk26.dim(`  Partial: ${String(result.partialBytes)} bytes beyond the checkpoint`));
       }
       for (const skipped of result.skippedSnapshots) {
-        console.error(chalk25.dim(`  skipped ${skipped.id}: ${skipped.reason}`));
+        console.error(chalk26.dim(`  skipped ${skipped.id}: ${skipped.reason}`));
       }
       for (const gap of result.notRestored)
-        console.error(chalk25.yellow(`  ! ${gap}`));
+        console.error(chalk26.yellow(`  ! ${gap}`));
     } catch (error3) {
-      handleError(error3, isJson);
+      const named = (options.snapshot?.trim() ?? "") !== "";
+      handleError(named ? error3 : sessionGoneGuidance(error3, "restore", reference), isJson);
     }
   });
 }
@@ -28403,12 +28494,12 @@ function parseDriftMode(raw) {
 // src/commands/helix/reference-commands.ts
 init_output();
 init_errors();
-import chalk26 from "chalk";
+import chalk27 from "chalk";
 function registerCheckpoints(session, root) {
   session.command("checkpoints").description("List the checkpoints of the sandbox a session runs in").argument("<reference>", "Session reference (hs1_...) from 'mutagent helix' or 'session list'").addHelpText("after", `
 Examples:
-  ${chalk26.dim("$")} mutagent helix session checkpoints <reference>
-  ${chalk26.dim("$")} mutagent helix session checkpoints <reference> --json
+  ${chalk27.dim("$")} mutagent helix session checkpoints <reference>
+  ${chalk27.dim("$")} mutagent helix session checkpoints <reference> --json
 
 Newest first, without the stored bytes. The list covers every session the
 sandbox has run, so SESSION names each checkpoint's session. MESSAGES is how
@@ -28428,7 +28519,7 @@ AI Agent Directive:
         return;
       }
       if (snapshots.length === 0) {
-        console.log(chalk26.gray("No checkpoints captured from this session's sandbox."));
+        console.log(chalk27.gray("No checkpoints captured from this session's sandbox."));
         console.log("");
         console.log(`  Capture one: mutagent helix session checkpoint ${reference}`);
         return;
@@ -28441,15 +28532,15 @@ AI Agent Directive:
         captured: new Date(snapshot.capturedAt).toLocaleString()
       })));
     } catch (error3) {
-      handleError(error3, isJson);
+      handleError(sessionGoneGuidance(error3, "checkpoints", reference), isJson);
     }
   });
 }
 function registerCloseInput(session, root) {
   session.command("close-input").description("Close a session's input (end of stdin)").argument("<reference>", "Session reference (hs1_...) from 'mutagent helix' or 'session list'").addHelpText("after", `
 Examples:
-  ${chalk26.dim("$")} mutagent helix session close-input <reference>
-  ${chalk26.dim("$")} mutagent helix session close-input <reference> --json
+  ${chalk27.dim("$")} mutagent helix session close-input <reference>
+  ${chalk27.dim("$")} mutagent helix session close-input <reference> --json
 
 Sends end-of-input to the session, as closing stdin does on 'mutagent helix --mode rpc'.
 An interactive session finishes its current work and ends; later 'session send' is
@@ -28492,7 +28583,7 @@ function planSessionStartArgs(argv, deps) {
 init_output();
 init_errors();
 import { Option as Option2 } from "commander";
-import chalk27 from "chalk";
+import chalk28 from "chalk";
 import { randomUUID as randomUUID4 } from "crypto";
 var COMMAND_TYPES = ["prompt", "steer", "follow_up", "abort"];
 var NEEDS_MESSAGE = new Set(["prompt", "steer", "follow_up"]);
@@ -28500,11 +28591,11 @@ function registerSendCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("send").description("Send a prompt or command to a session").argument("<reference>", "Session reference (hs1_...)").argument("[message...]", "What to say to the agent").addOption(new Option2("--session <id>", "The session id, when the first argument is a sandbox id").hideHelp()).option("--type <type>", `${COMMAND_TYPES.join(" | ")} (default: prompt)`).option("--line <json>", "Send this exact JSON command instead of building one").option("--message-id <id>", "Use this command id instead of a generated one").addHelpText("after", `
 Examples:
-  ${chalk27.dim("$")} mutagent helix session send <reference> "also check the refresh path"
-  ${chalk27.dim("$")} mutagent helix session send <reference> --type steer "stop and re-read the spec"
-  ${chalk27.dim("$")} mutagent helix session send <reference> --type abort
-  ${chalk27.dim("$")} mutagent helix session send <reference> --line '{"type":"prompt","id":"p7","message":"go"}'
-  ${chalk27.dim("$")} mutagent helix session send <reference> "run the tests" --json
+  ${chalk28.dim("$")} mutagent helix session send <reference> "also check the refresh path"
+  ${chalk28.dim("$")} mutagent helix session send <reference> --type steer "stop and re-read the spec"
+  ${chalk28.dim("$")} mutagent helix session send <reference> --type abort
+  ${chalk28.dim("$")} mutagent helix session send <reference> --line '{"type":"prompt","id":"p7","message":"go"}'
+  ${chalk28.dim("$")} mutagent helix session send <reference> "run the tests" --json
 
 Types:
   prompt     A new instruction to an agent that has finished its turn
@@ -28523,7 +28614,7 @@ reference reach the woken session. 'mutagent helix session restore <reference>'
 manual option; it continues the session in a new sandbox and prints the new reference.
 Send does not wait for the reply. The reply arrives on the session's stream as a
 'response' event carrying the command id (in --json output). Watch it with:
-  ${chalk27.dim("$")} mutagent helix session attach <reference>
+  ${chalk28.dim("$")} mutagent helix session attach <reference>
 
 AI Agent Directive:
   --json returns ONE object: { success, reference, type, id, line, accepted,
@@ -28571,10 +28662,10 @@ AI Agent Directive:
         return;
       }
       output.success(`Sent ${built.type} to session ${sessionId}`);
-      console.error(chalk27.dim(`  ${built.line}`));
-      console.error(chalk27.dim(`  The reply arrives on the stream, not here: mutagent sandbox attach ${id}`));
+      console.error(chalk28.dim(`  ${built.line}`));
+      console.error(chalk28.dim(`  The reply arrives on the stream, not here: mutagent sandbox attach ${id}`));
     } catch (error3) {
-      handleError(error3, isJson);
+      handleError(options.session === undefined ? sessionGoneGuidance(error3, "input", id) : error3, isJson);
     }
   });
 }
@@ -28637,16 +28728,16 @@ function readType(raw) {
 init_output();
 init_errors();
 import { Option as Option3 } from "commander";
-import chalk28 from "chalk";
+import chalk29 from "chalk";
 var SIGNAL_TYPES = ["SIGINT", "SIGTERM"];
 var DEFAULT_SIGNAL = "SIGINT";
 function registerSignalCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("signal").description("Stop a session with SIGINT or SIGTERM; its sandbox stays up").argument("<reference>", "Session reference (hs1_...)").addOption(new Option3("--session <id>", "The session id, when the argument is a sandbox id").hideHelp()).option("--type <signal>", `${SIGNAL_TYPES.join(" | ")} (default: ${DEFAULT_SIGNAL})`).option("-f, --force", "Confirm the stop (required in every mode, --json included)").addHelpText("after", `
 Examples:
-  ${chalk28.dim("$")} mutagent helix session signal <reference> --force
-  ${chalk28.dim("$")} mutagent helix session signal <reference> --type SIGTERM --force
-  ${chalk28.dim("$")} mutagent helix session signal <reference> --force --json
+  ${chalk29.dim("$")} mutagent helix session signal <reference> --force
+  ${chalk29.dim("$")} mutagent helix session signal <reference> --type SIGTERM --force
+  ${chalk29.dim("$")} mutagent helix session signal <reference> --force --json
 
 SIGINT (the signal Ctrl-C sends) and SIGTERM both stop the session's Helix process.
 SIGKILL is not supported.
@@ -28715,8 +28806,8 @@ AI Agent Directive:
         return;
       }
       output.success(`Sent ${signal} to session ${sessionId}`);
-      console.error(chalk28.dim(`  The sandbox is still up: mutagent sandbox attach ${id}`));
-      console.error(chalk28.dim(`  Destroy it with: mutagent sandbox delete ${id} --force`));
+      console.error(chalk29.dim(`  The sandbox is still up: mutagent sandbox attach ${id}`));
+      console.error(chalk29.dim(`  Destroy it with: mutagent sandbox delete ${id} --force`));
     } catch (error3) {
       handleError(error3, isJson);
     }
@@ -28736,11 +28827,11 @@ function resolveSignal(raw) {
 function registerSessionCommand(parent) {
   const session = new Command14("session").description("List, watch and control Helix sessions").addHelpText("after", `
 Examples:
-  ${chalk29.dim("$")} mutagent helix session list
-  ${chalk29.dim("$")} mutagent helix session attach <reference>
-  ${chalk29.dim("$")} mutagent helix session send <reference> "and now the tests"
-  ${chalk29.dim("$")} mutagent helix session signal <reference> --force
-  ${chalk29.dim("$")} mutagent helix session checkpoint <reference>
+  ${chalk30.dim("$")} mutagent helix session list
+  ${chalk30.dim("$")} mutagent helix session attach <reference>
+  ${chalk30.dim("$")} mutagent helix session send <reference> "and now the tests"
+  ${chalk30.dim("$")} mutagent helix session signal <reference> --force
+  ${chalk30.dim("$")} mutagent helix session checkpoint <reference>
 
 A session reference (hs1_...) is printed when a run starts and listed by 'session list'.
 attach, send, signal, close-input, checkpoint, checkpoints and restore take it.
@@ -28779,10 +28870,10 @@ function withSessionFlags(options, own) {
 function registerStart(session, root) {
   session.command("start", { hidden: true }).description("Start a Helix session in an existing sandbox, by sandbox id").argument("<sandbox-id>", "Sandbox to start the session in").argument("[args...]", "Helix flags (put -- before them)").allowUnknownOption(true).allowExcessArguments(true).option("--rpc", "Start an interactive session that accepts 'session send' (default: headless, runs once and ends)").option("--cwd <path>", "Working directory (default: $HOME for an interactive session)").option("--env <name>", "Workspace Environment to load (see mutagent env list)").addHelpText("after", `
 Examples:
-  ${chalk29.dim("$")} mutagent helix session start sbx_123 --rpc
-  ${chalk29.dim("$")} mutagent helix session start sbx_123 --rpc --env staging
-  ${chalk29.dim("$")} mutagent helix session start sbx_123 --rpc --json
-  ${chalk29.dim("$")} mutagent helix session start sbx_123 -- --model <provider/model> --thinking high
+  ${chalk30.dim("$")} mutagent helix session start sbx_123 --rpc
+  ${chalk30.dim("$")} mutagent helix session start sbx_123 --rpc --env staging
+  ${chalk30.dim("$")} mutagent helix session start sbx_123 --rpc --json
+  ${chalk30.dim("$")} mutagent helix session start sbx_123 -- --model <provider/model> --thinking high
 
 Prints the session id. Address the session as <sandbox-id> --session <session-id>
 for send, signal and checkpoint, and watch it with 'mutagent sandbox attach <sandbox-id>'.
@@ -28835,9 +28926,9 @@ AI Agent Directive:
         return;
       }
       output.success(`Session ${sessionId} started in ${id} (${mode})`);
-      console.error(chalk29.dim(`  Watch it:   mutagent sandbox attach ${id}`));
+      console.error(chalk30.dim(`  Watch it:   mutagent sandbox attach ${id}`));
       if (mode === "interactive") {
-        console.error(chalk29.dim(`  Talk to it: mutagent helix session send ${id} --session ${sessionId} "<message>"`));
+        console.error(chalk30.dim(`  Talk to it: mutagent helix session send ${id} --session ${sessionId} "<message>"`));
       }
     } catch (error3) {
       handleError(error3, isJson);
@@ -28852,8 +28943,8 @@ function requireSessionId(result, sandboxId) {
 function registerSessionList(session, root) {
   session.command("list").alias("ls").description("List this workspace's Helix sessions").argument("[sandbox-id]", "List only the session ids in this sandbox").addHelpText("after", `
 Examples:
-  ${chalk29.dim("$")} mutagent helix session list
-  ${chalk29.dim("$")} mutagent helix session list --json
+  ${chalk30.dim("$")} mutagent helix session list
+  ${chalk30.dim("$")} mutagent helix session list --json
 
 Every session in the workspace, live and ended, newest activity first.
 STATUS is live (running now), ended (finished; exitCode in --json), stopped-for-idling
@@ -28879,7 +28970,7 @@ AI Agent Directive:
           return;
         }
         if (sessions2.length === 0) {
-          console.log(chalk29.gray(`No sessions running in ${id}.`));
+          console.log(chalk30.gray(`No sessions running in ${id}.`));
           console.log("");
           console.log(`  Start one: mutagent helix session start ${id} --rpc`);
           return;
@@ -28898,7 +28989,7 @@ AI Agent Directive:
         return;
       }
       if (sessions.length === 0) {
-        console.log(chalk29.gray("No Helix sessions in this workspace yet."));
+        console.log(chalk30.gray("No Helix sessions in this workspace yet."));
         console.log("");
         console.log('  Start one: mutagent helix -p "<task>"  or  mutagent helix --rpc');
         return;
@@ -28913,7 +29004,7 @@ AI Agent Directive:
         "LAST ACTIVITY": s.lastActivityAt
       })));
       if (nextCursor !== undefined) {
-        console.log(chalk29.gray("\nMore sessions — re-run with the cursor from --json `nextCursor`."));
+        console.log(chalk30.gray("\nMore sessions — re-run with the cursor from --json `nextCursor`."));
       }
     } catch (error3) {
       handleError(error3, isJson);
@@ -28943,15 +29034,15 @@ function registerSessionAttach(session) {
         send: (line, signal) => sendHelixInput(reference, line, signal)
       });
     } catch (error3) {
-      handleError(error3, false);
+      handleError(sessionGoneGuidance(error3, "stream", reference), false);
     }
   });
 }
 function registerCheckpoint(session, root) {
   session.command("checkpoint").description("Save a session's conversation as a checkpoint").argument("<reference>", "Session reference (hs1_...)").addOption(new Option4("--session <id>", "The session id, when the argument is a sandbox id").hideHelp()).addHelpText("after", `
 Examples:
-  ${chalk29.dim("$")} mutagent helix session checkpoint <reference>
-  ${chalk29.dim("$")} mutagent helix session checkpoint <reference> --json
+  ${chalk30.dim("$")} mutagent helix session checkpoint <reference>
+  ${chalk30.dim("$")} mutagent helix session checkpoint <reference> --json
 
 Saves Helix's own session file, and the workspace and settings where the
 deployment supports it. notCaptured lists anything left out.
@@ -29000,7 +29091,7 @@ AI Agent Directive:
       if (Array.isArray(result.notCaptured))
         for (const reason of result.notCaptured)
           output.warn("Not captured: " + reason);
-      console.error(chalk29.dim(`  ${String(result.messageCount)} messages, ${String(result.bytes)} bytes, from ${result.sourcePath}`));
+      console.error(chalk30.dim(`  ${String(result.messageCount)} messages, ${String(result.bytes)} bytes, from ${result.sourcePath}`));
     } catch (error3) {
       handleError(error3, isJson);
     }
@@ -29016,10 +29107,10 @@ function requireSession(raw, example) {
 // src/commands/helix/models.ts
 init_output();
 init_errors();
-import chalk30 from "chalk";
+import chalk31 from "chalk";
 function printView(view, output) {
   if (view.models.length === 0) {
-    console.log(chalk30.gray("No Helix Cloud models: this workspace has no active LLM provider that Helix can use."));
+    console.log(chalk31.gray("No Helix Cloud models: this workspace has no active LLM provider that Helix can use."));
     console.log("");
     console.log("  Add one: mutagent providers add --provider <id> --name <name> --api-key <key>");
   } else {
@@ -29029,19 +29120,19 @@ function printView(view, output) {
       name: m.displayName
     })));
     console.log("");
-    console.log(view.default === null ? chalk30.yellow("No default set — a run without --model answers 428. Set one: mutagent helix models default <provider/model>") : `Default: ${view.default}`);
+    console.log(view.default === null ? chalk31.yellow("No default set — a run without --model answers 428. Set one: mutagent helix models default <provider/model>") : `Default: ${view.default}`);
   }
   if (view.unmapped.length > 0) {
-    console.log(chalk30.yellow(`Not usable by Helix Cloud (Helix cannot load this LLM provider's key): ${view.unmapped.join(", ")}`));
+    console.log(chalk31.yellow(`Not usable by Helix Cloud (Helix cannot load this LLM provider's key): ${view.unmapped.join(", ")}`));
   }
 }
 function registerModelsCommand(helix) {
   const models = helix.command("models").description("List the models Helix can use in the cloud, and the workspace default model").addHelpText("after", `
 Examples:
-  ${chalk30.dim("$")} mutagent helix models
-  ${chalk30.dim("$")} mutagent helix models --json
-  ${chalk30.dim("$")} mutagent helix models default zai-coding-cn/glm-5.2
-  ${chalk30.dim("$")} mutagent helix models default zai-coding-cn/glm-5.2 openai/gpt-5
+  ${chalk31.dim("$")} mutagent helix models
+  ${chalk31.dim("$")} mutagent helix models --json
+  ${chalk31.dim("$")} mutagent helix models default zai-coding-cn/glm-5.2
+  ${chalk31.dim("$")} mutagent helix models default zai-coding-cn/glm-5.2 openai/gpt-5
 
 Lists the models your workspace's active LLM providers ('mutagent providers') give
 Helix in the cloud. Each id is provider/model: pass it as --model to 'mutagent helix'
@@ -29070,9 +29161,9 @@ AI Agent Directive:
   });
   models.command("default").description("Set the workspace default model for Helix in the cloud, and its fallbacks").argument("[models...]", "Model ids from 'mutagent helix models'; the first is the default").option("--clear", "Remove the default model and every fallback").addHelpText("after", `
 Examples:
-  ${chalk30.dim("$")} mutagent helix models default zai-coding-cn/glm-5.2
-  ${chalk30.dim("$")} mutagent helix models default zai-coding-cn/glm-5.2 openai/gpt-5
-  ${chalk30.dim("$")} mutagent helix models default --clear
+  ${chalk31.dim("$")} mutagent helix models default zai-coding-cn/glm-5.2
+  ${chalk31.dim("$")} mutagent helix models default zai-coding-cn/glm-5.2 openai/gpt-5
+  ${chalk31.dim("$")} mutagent helix models default --clear
 
 Replaces the list. The first id is the default; later ids are used in order when
 an earlier model's LLM provider has been turned off. Every id must appear in
@@ -29107,7 +29198,7 @@ AI Agent Directive:
 init_output();
 init_errors();
 import { Option as Option5 } from "commander";
-import chalk31 from "chalk";
+import chalk32 from "chalk";
 
 // src/lib/sandbox-catalog.ts
 async function listPresets() {
@@ -29143,8 +29234,8 @@ function registerDoctorCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("doctor").description("Check the Helix build in the cloud image").addOption(new Option5("--sandbox <id>", "Run in an existing sandbox, by sandbox id").hideHelp()).option("--preset <name>", "Sandbox preset (not with --sandbox)").option("--strict", "Also launch Helix's embedded harness with --version and fail if it fails").option("--welcome", "Print the Helix welcome screen instead of the report").option("--refresh-runtime", "Refused: the cloud image has no Helix runtime to refresh").allowUnknownOption(true).addHelpText("after", `
 Examples:
-  ${chalk31.dim("$")} mutagent helix doctor
-  ${chalk31.dim("$")} mutagent helix doctor --strict --json
+  ${chalk32.dim("$")} mutagent helix doctor
+  ${chalk32.dim("$")} mutagent helix doctor --strict --json
 
 Runs Helix's own diagnostics in a temporary sandbox that is removed afterwards,
 and exits with Helix's exit code. It checks the cloud image, not your machine:
@@ -29180,8 +29271,8 @@ function registerSmokeCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("smoke").description("Run Helix's smoke test in the cloud").addOption(new Option5("--sandbox <id>", "Run in an existing sandbox, by sandbox id").hideHelp()).option("--preset <name>", "Sandbox preset (not with --sandbox)").allowUnknownOption(true).addHelpText("after", `
 Examples:
-  ${chalk31.dim("$")} mutagent helix smoke
-  ${chalk31.dim("$")} mutagent helix smoke --json
+  ${chalk32.dim("$")} mutagent helix smoke
+  ${chalk32.dim("$")} mutagent helix smoke --json
 
 Runs one real model turn in a temporary sandbox that is removed afterwards, and
 exits with Helix's exit code.
@@ -29225,8 +29316,8 @@ function registerVersionCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("version").description("Show this CLI's version and the Helix version the cloud uses").addHelpText("after", `
 Examples:
-  ${chalk31.dim("$")} mutagent helix version
-  ${chalk31.dim("$")} mutagent helix version --json
+  ${chalk32.dim("$")} mutagent helix version
+  ${chalk32.dim("$")} mutagent helix version --json
 
 cli    the mutagent CLI you are running
 helix  the Helix version the cloud image is released with, as the server reports it
@@ -29252,7 +29343,7 @@ async function reportVersions(isJson) {
     return;
   }
   console.log(`cli    ${cli}`);
-  console.log(`helix  ${helix ?? "unknown"} ${chalk31.dim("(pinned by the image, per the backend’s presets)")}`);
+  console.log(`helix  ${helix ?? "unknown"} ${chalk32.dim("(pinned by the image, per the backend’s presets)")}`);
 }
 async function pinnedHelixVersion() {
   const { presets, default: fallback } = await listPresets();
@@ -29364,12 +29455,12 @@ function createHelixCommand() {
 
 // src/commands/sandbox/index.ts
 import { Command as Command16 } from "commander";
-import chalk38 from "chalk";
+import chalk39 from "chalk";
 
 // src/commands/sandbox/spawn.ts
 init_output();
 init_errors();
-import chalk32 from "chalk";
+import chalk33 from "chalk";
 var ARCHES = ["x86_64", "arm64"];
 var EGRESS_POLICIES = ["deny", "allowlist", "allow"];
 var EGRESS_KINDS = ["port", "cidr", "domain"];
@@ -29377,10 +29468,10 @@ function registerSpawnCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("spawn").description("Spawn a persistent sandbox from an image and attach to it").requiredOption("--image <ref>", "Image reference (repository:tag or @digest)").option("--arch <arch>", `Image architecture: ${ARCHES.join(" | ")} (default: this host's)`).option("--name <name>", "Definition name (default: derived from the image reference)").option("--provider <name>", "Sandbox provider (default: the server's; see sandbox providers)").option("--env <name>", "Workspace Environment to load (see mutagent env list)").option("--egress <policy>", `Outbound network: ${EGRESS_POLICIES.join(" | ")} (default: deny)`).option("--egress-allow <rule>", "domain:, port: or cidr: rule for --egress allowlist (repeatable)", collectRule, []).option("--detach", "Print the sandbox ID and return").addHelpText("after", `
 Examples:
-  ${chalk32.dim("$")} mutagent sandbox spawn --image alpine:3.20
-  ${chalk32.dim("$")} mutagent sandbox spawn --image alpine:3.20 --detach --json
-  ${chalk32.dim("$")} mutagent sandbox spawn --image <helix-image> --egress allow
-  ${chalk32.dim("$")} mutagent sandbox spawn --image <ref> --egress allowlist --egress-allow domain:api.anthropic.com
+  ${chalk33.dim("$")} mutagent sandbox spawn --image alpine:3.20
+  ${chalk33.dim("$")} mutagent sandbox spawn --image alpine:3.20 --detach --json
+  ${chalk33.dim("$")} mutagent sandbox spawn --image <helix-image> --egress allow
+  ${chalk33.dim("$")} mutagent sandbox spawn --image <ref> --egress allowlist --egress-allow domain:api.anthropic.com
 
 --arch defaults to this machine's architecture; set it for an image built elsewhere.
 Egress defaults to deny. On Docker the sandbox then runs with --network none, so a Helix
@@ -29517,10 +29608,10 @@ async function createSandbox(definition, isJson) {
   const spinner = ora3(`Spawning ${definition.image} (${definition.arch})...`).start();
   try {
     const sandbox = await spawnSandbox(definition);
-    spinner.succeed(chalk32.green(`Sandbox ${sandbox.id} spawned`));
+    spinner.succeed(chalk33.green(`Sandbox ${sandbox.id} spawned`));
     return sandbox;
   } catch (error3) {
-    spinner.fail(chalk32.red("Spawn failed"));
+    spinner.fail(chalk33.red("Spawn failed"));
     throw error3;
   }
 }
@@ -29557,18 +29648,18 @@ function reportDetached(sandbox, id, output, isJson) {
 // src/commands/sandbox/exec.ts
 init_output();
 init_errors();
-import chalk33 from "chalk";
+import chalk34 from "chalk";
 function registerExecCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("exec").description("Run a command in a sandbox — an existing one, or a fresh one").argument("<argv...>", "Command and arguments (argv, not a shell string)").option("--sandbox <id>", "Run in this existing sandbox instead of a fresh one").option("--preset <name>", "Preset for a fresh sandbox (not with --sandbox)").option("--keep", "Keep the fresh sandbox after the command (not with --sandbox)").option("--cwd <dir>", "Working directory inside the sandbox").option("--timeout-ms <n>", "Command timeout in milliseconds").option("--no-stream", "With --sandbox, wait for the full result instead of streaming").addHelpText("after", `
 Examples:
-  ${chalk33.dim("$")} mutagent sandbox exec -- uname -m
-  ${chalk33.dim("$")} mutagent sandbox exec --json --preset <name> -- uname -m
-  ${chalk33.dim("$")} mutagent sandbox exec --sandbox sbx_123 --cwd /src -- git status
-  ${chalk33.dim("$")} mutagent sandbox exec -- sh -c 'ls | wc -l'
+  ${chalk34.dim("$")} mutagent sandbox exec -- uname -m
+  ${chalk34.dim("$")} mutagent sandbox exec --json --preset <name> -- uname -m
+  ${chalk34.dim("$")} mutagent sandbox exec --sandbox sbx_123 --cwd /src -- git status
+  ${chalk34.dim("$")} mutagent sandbox exec -- sh -c 'ls | wc -l'
 
 Put this command's flags, and --json, before the sandbox command; everything after it
-goes to the sandbox unchanged (${chalk33.bold("--")} is optional). The command is argv, not a shell
+goes to the sandbox unchanged (${chalk34.bold("--")} is optional). The command is argv, not a shell
 string: name a shell for pipes.
 
 Without --sandbox, a fresh sandbox starts from a preset (see sandbox presets), runs the
@@ -29700,15 +29791,15 @@ function reportResult(result, output, isJson, context) {
 // src/commands/sandbox/attach.ts
 init_output();
 init_errors();
-import chalk34 from "chalk";
+import chalk35 from "chalk";
 function registerAttachCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("attach").description("Stream a running sandbox's output").argument("<id>", "Sandbox ID").option("--since <seq>", "Resume after this sequence number instead of from the start").addHelpText("after", `
 Examples:
-  ${chalk34.dim("$")} mutagent sandbox attach sbx_123
-  ${chalk34.dim("$")} mutagent sandbox attach sbx_123 --since 412
-  ${chalk34.dim("$")} mutagent sandbox attach sbx_123 --json | tail -1
-  ${chalk34.dim("$")} mutagent sandbox attach sbx_123 > session.log
+  ${chalk35.dim("$")} mutagent sandbox attach sbx_123
+  ${chalk35.dim("$")} mutagent sandbox attach sbx_123 --since 412
+  ${chalk35.dim("$")} mutagent sandbox attach sbx_123 --json | tail -1
+  ${chalk35.dim("$")} mutagent sandbox attach sbx_123 > session.log
 
 Ctrl-C detaches; the sandbox keeps running and the re-attach command, with the resume
 point filled in, is printed to stderr. The sandbox runs until it is removed or stopped
@@ -29753,7 +29844,7 @@ AI Agent Directive:
 }
 
 // src/commands/sandbox/access.ts
-import chalk35 from "chalk";
+import chalk36 from "chalk";
 
 // src/lib/sandbox-access.ts
 init_errors();
@@ -29783,8 +29874,8 @@ init_output();
 function registerAccessCommand(parent) {
   parent.command("access").description("Check whether this account can create cloud sandboxes").addHelpText("after", `
 Examples:
-  ${chalk35.dim("$")} mutagent sandbox access
-  ${chalk35.dim("$")} mutagent sandbox access --json
+  ${chalk36.dim("$")} mutagent sandbox access
+  ${chalk36.dim("$")} mutagent sandbox access --json
 
 Asks the server once (GET /api/sandbox/access) for the current workspace and the
 signed-in account. It is a diagnostic: a launch needs no check first. Use it when
@@ -29825,13 +29916,13 @@ Requires a workspace: mutagent workspaces use <name> (or --workspace for one com
 // src/commands/sandbox/providers.ts
 init_output();
 init_errors();
-import chalk36 from "chalk";
+import chalk37 from "chalk";
 function registerProvidersCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("providers").description("List sandbox providers for mutagent helix --sandbox-provider (requires sign-in)").addHelpText("after", `
 Examples:
-  ${chalk36.dim("$")} mutagent sandbox providers
-  ${chalk36.dim("$")} mutagent sandbox providers --json
+  ${chalk37.dim("$")} mutagent sandbox providers
+  ${chalk37.dim("$")} mutagent sandbox providers --json
 
 A sandbox provider is where a sandbox runs (for example docker or mutagent-cloud). It is not an
 LLM provider (\`mutagent providers\`) and not an Environment (\`mutagent env\`).
@@ -29854,7 +29945,7 @@ AI Agent Directive:
         return;
       }
       if (list.names.length === 0) {
-        console.log(chalk36.gray("No sandbox providers configured on this backend."));
+        console.log(chalk37.gray("No sandbox providers configured on this backend."));
         return;
       }
       output.output(list.names.map((name) => ({ name, default: name === list.default ? "yes" : "" })));
@@ -29867,9 +29958,9 @@ function registerPreflightCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("preflight").description("Check whether a sandbox provider can run a definition, without creating anything").requiredOption("--image <ref>", "Image reference (repository:tag or @digest)").option("--arch <arch>", "Image architecture: x86_64 | arm64 (default: this host's)").option("--name <name>", "Definition name (default: derived from the image reference)").option("--provider <name>", "Sandbox provider to check against (default: the server's)").option("--env <name>", "Workspace Environment the definition would load").option("--egress <policy>", "Outbound network: deny | allowlist | allow (default: deny)").option("--egress-allow <rule>", "domain:, port: or cidr: rule for --egress allowlist (repeatable)", (value2, previous) => [...previous, value2], []).addHelpText("after", `
 Examples:
-  ${chalk36.dim("$")} mutagent sandbox preflight --image alpine:3.20
-  ${chalk36.dim("$")} mutagent sandbox preflight --image alpine:3.20 --provider mutagent-cloud --json
-  ${chalk36.dim("$")} mutagent sandbox preflight --image <ref> --egress allowlist --egress-allow domain:api.anthropic.com
+  ${chalk37.dim("$")} mutagent sandbox preflight --image alpine:3.20
+  ${chalk37.dim("$")} mutagent sandbox preflight --image alpine:3.20 --provider mutagent-cloud --json
+  ${chalk37.dim("$")} mutagent sandbox preflight --image <ref> --egress allowlist --egress-allow domain:api.anthropic.com
 
 Takes the same flags as spawn and checks the definition spawn would send. Every
 violation is listed. An incompatible definition exits 0 with compatible: false;
@@ -29898,7 +29989,7 @@ AI Agent Directive:
         output.success(`${definition.name} is compatible with ${verdict.provider}`);
         return;
       }
-      console.log(chalk36.yellow(`${definition.name} is NOT compatible with ${verdict.provider}:`));
+      console.log(chalk37.yellow(`${definition.name} is NOT compatible with ${verdict.provider}:`));
       for (const violation of verdict.violations)
         console.log(`  - ${violation}`);
     } catch (error3) {
@@ -29910,13 +30001,13 @@ AI Agent Directive:
 // src/commands/sandbox/inventory.ts
 init_output();
 init_errors();
-import chalk37 from "chalk";
+import chalk38 from "chalk";
 function registerListCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("list").alias("ls").description("List the workspace's live sandboxes").addHelpText("after", `
 Examples:
-  ${chalk37.dim("$")} mutagent sandbox list
-  ${chalk37.dim("$")} mutagent sandbox list --json
+  ${chalk38.dim("$")} mutagent sandbox list
+  ${chalk38.dim("$")} mutagent sandbox list --json
 
 Lists the sandboxes in the configured workspace
 (mutagent workspaces use <name>).
@@ -29938,7 +30029,7 @@ AI Agent Directive:
         return;
       }
       if (sandboxes.length === 0) {
-        console.log(chalk37.gray("No sandboxes running."));
+        console.log(chalk38.gray("No sandboxes running."));
         console.log("");
         console.log("  Start one: mutagent sandbox spawn --image <ref>");
         return;
@@ -29963,8 +30054,8 @@ function registerPresetsCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("presets").description("List presets for mutagent helix --preset (requires sign-in)").addHelpText("after", `
 Examples:
-  ${chalk37.dim("$")} mutagent sandbox presets
-  ${chalk37.dim("$")} mutagent sandbox presets --json
+  ${chalk38.dim("$")} mutagent sandbox presets
+  ${chalk38.dim("$")} mutagent sandbox presets --json
 
 A preset is a named sandbox definition kept on the server. \`mutagent helix --preset <name>\`
 and \`mutagent sandbox exec --preset <name>\` use it. Image references are not shown.
@@ -29985,7 +30076,7 @@ AI Agent Directive:
         return;
       }
       if (presets.length === 0) {
-        console.log(chalk37.gray("No presets configured on this backend."));
+        console.log(chalk38.gray("No presets configured on this backend."));
         console.log("");
         console.log("  Spawn with an explicit image: mutagent sandbox spawn --image <ref>");
         return;
@@ -30006,8 +30097,8 @@ function registerDeleteCommand2(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("delete").alias("rm").description("Destroy a sandbox now").argument("<id>", "Sandbox ID").option("-f, --force", "Confirm (required in every mode, --json included)").addHelpText("after", `
 Examples:
-  ${chalk37.dim("$")} mutagent sandbox delete sbx_123 --force
-  ${chalk37.dim("$")} mutagent sandbox delete sbx_123 --force --json
+  ${chalk38.dim("$")} mutagent sandbox delete sbx_123 --force
+  ${chalk38.dim("$")} mutagent sandbox delete sbx_123 --force --json
 
 Ends every session in the sandbox. The server first tries to capture a checkpoint,
 so a Helix session can be rebuilt with \`mutagent helix session restore <reference>\`.
@@ -30050,8 +30141,8 @@ function registerTracesCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("traces").description("Show the spans recorded for a sandbox").argument("<id>", "Sandbox ID").addHelpText("after", `
 Examples:
-  ${chalk37.dim("$")} mutagent sandbox traces sbx_123
-  ${chalk37.dim("$")} mutagent sandbox traces sbx_123 --json
+  ${chalk38.dim("$")} mutagent sandbox traces sbx_123
+  ${chalk38.dim("$")} mutagent sandbox traces sbx_123 --json
 
 An empty list means no spans were recorded; telemetry must be configured on the
 server for spans to exist.
@@ -30071,7 +30162,7 @@ AI Agent Directive:
         return;
       }
       if (spans.length === 0) {
-        console.log(chalk37.gray(`No spans captured for sandbox ${id}.`));
+        console.log(chalk38.gray(`No spans captured for sandbox ${id}.`));
         return;
       }
       output.output(spans.map((span) => {
@@ -30092,8 +30183,8 @@ function registerStatusCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("status").description("Print one sandbox's state").argument("<id>", "Sandbox ID").addHelpText("after", `
 Examples:
-  ${chalk37.dim("$")} mutagent sandbox status sbx_123
-  ${chalk37.dim("$")} mutagent sandbox status sbx_123 --json
+  ${chalk38.dim("$")} mutagent sandbox status sbx_123
+  ${chalk38.dim("$")} mutagent sandbox status sbx_123 --json
 
 States: pending, starting, running, paused, stopping, stopped, failed.
 For sandbox provider, arch and creation time use \`mutagent sandbox list --json\`.
@@ -30122,29 +30213,29 @@ AI Agent Directive:
 function createSandboxCommand() {
   const sandbox = new Command16("sandbox").description("Cloud sandboxes (advanced): run a command in a box; agent runs use mutagent helix").addHelpText("after", `
 Examples:
-  ${chalk38.dim("$")} mutagent sandbox exec -- uname -m               ${chalk38.dim("Run one shell command in a fresh cloud sandbox")}
-  ${chalk38.dim("$")} mutagent helix --sandbox-provider mutagent-cloud -p "run the tests"  ${chalk38.dim("Run an agent task in a cloud sandbox")}
-  ${chalk38.dim("$")} mutagent sandbox list
-  ${chalk38.dim("$")} mutagent sandbox status sbx_1
-  ${chalk38.dim("$")} mutagent sandbox delete sbx_1 --force
-  ${chalk38.dim("$")} mutagent sandbox presets                        ${chalk38.dim("Presets `mutagent helix --preset` can name")}
-  ${chalk38.dim("$")} mutagent sandbox providers                      ${chalk38.dim("Sandbox providers `mutagent helix --sandbox-provider` can name")}
-  ${chalk38.dim("$")} mutagent sandbox preflight --image alpine:3.20  ${chalk38.dim("Would this definition run?")}
-  ${chalk38.dim("$")} mutagent sandbox spawn --image alpine:3.20 --detach
-  ${chalk38.dim("$")} mutagent sandbox exec --sandbox sbx_1 -- bun test
-  ${chalk38.dim("$")} mutagent sandbox attach sbx_1 --since 412
-  ${chalk38.dim("$")} mutagent sandbox traces sbx_1
-  ${chalk38.dim("$")} mutagent sandbox access --json                  ${chalk38.dim("Diagnostic: check whether this account can create cloud sandboxes")}
+  ${chalk39.dim("$")} mutagent sandbox exec -- uname -m               ${chalk39.dim("Run one shell command in a fresh cloud sandbox")}
+  ${chalk39.dim("$")} mutagent helix --sandbox-provider mutagent-cloud -p "run the tests"  ${chalk39.dim("Run an agent task in a cloud sandbox")}
+  ${chalk39.dim("$")} mutagent sandbox list
+  ${chalk39.dim("$")} mutagent sandbox status sbx_1
+  ${chalk39.dim("$")} mutagent sandbox delete sbx_1 --force
+  ${chalk39.dim("$")} mutagent sandbox presets                        ${chalk39.dim("Presets `mutagent helix --preset` can name")}
+  ${chalk39.dim("$")} mutagent sandbox providers                      ${chalk39.dim("Sandbox providers `mutagent helix --sandbox-provider` can name")}
+  ${chalk39.dim("$")} mutagent sandbox preflight --image alpine:3.20  ${chalk39.dim("Would this definition run?")}
+  ${chalk39.dim("$")} mutagent sandbox spawn --image alpine:3.20 --detach
+  ${chalk39.dim("$")} mutagent sandbox exec --sandbox sbx_1 -- bun test
+  ${chalk39.dim("$")} mutagent sandbox attach sbx_1 --since 412
+  ${chalk39.dim("$")} mutagent sandbox traces sbx_1
+  ${chalk39.dim("$")} mutagent sandbox access --json                  ${chalk39.dim("Diagnostic: check whether this account can create cloud sandboxes")}
 
 Which command:
-  Use ${chalk38.bold("sandbox exec -- <cmd>")} for a shell command, ${chalk38.bold("mutagent helix -p")} for an agent task.
+  Use ${chalk39.bold("sandbox exec -- <cmd>")} for a shell command, ${chalk39.bold("mutagent helix -p")} for an agent task.
   Sandbox providers are managed by the platform; pick one per run with
   \`mutagent helix --sandbox-provider\` (see \`mutagent sandbox providers\`).
 
 Single command vs kept sandbox:
-  ${chalk38.bold("exec")} without --sandbox starts a fresh sandbox from a preset, runs one command
-  and removes the sandbox. ${chalk38.bold("spawn")} starts a sandbox from an image and leaves it running
-  for ${chalk38.bold("attach")} and ${chalk38.bold("exec --sandbox")}.
+  ${chalk39.bold("exec")} without --sandbox starts a fresh sandbox from a preset, runs one command
+  and removes the sandbox. ${chalk39.bold("spawn")} starts a sandbox from an image and leaves it running
+  for ${chalk39.bold("attach")} and ${chalk39.bold("exec --sandbox")}.
 
 Lifecycle:
   Ctrl-C, a dropped connection or a closed terminal detaches; the sandbox keeps running.
@@ -30185,7 +30276,7 @@ Requires a workspace: mutagent workspaces use <name> (or --workspace for one com
 init_output();
 init_errors();
 import { Command as Command17 } from "commander";
-import chalk39 from "chalk";
+import chalk40 from "chalk";
 import { readFileSync as readFileSync16 } from "fs";
 
 // src/lib/environment-api.ts
@@ -30332,19 +30423,19 @@ function shellWord2(word) {
 function createEnvCommand() {
   const env = new Command17("env").description("Workspace Environments: the variables and secrets an agent’s tools need").addHelpText("after", `
 Examples:
-  ${chalk39.dim("$")} mutagent env list
-  ${chalk39.dim("$")} mutagent env set demo GREETING=hello --secret GITHUB_TOKEN=ghp_…
-  ${chalk39.dim("$")} mutagent env set staging --from-file .env.staging --secrets-from-file .env.staging.secrets
-  ${chalk39.dim("$")} mutagent env show demo
-  ${chalk39.dim("$")} mutagent env unset demo GREETING
-  ${chalk39.dim("$")} mutagent env delete demo --force
-  ${chalk39.dim("$")} mutagent helix --env demo -p "check the deploy"    ${chalk39.dim("Load it into a Helix cloud run")}
+  ${chalk40.dim("$")} mutagent env list
+  ${chalk40.dim("$")} mutagent env set demo GREETING=hello --secret GITHUB_TOKEN=ghp_…
+  ${chalk40.dim("$")} mutagent env set staging --from-file .env.staging --secrets-from-file .env.staging.secrets
+  ${chalk40.dim("$")} mutagent env show demo
+  ${chalk40.dim("$")} mutagent env unset demo GREETING
+  ${chalk40.dim("$")} mutagent env delete demo --force
+  ${chalk40.dim("$")} mutagent helix --env demo -p "check the deploy"    ${chalk40.dim("Load it into a Helix cloud run")}
 
 An Environment holds the variables and secrets an agent's tools need: a GitHub token,
 a Langfuse key, a database URL. LLM provider keys belong in \`mutagent providers\`; a
 variable named like one (ANTHROPIC_API_KEY, …) is refused unless --allow-provider-key.
 
-Values are write-only. \`show\` prints each entry's name and a sha256[:8] fingerprint.
+Values are write-only. \`show\` prints each entry's name and a fingerprint of its value.
 
 Names: Environments use letters, digits, '.', '_' and '-' (up to 64); variables use
 A-Z, 0-9 and _, not starting with a digit. An Environment holds up to 64 KiB.
@@ -30356,7 +30447,7 @@ AI Agent Directive:
   merges into it when present (PATCH). Pass --replace --force to overwrite the whole
   Environment (PUT), which REMOVES entries you do not name. set --json returns
   { success, environment: { name, vars: [{name, fingerprint}], secrets: [...] },
-  variables: [names], secrets: [names], replaced }.
+  variables: [names], secrets: [names], replaced, created }.
   Never ask the server for a value; there is no route that returns one.
       `);
   registerList(env);
@@ -30369,8 +30460,8 @@ AI Agent Directive:
 function registerList(parent) {
   parent.command("list").alias("ls").description("List the workspace’s Environments").addHelpText("after", `
 Examples:
-  ${chalk39.dim("$")} mutagent env list
-  ${chalk39.dim("$")} mutagent env list --json
+  ${chalk40.dim("$")} mutagent env list
+  ${chalk40.dim("$")} mutagent env list --json
 
 An empty list means the workspace has no Environments yet.
 
@@ -30387,7 +30478,7 @@ AI Agent Directive:
         return;
       }
       if (environments.length === 0) {
-        console.log(chalk39.gray("No Environments in this workspace. Create one: mutagent env set <name> KEY=VALUE"));
+        console.log(chalk40.gray("No Environments in this workspace. Create one: mutagent env set <name> KEY=VALUE"));
         return;
       }
       output.output(environments.map((e) => ({
@@ -30404,12 +30495,13 @@ AI Agent Directive:
 function registerShow(parent) {
   parent.command("show").description("Entry names and fingerprints of one Environment — never a value").argument("<name>", "Environment name").addHelpText("after", `
 Examples:
-  ${chalk39.dim("$")} mutagent env show demo
-  ${chalk39.dim("$")} mutagent env show demo --json
+  ${chalk40.dim("$")} mutagent env show demo
+  ${chalk40.dim("$")} mutagent env show demo --json
 
-Each line is NAME  KIND  FINGERPRINT. The fingerprint is sha256(value)[:8]; compare
-it with your own (printf %s "$VALUE" | shasum -a 256 | cut -c1-8) to check what is
-stored without the server ever sending the value.
+Each line is NAME  KIND  FINGERPRINT. The fingerprint is 8 hex characters of an HMAC
+keyed by a secret only the server holds: it stays the same while the value is unchanged,
+so comparing two \`show\` runs tells you whether a value changed. It cannot be computed
+locally. To make sure a value is what you expect, set it again with \`mutagent env set\`.
 
 An unknown name is an error.
 
@@ -30430,10 +30522,10 @@ AI Agent Directive:
 function registerSet(parent) {
   parent.command("set").description("Set variables (and --secret secrets) on an Environment; creates it when absent").argument("<name>", "Environment name").argument("[assignments...]", "KEY=VALUE variables (non-secret)").option("-s, --secret <KEY=VALUE...>", "Secret entries, encrypted at rest and never returned; every KEY=VALUE after --secret is a secret, so put variables first").option("--from-file <path>", "Read variables from a .env file (KEY=VALUE lines); argv wins on the same name").option("--secrets-from-file <path>", "Read secrets from a .env file").option("--replace", "Replace the whole Environment instead of merging into it; removes entries you do not name, so it needs --force").option("-f, --force", "Required with --replace, in every mode (--json included); a merge needs none").option("--allow-provider-key", "Permit a variable named like an LLM provider key").addHelpText("after", `
 Examples:
-  ${chalk39.dim("$")} mutagent env set demo GREETING=hello
-  ${chalk39.dim("$")} mutagent env set demo GREETING=hello --secret TOKEN=abc123
-  ${chalk39.dim("$")} mutagent env set staging --from-file .env.staging
-  ${chalk39.dim("$")} mutagent env set staging --replace --from-file .env.staging --force   ${chalk39.dim("Drop everything not in the file")}
+  ${chalk40.dim("$")} mutagent env set demo GREETING=hello
+  ${chalk40.dim("$")} mutagent env set demo GREETING=hello --secret TOKEN=abc123
+  ${chalk40.dim("$")} mutagent env set staging --from-file .env.staging
+  ${chalk40.dim("$")} mutagent env set staging --replace --from-file .env.staging --force   ${chalk40.dim("Drop everything not in the file")}
 
 Entries you name are set and the rest stay; the Environment is created if missing.
 --replace removes every entry you do not name, secrets included. Without --force it
@@ -30443,7 +30535,7 @@ Positional KEY=VALUE and --from-file are variables; --secret and --secrets-from-
 secrets (encrypted at rest, never returned). Both are set as environment variables in
 the sandbox. A name cannot be both.
 --secret takes every KEY=VALUE after it, so put variables first:
-  ${chalk39.dim("$")} mutagent env set demo A=1 --secret TOKEN=x
+  ${chalk40.dim("$")} mutagent env set demo A=1 --secret TOKEN=x
 The output names what was stored as a variable and what as a secret.
 A value may contain '=': TOKEN=a=b stores "a=b".
 Names: A-Z, 0-9 and _, not starting with a digit. An invalid name exits 1. A name that
@@ -30455,7 +30547,7 @@ AI Agent Directive:
   --replace is destructive: confirm with the user first, then pass --force.
   Nothing printed here contains a value. --json returns { success, environment,
   variables: [names stored as variables], secrets: [names stored as secrets],
-  replaced: boolean }. Check that each name landed where you meant it to. An invalid name exits 1 and names the KEY, not the value;
+  replaced: boolean, created: boolean (true when this write made the Environment) }. Check that each name landed where you meant it to. An invalid name exits 1 and names the KEY, not the value;
   a name that looks like an LLM provider key exits 1 unless --allow-provider-key.
       `).action(async (name, assignments, options) => {
     const isJson = getJsonFlag(parent);
@@ -30483,17 +30575,19 @@ AI Agent Directive:
         }, new Set([...Object.keys(vars), ...Object.keys(secrets)]));
       }
       const environment = options.replace === true ? await replaceEnvironment(name, body, allow) : await patchEnvironment(name, body, allow);
+      const created = environment.createdAt !== null && environment.createdAt === environment.updatedAt;
       if (isJson) {
         output.output({
           success: true,
           environment,
           variables: Object.keys(vars),
           secrets: Object.keys(secrets),
-          replaced: options.replace === true
+          replaced: options.replace === true,
+          created
         });
         return;
       }
-      output.success(`${options.replace === true ? "Replaced" : "Updated"} Environment ${name}: ${String(environment.vars.length)} variable(s), ${String(environment.secrets.length)} secret(s)`);
+      output.success(`${created ? "Created" : options.replace === true ? "Replaced" : "Updated"} Environment ${name}: ${String(environment.vars.length)} variable(s), ${String(environment.secrets.length)} secret(s)`);
       if (Object.keys(vars).length > 0)
         console.log(`Stored as variables: ${Object.keys(vars).join(", ")}`);
       if (Object.keys(secrets).length > 0)
@@ -30507,8 +30601,8 @@ AI Agent Directive:
 function registerUnset(parent) {
   parent.command("unset").description("Remove entries from an Environment").argument("<name>", "Environment name").argument("<keys...>", "Entry names to remove").option("-s, --secret", "The names are secrets (default: try both variables and secrets)").option("-f, --force", "Confirm the removal (required in every mode, --json included)").addHelpText("after", `
 Examples:
-  ${chalk39.dim("$")} mutagent env unset demo GREETING --force
-  ${chalk39.dim("$")} mutagent env unset demo TOKEN OTHER_TOKEN --force --json
+  ${chalk40.dim("$")} mutagent env unset demo GREETING --force
+  ${chalk40.dim("$")} mutagent env unset demo TOKEN OTHER_TOKEN --force --json
 
 A name is removed wherever it is, variable or secret; a removed secret cannot be read
 back. Unsetting a name that is not there succeeds. Without --force the command refuses
@@ -30545,8 +30639,8 @@ AI Agent Directive:
 function registerDelete(parent) {
   parent.command("delete").alias("rm").description("Delete an Environment and its secrets").argument("<name>", "Environment name").option("-f, --force", "Confirm (required in every mode, --json included)").addHelpText("after", `
 Examples:
-  ${chalk39.dim("$")} mutagent env delete demo --force
-  ${chalk39.dim("$")} mutagent env delete demo --force --json
+  ${chalk40.dim("$")} mutagent env delete demo --force
+  ${chalk40.dim("$")} mutagent env delete demo --force --json
 
 Deletes the Environment and its encrypted secrets. Sandboxes already running keep the
 values they were given; the next run naming this Environment fails.
@@ -30591,7 +30685,7 @@ async function withNotFound(name, call) {
     return await call();
   } catch (error3) {
     if (error3 instanceof ApiError && error3.statusCode === 404)
-      throw new NotFoundError("Environment", name);
+      throw new NotFoundError("Environment", name, "mutagent env list");
     throw error3;
   }
 }
@@ -30600,7 +30694,7 @@ function printEnvironment(environment, output, isJson) {
     output.output({ success: true, environment });
     return;
   }
-  console.log(`${chalk39.bold(environment.name)}  ${chalk39.dim(environment.updatedAt ?? "")}`);
+  console.log(`${chalk40.bold(environment.name)}  ${chalk40.dim(environment.updatedAt ?? "")}`);
   printEntries(environment);
 }
 function printEntries(environment) {
@@ -30609,12 +30703,12 @@ function printEntries(environment) {
     ...environment.secrets.map((s) => ({ name: s.name, kind: "secret", fingerprint: s.fingerprint }))
   ];
   if (rows.length === 0) {
-    console.log(chalk39.gray("  (no entries)"));
+    console.log(chalk40.gray("  (no entries)"));
     return;
   }
   const width = Math.max(...rows.map((r) => r.name.length));
   for (const row of rows) {
-    console.log(`  ${row.name.padEnd(width)}  ${row.kind === "secret" ? chalk39.yellow("secret") : chalk39.dim("var   ")}  ${chalk39.dim(row.fingerprint)}`);
+    console.log(`  ${row.name.padEnd(width)}  ${row.kind === "secret" ? chalk40.yellow("secret") : chalk40.dim("var   ")}  ${chalk40.dim(row.fingerprint)}`);
   }
 }
 
@@ -30622,10 +30716,10 @@ function printEntries(environment) {
 init_config();
 init_errors();
 import { Command as Command23 } from "commander";
-import chalk51 from "chalk";
+import chalk52 from "chalk";
 
 // src/commands/gateway/status.ts
-import chalk41 from "chalk";
+import chalk42 from "chalk";
 
 // src/lib/gateway-api.ts
 init_config();
@@ -30841,7 +30935,7 @@ async function getGrantMoreRepositoriesUrl() {
 // src/lib/gateway-envelope.ts
 init_output();
 init_known_secrets();
-import chalk40 from "chalk";
+import chalk41 from "chalk";
 init_errors();
 
 // src/lib/gateway-notices.ts
@@ -31000,9 +31094,9 @@ function printGatewayOk(isJson, data, opts) {
   opts.human();
   if (opts.next && opts.next.length > 0) {
     console.log("");
-    console.log(chalk40.dim("Next:"));
+    console.log(chalk41.dim("Next:"));
     for (const step of opts.next)
-      console.log(chalk40.dim(`  ${step}`));
+      console.log(chalk41.dim(`  ${step}`));
   }
 }
 function printGatewayFailureWithData(isJson, error3, data, human) {
@@ -31015,21 +31109,21 @@ function printGatewayFailureWithData(isJson, error3, data, human) {
   return error3.exitCode;
 }
 function printHuman2(error3) {
-  console.error(chalk40.red(`Error: ${scrubKnown(error3.message)}`) + chalk40.dim(`  [${error3.code}]`));
+  console.error(chalk41.red(`Error: ${scrubKnown(error3.message)}`) + chalk41.dim(`  [${error3.code}]`));
   if (error3.fix.length > 0) {
     console.error("");
-    console.error(chalk40.yellow("Fix:"));
+    console.error(chalk41.yellow("Fix:"));
     for (const step of error3.fix)
-      console.error(chalk40.yellow(`  ${scrubKnown(step)}`));
+      console.error(chalk41.yellow(`  ${scrubKnown(step)}`));
   }
   if (error3.notes.length > 0) {
     console.error("");
     for (const note of error3.notes)
-      console.error(chalk40.dim(`  ${scrubKnown(note)}`));
+      console.error(chalk41.dim(`  ${scrubKnown(note)}`));
   }
   if (error3.escalate !== undefined) {
     console.error("");
-    console.error(chalk40.yellow(`Needs a person: ${scrubKnown(error3.escalate)}`));
+    console.error(chalk41.yellow(`Needs a person: ${scrubKnown(error3.escalate)}`));
   }
 }
 function handleGatewayError(error3, isJson, provider, resource) {
@@ -31087,16 +31181,16 @@ function nextStepFor(status) {
   return [`mutagent gateway test-run --repo ${first.name} --wait`];
 }
 function printStatusHuman(status) {
-  console.log(chalk41.bold("Gateway status") + chalk41.dim(`  workspace ${status.workspaceId}`));
+  console.log(chalk42.bold("Gateway status") + chalk42.dim(`  workspace ${status.workspaceId}`));
   for (const provider of ["github", "slack"]) {
     const conn = status.connections[provider];
     const connected = conn?.state === "connected";
-    const mark = connected ? chalk41.green("✓") : chalk41.yellow("·");
+    const mark = connected ? chalk42.green("✓") : chalk42.yellow("·");
     const detail = conn === null ? "unknown" : connected ? conn.accountName ?? conn.accountId ?? "connected" : conn.state;
     console.log(`  ${mark} ${provider.padEnd(6)} ${detail}`);
   }
   const linked = status.linkedRepositories.map((repo) => repo.name).join(", ");
-  console.log(`  ${linked === "" ? chalk41.yellow("·") : chalk41.green("✓")} repos  ${linked === "" ? "(none linked)" : linked}`);
+  console.log(`  ${linked === "" ? chalk42.yellow("·") : chalk42.green("✓")} repos  ${linked === "" ? "(none linked)" : linked}`);
 }
 function registerGatewayStatusCommands(gateway) {
   gateway.action(async () => {
@@ -31111,8 +31205,8 @@ function registerGatewayStatusCommands(gateway) {
   });
   gateway.command("status").description("What's connected, what's missing, and the next command to run").addHelpText("after", `
 Examples:
-  ${chalk41.dim("$")} mutagent gateway status
-  ${chalk41.dim("$")} mutagent gateway status --json
+  ${chalk42.dim("$")} mutagent gateway status
+  ${chalk42.dim("$")} mutagent gateway status --json
 
 Same as bare 'mutagent gateway' — the one command that always tells you what's next.
 
@@ -31131,8 +31225,8 @@ AI Agent Directive:
   });
   gateway.command("doctor").description("End-to-end check of the gateway setup, with fixes for anything broken").addHelpText("after", `
 Examples:
-  ${chalk41.dim("$")} mutagent gateway doctor
-  ${chalk41.dim("$")} mutagent gateway doctor --json
+  ${chalk42.dim("$")} mutagent gateway doctor
+  ${chalk42.dim("$")} mutagent gateway doctor --json
 
 Checks: GitHub/Slack connection state, a repository is linked, and — the one thing
 'status' does not check — that every linked repository is still reachable through the
@@ -31171,9 +31265,9 @@ AI Agent Directive:
       const printChecks = () => {
         printStatusHuman(status);
         console.log("");
-        console.log(chalk41.bold("Checks:"));
+        console.log(chalk42.bold("Checks:"));
         for (const check3 of checks) {
-          console.log(`  ${check3.pass ? chalk41.green("✓") : chalk41.red("✗")} ${check3.name}  ${chalk41.dim(check3.detail)}`);
+          console.log(`  ${check3.pass ? chalk42.green("✓") : chalk42.red("✗")} ${check3.name}  ${chalk42.dim(check3.detail)}`);
         }
       };
       const failing = checks.filter((c) => !c.pass);
@@ -31191,7 +31285,7 @@ AI Agent Directive:
 }
 
 // src/commands/gateway/connect.ts
-import chalk42 from "chalk";
+import chalk43 from "chalk";
 
 // src/lib/gateway-poll.ts
 function sleep2(ms) {
@@ -31259,7 +31353,7 @@ function reportAttempt(provider, state, attempt, isJson) {
     printGatewayOk(isJson, { provider, status: attempt.status }, {
       next: provider === "github" ? ["mutagent gateway repos link <owner/name>"] : [],
       human: () => {
-        console.log(chalk42.green(`✓ ${provider} connected`) + chalk42.dim(`  ${attempt.status?.accountName ?? attempt.status?.accountId ?? ""}`));
+        console.log(chalk43.green(`✓ ${provider} connected`) + chalk43.dim(`  ${attempt.status?.accountName ?? attempt.status?.accountId ?? ""}`));
       }
     });
     return;
@@ -31278,9 +31372,9 @@ function reportAttempt(provider, state, attempt, isJson) {
 function registerConnect(gateway) {
   gateway.command("connect").description("Connect GitHub or Slack (prints a URL to open, or resumes an attempt)").argument("<gateway-provider>", "github | slack").option("--wait", "Poll until the attempt settles instead of returning immediately").option("--open", "Also open the URL in a local browser (for a human at a desktop)").option("--attempt <id>", "Resume an existing attempt instead of starting a new one").addHelpText("after", `
 Examples:
-  ${chalk42.dim("$")} mutagent gateway connect github --json
-  ${chalk42.dim("$")} mutagent gateway connect github --wait --attempt att_abc123
-  ${chalk42.dim("$")} mutagent gateway connect slack --open
+  ${chalk43.dim("$")} mutagent gateway connect github --json
+  ${chalk43.dim("$")} mutagent gateway connect github --wait --attempt att_abc123
+  ${chalk43.dim("$")} mutagent gateway connect slack --open
 
 Already connected is success, not an error: re-running this once github or slack is
 already connected exits 0 and does nothing — safe to retry.
@@ -31309,7 +31403,7 @@ AI Agent Directive:
       if (existing?.state === "connected") {
         printGatewayOk(isJson, { provider, status: existing, alreadyConnected: true }, {
           human: () => {
-            console.log(chalk42.green(`✓ ${provider} already connected`) + chalk42.dim(`  ${existing.accountName ?? existing.accountId ?? ""}`));
+            console.log(chalk43.green(`✓ ${provider} already connected`) + chalk43.dim(`  ${existing.accountName ?? existing.accountId ?? ""}`));
           }
         });
         return;
@@ -31326,9 +31420,9 @@ AI Agent Directive:
             `mutagent gateway connect ${provider} --wait --attempt ${start.state}`
           ],
           human: () => {
-            console.log(`1. Sign in (in a browser): ${chalk42.cyan(signInUrl)}`);
-            console.log(`2. Then, in that SAME browser, authorize: ${chalk42.cyan(start.url)}`);
-            console.log(chalk42.dim(`attempt: ${start.state}`));
+            console.log(`1. Sign in (in a browser): ${chalk43.cyan(signInUrl)}`);
+            console.log(`2. Then, in that SAME browser, authorize: ${chalk43.cyan(start.url)}`);
+            console.log(chalk43.dim(`attempt: ${start.state}`));
           }
         });
         return;
@@ -31342,7 +31436,7 @@ AI Agent Directive:
 function registerReconnect(gateway) {
   gateway.command("reconnect").description("Re-authorize GitHub or Slack — also recovers RUN_PRINCIPAL_UNAVAILABLE").argument("<gateway-provider>", "github | slack").addHelpText("after", `
 Examples:
-  ${chalk42.dim("$")} mutagent gateway reconnect github --json
+  ${chalk43.dim("$")} mutagent gateway reconnect github --json
 
 Starts a re-auth attempt and exits 0. Sign in at signInUrl first, then open url in that
 SAME browser, then finish it the same way as 'connect':
@@ -31365,9 +31459,9 @@ AI Agent Directive:
           `mutagent gateway connect ${provider} --wait --attempt ${start.state}`
         ],
         human: () => {
-          console.log(`1. Sign in (in a browser): ${chalk42.cyan(signInUrl)}`);
-          console.log(`2. Then, in that SAME browser, authorize: ${chalk42.cyan(start.url)}`);
-          console.log(chalk42.dim(`attempt: ${start.state}`));
+          console.log(`1. Sign in (in a browser): ${chalk43.cyan(signInUrl)}`);
+          console.log(`2. Then, in that SAME browser, authorize: ${chalk43.cyan(start.url)}`);
+          console.log(chalk43.dim(`attempt: ${start.state}`));
         }
       });
       return;
@@ -31377,7 +31471,7 @@ AI Agent Directive:
 function registerDisconnect(gateway) {
   gateway.command("disconnect").description("Disconnect GitHub or Slack from this workspace").argument("<gateway-provider>", "github | slack").option("-f, --force", "Confirm the disconnect (required; never prompted for)").option("--yes", "Same as --force").addHelpText("after", `
 Examples:
-  ${chalk42.dim("$")} mutagent gateway disconnect slack --force
+  ${chalk43.dim("$")} mutagent gateway disconnect slack --force
 
 Idempotent: disconnecting when github or slack is already disconnected is success, not an error.
 Never prompts: without --force (or --yes) the command refuses (CONFIRMATION_REQUIRED,
@@ -31394,7 +31488,7 @@ AI Agent Directive:
       const status = await disconnectIntegration(provider);
       printGatewayOk(isJson, { provider, status }, {
         human: () => {
-          console.log(chalk42.green(`✓ ${provider} disconnected`));
+          console.log(chalk43.green(`✓ ${provider} disconnected`));
         }
       });
       return;
@@ -31408,17 +31502,17 @@ function registerGatewayConnectCommands(gateway) {
 }
 
 // src/commands/gateway/repos.ts
-import chalk43 from "chalk";
+import chalk44 from "chalk";
 function printLinkedRepo(repo) {
-  const mark = repo.state === "linked" ? chalk43.green("✓") : chalk43.yellow("·");
-  const dependents = repo.dependents.triggers + repo.dependents.routines > 0 ? chalk43.dim(`  ${String(repo.dependents.triggers)} trigger(s), ${String(repo.dependents.routines)} routine(s)`) : "";
+  const mark = repo.state === "linked" ? chalk44.green("✓") : chalk44.yellow("·");
+  const dependents = repo.dependents.triggers + repo.dependents.routines > 0 ? chalk44.dim(`  ${String(repo.dependents.triggers)} trigger(s), ${String(repo.dependents.routines)} routine(s)`) : "";
   console.log(`  ${mark} ${repo.name}${dependents}`);
 }
 function registerList2(gateway) {
   gateway.command("repos").description("Repositories the workspace's GitHub installation can reach, or has linked").option("--available", "Every reachable repository (same as no flag)").option("--linked", "Repositories this workspace has linked, by repos link or by use, and ones it unlinked").addHelpText("after", `
 Examples:
-  ${chalk43.dim("$")} mutagent gateway repos --json
-  ${chalk43.dim("$")} mutagent gateway repos --linked --json
+  ${chalk44.dim("$")} mutagent gateway repos --json
+  ${chalk44.dim("$")} mutagent gateway repos --linked --json
 
 No flag or --available: every repository the GitHub App installation can reach.
 Any of them is usable: a repository links itself the first time it is used.
@@ -31447,7 +31541,7 @@ AI Agent Directive:
         printGatewayOk(isJson, { items: items2, count: items2.length }, {
           human: () => {
             if (items2.length === 0) {
-              console.log(chalk43.gray("No repositories linked. Fix: mutagent gateway repos link owner/name"));
+              console.log(chalk44.gray("No repositories linked. Fix: mutagent gateway repos link owner/name"));
               return;
             }
             for (const repo of items2)
@@ -31460,11 +31554,11 @@ AI Agent Directive:
       printGatewayOk(isJson, { items, count: items.length }, {
         human: () => {
           if (items.length === 0) {
-            console.log(chalk43.gray("No repositories reachable. Fix: mutagent gateway repos grant-more"));
+            console.log(chalk44.gray("No repositories reachable. Fix: mutagent gateway repos grant-more"));
             return;
           }
           for (const repo of items)
-            console.log(`  ${repo.name}  ${chalk43.dim(repo.defaultBranch)}`);
+            console.log(`  ${repo.name}  ${chalk44.dim(repo.defaultBranch)}`);
         }
       });
       return;
@@ -31474,8 +31568,8 @@ AI Agent Directive:
 function registerLink(repos, gateway) {
   repos.command("link").description("Link repositories to this workspace now; using a reachable repository links it too").argument("<repositories...>", "owner/name (or GitHub repository id), 1–25").addHelpText("after", `
 Examples:
-  ${chalk43.dim("$")} mutagent gateway repos link owner/name
-  ${chalk43.dim("$")} mutagent gateway repos link owner/one owner/two
+  ${chalk44.dim("$")} mutagent gateway repos link owner/name
+  ${chalk44.dim("$")} mutagent gateway repos link owner/one owner/two
 
 Idempotent: an already-linked repository is returned unchanged. All-or-nothing —
 if one of several repositories can't be linked, none are.
@@ -31500,7 +31594,7 @@ AI Agent Directive:
 function registerUnlink(repos, gateway) {
   repos.command("unlink").description("Unlink a repository — its triggers and routines pause, they are not deleted").argument("<owner/name>", "The repository to unlink").option("-f, --force", "Confirm the unlink (required; never prompted for)").option("--yes", "Same as --force").addHelpText("after", `
 Examples:
-  ${chalk43.dim("$")} mutagent gateway repos unlink owner/name --force
+  ${chalk44.dim("$")} mutagent gateway repos unlink owner/name --force
 
 Dependent triggers and routines PAUSE (visibly — 'repository_unlinked'), never delete.
 Never prompts: without --force (or --yes) the command refuses
@@ -31517,11 +31611,11 @@ AI Agent Directive:
       const result = await unlinkRepository(repository);
       printGatewayOk(isJson, result, {
         human: () => {
-          console.log(chalk43.green(`✓ Unlinked ${result.repository.name}`));
+          console.log(chalk44.green(`✓ Unlinked ${result.repository.name}`));
           if (result.paused.triggers.length > 0)
-            console.log(chalk43.yellow(`  paused triggers: ${result.paused.triggers.join(", ")}`));
+            console.log(chalk44.yellow(`  paused triggers: ${result.paused.triggers.join(", ")}`));
           if (result.paused.routines.length > 0)
-            console.log(chalk43.yellow(`  paused routines: ${result.paused.routines.join(", ")}`));
+            console.log(chalk44.yellow(`  paused routines: ${result.paused.routines.join(", ")}`));
         }
       });
       return;
@@ -31531,7 +31625,7 @@ AI Agent Directive:
 function registerGrantMore(repos, gateway) {
   repos.command("grant-more").description("Print the GitHub page for granting the app access to more repositories").addHelpText("after", `
 Examples:
-  ${chalk43.dim("$")} mutagent gateway repos grant-more --json
+  ${chalk44.dim("$")} mutagent gateway repos grant-more --json
 
 Opens no browser itself — prints the URL. Open it in the SAME browser you signed
 in to Mutagent with, then 'repos link owner/name'.
@@ -31545,7 +31639,7 @@ AI Agent Directive:
       printGatewayOk(isJson, result, {
         next: ["mutagent gateway repos link owner/name"],
         human: () => {
-          console.log(`Open this URL (in the browser you signed in with): ${chalk43.cyan(result.url)}`);
+          console.log(`Open this URL (in the browser you signed in with): ${chalk44.cyan(result.url)}`);
         }
       });
       return;
@@ -31565,7 +31659,7 @@ function registerGatewayReposCommands(gateway) {
 // src/commands/gateway/triggers.ts
 import { readFileSync as readFileSync18 } from "node:fs";
 import { Command as Command18 } from "commander";
-import chalk46 from "chalk";
+import chalk47 from "chalk";
 
 // src/lib/gateway-api-triggers.ts
 var TRIGGER_KINDS = ["github.issue.opened", "slack.mention", "webhook", "github.ci-failed", "trace.threshold"];
@@ -31702,7 +31796,7 @@ function updatedTriggerFilter(options, id) {
 }
 
 // src/commands/gateway/env-flag.ts
-import chalk44 from "chalk";
+import chalk45 from "chalk";
 var ENVIRONMENT_NAME = /^[A-Za-z0-9._-]{1,64}$/;
 function parseEnvFlag(raw, resource) {
   if (raw === undefined)
@@ -31719,7 +31813,7 @@ function envField(environment) {
 }
 function printEnvironment2(environment) {
   if (environment)
-    console.log(chalk44.dim(`      environment: ${environment}`));
+    console.log(chalk45.dim(`      environment: ${environment}`));
 }
 function envHelp(verb) {
   const clear = verb === "update" ? `--env "" clears it: runs then load no Environment. Changing or clearing it writes a new version.` : `--env "" is the same as leaving it out: no Environment.`;
@@ -31730,7 +31824,7 @@ Environment. The workspace must have it when you write this: an unknown name is
 }
 
 // src/commands/gateway/stage-subject.ts
-import chalk45 from "chalk";
+import chalk46 from "chalk";
 var CLEAR = "none";
 function parseStageFlag(raw, resource) {
   if (raw === undefined)
@@ -31791,9 +31885,9 @@ function stageSubjectFields(stage, subject) {
 }
 function printStageSubject(stage, subject) {
   if (stage)
-    console.log(chalk45.dim(`      stage: ${stage}`));
+    console.log(chalk46.dim(`      stage: ${stage}`));
   if (subject)
-    console.log(chalk45.dim(`      subject: ${subject.kind} ${subject.names.join(", ")}`));
+    console.log(chalk46.dim(`      subject: ${subject.kind} ${subject.names.join(", ")}`));
 }
 var STAGE_COMMANDS = CONFIG_STAGES.map((s) => `${s} = ${STAGE_PRESETS[s].command}`).join(", ");
 var STAGE_HELP = `--stage labels what this serves: evaluate, diagnose or optimize; none clears it.
@@ -31894,12 +31988,12 @@ function trackRepoFlags(command) {
 // src/commands/gateway/triggers.ts
 var RESOURCE = "triggers";
 function printTrigger(t) {
-  const mark = t.status === "enabled" ? chalk46.green("✓") : t.status === "paused" ? chalk46.yellow("⏸") : chalk46.dim("○");
-  const builtin = t.builtin ? chalk46.dim(" [built-in]") : "";
-  const repository = t.repository?.name ?? chalk46.dim(t.builtin ? "the repository the mention names or picks" : "No repository");
-  console.log(`  ${mark} ${t.id}  ${t.name}${builtin}  ${chalk46.dim(t.kind)}  ${repository}`);
+  const mark = t.status === "enabled" ? chalk47.green("✓") : t.status === "paused" ? chalk47.yellow("⏸") : chalk47.dim("○");
+  const builtin = t.builtin ? chalk47.dim(" [built-in]") : "";
+  const repository = t.repository?.name ?? chalk47.dim(t.builtin ? "the repository the mention names or picks" : "No repository");
+  console.log(`  ${mark} ${t.id}  ${t.name}${builtin}  ${chalk47.dim(t.kind)}  ${repository}`);
   if (t.pausedReason)
-    console.log(chalk46.yellow(`      paused: ${t.pausedReason.reason}`));
+    console.log(chalk47.yellow(`      paused: ${t.pausedReason.reason}`));
   printStageSubject(t.stage, t.subject);
   printEnvironment2(t.environment);
 }
@@ -31917,7 +32011,7 @@ function registerList3(gateway) {
   gateway.addCommand(triggers);
   triggers.description("List triggers — user-created first, then built-ins").addHelpText("after", `
 Examples:
-  ${chalk46.dim("$")} mutagent gateway triggers --json
+  ${chalk47.dim("$")} mutagent gateway triggers --json
 
 Built-in triggers (the default @mention behaviour) are listed, marked 'builtin: true',
 and are read-only — 'update'/'enable'/'disable'/'delete' on one refuse (409). A built-in
@@ -31934,7 +32028,7 @@ AI Agent Directive:
       printGatewayOk(isJson, { items }, {
         human: () => {
           if (items.length === 0) {
-            console.log(chalk46.gray("No triggers."));
+            console.log(chalk47.gray("No triggers."));
             return;
           }
           for (const t of items)
@@ -31973,12 +32067,12 @@ function createBody(options) {
 function registerCreate(triggers, gateway, readGitRemote) {
   const create4 = triggers.command("create").description("Create a trigger").option("--on <kind>", `REQUIRED — trigger kind: ${TRIGGER_KINDS.join(" | ")} | emit:<kind>`).option("--repo <owner/name>", "The repository its runs check out (default: this directory's GitHub remote)").option("--no-repo", "No repository: its runs have no checkout (webhook, emit:<kind>, trace.threshold only)").option("--instruction <text>", "The instruction Helix runs").option("--instruction-file <path>", "Read the instruction from a file").option("--name <name>", "Name (default: derived from kind + repository)").option("--key <key>", "Idempotency key — a retry with the same key returns the same trigger").option("--channel <id...>", "slack.mention only: limit to these Slack channel ids").option("--threshold <n>", "trace.threshold only: fire at or above this many traces (1–1,000,000)").option("--window <duration>", "trace.threshold only: the counting window, e.g. 60m, 24h, 7d").option("--service <name>", "trace.threshold only: limit to this service name").option("--session <id>", "trace.threshold only: limit to this session id").option("--stage <stage>", "The stage it serves: evaluate | diagnose | optimize | none").option("--subject <kind:names>", "trace.threshold only: count only these subjects, e.g. agent:support-bot,triage-bot").option("--env <name>", "A workspace Environment every run loads (see mutagent env list)").addHelpText("after", `
 Examples:
-  ${chalk46.dim("$")} mutagent gateway triggers create --on github.issue.opened --repo owner/name --instruction "Triage: label, estimate, ask one clarifying question if needed"
-  ${chalk46.dim("$")} mutagent gateway triggers create --on slack.mention --channel C0123 --instruction "…"
-  ${chalk46.dim("$")} mutagent gateway triggers create --on trace.threshold --threshold 100 --window 60m --repo owner/name --instruction "Investigate the volume spike"
-  ${chalk46.dim("$")} mutagent gateway triggers create --on trace.threshold --threshold 50 --window 24h --subject agent:support-bot --stage diagnose --instruction "/diagnose why support-bot traces spiked"
-  ${chalk46.dim("$")} mutagent gateway triggers create --on github.issue.opened --repo owner/name --env staging --instruction "Reproduce the issue against staging"
-  ${chalk46.dim("$")} mutagent gateway triggers create --on webhook --no-repo --instruction "Summarise the payload and post it"
+  ${chalk47.dim("$")} mutagent gateway triggers create --on github.issue.opened --repo owner/name --instruction "Triage: label, estimate, ask one clarifying question if needed"
+  ${chalk47.dim("$")} mutagent gateway triggers create --on slack.mention --channel C0123 --instruction "…"
+  ${chalk47.dim("$")} mutagent gateway triggers create --on trace.threshold --threshold 100 --window 60m --repo owner/name --instruction "Investigate the volume spike"
+  ${chalk47.dim("$")} mutagent gateway triggers create --on trace.threshold --threshold 50 --window 24h --subject agent:support-bot --stage diagnose --instruction "/diagnose why support-bot traces spiked"
+  ${chalk47.dim("$")} mutagent gateway triggers create --on github.issue.opened --repo owner/name --env staging --instruction "Reproduce the issue against staging"
+  ${chalk47.dim("$")} mutagent gateway triggers create --on webhook --no-repo --instruction "Summarise the payload and post it"
 
 The repository is chosen on the trigger, never from the event payload:
 - --repo owner/name: that repository. Any repository the GitHub App reaches is
@@ -32056,7 +32150,7 @@ AI Agent Directive:
           const line = remoteChoiceLine(choice);
           if (line !== undefined)
             console.log(line);
-          console.log(chalk46.green(`✓ Created trigger ${trigger.id}`));
+          console.log(chalk47.green(`✓ Created trigger ${trigger.id}`));
           printTrigger(trigger);
         }
       });
@@ -32089,14 +32183,14 @@ function updateBody(id, options) {
 function registerUpdate(triggers, gateway) {
   triggers.command("update").description("Change a trigger: only the fields you pass are sent").argument("<id>", "Trigger id").option("--instruction <text>", "New instruction Helix runs").option("--instruction-file <path>", "Read the new instruction from a file").option("--name <name>", "New name").option("--channel <id...>", "slack.mention only: replace the Slack channel ids").option("--threshold <n>", "trace.threshold only: new trace count (with --window)").option("--window <duration>", "trace.threshold only: new counting window, e.g. 60m, 24h, 7d (with --threshold)").option("--service <name>", "trace.threshold only: limit to this service name").option("--session <id>", "trace.threshold only: limit to this session id").option("--stage <stage>", "New stage: evaluate | diagnose | optimize, or none to clear it").option("--subject <kind:names>", "trace.threshold only: new subject selector, or none to clear it").option("--env <name>", 'New workspace Environment every run loads; "" clears it').addHelpText("after", `
 Examples:
-  ${chalk46.dim("$")} mutagent gateway triggers update trg_abc --instruction "Label, estimate, and link duplicates"
-  ${chalk46.dim("$")} mutagent gateway triggers update trg_abc --name issue-triage --json
-  ${chalk46.dim("$")} mutagent gateway triggers update trg_abc --channel C0123 C0456
-  ${chalk46.dim("$")} mutagent gateway triggers update trg_abc --threshold 200 --window 24h
-  ${chalk46.dim("$")} mutagent gateway triggers update trg_abc --stage evaluate --subject skill:grader
-  ${chalk46.dim("$")} mutagent gateway triggers update trg_abc --stage none --subject none
-  ${chalk46.dim("$")} mutagent gateway triggers update trg_abc --env prod
-  ${chalk46.dim("$")} mutagent gateway triggers update trg_abc --env ""
+  ${chalk47.dim("$")} mutagent gateway triggers update trg_abc --instruction "Label, estimate, and link duplicates"
+  ${chalk47.dim("$")} mutagent gateway triggers update trg_abc --name issue-triage --json
+  ${chalk47.dim("$")} mutagent gateway triggers update trg_abc --channel C0123 C0456
+  ${chalk47.dim("$")} mutagent gateway triggers update trg_abc --threshold 200 --window 24h
+  ${chalk47.dim("$")} mutagent gateway triggers update trg_abc --stage evaluate --subject skill:grader
+  ${chalk47.dim("$")} mutagent gateway triggers update trg_abc --stage none --subject none
+  ${chalk47.dim("$")} mutagent gateway triggers update trg_abc --env prod
+  ${chalk47.dim("$")} mutagent gateway triggers update trg_abc --env ""
 
 Only the fields you pass are sent; everything else stays as it is. An instruction,
 filter, subject or Environment change writes a new version of the trigger; a stage or name change
@@ -32122,7 +32216,7 @@ AI Agent Directive:
       printGatewayOk(isJson, trigger, {
         next: [`mutagent gateway triggers show ${trigger.id} --json`],
         human: () => {
-          console.log(chalk46.green(`✓ Updated trigger ${trigger.id}`));
+          console.log(chalk47.green(`✓ Updated trigger ${trigger.id}`));
           printTrigger(trigger);
         }
       });
@@ -32161,7 +32255,7 @@ Built-in triggers refuse this (409 BUILTIN_TRIGGER_READ_ONLY).
 function registerDelete2(triggers, gateway) {
   triggers.command("delete").alias("rm").description("Delete a trigger").argument("<id>", "Trigger id").option("-f, --force", "Confirm the delete (required; never prompted for)").option("--yes", "Same as --force").addHelpText("after", `
 Examples:
-  ${chalk46.dim("$")} mutagent gateway triggers delete trg_abc --force
+  ${chalk47.dim("$")} mutagent gateway triggers delete trg_abc --force
 
 Built-in triggers refuse this. Never prompts: without --force (or --yes) the command
 refuses (CONFIRMATION_REQUIRED, exit 1) and sends nothing.
@@ -32175,7 +32269,7 @@ AI Agent Directive:
       requireConfirmation(options, `Deleting trigger ${id}`, `mutagent gateway triggers delete ${id} --force`, RESOURCE);
       await deleteTrigger(id);
       printGatewayOk(isJson, { id, deleted: true }, { human: () => {
-        console.log(chalk46.green(`✓ Deleted trigger ${id}`));
+        console.log(chalk47.green(`✓ Deleted trigger ${id}`));
       } });
       return;
     }, RESOURCE);
@@ -32184,7 +32278,7 @@ AI Agent Directive:
 function registerTest(triggers, gateway) {
   triggers.command("test").description("Dry run: would a sample event match this trigger?").argument("<id>", "Trigger id").option("--event <file>", "REQUIRED — JSON sample event, as @file.json").addHelpText("after", `
 Examples:
-  ${chalk46.dim("$")} mutagent gateway triggers test trg_abc --event @sample.json
+  ${chalk47.dim("$")} mutagent gateway triggers test trg_abc --event @sample.json
 
 sample.json: { "source": "github", "kind": "github.issues.opened", "repositoryId": "123" }
 Zero side effects — this never fires the trigger.
@@ -32214,7 +32308,7 @@ AI Agent Directive:
         human: () => {
           console.log(`matches: ${String(result.matches)}  wouldRun: ${String(result.wouldRun)}`);
           for (const c of result.checks)
-            console.log(`  ${c.passed ? chalk46.green("✓") : chalk46.red("✗")} ${c.check}: ${c.detail}`);
+            console.log(`  ${c.passed ? chalk47.green("✓") : chalk47.red("✗")} ${c.check}: ${c.detail}`);
         }
       });
       return;
@@ -32233,7 +32327,7 @@ function registerGatewayTriggersCommands(gateway, readGitRemote) {
 
 // src/commands/gateway/routines.ts
 import { Command as Command19 } from "commander";
-import chalk47 from "chalk";
+import chalk48 from "chalk";
 
 // src/lib/gateway-api-routines.ts
 var ROUTINE_EVERY_GRAMMAR = [
@@ -32310,12 +32404,12 @@ async function waitForRun(eventId) {
 // src/commands/gateway/routines.ts
 var RESOURCE2 = "routines";
 function printRoutine(r) {
-  const mark = r.status === "active" ? chalk47.green("✓") : chalk47.yellow("⏸");
-  console.log(`  ${mark} ${r.id}  ${r.name}  ${chalk47.dim(`${r.schedule.cron} ${r.schedule.timezone}`)}  ${r.repository?.name ?? chalk47.dim("No repository")}`);
+  const mark = r.status === "active" ? chalk48.green("✓") : chalk48.yellow("⏸");
+  console.log(`  ${mark} ${r.id}  ${r.name}  ${chalk48.dim(`${r.schedule.cron} ${r.schedule.timezone}`)}  ${r.repository?.name ?? chalk48.dim("No repository")}`);
   if (r.schedule.next.length > 0)
-    console.log(chalk47.dim(`      next: ${r.schedule.next.join(", ")}`));
+    console.log(chalk48.dim(`      next: ${r.schedule.next.join(", ")}`));
   if (r.pausedReason)
-    console.log(chalk47.yellow(`      paused: ${r.pausedReason.reason}`));
+    console.log(chalk48.yellow(`      paused: ${r.pausedReason.reason}`));
   printStageSubject(r.stage);
   printEnvironment2(r.environment);
 }
@@ -32324,7 +32418,7 @@ function registerList4(gateway) {
   gateway.addCommand(routines);
   routines.description("List routines, with their next three fire times").addHelpText("after", `
 Examples:
-  ${chalk47.dim("$")} mutagent gateway routines --json
+  ${chalk48.dim("$")} mutagent gateway routines --json
 
 AI Agent Directive:
   --json returns { success, ok, data: { items: Routine[] } }. schedule.next is 3 ISO-8601
@@ -32336,7 +32430,7 @@ AI Agent Directive:
       printGatewayOk(isJson, { items }, {
         human: () => {
           if (items.length === 0) {
-            console.log(chalk47.gray("No routines."));
+            console.log(chalk48.gray("No routines."));
             return;
           }
           for (const r of items)
@@ -32385,10 +32479,10 @@ function createBody2(options) {
 function registerCreate2(routines, gateway, readGitRemote) {
   const create4 = routines.command("create").description("Create a routine").option("--every <schedule>", "Plain-language schedule — see --help for the grammar").option("--cron <expr>", "5-field cron expression (minute hour day-of-month month day-of-week)").option("--tz <IANA timezone>", "REQUIRED — e.g. Europe/Berlin").option("--repo <owner/name>", "The repository its runs check out (default: this directory's GitHub remote)").option("--no-repo", "No repository: its runs have no checkout").option("--instruction <text>", "The instruction Helix runs").option("--instruction-file <path>", "Read the instruction from a file").option("--name <name>", "Name (default: derived)").option("--key <key>", "Idempotency key").option("--stage <stage>", "The stage it serves: evaluate | diagnose | optimize | none").option("--env <name>", "A workspace Environment every run loads (see mutagent env list)").addHelpText("after", `
 Examples:
-  ${chalk47.dim("$")} mutagent gateway routines create --every "weekdays 09:00" --tz Europe/Berlin --repo owner/name --instruction "Check main's failing CI and open an issue for each new failure"
-  ${chalk47.dim("$")} mutagent gateway routines create --cron "0 9 * * 1-5" --tz America/New_York --repo owner/name --instruction "…"
-  ${chalk47.dim("$")} mutagent gateway routines create --every "daily 06:00" --tz Europe/Berlin --repo owner/name --stage evaluate --instruction "/evaluate yesterday's support-bot traces"
-  ${chalk47.dim("$")} mutagent gateway routines create --every "weekdays 09:00" --tz Europe/Berlin --repo owner/name --env staging --instruction "Smoke-test staging"
+  ${chalk48.dim("$")} mutagent gateway routines create --every "weekdays 09:00" --tz Europe/Berlin --repo owner/name --instruction "Check main's failing CI and open an issue for each new failure"
+  ${chalk48.dim("$")} mutagent gateway routines create --cron "0 9 * * 1-5" --tz America/New_York --repo owner/name --instruction "…"
+  ${chalk48.dim("$")} mutagent gateway routines create --every "daily 06:00" --tz Europe/Berlin --repo owner/name --stage evaluate --instruction "/evaluate yesterday's support-bot traces"
+  ${chalk48.dim("$")} mutagent gateway routines create --every "weekdays 09:00" --tz Europe/Berlin --repo owner/name --env staging --instruction "Smoke-test staging"
 
 Exactly one of --every / --cron. --tz is REQUIRED — omitting it is refused locally,
 before any request:
@@ -32434,7 +32528,7 @@ AI Agent Directive:
           const line = remoteChoiceLine(choice);
           if (line !== undefined)
             console.log(line);
-          console.log(chalk47.green(`✓ Created routine ${routine.id}`));
+          console.log(chalk48.green(`✓ Created routine ${routine.id}`));
           printRoutine(routine);
         }
       });
@@ -32471,11 +32565,11 @@ function updateBody2(id, options) {
 function registerUpdate2(routines, gateway) {
   routines.command("update").description("Change a routine: only the fields you pass are sent").argument("<id>", "Routine id").option("--every <schedule>", "New plain-language schedule (with --tz) — grammar in routines create --help").option("--cron <expr>", "New 5-field cron expression (with --tz)").option("--tz <IANA timezone>", "Timezone: required with --every/--cron; alone, moves the current schedule").option("--instruction <text>", "New instruction Helix runs").option("--instruction-file <path>", "Read the new instruction from a file").option("--name <name>", "New name").option("--stage <stage>", "New stage: evaluate | diagnose | optimize, or none to clear it").option("--env <name>", 'New workspace Environment every run loads; "" clears it').addHelpText("after", `
 Examples:
-  ${chalk47.dim("$")} mutagent gateway routines update rtn_abc --every "weekdays 10:00" --tz Europe/Berlin
-  ${chalk47.dim("$")} mutagent gateway routines update rtn_abc --instruction "Check CI and label flaky tests" --json
-  ${chalk47.dim("$")} mutagent gateway routines update rtn_abc --tz America/New_York
-  ${chalk47.dim("$")} mutagent gateway routines update rtn_abc --stage none
-  ${chalk47.dim("$")} mutagent gateway routines update rtn_abc --env ""
+  ${chalk48.dim("$")} mutagent gateway routines update rtn_abc --every "weekdays 10:00" --tz Europe/Berlin
+  ${chalk48.dim("$")} mutagent gateway routines update rtn_abc --instruction "Check CI and label flaky tests" --json
+  ${chalk48.dim("$")} mutagent gateway routines update rtn_abc --tz America/New_York
+  ${chalk48.dim("$")} mutagent gateway routines update rtn_abc --stage none
+  ${chalk48.dim("$")} mutagent gateway routines update rtn_abc --env ""
 
 Only the fields you pass are sent; everything else stays as it is. An instruction
 or Environment change writes a new version of the routine; a schedule, name or stage
@@ -32499,7 +32593,7 @@ AI Agent Directive:
       printGatewayOk(isJson, routine, {
         next: [`mutagent gateway routines show ${routine.id} --json`],
         human: () => {
-          console.log(chalk47.green(`✓ Updated routine ${routine.id}`));
+          console.log(chalk48.green(`✓ Updated routine ${routine.id}`));
           printRoutine(routine);
         }
       });
@@ -32536,7 +32630,7 @@ function registerPauseResume(routines, gateway) {
 function registerDelete3(routines, gateway) {
   routines.command("delete").alias("rm").argument("<id>", "Routine id").option("-f, --force", "Confirm the delete (required; never prompted for)").option("--yes", "Same as --force").description("Delete a routine").addHelpText("after", `
 Examples:
-  ${chalk47.dim("$")} mutagent gateway routines delete rtn_abc --force
+  ${chalk48.dim("$")} mutagent gateway routines delete rtn_abc --force
 
 Never prompts: without --force (or --yes) the command refuses (CONFIRMATION_REQUIRED,
 exit 1) and sends nothing. To stop a routine without losing it, use 'routines pause'.
@@ -32550,7 +32644,7 @@ AI Agent Directive:
       requireConfirmation(options, `Deleting routine ${id}`, `mutagent gateway routines delete ${id} --force`, RESOURCE2);
       await deleteRoutine(id);
       printGatewayOk(isJson, { id, deleted: true }, { human: () => {
-        console.log(chalk47.green(`✓ Deleted routine ${id}`));
+        console.log(chalk48.green(`✓ Deleted routine ${id}`));
       } });
       return;
     }, RESOURCE2);
@@ -32559,7 +32653,7 @@ AI Agent Directive:
 function registerRunNow(routines, gateway) {
   routines.command("run-now").argument("<id>", "Routine id").option("--wait", "Poll until the run settles instead of returning the event id immediately").option("--key <key>", "Idempotency key (default: a fresh key each call — same key is the same run)").description("Run a routine once, right now").addHelpText("after", `
 Examples:
-  ${chalk47.dim("$")} mutagent gateway routines run-now rtn_abc --wait
+  ${chalk48.dim("$")} mutagent gateway routines run-now rtn_abc --wait
 
 Idempotent per key: the same --key returns the SAME run, not a new one.
 
@@ -32575,7 +32669,7 @@ AI Agent Directive:
         printGatewayOk(isJson, result, {
           next: [`mutagent gateway runs show ${result.eventId} --json`],
           human: () => {
-            console.log(chalk47.dim(`event: ${result.eventId}${result.created ? "" : "  (existing run for this key)"}`));
+            console.log(chalk48.dim(`event: ${result.eventId}${result.created ? "" : "  (existing run for this key)"}`));
           }
         });
         return;
@@ -32606,7 +32700,7 @@ function registerGatewayRoutinesCommands(gateway, readGitRemote) {
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { readFileSync as readFileSync19 } from "node:fs";
 import { Command as Command20 } from "commander";
-import chalk48 from "chalk";
+import chalk49 from "chalk";
 
 // src/lib/gateway-api-runs.ts
 init_known_secrets();
@@ -32763,32 +32857,32 @@ function printRunError(error3, indent) {
   if (error3 === null)
     return;
   if (error3.triageItem !== undefined) {
-    console.log(chalk48.green(`${indent}${filedAsTriageLine(error3.triageItem)}`));
-    console.log(chalk48.dim(`${indent}next: ${filedAsTriageNext(error3.triageItem).join(", ")}`));
+    console.log(chalk49.green(`${indent}${filedAsTriageLine(error3.triageItem)}`));
+    console.log(chalk49.dim(`${indent}next: ${filedAsTriageNext(error3.triageItem).join(", ")}`));
     return;
   }
-  console.log(chalk48.red(`${indent}${error3.code}: ${error3.reason}`));
+  console.log(chalk49.red(`${indent}${error3.code}: ${error3.reason}`));
   for (const step of error3.fix)
-    console.log(chalk48.yellow(`${indent}Fix: ${step}`));
+    console.log(chalk49.yellow(`${indent}Fix: ${step}`));
 }
 function nextForRun(run) {
   return run.error?.triageItem === undefined ? undefined : filedAsTriageNext(run.error.triageItem);
 }
 function printRunStatus(run) {
-  console.log(`${chalk48.bold(run.eventId)}  ${run.phase}`);
+  console.log(`${chalk49.bold(run.eventId)}  ${run.phase}`);
   if (run.sandbox)
-    console.log(chalk48.dim(`  sandbox: ${run.sandbox.kind} (${run.sandbox.environment})`));
+    console.log(chalk49.dim(`  sandbox: ${run.sandbox.kind} (${run.sandbox.environment})`));
   if (run.startedAt)
-    console.log(chalk48.dim(`  started: ${run.startedAt}`));
+    console.log(chalk49.dim(`  started: ${run.startedAt}`));
   if (run.finishedAt)
-    console.log(chalk48.dim(`  finished: ${run.finishedAt}`));
+    console.log(chalk49.dim(`  finished: ${run.finishedAt}`));
   printRunError(run.error, "  ");
 }
 function registerTestRun(gateway) {
   gateway.command("test-run").description("Run the built-in onboarding test agent on a repository").option("--repo <owner/name>", "REQUIRED — the repository to run on").option("--wait", "Poll until the run settles instead of returning the event id immediately").option("--key <key>", "Idempotency key — the same key is one run (default: a fresh key each call)").addHelpText("after", `
 Examples:
-  ${chalk48.dim("$")} mutagent gateway test-run --repo owner/name --wait
-  ${chalk48.dim("$")} mutagent gateway test-run --repo owner/name --key onboarding-check-1
+  ${chalk49.dim("$")} mutagent gateway test-run --repo owner/name --wait
+  ${chalk49.dim("$")} mutagent gateway test-run --repo owner/name --key onboarding-check-1
 
 Proves the whole pipeline runs: GitHub/Slack connection, repository access, and a
 Helix agent turn in a sandbox, latest default-branch commit.
@@ -32808,7 +32902,7 @@ AI Agent Directive:
         printGatewayOk(isJson, { eventId }, {
           next: [`mutagent gateway runs show ${eventId} --json`],
           human: () => {
-            console.log(chalk48.dim(`event: ${eventId}`));
+            console.log(chalk49.dim(`event: ${eventId}`));
           }
         });
         return;
@@ -32826,14 +32920,14 @@ AI Agent Directive:
   });
 }
 function printRunSummary(r) {
-  console.log(`  ${r.id}  ${chalk48.dim(r.state)}  ${r.origin.kind}${r.origin.id ? `:${r.origin.id}` : ""}  ${r.repository?.name ?? ""}`);
+  console.log(`  ${r.id}  ${chalk49.dim(r.state)}  ${r.origin.kind}${r.origin.id ? `:${r.origin.id}` : ""}  ${r.repository?.name ?? ""}`);
   printRunError(r.error, "    ");
 }
 function registerRunsList(runs, gateway) {
   runs.description("Runs from triggers, routines, the test run and emit — newest first").option("--status <s>", "Comma-separated states to filter to").option("--since <duration>", "ISO-8601 timestamp, or a duration like 30m / 24h / 7d").option("--trigger <id>", "Only runs launched by this trigger").option("--routine <id>", "Only runs launched by this routine").addHelpText("after", `
 Examples:
-  ${chalk48.dim("$")} mutagent gateway runs --since 24h --json
-  ${chalk48.dim("$")} mutagent gateway runs --status failed --json
+  ${chalk49.dim("$")} mutagent gateway runs --since 24h --json
+  ${chalk49.dim("$")} mutagent gateway runs --status failed --json
 
 AI Agent Directive:
   --json returns { success, ok, data: { items: RunSummary[] } }. state is one of queued |
@@ -32854,7 +32948,7 @@ AI Agent Directive:
       printGatewayOk(isJson, { items: display }, {
         human: () => {
           if (display.length === 0) {
-            console.log(chalk48.gray("No runs."));
+            console.log(chalk49.gray("No runs."));
             return;
           }
           for (const r of display)
@@ -32868,8 +32962,8 @@ AI Agent Directive:
 function registerRunsShow(runs, gateway) {
   runs.command("show").description("Run status — by event id or run id").argument("<id>", "The event id (from test-run, emit or mutagent gateway events list) or the run id (from mutagent gateway runs)").addHelpText("after", `
 Examples:
-  ${chalk48.dim("$")} mutagent gateway runs show evt_abc123 --json
-  ${chalk48.dim("$")} mutagent gateway runs show run_abc123 --json
+  ${chalk49.dim("$")} mutagent gateway runs show evt_abc123 --json
+  ${chalk49.dim("$")} mutagent gateway runs show run_abc123 --json
 
 Tries the event-id route first ('GET events/:eventId/run', unchanged since test-run
 and emit have always used it); an id that route doesn't recognise (not_found) is
@@ -32914,9 +33008,9 @@ AI Agent Directive:
 function registerRunsLogs(runs, gateway) {
   runs.command("logs").description("A run's logs, from its Helix session — by run id or event id").argument("<id>", "The run id (from mutagent gateway runs) or the event id (from test-run, emit or mutagent gateway events list)").option("--follow", "Poll and print new entries until the run is done").addHelpText("after", `
 Examples:
-  ${chalk48.dim("$")} mutagent gateway runs logs run_abc123 --json
-  ${chalk48.dim("$")} mutagent gateway runs logs run_abc123 --follow
-  ${chalk48.dim("$")} mutagent gateway runs logs evt_abc123 --json
+  ${chalk49.dim("$")} mutagent gateway runs logs run_abc123 --json
+  ${chalk49.dim("$")} mutagent gateway runs logs run_abc123 --follow
+  ${chalk49.dim("$")} mutagent gateway runs logs evt_abc123 --json
 
 Takes the same ids as 'runs show', looked up the same way: the event-id route first,
 then the id as a run id. An event id reads the logs of the run that event started
@@ -32945,7 +33039,7 @@ AI Agent Directive:
         printGatewayOk(isJson, page, {
           human: () => {
             for (const entry of page.items)
-              console.log(`${chalk48.dim(entry.at)}  ${entry.text}`);
+              console.log(`${chalk49.dim(entry.at)}  ${entry.text}`);
           }
         });
         if (options.follow !== true || page.done)
@@ -32971,8 +33065,8 @@ async function cancelWithHints(runId, reason) {
 function registerRunsCancel(runs, gateway) {
   runs.command("cancel").description("Cancel a run: stop it and its Helix session").argument("<runId>", "The run id (from mutagent gateway runs or runs show)").option("-f, --force", "Confirm the cancel (required; never prompted for)").option("--yes", "Same as --force").option("--reason <text>", "Why, for the server log only (never stored on the run or shown back)").addHelpText("after", `
 Examples:
-  ${chalk48.dim("$")} mutagent gateway runs cancel run_abc123 --force
-  ${chalk48.dim("$")} mutagent gateway runs cancel run_abc123 --force --reason "wrong repository" --json
+  ${chalk49.dim("$")} mutagent gateway runs cancel run_abc123 --force
+  ${chalk49.dim("$")} mutagent gateway runs cancel run_abc123 --force --reason "wrong repository" --json
 
 Stops the run and its Helix session; the run ends with the error code 'cancelled'.
 Cancelling a run that is already cancelled changes nothing and succeeds. A run that
@@ -32996,7 +33090,7 @@ AI Agent Directive:
       printGatewayOk(isJson, display, {
         next: [`mutagent gateway runs show ${runId} --json`],
         human: () => {
-          console.log(run.state === "cancelled" ? chalk48.green(`✓ Cancelled run ${runId}`) : chalk48.yellow(`Run ${runId} is stopping (state: ${run.state})`));
+          console.log(run.state === "cancelled" ? chalk49.green(`✓ Cancelled run ${runId}`) : chalk49.yellow(`Run ${runId} is stopping (state: ${run.state})`));
           printRunSummary(display);
         }
       });
@@ -33024,8 +33118,8 @@ function readPayloadFile(path) {
 function registerEmit(gateway) {
   gateway.command("emit").description("Emit a user-defined event into the gateway").argument("<kind>", "Event kind — matched against emit:<kind> triggers").option("--key <key>", "Idempotency key (default: a fresh key each call)").option("--payload <file>", "JSON payload, as @file.json").option("--wait", "Poll every resulting run to a terminal phase before returning").addHelpText("after", `
 Examples:
-  ${chalk48.dim("$")} mutagent gateway emit deploy.finished --payload @payload.json --wait
-  ${chalk48.dim("$")} mutagent gateway emit heartbeat --key daily-2026-09-22
+  ${chalk49.dim("$")} mutagent gateway emit deploy.finished --payload @payload.json --wait
+  ${chalk49.dim("$")} mutagent gateway emit heartbeat --key daily-2026-09-22
 
 --payload takes an '@' file reference, e.g. --payload @payload.json — never inline JSON
 (shells mangle quoting on long payloads).
@@ -33046,7 +33140,7 @@ AI Agent Directive:
       if (options.wait !== true || result.eventIds.length === 0) {
         printGatewayOk(isJson, result, {
           human: () => {
-            console.log(`${result.kind}  ${chalk48.dim(`${String(result.eventIds.length)} event(s)`)}`);
+            console.log(`${result.kind}  ${chalk49.dim(`${String(result.eventIds.length)} event(s)`)}`);
             for (const id of result.eventIds)
               console.log(`  ${id}`);
           }
@@ -33088,7 +33182,7 @@ function registerGatewayRunCommands(gateway) {
 
 // src/commands/gateway/events.ts
 import { Command as Command21 } from "commander";
-import chalk49 from "chalk";
+import chalk50 from "chalk";
 
 // src/lib/gateway-api-events.ts
 import { GatewayStreamError, streamGatewayUpdates } from "@mutagent/sdk/custom/gateway-stream.js";
@@ -33157,8 +33251,8 @@ function parseLimit2(raw, feed) {
   return value2;
 }
 function eventRow(e) {
-  const triage = e.filesTriage === true ? chalk49.yellow("  files a triage item") : "";
-  return `  ${chalk49.dim(e.receivedAt)}  ${e.outcome.padEnd(8)}  ${e.kind}  ${chalk49.dim(e.source)}  ${e.id}${triage}`;
+  const triage = e.filesTriage === true ? chalk50.yellow("  files a triage item") : "";
+  return `  ${chalk50.dim(e.receivedAt)}  ${e.outcome.padEnd(8)}  ${e.kind}  ${chalk50.dim(e.source)}  ${e.id}${triage}`;
 }
 function displayNotice(n) {
   const rendered = renderRunErrorForDisplay({ code: n.code, reason: n.reason, fix: n.fix });
@@ -33167,10 +33261,10 @@ function displayNotice(n) {
 function registerEventsList(events, gateway) {
   events.command("list").alias("ls").description("Events that reached the workspace, newest first, with their outcome").option("--since <when>", "ISO-8601 timestamp, or a duration like 30m / 24h / 7d").option("--cursor <cursor>", "nextCursor from the previous page").option("--limit <n>", "Page size, 1-100").option("--follow", "Stay connected and print each event as it settles (Ctrl-C to stop)").addHelpText("after", `
 Examples:
-  ${chalk49.dim("$")} mutagent gateway events list --since 24h
-  ${chalk49.dim("$")} mutagent gateway events list --limit 50 --json
-  ${chalk49.dim("$")} mutagent gateway events list --cursor <nextCursor> --json
-  ${chalk49.dim("$")} mutagent gateway events list --follow --json
+  ${chalk50.dim("$")} mutagent gateway events list --since 24h
+  ${chalk50.dim("$")} mutagent gateway events list --limit 50 --json
+  ${chalk50.dim("$")} mutagent gateway events list --cursor <nextCursor> --json
+  ${chalk50.dim("$")} mutagent gateway events list --follow --json
 
 outcome is matched (a trigger or rule took it), no_match, or refused. Events being
 matched appear once they settle. filesTriage: true marks a Slack mention leading
@@ -33217,7 +33311,7 @@ AI Agent Directive:
         next: page.nextCursor === null ? undefined : [`${again} --cursor ${page.nextCursor}${isJson ? " --json" : ""}`],
         human: () => {
           if (page.items.length === 0) {
-            console.log(chalk49.gray("No events."));
+            console.log(chalk50.gray("No events."));
             return;
           }
           for (const e of page.items)
@@ -33236,7 +33330,7 @@ async function followEvents(isJson) {
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
   if (!isJson)
-    console.error(chalk49.dim("Following gateway events (Ctrl-C to stop)…"));
+    console.error(chalk50.dim("Following gateway events (Ctrl-C to stop)…"));
   try {
     for await (const frame of followGateway(controller.signal)) {
       if (frame.event !== "event" && frame.event !== "ready" && frame.event !== "error")
@@ -33247,7 +33341,7 @@ async function followEvents(isJson) {
         console.log(eventRow(scrubKnownSuccessDeep(frame.data)));
       } else if (frame.event === "error") {
         const data = frame.data;
-        console.error(chalk49.yellow(`stream: ${data.code}: ${data.reason} (reconnecting)`));
+        console.error(chalk50.yellow(`stream: ${data.code}: ${data.reason} (reconnecting)`));
       }
     }
   } finally {
@@ -33255,13 +33349,13 @@ async function followEvents(isJson) {
     process.removeListener("SIGTERM", stop);
   }
   if (!isJson)
-    console.error(chalk49.dim("Stopped."));
+    console.error(chalk50.dim("Stopped."));
 }
 function registerNoticesList(notices, gateway) {
   notices.command("list").alias("ls").description('"Could not run" notices: why an app mention started no run, and the reply sent').option("--cursor <cursor>", "nextCursor from the previous page").option("--limit <n>", "Page size, 1-100").addHelpText("after", `
 Examples:
-  ${chalk49.dim("$")} mutagent gateway notices list
-  ${chalk49.dim("$")} mutagent gateway notices list --cursor <nextCursor> --json
+  ${chalk50.dim("$")} mutagent gateway notices list
+  ${chalk50.dim("$")} mutagent gateway notices list --cursor <nextCursor> --json
 
 Each notice says why a Slack or GitHub mention started no run (code, reason), the fix
 as a command, and whether the reply reached the thread (replySent, replyState). The
@@ -33285,19 +33379,19 @@ AI Agent Directive:
         next: page.nextCursor === null ? undefined : [`mutagent gateway notices list${limit === undefined ? "" : ` --limit ${String(limit)}`} --cursor ${page.nextCursor}${isJson ? " --json" : ""}`],
         human: () => {
           if (items.length === 0) {
-            console.log(chalk49.gray("No notices."));
+            console.log(chalk50.gray("No notices."));
             return;
           }
           for (const n of items) {
-            console.log(`  ${chalk49.dim(n.createdAt)}  ${n.eventKind}  ${chalk49.dim(n.eventId)}  reply ${n.replyTo}: ${n.replyState}`);
+            console.log(`  ${chalk50.dim(n.createdAt)}  ${n.eventKind}  ${chalk50.dim(n.eventId)}  reply ${n.replyTo}: ${n.replyState}`);
             if (n.triageItem !== undefined) {
-              console.log(chalk49.green(`    ${filedAsTriageLine(n.triageItem)}`));
-              console.log(chalk49.dim(`    next: ${filedAsTriageNext(n.triageItem).join(", ")}`));
+              console.log(chalk50.green(`    ${filedAsTriageLine(n.triageItem)}`));
+              console.log(chalk50.dim(`    next: ${filedAsTriageNext(n.triageItem).join(", ")}`));
               continue;
             }
             console.log(`    ${n.code}: ${n.reason}`);
             for (const step of n.fix)
-              console.log(chalk49.yellow(`    Fix: ${step}`));
+              console.log(chalk50.yellow(`    Fix: ${step}`));
           }
         }
       });
@@ -33316,7 +33410,7 @@ function registerGatewayEventsCommands(gateway) {
 
 // src/commands/gateway/admin.ts
 import { Command as Command22 } from "commander";
-import chalk50 from "chalk";
+import chalk51 from "chalk";
 
 // src/lib/gateway-admin.ts
 import { execFile as execFile2 } from "node:child_process";
@@ -33395,7 +33489,7 @@ init_known_secrets();
 function registerPreflight(admin, gateway) {
   admin.command("preflight").description("End-to-end check: could this deployment serve a gateway delivery right now?").option("--workspace <id>", "Scope repository/channel/target checks to one workspace (default: the configured workspace)").addHelpText("after", `
 Examples:
-  ${chalk50.dim("$")} mutagent gateway admin preflight --json
+  ${chalk51.dim("$")} mutagent gateway admin preflight --json
 
 Wraps 'bun run gateway:preflight' in the mutagent/ server checkout. Operator-only —
 see 'mutagent gateway admin --help' for what that requires (checkout + DATABASE_URL).
@@ -33418,9 +33512,9 @@ AI Agent Directive:
         throw new GatewayCliError("SERVER_FAULT", `gateway:preflight did not print JSON (exit ${String(result.exitCode)}): ${scrubKnownSuccess(result.stderr || result.stdout).slice(0, 500)}`, { notes: ["The server script failed before it could report. Its output is above; run it from the server checkout to see the full error."] });
       }
       const human = () => {
-        console.log(`${report.verdict === "PASS" ? chalk50.green("PASS") : chalk50.red("BLOCKED")}  ${chalk50.dim(`${String(report.checked.length)} checked`)}`);
+        console.log(`${report.verdict === "PASS" ? chalk51.green("PASS") : chalk51.red("BLOCKED")}  ${chalk51.dim(`${String(report.checked.length)} checked`)}`);
         for (const finding of report.findings)
-          console.log(`  ${chalk50.red("✗")} ${finding.item}: ${finding.detail}`);
+          console.log(`  ${chalk51.red("✗")} ${finding.item}: ${finding.detail}`);
       };
       if (report.verdict === "PASS") {
         printGatewayOk(isJson, report, { human });
@@ -33436,7 +33530,7 @@ AI Agent Directive:
 function registerSeedApps(admin, gateway) {
   admin.command("seed-apps").description("Load a GitHub App's / Slack app's credentials from the environment").addHelpText("after", `
 Examples:
-  ${chalk50.dim("$")} mutagent gateway admin seed-apps --json
+  ${chalk51.dim("$")} mutagent gateway admin seed-apps --json
 
 Wraps 'bun run gateway:seed-apps' in the mutagent/ server checkout. Operator-only —
 see 'mutagent gateway admin --help'. Credentials come from the environment ONLY
@@ -33471,8 +33565,8 @@ AI Agent Directive:
 function registerLimits(admin, gateway) {
   const limits = new Command22("limits").description("Show or set the workspace's run-concurrency and daily-run caps").addHelpText("after", `
 Examples:
-  ${chalk50.dim("$")} mutagent gateway admin limits --json
-  ${chalk50.dim("$")} mutagent gateway admin limits set --concurrent 5 --daily 100 --json
+  ${chalk51.dim("$")} mutagent gateway admin limits --json
+  ${chalk51.dim("$")} mutagent gateway admin limits set --concurrent 5 --daily 100 --json
 
 Bare (or 'admin limits'): shows the current caps. 'set': changes them — admins only.
 
@@ -33488,8 +33582,8 @@ AI Agent Directive:
       const current = await getWorkspaceLimits();
       printGatewayOk(isJson, current, {
         human: () => {
-          console.log(`concurrent: ${String(current.concurrent)}   daily: ${String(current.daily)}   ${chalk50.dim(`(${current.source})`)}`);
-          console.log(chalk50.dim(`used today (${current.day}): ${String(current.usedToday)} / ${String(current.daily)}`));
+          console.log(`concurrent: ${String(current.concurrent)}   daily: ${String(current.daily)}   ${chalk51.dim(`(${current.source})`)}`);
+          console.log(chalk51.dim(`used today (${current.day}): ${String(current.usedToday)} / ${String(current.daily)}`));
         }
       });
       return;
@@ -33497,7 +33591,7 @@ AI Agent Directive:
   });
   limits.command("set").description("Set the workspace's run-concurrency and/or daily-run caps").option("--concurrent <n>", `Runs in flight at once (${String(WORKSPACE_LIMIT_BOUNDS.concurrent.min)}–${String(WORKSPACE_LIMIT_BOUNDS.concurrent.max)})`).option("--daily <n>", `Runs started per UTC day (${String(WORKSPACE_LIMIT_BOUNDS.daily.min)}–${String(WORKSPACE_LIMIT_BOUNDS.daily.max)})`).addHelpText("after", `
 Examples:
-  ${chalk50.dim("$")} mutagent gateway admin limits set --concurrent 5 --daily 100
+  ${chalk51.dim("$")} mutagent gateway admin limits set --concurrent 5 --daily 100
 
 Admins only (workspace admin, or org owner/admin) — anyone else is refused.
 Pass one or both of --concurrent / --daily; the other stays unchanged.
@@ -33531,7 +33625,7 @@ AI Agent Directive:
       const updated = await setWorkspaceLimits(body);
       printGatewayOk(isJson, updated, {
         human: () => {
-          console.log(chalk50.green(`✓ concurrent: ${String(updated.concurrent)}   daily: ${String(updated.daily)}`));
+          console.log(chalk51.green(`✓ concurrent: ${String(updated.concurrent)}   daily: ${String(updated.daily)}`));
         }
       });
       return;
@@ -33568,12 +33662,12 @@ function createGatewayCommand(deps = {}) {
   registerGatewayEventsCommands(gateway);
   registerGatewayAdminCommands(gateway);
   gateway.addHelpText("after", `
-${chalk51.yellow("Start here:")}
-  mutagent gateway                        ${chalk51.dim("= status: connected, missing, next command")}
+${chalk52.yellow("Start here:")}
+  mutagent gateway                        ${chalk52.dim("= status: connected, missing, next command")}
   mutagent gateway status [--json]
-  mutagent gateway doctor                 ${chalk51.dim("End-to-end check, with fixes")}
+  mutagent gateway doctor                 ${chalk52.dim("End-to-end check, with fixes")}
 
-${chalk51.yellow("Configure:")}
+${chalk52.yellow("Configure:")}
   mutagent gateway connect github|slack [--wait] [--open] [--attempt <id>]
   mutagent gateway reconnect github|slack
   mutagent gateway disconnect github|slack --force
@@ -33582,17 +33676,17 @@ ${chalk51.yellow("Configure:")}
   mutagent gateway repos unlink owner/name --force
   mutagent gateway repos grant-more
 
-${chalk51.yellow("Configure — triggers (event → agent run):")}
+${chalk52.yellow("Configure — triggers (event → agent run):")}
   mutagent gateway triggers
   mutagent gateway triggers create --on <kind> [--repo owner/name | --no-repo] (--instruction "…" | --instruction-file f.md) [--name n]
-      [--stage evaluate|diagnose|optimize] [--subject agent|skill|service:name,…]   ${chalk51.dim("--subject: trace.threshold only")}
+      [--stage evaluate|diagnose|optimize] [--subject agent|skill|service:name,…]   ${chalk52.dim("--subject: trace.threshold only")}
   mutagent gateway triggers update <id> [--instruction "…" | --instruction-file f.md] [--name n] [--channel id…]
       [--stage <stage>|none] [--subject <kind:names>|none]
   mutagent gateway triggers show|enable|disable <id>
   mutagent gateway triggers delete <id> --force
   mutagent gateway triggers test <id> --event @sample.json
 
-${chalk51.yellow("Configure — routines (schedule → agent run):")}
+${chalk52.yellow("Configure — routines (schedule → agent run):")}
   mutagent gateway routines
   mutagent gateway routines create (--every "weekdays 09:00" | --cron "0 9 * * 1-5") --tz Europe/Berlin [--repo owner/name | --no-repo] (--instruction "…" | --instruction-file f.md) [--name n] [--stage <stage>]
   mutagent gateway routines update <id> [(--every "…" | --cron "…") --tz zone] [--instruction "…"] [--name n] [--stage <stage>|none]
@@ -33600,7 +33694,7 @@ ${chalk51.yellow("Configure — routines (schedule → agent run):")}
   mutagent gateway routines run-now <id> [--wait]
   mutagent gateway routines delete <id> --force
 
-${chalk51.yellow("Operate:")}
+${chalk52.yellow("Operate:")}
   mutagent gateway test-run [--repo owner/name] [--wait] [--key k]
   mutagent gateway runs [--status s] [--since 24h] [--trigger id|--routine id]
   mutagent gateway runs show <eventId|runId>
@@ -33608,18 +33702,18 @@ ${chalk51.yellow("Operate:")}
   mutagent gateway runs cancel <runId> --force [--reason "…"]
   mutagent gateway emit <kind> [--key k] [--payload @file] [--wait]
   mutagent gateway events list [--since 24h] [--cursor c] [--limit n]
-  mutagent gateway events list --follow   ${chalk51.dim("Live, until Ctrl-C (--json: one frame per line)")}
+  mutagent gateway events list --follow   ${chalk52.dim("Live, until Ctrl-C (--json: one frame per line)")}
   mutagent gateway notices list [--cursor c] [--limit n]
 
-${chalk51.yellow("Admin:")}
+${chalk52.yellow("Admin:")}
   mutagent gateway admin preflight [--workspace id]
   mutagent gateway admin seed-apps
   mutagent gateway admin limits
   mutagent gateway admin limits set --concurrent N --daily N
 
-${chalk51.yellow("--json output and exit codes (the same as every mutagent command):")}
-  Success: ${chalk51.bold("{ success: true, ok: true, data, next }")}
-  Failure: ${chalk51.bold("{ success: false, ok: false, error, code, suggestedAction, _agentGuidance }")}
+${chalk52.yellow("--json output and exit codes (the same as every mutagent command):")}
+  Success: ${chalk52.bold("{ success: true, ok: true, data, next }")}
+  Failure: ${chalk52.bold("{ success: false, ok: false, error, code, suggestedAction, _agentGuidance }")}
   ${EXIT_CODES_LINE}.
   'code' is specific (RUN_STARTING, GITHUB_NOT_CONNECTED, CONFIRMATION_REQUIRED, …) —
      branch on it, never on the error text. 'error' says what went wrong.
@@ -33635,7 +33729,7 @@ ${chalk51.yellow("--json output and exit codes (the same as every mutagent comma
   '_agentGuidance.escalate' is present only when a person has to act (a browser
      consent, a workspace admin, a Mutagent operator, a confirmation) and says who.
 
-${chalk51.yellow("AI Agent Directive:")}
+${chalk52.yellow("AI Agent Directive:")}
   1. Run 'mutagent gateway --json' first, every time, and run what 'next' says.
   2. On 'connect', a person opens 'data.signInUrl' first and signs in, then opens
      'data.url' in that SAME browser — the callback only completes in a browser signed
@@ -33657,18 +33751,18 @@ ${chalk51.yellow("AI Agent Directive:")}
      reaches is usable and links on create; one it cannot reach is refused with
      REPOSITORY_INACCESSIBLE (fix: mutagent gateway repos grant-more).
 ${!hasCredentials() ? `
-` + chalk51.yellow("  Warning: Not authenticated. Run: mutagent login --browser") + `
+` + chalk52.yellow("  Warning: Not authenticated. Run: mutagent login --browser") + `
 ` : ""}`);
   return gateway;
 }
 
 // src/commands/reports/index.ts
 import { Command as Command24 } from "commander";
-import chalk54 from "chalk";
+import chalk55 from "chalk";
 
 // src/commands/reports/manage.ts
 import { writeFileSync as writeFileSync7 } from "fs";
-import chalk52 from "chalk";
+import chalk53 from "chalk";
 init_errors();
 init_output();
 
@@ -33882,9 +33976,9 @@ function row(r) {
 function registerList5(reports) {
   reports.command("list").alias("ls").description("Reports in the workspace, newest first").option("--subject <id>", "Only reports about this agent, skill or workflow").option("--kind <kind>", "Only this kind: diagnostics|discovery|evaluator|hitl").option("--run-id <id>", "Only reports from this run").option("--session-ref <ref>", "Only reports from this Helix session").option("--cursor <cursor>", "Continue from a previous page's nextCursor").addHelpText("after", `
 Examples:
-  ${chalk52.dim("$")} mutagent reports list
-  ${chalk52.dim("$")} mutagent reports list --kind evaluator --subject support-bot --json
-  ${chalk52.dim("$")} mutagent reports list --cursor <nextCursor> --json
+  ${chalk53.dim("$")} mutagent reports list
+  ${chalk53.dim("$")} mutagent reports list --kind evaluator --subject support-bot --json
+  ${chalk53.dim("$")} mutagent reports list --cursor <nextCursor> --json
 
 Filters combine with AND. A page ends with nextCursor; pass it as --cursor for the next.
 
@@ -33906,20 +34000,20 @@ AI Agent Directive:
         return;
       }
       if (page.reports.length === 0) {
-        console.log(chalk52.gray("No reports."));
+        console.log(chalk53.gray("No reports."));
         return;
       }
       new OutputFormatter("table").output(page.reports.map(row));
       if (page.nextCursor !== null)
-        console.log(chalk52.dim(`More: mutagent reports list --cursor ${page.nextCursor}`));
+        console.log(chalk53.dim(`More: mutagent reports list --cursor ${page.nextCursor}`));
     });
   });
 }
 function registerShow4(reports) {
   reports.command("show").description("A report with its render input; --html saves the published HTML").argument("<id>", "The report id (from reports list or push)").option("--html <file>", "Write the published HTML to this file").addHelpText("after", `
 Examples:
-  ${chalk52.dim("$")} mutagent reports show rep_123
-  ${chalk52.dim("$")} mutagent reports show rep_123 --html report.html --json
+  ${chalk53.dim("$")} mutagent reports show rep_123
+  ${chalk53.dim("$")} mutagent reports show rep_123 --html report.html --json
 
 The HTML is never printed; it is served as a file under a sandboxing CSP.
 
@@ -33946,21 +34040,21 @@ AI Agent Directive:
         return;
       }
       const r = detail.report;
-      console.log(chalk52.bold(r.title));
+      console.log(chalk53.bold(r.title));
       for (const [label, value2] of Object.entries({ ...row(r), session: detail.sessionRef ?? "", html: links.html })) {
         if (label !== "title" && value2 !== "")
           console.log(`  ${label.padEnd(9)}${value2}`);
       }
       if (htmlFile !== undefined)
-        console.log(chalk52.green(`✓ HTML written to ${htmlFile}`));
+        console.log(chalk53.green(`✓ HTML written to ${htmlFile}`));
     });
   });
 }
 function registerReview(reports) {
   reports.command("review").description("Mark a report reviewed (--undo: unreviewed)").argument("<id>", "The report id").option("--undo", "Mark it unreviewed instead").addHelpText("after", `
 Examples:
-  ${chalk52.dim("$")} mutagent reports review rep_123
-  ${chalk52.dim("$")} mutagent reports review rep_123 --undo --json
+  ${chalk53.dim("$")} mutagent reports review rep_123
+  ${chalk53.dim("$")} mutagent reports review rep_123 --undo --json
 
 AI Agent Directive:
   A write: confirm with the user first. --json returns { success, report, _links,
@@ -33983,15 +34077,15 @@ AI Agent Directive:
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk52.green(`✓ Report ${report.id} marked ${reviewed ? "reviewed" : "unreviewed"}: ${report.title}`));
+      console.log(chalk53.green(`✓ Report ${report.id} marked ${reviewed ? "reviewed" : "unreviewed"}: ${report.title}`));
     });
   });
 }
 function registerRetract(reports) {
   reports.command("retract").description("Delete a report, its findings and its HTML").argument("<id>", "The report id").option("-f, --force", "Confirm the retract (required in every mode; never prompted for)").option("-y, --yes", "Same as --force").addHelpText("after", `
 Examples:
-  ${chalk52.dim("$")} mutagent reports retract rep_123 --force
-  ${chalk52.dim("$")} mutagent reports retract rep_123 --force --json
+  ${chalk53.dim("$")} mutagent reports retract rep_123 --force
+  ${chalk53.dim("$")} mutagent reports retract rep_123 --force --json
 
 Requires --force (or --yes) in every mode: a terminal, --json, --non-interactive or a
 pipe is not consent, and nothing prompts. Without it the command refuses
@@ -34019,7 +34113,7 @@ AI Agent Directive:
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk52.green(`✓ Retracted report ${id}`));
+      console.log(chalk53.green(`✓ Retracted report ${id}`));
     });
   });
 }
@@ -34032,7 +34126,7 @@ function registerReportsManage(reports) {
 
 // src/commands/reports/push.ts
 init_errors();
-import chalk53 from "chalk";
+import chalk54 from "chalk";
 import { ReportKind as SdkReportKind } from "@mutagent/sdk/models";
 init_output();
 
@@ -34193,11 +34287,11 @@ Usage:
   ${PUSH_USAGE}
 
 Examples:
-  ${chalk53.dim("$")} helix-cli report publish runs/42/report.html runs/42/report.client.html
-  ${chalk53.dim("$")} mutagent reports push runs/42 --kind evaluator
-  ${chalk53.dim("$")} mutagent reports push runs/42/report.client.html --kind diagnostics --run-id run-42 --json
-  ${chalk53.dim("$")} mutagent reports push runs/42 --kind evaluator --replace
-  ${chalk53.dim("$")} mutagent reports push review/ --kind hitl
+  ${chalk54.dim("$")} helix-cli report publish runs/42/report.html runs/42/report.client.html
+  ${chalk54.dim("$")} mutagent reports push runs/42 --kind evaluator
+  ${chalk54.dim("$")} mutagent reports push runs/42/report.client.html --kind diagnostics --run-id run-42 --json
+  ${chalk54.dim("$")} mutagent reports push runs/42 --kind evaluator --replace
+  ${chalk54.dim("$")} mutagent reports push review/ --kind hitl
 
 Kinds, and the helix-cli render kind each one comes from:
   diagnosis → diagnostics · discover → discovery · eval → evaluator · review → hitl
@@ -34275,12 +34369,12 @@ AI Agent Directive:
         return;
       }
       if (created)
-        console.log(chalk53.green(`✓ Stored report ${report.id} (${report.kind}): ${report.title}`));
+        console.log(chalk54.green(`✓ Stored report ${report.id} (${report.kind}): ${report.title}`));
       else if (replaced)
-        console.log(chalk53.green(`✓ Replaced the content of report ${report.id} (${report.kind}): ${report.title}`));
+        console.log(chalk54.green(`✓ Replaced the content of report ${report.id} (${report.kind}): ${report.title}`));
       else {
-        console.log(chalk53.blue(`ℹ already stored (created: false): report ${report.id} for run ${report.runId ?? "—"} kept its first content.`));
-        console.log(chalk53.dim("  Pass --replace to swap it."));
+        console.log(chalk54.blue(`ℹ already stored (created: false): report ${report.id} for run ${report.runId ?? "—"} kept its first content.`));
+        console.log(chalk54.dim("  Pass --replace to swap it."));
       }
       console.log(`  HTML:  ${links.html}`);
       console.log(`  Next:  mutagent reports show ${report.id}`);
@@ -34295,11 +34389,11 @@ function createReportsCommand() {
   registerReportsManage(reports);
   reports.addHelpText("after", `
 Examples:
-  ${chalk54.dim("$")} ${PUSH_USAGE}
-  ${chalk54.dim("$")} mutagent reports list [--subject <id>] [--kind <kind>] [--run-id <id>] [--session-ref <ref>] [--cursor <c>]
-  ${chalk54.dim("$")} mutagent reports show <id> [--html <file>]
-  ${chalk54.dim("$")} mutagent reports review <id> [--undo]
-  ${chalk54.dim("$")} mutagent reports retract <id> --force
+  ${chalk55.dim("$")} ${PUSH_USAGE}
+  ${chalk55.dim("$")} mutagent reports list [--subject <id>] [--kind <kind>] [--run-id <id>] [--session-ref <ref>] [--cursor <c>]
+  ${chalk55.dim("$")} mutagent reports show <id> [--html <file>]
+  ${chalk55.dim("$")} mutagent reports review <id> [--undo]
+  ${chalk55.dim("$")} mutagent reports retract <id> --force
 
 Kinds: diagnostics · discovery · evaluator · hitl
 The workspace is the usual one: --workspace, MUTAGENT_WORKSPACE_ID or 'mutagent workspaces use'.
@@ -34316,7 +34410,7 @@ AI Agent Directive:
 // src/commands/findings/index.ts
 init_errors();
 import { Command as Command25 } from "commander";
-import chalk55 from "chalk";
+import chalk56 from "chalk";
 import { FindingStatus } from "@mutagent/sdk/models";
 
 // src/lib/findings-status.ts
@@ -34422,9 +34516,9 @@ function statusDirective(f, links) {
 function registerList6(findings) {
   findings.command("list").alias("ls").description("Findings in the workspace, newest first").option("--status <status>", "Only this status: open|in-diagnostics|resolved").option("--subject <id>", "Only findings about this agent, skill or workflow").option("--run-id <id>", "Only findings from this run").option("--report <id>", "Only findings from this report").addHelpText("after", `
 Examples:
-  ${chalk55.dim("$")} mutagent findings list
-  ${chalk55.dim("$")} mutagent findings list --status open --subject support-bot --json
-  ${chalk55.dim("$")} mutagent findings list --report rpt_123 --json
+  ${chalk56.dim("$")} mutagent findings list
+  ${chalk56.dim("$")} mutagent findings list --status open --subject support-bot --json
+  ${chalk56.dim("$")} mutagent findings list --report rpt_123 --json
 
 Filters combine with AND. The whole list comes back in one page.
 
@@ -34446,7 +34540,7 @@ AI Agent Directive:
         return;
       }
       if (page.findings.length === 0) {
-        console.log(chalk55.gray("No findings."));
+        console.log(chalk56.gray("No findings."));
         return;
       }
       new OutputFormatter("table").output(page.findings.map(row2));
@@ -34456,8 +34550,8 @@ AI Agent Directive:
 function registerSetStatus(findings) {
   findings.command("set-status").description("Resolve or reopen a finding").argument("<id>", "The finding id (from findings list)").argument("<open|resolved>", "resolved to close it, open to reopen it").addHelpText("after", `
 Examples:
-  ${chalk55.dim("$")} mutagent findings set-status fnd_123 resolved
-  ${chalk55.dim("$")} mutagent findings set-status fnd_123 open --json
+  ${chalk56.dim("$")} mutagent findings set-status fnd_123 resolved
+  ${chalk56.dim("$")} mutagent findings set-status fnd_123 open --json
 
 The ladder: open → resolved, resolved → open, in-diagnostics → open or resolved.
 in-diagnostics itself is set only by routing a finding to diagnostics, which also
@@ -34490,7 +34584,7 @@ AI Agent Directive:
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk55.green(`✓ Finding ${finding.id} (${finding.criterion}) is ${finding.status}`));
+      console.log(chalk56.green(`✓ Finding ${finding.id} (${finding.criterion}) is ${finding.status}`));
       console.log(`  Report:  ${links.report}`);
     });
   });
@@ -34501,8 +34595,8 @@ function createFindingsCommand() {
   registerSetStatus(findings);
   findings.addHelpText("after", `
 Examples:
-  ${chalk55.dim("$")} mutagent findings list [--status <status>] [--subject <id>] [--run-id <id>] [--report <id>]
-  ${chalk55.dim("$")} mutagent findings set-status <id> <open|resolved>
+  ${chalk56.dim("$")} mutagent findings list [--status <status>] [--subject <id>] [--run-id <id>] [--report <id>]
+  ${chalk56.dim("$")} mutagent findings set-status <id> <open|resolved>
 
 Findings are created when an evaluator report is pushed: mutagent reports push <run> --kind evaluator
 The workspace is the usual one: --workspace, MUTAGENT_WORKSPACE_ID or 'mutagent workspaces use'.
@@ -34518,7 +34612,7 @@ AI Agent Directive:
 // src/commands/triage/index.ts
 init_errors();
 import { Command as Command26 } from "commander";
-import chalk57 from "chalk";
+import chalk58 from "chalk";
 import { FindingStatus as FindingStatus2 } from "@mutagent/sdk/models";
 init_output();
 
@@ -34526,7 +34620,7 @@ init_output();
 init_errors();
 init_output();
 import { readFileSync as readFileSync22 } from "fs";
-import chalk56 from "chalk";
+import chalk57 from "chalk";
 import { CreateTriageRequestSeverity, CreateTriageRequestSubjectKind, TriageSource } from "@mutagent/sdk/models";
 
 // src/lib/triage-request.ts
@@ -34755,10 +34849,10 @@ async function ask() {
 function registerTriageFile(triage) {
   triage.command("file").description("File a problem about an agent, skill or workflow (preview, then send on consent)").option("--subject <id>", "REQUIRED: the agent, skill or workflow the problem is about").option("--title <text>", "REQUIRED: one line").option("--body <text|@file>", "REQUIRED: what happened, or @path to read it from a file").option("--repo <owner/name>", "The linked GitHub repository, as owner/name (sent as repository)").option("--subject-kind <kind>", "What the subject is: agent | skill | workflow | multi-agent-system").option("--severity <level>", "CRIT | HIGH | MED | LOW (any case); left out, none is stored").option("--source <source>", "Who is filing: chat (default) | trace-score | external | mention").option("-y, --yes", "Consent to send without a prompt (after the user agreed to the preview)").addHelpText("after", `
 Examples:
-  ${chalk56.dim("$")} mutagent triage file --subject support-bot --title "Quotes the wrong refund window" --body "Told a customer 60 days; the policy is 30."
-  ${chalk56.dim("$")} mutagent triage file --subject support-bot --title "Refund window" --body @what-happened.md --severity high --json
-  ${chalk56.dim("$")} mutagent triage file --subject support-bot --subject-kind agent --repo acme/support-bot --title "Refund window" --body @what-happened.md --json
-  ${chalk56.dim("$")} mutagent triage file --subject support-bot --title "Refund window" --body @what-happened.md --severity high --yes --json
+  ${chalk57.dim("$")} mutagent triage file --subject support-bot --title "Quotes the wrong refund window" --body "Told a customer 60 days; the policy is 30."
+  ${chalk57.dim("$")} mutagent triage file --subject support-bot --title "Refund window" --body @what-happened.md --severity high --json
+  ${chalk57.dim("$")} mutagent triage file --subject support-bot --subject-kind agent --repo acme/support-bot --title "Refund window" --body @what-happened.md --json
+  ${chalk57.dim("$")} mutagent triage file --subject support-bot --title "Refund window" --body @what-happened.md --severity high --yes --json
 
 Nothing is sent without consent. The command first prints a preview of exactly what
 will be sent (workspace, server, every field, the full body), then:
@@ -34796,7 +34890,7 @@ AI Agent Directive:
           new OutputFormatter("json").output({ success: true, sent: false, consentRequired: true, request, preview, next });
           return;
         }
-        console.log(chalk56.yellow(consent === "declined" ? "Not filed. Nothing was sent." : "Nothing was sent. To file it, re-run the same command with --yes."));
+        console.log(chalk57.yellow(consent === "declined" ? "Not filed. Nothing was sent." : "Nothing was sent. To file it, re-run the same command with --yes."));
         return;
       }
       let item;
@@ -34817,7 +34911,7 @@ AI Agent Directive:
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk56.green(`✓ Filed triage item ${item.id} (${item.status}): ${item.title}`));
+      console.log(chalk57.green(`✓ Filed triage item ${item.id} (${item.status}): ${item.title}`));
       console.log(`  API:  ${links.api}`);
     });
   });
@@ -34839,8 +34933,8 @@ function row3(i) {
 function registerList7(triage) {
   triage.command("list").alias("ls").description("Triage items in the workspace, newest first").option("--status <status>", "Only this status: open|in-diagnostics|resolved").option("--subject <id>", "Only items about this agent, skill or workflow").addHelpText("after", `
 Examples:
-  ${chalk57.dim("$")} mutagent triage list
-  ${chalk57.dim("$")} mutagent triage list --status open --subject support-bot --json
+  ${chalk58.dim("$")} mutagent triage list
+  ${chalk58.dim("$")} mutagent triage list --status open --subject support-bot --json
 
 Filters combine with AND. The whole list comes back in one page.
 
@@ -34865,7 +34959,7 @@ AI Agent Directive:
         return;
       }
       if (page.items.length === 0) {
-        console.log(chalk57.gray("No triage items."));
+        console.log(chalk58.gray("No triage items."));
         return;
       }
       new OutputFormatter("table").output(page.items.map(row3));
@@ -34875,8 +34969,8 @@ AI Agent Directive:
 function registerShow5(triage) {
   triage.command("show").description("One triage item, with its body").argument("<id>", "The triage item id (from triage list or file)").addHelpText("after", `
 Examples:
-  ${chalk57.dim("$")} mutagent triage show tri_123
-  ${chalk57.dim("$")} mutagent triage show tri_123 --json
+  ${chalk58.dim("$")} mutagent triage show tri_123
+  ${chalk58.dim("$")} mutagent triage show tri_123 --json
 
 AI Agent Directive:
   --json returns { item, _links }. Reading is free. An unknown id is TRIAGE_NOT_FOUND (exit 1).
@@ -34893,7 +34987,7 @@ AI Agent Directive:
         new OutputFormatter("json").output({ item, _links: triageLinks(item.id) });
         return;
       }
-      console.log(chalk57.bold(`${item.id}  ${item.title}`));
+      console.log(chalk58.bold(`${item.id}  ${item.title}`));
       console.log(`  status      ${item.status}`);
       console.log(`  subject     ${item.subject}${item.subjectKind ? ` (${item.subjectKind})` : ""}`);
       console.log(`  severity    ${item.severity ?? "—"}`);
@@ -34911,8 +35005,8 @@ AI Agent Directive:
 function registerSetStatus2(triage) {
   triage.command("set-status").description("Resolve or reopen a triage item").argument("<id>", "The triage item id (from triage list)").argument("<open|resolved>", "resolved to close it, open to reopen it").addHelpText("after", `
 Examples:
-  ${chalk57.dim("$")} mutagent triage set-status tri_123 resolved
-  ${chalk57.dim("$")} mutagent triage set-status tri_123 open --json
+  ${chalk58.dim("$")} mutagent triage set-status tri_123 resolved
+  ${chalk58.dim("$")} mutagent triage set-status tri_123 open --json
 
 The ladder is the findings one: open → resolved, resolved → open, in-diagnostics → open
 or resolved. in-diagnostics itself is set only by routing an item to diagnostics, which
@@ -34950,7 +35044,7 @@ AI Agent Directive:
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk57.green(`✓ Triage item ${item.id} (${item.title}) is ${item.status}`));
+      console.log(chalk58.green(`✓ Triage item ${item.id} (${item.title}) is ${item.status}`));
     });
   });
 }
@@ -34962,10 +35056,10 @@ function createTriageCommand() {
   registerSetStatus2(triage);
   triage.addHelpText("after", `
 Examples:
-  ${chalk57.dim("$")} mutagent triage file --subject <id> --title "<one line>" --body "<text>|@file" [--subject-kind <kind>] [--repo <owner/name>] [--severity <level>] [--source <source>] [--yes]
-  ${chalk57.dim("$")} mutagent triage list [--status <status>] [--subject <id>]
-  ${chalk57.dim("$")} mutagent triage show <id>
-  ${chalk57.dim("$")} mutagent triage set-status <id> <open|resolved>
+  ${chalk58.dim("$")} mutagent triage file --subject <id> --title "<one line>" --body "<text>|@file" [--subject-kind <kind>] [--repo <owner/name>] [--severity <level>] [--source <source>] [--yes]
+  ${chalk58.dim("$")} mutagent triage list [--status <status>] [--subject <id>]
+  ${chalk58.dim("$")} mutagent triage show <id>
+  ${chalk58.dim("$")} mutagent triage set-status <id> <open|resolved>
 
 There is no delete: the server keeps every item, so an item is resolved, not removed.
 The workspace is the usual one: --workspace, MUTAGENT_WORKSPACE_ID or 'mutagent workspaces use'.
@@ -34981,11 +35075,11 @@ AI Agent Directive:
 
 // src/commands/inbox/index.ts
 import { Command as Command27 } from "commander";
-import chalk59 from "chalk";
+import chalk60 from "chalk";
 init_output();
 
 // src/commands/inbox/list.ts
-import chalk58 from "chalk";
+import chalk59 from "chalk";
 init_output();
 
 // src/commands/inbox/shared.ts
@@ -35046,10 +35140,10 @@ function inboxError(error3) {
 
 // src/commands/inbox/list.ts
 function printItem(item) {
-  const mark = item.read ? " " : chalk58.cyan("●");
-  const action = item.needsAction ? chalk58.yellow("  needs action") : "";
+  const mark = item.read ? " " : chalk59.cyan("●");
+  const action = item.needsAction ? chalk59.yellow("  needs action") : "";
   const where = item.projectPath ?? "—";
-  console.log(`${mark} ${item.id}  ${chalk58.dim(item.kind)}  ${item.title}  ${chalk58.dim(where)}  ${chalk58.dim(new Date(item.ts).toISOString())}${action}`);
+  console.log(`${mark} ${item.id}  ${chalk59.dim(item.kind)}  ${item.title}  ${chalk59.dim(where)}  ${chalk59.dim(new Date(item.ts).toISOString())}${action}`);
 }
 function unreadLine(list) {
   const byProject = Object.entries(list.unreadByProject).filter(([, n]) => n > 0).map(([project, n]) => `${project === "" ? "(no repository)" : project}: ${String(n)}`);
@@ -35058,9 +35152,9 @@ function unreadLine(list) {
 function registerInboxList(inbox) {
   inbox.command("list").alias("ls").description("Your inbox items, newest first").option("--limit <n>", "Items per page, 1 to 100 (server default 50)").option("--cursor <cursor>", "The next page: the nextCursor a previous list returned").addHelpText("after", `
 Examples:
-  ${chalk58.dim("$")} mutagent inbox list
-  ${chalk58.dim("$")} mutagent inbox list --limit 20 --json
-  ${chalk58.dim("$")} mutagent inbox list --cursor <nextCursor> --json
+  ${chalk59.dim("$")} mutagent inbox list
+  ${chalk59.dim("$")} mutagent inbox list --limit 20 --json
+  ${chalk59.dim("$")} mutagent inbox list --cursor <nextCursor> --json
 
 The read flag and the unread counts are yours: read state is per user. unread and
 unreadByProject count every unread item, not just this page. A cursor the server did
@@ -35099,7 +35193,7 @@ AI Agent Directive:
         return;
       }
       if (list.items.length === 0) {
-        console.log(chalk58.gray("Inbox is empty."));
+        console.log(chalk59.gray("Inbox is empty."));
         return;
       }
       for (const item of list.items)
@@ -35107,7 +35201,7 @@ AI Agent Directive:
       console.log("");
       console.log(unreadLine(list));
       if (next[0] !== undefined)
-        console.log(chalk58.dim(`More: ${next[0]}`));
+        console.log(chalk59.dim(`More: ${next[0]}`));
     });
   });
 }
@@ -35116,8 +35210,8 @@ AI Agent Directive:
 function registerRead(inbox) {
   inbox.command("read").description("Mark one inbox item read").argument("<id>", "The inbox item id (from inbox list)").addHelpText("after", `
 Examples:
-  ${chalk59.dim("$")} mutagent inbox read ibx_123
-  ${chalk59.dim("$")} mutagent inbox read ibx_123 --json
+  ${chalk60.dim("$")} mutagent inbox read ibx_123
+  ${chalk60.dim("$")} mutagent inbox read ibx_123 --json
 
 Marks the item read for you only; other members keep their own read state.
 Idempotent: an item already read stays read and the command succeeds.
@@ -35148,15 +35242,15 @@ AI Agent Directive:
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk59.green(`✓ Marked ${id} read`));
+      console.log(chalk60.green(`✓ Marked ${id} read`));
     });
   });
 }
 function registerReadAll(inbox) {
   inbox.command("read-all").description("Mark every inbox item read").addHelpText("after", `
 Examples:
-  ${chalk59.dim("$")} mutagent inbox read-all
-  ${chalk59.dim("$")} mutagent inbox read-all --json
+  ${chalk60.dim("$")} mutagent inbox read-all
+  ${chalk60.dim("$")} mutagent inbox read-all --json
 
 Marks every item in this workspace read for you only; other members keep their own
 read state. Idempotent. Nothing is deleted, so it takes no force flag and never
@@ -35188,7 +35282,7 @@ AI Agent Directive:
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk59.green("✓ Marked every inbox item read"));
+      console.log(chalk60.green("✓ Marked every inbox item read"));
     });
   });
 }
@@ -35199,9 +35293,9 @@ function createInboxCommand() {
   registerReadAll(inbox);
   inbox.addHelpText("after", `
 Examples:
-  ${chalk59.dim("$")} mutagent inbox list [--limit <n>] [--cursor <cursor>]
-  ${chalk59.dim("$")} mutagent inbox read <id>
-  ${chalk59.dim("$")} mutagent inbox read-all
+  ${chalk60.dim("$")} mutagent inbox list [--limit <n>] [--cursor <cursor>]
+  ${chalk60.dim("$")} mutagent inbox read <id>
+  ${chalk60.dim("$")} mutagent inbox read-all
 
 Items come from findings, reports, session status, approvals, routines and triggers.
 Read state is yours alone. There is no delete: the server expires old items itself.
@@ -35217,13 +35311,13 @@ AI Agent Directive:
 
 // src/commands/integrations/index.ts
 import { Command as Command28 } from "commander";
-import chalk62 from "chalk";
+import chalk63 from "chalk";
 
 // src/commands/integrations/pulls.ts
 init_errors();
 import { accessSync as accessSync5, closeSync as closeSync2, constants as constants5, openSync as openSync2, rmSync as rmSync3, writeSync } from "fs";
 import { dirname as dirname10, resolve as resolve11 } from "path";
-import chalk60 from "chalk";
+import chalk61 from "chalk";
 
 // src/lib/integration-sources-input.ts
 init_errors();
@@ -35754,9 +35848,9 @@ function pullNext(id, p) {
 function registerPull(sources) {
   sources.command("pull").description("Start a pull of a source's traces into UniTF on the server").argument("<id>", "The source id").option("--since <time>", "Window start, ISO-8601 (omit for open)").option("--until <time>", "Window end, ISO-8601 (omit for open)").option("--limit <n>", "At most this many traces, 1-5000 (server default 500)").option("--agent-name <name>", "Only traces of this agent").option("--session-id <id>", "Only traces of this session").option("--tag <tag>", "Only traces with this tag (repeatable, at most 20)", (v, acc = []) => [...acc, v]).addHelpText("after", `
 Examples:
-  ${chalk60.dim("$")} ${SOURCES2} pull src_123
-  ${chalk60.dim("$")} ${SOURCES2} pull src_123 --since 2026-09-01T00:00:00Z --until 2026-09-02T00:00:00Z --limit 1000
-  ${chalk60.dim("$")} ${SOURCES2} pull src_123 --agent-name support-bot --tag prod --tag eu --json
+  ${chalk61.dim("$")} ${SOURCES2} pull src_123
+  ${chalk61.dim("$")} ${SOURCES2} pull src_123 --since 2026-09-01T00:00:00Z --until 2026-09-02T00:00:00Z --limit 1000
+  ${chalk61.dim("$")} ${SOURCES2} pull src_123 --agent-name support-bot --tag prod --tag eu --json
 
 Starts the pull and returns at once (status running). Poll it with pull-get; once it has
 succeeded, read pull-manifest and pull-traces. One running pull per source. A throttled or
@@ -35785,7 +35879,7 @@ AI Agent Directive:
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk60.green(`✓ Pull ${started.id} started (${started.status})`));
+      console.log(chalk61.green(`✓ Pull ${started.id} started (${started.status})`));
       console.log(`  Next: ${next[0] ?? ""}`);
     });
   });
@@ -35793,8 +35887,8 @@ AI Agent Directive:
 function registerPulls(sources) {
   sources.command("pulls").description("A source's pulls, newest first (at most 50; kept 90 days)").argument("<id>", "The source id").addHelpText("after", `
 Examples:
-  ${chalk60.dim("$")} ${SOURCES2} pulls src_123
-  ${chalk60.dim("$")} ${SOURCES2} pulls src_123 --json
+  ${chalk61.dim("$")} ${SOURCES2} pulls src_123
+  ${chalk61.dim("$")} ${SOURCES2} pulls src_123 --json
 
 AI Agent Directive:
   Reading is free. --json returns { pulls, count }.
@@ -35808,7 +35902,7 @@ AI Agent Directive:
         return;
       }
       if (list.items.length === 0) {
-        console.log(chalk60.gray(`No pulls. Start one: ${SOURCES2} pull ${id}`));
+        console.log(chalk61.gray(`No pulls. Start one: ${SOURCES2} pull ${id}`));
         return;
       }
       new OutputFormatter("table").output(list.items.map((p) => ({
@@ -35824,8 +35918,8 @@ AI Agent Directive:
 function registerPullGet(sources) {
   sources.command("pull-get").description("One pull: its status, counts and coverage").argument("<id>", "The source id").argument("<pullId>", "The pull id (from pull or pulls)").addHelpText("after", `
 Examples:
-  ${chalk60.dim("$")} ${SOURCES2} pull-get src_123 pull_456
-  ${chalk60.dim("$")} ${SOURCES2} pull-get src_123 pull_456 --json
+  ${chalk61.dim("$")} ${SOURCES2} pull-get src_123 pull_456
+  ${chalk61.dim("$")} ${SOURCES2} pull-get src_123 pull_456 --json
 
 AI Agent Directive:
   Reading is free: poll it while status is running. --json returns { pull, note, next, _links }.
@@ -35839,7 +35933,7 @@ AI Agent Directive:
         new OutputFormatter("json").output({ pull: pullView(p), note, next, _links: pullLinks(id, pullId) });
         return;
       }
-      console.log(`${chalk60.bold(p.id)}  ${p.status}  ${String(p.traces)} traces`);
+      console.log(`${chalk61.bold(p.id)}  ${p.status}  ${String(p.traces)} traces`);
       if (p.truncated)
         console.log(`  truncated: ${p.truncationCause ?? "yes"}`);
       if (p.dropped > 0)
@@ -35853,8 +35947,8 @@ AI Agent Directive:
 function registerPullManifest(sources) {
   sources.command("pull-manifest").description("A pull's unitf@0.1 manifest: what the JSONL holds and how completely").argument("<id>", "The source id").argument("<pullId>", "The pull id").addHelpText("after", `
 Examples:
-  ${chalk60.dim("$")} ${SOURCES2} pull-manifest src_123 pull_456
-  ${chalk60.dim("$")} ${SOURCES2} pull-manifest src_123 pull_456 --json
+  ${chalk61.dim("$")} ${SOURCES2} pull-manifest src_123 pull_456
+  ${chalk61.dim("$")} ${SOURCES2} pull-manifest src_123 pull_456 --json
 
 Available once the pull has succeeded (INTEGRATION_PULL_NOT_READY before).
 
@@ -35871,12 +35965,12 @@ AI Agent Directive:
         return;
       }
       const complete = manifest.coverage?.complete;
-      console.log(`${chalk60.bold(manifest.format)}  ${manifest.platform}  ${String(manifest.count)} traces`);
+      console.log(`${chalk61.bold(manifest.format)}  ${manifest.platform}  ${String(manifest.count)} traces`);
       console.log(`  complete: ${complete === undefined ? "not recorded" : complete ? "yes" : "no"}`);
       if (manifest.truncated)
         console.log(`  truncated: ${manifest.truncationReason ?? "yes"}`);
       for (const w of manifest.warnings ?? [])
-        console.log(chalk60.yellow(`  ⚠ ${w}`));
+        console.log(chalk61.yellow(`  ⚠ ${w}`));
     });
   });
 }
@@ -35927,8 +36021,8 @@ var stdoutSink = {
 function registerPullTraces(sources) {
   sources.command("pull-traces").description("Stream a pull's UniTF JSONL to stdout, or to a file with --out").argument("<id>", "The source id").argument("<pullId>", "The pull id").option("-o, --out <file>", "Write the JSONL to this file instead of stdout").addHelpText("after", `
 Examples:
-  ${chalk60.dim("$")} ${SOURCES2} pull-traces src_123 pull_456 > traces.jsonl
-  ${chalk60.dim("$")} ${SOURCES2} pull-traces src_123 pull_456 --out traces.jsonl --json
+  ${chalk61.dim("$")} ${SOURCES2} pull-traces src_123 pull_456 > traces.jsonl
+  ${chalk61.dim("$")} ${SOURCES2} pull-traces src_123 pull_456 --out traces.jsonl --json
 
 One UniTF 0.1 trace per line, streamed as it arrives. Available once the pull has succeeded.
 --json: without --out, stdout is the JSONL unchanged (each line is already JSON; nothing
@@ -35965,7 +36059,7 @@ AI Agent Directive:
         new OutputFormatter("json").output({ success: true, file: opts.out, bytes, lines: sink.lines, _links: pullLinks(id, pullId) });
         return;
       }
-      console.log(chalk60.green(`✓ Wrote ${String(sink.lines)} traces (${String(bytes)} bytes) to ${opts.out}`));
+      console.log(chalk61.green(`✓ Wrote ${String(sink.lines)} traces (${String(bytes)} bytes) to ${opts.out}`));
     });
   });
 }
@@ -35978,7 +36072,7 @@ function registerPullVerbs(sources) {
 }
 
 // src/commands/integrations/sources.ts
-import chalk61 from "chalk";
+import chalk62 from "chalk";
 init_known_secrets();
 init_output();
 var WRITE_DIRECTIVE = `AI Agent Directive:
@@ -36010,8 +36104,8 @@ function row4(s) {
 function registerList8(sources) {
   sources.command("list").alias("ls").description("Trace sources in the workspace, newest first").addHelpText("after", `
 Examples:
-  ${chalk61.dim("$")} ${SOURCES2} list
-  ${chalk61.dim("$")} ${SOURCES2} list --json
+  ${chalk62.dim("$")} ${SOURCES2} list
+  ${chalk62.dim("$")} ${SOURCES2} list --json
 
 Credentials are never returned; each source names its current ones by credentialRef.
 A row marked read-only is OTLP ingest: it lists while OTLP traces arrive (latest trace
@@ -36029,7 +36123,7 @@ AI Agent Directive:
         return;
       }
       if (all.length === 0) {
-        console.log(chalk61.gray(`No trace sources. Connect one: ${SOURCES2} add langfuse --name <name> --public-key <pk> --secret-stdin`));
+        console.log(chalk62.gray(`No trace sources. Connect one: ${SOURCES2} add langfuse --name <name> --public-key <pk> --secret-stdin`));
         return;
       }
       new OutputFormatter("table").output(all.map(row4));
@@ -36039,10 +36133,10 @@ AI Agent Directive:
 function registerAdd(sources) {
   addCredentialOptions(sources.command("add").description("Connect a Langfuse or OpenObserve trace source (credentials are write-only)").argument("<kind>", "langfuse | openobserve").option("--name <name>", "A name, unique in the workspace (1-100 characters)").option("--host <url>", "Base URL: langfuse default https://cloud.langfuse.com; required for openobserve").option("--openobserve-org <org>", `openobserve: organization id, the model's org (default "default"); not the global --org`).option("--stream <stream>", 'openobserve: stream name (default "default")').option("--signal <signal>", "openobserve: events | spans (omit to detect it from the rows)")).addHelpText("after", `
 Examples:
-  ${chalk61.dim("$")} pass show langfuse/sk | ${SOURCES2} add langfuse --name prod --public-key pk-lf-… --secret-stdin
-  ${chalk61.dim("$")} ${SOURCES2} add langfuse --name self-hosted --host https://langfuse.example.com --public-key pk-lf-… --secret-env LANGFUSE_SECRET_KEY
-  ${chalk61.dim("$")} ${SOURCES2} add openobserve --name oo --host https://api.openobserve.ai --openobserve-org acme --email ops@acme.com --secret-stdin
-  ${chalk61.dim("$")} ${SOURCES2} add openobserve --name oo --host http://oo.internal.example:5080 --secret-env OO_TOKEN --json
+  ${chalk62.dim("$")} pass show langfuse/sk | ${SOURCES2} add langfuse --name prod --public-key pk-lf-… --secret-stdin
+  ${chalk62.dim("$")} ${SOURCES2} add langfuse --name self-hosted --host https://langfuse.example.com --public-key pk-lf-… --secret-env LANGFUSE_SECRET_KEY
+  ${chalk62.dim("$")} ${SOURCES2} add openobserve --name oo --host https://api.openobserve.ai --openobserve-org acme --email ops@acme.com --secret-stdin
+  ${chalk62.dim("$")} ${SOURCES2} add openobserve --name oo --host http://oo.internal.example:5080 --secret-env OO_TOKEN --json
 
 The secret (langfuse secret key; openobserve password with --email, or token without) comes
 from its flag, from --secret-env <VAR>, or from stdin with --secret-stdin: exactly one. A flag
@@ -36066,7 +36160,7 @@ ${WRITE_DIRECTIVE}
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk61.green(`✓ Added ${view.kind} source ${view.name} (id: ${view.id})`));
+      console.log(chalk62.green(`✓ Added ${view.kind} source ${view.name} (id: ${view.id})`));
       console.log(`  Next: ${SOURCES2} test ${view.id}`);
     });
   });
@@ -36074,8 +36168,8 @@ ${WRITE_DIRECTIVE}
 function registerRemove(sources) {
   sources.command("remove").description("Delete a trace source, its credentials, its pulls and their output").argument("<id>", "The source id (from list)").option("-f, --force", "Required: confirms the delete (every mode; there is no prompt)").option("-y, --yes", "Same as --force").addHelpText("after", `
 Examples:
-  ${chalk61.dim("$")} ${SOURCES2} remove src_123 --force
-  ${chalk61.dim("$")} ${SOURCES2} remove src_123 --force --json
+  ${chalk62.dim("$")} ${SOURCES2} remove src_123 --force
+  ${chalk62.dim("$")} ${SOURCES2} remove src_123 --force --json
 
 Destructive: without -f/--force (or --yes) it refuses and sends nothing, in a terminal
 or not, with --json or not. There is no confirmation prompt. Removing a source that is
@@ -36103,15 +36197,15 @@ AI Agent Directive:
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk61.green(`✓ Removed trace source ${id}`));
+      console.log(chalk62.green(`✓ Removed trace source ${id}`));
     });
   });
 }
 function registerTest2(sources) {
   sources.command("test").description("Test a source's connection with its stored credentials").argument("<id>", "The source id").addHelpText("after", `
 Examples:
-  ${chalk61.dim("$")} ${SOURCES2} test src_123
-  ${chalk61.dim("$")} ${SOURCES2} test src_123 --json
+  ${chalk62.dim("$")} ${SOURCES2} test src_123
+  ${chalk62.dim("$")} ${SOURCES2} test src_123 --json
 
 One authenticated request from the server to the source; the outcome is recorded as the
 source's last test. A failed test exits 1 and names the check that failed:
@@ -36135,16 +36229,16 @@ AI Agent Directive:
         return;
       }
       const total = test.totalItems === null ? "" : ` (${String(test.totalItems)} traces reported)`;
-      console.log(chalk61.green(`✓ Source ${id} connected${total}`));
+      console.log(chalk62.green(`✓ Source ${id} connected${total}`));
     });
   });
 }
 function registerRotate(sources) {
   addCredentialOptions(sources.command("rotate").description("Replace a source's credentials (the key version goes up, the last test is cleared)").argument("<id>", "The source id")).addHelpText("after", `
 Examples:
-  ${chalk61.dim("$")} pass show langfuse/sk | ${SOURCES2} rotate src_123 --public-key pk-lf-… --secret-stdin
-  ${chalk61.dim("$")} ${SOURCES2} rotate src_456 --secret-env OO_TOKEN --json
-  ${chalk61.dim("$")} ${SOURCES2} rotate src_456 --email ops@acme.com --secret-stdin
+  ${chalk62.dim("$")} pass show langfuse/sk | ${SOURCES2} rotate src_123 --public-key pk-lf-… --secret-stdin
+  ${chalk62.dim("$")} ${SOURCES2} rotate src_456 --secret-env OO_TOKEN --json
+  ${chalk62.dim("$")} ${SOURCES2} rotate src_456 --email ops@acme.com --secret-stdin
 
 Takes the credentials the source's kind takes (it reads the source's kind first): langfuse
 --public-key and a secret key; openobserve --email and a password, or a token. The secret
@@ -36170,7 +36264,7 @@ ${WRITE_DIRECTIVE}
         echoDirectiveToStderr(directive);
         return;
       }
-      console.log(chalk61.green(`✓ Rotated the credentials of ${view.name} (key version ${String(view.keyVersion)})`));
+      console.log(chalk62.green(`✓ Rotated the credentials of ${view.name} (key version ${String(view.keyVersion)})`));
       console.log(`  Next: ${SOURCES2} test ${id}`);
     });
   });
@@ -36191,16 +36285,16 @@ function createSourcesCommand() {
   registerPullVerbs(sources);
   sources.addHelpText("after", `
 Examples:
-  ${chalk62.dim("$")} ${SOURCES2} list
-  ${chalk62.dim("$")} pass show langfuse/sk | ${SOURCES2} add langfuse --name prod --public-key pk-lf-… --secret-stdin
-  ${chalk62.dim("$")} ${SOURCES2} test <id>
-  ${chalk62.dim("$")} ${SOURCES2} rotate <id> --public-key pk-lf-… --secret-env LANGFUSE_SECRET_KEY
-  ${chalk62.dim("$")} ${SOURCES2} remove <id> --force
-  ${chalk62.dim("$")} ${SOURCES2} pull <id> [--since <iso>] [--until <iso>] [--limit <n>] [--agent-name <n>] [--session-id <s>] [--tag <t>]…
-  ${chalk62.dim("$")} ${SOURCES2} pulls <id>
-  ${chalk62.dim("$")} ${SOURCES2} pull-get <id> <pullId>
-  ${chalk62.dim("$")} ${SOURCES2} pull-manifest <id> <pullId>
-  ${chalk62.dim("$")} ${SOURCES2} pull-traces <id> <pullId> [--out <file>]
+  ${chalk63.dim("$")} ${SOURCES2} list
+  ${chalk63.dim("$")} pass show langfuse/sk | ${SOURCES2} add langfuse --name prod --public-key pk-lf-… --secret-stdin
+  ${chalk63.dim("$")} ${SOURCES2} test <id>
+  ${chalk63.dim("$")} ${SOURCES2} rotate <id> --public-key pk-lf-… --secret-env LANGFUSE_SECRET_KEY
+  ${chalk63.dim("$")} ${SOURCES2} remove <id> --force
+  ${chalk63.dim("$")} ${SOURCES2} pull <id> [--since <iso>] [--until <iso>] [--limit <n>] [--agent-name <n>] [--session-id <s>] [--tag <t>]…
+  ${chalk63.dim("$")} ${SOURCES2} pulls <id>
+  ${chalk63.dim("$")} ${SOURCES2} pull-get <id> <pullId>
+  ${chalk63.dim("$")} ${SOURCES2} pull-manifest <id> <pullId>
+  ${chalk63.dim("$")} ${SOURCES2} pull-traces <id> <pullId> [--out <file>]
 
 Credentials are write-only: they are stored encrypted and no command ever prints them.
 A secret comes from its flag, from --secret-env <VAR>, or from stdin with --secret-stdin.
@@ -36233,8 +36327,8 @@ Deploy targets are not available yet: the platform has not built them, so there
 command for them. Messaging (GitHub, Slack, events, runs) lives in 'mutagent gateway'.
 
 Examples:
-  ${chalk62.dim("$")} ${SOURCES2} list
-  ${chalk62.dim("$")} ${SOURCES2} --help
+  ${chalk63.dim("$")} ${SOURCES2} list
+  ${chalk63.dim("$")} ${SOURCES2} --help
 
 AI Agent Directive:
   Start with '${SOURCES2} list --json'. Do not look for a targets command; there is none yet.
@@ -36392,7 +36486,7 @@ init_key_check();
 init_config();
 init_organization_scope();
 init_output();
-import chalk63 from "chalk";
+import chalk64 from "chalk";
 
 // src/lib/brand.ts
 var BRAND = {
@@ -36980,44 +37074,44 @@ A managed agent is an agent.md folder deployed with mutagent agent deploy.
   });
   program.addHelpText("beforeAll", () => renderBanner());
   program.addHelpText("after", `
-${chalk63.yellow("Get started:")}
+${chalk64.yellow("Get started:")}
   1. mutagent login
-     ${chalk63.dim("Sign in: in the browser, or with MUTAGENT_API_KEY set")}
+     ${chalk64.dim("Sign in: in the browser, or with MUTAGENT_API_KEY set")}
   2. mutagent providers add --provider openai --name "My OpenAI" --api-key-stdin < key.txt
-     ${chalk63.dim("Add your LLM provider key, read from stdin (mutagent providers mirror copies your local Helix logins instead)")}
+     ${chalk64.dim("Add your LLM provider key, read from stdin (mutagent providers mirror copies your local Helix logins instead)")}
   3. mutagent env set staging GREETING=hello --secrets-from-file .env.secrets
-     ${chalk63.dim("Create an Environment: the variables and secrets a sandbox gets")}
+     ${chalk64.dim("Create an Environment: the variables and secrets a sandbox gets")}
   4. mutagent helix --env staging -p "<task>"
-     ${chalk63.dim("Run Helix on the task in a cloud sandbox and print its answer")}
-  ${chalk63.dim("To run Helix on this machine instead: mutagent install helix installs the standalone binary")}
-
-${chalk63.yellow("Managed agents:")}
-  mutagent agent deploy <agent.md>        ${chalk63.dim("Check, upload and activate an agent.md folder (--env names the Environment whose slot is used)")}
-  mutagent helix agent @<slug> -p "<task>" ${chalk63.dim("Run a managed agent in the cloud")}
-  mutagent agent --help                   ${chalk63.dim("check, pack, run, deploy, activate, list, inspect, retire")}
-
-${chalk63.yellow("Workspace:")}
-  mutagent workspaces use <name>          ${chalk63.dim("Choose the workspace every later command works in")}
-  mutagent workspaces current             ${chalk63.dim("The key's scope, organization and the verified workspace")}
-  mutagent workspaces list                ${chalk63.dim("Your workspaces in the key's organization")}
-  --workspace <name|id>                   ${chalk63.dim("One command in another workspace (then MUTAGENT_WORKSPACE_ID, then the selection)")}
-  mutagent login --org <slug>             ${chalk63.dim("Sign in for another organization")}
-  mutagent providers list                 ${chalk63.dim("LLM providers in the workspace")}
-  mutagent helix models                   ${chalk63.dim("Models Helix can use in the cloud, and the workspace default model")}
-  mutagent env list                       ${chalk63.dim("Environments: variables and secrets for tools")}
-  mutagent usage                          ${chalk63.dim("Count the workspace's LLM providers and your workspaces")}
-
-${chalk63.yellow("Automation:")}
-  MUTAGENT_API_KEY=mg_live_...            ${chalk63.dim("Sign in without a browser (or --api-key <key>)")}
-  --json                                  ${chalk63.dim("Structured output")}
-  --non-interactive                       ${chalk63.dim("No sign-in method or consent prompts (also when CI=true or stdin is not a terminal); a first sign-in in a terminal ends with a menu unless --json")}
-  -v, --version                           ${chalk63.dim("CLI version (only before a subcommand)")}
-
-${chalk63.yellow("Report a problem:")}
+     ${chalk64.dim("Run Helix on the task in a cloud sandbox and print its answer")}
+  ${chalk64.dim("To run Helix on this machine instead: mutagent install helix installs the standalone binary")}
+
+${chalk64.yellow("Managed agents:")}
+  mutagent agent deploy <agent.md>        ${chalk64.dim("Check, upload and activate an agent.md folder (--env names the Environment whose slot is used)")}
+  mutagent helix agent @<slug> -p "<task>" ${chalk64.dim("Run a managed agent in the cloud")}
+  mutagent agent --help                   ${chalk64.dim("check, pack, run, deploy, activate, list, inspect, retire")}
+
+${chalk64.yellow("Workspace:")}
+  mutagent workspaces use <name>          ${chalk64.dim("Choose the workspace every later command works in")}
+  mutagent workspaces current             ${chalk64.dim("The key's scope, organization and the verified workspace")}
+  mutagent workspaces list                ${chalk64.dim("Your workspaces in the key's organization")}
+  --workspace <name|id>                   ${chalk64.dim("One command in another workspace (then MUTAGENT_WORKSPACE_ID, then the selection)")}
+  mutagent login --org <slug>             ${chalk64.dim("Sign in for another organization")}
+  mutagent providers list                 ${chalk64.dim("LLM providers in the workspace")}
+  mutagent helix models                   ${chalk64.dim("Models Helix can use in the cloud, and the workspace default model")}
+  mutagent env list                       ${chalk64.dim("Environments: variables and secrets for tools")}
+  mutagent usage                          ${chalk64.dim("Count the workspace's LLM providers and your workspaces")}
+
+${chalk64.yellow("Automation:")}
+  MUTAGENT_API_KEY=mg_live_...            ${chalk64.dim("Sign in without a browser (or --api-key <key>)")}
+  --json                                  ${chalk64.dim("Structured output")}
+  --non-interactive                       ${chalk64.dim("No sign-in method or consent prompts (also when CI=true or stdin is not a terminal); a first sign-in in a terminal ends with a menu unless --json")}
+  -v, --version                           ${chalk64.dim("CLI version (only before a subcommand)")}
+
+${chalk64.yellow("Report a problem:")}
   mutagent feedback send "<what happened>" --category cli
-  ${chalk63.dim("--category accepts: cli | helix | stage:<spec|build|evaluate|diagnose|optimize>")}
+  ${chalk64.dim("--category accepts: cli | helix | stage:<spec|build|evaluate|diagnose|optimize>")}
 
-${chalk63.yellow("AI Agent Directive:")}
+${chalk64.yellow("AI Agent Directive:")}
   Install the skill first: mutagent skills install (.claude/skills/mutagent-cli/SKILL.md).
   It holds the full workflows. These rules apply to every command:
   1. Sign in: with MUTAGENT_API_KEY set, run mutagent login --json. To help a user sign in,
@@ -37033,7 +37127,7 @@ ${chalk63.yellow("AI Agent Directive:")}
   6. Ask the user through your own question tool. With --json only mutagent login can prompt, in a terminal; pass --browser or set MUTAGENT_API_KEY.
   7. Keep secrets off the command line: --api-key-stdin for an LLM provider key, --secrets-from-file for Environment secrets.
 ${!hasCredentials() ? `
-` + chalk63.yellow("  Not signed in: start with step 1, mutagent login.") + `
+` + chalk64.yellow("  Not signed in: start with step 1, mutagent login.") + `
 ` : ""}`);
   const rawArgs = rescopeProviderApiKeyFlag(argv);
   if (isGlobalVersionFlag(rawArgs)) {
@@ -37109,4 +37203,4 @@ if (process.env.CLI_VERSION) {
 }
 runCli(process.argv.slice(2), cliVersion);
 
-//# debugId=C4F4814AB256A5B164756E2164756E21
+//# debugId=D8F738AA79625F7864756E2164756E21