bravenlab 0.1.0 → 0.1.3

package/dist/bin.js

@@ -76,7 +76,6 @@ var fail = (message, exitCode = EXIT_FAILURE) => Effect.fail(new CliFailure({ me
 var oneLine = (value3) => Str2.trim(Str2.replace(/\s+/g, " ")(String(value3))).slice(0, 300);
 
 // ../identity-store/src/identity.ts
-import { Entry } from "@napi-rs/keyring";
 import { Context as Context2, Effect as Effect2, Layer as Layer2, Option as Option2, pipe } from "effect";
 import * as Arr from "effect/Array";
 import * as R from "effect/Record";
@@ -86,7 +85,6 @@ import * as Predicate from "effect/Predicate";
 import * as Schema2 from "effect/Schema";
 import * as Str3 from "effect/String";
 var CONFIG_VERSION = 1;
-var KEYCHAIN_SERVICE = "braven";
 var CredentialKind = Schema2.Literals(["session", "apiKey"]);
 var Account = class extends Schema2.Class("Account")({
   origin: Schema2.String,
@@ -123,29 +121,56 @@ var ConfigFile = class extends Schema2.Class("ConfigFile")({
 var ConfigJson = Schema2.fromJsonString(ConfigFile, { space: 2 });
 var StoreConfig = class extends Context2.Service()("braven/StoreConfig") {
 };
-var Keychain = class extends Context2.Service()(
-  "braven/Keychain"
+var CREDENTIALS_FILE = "credentials.json";
+var Secrets = class extends Context2.Service()(
+  "braven/Secrets"
 ) {
 };
-var entry = (account) => new Entry(KEYCHAIN_SERVICE, account);
-var keychainAction = (action, run2) => Effect2.try({
-  try: run2,
-  catch: (cause) => new CliFailure({
-    message: `keychain ${action} failed: ${oneLine(cause)}`,
-    exitCode: EXIT_FAILURE
-  })
-});
-var keychainLayer = Layer2.succeed(Keychain)({
-  get: (account) => keychainAction("read", () => entry(account).getPassword()).pipe(
-    Effect2.map(Option2.fromNullishOr)
-  ),
-  set: (account, secret) => keychainAction("write", () => {
-    entry(account).setPassword(secret);
-  }),
-  remove: (account) => keychainAction("delete", () => {
-    entry(account).deletePassword();
+var SecretsJson = Schema2.fromJsonString(
+  Schema2.Record(Schema2.String, Schema2.String),
+  { space: 2 }
+);
+var credentialsPath = (configPath3) => Str3.replace(/config\.json$/, CREDENTIALS_FILE)(configPath3);
+var secretsLayer = Layer2.effect(Secrets)(
+  Effect2.gen(function* () {
+    const { path } = yield* StoreConfig;
+    const fs = yield* FileSystem.FileSystem;
+    const pathService = yield* Path.Path;
+    const file = credentialsPath(path);
+    const read2 = () => Effect2.gen(function* () {
+      if (!(yield* fs.exists(file).pipe(Effect2.mapError(storageFailure("read", file))))) {
+        return {};
+      }
+      const text = yield* fs.readFileString(file).pipe(Effect2.mapError(storageFailure("read", file)));
+      return yield* Schema2.decodeUnknownEffect(SecretsJson)(text).pipe(
+        Effect2.mapError(
+          (cause) => new CliFailure({
+            message: `${file} is not a credentials file: ${oneLine(cause.message)}`,
+            exitCode: EXIT_FAILURE
+          })
+        )
+      );
+    });
+    const write2 = (secrets) => Effect2.gen(function* () {
+      const text = yield* Schema2.encodeUnknownEffect(SecretsJson)(
+        secrets
+      ).pipe(Effect2.mapError(storageFailure("encode", file)));
+      yield* fs.makeDirectory(pathService.dirname(file), { recursive: true }).pipe(Effect2.mapError(storageFailure("create", file)));
+      const temporary = `${file}.tmp`;
+      yield* fs.writeFileString(temporary, text, { mode: 384 }).pipe(Effect2.mapError(storageFailure("write", file)));
+      yield* fs.chmod(temporary, 384).pipe(Effect2.mapError(storageFailure("write", file)));
+      yield* fs.rename(temporary, file).pipe(Effect2.mapError(storageFailure("write", file)));
+    });
+    const update = (change) => Effect2.gen(function* () {
+      yield* write2(change(yield* read2()));
+    });
+    return Secrets.of({
+      get: (account) => read2().pipe(Effect2.map((all4) => Option2.fromNullishOr(all4[account]))),
+      set: (account, secret) => update((all4) => R.set(all4, account, secret)),
+      remove: (account) => update((all4) => R.remove(all4, account))
+    });
   })
-});
+);
 var accountKey = (origin, email) => `${normalizeOrigin(origin)}|${email}`;
 var normalizeOrigin = (origin) => Str3.replace(/\/+$/, "")(origin);
 var storageFailure = (action, path) => (cause) => new CliFailure({
@@ -212,8 +237,8 @@ var storeCredential = (credential2, label = Option2.none()) => Effect2.gen(funct
   }
   const origin = normalizeOrigin(credential2.origin);
   const key2 = accountKey(origin, credential2.email);
-  const keychain = yield* Keychain;
-  yield* keychain.set(key2, credential2.secret);
+  const secrets = yield* Secrets;
+  yield* secrets.set(key2, credential2.secret);
   const config = yield* loadConfig();
   const account = new Account({
     origin,
@@ -260,8 +285,8 @@ var removeCredential = (email) => Effect2.gen(function* () {
   if (Option2.isNone(account)) return Option2.none();
   const target = account.value;
   const key2 = accountKey(target.origin, target.email);
-  const keychain = yield* Keychain;
-  yield* keychain.remove(key2);
+  const secrets = yield* Secrets;
+  yield* secrets.remove(key2);
   const accounts = config.accounts.filter(
     (stored) => accountKey(stored.origin, stored.email) !== key2
   );
@@ -308,8 +333,8 @@ var storedCredential = (options) => Effect2.gen(function* () {
   const account = Option2.isSome(options.origin) || Option2.isSome(options.email) ? findAccount(config, options.origin, options.email) : currentAccount(config);
   if (Option2.isNone(account)) return Option2.none();
   const stored = account.value;
-  const keychain = yield* Keychain;
-  const secret = yield* keychain.get(accountKey(stored.origin, stored.email));
+  const secrets = yield* Secrets;
+  const secret = yield* secrets.get(accountKey(stored.origin, stored.email));
   if (Option2.isNone(secret)) return Option2.none();
   return Option2.some({
     origin: stored.origin,
@@ -796,18 +821,18 @@ var candidateDirs = (dir) => {
   ];
 };
 var resolveFolderSettings = (settings, folder, path) => {
-  const entry2 = settings[folder];
-  if (entry2 === void 0) {
+  const entry = settings[folder];
+  if (entry === void 0) {
     return { projectId: Option3.none(), experimentId: Option3.none() };
   }
   const relativePath = relative(folder, path).split(sep).join("/");
   const dir = dirname(relativePath);
   const match18 = candidateDirs(dir).find(
-    (candidate) => entry2.experiments[candidate] !== void 0
+    (candidate) => entry.experiments[candidate] !== void 0
   );
   return {
-    projectId: entry2.projectId,
-    experimentId: match18 === void 0 ? Option3.none() : Option3.some(entry2.experiments[match18] ?? "")
+    projectId: entry.projectId,
+    experimentId: match18 === void 0 ? Option3.none() : Option3.some(entry.experiments[match18] ?? "")
   };
 };
 
@@ -1468,11 +1493,12 @@ import * as Path5 from "effect/Path";
 // ../../apps/agent/src/sqlite.ts
 var openDatabase = async (path) => {
   if (process.versions.bun !== void 0) {
-    const bunSqlite = "bun:sqlite";
+    const bunSqlite = ["bun", "sqlite"].join(":");
     const loaded = await import(bunSqlite);
     return new loaded.Database(path);
   }
-  const { DatabaseSync } = await import("node:sqlite");
+  const nodeSqlite = ["node", "sqlite"].join(":");
+  const { DatabaseSync } = await import(nodeSqlite);
   return new DatabaseSync(path);
 };
 
@@ -1634,7 +1660,7 @@ var watcherKey = (origin) => `watcher_id:${origin}`;
 var INSTANCE_ID_KEY = "instance_id";
 var failed = (action) => (cause) => new AgentFailure({ message: `${action}: ${oneLine2(cause)}` });
 var make3 = (db, crypto2) => {
-  const attemptSql = (action, run2) => Effect11.try({ try: run2, catch: failed(action) });
+  const attemptSql = (action, run3) => Effect11.try({ try: run3, catch: failed(action) });
   const query = (action, decoder, sql, ...params) => attemptSql(action, () => db.prepare(sql).all(...params)).pipe(
     Effect11.flatMap(
       (rows) => decoder(rows).pipe(
@@ -1959,7 +1985,7 @@ var walk = (root, extra = []) => Stream3.unwrap(
     const paths = yield* Path7.Path;
     const entries = yield* fs.readDirectory(root).pipe(Effect12.orElseSucceed(() => []));
     return Stream3.fromIterable(entries).pipe(
-      Stream3.map((entry2) => paths.join(root, entry2)),
+      Stream3.map((entry) => paths.join(root, entry)),
       Stream3.filter((path) => !isIgnored(path, extra)),
       Stream3.flatMap(
         (path) => fs.stat(path).pipe(
@@ -2173,7 +2199,7 @@ var make6 = (config) => Effect14.gen(function* () {
       { concurrency: config.concurrency }
     );
     const missing = Arr5.map(
-      Arr5.filter(checked, (entry2) => entry2.state === "missing"),
+      Arr5.filter(checked, (entry) => entry.state === "missing"),
       ({ item }) => item
     );
     yield* Effect14.forEach(
@@ -2184,21 +2210,21 @@ var make6 = (config) => Effect14.gen(function* () {
     const superseded = Arr5.getSomes(
       Arr5.map(
         checked,
-        (entry2) => entry2.state === "superseded" ? Option9.some(entry2) : Option9.none()
+        (entry) => entry.state === "superseded" ? Option9.some(entry) : Option9.none()
       )
     );
     yield* Effect14.forEach(
       superseded,
-      (entry2) => Effect14.gen(function* () {
+      (entry) => Effect14.gen(function* () {
         yield* queue.fail(
-          entry2.item.id,
+          entry.item.id,
           "superseded by the file's current contents"
         );
         yield* queue.enqueue({
-          folder: entry2.item.folder,
-          path: entry2.item.path,
-          hash: entry2.hashed.hash,
-          size: entry2.hashed.size
+          folder: entry.item.folder,
+          path: entry.item.path,
+          hash: entry.hashed.hash,
+          size: entry.hashed.size
         });
       }),
       { concurrency: 1 }
@@ -2602,7 +2628,6 @@ var layer4 = (config) => Layer7.effect(Engine, make6(config));
 import { Effect as Effect15, Match as Match5, Option as Option10, Redacted as Redacted4 } from "effect";
 import "effect/FileSystem";
 import * as Str8 from "effect/String";
-var KEYCHAIN_SERVICE2 = "braven";
 var environmentValue2 = (environment, name) => Option10.fromNullishOr(environment.values[name]).pipe(
   Option10.filter(Str8.isNonEmpty)
 );
@@ -2691,18 +2716,18 @@ var resolveCredential2 = (options) => Effect15.gen(function* () {
     );
   }
   const stored = account.value;
-  const keychain = yield* Keychain;
-  const secret = yield* keychain.get(accountKey(stored.origin, stored.email)).pipe(
+  const secrets = yield* Secrets;
+  const secret = yield* secrets.get(accountKey(stored.origin, stored.email)).pipe(
     Effect15.mapError(
       (cause) => new AgentFailure({
-        message: `cannot read the ${KEYCHAIN_SERVICE2} keychain: ${oneLine2(cause)}`
+        message: `cannot read the credentials file: ${oneLine2(cause)}`
       })
     )
   );
   if (Option10.isNone(secret)) {
     return yield* Effect15.fail(
       new AgentFailure({
-        message: `the keychain has no secret for ${stored.email} on ${origin} \u2014 run \`braven login --origin ${origin}\``
+        message: `the secrets has no secret for ${stored.email} on ${origin} \u2014 run \`braven login --origin ${origin}\``
       })
     );
   }
@@ -4365,7 +4390,7 @@ var make9 = (options, queue, client, gate, heartbeating, folders) => {
       Effect19.forever
     );
   };
-  const resolve2 = Effect19.gen(function* () {
+  const resolve3 = Effect19.gen(function* () {
     if (Option13.isSome(options.instanceId)) {
       const provided = options.instanceId.value;
       yield* Effect19.logInfo("using the provided watcher instance id").pipe(
@@ -4425,7 +4450,7 @@ var make9 = (options, queue, client, gate, heartbeating, folders) => {
     return Option13.some(watcherId);
   });
   const start2 = Effect19.gen(function* () {
-    const resolved = yield* resolve2;
+    const resolved = yield* resolve3;
     if (Option13.isNone(resolved)) return Option13.none();
     const watcherId = resolved.value;
     yield* syncFolders(watcherId).pipe(
@@ -4789,11 +4814,11 @@ import { createServer as createServer2 } from "node:http";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { basename, relative as relative2 } from "node:path";
 var folderSettingsJson = (settings) => Object.fromEntries(
-  Object.entries(settings).map(([path, entry2]) => [
+  Object.entries(settings).map(([path, entry]) => [
     path,
     {
-      ...Option16.isSome(entry2.projectId) ? { projectId: entry2.projectId.value } : {},
-      experiments: entry2.experiments
+      ...Option16.isSome(entry.projectId) ? { projectId: entry.projectId.value } : {},
+      experiments: entry.experiments
     }
   ])
 );
@@ -5477,7 +5502,7 @@ var make13 = Effect25.gen(function* () {
 });
 
 // ../../apps/agent/src/version.ts
-var VERSION = "0.1.0";
+var VERSION = "0.1.3";
 
 // ../../apps/agent/src/run.ts
 var USAGE = `braven agent --folder <path> [--folder <path>] --project-id <id> [options]
@@ -5523,10 +5548,13 @@ var runAgent = (argv2) => Effect26.scoped(
       yield* Effect26.logInfo(USAGE);
       return;
     }
-    const provided = Layer13.mergeAll(
+    const store2 = Layer13.mergeAll(
       NodeServices.layer,
-      Layer13.succeed(StoreConfig)({ path: configPath2(storeEnvironment) }),
-      keychainLayer
+      Layer13.succeed(StoreConfig)({ path: configPath2(storeEnvironment) })
+    );
+    const provided = Layer13.mergeAll(
+      store2,
+      secretsLayer.pipe(Layer13.provide(store2))
     );
     const settingsPath = settingsFile(bravenDirectory(storeEnvironment));
     const stored = Option18.getOrNull(
@@ -5569,11 +5597,11 @@ var runAgent = (argv2) => Effect26.scoped(
     const config = new AgentConfig({
       folders: watched,
       folderSettings: stored === null ? {} : Object.fromEntries(
-        Object.entries(stored.folderSettings).map(([path, entry2]) => [
+        Object.entries(stored.folderSettings).map(([path, entry]) => [
           path,
           {
-            projectId: entry2.projectId,
-            experiments: entry2.experiments
+            projectId: entry.projectId,
+            experiments: entry.experiments
           }
         ])
       ),
@@ -5750,11 +5778,11 @@ var runAgent = (argv2) => Effect26.scoped(
                 // The settings file stores the encoded form: a bare string
                 // for a project, and no key for "none".
                 folderSettings: Object.fromEntries(
-                  Object.entries(overrides).map(([path, entry2]) => [
+                  Object.entries(overrides).map(([path, entry]) => [
                     path,
                     new FolderSettings({
-                      projectId: entry2.projectId,
-                      experiments: entry2.experiments
+                      projectId: entry.projectId,
+                      experiments: entry.experiments
                     })
                   ])
                 ),
@@ -5821,9 +5849,9 @@ var runAgent = (argv2) => Effect26.scoped(
 );
 
 // src/bin.ts
-import { Effect as Effect59, Layer as Layer21 } from "effect";
+import { Effect as Effect60, Layer as Layer21 } from "effect";
 import { FetchHttpClient as FetchHttpClient3 } from "effect/http";
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 
 // src/auth.ts
 import {
@@ -6270,7 +6298,7 @@ and confirm the code ${code.user_code} in the browser.`
 
 // src/cli.ts
 import { Argument as Argument4, Command as Command4, Flag as Flag4 } from "effect/cli";
-import { Console as Console8, Effect as Effect58, Match as Match15, Option as Option50 } from "effect";
+import { Console as Console9, Effect as Effect59, Match as Match15, Option as Option50 } from "effect";
 
 // ../agent-tools/src/catalog.ts
 import { Tool as Tool2 } from "effect/ai";
@@ -6876,7 +6904,7 @@ var catalog = [...tools, ...webTools].map(
   toEntry
 );
 var remoteTools = catalog.filter(
-  (entry2) => entry2.surfaces.includes("mcp") && !entry2.local
+  (entry) => entry.surfaces.includes("mcp") && !entry.local
 );
 
 // ../agent-tools/src/server.ts
@@ -7070,7 +7098,7 @@ var layer9 = Layer16.effect(Scopes)(
     return Scopes.of({ scopes });
   })
 );
-var permit = (access, tool, run2) => Arr10.some(scopesOf(tool), (scope) => Arr10.contains(access.scopes, scope)) ? run2 : Effect31.fail(
+var permit = (access, tool, run3) => Arr10.some(scopesOf(tool), (scope) => Arr10.contains(access.scopes, scope)) ? run3 : Effect31.fail(
   new AgentToolError({
     message: `${tool.name} needs the ${scopesOf(tool).join("/")} scope; this server allows ${access.scopes.join(", ")}. Nothing was changed. Set BRAVEN_MCP_SCOPES to include it, or run it from the CLI or dashboard.`,
     code: "forbidden"
@@ -7438,7 +7466,7 @@ var canonicalValue = (value3) => {
         Object.entries(value3),
         Order2.mapInput(
           Order2.String,
-          (entry2) => entry2[0]
+          (entry) => entry[0]
         )
       ),
       ([key2, field2]) => {
@@ -8334,7 +8362,7 @@ var stableText = (value3) => Match9.value(value3).pipe(
         Object.entries(record2),
         Order3.mapInput(
           Order3.String,
-          (entry2) => entry2[0]
+          (entry) => entry[0]
         )
       ),
       ([key2, field2]) => `${key2.length}:${key2}=${stableText(field2)}`
@@ -9070,7 +9098,7 @@ var mergeRuntime = (state, base, local, remote) => {
     scalarKey,
     scalarJson
   );
-  const entry2 = field(
+  const entry = field(
     state,
     "/runtime/entry",
     base.entry,
@@ -9097,7 +9125,7 @@ var mergeRuntime = (state, base, local, remote) => {
     (value3) => stableText(Schema35.encodeSync(Schema35.Array(Schema35.String))(value3)),
     (value3) => asJson(Schema35.encodeSync(Schema35.Array(Schema35.String))(value3))
   );
-  return Option26.all({ python, entry: entry2, requirements, imports }).pipe(
+  return Option26.all({ python, entry, requirements, imports }).pipe(
     Option26.map(
       (fields) => new IrRuntime({
         python: fields.python,
@@ -11179,7 +11207,7 @@ var make15 = (options) => {
   const valuesOf = (entries, category) => R6.fromEntries(
     Arr21.flatMap(
       entries,
-      (entry2) => entry2.category === category && entry2.value !== null ? [[entry2.key, entry2.value]] : []
+      (entry) => entry.category === category && entry.value !== null ? [[entry.key, entry.value]] : []
     )
   );
   return {
@@ -12609,16 +12637,16 @@ var login = Effect53.fn("login")(function* (options) {
   yield* printSignedIn(account);
 });
 var watcherAccountFor = (accounts, origin) => Option46.fromNullishOr(accounts.find((account) => account.origin === origin));
-var watcherAccount = (store, origin) => Option46.isSome(origin) ? watcherAccountFor(store.accounts, origin.value) : Option46.orElse(
+var watcherAccount = (store2, origin) => Option46.isSome(origin) ? watcherAccountFor(store2.accounts, origin.value) : Option46.orElse(
   Option46.flatMap(
-    store.current,
+    store2.current,
     (current) => Option46.fromNullishOr(
-      store.accounts.find(
+      store2.accounts.find(
         (account) => accountKey(account.origin, account.email) === current
       )
     )
   ),
-  () => Option46.fromNullishOr(store.accounts[0])
+  () => Option46.fromNullishOr(store2.accounts[0])
 );
 var loginCommand = (options) => Effect53.gen(function* () {
   const environment = yield* Environment;
@@ -13736,20 +13764,40 @@ import * as P6 from "effect/Predicate";
 import * as R7 from "effect/Record";
 import * as Schema49 from "effect/Schema";
 import * as Str19 from "effect/String";
-var CLIENTS = ["claude", "cursor", "zed", "vscode"];
+var CLIENTS = [
+  "claude",
+  "cursor",
+  "opencode",
+  "zed",
+  "vscode"
+];
 var serversKey = {
   claude: "mcpServers",
   cursor: "mcpServers",
+  opencode: "mcp",
   zed: "context_servers",
   vscode: "servers"
 };
 var displayName = {
   claude: "Claude Desktop",
   cursor: "Cursor",
+  opencode: "opencode",
   zed: "Zed",
   vscode: "VS Code"
 };
-var serverEntry = (client) => client === "vscode" ? { type: "stdio", command: "braven", args: ["mcp"] } : { command: "braven", args: ["mcp"] };
+var serverEntry = (client) => Match14.value(client).pipe(
+  Match14.when("vscode", () => ({
+    type: "stdio",
+    command: "braven",
+    args: ["mcp"]
+  })),
+  Match14.when("opencode", () => ({
+    type: "local",
+    command: ["braven", "mcp"],
+    enabled: true
+  })),
+  Match14.orElse(() => ({ command: "braven", args: ["mcp"] }))
+);
 var isRecord = (value3) => P6.isObject(value3);
 var asRecord = (value3) => Option49.liftPredicate(isRecord)(value3);
 var value2 = (shape2, name) => Option49.filter(Option49.fromNullishOr(shape2.values[name]), Str19.isNonEmpty);
@@ -13773,6 +13821,10 @@ var applications = (shape2) => Match14.value(shape2.platform).pipe(
     )
   )
 );
+var configHome = (shape2) => Option49.getOrElse(
+  value2(shape2, "XDG_CONFIG_HOME"),
+  () => join11(shape2, shape2.home, ".config")
+);
 var configPathFor = (client, shape2) => Match14.value(client).pipe(
   Match14.when(
     "claude",
@@ -13791,14 +13843,21 @@ var configPathFor = (client, shape2) => Match14.value(client).pipe(
       )
     )
   ),
+  Match14.when(
+    "opencode",
+    () => Option49.getOrElse(
+      value2(shape2, "OPENCODE_CONFIG"),
+      () => join11(shape2, configHome(shape2), "opencode", "opencode.json")
+    )
+  ),
   Match14.when("vscode", () => join11(shape2, shape2.cwd, ".vscode", "mcp.json")),
   Match14.exhaustive
 );
 var decodeJson2 = Schema49.decodeUnknownOption(
   Schema49.fromJsonString(Schema49.Unknown)
 );
-var withoutEmptyEnv = (entry2) => Option49.match(asRecord(entry2), {
-  onNone: () => entry2,
+var withoutEmptyEnv = (entry) => Option49.match(asRecord(entry), {
+  onNone: () => entry,
   onSome: (record2) => Option49.match(Option49.flatMap(R7.get(record2, "env"), asRecord), {
     onNone: () => record2,
     onSome: (env) => Match14.value(R7.isEmptyRecord(env)).pipe(
@@ -13814,16 +13873,16 @@ var withServer = (config, key2, servers, client) => ({
 var invalid = (reason) => ({ kind: "invalid", reason });
 var mergeEntry = (client, config, key2, servers, force) => Option49.match(R7.get(servers, "braven"), {
   onNone: () => withServer(config, key2, servers, client),
-  onSome: (entry2) => Bool2.match(
+  onSome: (entry) => Bool2.match(
     Equal.equals(
-      withoutEmptyEnv(entry2),
+      withoutEmptyEnv(entry),
       withoutEmptyEnv(serverEntry(client))
     ),
     {
       onTrue: () => ({ kind: "unchanged" }),
       onFalse: () => Bool2.match(force, {
         onTrue: () => withServer(config, key2, servers, client),
-        onFalse: () => ({ kind: "conflict", current: entry2 })
+        onFalse: () => ({ kind: "conflict", current: entry })
       })
     }
   )
@@ -13918,10 +13977,10 @@ var install = Effect57.fn("mcp.install")(function* (options) {
       { kind: "conflict" },
       ({ current }) => Effect57.flatMap(
         inline(current),
-        (entry2) => Console7.log(
+        (entry) => Console7.log(
           `braven is already configured differently:
   file     ${options.path}
-  current  ${entry2}`
+  current  ${entry}`
         ).pipe(
           Effect57.andThen(
             fail(
@@ -13986,8 +14045,81 @@ var installCommand = Effect57.fn("mcp.installCommand")(
   }
 );
 
+// src/desktop.ts
+import { Console as Console8, Effect as Effect58 } from "effect";
+import { execFile } from "node:child_process";
+import { cpSync, existsSync, mkdtempSync, rmSync } from "node:fs";
+import { homedir as homedir2, tmpdir } from "node:os";
+import { join as join12, resolve as resolve2 } from "node:path";
+var destinationOf = (input) => input.destination ?? (input.system === true ? "/Applications/Braven.app" : join12(homedir2(), "Applications", "Braven.app"));
+var run2 = (bin, args) => Effect58.tryPromise({
+  try: () => new Promise((resolvePromise, reject) => {
+    execFile(
+      bin,
+      [...args],
+      (error, stdout) => error === null ? resolvePromise(stdout) : reject(error)
+    );
+  }),
+  catch: (cause) => new Error(`${bin} failed: ${String(cause)}`)
+});
+var copyApp = (source, destination) => Effect58.sync(() => {
+  if (!existsSync(join12(source, "Contents", "Info.plist")))
+    throw new Error(`${source} is not a Braven.app`);
+  rmSync(destination, { recursive: true, force: true });
+  cpSync(source, destination, { recursive: true });
+});
+var installDesktop = Effect58.fn("desktop.install")(function* (input) {
+  if (process.platform === "win32") {
+    if (input.exe === void 0)
+      return yield* Effect58.fail(
+        new Error("pass --exe <Braven-Setup.exe> on Windows")
+      );
+    yield* run2(
+      resolve2(input.exe),
+      input.silent === true ? ["/SILENT", "/SUPPRESSMSGBOXES", "/NORESTART"] : []
+    );
+    yield* Console8.log(
+      input.silent === true ? "installer finished" : "the installer will finish in its own window"
+    );
+    return;
+  }
+  if (process.platform !== "darwin")
+    return yield* Effect58.fail(
+      new Error("the watcher window is available on macOS and Windows")
+    );
+  if (input.dmg === void 0 && input.app === void 0)
+    return yield* Effect58.fail(
+      new Error("pass --dmg <file.dmg> or --app <Braven.app>")
+    );
+  const destination = destinationOf(input);
+  if (input.app !== void 0) {
+    yield* copyApp(resolve2(input.app), destination);
+  } else {
+    const mount = mkdtempSync(join12(tmpdir(), "braven-dmg-"));
+    yield* Effect58.ensuring(
+      Effect58.gen(function* () {
+        yield* run2("hdiutil", [
+          "attach",
+          "-nobrowse",
+          "-readonly",
+          "-mountpoint",
+          mount,
+          resolve2(input.dmg)
+        ]);
+        yield* copyApp(join12(mount, "Braven.app"), destination);
+      }),
+      Effect58.sync(() => {
+        void run2("hdiutil", ["detach", mount]);
+        rmSync(mount, { recursive: true, force: true });
+      })
+    );
+  }
+  yield* Console8.log(`installed ${destination}`);
+  yield* run2("open", [destination]);
+});
+
 // src/cli.ts
-var VERSION2 = "0.0.0";
+var VERSION2 = true ? "0.1.3" : "0.0.0";
 var originFlag = Flag4.String("origin").pipe(
   Flag4.optional,
   Flag4.withDescription(
@@ -14038,7 +14170,7 @@ var login2 = Command4.make(
     ),
     email: emailFlag
   },
-  Effect58.fn(function* ({
+  Effect59.fn(function* ({
     origin,
     webOrigin,
     device,
@@ -14082,7 +14214,7 @@ var keyAddCommand = Command4.make(
     ),
     origin: originFlag
   },
-  Effect58.fn(function* ({ key: key2, email, label, origin }) {
+  Effect59.fn(function* ({ key: key2, email, label, origin }) {
     const environment = yield* Environment;
     yield* keyAdd({
       origin: resolveOrigin(origin, environment),
@@ -14125,7 +14257,7 @@ var pushCommand2 = Command4.make(
       )
     )
   },
-  Effect58.fn(function* ({ file, override, path, projectId }) {
+  Effect59.fn(function* ({ file, override, path, projectId }) {
     yield* push2({ file, override, path, projectId });
   })
 ).pipe(
@@ -14144,14 +14276,14 @@ var configSetCommand = Command4.make(
     name: Argument4.Literals("name", ["company", "project"]),
     value: Argument4.String("value")
   },
-  Effect58.fn(function* ({ name, value: value3 }) {
+  Effect59.fn(function* ({ name, value: value3 }) {
     yield* configSet({ name, value: value3 });
   })
 ).pipe(Command4.withDescription("set a default"));
 var configUseCommand = Command4.make(
   "use",
   { email: Argument4.String("email") },
-  Effect58.fn(function* ({ email }) {
+  Effect59.fn(function* ({ email }) {
     yield* configUse(email);
   })
 ).pipe(Command4.withDescription("switch the current account"));
@@ -14168,7 +14300,7 @@ var configCommand = Command4.make("config", {}, () => configShow()).pipe(
 var logoutCommand = Command4.make(
   "logout",
   { email: emailFlag },
-  Effect58.fn(function* ({ email }) {
+  Effect59.fn(function* ({ email }) {
     yield* logout(email);
   })
 ).pipe(
@@ -14193,14 +14325,57 @@ var mcpInstallCommand = Command4.make(
       Flag4.withDescription("write this file instead of the client's default")
     )
   },
-  Effect58.fn(function* ({ client, force, path }) {
+  Effect59.fn(function* ({ client, force, path }) {
     yield* installCommand({ client, force, path });
   })
 ).pipe(
   Command4.withDescription(
-    "merge the Braven server into a client's MCP config (Claude, Cursor, Zed, VS Code)"
+    "merge the Braven server into a client's MCP config (Claude, Cursor, opencode, Zed, VS Code)"
   )
 );
+var desktopInstallCommand = Command4.make(
+  "install",
+  {
+    dmg: Flag4.String("dmg").pipe(
+      Flag4.optional,
+      Flag4.withDescription("a Braven DMG to install")
+    ),
+    app: Flag4.String("app").pipe(
+      Flag4.optional,
+      Flag4.withDescription("an already-built Braven.app")
+    ),
+    exe: Flag4.String("exe").pipe(
+      Flag4.optional,
+      Flag4.withDescription("a Windows Braven installer (.exe)")
+    ),
+    silent: Flag4.Boolean("silent").pipe(
+      Flag4.withDefault(false),
+      Flag4.withDescription("Windows: run the installer without its wizard")
+    ),
+    system: Flag4.Boolean("system").pipe(
+      Flag4.withDefault(false),
+      Flag4.withDescription("install into /Applications")
+    ),
+    destination: Flag4.String("destination").pipe(
+      Flag4.optional,
+      Flag4.withDescription("install here instead of ~/Applications")
+    )
+  },
+  Effect59.fn(function* ({ dmg, app, exe, silent, system, destination }) {
+    yield* installDesktop({
+      dmg: Option50.getOrUndefined(dmg),
+      app: Option50.getOrUndefined(app),
+      exe: Option50.getOrUndefined(exe),
+      silent,
+      system,
+      destination: Option50.getOrUndefined(destination)
+    });
+  })
+).pipe(Command4.withDescription("copy the watcher window into Applications"));
+var desktopCommand = Command4.make("desktop", {}).pipe(
+  Command4.withDescription("the watcher window (macOS)"),
+  Command4.withSubcommands([desktopInstallCommand])
+);
 var mcpCommand = Command4.make("mcp", {}, () => runMcp(VERSION2)).pipe(
   Command4.withDescription(
     "run the Braven MCP server over stdio (connect Claude, Cursor, or Zed here)"
@@ -14218,6 +14393,7 @@ var braven = Command4.make("braven").pipe(
     pushCommand2,
     agentCommand,
     mcpCommand,
+    desktopCommand,
     whoamiCommand,
     configCommand,
     logoutCommand
@@ -14263,15 +14439,15 @@ var describe = (error) => Match15.value(error).pipe(
   })),
   Match15.orElse((other) => ({ code: EXIT_USAGE, message: other.message }))
 );
-var main = Effect58.fn("braven")(function* (args) {
+var main = Effect59.fn("braven")(function* (args) {
   return yield* runCli(args).pipe(
-    Effect58.as(0),
-    Effect58.catch((error) => {
+    Effect59.as(0),
+    Effect59.catch((error) => {
       const described = describe(error);
-      if (described.code === 0) return Effect58.succeed(0);
-      if (described.message.length === 0) return Effect58.succeed(described.code);
-      return Console8.error(`braven: ${oneLine(described.message)}`).pipe(
-        Effect58.as(described.code)
+      if (described.code === 0) return Effect59.succeed(0);
+      if (described.message.length === 0) return Effect59.succeed(described.code);
+      return Console9.error(`braven: ${oneLine(described.message)}`).pipe(
+        Effect59.as(described.code)
       );
     })
   );
@@ -14280,16 +14456,19 @@ var main = Effect58.fn("braven")(function* (args) {
 // src/bin.ts
 var shape = {
   platform: process.platform,
-  home: homedir2(),
+  home: homedir3(),
   cwd: process.cwd(),
   values: process.env
 };
-var AppLayer = Layer21.mergeAll(
+var store = Layer21.mergeAll(
   NodeServices2.layer,
-  FetchHttpClient3.layer,
   environmentLayer(shape),
-  Layer21.succeed(StoreConfig)({ path: configPath(shape) }),
-  keychainLayer,
+  Layer21.succeed(StoreConfig)({ path: configPath(shape) })
+);
+var AppLayer = Layer21.mergeAll(
+  store,
+  FetchHttpClient3.layer,
+  secretsLayer.pipe(Layer21.provide(store)),
   browserLayer,
   sessionsLayer.pipe(Layer21.provide(FetchHttpClient3.layer)),
   layer8.pipe(Layer21.provide(NodeServices2.layer))
@@ -14300,13 +14479,13 @@ if (argv[0] === "agent") {
 } else {
   NodeRuntime.runMain(
     main(argv).pipe(
-      Effect59.tap(
-        (code) => Effect59.sync(() => {
+      Effect60.tap(
+        (code) => Effect60.sync(() => {
           process.exitCode = code;
         })
       ),
-      Effect59.asVoid,
-      Effect59.provide(AppLayer)
+      Effect60.asVoid,
+      Effect60.provide(AppLayer)
     )
   );
 }