broods 0.1.0

package/dist/cli/index.js

@@ -0,0 +1,3204 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/cli/index.ts
+import { mkdir as mkdir3, readFile as readFile3, readdir as readdir2, writeFile as writeFile3 } from "fs/promises";
+import { createHash as createHash2 } from "crypto";
+import { basename as basename2, dirname as dirname2, join as join4, relative as relative2, resolve as resolve4 } from "path";
+import { watch } from "fs";
+import { spawn as spawn2 } from "child_process";
+import { tmpdir } from "os";
+import { performance } from "perf_hooks";
+
+// src/manifest.ts
+import { pathToFileURL } from "url";
+import { createHash } from "crypto";
+import { readdir, readFile as readFile2 } from "fs/promises";
+import { basename, isAbsolute, join as join3, relative, resolve as resolve2 } from "path";
+
+// src/config.ts
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var PROJECT_DIR = "broods";
+var GENERATED_DIR = "_generated";
+var USER_CONFIG_PATH = join(homedir(), ".broods", "config.json");
+async function readStoredAuth() {
+  const envToken = process.env.BROODS_TOKEN;
+  const envUrl = process.env.BROODS_DASHBOARD_URL;
+  if (envToken && envUrl) {
+    return {
+      dashboardUrl: envUrl,
+      token: envToken,
+      createdAt: new Date().toISOString()
+    };
+  }
+  try {
+    return JSON.parse(await readFile(USER_CONFIG_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function writeStoredAuth(config) {
+  await mkdir(dirname(USER_CONFIG_PATH), { recursive: true });
+  await writeFile(USER_CONFIG_PATH, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+}
+function stripTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+
+// src/runtime-config.ts
+import { existsSync, readFileSync } from "fs";
+import { join as join2, resolve } from "path";
+var loadedEnvForCwd = null;
+function loadBroodsRuntimeConfig(cwd = process.cwd()) {
+  loadEnvFiles(cwd);
+  const stored = readStoredAuthSync();
+  return {
+    dashboardUrl: process.env.BROODS_DASHBOARD_URL ?? stored?.dashboardUrl,
+    token: process.env.BROODS_TOKEN ?? stored?.token,
+    project: process.env.BROODS_PROJECT,
+    environment: process.env.BROODS_ENVIRONMENT
+  };
+}
+function loadEnvFiles(cwd) {
+  const root = resolve(cwd);
+  if (loadedEnvForCwd === root)
+    return;
+  loadedEnvForCwd = root;
+  const originallySet = new Set(Object.keys(process.env));
+  for (const file of [".env", ".env.local"]) {
+    const path = join2(root, file);
+    if (!existsSync(path))
+      continue;
+    for (const [key, value] of Object.entries(parseEnv(readFileSync(path, "utf8")))) {
+      if (!originallySet.has(key))
+        process.env[key] = value;
+    }
+  }
+}
+function parseEnv(source) {
+  const values = {};
+  for (const rawLine of source.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const assignment = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const eq = assignment.indexOf("=");
+    if (eq <= 0)
+      continue;
+    const key = assignment.slice(0, eq).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    values[key] = unquoteEnvValue(assignment.slice(eq + 1).trim());
+  }
+  return values;
+}
+function unquoteEnvValue(value) {
+  if (value.startsWith('"') && value.endsWith('"')) {
+    return value.slice(1, -1).replace(/\\n/g, `
+`).replace(/\\"/g, '"');
+  }
+  if (value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  const commentIndex = value.indexOf(" #");
+  return commentIndex >= 0 ? value.slice(0, commentIndex).trimEnd() : value;
+}
+function readStoredAuthSync() {
+  try {
+    const value = JSON.parse(readFileSync(USER_CONFIG_PATH, "utf8"));
+    if (typeof value.dashboardUrl !== "string" || typeof value.token !== "string")
+      return null;
+    return {
+      dashboardUrl: stripTrailingSlash(value.dashboardUrl),
+      token: value.token
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/resources.ts
+var RESOURCE_MARKER = Symbol.for("broods.resource");
+var CONFIG_MARKER = Symbol.for("broods.config");
+var CHANNEL_MARKER = Symbol.for("broods.channel");
+var env = new Proxy(function env2(name) {
+  return { __beeblastEnv: true, name };
+}, {
+  get(target, property, receiver) {
+    if (typeof property === "string")
+      return { __beeblastEnv: true, name: property };
+    return Reflect.get(target, property, receiver);
+  }
+});
+function defineResource(kind, input) {
+  if (input.config === undefined) {
+    throw new Error(`Resource "${input.name}" must include config`);
+  }
+  return {
+    [RESOURCE_MARKER]: true,
+    kind,
+    name: input.name,
+    ...input.description ? { description: input.description } : {},
+    config: input.config
+  };
+}
+function defineChannel(type, config) {
+  return {
+    [CHANNEL_MARKER]: true,
+    kind: "channel",
+    type,
+    config
+  };
+}
+function defineTelegramChannel(config) {
+  return defineChannel("telegram", config);
+}
+function defineGitHubChannel(config) {
+  return defineChannel("github", config);
+}
+function defineSlackChannel(config) {
+  return defineChannel("slack", config);
+}
+function defineDiscordChannel(config) {
+  return defineChannel("discord", config);
+}
+function definePancakeChannel(config) {
+  const { ignoreTagIds, ...channelConfig } = config;
+  return defineChannel("pancake", {
+    ...channelConfig,
+    ...ignoreTagIds === undefined ? {} : { options: { ignoreTagIds } }
+  });
+}
+function defineZaloChannel(config) {
+  return defineChannel("zalo", config);
+}
+function defineBroods(config) {
+  return { [CONFIG_MARKER]: true, config };
+}
+function defineAgent(input) {
+  return defineResource("agent", input);
+}
+function defineWorkspace(input) {
+  return defineResource("workspace", input);
+}
+function defineSandbox(input) {
+  return defineResource("sandbox", input);
+}
+function defineSkill(input) {
+  return defineResource("skill", input);
+}
+function defineTool(input) {
+  return defineResource("tool", input);
+}
+function defineCron(input) {
+  return defineResource("cron", input);
+}
+function isResource(value) {
+  return Boolean(value && typeof value === "object" && value[RESOURCE_MARKER]);
+}
+function isChannelDefinition(value) {
+  return Boolean(value && typeof value === "object" && value[CHANNEL_MARKER]);
+}
+function isBroodsConfig(value) {
+  return Boolean(value && typeof value === "object" && value[CONFIG_MARKER]);
+}
+
+// src/manifest.ts
+var MAX_BUNDLE_FILE_BYTES = 1e6;
+var MAX_BUNDLE_TOTAL_BYTES = 5000000;
+var MAX_BUNDLE_FILES = 200;
+var SKIPPED_BUNDLE_DIRECTORIES = new Set(["node_modules", ".git"]);
+var UNSAFE_BUNDLE_FILE_NAMES = [
+  /^\.env(?:\.|$)/i,
+  /^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/i,
+  /\.(?:pem|key|p12|pfx)$/i
+];
+async function compileProject(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  loadBroodsRuntimeConfig(cwd);
+  const root = resolve2(cwd, PROJECT_DIR);
+  const files = await listTypeScriptFiles(root);
+  const exports = await loadExports(files);
+  const config = await findConfig(exports, cwd, options.project);
+  const resourceExports = exports.filter((entry) => isResource(entry.value)).map((entry) => ({ exportName: entry.exportName, resource: entry.value }));
+  const resources = resourceExports.map((entry) => entry.resource);
+  assertUniqueResources(resources);
+  const channels = compileChannels(resourceExports, exports);
+  for (const resource of resources)
+    assertKnownConfigKeys(resource);
+  for (const resource of resources)
+    assertSupportedWorkspaceStorage(resource);
+  assertSupportedWorkspaceSandboxMounts(resources);
+  const resourceAliases = aliasesForResources(resourceExports);
+  const environment = resolveEnvironment(config, options.environment ?? (options.useRuntimeEnvironment === false ? undefined : process.env.BROODS_ENVIRONMENT), options.command ?? "dev");
+  const manifestResources = (await Promise.all(resources.map((resource) => toManifestResource(resource, root)))).sort((a, b) => `${a.kind}:${a.name}`.localeCompare(`${b.kind}:${b.name}`));
+  return {
+    config,
+    resources,
+    resourceAliases,
+    channels,
+    manifest: {
+      version: 1,
+      project: config.project,
+      environment,
+      resources: manifestResources
+    }
+  };
+}
+function collectEnvRefNames(manifest) {
+  const names = new Set;
+  function walk(value) {
+    if (Array.isArray(value)) {
+      for (const entry of value)
+        walk(entry);
+      return;
+    }
+    if (value && typeof value === "object") {
+      const record = value;
+      if (record.__beeblastEnv === true && typeof record.name === "string") {
+        names.add(record.name);
+        return;
+      }
+      for (const entry of Object.values(record))
+        walk(entry);
+    }
+  }
+  for (const resource of manifest.resources)
+    walk(resource.config);
+  return [...names].sort();
+}
+function resolveEnvironment(config, explicit, command) {
+  if (explicit)
+    return explicit;
+  const configured = config.environments?.[command];
+  if (configured)
+    return configured;
+  return command === "deploy" ? "production" : "development";
+}
+async function listTypeScriptFiles(root) {
+  const results = [];
+  async function walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === GENERATED_DIR || entry.name === "generated")
+          continue;
+        await walk(full);
+      } else if (entry.isFile() && entry.name.endsWith(".ts")) {
+        results.push(full);
+      }
+    }
+  }
+  await walk(root);
+  return results.sort((a, b) => relative(root, a).localeCompare(relative(root, b)));
+}
+async function loadExports(files) {
+  const values = [];
+  for (const file of files) {
+    const href = `${pathToFileURL(file).href}?t=${Date.now()}`;
+    const mod = await import(href);
+    values.push(...Object.entries(mod).map(([exportName, value]) => ({ exportName, value })));
+  }
+  return values;
+}
+async function findConfig(exports, cwd, explicitProject) {
+  const config = exports.find((entry) => isBroodsConfig(entry.value))?.value;
+  const configValue = config?.config ?? {};
+  const project = explicitProject ?? process.env.BROODS_PROJECT ?? configValue.project ?? normalizeProjectName(basename(resolve2(cwd)));
+  if (!project.trim()) {
+    throw new Error("Project name is required. Pass --project <name> or set BROODS_PROJECT.");
+  }
+  return {
+    ...configValue,
+    project
+  };
+}
+var KNOWN_AGENT_CONFIG_KEYS = new Set([
+  "agent",
+  "model",
+  "provider",
+  "session",
+  "hooks",
+  "channels",
+  "tools",
+  "sandbox",
+  "workspaces",
+  "subagent",
+  "skills",
+  "publicAccess"
+]);
+var AGENT_KEY_SUGGESTIONS = {
+  workspace: "workspaces",
+  skill: "skills",
+  tool: "tools",
+  channel: "channels",
+  hook: "hooks",
+  subagents: "subagent",
+  sandboxes: "sandbox",
+  systemPrompt: "agent",
+  system: "agent"
+};
+function assertKnownConfigKeys(resource) {
+  if (resource.kind !== "agent")
+    return;
+  const config = resource.config;
+  for (const key of Object.keys(config)) {
+    if (KNOWN_AGENT_CONFIG_KEYS.has(key))
+      continue;
+    const suggestion = AGENT_KEY_SUGGESTIONS[key];
+    const hint = suggestion ? ` Did you mean "${suggestion}"?` : ` Allowed keys: ${[...KNOWN_AGENT_CONFIG_KEYS].sort().join(", ")}.`;
+    throw new Error(`Agent "${resource.name}" has an unknown config key "${key}".${hint}`);
+  }
+}
+function assertSupportedWorkspaceStorage(resource) {
+  if (resource.kind !== "workspace")
+    return;
+  const config = resource.config;
+  const storage = config.storage;
+  if (storage === undefined)
+    return;
+  if (!storage || typeof storage !== "object" || Array.isArray(storage)) {
+    throw new Error(`Workspace "${resource.name}" config.storage must be an object`);
+  }
+  const provider = storage.provider;
+  if (provider === undefined || provider === "s3")
+    return;
+  if (provider === "vercel") {
+    throw new Error(`Workspace "${resource.name}" uses storage.provider "vercel", but Vercel Drive workspace storage is not supported yet. Use storage.provider "s3" or omit storage until Vercel Drive is wired.`);
+  }
+  throw new Error(`Workspace "${resource.name}" config.storage.provider must be one of: s3`);
+}
+function assertSupportedWorkspaceSandboxMounts(resources) {
+  const sandboxes = new Map(resources.filter((resource) => resource.kind === "sandbox").map((resource) => [resource.name, resource]));
+  for (const resource of resources) {
+    if (resource.kind !== "agent")
+      continue;
+    const config = resource.config;
+    const agentSandbox = resolveLocalSandbox(config.sandbox, sandboxes);
+    const workspaces = config.workspaces;
+    if (!Array.isArray(workspaces))
+      continue;
+    for (const entry of workspaces) {
+      const workspaceName = workspaceNameFor(entry);
+      const sandbox = effectiveWorkspaceSandbox(entry, agentSandbox, sandboxes);
+      if (!sandbox || supportsS3WorkspaceMount(sandbox))
+        continue;
+      throw new Error(`Agent "${resource.name}" workspace "${workspaceName}" uses sandbox "${sandbox.name}" (${sandboxProvider(sandbox)}) which does not support S3 workspace mounts. Use lambda, or daytona/kubernetes with options.mountAwsS3Buckets: true, or set this workspace ref to sandbox: null for read-only S3 access.`);
+    }
+  }
+}
+function resolveLocalSandbox(value, sandboxes) {
+  if (isResource(value) && value.kind === "sandbox")
+    return value;
+  if (typeof value === "string")
+    return sandboxes.get(value);
+  return;
+}
+function effectiveWorkspaceSandbox(entry, agentSandbox, sandboxes) {
+  if (entry && typeof entry === "object" && "sandbox" in entry) {
+    const sandbox = entry.sandbox;
+    if (sandbox === null)
+      return;
+    return resolveLocalSandbox(sandbox, sandboxes);
+  }
+  return agentSandbox;
+}
+function workspaceNameFor(entry) {
+  if (isResource(entry) && entry.kind === "workspace")
+    return entry.name;
+  if (entry && typeof entry === "object" && "workspace" in entry) {
+    const workspace = entry.workspace;
+    if (isResource(workspace))
+      return workspace.name;
+    if (typeof workspace === "string")
+      return workspace;
+  }
+  return "<unknown>";
+}
+function supportsS3WorkspaceMount(sandbox) {
+  const provider = sandboxProvider(sandbox);
+  if (provider === "lambda")
+    return true;
+  if (provider !== "daytona" && provider !== "kubernetes")
+    return false;
+  const options = sandbox.config.options;
+  return Boolean(options && typeof options === "object" && !Array.isArray(options) && options.mountAwsS3Buckets === true);
+}
+function sandboxProvider(sandbox) {
+  return typeof sandbox.config.provider === "string" ? sandbox.config.provider : "lambda";
+}
+function assertUniqueResources(resources) {
+  const seen = new Set;
+  for (const resource of resources) {
+    const key = `${resource.kind}:${resource.name}`;
+    if (seen.has(key)) {
+      throw new Error(`Duplicate resource: ${key}`);
+    }
+    seen.add(key);
+  }
+}
+function aliasesForResources(resources) {
+  const aliases = {};
+  const seenAliases = new Set;
+  for (const { exportName, resource } of resources) {
+    if (exportName === "default" || !isValidIdentifier(exportName))
+      continue;
+    const key = `${resource.kind}:${exportName}`;
+    if (seenAliases.has(key)) {
+      throw new Error(`Duplicate export alias for ${resource.kind}: ${exportName}`);
+    }
+    seenAliases.add(key);
+    aliases[resource.kind] ??= {};
+    aliases[resource.kind][resource.name] = exportName;
+  }
+  return aliases;
+}
+function compileChannels(resources, exports) {
+  const exportedAliases = new Map;
+  for (const entry of exports) {
+    if (!isChannelDefinition(entry.value) || entry.exportName === "default" || !isValidIdentifier(entry.exportName))
+      continue;
+    const previous = exportedAliases.get(entry.value);
+    if (previous && previous !== entry.exportName) {
+      throw new Error(`Channel is exported more than once: ${previous}, ${entry.exportName}`);
+    }
+    exportedAliases.set(entry.value, entry.exportName);
+  }
+  const owners = new Map;
+  const aliases = new Set;
+  const compiled = [];
+  for (const { exportName, resource } of resources) {
+    if (resource.kind !== "agent")
+      continue;
+    const value = resource.config.channels;
+    if (value === undefined)
+      continue;
+    if (!Array.isArray(value)) {
+      throw new Error(`Agent "${resource.name}" config.channels must be an array of channel definitions`);
+    }
+    const types = new Set;
+    for (const entry of value) {
+      if (!isChannelDefinition(entry)) {
+        throw new Error(`Agent "${resource.name}" config.channels must contain channel definitions`);
+      }
+      const owner = owners.get(entry);
+      if (owner && owner !== resource.name) {
+        throw new Error(`Channel ${entry.type} is already attached to agent "${owner}" and cannot also attach to "${resource.name}"`);
+      }
+      if (types.has(entry.type)) {
+        throw new Error(`Agent "${resource.name}" cannot configure more than one ${entry.type} channel`);
+      }
+      owners.set(entry, resource.name);
+      types.add(entry.type);
+      const fallbackAgent = exportName !== "default" && isValidIdentifier(exportName) ? exportName : resource.name;
+      const alias = exportedAliases.get(entry) ?? `${fallbackAgent}${capitalize(entry.type)}Channel`;
+      if (aliases.has(alias))
+        throw new Error(`Duplicate channel export alias: ${alias}`);
+      aliases.add(alias);
+      compiled.push({ alias, type: entry.type, agentName: resource.name });
+    }
+  }
+  for (const [channel, alias] of exportedAliases) {
+    if (!owners.has(channel))
+      throw new Error(`Channel "${alias}" must be attached to exactly one agent`);
+  }
+  return compiled.sort((left, right) => left.alias.localeCompare(right.alias));
+}
+function capitalize(value) {
+  return value.charAt(0).toUpperCase() + value.slice(1);
+}
+function isValidIdentifier(value) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(value);
+}
+async function toManifestResource(resource, projectRoot) {
+  return {
+    kind: resource.kind,
+    name: resource.name,
+    ...resource.description ? { description: resource.description } : {},
+    config: await normalizeConfig(resource, projectRoot)
+  };
+}
+async function normalizeConfig(resource, projectRoot) {
+  if (resource.kind === "agent") {
+    const config = { ...resource.config };
+    if (config.channels !== undefined) {
+      if (!Array.isArray(config.channels)) {
+        throw new Error(`Agent "${resource.name}" config.channels must be an array of channel definitions`);
+      }
+      config.channels = Object.fromEntries(config.channels.map((channel) => {
+        if (!isChannelDefinition(channel)) {
+          throw new Error(`Agent "${resource.name}" config.channels must contain channel definitions`);
+        }
+        return [channel.type, channel.config];
+      }));
+    }
+    if (isResource(config.sandbox)) {
+      config.sandbox = config.sandbox.name;
+    }
+    if (Array.isArray(config.workspaces)) {
+      config.workspaces = config.workspaces.map((workspace) => normalizeWorkspaceRef(workspace, resource.name));
+    }
+    return rewriteValues(config);
+  }
+  if (resource.kind === "skill") {
+    return await normalizeSkillConfig(resource.config, projectRoot);
+  }
+  if (resource.kind === "tool") {
+    return await normalizeToolConfig(resource.config, projectRoot);
+  }
+  if (resource.kind === "cron") {
+    const config = { ...resource.config };
+    const agent = config.agent;
+    config.agentId = isResource(agent) ? agent.name : agent;
+    config.name = config.name ?? resource.name;
+    delete config.agent;
+    if (typeof config.input === "string") {
+      config.events = [{ role: "user", content: [{ type: "text", text: config.input }] }];
+      delete config.input;
+    }
+    return rewriteValues(config);
+  }
+  return rewriteValues(resource.config);
+}
+async function normalizeSkillConfig(config, projectRoot) {
+  const skillRoot = resolveContainedResourcePath(projectRoot, config.path, "Skill");
+  const manifestPath = relative(projectRoot, skillRoot).split("\\").join("/");
+  const files = await readBundleFiles(skillRoot);
+  if (!files.some((file) => file.path === "SKILL.md")) {
+    throw new Error(`Skill folder ${config.path} must contain SKILL.md`);
+  }
+  return {
+    source: "files",
+    path: manifestPath,
+    files
+  };
+}
+async function normalizeToolConfig(config, projectRoot) {
+  const bundlePath = resolveContainedResourcePath(projectRoot, config.path, "Tool");
+  const manifestPath = relative(projectRoot, bundlePath).split("\\").join("/");
+  assertSafeBundlePath(manifestPath, "Tool");
+  const sourceSize = Buffer.byteLength(await readFile2(bundlePath));
+  if (sourceSize > MAX_BUNDLE_FILE_BYTES) {
+    throw new Error(`Tool source ${manifestPath} is too large (${sourceSize} bytes, max ${MAX_BUNDLE_FILE_BYTES})`);
+  }
+  const build = await Bun.build({
+    entrypoints: [bundlePath],
+    root: projectRoot,
+    target: "node",
+    format: "esm",
+    minify: false
+  });
+  if (!build.success || build.outputs.length !== 1) {
+    const details = build.logs.map((entry) => entry.message).filter(Boolean).join("; ");
+    throw new Error(`Tool bundle ${manifestPath} failed to build${details ? `: ${details}` : ""}`);
+  }
+  const bundle = await build.outputs[0].text();
+  const bundleSize = Buffer.byteLength(bundle);
+  if (bundleSize > MAX_BUNDLE_FILE_BYTES) {
+    throw new Error(`Tool bundle ${manifestPath} is too large (${bundleSize} bytes, max ${MAX_BUNDLE_FILE_BYTES})`);
+  }
+  return {
+    path: manifestPath,
+    description: config.description,
+    inputSchema: config.inputSchema,
+    ...config.defaultConfig !== undefined ? { defaultConfig: config.defaultConfig } : {},
+    bundle,
+    sha256: sha256Hex(bundle)
+  };
+}
+function normalizeWorkspaceRef(entry, agentName) {
+  if (isResource(entry)) {
+    return { name: entry.name, workspaceId: entry.name };
+  }
+  if (entry && typeof entry === "object" && "workspace" in entry) {
+    const ref = entry.workspace;
+    const name = isResource(ref) ? ref.name : ref;
+    if (typeof name !== "string") {
+      throw new Error(`Agent ${agentName} workspace ref must be a defineWorkspace(...) resource or its name`);
+    }
+    const normalized = { name, workspaceId: name };
+    if ("sandbox" in entry) {
+      const sandbox = entry.sandbox;
+      normalized.sandbox = sandbox === null ? null : isResource(sandbox) ? sandbox.name : sandbox;
+    }
+    return normalized;
+  }
+  throw new Error(`Agent ${agentName} workspaces must be defineWorkspace(...) resources or { workspace, sandbox } refs`);
+}
+function resolveContainedResourcePath(projectRoot, resourcePath, kind) {
+  if (resourcePath.trim().length === 0)
+    throw new Error(`${kind} path is required`);
+  if (resourcePath.includes("\x00"))
+    throw new Error(`${kind} path must not contain null bytes`);
+  const root = resolve2(projectRoot);
+  const target = resolve2(root, resourcePath);
+  const rel = relative(root, target);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel))
+    return target;
+  throw new Error(`${kind} path ${resourcePath} must stay inside ${PROJECT_DIR}/`);
+}
+function rewriteValues(value) {
+  if (Array.isArray(value)) {
+    return value.map((entry) => rewriteValues(entry));
+  }
+  if (isResource(value)) {
+    return value.name;
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, rewriteValues(entry)]));
+  }
+  return value;
+}
+async function readBundleFiles(root) {
+  const files = [];
+  let totalBytes = 0;
+  async function walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const absolute = join3(dir, entry.name);
+      const rel = relative(root, absolute).split("\\").join("/");
+      if (entry.isDirectory()) {
+        if (shouldSkipBundleEntry(entry.name))
+          continue;
+        await walk(absolute);
+      } else if (entry.isFile()) {
+        if (shouldSkipBundleEntry(entry.name) || isUnsafeBundlePath(rel))
+          continue;
+        const bytes = await readFile2(absolute);
+        if (bytes.byteLength > MAX_BUNDLE_FILE_BYTES) {
+          throw new Error(`Skill bundle file ${rel} is too large (${bytes.byteLength} bytes, max ${MAX_BUNDLE_FILE_BYTES})`);
+        }
+        totalBytes += bytes.byteLength;
+        if (totalBytes > MAX_BUNDLE_TOTAL_BYTES) {
+          throw new Error(`Skill bundle at ${root} is too large (${totalBytes} bytes, max ${MAX_BUNDLE_TOTAL_BYTES})`);
+        }
+        if (files.length >= MAX_BUNDLE_FILES) {
+          throw new Error(`Skill bundle at ${root} has too many files (max ${MAX_BUNDLE_FILES})`);
+        }
+        files.push({
+          path: rel,
+          size: bytes.byteLength,
+          sha256: sha256Hex(bytes),
+          contentBase64: bytes.toString("base64"),
+          contentType: contentTypeForPath(rel)
+        });
+      }
+    }
+  }
+  await walk(root);
+  return files.sort((a, b) => String(a.path).localeCompare(String(b.path)));
+}
+function shouldSkipBundleEntry(name) {
+  return name.startsWith(".") || SKIPPED_BUNDLE_DIRECTORIES.has(name);
+}
+function assertSafeBundlePath(path, kind) {
+  if (isUnsafeBundlePath(path)) {
+    throw new Error(`${kind} bundle path ${path} looks like a hidden file or secret and will not be bundled`);
+  }
+}
+function isUnsafeBundlePath(path) {
+  const parts = path.split("/");
+  return parts.some((part) => part.startsWith(".") || UNSAFE_BUNDLE_FILE_NAMES.some((pattern) => pattern.test(part)));
+}
+function sha256Hex(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function contentTypeForPath(path) {
+  if (path.endsWith(".md"))
+    return "text/markdown; charset=utf-8";
+  if (path.endsWith(".json"))
+    return "application/json";
+  if (path.endsWith(".js") || path.endsWith(".mjs"))
+    return "application/javascript";
+  if (path.endsWith(".ts"))
+    return "text/typescript; charset=utf-8";
+  if (path.endsWith(".txt"))
+    return "text/plain; charset=utf-8";
+  return "application/octet-stream";
+}
+function normalizeProjectName(name) {
+  return name.replace(/^@/, "").replace(/\//g, "-").replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+
+// src/codegen.ts
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { resolve as resolve3 } from "path";
+async function writeGeneratedFiles(manifest, ids, cwd = process.cwd(), aliases = {}, endpoint = null, channels = []) {
+  const dir = resolve3(cwd, PROJECT_DIR, GENERATED_DIR);
+  const scopedIds = idsForManifest(ids, manifest);
+  await mkdir2(dir, { recursive: true });
+  await writeFile2(resolve3(dir, "ids.ts"), idsFile(scopedIds), "utf8");
+  await writeFile2(resolve3(dir, "api.ts"), apiFile(manifest, scopedIds, aliases, endpoint, channels), "utf8");
+  await writeFile2(resolve3(dir, "resources.ts"), resourcesFile(manifest), "utf8");
+  await writeFile2(resolve3(dir, "dataModel.ts"), dataModelFile(), "utf8");
+}
+function idsForManifest(ids, manifest) {
+  const namesByKind = {
+    agents: namesForKind(manifest, "agent"),
+    workspaces: namesForKind(manifest, "workspace"),
+    sandboxes: namesForKind(manifest, "sandbox"),
+    crons: namesForKind(manifest, "cron"),
+    skills: namesForKind(manifest, "skill"),
+    tools: namesForKind(manifest, "tool")
+  };
+  return {
+    agents: pickIds(ids.agents, namesByKind.agents),
+    workspaces: pickIds(ids.workspaces, namesByKind.workspaces),
+    sandboxes: pickIds(ids.sandboxes, namesByKind.sandboxes),
+    crons: pickIds(ids.crons, namesByKind.crons),
+    skills: pickIds(ids.skills, namesByKind.skills),
+    tools: pickIds(ids.tools, namesByKind.tools)
+  };
+}
+function namesForKind(manifest, kind) {
+  return new Set(manifest.resources.filter((resource) => resource.kind === kind).map((resource) => resource.name));
+}
+function pickIds(values, names) {
+  return Object.fromEntries(Object.entries(values).filter(([name]) => names.has(name)));
+}
+function idsFile(ids) {
+  return `// Generated by broods. Do not edit by hand.
+` + `export const ids = ${JSON.stringify(ids, null, 2)} as const;
+` + `export const agents = ids.agents;
+` + `export const workspaces = ids.workspaces;
+` + `export const sandboxes = ids.sandboxes;
+` + `export const crons = ids.crons;
+` + `export const skills = ids.skills;
+` + `export const tools = ids.tools;
+`;
+}
+function resourcesFile(manifest) {
+  return `// Generated by broods. Do not edit by hand.
+` + `export const manifest = ${JSON.stringify(manifest, null, 2)} as const;
+`;
+}
+function apiFile(manifest, ids, aliases, endpoint, channels) {
+  const agents = Object.keys(ids.agents);
+  const scope = endpoint ? `, endpointId: ${JSON.stringify(endpoint.endpointId)}, projectSlug: ${JSON.stringify(endpoint.projectSlug)}, environmentSlug: ${JSON.stringify(endpoint.environmentSlug)}` : "";
+  const agentEntries = agents.map((name) => `    ${propertyKey(aliases.agent?.[name] ?? name)}: { kind: "agent", name: ${JSON.stringify(name)}, id: ids.agents[${JSON.stringify(name)}], project: ${JSON.stringify(manifest.project)}, environment: ${JSON.stringify(manifest.environment)}${scope} },`).join(`
+`);
+  const channelEntries = endpoint ? channels.map((channel) => {
+    const path = `/webhooks/${encodeURIComponent(endpoint.accountId)}/${encodeURIComponent(ids.agents[channel.agentName] ?? channel.agentName)}/${encodeURIComponent(channel.type)}`;
+    return `    ${propertyKey(channel.alias)}: { kind: "channel", type: ${JSON.stringify(channel.type)}, agentName: ${JSON.stringify(channel.agentName)}, agentId: ids.agents[${JSON.stringify(channel.agentName)}], accountId: ${JSON.stringify(endpoint.accountId)}, webhookPath: ${JSON.stringify(path)} },`;
+  }).join(`
+`) : "";
+  return `// Generated by broods. Do not edit by hand.
+` + `import type { ResourceApi } from "broods";
+` + `import { ids } from "./ids";
+
+` + `/** Typed references for resources defined in broods/. */
+` + `export const api = {
+` + `  agents: {
+${agentEntries}
+  },
+` + `  channels: {
+${channelEntries}
+  },
+` + `  workspaces: ${aliasedIdMap("workspaces", ids.workspaces, aliases.workspace)},
+` + `  sandboxes: ${aliasedIdMap("sandboxes", ids.sandboxes, aliases.sandbox)},
+` + `  crons: ${aliasedIdMap("crons", ids.crons, aliases.cron)},
+` + `  skills: ${aliasedIdMap("skills", ids.skills, aliases.skill)},
+` + `  tools: ${aliasedIdMap("tools", ids.tools, aliases.tool)},
+` + `} as const satisfies ResourceApi;
+`;
+}
+function aliasedIdMap(idsKey, values, alias) {
+  const names = Object.keys(values);
+  if (names.length === 0)
+    return "{}";
+  const entries = names.map((name) => `    ${propertyKey(alias?.[name] ?? name)}: ids.${idsKey}[${JSON.stringify(name)}],`).join(`
+`);
+  return `{
+${entries}
+  }`;
+}
+function propertyKey(value) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(value) ? value : JSON.stringify(value);
+}
+function dataModelFile() {
+  return `// Generated by broods. Do not edit by hand.
+` + `export type { AgentReference, ChannelReference, AgentRunInput, AgentRunResult, ResourceApi } from "broods";
+`;
+}
+
+// src/sync.ts
+class BroodsSyncClient {
+  dashboardUrl;
+  token;
+  fetchImpl;
+  constructor(options) {
+    this.dashboardUrl = stripTrailingSlash(options.dashboardUrl);
+    this.token = options.token;
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  async getManifest(project, environment) {
+    const response = await this.request(project, environment, "/manifest", { method: "GET" });
+    if (response.status === 404)
+      return null;
+    await assertOk(response, "Fetch manifest failed");
+    return await response.json();
+  }
+  async putManifest(manifest, prune, rotateRuntimeKey = false) {
+    const response = await this.request(manifest.project, manifest.environment, "/manifest", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ manifest, prune, rotateRuntimeKey })
+    });
+    await assertOk(response, "Sync manifest failed");
+    return await response.json();
+  }
+  async getRuntimeKey(project, environment) {
+    const response = await this.request(project, environment, "/runtime-key", { method: "GET" });
+    if (response.status === 404)
+      return null;
+    await assertOk(response, "Fetch runtime key failed");
+    const payload = await response.json();
+    if (!payload.apiKey)
+      throw new Error("Fetch runtime key failed: response omitted apiKey");
+    return { apiKey: payload.apiKey, keyHint: payload.keyHint ?? "" };
+  }
+  async setEnv(project, environment, name, value) {
+    const response = await this.request(project, environment, `/env/${encodeURIComponent(name)}`, {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ value })
+    });
+    await assertOk(response, "Set environment variable failed");
+  }
+  async listEnv(project, environment) {
+    const response = await this.request(project, environment, "/env", { method: "GET" });
+    await assertOk(response, "List environment variables failed");
+    const payload = await response.json();
+    return payload.variables ?? [];
+  }
+  async getEnv(project, environment, name) {
+    const response = await this.request(project, environment, `/env/${encodeURIComponent(name)}`, { method: "GET" });
+    if (response.status === 404)
+      return null;
+    await assertOk(response, "Read environment variable failed");
+    const payload = await response.json();
+    return payload.value ?? null;
+  }
+  async removeEnv(project, environment, name) {
+    const response = await this.request(project, environment, `/env/${encodeURIComponent(name)}`, {
+      method: "DELETE"
+    });
+    await assertOk(response, "Remove environment variable failed");
+  }
+  async getOnboarding() {
+    const response = await this.fetchImpl(`${this.dashboardUrl}/api/cli/onboarding`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${this.token}`
+      }
+    });
+    await assertOk(response, "Fetch CLI onboarding context failed");
+    return await response.json();
+  }
+  async selectOnboardingOrg(orgId) {
+    const response = await this.fetchImpl(`${this.dashboardUrl}/api/cli/onboarding`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ orgId })
+    });
+    await assertOk(response, "Select CLI org failed");
+    return await response.json();
+  }
+  async request(project, environment, suffix, init) {
+    const url = `${this.dashboardUrl}/api/cli/projects/${encodeURIComponent(project)}` + `/environments/${encodeURIComponent(environment)}${suffix}`;
+    return await this.fetchImpl(url, {
+      ...init,
+      headers: {
+        Authorization: `Bearer ${this.token}`,
+        ...init.headers
+      }
+    });
+  }
+}
+function diffManifests(local, remote) {
+  const remoteResources = new Map((remote?.resources ?? []).map((entry) => [`${entry.kind}:${entry.name}`, entry]));
+  const localResources = new Map(local.resources.map((entry) => [`${entry.kind}:${entry.name}`, entry]));
+  const entries = [];
+  const unmatchedLocal = [];
+  const unmatchedRemote = [];
+  for (const [key, resource] of localResources) {
+    const remoteResource = remoteResources.get(key);
+    if (!remoteResource) {
+      unmatchedLocal.push({ key, resource });
+    } else if (stableJson(snapshotResource(remoteResource)) !== stableJson(snapshotResource(resource))) {
+      entries.push({ operation: "update", kind: resource.kind, name: resource.name });
+    }
+  }
+  for (const [key, resource] of remoteResources) {
+    if (!localResources.has(key)) {
+      unmatchedRemote.push({ key, resource });
+    }
+  }
+  const renamedRemoteKeys = new Set;
+  const renamedLocalKeys = new Set;
+  for (const localEntry of unmatchedLocal) {
+    const match = unmatchedRemote.find((remoteEntry) => !renamedRemoteKeys.has(remoteEntry.key) && isRenamableKind(localEntry.resource.kind) && localEntry.resource.kind === remoteEntry.resource.kind && stableJson(renameSnapshot(localEntry.resource)) === stableJson(renameSnapshot(remoteEntry.resource)));
+    if (!match)
+      continue;
+    renamedLocalKeys.add(localEntry.key);
+    renamedRemoteKeys.add(match.key);
+    entries.push({
+      operation: "rename",
+      kind: localEntry.resource.kind,
+      name: localEntry.resource.name,
+      previousName: match.resource.name
+    });
+  }
+  for (const { key, resource } of unmatchedLocal) {
+    if (!renamedLocalKeys.has(key)) {
+      entries.push({ operation: "create", kind: resource.kind, name: resource.name });
+    }
+  }
+  for (const { key, resource } of unmatchedRemote) {
+    if (!renamedRemoteKeys.has(key)) {
+      entries.push({ operation: "delete", kind: resource.kind, name: resource.name });
+    }
+  }
+  return entries.sort((a, b) => diffSortKey(a).localeCompare(diffSortKey(b)));
+}
+function snapshotResource(resource) {
+  const normalized = normalizeEnvRefs(resource);
+  if (resource.kind !== "skill" && resource.kind !== "tool")
+    return normalized;
+  return {
+    ...normalized,
+    config: stripArtifactContent(normalized.config)
+  };
+}
+function renameSnapshot(resource) {
+  const normalized = snapshotResource(resource);
+  const { name: _name, ...rest } = normalized;
+  return rest;
+}
+function isRenamableKind(kind) {
+  return kind === "agent" || kind === "workspace" || kind === "sandbox";
+}
+function diffSortKey(entry) {
+  const rank = {
+    create: 0,
+    rename: 1,
+    update: 2,
+    delete: 3
+  };
+  return `${rank[entry.operation]}:${entry.kind}:${entry.previousName ?? ""}:${entry.name}`;
+}
+function normalizeEnvRefs(value) {
+  if (Array.isArray(value))
+    return value.map(normalizeEnvRefs);
+  if (value && typeof value === "object") {
+    const record = value;
+    if (record.__beeblastEnv === true && typeof record.name === "string") {
+      return `\${${record.name}}`;
+    }
+    return Object.fromEntries(Object.entries(record).map(([key, entry]) => [key, normalizeEnvRefs(entry)]));
+  }
+  return value;
+}
+function stripArtifactContent(value) {
+  if (Array.isArray(value))
+    return value.map(stripArtifactContent);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).flatMap(([key, entry]) => {
+      if (key === "contentBase64" || key === "bundle")
+        return [];
+      return [[key, stripArtifactContent(entry)]];
+    }));
+  }
+  return value;
+}
+function stableJson(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value))
+    return value.map(sortValue);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => [key, sortValue(entry)]));
+  }
+  return value;
+}
+async function assertOk(response, message) {
+  if (!response.ok) {
+    throw new Error(`${message}: ${response.status} ${await response.text()}`);
+  }
+}
+
+// src/run-input.ts
+function resolveRunEvents(input) {
+  if (input.events && input.input !== undefined) {
+    throw new Error("Run input accepts either `input` or `events`, not both");
+  }
+  if (input.events && input.events.length > 0)
+    return input.events;
+  if (typeof input.input === "string") {
+    return [{ role: "user", content: [{ type: "text", text: input.input }] }];
+  }
+  throw new Error("Run input requires `input` (string) or a non-empty `events` array");
+}
+
+// src/stream.ts
+async function* readSseStream(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split(`
+`);
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        if (line.startsWith("data: "))
+          yield line.slice(6);
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+// src/client.ts
+var DEFAULT_CORE_BASE_URL = "https://gateway.broods.app";
+
+class BroodsClient {
+  baseUrl;
+  apiKey;
+  fetchImpl;
+  constructor(options = {}) {
+    loadBroodsRuntimeConfig();
+    this.baseUrl = normalizeHttpServiceUrl(options.baseUrl || options.host || process.env.BROODS_BASE_URL || process.env.BROODS_HOST || DEFAULT_CORE_BASE_URL);
+    this.apiKey = options.apiKey || process.env.BROODS_API_KEY || undefined;
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  channelWebhookUrl(ref) {
+    return `${this.baseUrl}${ref.webhookPath.startsWith("/") ? "" : "/"}${ref.webhookPath}`;
+  }
+  agent(refOrName, agentId) {
+    if (typeof refOrName === "string") {
+      const name = refOrName;
+      const id = agentId ?? "";
+      if (!id)
+        throw new Error(`Agent ${name} is missing a generated id. Run broods deploy first.`);
+      return {
+        id,
+        run: (input) => this.run({ ...input, agentName: name, agentId: id }),
+        runAsync: (input) => this.runAsync({ ...input, agentName: name, agentId: id }),
+        stream: (input) => this.stream({ ...input, agentName: name, agentId: id })
+      };
+    }
+    const ref = refOrName;
+    if (!ref.id)
+      throw new Error(`Agent ${ref.name} is missing a generated id. Run broods deploy first.`);
+    return {
+      id: ref.id,
+      run: (input) => this.run(ref, input),
+      runAsync: (input) => this.runAsync(ref, input),
+      stream: (input) => this.stream(ref, input)
+    };
+  }
+  async run(refOrInput, maybeInput) {
+    const events = [];
+    let text = "";
+    const stream = maybeInput ? this.stream(refOrInput, maybeInput) : this.stream(refOrInput);
+    for await (const part of stream) {
+      events.push(part);
+      if (part.type === "text-delta")
+        text += part.text;
+    }
+    return { text, events };
+  }
+  async* stream(refOrInput, maybeInput) {
+    const input = maybeInput ? {
+      ...maybeInput,
+      agentId: refOrInput.id,
+      agentName: refOrInput.name
+    } : refOrInput;
+    const body = directRunBody(input, "cli");
+    const targetUrl = maybeInput ? this.scopedUrl(refOrInput) : this.baseUrl;
+    const response = await this.openStream(body, targetUrl);
+    if (!response.ok)
+      throw new Error(`Run failed: ${response.status} ${await response.text()}`);
+    if (!response.body)
+      throw new Error("Run response has no body");
+    for await (const data of readSseStream(response.body)) {
+      let part;
+      try {
+        part = JSON.parse(data);
+      } catch {
+        continue;
+      }
+      if (part.type === "error")
+        throw new Error(`Agent run failed: ${formatStreamError(part.error)}`);
+      yield part;
+    }
+  }
+  async runAsync(refOrInput, maybeInput) {
+    const input = maybeInput ? {
+      ...maybeInput,
+      agentId: refOrInput.id,
+      agentName: refOrInput.name
+    } : refOrInput;
+    const body = directRunBody(input, "async");
+    const response = await this.fetchJson(`${this.baseUrl}/async`, {
+      method: "POST",
+      headers: this.apiKeyHeaders(),
+      body: JSON.stringify(body)
+    });
+    if (response.status !== 202) {
+      throw new Error(`Async run failed: ${response.status} ${await responseErrorDetails(response, "202 JSON")}`);
+    }
+    const accepted = normalizeAsyncAccepted(await response.json(), body);
+    return {
+      ...accepted,
+      conversationKey: body.conversationKey,
+      poll: () => this.getAsyncStatus(accepted),
+      wait: (options) => this.waitForAsyncStatus(accepted, options)
+    };
+  }
+  async getAsyncStatus(status, options = {}) {
+    const statusUrl = this.resolveStatusUrl(status, options);
+    const response = await this.fetchJson(statusUrl, {
+      method: "GET",
+      headers: this.apiKeyHeaders()
+    });
+    if (response.status === 404)
+      return { status: "not_found" };
+    if (!response.ok)
+      throw new Error(`Status check failed: ${response.status} ${await response.text()}`);
+    return await response.json();
+  }
+  async waitForAsyncStatus(status, options = {}) {
+    const deadline = Date.now() + (options.timeoutMs ?? 180000);
+    const intervalMs = options.intervalMs ?? 2000;
+    while (Date.now() < deadline) {
+      if (options.signal?.aborted)
+        throw new Error("Async status polling aborted.");
+      const payload = await this.getAsyncStatus(status, options);
+      if (payload.status === "awaiting_approval" || payload.status === "completed" || payload.status === "failed" || payload.status === "not_found") {
+        return payload;
+      }
+      await sleep(intervalMs, options.signal);
+    }
+    throw new Error("Polling timeout");
+  }
+  async createCron(input) {
+    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons`, {
+      method: "POST",
+      headers: this.apiKeyHeaders(),
+      body: JSON.stringify(resolveCronInput(input))
+    });
+    if (response.status !== 201)
+      throw new Error(`Create cron job failed: ${response.status} ${await cronErrorDetails(response)}`);
+    return await response.json();
+  }
+  async listCrons() {
+    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons`, {
+      method: "GET",
+      headers: this.apiKeyHeaders()
+    });
+    if (!response.ok)
+      throw new Error(`List cron jobs failed: ${response.status} ${await cronErrorDetails(response)}`);
+    const payload = await response.json();
+    return payload.crons;
+  }
+  async getCron(cronId) {
+    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons/${encodeURIComponent(cronId)}`, {
+      method: "GET",
+      headers: this.apiKeyHeaders()
+    });
+    if (response.status === 404)
+      return null;
+    if (!response.ok)
+      throw new Error(`Get cron job failed: ${response.status} ${await cronErrorDetails(response)}`);
+    return await response.json();
+  }
+  async listCronRuns(cronId, options = {}) {
+    const params = new URLSearchParams;
+    if (options.limit !== undefined)
+      params.set("limit", String(options.limit));
+    const suffix = params.size > 0 ? `?${params}` : "";
+    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons/${encodeURIComponent(cronId)}/runs${suffix}`, {
+      method: "GET",
+      headers: this.apiKeyHeaders()
+    });
+    if (!response.ok)
+      throw new Error(`List cron job runs failed: ${response.status} ${await cronErrorDetails(response)}`);
+    const payload = await response.json();
+    return payload.runs;
+  }
+  async updateCron(cronId, patch) {
+    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons/${encodeURIComponent(cronId)}`, {
+      method: "PATCH",
+      headers: this.apiKeyHeaders(),
+      body: JSON.stringify(patch)
+    });
+    if (!response.ok)
+      throw new Error(`Update cron job failed: ${response.status} ${await cronErrorDetails(response)}`);
+    return await response.json();
+  }
+  async deleteCron(cronId) {
+    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons/${encodeURIComponent(cronId)}`, {
+      method: "DELETE",
+      headers: this.apiKeyHeaders()
+    });
+    if (response.status === 404)
+      return false;
+    if (!response.ok)
+      throw new Error(`Delete cron job failed: ${response.status} ${await cronErrorDetails(response)}`);
+    const payload = await response.json();
+    return payload.deleted;
+  }
+  scopedUrl(ref) {
+    if (ref.projectSlug && ref.environmentSlug && ref.endpointId) {
+      return `${this.baseUrl}/v1/${encodeURIComponent(ref.projectSlug)}` + `/agents/${encodeURIComponent(ref.environmentSlug)}/${encodeURIComponent(ref.endpointId)}`;
+    }
+    return this.baseUrl;
+  }
+  async openStream(body, targetUrl) {
+    if (this.apiKey) {
+      return await this.fetchCore(body, targetUrl, {
+        Authorization: `Bearer ${this.apiKey}`
+      });
+    }
+    throw new Error(`BroodsClient streams directly from the core service at ${this.baseUrl}. ` + "Provide apiKey. " + "For a self-hosted core service, set host/baseUrl or BROODS_HOST/BROODS_BASE_URL.");
+  }
+  async fetchCore(body, targetUrl, authHeaders) {
+    try {
+      return await this.fetchImpl(targetUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "text/event-stream",
+          ...authHeaders
+        },
+        body: JSON.stringify(body)
+      });
+    } catch (error) {
+      throw new Error(`Cannot access the broods core service at ${targetUrl}. ` + `The SDK uses ${DEFAULT_CORE_BASE_URL} by default; set host/baseUrl or BROODS_HOST/BROODS_BASE_URL ` + `to your own core service URL if your account uses a custom deployment. ` + `Cause: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  apiKeyHeaders() {
+    if (!this.apiKey) {
+      throw new Error("BroodsClient requires apiKey or BROODS_API_KEY.");
+    }
+    return {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${this.apiKey}`
+    };
+  }
+  async fetchJson(targetUrl, init) {
+    try {
+      return await this.fetchImpl(targetUrl, {
+        ...init,
+        headers: {
+          "Content-Type": "application/json",
+          ...init.headers ?? {}
+        }
+      });
+    } catch (error) {
+      throw new Error(`Cannot access the broods core service at ${targetUrl}. ` + `Cause: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  resolveStatusUrl(status, options) {
+    if (typeof status !== "string")
+      return status.statusUrl;
+    if (/^https?:\/\//.test(status))
+      return status;
+    if (!options.agentId)
+      throw new Error("Polling by status id requires agentId.");
+    return statusUrlFor(this.baseUrl, status, options.agentId);
+  }
+}
+function normalizeHttpServiceUrl(value) {
+  const trimmed = value.trim();
+  const withProtocol = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(trimmed) ? trimmed : `https://${trimmed}`;
+  return stripTrailingSlash(withProtocol);
+}
+function directRunBody(input, prefix) {
+  const eventId = input.eventId ?? `${prefix}-${Date.now()}`;
+  return {
+    agentId: input.agentId,
+    eventId,
+    conversationKey: input.conversationKey ?? eventId,
+    events: resolveRunEvents(input),
+    ...input.system !== undefined ? { system: input.system } : {},
+    ...input.model !== undefined ? { model: input.model } : {}
+  };
+}
+function normalizeAsyncAccepted(payload, requestBody) {
+  if (!payload || typeof payload !== "object") {
+    throw new Error("Async response must be an object");
+  }
+  const statusUrl = payload.statusUrl;
+  if (typeof statusUrl !== "string" || statusUrl.length === 0) {
+    throw new Error("Async response missing statusUrl");
+  }
+  const status = parseStatusUrl(statusUrl);
+  if (!status.statusId)
+    throw new Error("Async response statusUrl missing status id");
+  return {
+    statusUrl,
+    statusId: status.statusId,
+    eventId: status.statusId,
+    agentId: status.agentId ?? requestBody.agentId
+  };
+}
+function parseStatusUrl(statusUrl) {
+  const url = new URL(statusUrl);
+  const match = url.pathname.match(/\/status\/([^/]+)$/);
+  return {
+    statusId: match?.[1] ? decodeURIComponent(match[1]) : undefined,
+    agentId: url.searchParams.get("agentId") ?? undefined
+  };
+}
+function statusUrlFor(baseUrl, statusId, agentId) {
+  return `${normalizeHttpServiceUrl(baseUrl)}/status/${encodeURIComponent(statusId)}?agentId=${encodeURIComponent(agentId)}`;
+}
+async function responseErrorDetails(response, expected) {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (contentType.toLowerCase().includes("text/event-stream")) {
+    await response.body?.cancel().catch(() => {});
+    return `expected ${expected}, but the server returned an SSE stream. This usually means the core deployment routed /async to the direct streaming runner instead of the async handler.`;
+  }
+  const text = await response.text();
+  if (text.length <= 2000)
+    return text;
+  return `${text.slice(0, 2000)}... [truncated ${text.length - 2000} chars]`;
+}
+async function cronErrorDetails(response) {
+  const text = await response.text();
+  if (text.includes("Request body must include eventId and conversationKey")) {
+    return `${text}. Cron job APIs must be served by the configured baseUrl. ` + "Prefer defining stable cron jobs with defineCron(...) in broods/ and syncing with `broods dev` or `broods deploy`.";
+  }
+  return text;
+}
+function resolveCronInput(input) {
+  if ("agentId" in input)
+    return input;
+  const agent = input.agent;
+  const agentId = typeof agent === "string" ? agent : agent.id;
+  const { agent: _agent, ...rest } = input;
+  return { ...rest, agentId };
+}
+function sleep(ms, signal) {
+  return new Promise((resolvePromise, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("Async status polling aborted."));
+      return;
+    }
+    const timer = setTimeout(resolvePromise, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      reject(new Error("Async status polling aborted."));
+    }, { once: true });
+  });
+}
+function formatStreamError(error) {
+  if (typeof error === "string")
+    return error;
+  if (!error || typeof error !== "object")
+    return String(error);
+  const err = error;
+  const detail = err.data?.error?.message ?? err.message ?? err.responseBody ?? JSON.stringify(error);
+  const prefix = err.name ? `${err.name}: ` : "";
+  const status = err.statusCode ? ` (HTTP ${err.statusCode})` : "";
+  return `${prefix}${detail}${status}`;
+}
+
+// src/websocket.ts
+var DEFAULT_CONNECT_TIMEOUT_MS = 2000;
+var WS_CONNECTING = 0;
+var WS_OPEN = 1;
+var LAMBDA_FUNCTION_URL_HOST_RE = /\.lambda-url\.[a-z0-9-]+\.on\.aws$/i;
+
+class BroodsWebSocketClient {
+  baseUrl;
+  apiKey;
+  WebSocketImpl;
+  connectTimeoutMs;
+  constructor(options = {}) {
+    loadBroodsRuntimeConfig();
+    this.baseUrl = normalizeWebSocketServiceUrl(options.baseUrl || process.env.BROODS_WEBSOCKET_URL || options.host || process.env.BROODS_BASE_URL || process.env.BROODS_HOST || DEFAULT_CORE_BASE_URL);
+    this.apiKey = options.apiKey || process.env.BROODS_API_KEY || "";
+    if (!this.apiKey)
+      throw new Error("BroodsWebSocketClient requires apiKey or BROODS_API_KEY.");
+    this.WebSocketImpl = options.WebSocket;
+    this.connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+  }
+  subscribe(input, handlers = {}) {
+    const WebSocketImpl = this.resolveWebSocket();
+    const url = this.buildUrl(input);
+    const agentId = resolveAgentId(input);
+    const accessError = webSocketAccessError(this.baseUrl);
+    const socket = new WebSocketImpl(url);
+    let opened = false;
+    let closed = false;
+    const timeout = setTimeout(() => {
+      if (!opened)
+        fail(accessError);
+    }, this.connectTimeoutMs);
+    const close = (code = 1000, reason = "client closed") => {
+      if (closed)
+        return;
+      closed = true;
+      clearTimeout(timeout);
+      input.signal?.removeEventListener("abort", onAbort);
+      if (socket.readyState === WS_OPEN || socket.readyState === WS_CONNECTING) {
+        socket.close(code, reason);
+      }
+    };
+    const fail = (error) => {
+      handlers.onError?.(error);
+      close(1011, "websocket error");
+    };
+    const finish = () => {
+      handlers.onDone?.();
+      close(1000, "done");
+    };
+    const onAbort = () => {
+      if (socket.readyState === WS_OPEN) {
+        socket.send(JSON.stringify({ type: "cancel" }));
+      }
+      fail(new Error("WebSocket run aborted."));
+    };
+    input.signal?.addEventListener("abort", onAbort, { once: true });
+    socket.onopen = () => {
+      opened = true;
+      clearTimeout(timeout);
+      if (input.signal?.aborted) {
+        onAbort();
+        return;
+      }
+      socket.send(JSON.stringify({
+        type: "execute",
+        agentId,
+        events: resolveRunEvents(input),
+        sessionId: input.sessionId,
+        ...input.eventId !== undefined ? { eventId: input.eventId } : {},
+        ...input.system !== undefined ? { system: input.system } : {},
+        ...input.model !== undefined ? { model: input.model } : {}
+      }));
+    };
+    socket.onmessage = (event) => {
+      if (typeof event.data !== "string")
+        return;
+      const payload = parseServerMessage(event.data);
+      if (!payload)
+        return;
+      handlers.onMessage?.(payload);
+      switch (payload.type) {
+        case "meta":
+          handlers.onMeta?.(payload);
+          break;
+        case "done":
+          finish();
+          break;
+        case "error":
+          fail(new Error(formatWireError(payload.error)));
+          break;
+      }
+    };
+    socket.onerror = () => {
+      fail(accessError);
+    };
+    socket.onclose = (event) => {
+      clearTimeout(timeout);
+      input.signal?.removeEventListener("abort", onAbort);
+      if (closed || event.code === 1000)
+        return;
+      fail(new Error(event.reason || "WebSocket connection closed."));
+    };
+    return {
+      url,
+      close
+    };
+  }
+  async* stream(input) {
+    const queue = [];
+    let done = false;
+    let error = null;
+    let wake = null;
+    const wakeReader = () => {
+      wake?.();
+      wake = null;
+    };
+    const subscription = this.subscribe(input, {
+      onMessage(message) {
+        queue.push(message);
+        wakeReader();
+      },
+      onDone() {
+        done = true;
+        wakeReader();
+      },
+      onError(nextError) {
+        error = nextError;
+        wakeReader();
+      }
+    });
+    try {
+      while (true) {
+        if (queue.length > 0) {
+          yield queue.shift();
+          continue;
+        }
+        if (error)
+          throw error;
+        if (done)
+          return;
+        await new Promise((resolve4) => {
+          wake = resolve4;
+        });
+      }
+    } finally {
+      subscription.close();
+    }
+  }
+  buildUrl(input) {
+    const endpointId = resolveEndpointId(input);
+    const projectSlug = input.projectSlug ?? input.agent?.projectSlug;
+    const environmentSlug = input.environmentSlug ?? input.agent?.environmentSlug;
+    const projectPrefix = projectSlug ? `/${projectSlug}` : "";
+    const environmentPrefix = environmentSlug ? `/${environmentSlug}` : "";
+    const wsBaseUrl = toWebSocketBaseUrl(this.baseUrl);
+    return `${wsBaseUrl}/v1${projectPrefix}/agents${environmentPrefix}/${encodeURIComponent(endpointId)}/ws` + `?token=${encodeURIComponent(this.apiKey)}`;
+  }
+  resolveWebSocket() {
+    const WebSocketImpl = this.WebSocketImpl ?? globalThis.WebSocket;
+    if (!WebSocketImpl) {
+      throw new Error("WebSocket is not available. Pass a WebSocket implementation in BroodsWebSocketClient options.");
+    }
+    return WebSocketImpl;
+  }
+}
+function resolveAgentId(input) {
+  const agentId = input.agentId ?? input.agent?.id ?? input.endpointId;
+  if (!agentId) {
+    throw new Error("WebSocket run requires agent, agentId, or endpointId.");
+  }
+  return agentId;
+}
+function resolveEndpointId(input) {
+  const endpointId = input.endpointId ?? input.agent?.endpointId ?? input.agent?.id;
+  if (!endpointId) {
+    throw new Error("WebSocket run requires agent or endpointId.");
+  }
+  return endpointId;
+}
+function toWebSocketBaseUrl(url) {
+  const parsed = new URL(normalizeWebSocketServiceUrl(url));
+  if (parsed.protocol === "https:")
+    parsed.protocol = "wss:";
+  if (parsed.protocol === "http:")
+    parsed.protocol = "ws:";
+  return stripTrailingSlash(parsed.toString());
+}
+function normalizeWebSocketServiceUrl(value) {
+  const trimmed = value.trim();
+  if (/^wss?:\/\//.test(trimmed))
+    return stripTrailingSlash(trimmed);
+  return normalizeHttpServiceUrl(trimmed);
+}
+function webSocketAccessError(baseUrl) {
+  const host = new URL(baseUrl).hostname;
+  if (LAMBDA_FUNCTION_URL_HOST_RE.test(host)) {
+    return new Error(`Cannot access the WebSocket service at ${baseUrl}. AWS Lambda Function URLs do not support WebSocket upgrades; ` + "set BROODS_WEBSOCKET_URL or BROODS_HOST to the deployed WebSocket gateway URL instead.");
+  }
+  return new Error(`Cannot access the WebSocket service at ${baseUrl}.`);
+}
+function parseServerMessage(data) {
+  try {
+    const value = JSON.parse(data);
+    return typeof value === "object" && value !== null && typeof value.type === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+function formatWireError(error) {
+  if (typeof error === "string")
+    return error;
+  if (error && typeof error === "object" && typeof error.message === "string") {
+    return error.message;
+  }
+  return error === undefined ? "WebSocket stream error." : JSON.stringify(error);
+}
+
+// src/observability-client.ts
+var WS_OPEN2 = 1;
+var WS_CONNECTING2 = 0;
+function buildObservabilityUrl(baseUrl, project, environment, apiKey) {
+  const wsBase = toWebSocketBaseUrl(baseUrl);
+  return `${wsBase}/v1/${encodeURIComponent(project)}/${encodeURIComponent(environment)}/observability/ws` + `?token=${encodeURIComponent(apiKey)}`;
+}
+function parseServerMessage2(data) {
+  if (typeof data !== "string")
+    return null;
+  try {
+    const value = JSON.parse(data);
+    return typeof value === "object" && value !== null && typeof value.type === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+function resolveWebSocket() {
+  const impl = globalThis.WebSocket;
+  if (!impl)
+    throw new Error("WebSocket is not available in this environment.");
+  return impl;
+}
+async function* subscribeObservabilityLogs(options, subscribeOptions = {}) {
+  const seen = new Set;
+  let retryMs = 500;
+  while (!subscribeOptions.signal?.aborted) {
+    try {
+      for await (const entry of subscribeObservabilityLogsOnce(options, subscribeOptions)) {
+        const key = `${entry.ts}|${entry.eventType}|${entry.message}`;
+        if (seen.has(key))
+          continue;
+        seen.add(key);
+        if (seen.size > 5000)
+          seen.delete(seen.values().next().value);
+        retryMs = 500;
+        yield entry;
+      }
+    } catch (error) {
+      if (subscribeOptions.signal?.aborted)
+        return;
+      const message = error instanceof Error ? error.message : String(error);
+      if (/unauthorized|invalid websocket token|scope does not match/i.test(message))
+        throw error;
+    }
+    await reconnectDelay(retryMs, subscribeOptions.signal);
+    retryMs = Math.min(retryMs * 2, 5000);
+  }
+}
+async function* subscribeObservabilityLogsOnce(options, subscribeOptions) {
+  const { baseUrl, apiKey, project, environment } = options;
+  const { backfill = 0, minLevel, signal } = subscribeOptions;
+  if (signal?.aborted)
+    return;
+  const url = buildObservabilityUrl(baseUrl, project, environment, apiKey);
+  const displayUrl = url.slice(0, url.indexOf("?"));
+  const WebSocketImpl = resolveWebSocket();
+  const entries = [];
+  let socketError = null;
+  let done = false;
+  let wake = null;
+  const notify = () => {
+    wake?.();
+    wake = null;
+  };
+  const socket = new WebSocketImpl(url);
+  const cleanup = () => {
+    if (socket.readyState === WS_OPEN2 || socket.readyState === WS_CONNECTING2) {
+      socket.close(1000, "client closed");
+    }
+    signal?.removeEventListener("abort", onAbort);
+  };
+  const onAbort = () => {
+    done = true;
+    notify();
+    cleanup();
+  };
+  signal?.addEventListener("abort", onAbort, { once: true });
+  socket.onopen = () => {
+    if (signal?.aborted) {
+      cleanup();
+      return;
+    }
+    const msg = {
+      type: "subscribe",
+      stream: "logs",
+      ...backfill > 0 ? { backfill } : {},
+      ...minLevel !== undefined ? { minLevel } : {}
+    };
+    socket.send(JSON.stringify(msg));
+  };
+  socket.onmessage = (event) => {
+    const msg = parseServerMessage2(event.data);
+    if (!msg)
+      return;
+    switch (msg.type) {
+      case "backfill":
+        if (msg.stream === "logs") {
+          for (const entry of msg.entries) {
+            entries.push(entry);
+          }
+          notify();
+        }
+        break;
+      case "log":
+        entries.push(msg.entry);
+        notify();
+        break;
+      case "error":
+        socketError = new Error(`Observability gateway error: ${msg.error}`);
+        done = true;
+        notify();
+        break;
+      case "ready":
+        break;
+      default:
+        break;
+    }
+  };
+  socket.onerror = () => {
+    socketError = new Error(`Cannot connect to the observability gateway at ${displayUrl}.`);
+    done = true;
+    notify();
+  };
+  socket.onclose = (event) => {
+    if (!done) {
+      if (event.code !== 1000) {
+        socketError = new Error(event.reason ? `Observability WebSocket closed: ${event.reason}` : `Observability WebSocket closed with code ${event.code}.`);
+      }
+      done = true;
+      notify();
+    }
+  };
+  try {
+    while (true) {
+      if (entries.length > 0) {
+        yield entries.shift();
+        continue;
+      }
+      if (socketError)
+        throw socketError;
+      if (done)
+        return;
+      await new Promise((resolve4) => {
+        wake = resolve4;
+      });
+    }
+  } finally {
+    cleanup();
+  }
+}
+function reconnectDelay(ms, signal) {
+  return new Promise((resolve4) => {
+    if (signal?.aborted)
+      return resolve4();
+    const timer = setTimeout(resolve4, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      resolve4();
+    }, { once: true });
+  });
+}
+
+// src/cli/utils.ts
+import { createServer } from "http";
+import { spawn } from "child_process";
+import { createInterface } from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+var LOGIN_TIMEOUT_MS = 3 * 60 * 1000;
+function optionValue(args, name) {
+  const index = args.indexOf(name);
+  return index >= 0 ? args[index + 1] : undefined;
+}
+function hasFlag(args, name) {
+  return args.includes(name);
+}
+async function requireAuth(dashboardUrl) {
+  loadBroodsRuntimeConfig();
+  const auth = await readStoredAuth();
+  if (!auth) {
+    throw new Error("Run `broods login` first, or set BROODS_TOKEN and BROODS_DASHBOARD_URL.");
+  }
+  return dashboardUrl ? { ...auth, dashboardUrl } : auth;
+}
+async function promptSecret(label) {
+  const rl = createInterface({ input, output });
+  try {
+    const value = await rl.question(`${label}: `);
+    if (!value)
+      throw new Error(`${label} is required`);
+    return value;
+  } finally {
+    rl.close();
+  }
+}
+async function promptText(label, defaultValue) {
+  const rl = createInterface({ input, output });
+  try {
+    const pending = rl.question(`${label}: `);
+    if (defaultValue) {
+      if (input.isTTY && output.isTTY)
+        output.write("\x1B[90m");
+      rl.write(defaultValue);
+      if (input.isTTY && output.isTTY)
+        output.write("\x1B[0m");
+    }
+    const answer = (await pending).trim();
+    return answer || defaultValue || "";
+  } finally {
+    rl.close();
+  }
+}
+async function promptSelect(label, options, render) {
+  if (options.length === 0)
+    throw new Error(`${label}: no options available`);
+  if (options.length === 1)
+    return options[0];
+  console.log(label);
+  options.forEach((option, index) => {
+    console.log(`  ${index + 1}. ${render(option)}`);
+  });
+  const rl = createInterface({ input, output });
+  try {
+    while (true) {
+      const answer = (await rl.question(`Choose 1-${options.length}: `)).trim();
+      const index = Number(answer);
+      if (Number.isInteger(index) && index >= 1 && index <= options.length) {
+        return options[index - 1];
+      }
+      console.log(`Enter a number from 1 to ${options.length}.`);
+    }
+  } finally {
+    rl.close();
+  }
+}
+async function promptConfirm(question) {
+  if (!input.isTTY)
+    return false;
+  const rl = createInterface({ input, output });
+  try {
+    const answer = (await rl.question(`${question} [y/N] `)).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function loginWithBrowser(dashboardUrl) {
+  const state = crypto.randomUUID();
+  const { code, close } = await waitForCallback(state);
+  try {
+    const callbackUrl = code.callbackUrl;
+    const startUrl = `${stripTrailingSlash(dashboardUrl)}/cli-auth/start?` + new URLSearchParams({ callback: callbackUrl, state });
+    await assertCliAuthRouteExists(startUrl);
+    openBrowser(startUrl);
+    console.log(`Opening ${startUrl}`);
+    const loginCode = await waitWithTimeout(code.promise, LOGIN_TIMEOUT_MS);
+    const response = await fetch(`${stripTrailingSlash(dashboardUrl)}/api/cli/auth/exchange`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ code: loginCode })
+    });
+    if (!response.ok) {
+      throw new Error(`Login exchange failed: ${response.status} ${await response.text()}`);
+    }
+    const payload = await response.json();
+    const auth = {
+      dashboardUrl: stripTrailingSlash(dashboardUrl),
+      token: payload.token,
+      createdAt: new Date().toISOString(),
+      ...payload.user ? { user: payload.user } : {},
+      ...payload.org ? { org: payload.org } : {},
+      ...payload.account ? { account: payload.account } : {}
+    };
+    await writeStoredAuth(auth);
+    return auth;
+  } finally {
+    close();
+  }
+}
+async function assertCliAuthRouteExists(startUrl) {
+  const response = await fetch(startUrl, {
+    method: "GET",
+    redirect: "manual"
+  });
+  if (response.status === 404) {
+    const url = new URL(startUrl);
+    throw new Error(`${url.origin} does not expose /cli-auth/start yet. Deploy the dashboard changes first, ` + `or use --dashboard-url http://localhost:3000 with a local dashboard dev server.`);
+  }
+  if (response.status >= 500) {
+    throw new Error(`Dashboard CLI auth route failed: ${response.status} ${await response.text()}`);
+  }
+}
+function waitForCallback(expectedState) {
+  return new Promise((resolve4, reject) => {
+    const server = createServer((req, res) => {
+      try {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        const state = url.searchParams.get("state");
+        const code = url.searchParams.get("code");
+        if (state !== expectedState || !code) {
+          res.writeHead(400).end("Invalid broods login callback.");
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/plain" }).end("broods CLI login complete. You can close this tab.");
+        callbackResolve(code);
+      } catch (error) {
+        callbackReject(error);
+      }
+    });
+    let callbackResolve;
+    let callbackReject;
+    const promise = new Promise((res, rej) => {
+      callbackResolve = res;
+      callbackReject = rej;
+    });
+    const requestedPort = callbackPort();
+    server.on("error", (error) => {
+      if (!process.env.BROODS_LOGIN_PORT && requestedPort !== 0 && error.code === "EADDRINUSE") {
+        server.listen(0, "127.0.0.1");
+        return;
+      }
+      reject(error);
+    });
+    server.listen(requestedPort, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Failed to allocate callback port"));
+        return;
+      }
+      resolve4({
+        code: {
+          callbackUrl: `http://127.0.0.1:${address.port}/callback`,
+          promise
+        },
+        close: () => server.close()
+      });
+    });
+  });
+}
+async function waitWithTimeout(promise, ms) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`Timed out waiting for browser login to complete.
+` + `Check the browser tab and the dashboard logs for an error. If the browser shows
+` + `404 on /cli-auth/start, deploy the dashboard build that includes CLI auth or pass
+` + `--dashboard-url for the environment you deployed. Other common causes are missing
+` + "cliAuth Convex functions or no active API account (Settings -> API Access).")), ms);
+  });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function callbackPort() {
+  const raw = process.env.BROODS_LOGIN_PORT;
+  if (raw) {
+    const port = Number(raw);
+    if (Number.isInteger(port) && port > 0 && port < 65536)
+      return port;
+    throw new Error("BROODS_LOGIN_PORT must be a TCP port number");
+  }
+  return 18987;
+}
+function openBrowser(url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", url] : [url];
+  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.unref();
+}
+
+// src/cli/output.ts
+var RESET = "\x1B[0m";
+var DIM = "\x1B[2m";
+var UNDERLINE = "\x1B[4m";
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var RED = "\x1B[31m";
+var CYAN = "\x1B[36m";
+var LABEL_BG_GREEN = "\x1B[42m\x1B[30m\x1B[1m";
+function formatDeploymentTarget(target, options = {}) {
+  const color = shouldUseColor(options);
+  const bar = paint("\u258C", GREEN, color);
+  const label = color ? `${LABEL_BG_GREEN} Development ${RESET}` : "[Development]";
+  const dashboardText = color ? paint("dashboard", UNDERLINE, color) : "dashboard";
+  const deepLink = `${target.dashboardUrl}?project=${encodeURIComponent(target.project)}&env=${encodeURIComponent(target.environment)}`;
+  const url = paint(deepLink, `${DIM}${UNDERLINE}`, color);
+  return [
+    `${bar} Syncing Development: ${paint(target.project, "", color)}`,
+    `${bar} ${label} ${target.environment} (${dashboardText})`,
+    `${bar} ${paint("\u2514\u2500", DIM, color)} ${url}`
+  ].join(`
+`);
+}
+function formatReadyLine(durationMs, options = {}) {
+  const time = (options.now ?? new Date).toTimeString().slice(0, 8);
+  return `${paint("\u2714", GREEN, shouldUseColor(options))} ${time} Resources ready! (${formatDuration(durationMs)})`;
+}
+function formatEnvSync(names, options = {}) {
+  const color = shouldUseColor(options);
+  const bar = paint("\u258C", GREEN, color);
+  const arrow = paint("\u2191", GREEN, color);
+  return `${bar} ${arrow} Synced ${names.length} env var(s) from .env.local: ${names.join(", ")}`;
+}
+function formatDiffEntries(entries, options = {}) {
+  const color = shouldUseColor(options);
+  return entries.map((entry) => {
+    const marker = formatDiffMarker(entry.operation, color);
+    if (entry.operation === "rename" && entry.previousName) {
+      return `  ${marker} ${entry.kind}:${entry.previousName} -> ${entry.name}`;
+    }
+    return `  ${marker} ${entry.kind}:${entry.name}`;
+  });
+}
+function formatWarning(message, options = {}) {
+  return paint(message, YELLOW, shouldUseColor(options));
+}
+function printReadyLine(durationMs) {
+  console.error(formatReadyLine(durationMs));
+}
+function printDeploymentTarget(target) {
+  console.error(formatDeploymentTarget(target));
+}
+function printEnvSync(names) {
+  console.error(formatEnvSync(names));
+}
+function printDiffEntries(entries) {
+  for (const line of formatDiffEntries(entries))
+    console.log(line);
+}
+function printWarning(message) {
+  console.log(formatWarning(message));
+}
+function shouldUseColor(options) {
+  if (options.color !== undefined)
+    return options.color;
+  if (Object.hasOwn(process.env, "NO_COLOR"))
+    return false;
+  if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0")
+    return true;
+  return process.stderr.isTTY && process.env.TERM !== "dumb";
+}
+function paint(value, style, color) {
+  return color ? `${style}${value}${RESET}` : value;
+}
+function formatDiffMarker(operation, color) {
+  if (operation === "create")
+    return `[${paint("+", GREEN, color)}]`;
+  if (operation === "rename")
+    return `[${paint("~", YELLOW, color)}]`;
+  if (operation === "update")
+    return `[${paint("*", CYAN, color)}]`;
+  return `[${paint("-", RED, color)}]`;
+}
+function formatDuration(ms) {
+  if (ms >= 1000)
+    return `${(ms / 1000).toFixed(2)}s`;
+  return `${Math.max(ms, 0).toFixed(1)}ms`;
+}
+
+// src/cli/render.ts
+var RESET2 = "\x1B[0m";
+var DIM2 = "\x1B[90m";
+var GREEN2 = "\x1B[32m";
+var CYAN2 = "\x1B[36m";
+var MAGENTA = "\x1B[35m";
+var YELLOW2 = "\x1B[33m";
+var GREY = "\x1B[37m";
+var RED2 = "\x1B[31m";
+function createRenderState() {
+  return { streamedToolInputs: new Set };
+}
+function useColor() {
+  if (Object.hasOwn(process.env, "NO_COLOR"))
+    return false;
+  if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0")
+    return true;
+  return Boolean(process.stdout.isTTY) && process.env.TERM !== "dumb";
+}
+function paint2(value, style) {
+  return useColor() ? `${style}${value}${RESET2}` : value;
+}
+function write(value, style) {
+  process.stdout.write(style ? paint2(value, style) : value);
+}
+function preview(value, max = 500) {
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  if (text === undefined)
+    return "";
+  return text.length > max ? `${text.slice(0, max)}\u2026 [${text.length - max} more chars]` : text;
+}
+function formatUsage(usage) {
+  const parts = [];
+  if (typeof usage.inputTokens === "number")
+    parts.push(`${usage.inputTokens} in`);
+  if (typeof usage.outputTokens === "number")
+    parts.push(`${usage.outputTokens} out`);
+  if (parts.length === 0 && typeof usage.totalTokens === "number")
+    parts.push(`${usage.totalTokens} tokens`);
+  return parts.join(" / ");
+}
+function renderStreamPart(part, state) {
+  switch (part.type) {
+    case "reasoning-start":
+      write(`
+\uD83D\uDCAD thinking
+`, DIM2);
+      break;
+    case "reasoning-delta":
+      write(part.text, DIM2);
+      break;
+    case "reasoning-end":
+      write(`
+`);
+      break;
+    case "text-start":
+      write(`
+`);
+      break;
+    case "text-delta":
+      write(part.text, GREEN2);
+      break;
+    case "text-end":
+      write(`
+`);
+      break;
+    case "tool-input-start":
+      state.streamedToolInputs.add(part.id);
+      write(`
+\uD83D\uDD27 ${part.toolName}(`, CYAN2);
+      break;
+    case "tool-input-delta":
+      write(part.delta, DIM2);
+      break;
+    case "tool-input-end":
+      write(`)
+`, CYAN2);
+      break;
+    case "tool-call":
+      if (!state.streamedToolInputs.has(part.toolCallId)) {
+        write(`
+\uD83D\uDD27 ${part.toolName}(${preview(part.input)})
+`, CYAN2);
+      }
+      break;
+    case "tool-result":
+      write(`\u21B3 ${part.toolName} \u2192 ${preview(part.output)}
+`, MAGENTA);
+      break;
+    case "tool-error":
+      write(`\u21B3 ${part.toolName} error: ${preview(part.error)}
+`, RED2);
+      break;
+    case "tool-output-denied":
+      write(`\u21B3 ${part.toolName} output denied
+`, YELLOW2);
+      break;
+    case "tool-approval-request":
+      write(`\u23F8 approval required: ${part.toolCall.toolName}
+`, YELLOW2);
+      break;
+    case "source":
+      write(`\uD83D\uDD17 source: ${part.sourceType === "url" ? part.url : part.title}
+`, DIM2);
+      break;
+    case "file":
+      write(`\uD83D\uDCCE file: ${part.file.mediaType}
+`, DIM2);
+      break;
+    case "finish":
+      write(`
+[finished: ${part.finishReason}${formatUsage(part.totalUsage) ? ` \xB7 ${formatUsage(part.totalUsage)}` : ""}]
+`, GREY);
+      break;
+    case "abort":
+      write(`
+[aborted${part.reason ? `: ${part.reason}` : ""}]
+`, RED2);
+      break;
+    case "error":
+      write(`
+[error: ${preview(part.error)}]
+`, RED2);
+      break;
+    default:
+      break;
+  }
+}
+
+// src/cli/index.ts
+var VERSION = "0.1.0";
+var DEFAULT_DASHBOARD_URL = "https://dashboard.broods.app";
+var HELP = `broods v${VERSION}
+
+Usage: broods <command>
+
+Commands:
+  init                 Create a broods/ project shell
+  login                Authenticate with WorkOS through the dashboard
+  dev                  Watch + sync Development AND live-tail agent logs (like \`convex dev\`);
+                       confirms before deleting; auto-pushes env.NAME values from .env.local
+  dev --once           Sync Development a single time and exit (no watch, no log stream)
+  diff                 Show local desired state vs remote state
+  deploy               Sync Production once; writes BROODS_API_KEY to .env.local
+                       (--prune deletes undeclared remote resources; --rotate-key mints a fresh key)
+  env set <name>       Store an encrypted environment variable
+  env get <name>       Reveal a variable's value (audited)
+  env list             List environment variable names (values stay hidden)
+  env rm <name>        Remove an environment variable
+  stream               Stream live logs for the whole project/environment (Ctrl+C to stop)
+  logs                 Backfill recent logs then live-tail; default 100 lines
+                       (--errors / --level warn filter to WARN+; -n/--limit <n> changes backfill size)
+  agent list           List the agents in the current project/environment scope
+  agent get <name>     Show an agent's resources (model, sandbox, workspaces, tools, channels)
+  run <agent> <prompt> Run an agent once and pretty-stream the result (thinking, tool calls, text)
+
+Options:
+  --dashboard-url <url> Dashboard base URL (default: ${DEFAULT_DASHBOARD_URL})
+  --project <name>      Project name override (default: package name or folder)
+  --env <name>          Target environment override
+  --prune               Allow deploy to delete undeclared remote resources
+  --rotate-key          Mint a fresh runtime API key on deploy and write it to .env.local
+  --errors              Show WARN/ERROR only (with \`stream\` and \`logs\`)
+  --level <lvl>         Minimum log level INFO|WARN|ERROR (with \`stream\` and \`logs\`)
+  -n, --limit <n>       Backfill line count (with \`logs\`, default 100)
+  --json                Print logs as raw JSON (with \`logs\`, applies to backfill output)
+  --force               Allow init to overwrite starter files`;
+async function main() {
+  const [, , command, ...args] = process.argv;
+  switch (command) {
+    case undefined:
+    case "--help":
+    case "-h":
+      console.log(HELP);
+      return;
+    case "--version":
+    case "-v":
+      console.log(VERSION);
+      return;
+    case "init":
+      await init(args);
+      return;
+    case "login":
+      await login(args);
+      return;
+    case "diff":
+      await diff(args);
+      return;
+    case "deploy":
+      await deploy(args);
+      return;
+    case "dev":
+      await dev(args);
+      return;
+    case "env":
+      await envCommand(args);
+      return;
+    case "stream":
+      await streamLogs(args);
+      return;
+    case "logs":
+      await logs(args);
+      return;
+    case "agent":
+      await agentCommand(args);
+      return;
+    case "run":
+      await run(args);
+      return;
+    default:
+      throw new Error(`Unknown command: ${command}
+
+${HELP}`);
+  }
+}
+async function init(args) {
+  const force = hasFlag(args, "--force");
+  const root = resolve4(process.cwd(), PROJECT_DIR);
+  await mkdir3(resolve4(root, GENERATED_DIR), { recursive: true });
+  await writeStarter(resolve4(root, "index.ts"), starterAgent(), force);
+  await writeStarter(resolve4(root, ".gitignore"), `_generated
+.cache
+`, force);
+  await writeLocalEnvDefaults({
+    dashboardUrl: optionValue(args, "--dashboard-url") ?? DEFAULT_DASHBOARD_URL,
+    project: optionValue(args, "--project") ?? inferProjectName(process.cwd()),
+    environment: optionValue(args, "--env") ?? "development",
+    force
+  });
+  console.log(`Created ${PROJECT_DIR}/`);
+}
+async function login(args) {
+  if (hasFlag(args, "--help") || hasFlag(args, "-h")) {
+    console.log("Usage: broods login [--dashboard-url <url>]");
+    return;
+  }
+  const runtime = loadBroodsRuntimeConfig();
+  const dashboardUrl = optionValue(args, "--dashboard-url") ?? runtime.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
+  const auth = await loginWithBrowser(dashboardUrl);
+  const project = optionValue(args, "--project") ?? process.env.BROODS_PROJECT ?? inferProjectName(process.cwd());
+  const environment = optionValue(args, "--env") ?? process.env.BROODS_ENVIRONMENT ?? "development";
+  await writeLocalEnvDefaults({
+    dashboardUrl: auth.dashboardUrl,
+    project,
+    environment,
+    force: false
+  });
+  const user = auth.user?.email || auth.user?.name || auth.user?.authId;
+  const org = auth.org ? `${auth.org.name} (${auth.org.slug})` : undefined;
+  const account = auth.account?.username;
+  console.log(`Logged in to ${auth.dashboardUrl}`);
+  if (user)
+    console.log(`User: ${user}`);
+  if (org)
+    console.log(`Org: ${org}`);
+  if (account)
+    console.log(`Account: ${account}`);
+  await writeRuntimeKeyForLogin(auth.dashboardUrl, auth.token, project, environment);
+}
+async function writeRuntimeKeyForLogin(dashboardUrl, token, project, environment) {
+  try {
+    const client = new BroodsSyncClient({ dashboardUrl, token });
+    const key = await client.getRuntimeKey(project, environment);
+    if (key?.apiKey) {
+      await writeEnvValue("BROODS_API_KEY", key.apiKey);
+      console.log(`Wrote BROODS_API_KEY (${key.keyHint}) to .env.local`);
+    }
+  } catch {}
+}
+async function diff(args) {
+  const { manifest, config } = await compileProject({
+    project: optionValue(args, "--project"),
+    environment: optionValue(args, "--env"),
+    command: "dev"
+  });
+  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
+  const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+  const remote = await client.getManifest(manifest.project, manifest.environment);
+  printDiffEntries(diffManifests(manifest, remote?.manifest ?? null));
+}
+async function deploy(args) {
+  const { manifest, config, resourceAliases, channels } = await compileProject({
+    project: optionValue(args, "--project"),
+    environment: optionValue(args, "--env"),
+    command: "deploy",
+    useRuntimeEnvironment: false
+  });
+  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
+  const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+  const result = await client.putManifest(manifest, hasFlag(args, "--prune"), hasFlag(args, "--rotate-key"));
+  await writeGeneratedFiles(manifest, result.ids, process.cwd(), resourceAliases, result.deployment, channels);
+  await ensureGitIgnore();
+  console.log(`Synced ${result.manifest.resources.length} resources to ${manifest.project}/${manifest.environment}`);
+  await applyDeploymentKey(result.deployment);
+  printChannelEndpoints(channels, result);
+  printSyncWarnings(result);
+}
+async function applyDeploymentKey(deployment) {
+  if (!deployment)
+    return;
+  if (deployment.apiKey) {
+    await writeEnvValue("BROODS_API_KEY", deployment.apiKey);
+    console.log(`Wrote BROODS_API_KEY (${deployment.keyHint}) to .env.local`);
+    return;
+  }
+}
+function printSyncWarnings(result) {
+  const missing = result.warnings?.missingEnv ?? [];
+  if (missing.length === 0)
+    return;
+  printWarning(`\u26A0 ${missing.length} env var(s) referenced in agent config but not set: ${missing.join(", ")}`);
+  for (const name of missing)
+    console.log(`    broods env set ${name}`);
+}
+async function dev(args) {
+  await ensureDevOnboarding(args);
+  if (hasFlag(args, "--once")) {
+    if (!process.env.BROODS_SUPPRESS_DEV_TARGET) {
+      await printDevTarget(args);
+    }
+    const start = performance.now();
+    await syncDev(args);
+    printReadyLine(performance.now() - start);
+    return;
+  }
+  const declinedFile = join4(tmpdir(), `broods-declined-${process.pid}.txt`);
+  const childEnv = {
+    ...process.env,
+    BROODS_DECLINED_FILE: declinedFile,
+    BROODS_SUPPRESS_DEV_TARGET: "1"
+  };
+  await printDevTarget(args);
+  await runSyncChild(args, childEnv);
+  let timer;
+  let syncing = false;
+  let pending = false;
+  let lastSourceSignature = await sourceSignature();
+  const runSync = () => {
+    if (syncing) {
+      pending = true;
+      return;
+    }
+    syncing = true;
+    sourceSignature().then(async (signature) => {
+      if (signature === lastSourceSignature)
+        return;
+      lastSourceSignature = signature;
+      await runSyncChild(args, childEnv);
+    }).catch((error) => console.error(error instanceof Error ? error.message : String(error))).finally(() => {
+      syncing = false;
+      if (pending) {
+        pending = false;
+        runSync();
+      }
+    });
+  };
+  const watcher = watch(resolve4(process.cwd(), PROJECT_DIR), { recursive: true }, (_event, filename) => {
+    if (!filename || isGeneratedPath(filename))
+      return;
+    clearTimeout(timer);
+    timer = setTimeout(runSync, 150);
+  });
+  const logController = new AbortController;
+  streamDevLogs(args, logController.signal);
+  process.on("SIGINT", () => {
+    logController.abort();
+    watcher.close();
+    process.exit(0);
+  });
+}
+async function streamDevLogs(args, signal) {
+  let creds;
+  try {
+    creds = resolveObservabilityCredentials();
+  } catch {
+    console.log("\xB7 live logs off \u2014 set BROODS_API_KEY (run `deploy` first) to stream agent logs here");
+    return;
+  }
+  let project;
+  let environment;
+  try {
+    ({ project, environment } = await resolveProjectEnv(args));
+  } catch {
+    return;
+  }
+  const minLevel = resolveMinLevel(args);
+  try {
+    for await (const entry of subscribeObservabilityLogs({ baseUrl: creds.baseUrl, apiKey: creds.apiKey, project, environment }, { backfill: 0, minLevel, signal })) {
+      console.log(formatObservabilityEntry(entry));
+    }
+  } catch (error) {
+    if (!signal.aborted) {
+      console.error(`live logs: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+}
+async function ensureDevOnboarding(args) {
+  await ensureProjectShell();
+  await ensureLocalDevDefaults(args);
+}
+async function ensureProjectShell() {
+  const root = resolve4(process.cwd(), PROJECT_DIR);
+  await mkdir3(resolve4(root, GENERATED_DIR), { recursive: true });
+  const files = [];
+  await collectSourceFiles(root, files);
+  if (files.length > 0)
+    return;
+  await writeStarter(resolve4(root, "index.ts"), starterAgent(), false);
+  await writeStarter(resolve4(root, ".gitignore"), `_generated
+.cache
+`, false);
+  console.log(`Created starter ${PROJECT_DIR}/`);
+}
+async function ensureLocalDevDefaults(args) {
+  const path = resolve4(process.cwd(), ".env.local");
+  const current = await readTextIfExists(path);
+  const values = parseEnv2(current);
+  const missing = [
+    "BROODS_DASHBOARD_URL",
+    "BROODS_PROJECT",
+    "BROODS_ENVIRONMENT"
+  ].filter((key) => values[key] === undefined);
+  if (missing.length === 0)
+    return;
+  const needsProject = values.BROODS_PROJECT === undefined;
+  const needsEnvironment = values.BROODS_ENVIRONMENT === undefined;
+  const runtime = loadBroodsRuntimeConfig();
+  const dashboardUrl = optionValue(args, "--dashboard-url") ?? runtime.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
+  let project = optionValue(args, "--project") ?? process.env.BROODS_PROJECT ?? inferProjectName(process.cwd());
+  let environment = optionValue(args, "--env") ?? process.env.BROODS_ENVIRONMENT ?? "development";
+  if (process.stdin.isTTY && needsProject) {
+    const auth = await requireAuthOrLogin(dashboardUrl);
+    const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+    const context = await getOnboardingContextOrFallback(client, auth);
+    const selectableOrgs = context.orgs.filter((org) => org.accountStatus === "active");
+    if (selectableOrgs.length === 0) {
+      throw new Error("No selectable org has an active API account. Open Settings -> API Access in the dashboard first.");
+    }
+    const selectedOrg = await promptSelect("Select organization", selectableOrgs, formatOrgChoice);
+    const selectedContext = selectedOrg.id === context.currentOrgId ? context : await client.selectOnboardingOrg(selectedOrg.id);
+    project = await promptText("Project name", defaultProjectName(selectedContext, project));
+    if (!project.trim())
+      throw new Error("Project name is required.");
+  }
+  if (process.stdin.isTTY && needsEnvironment) {
+    environment = await promptText("Environment", environment);
+    if (!environment.trim())
+      throw new Error("Environment is required.");
+  }
+  await writeLocalEnvDefaults({
+    dashboardUrl,
+    project,
+    environment,
+    force: false
+  });
+}
+async function requireAuthOrLogin(dashboardUrl) {
+  try {
+    return await requireAuth(dashboardUrl);
+  } catch (error) {
+    if (!process.stdin.isTTY)
+      throw error;
+    printWarning("No CLI login found. Starting browser login.");
+    return await loginWithBrowser(dashboardUrl);
+  }
+}
+async function getOnboardingContextOrFallback(client, auth) {
+  try {
+    return await client.getOnboarding();
+  } catch (error) {
+    if (!auth.org)
+      throw error;
+    printWarning("CLI onboarding endpoint is not available yet; using the org from the current login.");
+    return {
+      currentOrgId: auth.org.id,
+      orgs: [{
+        id: auth.org.id,
+        name: auth.org.name,
+        slug: auth.org.slug,
+        role: "admin",
+        accountStatus: "active"
+      }],
+      projects: []
+    };
+  }
+}
+function formatOrgChoice(org) {
+  const suffix = org.role === "owner" || org.role === "admin" ? org.role : "member";
+  return `${org.name} (${org.slug}, ${suffix})`;
+}
+function defaultProjectName(context, inferred) {
+  const exact = context.projects.find((project) => project.name === inferred || project.slug === inferred);
+  return exact?.name ?? inferred;
+}
+function runSyncChild(args, env3) {
+  return new Promise((resolvePromise, reject) => {
+    const entryPoint = process.argv[1] ?? "";
+    const child = spawn2(process.execPath, [entryPoint, "dev", "--once", ...args], {
+      stdio: "inherit",
+      env: env3
+    });
+    child.on("error", reject);
+    child.on("exit", (code, signal) => {
+      if (code === 0) {
+        resolvePromise();
+        return;
+      }
+      reject(new Error(signal ? `Sync child exited from signal ${signal}` : `Sync child exited with code ${code ?? "unknown"}`));
+    });
+  });
+}
+async function syncDev(args) {
+  const { manifest, config, resourceAliases, channels } = await compileProject({
+    project: optionValue(args, "--project"),
+    environment: optionValue(args, "--env"),
+    command: "dev"
+  });
+  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
+  const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+  const remote = await client.getManifest(manifest.project, manifest.environment);
+  const diff2 = diffManifests(manifest, remote?.manifest ?? null);
+  printDiffEntries(diff2.filter((entry) => entry.operation !== "delete"));
+  await syncLocalEnvVars(client, manifest);
+  let result = await client.putManifest(manifest, false);
+  await writeGeneratedFiles(manifest, result.ids, process.cwd(), resourceAliases, result.deployment, channels);
+  await ensureGitIgnore();
+  const declined = await loadDeclinedDeletes();
+  const deletes = diff2.filter((entry) => entry.operation === "delete");
+  const undecided = deletes.filter((entry) => !declined.has(`${entry.kind}:${entry.name}`));
+  let pruned = false;
+  if (undecided.length > 0) {
+    printWarning("\u26A0 These remote resources are no longer declared locally:");
+    printDiffEntries(undecided);
+    if (await promptConfirm(`Delete ${undecided.length} resource(s) from ${manifest.project}/${manifest.environment}?`)) {
+      result = await client.putManifest(manifest, true);
+      await writeGeneratedFiles(manifest, result.ids, process.cwd(), resourceAliases, result.deployment, channels);
+      await clearDeclinedDeletes();
+      pruned = true;
+    } else {
+      await rememberDeclinedDeletes(undecided.map((entry) => `${entry.kind}:${entry.name}`));
+    }
+  }
+  if (!pruned && deletes.length > 0) {
+    const names = deletes.map((entry) => `${entry.kind}:${entry.name}`).join(", ");
+    printWarning(`\u26A0 ${deletes.length} undeclared resource(s) kept remotely: ${names} \u2014 re-declare in code or run \`deploy --prune\` to remove.`);
+  }
+  await applyDeploymentKey(result.deployment);
+  printChannelEndpoints(channels, result);
+  printSyncWarnings(result);
+  return result;
+}
+function printChannelEndpoints(channels, result) {
+  const deployment = result.deployment;
+  if (!deployment || channels.length === 0)
+    return;
+  const client = new BroodsClient;
+  for (const channel of channels) {
+    const agentId = result.ids.agents[channel.agentName];
+    if (!agentId)
+      continue;
+    const webhookPath = `/webhooks/${encodeURIComponent(deployment.accountId)}/${encodeURIComponent(agentId)}/${encodeURIComponent(channel.type)}`;
+    const url = client.channelWebhookUrl({
+      kind: "channel",
+      type: channel.type,
+      agentName: channel.agentName,
+      agentId,
+      accountId: deployment.accountId,
+      webhookPath
+    });
+    console.log(`Channel ${channel.alias} (${channel.type}): ${url}${channel.type === "pancake" ? "?secret=<PANCAKE_WEBHOOK_SECRET>" : ""}`);
+  }
+}
+async function syncLocalEnvVars(client, manifest) {
+  const present = collectEnvRefNames(manifest).filter((name) => {
+    const value = process.env[name];
+    return !name.startsWith("BROODS_") && value !== undefined && value !== "";
+  });
+  if (present.length === 0)
+    return;
+  const cache = await loadEnvSyncCache();
+  const known = cache[envCacheKey(manifest.project, manifest.environment)] ?? {};
+  const changed = present.filter((name) => known[name] !== hashEnvValue(process.env[name]));
+  if (changed.length === 0)
+    return;
+  await Promise.all(changed.map((name) => client.setEnv(manifest.project, manifest.environment, name, process.env[name])));
+  for (const name of changed)
+    known[name] = hashEnvValue(process.env[name]);
+  cache[envCacheKey(manifest.project, manifest.environment)] = known;
+  await saveEnvSyncCache(cache);
+  printEnvSync(changed);
+}
+function envCacheKey(project, environment) {
+  return `${project}:${environment}`;
+}
+function envSyncCachePath() {
+  return resolve4(dirname2(USER_CONFIG_PATH), "env-sync.json");
+}
+function hashEnvValue(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+async function loadEnvSyncCache() {
+  const text = await readTextIfExists(envSyncCachePath());
+  if (!text)
+    return {};
+  try {
+    const parsed = JSON.parse(text);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function saveEnvSyncCache(cache) {
+  const path = envSyncCachePath();
+  await mkdir3(resolve4(path, ".."), { recursive: true });
+  await writeFile3(path, `${JSON.stringify(cache, null, 2)}
+`, "utf8");
+}
+async function rememberEnvSyncValue(project, environment, name, value) {
+  const cache = await loadEnvSyncCache();
+  const key = envCacheKey(project, environment);
+  cache[key] = { ...cache[key] ?? {}, [name]: hashEnvValue(value) };
+  await saveEnvSyncCache(cache);
+}
+async function forgetEnvSyncValue(project, environment, name) {
+  const cache = await loadEnvSyncCache();
+  const key = envCacheKey(project, environment);
+  if (!cache[key] || !(name in cache[key]))
+    return;
+  delete cache[key][name];
+  await saveEnvSyncCache(cache);
+}
+async function printDevTarget(args) {
+  const { manifest, config } = await compileProject({
+    project: optionValue(args, "--project"),
+    environment: optionValue(args, "--env"),
+    command: "dev"
+  });
+  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
+  printDeploymentTarget({
+    project: manifest.project,
+    environment: manifest.environment,
+    dashboardUrl: auth.dashboardUrl
+  });
+}
+async function loadDeclinedDeletes() {
+  const path = process.env.BROODS_DECLINED_FILE;
+  if (!path)
+    return new Set;
+  const text = await readTextIfExists(path);
+  return new Set(text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+}
+async function rememberDeclinedDeletes(keys) {
+  const path = process.env.BROODS_DECLINED_FILE;
+  if (!path || keys.length === 0)
+    return;
+  await writeFile3(path, `${keys.join(`
+`)}
+`, { flag: "a" });
+}
+async function clearDeclinedDeletes() {
+  const path = process.env.BROODS_DECLINED_FILE;
+  if (!path)
+    return;
+  await writeFile3(path, "", "utf8");
+}
+async function envCommand(args) {
+  const subcommand = args[0];
+  const name = args[1];
+  const isList = subcommand === "list" || subcommand === "ls";
+  const isRemove = subcommand === "rm" || subcommand === "remove";
+  const isGet = subcommand === "get";
+  const needsName = subcommand === "set" || isRemove || isGet;
+  if (needsName && !name || !isList && !needsName) {
+    throw new Error("Usage: broods env <set|get|list|rm> [name]");
+  }
+  const { manifest, config } = await compileProject({
+    project: optionValue(args, "--project"),
+    environment: optionValue(args, "--env"),
+    command: "dev"
+  });
+  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
+  const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+  const target = `${manifest.project}/${manifest.environment}`;
+  if (isList) {
+    const variables = await client.listEnv(manifest.project, manifest.environment);
+    if (variables.length === 0) {
+      console.log(`No environment variables set for ${target}.`);
+      return;
+    }
+    console.log(`Environment variables for ${target} (values hidden):`);
+    for (const variable of variables)
+      console.log(`  ${variable.name}`);
+    return;
+  }
+  if (isGet) {
+    const value2 = await client.getEnv(manifest.project, manifest.environment, name);
+    if (value2 === null) {
+      console.error(`${name} is not set for ${target}`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(value2);
+    return;
+  }
+  if (isRemove) {
+    await client.removeEnv(manifest.project, manifest.environment, name);
+    await forgetEnvSyncValue(manifest.project, manifest.environment, name);
+    console.log(`Removed ${name} from ${target}`);
+    return;
+  }
+  const value = await promptSecret(name);
+  await client.setEnv(manifest.project, manifest.environment, name, value);
+  await rememberEnvSyncValue(manifest.project, manifest.environment, name, value);
+  console.log(`Stored ${name} for ${target}`);
+}
+function resolveObservabilityCredentials() {
+  loadBroodsRuntimeConfig();
+  const apiKey = process.env.BROODS_API_KEY ?? "";
+  if (!apiKey) {
+    throw new Error("BROODS_API_KEY is not set. Run `broods deploy` first, or set the key in .env.local.");
+  }
+  const baseUrl = process.env.BROODS_BASE_URL ?? process.env.BROODS_HOST ?? DEFAULT_CORE_BASE_URL;
+  return { apiKey, baseUrl };
+}
+function resolveMinLevel(args) {
+  if (hasFlag(args, "--errors"))
+    return "WARN";
+  const raw = optionValue(args, "--level");
+  if (!raw)
+    return;
+  const upper = raw.toUpperCase();
+  if (upper === "WARN" || upper === "WARNING")
+    return "WARN";
+  if (upper === "ERROR")
+    return "ERROR";
+  if (upper === "INFO")
+    return "INFO";
+  throw new Error(`Unknown log level: ${raw}. Use INFO, WARN, or ERROR.`);
+}
+async function resolveProjectEnv(args) {
+  loadBroodsRuntimeConfig();
+  const project = optionValue(args, "--project") ?? process.env.BROODS_PROJECT;
+  const environment = optionValue(args, "--env") ?? process.env.BROODS_ENVIRONMENT;
+  if (!project) {
+    throw new Error("Project name is required. Pass --project <name> or set BROODS_PROJECT in .env.local.");
+  }
+  if (!environment) {
+    throw new Error("Environment name is required. Pass --env <name> or set BROODS_ENVIRONMENT in .env.local.");
+  }
+  return { project, environment };
+}
+function formatObservabilityEntry(entry) {
+  const time = new Date(entry.ts).toISOString().slice(11, 23);
+  const level = entry.level.padEnd(5);
+  return `${time} ${level} ${entry.eventType} ${entry.message}`;
+}
+async function streamLogs(args) {
+  const { apiKey, baseUrl } = resolveObservabilityCredentials();
+  const { project, environment } = await resolveProjectEnv(args);
+  const minLevel = resolveMinLevel(args);
+  const controller = new AbortController;
+  const onSigint = () => controller.abort();
+  process.on("SIGINT", onSigint);
+  console.log(`Streaming live logs for ${project}/${environment}` + (minLevel ? ` [${minLevel}+]` : "") + " \u2014 Ctrl+C to stop");
+  try {
+    for await (const entry of subscribeObservabilityLogs({ baseUrl, apiKey, project, environment }, { backfill: 0, minLevel, signal: controller.signal })) {
+      console.log(formatObservabilityEntry(entry));
+    }
+  } catch (error) {
+    if (!controller.signal.aborted) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exitCode = 1;
+    }
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+}
+async function logs(args) {
+  const { apiKey, baseUrl } = resolveObservabilityCredentials();
+  const { project, environment } = await resolveProjectEnv(args);
+  const minLevel = resolveMinLevel(args);
+  const limit = Number(optionValue(args, "--limit") ?? optionValue(args, "-n") ?? 100);
+  const jsonMode = hasFlag(args, "--json");
+  const controller = new AbortController;
+  const onSigint = () => controller.abort();
+  process.on("SIGINT", onSigint);
+  console.log(`Logs for ${project}/${environment}` + (minLevel ? ` [${minLevel}+]` : "") + ` (backfill ${limit}) \u2014 Ctrl+C to stop`);
+  try {
+    for await (const entry of subscribeObservabilityLogs({ baseUrl, apiKey, project, environment }, { backfill: limit, minLevel, signal: controller.signal })) {
+      if (jsonMode) {
+        console.log(JSON.stringify(entry));
+      } else {
+        console.log(formatObservabilityEntry(entry));
+      }
+    }
+  } catch (error) {
+    if (!controller.signal.aborted) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exitCode = 1;
+    }
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+}
+async function agentCommand(args) {
+  const subcommand = args[0];
+  if (subcommand === "list" || subcommand === "ls") {
+    await agentList(args);
+    return;
+  }
+  if (subcommand === "get") {
+    await agentGet(args[1], args);
+    return;
+  }
+  throw new Error("Usage: broods agent <list|get> [name]");
+}
+async function loadAgentsWithIds(args) {
+  const { manifest, config } = await compileProject({
+    project: optionValue(args, "--project"),
+    environment: optionValue(args, "--env"),
+    command: "dev"
+  });
+  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
+  const remote = await new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token }).getManifest(manifest.project, manifest.environment);
+  const agents = manifest.resources.filter((resource) => resource.kind === "agent").map((resource) => ({
+    name: resource.name,
+    config: resource.config ?? {},
+    agentId: remote?.ids.agents[resource.name]
+  }));
+  return { manifest, agents };
+}
+async function agentList(args) {
+  const { manifest, agents } = await loadAgentsWithIds(args);
+  if (agents.length === 0) {
+    console.log(`No agents declared in ${manifest.project}/${manifest.environment}.`);
+    return;
+  }
+  console.log(`Agents in ${manifest.project}/${manifest.environment}:`);
+  for (const agent of agents) {
+    const model = agentModelLabel(agent.config);
+    const access = agent.config.publicAccess === true ? "public" : "private";
+    const status = agent.agentId ? agent.agentId : "not deployed";
+    console.log(`  ${agent.name}  [${access}]  ${model}  (${status})`);
+  }
+}
+async function agentGet(name, args) {
+  if (!name)
+    throw new Error("Usage: broods agent get <name>");
+  const { manifest, agents } = await loadAgentsWithIds(args);
+  const agent = agents.find((entry) => entry.name === name);
+  if (!agent)
+    throw new Error(`Unknown local agent: ${name}`);
+  const config = agent.config;
+  const sandbox = typeof config.sandbox === "string" ? config.sandbox : undefined;
+  const workspaces = Array.isArray(config.workspaces) ? config.workspaces.map((ref) => typeof ref === "string" ? ref : ref.name).filter(Boolean) : [];
+  const tools = isRecord(config.tools) ? Object.keys(config.tools) : [];
+  const channels = isRecord(config.channels) ? Object.keys(config.channels) : [];
+  const subagents = isRecord(config.subagent) && Array.isArray(config.subagent.allowed) ? config.subagent.allowed.map((entry) => typeof entry === "string" ? entry : entry.name).filter(Boolean) : [];
+  const webhooks = isRecord(config.hooks) && Array.isArray(config.hooks.webhooks) ? config.hooks.webhooks.filter(isRecord) : [];
+  console.log(`Agent: ${agent.name}`);
+  console.log(`  Project/Env:  ${manifest.project}/${manifest.environment}`);
+  console.log(`  Deployed id:  ${agent.agentId ?? "not deployed"}`);
+  console.log(`  Public access: ${config.publicAccess === true ? "public (SSE/WebSocket enabled)" : "private (secured by default)"}`);
+  console.log(`  Model:        ${agentModelLabel(config)}`);
+  console.log(`  Sandbox:      ${sandbox ?? "\u2014"}`);
+  console.log(`  Workspaces:   ${workspaces.length > 0 ? workspaces.join(", ") : "\u2014"}`);
+  console.log(`  Tools:        ${tools.length > 0 ? tools.join(", ") : "\u2014"}`);
+  console.log(`  Subagents:    ${subagents.length > 0 ? subagents.join(", ") : "\u2014"}`);
+  console.log(`  Channels:     ${channels.length > 0 ? channels.join(", ") : "\u2014"}`);
+  if (webhooks.length > 0) {
+    console.log(`  Webhooks:`);
+    webhooks.forEach((webhook, index) => {
+      const events = Array.isArray(webhook.events) && webhook.events.length > 0 ? webhook.events.join(", ") : "all events";
+      const state = webhook.enabled === false ? "disabled" : "enabled";
+      console.log(`    [${index}] ${state} \u2192 ${webhook.url ?? "\u2014"} (${events})`);
+    });
+  }
+}
+function agentModelLabel(config) {
+  const model = isRecord(config.model) ? config.model : {};
+  const provider = typeof model.provider === "string" ? model.provider : undefined;
+  const modelId = typeof model.modelId === "string" ? model.modelId : undefined;
+  if (provider && modelId)
+    return `${provider}/${modelId}`;
+  return modelId ?? provider ?? "unconfigured model";
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function run(args) {
+  const [agentName, ...promptParts] = args.filter((arg) => !arg.startsWith("--"));
+  if (!agentName || promptParts.length === 0) {
+    throw new Error("Usage: broods run <agent> <prompt>");
+  }
+  const { manifest, config } = await compileProject({
+    project: optionValue(args, "--project"),
+    environment: optionValue(args, "--env"),
+    command: "dev"
+  });
+  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
+  const agent = manifest.resources.find((resource) => resource.kind === "agent" && resource.name === agentName);
+  if (!agent)
+    throw new Error(`Unknown local agent: ${agentName}`);
+  const remote = await new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token }).getManifest(manifest.project, manifest.environment);
+  const agentId = remote?.ids.agents[agentName];
+  if (!agentId)
+    throw new Error(`Agent ${agentName} is not deployed. Run broods deploy first.`);
+  if (agent.config.publicAccess !== true) {
+    printWarning(`\u26A0 Agent "${agentName}" does not set publicAccess: true. The public endpoint is secured by default; ` + "if the deployed agent has not enabled it, this run will be refused.");
+  }
+  const client = new BroodsClient;
+  const state = createRenderState();
+  try {
+    for await (const part of client.stream({
+      kind: "agent",
+      name: agentName,
+      id: agentId,
+      project: manifest.project,
+      environment: manifest.environment
+    }, { input: promptParts.join(" ") })) {
+      renderStreamPart(part, state);
+    }
+    process.stdout.write(`
+`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("public_access_disabled")) {
+      throw new Error(`Agent "${agentName}" is not publicly accessible (secured by default). ` + "Set publicAccess: true in its config and redeploy, or enable Public access in the dashboard.");
+    }
+    throw error;
+  }
+}
+async function writeStarter(path, contents, force) {
+  try {
+    await writeFile3(path, contents, { flag: force ? "w" : "wx" });
+  } catch (error) {
+    if (error.code === "EEXIST")
+      return;
+    throw error;
+  }
+}
+async function ensureGitIgnore() {
+  const path = resolve4(process.cwd(), PROJECT_DIR, ".gitignore");
+  const existing = await readTextIfExists(path);
+  const needed = ["_generated", ".cache"];
+  const missing = needed.filter((line) => !existing.split(/\r?\n/).some((l) => l.trim() === line));
+  if (missing.length === 0)
+    return;
+  const body = existing ? existing.trimEnd() + `
+` + missing.join(`
+`) + `
+` : missing.join(`
+`) + `
+`;
+  await writeFile3(path, body, "utf8");
+}
+async function writeLocalEnvDefaults(options) {
+  const path = resolve4(process.cwd(), ".env.local");
+  const current = await readTextIfExists(path);
+  const values = parseEnv2(current);
+  const nextValues = {
+    BROODS_DASHBOARD_URL: options.dashboardUrl,
+    BROODS_PROJECT: options.project,
+    BROODS_ENVIRONMENT: options.environment
+  };
+  const lines = current ? current.replace(/\n?$/, `
+`).split(/\n/) : [
+    "# Local broods CLI settings. Tokens are stored outside the repo."
+  ];
+  let changed = false;
+  for (const [key, value] of Object.entries(nextValues)) {
+    if (values[key] !== undefined && !options.force)
+      continue;
+    const index = lines.findIndex((line) => line.trim().startsWith(`${key}=`));
+    if (index >= 0)
+      lines[index] = `${key}=${quoteEnv(value)}`;
+    else
+      lines.push(`${key}=${quoteEnv(value)}`);
+    if (process.env[key] === undefined)
+      process.env[key] = value;
+    changed = true;
+  }
+  if (!changed && current)
+    return;
+  const body = `${lines.filter((line, index, all) => !(line === "" && index === all.length - 1)).join(`
+`)}
+`;
+  await writeFile3(path, body, "utf8");
+}
+async function writeEnvValue(key, value) {
+  const path = resolve4(process.cwd(), ".env.local");
+  const current = await readTextIfExists(path);
+  const lines = current ? current.replace(/\n?$/, `
+`).split(/\n/) : ["# Local broods CLI settings. Tokens are stored outside the repo."];
+  const index = lines.findIndex((line) => line.trim().startsWith(`${key}=`));
+  if (index >= 0)
+    lines[index] = `${key}=${quoteEnv(value)}`;
+  else
+    lines.push(`${key}=${quoteEnv(value)}`);
+  process.env[key] = value;
+  const body = `${lines.filter((line, i, all) => !(line === "" && i === all.length - 1)).join(`
+`)}
+`;
+  await writeFile3(path, body, "utf8");
+}
+async function readTextIfExists(path) {
+  try {
+    return await readFile3(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return "";
+    throw error;
+  }
+}
+function parseEnv2(source) {
+  const values = {};
+  for (const rawLine of source.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const index = line.indexOf("=");
+    if (index <= 0)
+      continue;
+    values[line.slice(0, index).trim()] = line.slice(index + 1).trim();
+  }
+  return values;
+}
+function quoteEnv(value) {
+  return JSON.stringify(value);
+}
+function inferProjectName(cwd) {
+  return basename2(resolve4(cwd)).replace(/^@/, "").replace(/\//g, "-").replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "broods-app";
+}
+async function sourceSignature() {
+  const root = resolve4(process.cwd(), PROJECT_DIR);
+  const files = [];
+  await collectSourceFiles(root, files);
+  const hash = createHash2("sha256");
+  for (const file of files.sort()) {
+    hash.update(relative2(root, file));
+    hash.update("\x00");
+    hash.update(await readFile3(file));
+    hash.update("\x00");
+  }
+  return hash.digest("hex");
+}
+async function collectSourceFiles(dir, files) {
+  const entries = await readdir2(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = join4(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === GENERATED_DIR || entry.name === "generated" || entry.name === ".cache")
+        continue;
+      await collectSourceFiles(full, files);
+      continue;
+    }
+    if (entry.isFile() && entry.name.endsWith(".ts"))
+      files.push(full);
+  }
+}
+function isGeneratedPath(path) {
+  return path.split(/[\\/]/).some((part) => part === GENERATED_DIR || part === "generated" || part === ".cache");
+}
+function starterAgent() {
+  return `import { defineAgent, defineSandbox, env } from "broods";
+
+` + `// A Lambda sandbox: a fresh, ephemeral bash environment created per run.
+` + `export const lambdaSandbox = defineSandbox({
+` + `  name: "lambda-sandbox",
+` + `  config: {
+` + `    provider: "lambda",
+` + `    network: { mode: "deny-all" },
+` + `    permissionMode: "bypass",
+` + `    timeout: 60,
+` + `  },
+` + `});
+
+` + `export const myAgent = defineAgent({
+` + `  name: "my-agent",
+` + `  config: {
+` + `    provider: {
+` + `      openai: { apiKey: env.OPENAI_API_KEY },
+` + `    },
+` + `    model: {
+` + `      provider: "openai",
+` + `      modelId: "gpt-5.5",
+` + `    },
+` + `    agent: {
+` + `      system: "You are a helpful assistant.",
+` + `    },
+` + `    sandbox: lambdaSandbox,
+` + `    // Expose the public runtime endpoint (SSE/WebSocket) so the API key and
+` + `    // \`broods run\` can reach this agent. Off by default \u2014 secured: a
+` + `    // private agent is only reachable via internal endpoints or channel webhooks.
+` + `    publicAccess: true,
+` + `  },
+` + `});
+`;
+}
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});