broods 0.1.1 → 0.2.1

package/dist/cli/index.js

@@ -25,16 +25,19 @@ var GENERATED_DIR = "_generated";
 var USER_CONFIG_PATH = join(homedir(), ".broods", "config.json");
 async function readStoredAuth() {
   const envToken = process.env.BROODS_TOKEN;
-  const envUrl = process.env.BROODS_DASHBOARD_URL;
-  if (envToken && envUrl) {
+  const envConvexUrl = process.env.BROODS_BASE_URL;
+  if (envToken && envConvexUrl) {
     return {
-      dashboardUrl: envUrl,
+      baseUrl: stripTrailingSlash(envConvexUrl),
       token: envToken,
       createdAt: new Date().toISOString()
     };
   }
   try {
-    return JSON.parse(await readFile(USER_CONFIG_PATH, "utf8"));
+    const stored = JSON.parse(await readFile(USER_CONFIG_PATH, "utf8"));
+    if (typeof stored.baseUrl !== "string" || !stored.baseUrl)
+      return null;
+    return stored;
   } catch {
     return null;
   }
@@ -49,14 +52,17 @@ function stripTrailingSlash(value) {
 }
 
 // src/runtime-config.ts
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync, statSync } from "fs";
 import { join as join2, resolve } from "path";
-var loadedEnvForCwd = null;
+var envFileCache = new Map;
+var realEnvSnapshot = new Set(Object.keys(process.env));
+var loadedFromFiles = new Set;
 function loadBroodsRuntimeConfig(cwd = process.cwd()) {
   loadEnvFiles(cwd);
   const stored = readStoredAuthSync();
   return {
     dashboardUrl: process.env.BROODS_DASHBOARD_URL ?? stored?.dashboardUrl,
+    baseUrl: process.env.BROODS_BASE_URL ?? stored?.baseUrl,
     token: process.env.BROODS_TOKEN ?? stored?.token,
     project: process.env.BROODS_PROJECT,
     environment: process.env.BROODS_ENVIRONMENT
@@ -64,17 +70,23 @@ function loadBroodsRuntimeConfig(cwd = process.cwd()) {
 }
 function loadEnvFiles(cwd) {
   const root = resolve(cwd);
-  if (loadedEnvForCwd === root)
-    return;
-  loadedEnvForCwd = root;
-  const originallySet = new Set(Object.keys(process.env));
+  const forceReload = process.env.BROODS_RELOAD_ENV === "1";
   for (const file of [".env", ".env.local"]) {
     const path = join2(root, file);
-    if (!existsSync(path))
+    if (!existsSync(path)) {
+      envFileCache.delete(path);
       continue;
+    }
+    const mtimeMs = statSync(path).mtimeMs;
+    const cached = envFileCache.get(path);
+    if (cached && cached.mtimeMs === mtimeMs)
+      continue;
+    envFileCache.set(path, { mtimeMs });
     for (const [key, value] of Object.entries(parseEnv(readFileSync(path, "utf8")))) {
-      if (!originallySet.has(key))
+      if (forceReload || !realEnvSnapshot.has(key) || loadedFromFiles.has(key)) {
         process.env[key] = value;
+        loadedFromFiles.add(key);
+      }
     }
   }
 }
@@ -109,10 +121,11 @@ function unquoteEnvValue(value) {
 function readStoredAuthSync() {
   try {
     const value = JSON.parse(readFileSync(USER_CONFIG_PATH, "utf8"));
-    if (typeof value.dashboardUrl !== "string" || typeof value.token !== "string")
+    if (typeof value.baseUrl !== "string" || typeof value.token !== "string")
       return null;
     return {
-      dashboardUrl: stripTrailingSlash(value.dashboardUrl),
+      baseUrl: stripTrailingSlash(value.baseUrl),
+      ...typeof value.dashboardUrl === "string" ? { dashboardUrl: stripTrailingSlash(value.dashboardUrl) } : {},
       token: value.token
     };
   } catch {
@@ -146,11 +159,16 @@ function defineResource(kind, input) {
   };
 }
 function defineChannel(type, config) {
+  const { workspaceScope, ...channelConfig } = config;
   return {
     [CHANNEL_MARKER]: true,
     kind: "channel",
     type,
-    config
+    ...workspaceScope ? { workspaceScope } : {},
+    config: {
+      ...channelConfig,
+      ...workspaceScope ? { workspaceScope } : {}
+    }
   };
 }
 function defineTelegramChannel(config) {
@@ -166,11 +184,7 @@ function defineDiscordChannel(config) {
   return defineChannel("discord", config);
 }
 function definePancakeChannel(config) {
-  const { ignoreTagIds, ...channelConfig } = config;
-  return defineChannel("pancake", {
-    ...channelConfig,
-    ...ignoreTagIds === undefined ? {} : { options: { ignoreTagIds } }
-  });
+  return defineChannel("pancake", config);
 }
 function defineZaloChannel(config) {
   return defineChannel("zalo", config);
@@ -193,6 +207,9 @@ function defineSkill(input) {
 function defineTool(input) {
   return defineResource("tool", input);
 }
+function definePolicy(input) {
+  return defineResource("policy", input);
+}
 function defineCron(input) {
   return defineResource("cron", input);
 }
@@ -216,6 +233,18 @@ var UNSAFE_BUNDLE_FILE_NAMES = [
   /^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/i,
   /\.(?:pem|key|p12|pfx)$/i
 ];
+var INLINE_AGENT_HOOK_EVENTS = {
+  onStart: "agent.started",
+  onStepFinish: "agent.step.finished",
+  onToolCall: "tool.call.started",
+  onToolResult: "tool.result",
+  onFinish: "agent.finished",
+  onApproval: "agent.approval.required",
+  onError: "agent.failed",
+  onSubagentFinish: "subagent.task.finished",
+  onMessageReceived: "channel.message.received",
+  onMessageSending: "channel.message.sending"
+};
 async function compileProject(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   loadBroodsRuntimeConfig(cwd);
@@ -231,10 +260,13 @@ async function compileProject(options = {}) {
     assertKnownConfigKeys(resource);
   for (const resource of resources)
     assertSupportedWorkspaceStorage(resource);
+  for (const resource of resources)
+    assertSupportedWorkspaceIsolationShape(resource);
+  assertWorkspaceIsolationConsistency(resources);
   assertSupportedWorkspaceSandboxMounts(resources);
   const resourceAliases = aliasesForResources(resourceExports);
   const environment = resolveEnvironment(config, options.environment ?? (options.useRuntimeEnvironment === false ? undefined : process.env.BROODS_ENVIRONMENT), options.command ?? "dev");
-  const manifestResources = (await Promise.all(resources.map((resource) => toManifestResource(resource, root)))).sort((a, b) => `${a.kind}:${a.name}`.localeCompare(`${b.kind}:${b.name}`));
+  const manifestResources = (await Promise.all(resources.map((resource) => toManifestResources(resource, root)))).flat().sort((a, b) => `${a.kind}:${a.name}`.localeCompare(`${b.kind}:${b.name}`));
   return {
     config,
     resources,
@@ -329,11 +361,13 @@ var KNOWN_AGENT_CONFIG_KEYS = new Set([
   "workspaces",
   "subagent",
   "skills",
+  "policy",
   "publicAccess"
 ]);
 var AGENT_KEY_SUGGESTIONS = {
   workspace: "workspaces",
   skill: "skills",
+  policies: "policy",
   tool: "tools",
   channel: "channels",
   hook: "hooks",
@@ -372,6 +406,93 @@ function assertSupportedWorkspaceStorage(resource) {
   }
   throw new Error(`Workspace "${resource.name}" config.storage.provider must be one of: s3`);
 }
+function assertSupportedWorkspaceIsolationShape(resource) {
+  if (resource.kind !== "workspace")
+    return;
+  const config = resource.config;
+  if (typeof config.isolation === "string") {
+    throw new Error(`Workspace "${resource.name}" config.isolation no longer supports string modes; use isolation: true or omit it.`);
+  }
+  if (config.isolation !== undefined && typeof config.isolation !== "boolean") {
+    throw new Error(`Workspace "${resource.name}" config.isolation must be a boolean`);
+  }
+}
+function assertWorkspaceIsolationConsistency(resources) {
+  const workspaceResources = new Map(resources.filter((resource) => resource.kind === "workspace").map((resource) => [resource.name, resource]));
+  for (const resource of resources) {
+    if (resource.kind !== "agent")
+      continue;
+    const config = resource.config;
+    const channels = config.channels;
+    if (channels !== undefined && !Array.isArray(channels)) {
+      throw new Error(`Agent "${resource.name}" config.channels must be an array of channel definitions`);
+    }
+    const channelDefinitions = Array.isArray(channels) ? channels.filter(isChannelDefinition) : [];
+    const channelIds = new Set;
+    for (const channel of channelDefinitions) {
+      const config2 = channel.config;
+      const channelId = typeof config2.id === "string" ? config2.id : undefined;
+      if (channelId) {
+        if (channelIds.has(channelId))
+          throw new Error(`Duplicate channel id: ${channelId}`);
+        channelIds.add(channelId);
+      }
+      if (channel.workspaceScope) {
+        assertWorkspaceScopeShape(channel.workspaceScope, `Agent "${resource.name}" channel "${channel.type}"`);
+      }
+      if (channel.config && typeof channel.config === "object" && "workspaceIsolationScope" in channel.config) {
+        throw new Error(`Agent "${resource.name}" channel "${channel.type}" uses workspaceIsolationScope, which is no longer supported; use workspaceScope.`);
+      }
+    }
+    const attachedWorkspaces = Array.isArray(config.workspaces) ? config.workspaces.map((entry) => resolveLocalWorkspace(entry, workspaceResources)).filter((entry) => Boolean(entry)) : [];
+    const isolatedWorkspaces = attachedWorkspaces.filter((workspace) => workspace.config.isolation === true);
+    const scopedChannels = channelDefinitions.filter((channel) => channel.workspaceScope);
+    if (scopedChannels.length > 0 && isolatedWorkspaces.length === 0) {
+      const channel = scopedChannels[0];
+      throw new Error(`Agent "${resource.name}" channel "${channel.type}" defines workspaceScope, but no attached workspace has isolation: true.`);
+    }
+    if (isolatedWorkspaces.length > 0) {
+      for (const channel of channelDefinitions) {
+        if (!channel.workspaceScope) {
+          throw new Error(`Agent "${resource.name}" attaches isolated workspace "${isolatedWorkspaces[0].name}", but channel "${channel.type}" does not define workspaceScope.`);
+        }
+      }
+    }
+  }
+}
+function assertWorkspaceScopeShape(scope, name) {
+  if (!scope)
+    return;
+  if (scope.level === "channel") {
+    if ("alias" in scope && scope.alias !== undefined) {
+      throw new Error(`${name} workspaceScope.alias is only supported when workspaceScope.level is conversation`);
+    }
+    return;
+  }
+  if (scope.level !== "conversation") {
+    throw new Error(`${name} workspaceScope.level must be one of: channel, conversation`);
+  }
+  if (!("alias" in scope) || typeof scope.alias !== "string" || scope.alias.length === 0) {
+    throw new Error(`${name} workspaceScope.alias must be a non-empty string when workspaceScope.level is conversation`);
+  }
+  if (!/^[A-Za-z0-9._-]+$/.test(scope.alias)) {
+    throw new Error(`${name} workspaceScope.alias must use only letters, numbers, dots, underscores, or hyphens`);
+  }
+}
+function resolveLocalWorkspace(entry, workspaces) {
+  if (isResource(entry) && entry.kind === "workspace")
+    return entry;
+  if (typeof entry === "string")
+    return workspaces.get(entry);
+  if (entry && typeof entry === "object" && "workspace" in entry) {
+    const workspace = entry.workspace;
+    if (isResource(workspace) && workspace.kind === "workspace")
+      return workspace;
+    if (typeof workspace === "string")
+      return workspaces.get(workspace);
+  }
+  return;
+}
 function assertSupportedWorkspaceSandboxMounts(resources) {
   const sandboxes = new Map(resources.filter((resource) => resource.kind === "sandbox").map((resource) => [resource.name, resource]));
   for (const resource of resources) {
@@ -387,7 +508,7 @@ function assertSupportedWorkspaceSandboxMounts(resources) {
       const sandbox = effectiveWorkspaceSandbox(entry, agentSandbox, sandboxes);
       if (!sandbox || supportsS3WorkspaceMount(sandbox))
         continue;
-      throw new Error(`Agent "${resource.name}" workspace "${workspaceName}" uses sandbox "${sandbox.name}" (${sandboxProvider(sandbox)}) which does not support S3 workspace mounts. Use lambda, or daytona/kubernetes with options.mountAwsS3Buckets: true, or set this workspace ref to sandbox: null for read-only S3 access.`);
+      throw new Error(`Agent "${resource.name}" workspace "${workspaceName}" uses sandbox "${sandbox.name}" (${sandboxProvider(sandbox)}) which does not support S3 workspace mounts. Use lambda/sandbox, or daytona with options.mountAwsS3Buckets: true, or set this workspace ref to sandbox: null for read-only S3 access.`);
     }
   }
 }
@@ -421,9 +542,9 @@ function workspaceNameFor(entry) {
 }
 function supportsS3WorkspaceMount(sandbox) {
   const provider = sandboxProvider(sandbox);
-  if (provider === "lambda")
+  if (provider === "lambda" || provider === "sandbox")
     return true;
-  if (provider !== "daytona" && provider !== "kubernetes")
+  if (provider !== "daytona")
     return false;
   const options = sandbox.config.options;
   return Boolean(options && typeof options === "object" && !Array.isArray(options) && options.mountAwsS3Buckets === true);
@@ -499,7 +620,12 @@ function compileChannels(resources, exports) {
       if (aliases.has(alias))
         throw new Error(`Duplicate channel export alias: ${alias}`);
       aliases.add(alias);
-      compiled.push({ alias, type: entry.type, agentName: resource.name });
+      compiled.push({
+        alias,
+        type: entry.type,
+        id: alias,
+        agentName: resource.name
+      });
     }
   }
   for (const [channel, alias] of exportedAliases) {
@@ -514,42 +640,38 @@ function capitalize(value) {
 function isValidIdentifier(value) {
   return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(value);
 }
-async function toManifestResource(resource, projectRoot) {
-  return {
+async function toManifestResources(resource, projectRoot) {
+  if (resource.kind === "agent") {
+    const normalized = normalizeAgentConfig(resource, projectRoot);
+    return [
+      ...normalized.hookResource ? [normalized.hookResource] : [],
+      {
+        kind: resource.kind,
+        name: resource.name,
+        ...resource.description ? { description: resource.description } : {},
+        config: normalized.config
+      }
+    ];
+  }
+  return [{
     kind: resource.kind,
     name: resource.name,
     ...resource.description ? { description: resource.description } : {},
     config: await normalizeConfig(resource, projectRoot)
-  };
+  }];
 }
 async function normalizeConfig(resource, projectRoot) {
-  if (resource.kind === "agent") {
-    const config = { ...resource.config };
-    if (config.channels !== undefined) {
-      if (!Array.isArray(config.channels)) {
-        throw new Error(`Agent "${resource.name}" config.channels must be an array of channel definitions`);
-      }
-      config.channels = Object.fromEntries(config.channels.map((channel) => {
-        if (!isChannelDefinition(channel)) {
-          throw new Error(`Agent "${resource.name}" config.channels must contain channel definitions`);
-        }
-        return [channel.type, channel.config];
-      }));
-    }
-    if (isResource(config.sandbox)) {
-      config.sandbox = config.sandbox.name;
-    }
-    if (Array.isArray(config.workspaces)) {
-      config.workspaces = config.workspaces.map((workspace) => normalizeWorkspaceRef(workspace, resource.name));
-    }
-    return rewriteValues(config);
-  }
   if (resource.kind === "skill") {
     return await normalizeSkillConfig(resource.config, projectRoot);
   }
   if (resource.kind === "tool") {
     return await normalizeToolConfig(resource.config, projectRoot);
   }
+  if (resource.kind === "policy") {
+    const config = { ...resource.config };
+    config.version = config.version ?? 1;
+    return rewriteValues(config);
+  }
   if (resource.kind === "cron") {
     const config = { ...resource.config };
     const agent = config.agent;
@@ -564,6 +686,211 @@ async function normalizeConfig(resource, projectRoot) {
   }
   return rewriteValues(resource.config);
 }
+var KNOWN_PROVIDER_NAMES = ["google", "openai", "anthropic", "bedrock", "gateway", "minimax", "custom"];
+var KNOWN_PROVIDER_SETTING_KEYS = new Set([
+  "apiKey",
+  "base_url",
+  "baseURL",
+  "headers",
+  "organization",
+  "project",
+  "name",
+  "region",
+  "accessKeyId",
+  "secretAccessKey",
+  "sessionToken"
+]);
+function suggestProviderKey(key) {
+  const canonical = key.replace(/[^a-z0-9]/gi, "").toLowerCase();
+  if (canonical === "baseurl")
+    return `"base_url" or "baseURL"`;
+  if (canonical === "apikey")
+    return `"apiKey"`;
+  return "";
+}
+function validateProviderConfig(agentName, provider) {
+  if (provider === undefined || provider === null)
+    return;
+  if (typeof provider !== "object" || Array.isArray(provider)) {
+    throw new Error(`Agent "${agentName}" config.provider must be an object`);
+  }
+  for (const [providerName, settings] of Object.entries(provider)) {
+    if (!KNOWN_PROVIDER_NAMES.includes(providerName)) {
+      throw new Error(`Agent "${agentName}" config.provider.${providerName} is not a supported provider (expected one of: ${KNOWN_PROVIDER_NAMES.join(", ")})`);
+    }
+    if (typeof settings !== "object" || settings === null || Array.isArray(settings)) {
+      throw new Error(`Agent "${agentName}" config.provider.${providerName} must be an object`);
+    }
+    const record = settings;
+    for (const key of Object.keys(record)) {
+      if (KNOWN_PROVIDER_SETTING_KEYS.has(key))
+        continue;
+      const suggestion = suggestProviderKey(key);
+      throw new Error(`Agent "${agentName}" config.provider.${providerName} has unknown option "${key}"${suggestion ? ` \u2014 did you mean ${suggestion}?` : ""}`);
+    }
+    if (providerName === "custom" && record.base_url === undefined && record.baseURL === undefined) {
+      throw new Error(`Agent "${agentName}" config.provider.custom.base_url is required (use "base_url" or "baseURL")`);
+    }
+  }
+}
+function normalizeAgentConfig(resource, _projectRoot) {
+  const config = { ...resource.config };
+  validateProviderConfig(resource.name, config.provider);
+  const inlineHooks = normalizeInlineAgentHooks(resource.name, config.hooks);
+  if (inlineHooks) {
+    config.hooks = inlineHooks.agentHooksConfig;
+  } else if (config.hooks !== undefined) {
+    config.hooks = stripInlineHookKeys(config.hooks, resource.name);
+  }
+  if (config.channels !== undefined) {
+    if (!Array.isArray(config.channels)) {
+      throw new Error(`Agent "${resource.name}" config.channels must be an array of channel definitions`);
+    }
+    config.channels = Object.fromEntries(config.channels.map((channel) => {
+      if (!isChannelDefinition(channel)) {
+        throw new Error(`Agent "${resource.name}" config.channels must contain channel definitions`);
+      }
+      const channelId = `${resource.name}${capitalize(channel.type)}Channel`;
+      return [channel.type, { id: channelId, ...channel.config }];
+    }));
+  }
+  if (isResource(config.sandbox)) {
+    config.sandbox = config.sandbox.name;
+  }
+  if (Array.isArray(config.workspaces)) {
+    config.workspaces = config.workspaces.map((workspace) => normalizeWorkspaceRef(workspace, resource.name));
+  }
+  if (config.policy !== undefined) {
+    const policy = normalizeAgentPolicyConfig(config.policy, resource.name);
+    if (policy)
+      config.policy = policy;
+    else
+      delete config.policy;
+  }
+  return {
+    config: rewriteValues(config),
+    ...inlineHooks?.hookResource ? { hookResource: inlineHooks.hookResource } : {}
+  };
+}
+function normalizeInlineAgentHooks(agentName, hooks) {
+  if (hooks === undefined)
+    return;
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks)) {
+    throw new Error(`Agent "${agentName}" config.hooks must be an object`);
+  }
+  const hookConfig = hooks;
+  const entries = Object.keys(INLINE_AGENT_HOOK_EVENTS).flatMap((name) => {
+    const handler = hookConfig[name];
+    if (handler === undefined)
+      return [];
+    if (typeof handler !== "function") {
+      throw new Error(`Agent "${agentName}" config.hooks.${name} must be a function`);
+    }
+    return [{
+      name,
+      event: INLINE_AGENT_HOOK_EVENTS[name],
+      source: toHookFunctionExpression(handler.toString())
+    }];
+  });
+  if (entries.length === 0)
+    return;
+  const hookName = `${agentName}-hooks`;
+  const bundle = transpileInlineHookBundle(agentName, entries);
+  const bundleSize = Buffer.byteLength(bundle);
+  if (bundleSize > MAX_BUNDLE_FILE_BYTES) {
+    throw new Error(`Agent "${agentName}" hook bundle is too large (${bundleSize} bytes, max ${MAX_BUNDLE_FILE_BYTES})`);
+  }
+  const events = entries.map((entry) => entry.event);
+  const agentHooksConfig = stripInlineHookKeys(hookConfig, agentName);
+  agentHooksConfig.code = [{ hookId: hookName }];
+  return {
+    agentHooksConfig,
+    hookResource: {
+      kind: "hook",
+      name: hookName,
+      description: `Inline hooks for agent ${agentName}`,
+      config: {
+        events,
+        bundle,
+        sha256: sha256Hex(bundle)
+      }
+    }
+  };
+}
+function stripInlineHookKeys(hooks, agentName) {
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks)) {
+    throw new Error(`Agent "${agentName}" config.hooks must be an object`);
+  }
+  const entries = Object.entries(hooks);
+  for (const [key] of entries) {
+    if (key === "webhooks" || key in INLINE_AGENT_HOOK_EVENTS)
+      continue;
+    throw new Error(`Agent "${agentName}" config.hooks.${key} is not supported. Use inline hook callbacks or hooks.webhooks.`);
+  }
+  const result = Object.fromEntries(entries.filter(([key]) => key === "webhooks"));
+  return result;
+}
+function toHookFunctionExpression(source) {
+  const trimmed = source.trim();
+  if (/^(async\s+)?function\b/.test(trimmed) || /^(async\s*)?\(/.test(trimmed) || /^(async\s+)?[A-Za-z_$][\w$]*\s*=>/.test(trimmed)) {
+    return trimmed;
+  }
+  if (/^(async\s+)?[A-Za-z_$][\w$]*\s*\(/.test(trimmed)) {
+    return trimmed.replace(/^(async\s+)?/, "$1function ");
+  }
+  return trimmed;
+}
+function transpileInlineHookBundle(agentName, entries) {
+  const moduleSource = `export default {
+${entries.map((entry) => `  ${JSON.stringify(entry.event)}: ${entry.source},`).join(`
+`)}
+};
+`;
+  try {
+    return new Bun.Transpiler({ loader: "ts" }).transformSync(moduleSource);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Agent "${agentName}" inline hooks failed to transpile: ${message}`);
+  }
+}
+function normalizeAgentPolicyConfig(config, agentName) {
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    throw new Error(`Agent "${agentName}" config.policy must be an object`);
+  }
+  const input = config;
+  for (const key of Object.keys(input)) {
+    if (key !== "enabled" && key !== "policyIds" && key !== "policies" && key !== "mode") {
+      throw new Error(`Agent "${agentName}" config.policy.${key} is not supported`);
+    }
+  }
+  const policyIds = input.policyIds;
+  const policies = input.policies;
+  if (policyIds !== undefined && policies !== undefined) {
+    throw new Error(`Agent "${agentName}" config.policy cannot set both policyIds and policies`);
+  }
+  const refs = policies ?? policyIds;
+  if (refs !== undefined && !Array.isArray(refs)) {
+    throw new Error(`Agent "${agentName}" config.policy.policies must be an array`);
+  }
+  const normalized = {
+    ...input,
+    ...Array.isArray(refs) ? {
+      policyIds: refs.map((entry) => {
+        if (isResource(entry) && entry.kind === "policy")
+          return entry.name;
+        if (typeof entry === "string")
+          return entry;
+        throw new Error(`Agent "${agentName}" config.policy.policies must contain definePolicy(...) resources or strings`);
+      })
+    } : {}
+  };
+  delete normalized.policies;
+  delete normalized.enabled;
+  if (Array.isArray(normalized.policyIds) && normalized.policyIds.length === 0) {
+    delete normalized.policyIds;
+  }
+  return Array.isArray(normalized.policyIds) && normalized.policyIds.length > 0 ? normalized : undefined;
+}
 async function normalizeSkillConfig(config, projectRoot) {
   const skillRoot = resolveContainedResourcePath(projectRoot, config.path, "Skill");
   const manifestPath = relative(projectRoot, skillRoot).split("\\").join("/");
@@ -605,6 +932,7 @@ async function normalizeToolConfig(config, projectRoot) {
     path: manifestPath,
     description: config.description,
     inputSchema: config.inputSchema,
+    ...config.runtime !== undefined ? { runtime: config.runtime } : {},
     ...config.defaultConfig !== undefined ? { defaultConfig: config.defaultConfig } : {},
     bundle,
     sha256: sha256Hex(bundle)
@@ -743,7 +1071,8 @@ function idsForManifest(ids, manifest) {
     sandboxes: namesForKind(manifest, "sandbox"),
     crons: namesForKind(manifest, "cron"),
     skills: namesForKind(manifest, "skill"),
-    tools: namesForKind(manifest, "tool")
+    tools: namesForKind(manifest, "tool"),
+    policies: namesForKind(manifest, "policy")
   };
   return {
     agents: pickIds(ids.agents, namesByKind.agents),
@@ -751,14 +1080,16 @@ function idsForManifest(ids, manifest) {
     sandboxes: pickIds(ids.sandboxes, namesByKind.sandboxes),
     crons: pickIds(ids.crons, namesByKind.crons),
     skills: pickIds(ids.skills, namesByKind.skills),
-    tools: pickIds(ids.tools, namesByKind.tools)
+    tools: pickIds(ids.tools, namesByKind.tools),
+    hooks: {},
+    policies: pickIds(ids.policies, namesByKind.policies)
   };
 }
 function namesForKind(manifest, kind) {
   return new Set(manifest.resources.filter((resource) => resource.kind === kind).map((resource) => resource.name));
 }
 function pickIds(values, names) {
-  return Object.fromEntries(Object.entries(values).filter(([name]) => names.has(name)));
+  return Object.fromEntries(Object.entries(values ?? {}).filter(([name]) => names.has(name)));
 }
 function idsFile(ids) {
   return `// Generated by broods. Do not edit by hand.
@@ -769,6 +1100,7 @@ function idsFile(ids) {
 ` + `export const crons = ids.crons;
 ` + `export const skills = ids.skills;
 ` + `export const tools = ids.tools;
+` + `export const policies = ids.policies;
 `;
 }
 function resourcesFile(manifest) {
@@ -803,6 +1135,7 @@ ${channelEntries}
 ` + `  crons: ${aliasedIdMap("crons", ids.crons, aliases.cron)},
 ` + `  skills: ${aliasedIdMap("skills", ids.skills, aliases.skill)},
 ` + `  tools: ${aliasedIdMap("tools", ids.tools, aliases.tool)},
+` + `  policies: ${aliasedIdMap("policies", ids.policies, aliases.policy)},
 ` + `} as const satisfies ResourceApi;
 `;
 }
@@ -827,11 +1160,11 @@ function dataModelFile() {
 
 // src/sync.ts
 class BroodsSyncClient {
-  dashboardUrl;
+  baseUrl;
   token;
   fetchImpl;
   constructor(options) {
-    this.dashboardUrl = stripTrailingSlash(options.dashboardUrl);
+    this.baseUrl = stripTrailingSlash(options.baseUrl);
     this.token = options.token;
     this.fetchImpl = options.fetch ?? fetch;
   }
@@ -859,7 +1192,13 @@ class BroodsSyncClient {
     const payload = await response.json();
     if (!payload.apiKey)
       throw new Error("Fetch runtime key failed: response omitted apiKey");
-    return { apiKey: payload.apiKey, keyHint: payload.keyHint ?? "" };
+    return {
+      apiKey: payload.apiKey,
+      keyHint: payload.keyHint ?? "",
+      ...payload.endpointId ? { endpointId: payload.endpointId } : {},
+      ...payload.projectSlug ? { projectSlug: payload.projectSlug } : {},
+      ...payload.environmentSlug ? { environmentSlug: payload.environmentSlug } : {}
+    };
   }
   async setEnv(project, environment, name, value) {
     const response = await this.request(project, environment, `/env/${encodeURIComponent(name)}`, {
@@ -890,7 +1229,7 @@ class BroodsSyncClient {
     await assertOk(response, "Remove environment variable failed");
   }
   async getOnboarding() {
-    const response = await this.fetchImpl(`${this.dashboardUrl}/api/cli/onboarding`, {
+    const response = await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`, {
       method: "GET",
       headers: {
         Authorization: `Bearer ${this.token}`
@@ -900,7 +1239,7 @@ class BroodsSyncClient {
     return await response.json();
   }
   async selectOnboardingOrg(orgId) {
-    const response = await this.fetchImpl(`${this.dashboardUrl}/api/cli/onboarding`, {
+    const response = await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${this.token}`,
@@ -911,8 +1250,20 @@ class BroodsSyncClient {
     await assertOk(response, "Select CLI org failed");
     return await response.json();
   }
+  async createOnboardingOrg(name) {
+    const response = await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ createOrgName: name })
+    });
+    await assertOk(response, "Create CLI org failed");
+    return await response.json();
+  }
   async request(project, environment, suffix, init) {
-    const url = `${this.dashboardUrl}/api/cli/projects/${encodeURIComponent(project)}` + `/environments/${encodeURIComponent(environment)}${suffix}`;
+    const url = `${this.baseUrl}/v1/account/projects/${encodeURIComponent(project)}` + `/environments/${encodeURIComponent(environment)}${suffix}`;
     return await this.fetchImpl(url, {
       ...init,
       headers: {
@@ -970,7 +1321,7 @@ function diffManifests(local, remote) {
 }
 function snapshotResource(resource) {
   const normalized = normalizeEnvRefs(resource);
-  if (resource.kind !== "skill" && resource.kind !== "tool")
+  if (resource.kind !== "skill" && resource.kind !== "tool" && resource.kind !== "hook")
     return normalized;
   return {
     ...normalized,
@@ -983,7 +1334,7 @@ function renameSnapshot(resource) {
   return rest;
 }
 function isRenamableKind(kind) {
-  return kind === "agent" || kind === "workspace" || kind === "sandbox";
+  return kind === "agent" || kind === "workspace" || kind === "sandbox" || kind === "policy";
 }
 function diffSortKey(entry) {
   const rank = {
@@ -1093,7 +1444,7 @@ class BroodsClient {
       const name = refOrName;
       const id = agentId ?? "";
       if (!id)
-        throw new Error(`Agent ${name} is missing a generated id. Run broods deploy first.`);
+        throw new Error(`Agent ${name} is missing a generated id. Run broods dev --once or broods deploy to sync it first.`);
       return {
         id,
         run: (input) => this.run({ ...input, agentName: name, agentId: id }),
@@ -1103,7 +1454,7 @@ class BroodsClient {
     }
     const ref = refOrName;
     if (!ref.id)
-      throw new Error(`Agent ${ref.name} is missing a generated id. Run broods deploy first.`);
+      throw new Error(`Agent ${ref.name} is missing a generated id. Run broods dev --once or broods deploy to sync it first.`);
     return {
       id: ref.id,
       run: (input) => this.run(ref, input),
@@ -1154,7 +1505,8 @@ class BroodsClient {
       agentName: refOrInput.name
     } : refOrInput;
     const body = directRunBody(input, "async");
-    const response = await this.fetchJson(`${this.baseUrl}/async`, {
+    const targetUrl = maybeInput ? this.scopedUrl(refOrInput, "/async") : `${this.baseUrl}/async`;
+    const response = await this.fetchJson(targetUrl, {
       method: "POST",
       headers: this.apiKeyHeaders(),
       body: JSON.stringify(body)
@@ -1197,7 +1549,7 @@ class BroodsClient {
     throw new Error("Polling timeout");
   }
   async createCron(input) {
-    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons`, {
+    const response = await this.fetchJson(`${this.baseUrl}/v1/crons`, {
       method: "POST",
       headers: this.apiKeyHeaders(),
       body: JSON.stringify(resolveCronInput(input))
@@ -1207,7 +1559,7 @@ class BroodsClient {
     return await response.json();
   }
   async listCrons() {
-    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons`, {
+    const response = await this.fetchJson(`${this.baseUrl}/v1/crons`, {
       method: "GET",
       headers: this.apiKeyHeaders()
     });
@@ -1217,7 +1569,7 @@ class BroodsClient {
     return payload.crons;
   }
   async getCron(cronId) {
-    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons/${encodeURIComponent(cronId)}`, {
+    const response = await this.fetchJson(`${this.baseUrl}/v1/crons/${encodeURIComponent(cronId)}`, {
       method: "GET",
       headers: this.apiKeyHeaders()
     });
@@ -1232,7 +1584,7 @@ class BroodsClient {
     if (options.limit !== undefined)
       params.set("limit", String(options.limit));
     const suffix = params.size > 0 ? `?${params}` : "";
-    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons/${encodeURIComponent(cronId)}/runs${suffix}`, {
+    const response = await this.fetchJson(`${this.baseUrl}/v1/crons/${encodeURIComponent(cronId)}/runs${suffix}`, {
       method: "GET",
       headers: this.apiKeyHeaders()
     });
@@ -1242,7 +1594,7 @@ class BroodsClient {
     return payload.runs;
   }
   async updateCron(cronId, patch) {
-    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons/${encodeURIComponent(cronId)}`, {
+    const response = await this.fetchJson(`${this.baseUrl}/v1/crons/${encodeURIComponent(cronId)}`, {
       method: "PATCH",
       headers: this.apiKeyHeaders(),
       body: JSON.stringify(patch)
@@ -1252,7 +1604,7 @@ class BroodsClient {
     return await response.json();
   }
   async deleteCron(cronId) {
-    const response = await this.fetchJson(`${this.baseUrl}/accounts/me/crons/${encodeURIComponent(cronId)}`, {
+    const response = await this.fetchJson(`${this.baseUrl}/v1/crons/${encodeURIComponent(cronId)}`, {
       method: "DELETE",
       headers: this.apiKeyHeaders()
     });
@@ -1263,11 +1615,11 @@ class BroodsClient {
     const payload = await response.json();
     return payload.deleted;
   }
-  scopedUrl(ref) {
+  scopedUrl(ref, suffix = "") {
     if (ref.projectSlug && ref.environmentSlug && ref.endpointId) {
-      return `${this.baseUrl}/v1/${encodeURIComponent(ref.projectSlug)}` + `/agents/${encodeURIComponent(ref.environmentSlug)}/${encodeURIComponent(ref.endpointId)}`;
+      return `${this.baseUrl}/v1/${encodeURIComponent(ref.projectSlug)}` + `/agents/${encodeURIComponent(ref.environmentSlug)}/${encodeURIComponent(ref.endpointId)}${suffix}`;
     }
-    return this.baseUrl;
+    return `${this.baseUrl}${suffix}`;
   }
   async openStream(body, targetUrl) {
     if (this.apiKey) {
@@ -1424,7 +1776,6 @@ function formatStreamError(error) {
 var DEFAULT_CONNECT_TIMEOUT_MS = 2000;
 var WS_CONNECTING = 0;
 var WS_OPEN = 1;
-var LAMBDA_FUNCTION_URL_HOST_RE = /\.lambda-url\.[a-z0-9-]+\.on\.aws$/i;
 
 class BroodsWebSocketClient {
   baseUrl;
@@ -1433,7 +1784,7 @@ class BroodsWebSocketClient {
   connectTimeoutMs;
   constructor(options = {}) {
     loadBroodsRuntimeConfig();
-    this.baseUrl = normalizeWebSocketServiceUrl(options.baseUrl || process.env.BROODS_WEBSOCKET_URL || options.host || process.env.BROODS_BASE_URL || process.env.BROODS_HOST || DEFAULT_CORE_BASE_URL);
+    this.baseUrl = normalizeWebSocketServiceUrl(options.baseUrl || options.host || process.env.BROODS_BASE_URL || process.env.BROODS_HOST || DEFAULT_CORE_BASE_URL);
     this.apiKey = options.apiKey || process.env.BROODS_API_KEY || "";
     if (!this.apiKey)
       throw new Error("BroodsWebSocketClient requires apiKey or BROODS_API_KEY.");
@@ -1615,10 +1966,6 @@ function normalizeWebSocketServiceUrl(value) {
   return normalizeHttpServiceUrl(trimmed);
 }
 function webSocketAccessError(baseUrl) {
-  const host = new URL(baseUrl).hostname;
-  if (LAMBDA_FUNCTION_URL_HOST_RE.test(host)) {
-    return new Error(`Cannot access the WebSocket service at ${baseUrl}. AWS Lambda Function URLs do not support WebSocket upgrades; ` + "set BROODS_WEBSOCKET_URL or BROODS_HOST to the deployed WebSocket gateway URL instead.");
-  }
   return new Error(`Cannot access the WebSocket service at ${baseUrl}.`);
 }
 function parseServerMessage(data) {
@@ -1690,6 +2037,7 @@ async function* subscribeObservabilityLogs(options, subscribeOptions = {}) {
 async function* subscribeObservabilityLogsOnce(options, subscribeOptions) {
   const { baseUrl, apiKey, project, environment } = options;
   const { backfill = 0, minLevel, signal } = subscribeOptions;
+  const liveOnly = subscribeOptions.liveOnly ?? backfill <= 0;
   if (signal?.aborted)
     return;
   const url = buildObservabilityUrl(baseUrl, project, environment, apiKey);
@@ -1725,6 +2073,7 @@ async function* subscribeObservabilityLogsOnce(options, subscribeOptions) {
       type: "subscribe",
       stream: "logs",
       ...backfill > 0 ? { backfill } : {},
+      ...liveOnly ? { liveOnly: true } : {},
       ...minLevel !== undefined ? { minLevel } : {}
     };
     socket.send(JSON.stringify(msg));
@@ -1814,13 +2163,19 @@ function optionValue(args, name) {
 function hasFlag(args, name) {
   return args.includes(name);
 }
-async function requireAuth(dashboardUrl) {
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function requireAuth(baseUrl) {
   loadBroodsRuntimeConfig();
   const auth = await readStoredAuth();
   if (!auth) {
-    throw new Error("Run `broods login` first, or set BROODS_TOKEN and BROODS_DASHBOARD_URL.");
+    throw new Error("Run `broods login` first, or set BROODS_TOKEN and BROODS_BASE_URL.");
   }
-  return dashboardUrl ? { ...auth, dashboardUrl } : auth;
+  return {
+    ...auth,
+    ...baseUrl ? { baseUrl: stripTrailingSlash(baseUrl) } : {}
+  };
 }
 async function promptSecret(label) {
   const rl = createInterface({ input, output });
@@ -1893,17 +2248,18 @@ async function loginWithBrowser(dashboardUrl) {
     await assertCliAuthRouteExists(startUrl);
     openBrowser(startUrl);
     console.log(`Opening ${startUrl}`);
-    const loginCode = await waitWithTimeout(code.promise, LOGIN_TIMEOUT_MS);
-    const response = await fetch(`${stripTrailingSlash(dashboardUrl)}/api/cli/auth/exchange`, {
+    const login = await waitWithTimeout(code.promise, LOGIN_TIMEOUT_MS);
+    const response = await fetch(`${login.baseUrl}/v1/account/auth/exchange`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ code: loginCode })
+      body: JSON.stringify({ code: login.code })
     });
     if (!response.ok) {
       throw new Error(`Login exchange failed: ${response.status} ${await response.text()}`);
     }
     const payload = await response.json();
     const auth = {
+      baseUrl: login.baseUrl,
       dashboardUrl: stripTrailingSlash(dashboardUrl),
       token: payload.token,
       createdAt: new Date().toISOString(),
@@ -1937,12 +2293,21 @@ function waitForCallback(expectedState) {
         const url = new URL(req.url ?? "/", "http://127.0.0.1");
         const state = url.searchParams.get("state");
         const code = url.searchParams.get("code");
+        const baseUrl = url.searchParams.get("base_url");
         if (state !== expectedState || !code) {
           res.writeHead(400).end("Invalid broods login callback.");
           return;
         }
+        if (!baseUrl) {
+          res.writeHead(400).end("Login callback omitted base_url; update the dashboard deployment.");
+          callbackReject(new Error("Login callback did not advertise the API base URL (base_url). " + "Deploy a dashboard build that includes the Convex-direct CLI auth flow."));
+          return;
+        }
         res.writeHead(200, { "Content-Type": "text/plain" }).end("broods CLI login complete. You can close this tab.");
-        callbackResolve(code);
+        callbackResolve({
+          code,
+          baseUrl: stripTrailingSlash(baseUrl)
+        });
       } catch (error) {
         callbackReject(error);
       }
@@ -2230,7 +2595,7 @@ function renderStreamPart(part, state) {
 // package.json
 var package_default = {
   name: "broods",
-  version: "0.1.1",
+  version: "0.2.1",
   description: "CLI + TypeScript SDK for the broods agent platform.",
   type: "module",
   license: "MIT",
@@ -2272,12 +2637,20 @@ var package_default = {
     "pack:check": "bun run build && npm pack --dry-run",
     test: "bun test"
   },
+  engines: {
+    node: ">=22"
+  },
   dependencies: {
-    ai: "^6.0.195"
+    "@chat-adapter/discord": "^4.31.0",
+    "@chat-adapter/github": "^4.31.0",
+    "@chat-adapter/slack": "^4.31.0",
+    "@chat-adapter/telegram": "^4.31.0",
+    ai: "^7.0.11"
   },
   devDependencies: {
     "@types/bun": "^1.3.14",
     rollup: "^4.53.3",
+    typescript: "^6.0.3",
     "rollup-plugin-dts": "^6.3.0"
   }
 };
@@ -2285,6 +2658,12 @@ var package_default = {
 // src/cli/index.ts
 var VERSION = package_default.version;
 var DEFAULT_DASHBOARD_URL = "https://dashboard.broods.app";
+var DEFAULT_SERVICE_REGION = "eu-west-1";
+var SERVICE_REGIONS = [
+  { region: "eu-west-1", label: "eu-west-1 (Ireland)" },
+  { region: "us-east-1", label: "us-east-1 (US East)" },
+  { region: "ap-southeast-1", label: "ap-southeast-1 (Singapore)" }
+];
 var HELP = `broods v${VERSION}
 
 Usage: broods <command>
@@ -2310,13 +2689,15 @@ Commands:
   run <agent> <prompt> Run an agent once and pretty-stream the result (thinking, tool calls, text)
 
 Options:
-  --dashboard-url <url> Dashboard base URL (default: ${DEFAULT_DASHBOARD_URL})
+  --dashboard-url <url> Dashboard base URL for login and deep links (default: ${DEFAULT_DASHBOARD_URL})
+  --base-url <url>      broods API base URL for sync/env calls (default: discovered at login)
   --project <name>      Project name override (default: package name or folder)
   --env <name>          Target environment override
+  --region <region>     Broods service region preference (default: ${DEFAULT_SERVICE_REGION})
   --prune               Allow deploy to delete undeclared remote resources
   --rotate-key          Mint a fresh runtime API key on deploy and write it to .env.local
-  --errors              Show WARN/ERROR only (with \`stream\` and \`logs\`)
-  --level <lvl>         Minimum log level INFO|WARN|ERROR (with \`stream\` and \`logs\`)
+  --errors              Show WARN/ERROR only (default for \`dev\`, \`stream\`, and \`logs\`)
+  --level <lvl>         Minimum log level INFO|WARN|ERROR (default WARN)
   -n, --limit <n>       Backfill line count (with \`logs\`, default 100)
   --json                Print logs as raw JSON (with \`logs\`, applies to backfill output)
   --force               Allow init to overwrite starter files`;
@@ -2380,6 +2761,7 @@ async function init(args) {
     dashboardUrl: optionValue(args, "--dashboard-url") ?? DEFAULT_DASHBOARD_URL,
     project: optionValue(args, "--project") ?? inferProjectName(process.cwd()),
     environment: optionValue(args, "--env") ?? "development",
+    region: optionValue(args, "--region") ?? DEFAULT_SERVICE_REGION,
     force
   });
   console.log(`Created ${PROJECT_DIR}/`);
@@ -2395,9 +2777,10 @@ async function login(args) {
   const project = optionValue(args, "--project") ?? process.env.BROODS_PROJECT ?? inferProjectName(process.cwd());
   const environment = optionValue(args, "--env") ?? process.env.BROODS_ENVIRONMENT ?? "development";
   await writeLocalEnvDefaults({
-    dashboardUrl: auth.dashboardUrl,
+    dashboardUrl: auth.dashboardUrl ?? dashboardUrl,
     project,
     environment,
+    region: optionValue(args, "--region") ?? process.env.BROODS_REGION ?? DEFAULT_SERVICE_REGION,
     force: false
   });
   const user = auth.user?.email || auth.user?.name || auth.user?.authId;
@@ -2410,11 +2793,11 @@ async function login(args) {
     console.log(`Org: ${org}`);
   if (account)
     console.log(`Account: ${account}`);
-  await writeRuntimeKeyForLogin(auth.dashboardUrl, auth.token, project, environment);
+  await writeRuntimeKeyForLogin(auth.baseUrl, auth.token, project, environment);
 }
-async function writeRuntimeKeyForLogin(dashboardUrl, token, project, environment) {
+async function writeRuntimeKeyForLogin(baseUrl, token, project, environment) {
   try {
-    const client = new BroodsSyncClient({ dashboardUrl, token });
+    const client = new BroodsSyncClient({ baseUrl, token });
     const key = await client.getRuntimeKey(project, environment);
     if (key?.apiKey) {
       await writeEnvValue("BROODS_API_KEY", key.apiKey);
@@ -2428,8 +2811,8 @@ async function diff(args) {
     environment: optionValue(args, "--env"),
     command: "dev"
   });
-  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
-  const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+  const auth = await requireAuth(optionValue(args, "--base-url") ?? config.baseUrl);
+  const client = new BroodsSyncClient({ baseUrl: auth.baseUrl, token: auth.token });
   const remote = await client.getManifest(manifest.project, manifest.environment);
   printDiffEntries(diffManifests(manifest, remote?.manifest ?? null));
 }
@@ -2440,8 +2823,8 @@ async function deploy(args) {
     command: "deploy",
     useRuntimeEnvironment: false
   });
-  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
-  const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+  const auth = await requireAuth(optionValue(args, "--base-url") ?? config.baseUrl);
+  const client = new BroodsSyncClient({ baseUrl: auth.baseUrl, token: auth.token });
   const result = await client.putManifest(manifest, hasFlag(args, "--prune"), hasFlag(args, "--rotate-key"));
   await writeGeneratedFiles(manifest, result.ids, process.cwd(), resourceAliases, result.deployment, channels);
   await ensureGitIgnore();
@@ -2461,11 +2844,15 @@ async function applyDeploymentKey(deployment) {
 }
 function printSyncWarnings(result) {
   const missing = result.warnings?.missingEnv ?? [];
-  if (missing.length === 0)
-    return;
-  printWarning(`\u26A0 ${missing.length} env var(s) referenced in agent config but not set: ${missing.join(", ")}`);
-  for (const name of missing)
-    console.log(`    broods env set ${name}`);
+  if (missing.length > 0) {
+    printWarning(`\u26A0 ${missing.length} env var(s) referenced in agent config but not set: ${missing.join(", ")}`);
+    for (const name of missing)
+      console.log(`    broods env set ${name}`);
+  }
+  const missingPolicies = result.warnings?.missingPolicies ?? [];
+  if (missingPolicies.length > 0) {
+    printWarning(`\u26A0 ${missingPolicies.length} policy ref(s) in agent config match no policy resource ` + `in this deploy and will be ignored at runtime: ${missingPolicies.join(", ")}`);
+  }
 }
 async function dev(args) {
   await ensureDevOnboarding(args);
@@ -2482,7 +2869,8 @@ async function dev(args) {
   const childEnv = {
     ...process.env,
     BROODS_DECLINED_FILE: declinedFile,
-    BROODS_SUPPRESS_DEV_TARGET: "1"
+    BROODS_SUPPRESS_DEV_TARGET: "1",
+    BROODS_RELOAD_ENV: "1"
   };
   await printDevTarget(args);
   await runSyncChild(args, childEnv);
@@ -2528,7 +2916,7 @@ async function streamDevLogs(args, signal) {
   try {
     creds = resolveObservabilityCredentials();
   } catch {
-    console.log("\xB7 live logs off \u2014 set BROODS_API_KEY (run `deploy` first) to stream agent logs here");
+    console.log("\xB7 live logs off \u2014 no runtime key found for this environment yet. Run `broods dev --once` after login to create or reconnect it.");
     return;
   }
   let project;
@@ -2573,27 +2961,25 @@ async function ensureLocalDevDefaults(args) {
   const missing = [
     "BROODS_DASHBOARD_URL",
     "BROODS_PROJECT",
-    "BROODS_ENVIRONMENT"
+    "BROODS_ENVIRONMENT",
+    "BROODS_REGION"
   ].filter((key) => values[key] === undefined);
   if (missing.length === 0)
     return;
   const needsProject = values.BROODS_PROJECT === undefined;
   const needsEnvironment = values.BROODS_ENVIRONMENT === undefined;
+  const needsRegion = values.BROODS_REGION === undefined;
   const runtime = loadBroodsRuntimeConfig();
   const dashboardUrl = optionValue(args, "--dashboard-url") ?? runtime.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
   let project = optionValue(args, "--project") ?? process.env.BROODS_PROJECT ?? inferProjectName(process.cwd());
   let environment = optionValue(args, "--env") ?? process.env.BROODS_ENVIRONMENT ?? "development";
+  let region = optionValue(args, "--region") ?? process.env.BROODS_REGION ?? DEFAULT_SERVICE_REGION;
   if (process.stdin.isTTY && needsProject) {
     const auth = await requireAuthOrLogin(dashboardUrl);
-    const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+    const client = new BroodsSyncClient({ baseUrl: auth.baseUrl, token: auth.token });
     const context = await getOnboardingContextOrFallback(client, auth);
-    const selectableOrgs = context.orgs.filter((org) => org.accountStatus === "active");
-    if (selectableOrgs.length === 0) {
-      throw new Error("No selectable org has an active API account. Open Settings -> API Access in the dashboard first.");
-    }
-    const selectedOrg = await promptSelect("Select organization", selectableOrgs, formatOrgChoice);
-    const selectedContext = selectedOrg.id === context.currentOrgId ? context : await client.selectOnboardingOrg(selectedOrg.id);
-    project = await promptText("Project name", defaultProjectName(selectedContext, project));
+    const selectedContext = await selectOnboardingOrg(client, context);
+    project = await selectOnboardingProject(selectedContext, project);
     if (!project.trim())
       throw new Error("Project name is required.");
   }
@@ -2602,16 +2988,20 @@ async function ensureLocalDevDefaults(args) {
     if (!environment.trim())
       throw new Error("Environment is required.");
   }
+  if (process.stdin.isTTY && needsRegion) {
+    region = await promptSelect("Select service region", [...SERVICE_REGIONS], (entry) => entry.label).then((entry) => entry.region);
+  }
   await writeLocalEnvDefaults({
     dashboardUrl,
     project,
     environment,
+    region,
     force: false
   });
 }
 async function requireAuthOrLogin(dashboardUrl) {
   try {
-    return await requireAuth(dashboardUrl);
+    return await requireAuth();
   } catch (error) {
     if (!process.stdin.isTTY)
       throw error;
@@ -2643,10 +3033,37 @@ function formatOrgChoice(org) {
   const suffix = org.role === "owner" || org.role === "admin" ? org.role : "member";
   return `${org.name} (${org.slug}, ${suffix})`;
 }
+async function selectOnboardingOrg(client, context) {
+  const activeOrgs = context.orgs.filter((org) => org.accountStatus === "active");
+  const createNew = { kind: "create", name: "New organization" };
+  const selected = await promptSelect("Select organization", [...activeOrgs, createNew], (entry) => ("kind" in entry) ? "Create new organization" : formatOrgChoice(entry));
+  if ("kind" in selected) {
+    const name = await promptText("Organization name", inferProjectName(process.cwd()));
+    if (!name.trim())
+      throw new Error("Organization name is required.");
+    return await client.createOnboardingOrg(name);
+  }
+  return selected.id === context.currentOrgId ? context : await client.selectOnboardingOrg(selected.id);
+}
 function defaultProjectName(context, inferred) {
   const exact = context.projects.find((project) => project.name === inferred || project.slug === inferred);
   return exact?.name ?? inferred;
 }
+async function selectOnboardingProject(context, inferred) {
+  if (context.projects.length === 0) {
+    return promptText("Project name", inferred);
+  }
+  const createNew = { kind: "create", name: defaultProjectName(context, inferred), slug: "" };
+  const choices = [
+    ...context.projects,
+    createNew
+  ];
+  const selected = await promptSelect("Select project", choices, (entry) => ("kind" in entry) && entry.kind === "create" ? `Create new project (${entry.name})` : `${entry.name} (${entry.slug})`);
+  if ("kind" in selected && selected.kind === "create") {
+    return promptText("New project name", selected.name);
+  }
+  return selected.name;
+}
 function runSyncChild(args, env3) {
   return new Promise((resolvePromise, reject) => {
     const entryPoint = process.argv[1] ?? "";
@@ -2670,12 +3087,12 @@ async function syncDev(args) {
     environment: optionValue(args, "--env"),
     command: "dev"
   });
-  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
-  const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+  const auth = await requireAuth(optionValue(args, "--base-url") ?? config.baseUrl);
+  const client = new BroodsSyncClient({ baseUrl: auth.baseUrl, token: auth.token });
   const remote = await client.getManifest(manifest.project, manifest.environment);
   const diff2 = diffManifests(manifest, remote?.manifest ?? null);
   printDiffEntries(diff2.filter((entry) => entry.operation !== "delete"));
-  await syncLocalEnvVars(client, manifest);
+  await syncLocalEnvVars(client, manifest, envSyncScopeKey(auth.baseUrl, auth.token));
   let result = await client.putManifest(manifest, false);
   await writeGeneratedFiles(manifest, result.ids, process.cwd(), resourceAliases, result.deployment, channels);
   await ensureGitIgnore();
@@ -2725,7 +3142,7 @@ function printChannelEndpoints(channels, result) {
     console.log(`Channel ${channel.alias} (${channel.type}): ${url}${channel.type === "pancake" ? "?secret=<PANCAKE_WEBHOOK_SECRET>" : ""}`);
   }
 }
-async function syncLocalEnvVars(client, manifest) {
+async function syncLocalEnvVars(client, manifest, scopeKey) {
   const present = collectEnvRefNames(manifest).filter((name) => {
     const value = process.env[name];
     return !name.startsWith("BROODS_") && value !== undefined && value !== "";
@@ -2733,19 +3150,23 @@ async function syncLocalEnvVars(client, manifest) {
   if (present.length === 0)
     return;
   const cache = await loadEnvSyncCache();
-  const known = cache[envCacheKey(manifest.project, manifest.environment)] ?? {};
-  const changed = present.filter((name) => known[name] !== hashEnvValue(process.env[name]));
+  const known = cache[envCacheKey(scopeKey, manifest.project, manifest.environment)] ?? {};
+  const remoteNames = new Set((await client.listEnv(manifest.project, manifest.environment)).map((entry) => entry.name));
+  const changed = present.filter((name) => !remoteNames.has(name) || known[name] !== hashEnvValue(process.env[name]));
   if (changed.length === 0)
     return;
   await Promise.all(changed.map((name) => client.setEnv(manifest.project, manifest.environment, name, process.env[name])));
   for (const name of changed)
     known[name] = hashEnvValue(process.env[name]);
-  cache[envCacheKey(manifest.project, manifest.environment)] = known;
+  cache[envCacheKey(scopeKey, manifest.project, manifest.environment)] = known;
   await saveEnvSyncCache(cache);
   printEnvSync(changed);
 }
-function envCacheKey(project, environment) {
-  return `${project}:${environment}`;
+function envSyncScopeKey(baseUrl, token) {
+  return `${baseUrl}:${createHash2("sha256").update(token).digest("hex").slice(0, 16)}`;
+}
+function envCacheKey(scopeKey, project, environment) {
+  return `${scopeKey}:${project}:${environment}`;
 }
 function envSyncCachePath() {
   return resolve4(dirname2(USER_CONFIG_PATH), "env-sync.json");
@@ -2770,15 +3191,15 @@ async function saveEnvSyncCache(cache) {
   await writeFile3(path, `${JSON.stringify(cache, null, 2)}
 `, "utf8");
 }
-async function rememberEnvSyncValue(project, environment, name, value) {
+async function rememberEnvSyncValue(scopeKey, project, environment, name, value) {
   const cache = await loadEnvSyncCache();
-  const key = envCacheKey(project, environment);
+  const key = envCacheKey(scopeKey, project, environment);
   cache[key] = { ...cache[key] ?? {}, [name]: hashEnvValue(value) };
   await saveEnvSyncCache(cache);
 }
-async function forgetEnvSyncValue(project, environment, name) {
+async function forgetEnvSyncValue(scopeKey, project, environment, name) {
   const cache = await loadEnvSyncCache();
-  const key = envCacheKey(project, environment);
+  const key = envCacheKey(scopeKey, project, environment);
   if (!cache[key] || !(name in cache[key]))
     return;
   delete cache[key][name];
@@ -2790,11 +3211,11 @@ async function printDevTarget(args) {
     environment: optionValue(args, "--env"),
     command: "dev"
   });
-  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
+  const auth = await requireAuth(optionValue(args, "--base-url") ?? config.baseUrl);
   printDeploymentTarget({
     project: manifest.project,
     environment: manifest.environment,
-    dashboardUrl: auth.dashboardUrl
+    dashboardUrl: auth.dashboardUrl ?? DEFAULT_DASHBOARD_URL
   });
 }
 async function loadDeclinedDeletes() {
@@ -2833,8 +3254,9 @@ async function envCommand(args) {
     environment: optionValue(args, "--env"),
     command: "dev"
   });
-  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
-  const client = new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token });
+  const auth = await requireAuth(optionValue(args, "--base-url") ?? config.baseUrl);
+  const client = new BroodsSyncClient({ baseUrl: auth.baseUrl, token: auth.token });
+  const scopeKey = envSyncScopeKey(auth.baseUrl, auth.token);
   const target = `${manifest.project}/${manifest.environment}`;
   if (isList) {
     const variables = await client.listEnv(manifest.project, manifest.environment);
@@ -2859,13 +3281,13 @@ async function envCommand(args) {
   }
   if (isRemove) {
     await client.removeEnv(manifest.project, manifest.environment, name);
-    await forgetEnvSyncValue(manifest.project, manifest.environment, name);
+    await forgetEnvSyncValue(scopeKey, manifest.project, manifest.environment, name);
     console.log(`Removed ${name} from ${target}`);
     return;
   }
   const value = await promptSecret(name);
   await client.setEnv(manifest.project, manifest.environment, name, value);
-  await rememberEnvSyncValue(manifest.project, manifest.environment, name, value);
+  await rememberEnvSyncValue(scopeKey, manifest.project, manifest.environment, name, value);
   console.log(`Stored ${name} for ${target}`);
 }
 function resolveObservabilityCredentials() {
@@ -2882,7 +3304,7 @@ function resolveMinLevel(args) {
     return "WARN";
   const raw = optionValue(args, "--level");
   if (!raw)
-    return;
+    return "WARN";
   const upper = raw.toUpperCase();
   if (upper === "WARN" || upper === "WARNING")
     return "WARN";
@@ -2975,8 +3397,8 @@ async function loadAgentsWithIds(args) {
     environment: optionValue(args, "--env"),
     command: "dev"
   });
-  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
-  const remote = await new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token }).getManifest(manifest.project, manifest.environment);
+  const auth = await requireAuth(optionValue(args, "--base-url") ?? config.baseUrl);
+  const remote = await new BroodsSyncClient({ baseUrl: auth.baseUrl, token: auth.token }).getManifest(manifest.project, manifest.environment);
   const agents = manifest.resources.filter((resource) => resource.kind === "agent").map((resource) => ({
     name: resource.name,
     config: resource.config ?? {},
@@ -3008,10 +3430,10 @@ async function agentGet(name, args) {
   const config = agent.config;
   const sandbox = typeof config.sandbox === "string" ? config.sandbox : undefined;
   const workspaces = Array.isArray(config.workspaces) ? config.workspaces.map((ref) => typeof ref === "string" ? ref : ref.name).filter(Boolean) : [];
-  const tools = isRecord(config.tools) ? Object.keys(config.tools) : [];
-  const channels = isRecord(config.channels) ? Object.keys(config.channels) : [];
-  const subagents = isRecord(config.subagent) && Array.isArray(config.subagent.allowed) ? config.subagent.allowed.map((entry) => typeof entry === "string" ? entry : entry.name).filter(Boolean) : [];
-  const webhooks = isRecord(config.hooks) && Array.isArray(config.hooks.webhooks) ? config.hooks.webhooks.filter(isRecord) : [];
+  const tools = isPlainObject(config.tools) ? Object.keys(config.tools) : [];
+  const channels = isPlainObject(config.channels) ? Object.keys(config.channels) : [];
+  const subagents = isPlainObject(config.subagent) && Array.isArray(config.subagent.allowed) ? config.subagent.allowed.map((entry) => typeof entry === "string" ? entry : entry.name).filter(Boolean) : [];
+  const webhooks = isPlainObject(config.hooks) && Array.isArray(config.hooks.webhooks) ? config.hooks.webhooks.filter(isPlainObject) : [];
   console.log(`Agent: ${agent.name}`);
   console.log(`  Project/Env:  ${manifest.project}/${manifest.environment}`);
   console.log(`  Deployed id:  ${agent.agentId ?? "not deployed"}`);
@@ -3032,16 +3454,13 @@ async function agentGet(name, args) {
   }
 }
 function agentModelLabel(config) {
-  const model = isRecord(config.model) ? config.model : {};
+  const model = isPlainObject(config.model) ? config.model : {};
   const provider = typeof model.provider === "string" ? model.provider : undefined;
   const modelId = typeof model.modelId === "string" ? model.modelId : undefined;
   if (provider && modelId)
     return `${provider}/${modelId}`;
   return modelId ?? provider ?? "unconfigured model";
 }
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 async function run(args) {
   const [agentName, ...promptParts] = args.filter((arg) => !arg.startsWith("--"));
   if (!agentName || promptParts.length === 0) {
@@ -3052,18 +3471,22 @@ async function run(args) {
     environment: optionValue(args, "--env"),
     command: "dev"
   });
-  const auth = await requireAuth(optionValue(args, "--dashboard-url") ?? config.dashboardUrl);
+  const auth = await requireAuth(optionValue(args, "--base-url") ?? config.baseUrl);
   const agent = manifest.resources.find((resource) => resource.kind === "agent" && resource.name === agentName);
   if (!agent)
     throw new Error(`Unknown local agent: ${agentName}`);
-  const remote = await new BroodsSyncClient({ dashboardUrl: auth.dashboardUrl, token: auth.token }).getManifest(manifest.project, manifest.environment);
+  const remote = await new BroodsSyncClient({ baseUrl: auth.baseUrl, token: auth.token }).getManifest(manifest.project, manifest.environment);
   const agentId = remote?.ids.agents[agentName];
   if (!agentId)
-    throw new Error(`Agent ${agentName} is not deployed. Run broods deploy first.`);
+    throw new Error(`Agent ${agentName} is not synced yet. Run broods dev --once or broods deploy first.`);
+  const runtimeKey = await new BroodsSyncClient({ baseUrl: auth.baseUrl, token: auth.token }).getRuntimeKey(manifest.project, manifest.environment).catch(() => null);
+  if (runtimeKey?.apiKey) {
+    await writeEnvValue("BROODS_API_KEY", runtimeKey.apiKey);
+  }
   if (agent.config.publicAccess !== true) {
     printWarning(`\u26A0 Agent "${agentName}" does not set publicAccess: true. The public endpoint is secured by default; ` + "if the deployed agent has not enabled it, this run will be refused.");
   }
-  const client = new BroodsClient;
+  const client = new BroodsClient(runtimeKey?.apiKey ? { apiKey: runtimeKey.apiKey } : {});
   const state = createRenderState();
   try {
     for await (const part of client.stream({
@@ -3071,7 +3494,10 @@ async function run(args) {
       name: agentName,
       id: agentId,
       project: manifest.project,
-      environment: manifest.environment
+      environment: manifest.environment,
+      ...runtimeKey?.endpointId ? { endpointId: runtimeKey.endpointId } : {},
+      ...runtimeKey?.projectSlug ? { projectSlug: runtimeKey.projectSlug } : {},
+      ...runtimeKey?.environmentSlug ? { environmentSlug: runtimeKey.environmentSlug } : {}
     }, { input: promptParts.join(" ") })) {
       renderStreamPart(part, state);
     }
@@ -3116,7 +3542,8 @@ async function writeLocalEnvDefaults(options) {
   const nextValues = {
     BROODS_DASHBOARD_URL: options.dashboardUrl,
     BROODS_PROJECT: options.project,
-    BROODS_ENVIRONMENT: options.environment
+    BROODS_ENVIRONMENT: options.environment,
+    BROODS_REGION: options.region
   };
   const lines = current ? current.replace(/\n?$/, `
 `).split(/\n/) : [
@@ -3209,7 +3636,7 @@ async function collectSourceFiles(dir, files) {
       await collectSourceFiles(full, files);
       continue;
     }
-    if (entry.isFile() && entry.name.endsWith(".ts"))
+    if (entry.isFile() && (entry.name.endsWith(".ts") || entry.name.endsWith(".md")))
       files.push(full);
   }
 }