@vm0/cli 5.7.2 → 5.9.0

package/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command35 } from "commander";
-import chalk36 from "chalk";
+import { Command as Command40 } from "commander";
+import chalk40 from "chalk";
 
 // src/lib/api/auth.ts
 import chalk from "chalk";
@@ -192,7 +192,7 @@ import { parse as parseYaml2 } from "yaml";
 import prompts from "prompts";
 
 // ../../packages/core/src/variable-expander.ts
-var VARIABLE_PATTERN = /\$\{\{\s*(env|vars|secrets)\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
+var VARIABLE_PATTERN = /\$\{\{\s*(env|vars|secrets|credentials)\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
 function extractVariableReferencesFromString(value) {
   const refs = [];
   const matches = value.matchAll(VARIABLE_PATTERN);
@@ -237,7 +237,8 @@ function groupVariablesBySource(refs) {
   const groups = {
     env: [],
     vars: [],
-    secrets: []
+    secrets: [],
+    credentials: []
   };
   for (const ref of refs) {
     groups[ref.source].push(ref);
@@ -333,7 +334,9 @@ var storedExecutionContextSchema = z2.object({
   encryptedSecrets: z2.string().nullable(),
   // AES-256-GCM encrypted secrets
   cliAgentType: z2.string(),
-  experimentalFirewall: experimentalFirewallSchema.optional()
+  experimentalFirewall: experimentalFirewallSchema.optional(),
+  // Debug flag to force real Claude in mock environments (internal use only)
+  debugNoMockClaude: z2.boolean().optional()
 });
 var executionContextSchema = z2.object({
   runId: z2.string().uuid(),
@@ -351,7 +354,9 @@ var executionContextSchema = z2.object({
   secretValues: z2.array(z2.string()).nullable(),
   cliAgentType: z2.string(),
   // Experimental firewall configuration
-  experimentalFirewall: experimentalFirewallSchema.optional()
+  experimentalFirewall: experimentalFirewallSchema.optional(),
+  // Debug flag to force real Claude in mock environments (internal use only)
+  debugNoMockClaude: z2.boolean().optional()
 });
 var runnersJobClaimContract = c.router({
   claim: {
@@ -634,6 +639,8 @@ var unifiedRunRequestSchema = z4.object({
   vars: z4.record(z4.string(), z4.string()).optional(),
   secrets: z4.record(z4.string(), z4.string()).optional(),
   volumeVersions: z4.record(z4.string(), z4.string()).optional(),
+  // Debug flag to force real Claude in mock environments (internal use only)
+  debugNoMockClaude: z4.boolean().optional(),
   // Required
   prompt: z4.string().min(1, "Missing prompt")
 });
@@ -1640,43 +1647,137 @@ var scopeContract = c9.router({
   }
 });
 
-// ../../packages/core/src/contracts/sessions.ts
+// ../../packages/core/src/contracts/credentials.ts
 import { z as z12 } from "zod";
 var c10 = initContract();
-var sessionResponseSchema = z12.object({
-  id: z12.string(),
-  agentComposeId: z12.string(),
-  agentComposeVersionId: z12.string().nullable(),
-  conversationId: z12.string().nullable(),
-  artifactName: z12.string().nullable(),
-  vars: z12.record(z12.string(), z12.string()).nullable(),
-  secretNames: z12.array(z12.string()).nullable(),
-  volumeVersions: z12.record(z12.string(), z12.string()).nullable(),
+var credentialNameSchema = z12.string().min(1, "Credential name is required").max(255, "Credential name must be at most 255 characters").regex(
+  /^[A-Z][A-Z0-9_]*$/,
+  "Credential name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_API_KEY)"
+);
+var credentialResponseSchema = z12.object({
+  id: z12.string().uuid(),
+  name: z12.string(),
+  description: z12.string().nullable(),
   createdAt: z12.string(),
   updatedAt: z12.string()
 });
-var agentComposeSnapshotSchema = z12.object({
-  agentComposeVersionId: z12.string(),
-  vars: z12.record(z12.string(), z12.string()).optional(),
-  secretNames: z12.array(z12.string()).optional()
+var credentialListResponseSchema = z12.object({
+  credentials: z12.array(credentialResponseSchema)
 });
-var artifactSnapshotSchema2 = z12.object({
-  artifactName: z12.string(),
-  artifactVersion: z12.string()
+var setCredentialRequestSchema = z12.object({
+  name: credentialNameSchema,
+  value: z12.string().min(1, "Credential value is required"),
+  description: z12.string().max(1e3).optional()
 });
-var volumeVersionsSnapshotSchema2 = z12.object({
-  versions: z12.record(z12.string(), z12.string())
+var credentialsMainContract = c10.router({
+  /**
+   * GET /api/credentials
+   * List all credentials for the current user's scope (metadata only)
+   */
+  list: {
+    method: "GET",
+    path: "/api/credentials",
+    responses: {
+      200: credentialListResponseSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List all credentials (metadata only)"
+  },
+  /**
+   * PUT /api/credentials
+   * Create or update a credential
+   */
+  set: {
+    method: "PUT",
+    path: "/api/credentials",
+    body: setCredentialRequestSchema,
+    responses: {
+      200: credentialResponseSchema,
+      201: credentialResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Create or update a credential"
+  }
 });
-var checkpointResponseSchema = z12.object({
-  id: z12.string(),
-  runId: z12.string(),
-  conversationId: z12.string(),
+var credentialsByNameContract = c10.router({
+  /**
+   * GET /api/credentials/:name
+   * Get a credential by name (metadata only)
+   */
+  get: {
+    method: "GET",
+    path: "/api/credentials/:name",
+    pathParams: z12.object({
+      name: credentialNameSchema
+    }),
+    responses: {
+      200: credentialResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get credential metadata by name"
+  },
+  /**
+   * DELETE /api/credentials/:name
+   * Delete a credential by name
+   */
+  delete: {
+    method: "DELETE",
+    path: "/api/credentials/:name",
+    pathParams: z12.object({
+      name: credentialNameSchema
+    }),
+    responses: {
+      204: z12.undefined(),
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Delete a credential"
+  }
+});
+
+// ../../packages/core/src/contracts/sessions.ts
+import { z as z13 } from "zod";
+var c11 = initContract();
+var sessionResponseSchema = z13.object({
+  id: z13.string(),
+  agentComposeId: z13.string(),
+  agentComposeVersionId: z13.string().nullable(),
+  conversationId: z13.string().nullable(),
+  artifactName: z13.string().nullable(),
+  vars: z13.record(z13.string(), z13.string()).nullable(),
+  secretNames: z13.array(z13.string()).nullable(),
+  volumeVersions: z13.record(z13.string(), z13.string()).nullable(),
+  createdAt: z13.string(),
+  updatedAt: z13.string()
+});
+var agentComposeSnapshotSchema = z13.object({
+  agentComposeVersionId: z13.string(),
+  vars: z13.record(z13.string(), z13.string()).optional(),
+  secretNames: z13.array(z13.string()).optional()
+});
+var artifactSnapshotSchema2 = z13.object({
+  artifactName: z13.string(),
+  artifactVersion: z13.string()
+});
+var volumeVersionsSnapshotSchema2 = z13.object({
+  versions: z13.record(z13.string(), z13.string())
+});
+var checkpointResponseSchema = z13.object({
+  id: z13.string(),
+  runId: z13.string(),
+  conversationId: z13.string(),
   agentComposeSnapshot: agentComposeSnapshotSchema,
   artifactSnapshot: artifactSnapshotSchema2.nullable(),
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
-  createdAt: z12.string()
+  createdAt: z13.string()
 });
-var sessionsByIdContract = c10.router({
+var sessionsByIdContract = c11.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -1684,8 +1785,8 @@ var sessionsByIdContract = c10.router({
   getById: {
     method: "GET",
     path: "/api/agent/sessions/:id",
-    pathParams: z12.object({
-      id: z12.string().min(1, "Session ID is required")
+    pathParams: z13.object({
+      id: z13.string().min(1, "Session ID is required")
     }),
     responses: {
       200: sessionResponseSchema,
@@ -1696,7 +1797,7 @@ var sessionsByIdContract = c10.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c10.router({
+var checkpointsByIdContract = c11.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -1704,8 +1805,8 @@ var checkpointsByIdContract = c10.router({
   getById: {
     method: "GET",
     path: "/api/agent/checkpoints/:id",
-    pathParams: z12.object({
-      id: z12.string().min(1, "Checkpoint ID is required")
+    pathParams: z13.object({
+      id: z13.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
       200: checkpointResponseSchema,
@@ -1718,91 +1819,91 @@ var checkpointsByIdContract = c10.router({
 });
 
 // ../../packages/core/src/contracts/schedules.ts
-import { z as z13 } from "zod";
-var c11 = initContract();
-var scheduleTriggerSchema = z13.object({
-  cron: z13.string().optional(),
-  at: z13.string().optional(),
-  timezone: z13.string().default("UTC")
+import { z as z14 } from "zod";
+var c12 = initContract();
+var scheduleTriggerSchema = z14.object({
+  cron: z14.string().optional(),
+  at: z14.string().optional(),
+  timezone: z14.string().default("UTC")
 }).refine((data) => data.cron && !data.at || !data.cron && data.at, {
   message: "Exactly one of 'cron' or 'at' must be specified"
 });
-var scheduleRunConfigSchema = z13.object({
-  agent: z13.string().min(1, "Agent reference required"),
-  prompt: z13.string().min(1, "Prompt required"),
-  vars: z13.record(z13.string(), z13.string()).optional(),
-  secrets: z13.record(z13.string(), z13.string()).optional(),
-  artifactName: z13.string().optional(),
-  artifactVersion: z13.string().optional(),
-  volumeVersions: z13.record(z13.string(), z13.string()).optional()
+var scheduleRunConfigSchema = z14.object({
+  agent: z14.string().min(1, "Agent reference required"),
+  prompt: z14.string().min(1, "Prompt required"),
+  vars: z14.record(z14.string(), z14.string()).optional(),
+  secrets: z14.record(z14.string(), z14.string()).optional(),
+  artifactName: z14.string().optional(),
+  artifactVersion: z14.string().optional(),
+  volumeVersions: z14.record(z14.string(), z14.string()).optional()
 });
-var scheduleDefinitionSchema = z13.object({
+var scheduleDefinitionSchema = z14.object({
   on: scheduleTriggerSchema,
   run: scheduleRunConfigSchema
 });
-var scheduleYamlSchema = z13.object({
-  version: z13.literal("1.0"),
-  schedules: z13.record(z13.string(), scheduleDefinitionSchema)
-});
-var deployScheduleRequestSchema = z13.object({
-  name: z13.string().min(1).max(64, "Schedule name max 64 chars"),
-  cronExpression: z13.string().optional(),
-  atTime: z13.string().optional(),
-  timezone: z13.string().default("UTC"),
-  prompt: z13.string().min(1, "Prompt required"),
-  vars: z13.record(z13.string(), z13.string()).optional(),
-  secrets: z13.record(z13.string(), z13.string()).optional(),
-  artifactName: z13.string().optional(),
-  artifactVersion: z13.string().optional(),
-  volumeVersions: z13.record(z13.string(), z13.string()).optional(),
+var scheduleYamlSchema = z14.object({
+  version: z14.literal("1.0"),
+  schedules: z14.record(z14.string(), scheduleDefinitionSchema)
+});
+var deployScheduleRequestSchema = z14.object({
+  name: z14.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z14.string().optional(),
+  atTime: z14.string().optional(),
+  timezone: z14.string().default("UTC"),
+  prompt: z14.string().min(1, "Prompt required"),
+  vars: z14.record(z14.string(), z14.string()).optional(),
+  secrets: z14.record(z14.string(), z14.string()).optional(),
+  artifactName: z14.string().optional(),
+  artifactVersion: z14.string().optional(),
+  volumeVersions: z14.record(z14.string(), z14.string()).optional(),
   // Resolved agent compose ID (CLI resolves scope/name:version → composeId)
-  composeId: z13.string().uuid("Invalid compose ID")
+  composeId: z14.string().uuid("Invalid compose ID")
 }).refine(
   (data) => data.cronExpression && !data.atTime || !data.cronExpression && data.atTime,
   {
     message: "Exactly one of 'cronExpression' or 'atTime' must be specified"
   }
 );
-var scheduleResponseSchema = z13.object({
-  id: z13.string().uuid(),
-  composeId: z13.string().uuid(),
-  composeName: z13.string(),
-  scopeSlug: z13.string(),
-  name: z13.string(),
-  cronExpression: z13.string().nullable(),
-  atTime: z13.string().nullable(),
-  timezone: z13.string(),
-  prompt: z13.string(),
-  vars: z13.record(z13.string(), z13.string()).nullable(),
+var scheduleResponseSchema = z14.object({
+  id: z14.string().uuid(),
+  composeId: z14.string().uuid(),
+  composeName: z14.string(),
+  scopeSlug: z14.string(),
+  name: z14.string(),
+  cronExpression: z14.string().nullable(),
+  atTime: z14.string().nullable(),
+  timezone: z14.string(),
+  prompt: z14.string(),
+  vars: z14.record(z14.string(), z14.string()).nullable(),
   // Secret names only (values are never returned)
-  secretNames: z13.array(z13.string()).nullable(),
-  artifactName: z13.string().nullable(),
-  artifactVersion: z13.string().nullable(),
-  volumeVersions: z13.record(z13.string(), z13.string()).nullable(),
-  enabled: z13.boolean(),
-  nextRunAt: z13.string().nullable(),
-  createdAt: z13.string(),
-  updatedAt: z13.string()
-});
-var runSummarySchema = z13.object({
-  id: z13.string().uuid(),
-  status: z13.enum(["pending", "running", "completed", "failed", "timeout"]),
-  createdAt: z13.string(),
-  completedAt: z13.string().nullable(),
-  error: z13.string().nullable()
-});
-var scheduleRunsResponseSchema = z13.object({
-  runs: z13.array(runSummarySchema)
-});
-var scheduleListResponseSchema = z13.object({
-  schedules: z13.array(scheduleResponseSchema)
-});
-var deployScheduleResponseSchema = z13.object({
+  secretNames: z14.array(z14.string()).nullable(),
+  artifactName: z14.string().nullable(),
+  artifactVersion: z14.string().nullable(),
+  volumeVersions: z14.record(z14.string(), z14.string()).nullable(),
+  enabled: z14.boolean(),
+  nextRunAt: z14.string().nullable(),
+  createdAt: z14.string(),
+  updatedAt: z14.string()
+});
+var runSummarySchema = z14.object({
+  id: z14.string().uuid(),
+  status: z14.enum(["pending", "running", "completed", "failed", "timeout"]),
+  createdAt: z14.string(),
+  completedAt: z14.string().nullable(),
+  error: z14.string().nullable()
+});
+var scheduleRunsResponseSchema = z14.object({
+  runs: z14.array(runSummarySchema)
+});
+var scheduleListResponseSchema = z14.object({
+  schedules: z14.array(scheduleResponseSchema)
+});
+var deployScheduleResponseSchema = z14.object({
   schedule: scheduleResponseSchema,
-  created: z13.boolean()
+  created: z14.boolean()
   // true if created, false if updated
 });
-var schedulesMainContract = c11.router({
+var schedulesMainContract = c12.router({
   /**
    * POST /api/agent/schedules
    * Deploy (create or update) a schedule
@@ -1838,7 +1939,7 @@ var schedulesMainContract = c11.router({
     summary: "List all schedules"
   }
 });
-var schedulesByNameContract = c11.router({
+var schedulesByNameContract = c12.router({
   /**
    * GET /api/agent/schedules/:name
    * Get schedule by name
@@ -1846,11 +1947,11 @@ var schedulesByNameContract = c11.router({
   getByName: {
     method: "GET",
     path: "/api/agent/schedules/:name",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    query: z13.object({
-      composeId: z13.string().uuid("Compose ID required")
+    query: z14.object({
+      composeId: z14.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -1866,21 +1967,21 @@ var schedulesByNameContract = c11.router({
   delete: {
     method: "DELETE",
     path: "/api/agent/schedules/:name",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    query: z13.object({
-      composeId: z13.string().uuid("Compose ID required")
+    query: z14.object({
+      composeId: z14.string().uuid("Compose ID required")
     }),
     responses: {
-      204: z13.undefined(),
+      204: z14.undefined(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete schedule"
   }
 });
-var schedulesEnableContract = c11.router({
+var schedulesEnableContract = c12.router({
   /**
    * POST /api/agent/schedules/:name/enable
    * Enable a disabled schedule
@@ -1888,11 +1989,11 @@ var schedulesEnableContract = c11.router({
   enable: {
     method: "POST",
     path: "/api/agent/schedules/:name/enable",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    body: z13.object({
-      composeId: z13.string().uuid("Compose ID required")
+    body: z14.object({
+      composeId: z14.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -1908,11 +2009,11 @@ var schedulesEnableContract = c11.router({
   disable: {
     method: "POST",
     path: "/api/agent/schedules/:name/disable",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    body: z13.object({
-      composeId: z13.string().uuid("Compose ID required")
+    body: z14.object({
+      composeId: z14.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -1922,7 +2023,7 @@ var schedulesEnableContract = c11.router({
     summary: "Disable schedule"
   }
 });
-var scheduleRunsContract = c11.router({
+var scheduleRunsContract = c12.router({
   /**
    * GET /api/agent/schedules/:name/runs
    * List recent runs for a schedule
@@ -1930,12 +2031,12 @@ var scheduleRunsContract = c11.router({
   listRuns: {
     method: "GET",
     path: "/api/agent/schedules/:name/runs",
-    pathParams: z13.object({
-      name: z13.string().min(1, "Schedule name required")
+    pathParams: z14.object({
+      name: z14.string().min(1, "Schedule name required")
     }),
-    query: z13.object({
-      composeId: z13.string().uuid("Compose ID required"),
-      limit: z13.coerce.number().min(0).max(100).default(5)
+    query: z14.object({
+      composeId: z14.string().uuid("Compose ID required"),
+      limit: z14.coerce.number().min(0).max(100).default(5)
     }),
     responses: {
       200: scheduleRunsResponseSchema,
@@ -1947,8 +2048,8 @@ var scheduleRunsContract = c11.router({
 });
 
 // ../../packages/core/src/contracts/public/common.ts
-import { z as z14 } from "zod";
-var publicApiErrorTypeSchema = z14.enum([
+import { z as z15 } from "zod";
+var publicApiErrorTypeSchema = z15.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -1960,55 +2061,55 @@ var publicApiErrorTypeSchema = z14.enum([
   "conflict_error"
   // Resource conflict (409)
 ]);
-var publicApiErrorSchema = z14.object({
-  error: z14.object({
+var publicApiErrorSchema = z15.object({
+  error: z15.object({
     type: publicApiErrorTypeSchema,
-    code: z14.string(),
-    message: z14.string(),
-    param: z14.string().optional(),
-    doc_url: z14.string().url().optional()
+    code: z15.string(),
+    message: z15.string(),
+    param: z15.string().optional(),
+    doc_url: z15.string().url().optional()
   })
 });
-var paginationSchema = z14.object({
-  has_more: z14.boolean(),
-  next_cursor: z14.string().nullable()
+var paginationSchema = z15.object({
+  has_more: z15.boolean(),
+  next_cursor: z15.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z14.object({
-    data: z14.array(dataSchema),
+  return z15.object({
+    data: z15.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z14.object({
-  cursor: z14.string().optional(),
-  limit: z14.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z15.object({
+  cursor: z15.string().optional(),
+  limit: z15.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z14.string().uuid();
-var timestampSchema = z14.string().datetime();
+var requestIdSchema = z15.string().uuid();
+var timestampSchema = z15.string().datetime();
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z15 } from "zod";
-var c12 = initContract();
-var publicAgentSchema = z15.object({
-  id: z15.string(),
-  name: z15.string(),
-  current_version_id: z15.string().nullable(),
+import { z as z16 } from "zod";
+var c13 = initContract();
+var publicAgentSchema = z16.object({
+  id: z16.string(),
+  name: z16.string(),
+  current_version_id: z16.string().nullable(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var agentVersionSchema = z15.object({
-  id: z15.string(),
-  agent_id: z15.string(),
-  version_number: z15.number(),
+var agentVersionSchema = z16.object({
+  id: z16.string(),
+  agent_id: z16.string(),
+  version_number: z16.number(),
   created_at: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z15.string().optional()
+  name: z16.string().optional()
 });
-var publicAgentsListContract = c12.router({
+var publicAgentsListContract = c13.router({
   list: {
     method: "GET",
     path: "/v1/agents",
@@ -2022,12 +2123,12 @@ var publicAgentsListContract = c12.router({
     description: "List all agents in the current scope with pagination. Use the `name` query parameter to filter by agent name."
   }
 });
-var publicAgentByIdContract = c12.router({
+var publicAgentByIdContract = c13.router({
   get: {
     method: "GET",
     path: "/v1/agents/:id",
-    pathParams: z15.object({
-      id: z15.string().min(1, "Agent ID is required")
+    pathParams: z16.object({
+      id: z16.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -2039,12 +2140,12 @@ var publicAgentByIdContract = c12.router({
     description: "Get agent details by ID"
   }
 });
-var publicAgentVersionsContract = c12.router({
+var publicAgentVersionsContract = c13.router({
   list: {
     method: "GET",
     path: "/v1/agents/:id/versions",
-    pathParams: z15.object({
-      id: z15.string().min(1, "Agent ID is required")
+    pathParams: z16.object({
+      id: z16.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -2059,9 +2160,9 @@ var publicAgentVersionsContract = c12.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z16 } from "zod";
-var c13 = initContract();
-var publicRunStatusSchema = z16.enum([
+import { z as z17 } from "zod";
+var c14 = initContract();
+var publicRunStatusSchema = z17.enum([
   "pending",
   "running",
   "completed",
@@ -2069,56 +2170,56 @@ var publicRunStatusSchema = z16.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z16.object({
-  id: z16.string(),
-  agent_id: z16.string(),
-  agent_name: z16.string(),
+var publicRunSchema = z17.object({
+  id: z17.string(),
+  agent_id: z17.string(),
+  agent_name: z17.string(),
   status: publicRunStatusSchema,
-  prompt: z16.string(),
+  prompt: z17.string(),
   created_at: timestampSchema,
   started_at: timestampSchema.nullable(),
   completed_at: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z16.string().nullable(),
-  execution_time_ms: z16.number().nullable(),
-  checkpoint_id: z16.string().nullable(),
-  session_id: z16.string().nullable(),
-  artifact_name: z16.string().nullable(),
-  artifact_version: z16.string().nullable(),
-  volumes: z16.record(z16.string(), z16.string()).optional()
+  error: z17.string().nullable(),
+  execution_time_ms: z17.number().nullable(),
+  checkpoint_id: z17.string().nullable(),
+  session_id: z17.string().nullable(),
+  artifact_name: z17.string().nullable(),
+  artifact_version: z17.string().nullable(),
+  volumes: z17.record(z17.string(), z17.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z16.object({
+var createRunRequestSchema = z17.object({
   // Agent identification (one of: agent, agent_id, session_id, checkpoint_id)
-  agent: z16.string().optional(),
+  agent: z17.string().optional(),
   // Agent name
-  agent_id: z16.string().optional(),
+  agent_id: z17.string().optional(),
   // Agent ID
-  agent_version: z16.string().optional(),
+  agent_version: z17.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  session_id: z16.string().optional(),
+  session_id: z17.string().optional(),
   // Resume from checkpoint
-  checkpoint_id: z16.string().optional(),
+  checkpoint_id: z17.string().optional(),
   // Required
-  prompt: z16.string().min(1, "Prompt is required"),
+  prompt: z17.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z16.record(z16.string(), z16.string()).optional(),
-  secrets: z16.record(z16.string(), z16.string()).optional(),
-  artifact_name: z16.string().optional(),
+  variables: z17.record(z17.string(), z17.string()).optional(),
+  secrets: z17.record(z17.string(), z17.string()).optional(),
+  artifact_name: z17.string().optional(),
   // Artifact name to mount
-  artifact_version: z16.string().optional(),
+  artifact_version: z17.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z16.record(z16.string(), z16.string()).optional()
+  volumes: z17.record(z17.string(), z17.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
-  agent_id: z16.string().optional(),
+  agent_id: z17.string().optional(),
   status: publicRunStatusSchema.optional(),
   since: timestampSchema.optional()
 });
-var publicRunsListContract = c13.router({
+var publicRunsListContract = c14.router({
   list: {
     method: "GET",
     path: "/v1/runs",
@@ -2147,12 +2248,12 @@ var publicRunsListContract = c13.router({
     description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
   }
 });
-var publicRunByIdContract = c13.router({
+var publicRunByIdContract = c14.router({
   get: {
     method: "GET",
     path: "/v1/runs/:id",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -2164,14 +2265,14 @@ var publicRunByIdContract = c13.router({
     description: "Get run details by ID"
   }
 });
-var publicRunCancelContract = c13.router({
+var publicRunCancelContract = c14.router({
   cancel: {
     method: "POST",
     path: "/v1/runs/:id/cancel",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
-    body: z16.undefined(),
+    body: z17.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -2184,26 +2285,26 @@ var publicRunCancelContract = c13.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z16.object({
+var logEntrySchema = z17.object({
   timestamp: timestampSchema,
-  type: z16.enum(["agent", "system", "network"]),
-  level: z16.enum(["debug", "info", "warn", "error"]),
-  message: z16.string(),
-  metadata: z16.record(z16.string(), z16.unknown()).optional()
+  type: z17.enum(["agent", "system", "network"]),
+  level: z17.enum(["debug", "info", "warn", "error"]),
+  message: z17.string(),
+  metadata: z17.record(z17.string(), z17.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z16.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z17.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z16.enum(["asc", "desc"]).default("asc")
+  order: z17.enum(["asc", "desc"]).default("asc")
 });
-var publicRunLogsContract = c13.router({
+var publicRunLogsContract = c14.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -2216,29 +2317,29 @@ var publicRunLogsContract = c13.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z16.object({
+var metricPointSchema = z17.object({
   timestamp: timestampSchema,
-  cpu_percent: z16.number(),
-  memory_used_mb: z16.number(),
-  memory_total_mb: z16.number(),
-  disk_used_mb: z16.number(),
-  disk_total_mb: z16.number()
-});
-var metricsSummarySchema = z16.object({
-  avg_cpu_percent: z16.number(),
-  max_memory_used_mb: z16.number(),
-  total_duration_ms: z16.number().nullable()
-});
-var metricsResponseSchema2 = z16.object({
-  data: z16.array(metricPointSchema),
+  cpu_percent: z17.number(),
+  memory_used_mb: z17.number(),
+  memory_total_mb: z17.number(),
+  disk_used_mb: z17.number(),
+  disk_total_mb: z17.number()
+});
+var metricsSummarySchema = z17.object({
+  avg_cpu_percent: z17.number(),
+  max_memory_used_mb: z17.number(),
+  total_duration_ms: z17.number().nullable()
+});
+var metricsResponseSchema2 = z17.object({
+  data: z17.array(metricPointSchema),
   summary: metricsSummarySchema
 });
-var publicRunMetricsContract = c13.router({
+var publicRunMetricsContract = c14.router({
   getMetrics: {
     method: "GET",
     path: "/v1/runs/:id/metrics",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -2250,7 +2351,7 @@ var publicRunMetricsContract = c13.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z16.enum([
+var sseEventTypeSchema = z17.enum([
   "status",
   // Run status change
   "output",
@@ -2262,25 +2363,25 @@ var sseEventTypeSchema = z16.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z16.object({
+var sseEventSchema = z17.object({
   event: sseEventTypeSchema,
-  data: z16.unknown(),
-  id: z16.string().optional()
+  data: z17.unknown(),
+  id: z17.string().optional()
   // For Last-Event-ID reconnection
 });
-var publicRunEventsContract = c13.router({
+var publicRunEventsContract = c14.router({
   streamEvents: {
     method: "GET",
     path: "/v1/runs/:id/events",
-    pathParams: z16.object({
-      id: z16.string().min(1, "Run ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
     }),
-    query: z16.object({
-      last_event_id: z16.string().optional()
+    query: z17.object({
+      last_event_id: z17.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z16.any(),
+      200: z17.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -2292,28 +2393,28 @@ var publicRunEventsContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z17 } from "zod";
-var c14 = initContract();
-var publicArtifactSchema = z17.object({
-  id: z17.string(),
-  name: z17.string(),
-  current_version_id: z17.string().nullable(),
-  size: z17.number(),
+import { z as z18 } from "zod";
+var c15 = initContract();
+var publicArtifactSchema = z18.object({
+  id: z18.string(),
+  name: z18.string(),
+  current_version_id: z18.string().nullable(),
+  size: z18.number(),
   // Total size in bytes
-  file_count: z17.number(),
+  file_count: z18.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var artifactVersionSchema = z17.object({
-  id: z17.string(),
+var artifactVersionSchema = z18.object({
+  id: z18.string(),
   // SHA-256 content hash
-  artifact_id: z17.string(),
-  size: z17.number(),
+  artifact_id: z18.string(),
+  size: z18.number(),
   // Size in bytes
-  file_count: z17.number(),
-  message: z17.string().nullable(),
+  file_count: z18.number(),
+  message: z18.string().nullable(),
   // Optional commit message
-  created_by: z17.string(),
+  created_by: z18.string(),
   created_at: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -2323,7 +2424,7 @@ var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchem
 var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
   artifactVersionSchema
 );
-var publicArtifactsListContract = c14.router({
+var publicArtifactsListContract = c15.router({
   list: {
     method: "GET",
     path: "/v1/artifacts",
@@ -2337,12 +2438,12 @@ var publicArtifactsListContract = c14.router({
     description: "List all artifacts in the current scope with pagination"
   }
 });
-var publicArtifactByIdContract = c14.router({
+var publicArtifactByIdContract = c15.router({
   get: {
     method: "GET",
     path: "/v1/artifacts/:id",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Artifact ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -2354,12 +2455,12 @@ var publicArtifactByIdContract = c14.router({
     description: "Get artifact details by ID"
   }
 });
-var publicArtifactVersionsContract = c14.router({
+var publicArtifactVersionsContract = c15.router({
   list: {
     method: "GET",
     path: "/v1/artifacts/:id/versions",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Artifact ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -2372,19 +2473,19 @@ var publicArtifactVersionsContract = c14.router({
     description: "List all versions of an artifact with pagination"
   }
 });
-var publicArtifactDownloadContract = c14.router({
+var publicArtifactDownloadContract = c15.router({
   download: {
     method: "GET",
     path: "/v1/artifacts/:id/download",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Artifact ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
     }),
-    query: z17.object({
-      version_id: z17.string().optional()
+    query: z18.object({
+      version_id: z18.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z17.undefined(),
+      302: z18.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -2396,28 +2497,28 @@ var publicArtifactDownloadContract = c14.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z18 } from "zod";
-var c15 = initContract();
-var publicVolumeSchema = z18.object({
-  id: z18.string(),
-  name: z18.string(),
-  current_version_id: z18.string().nullable(),
-  size: z18.number(),
+import { z as z19 } from "zod";
+var c16 = initContract();
+var publicVolumeSchema = z19.object({
+  id: z19.string(),
+  name: z19.string(),
+  current_version_id: z19.string().nullable(),
+  size: z19.number(),
   // Total size in bytes
-  file_count: z18.number(),
+  file_count: z19.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var volumeVersionSchema = z18.object({
-  id: z18.string(),
+var volumeVersionSchema = z19.object({
+  id: z19.string(),
   // SHA-256 content hash
-  volume_id: z18.string(),
-  size: z18.number(),
+  volume_id: z19.string(),
+  size: z19.number(),
   // Size in bytes
-  file_count: z18.number(),
-  message: z18.string().nullable(),
+  file_count: z19.number(),
+  message: z19.string().nullable(),
   // Optional commit message
-  created_by: z18.string(),
+  created_by: z19.string(),
   created_at: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -2425,7 +2526,7 @@ var publicVolumeDetailSchema = publicVolumeSchema.extend({
 });
 var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
 var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
-var publicVolumesListContract = c15.router({
+var publicVolumesListContract = c16.router({
   list: {
     method: "GET",
     path: "/v1/volumes",
@@ -2439,12 +2540,12 @@ var publicVolumesListContract = c15.router({
     description: "List all volumes in the current scope with pagination"
   }
 });
-var publicVolumeByIdContract = c15.router({
+var publicVolumeByIdContract = c16.router({
   get: {
     method: "GET",
     path: "/v1/volumes/:id",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Volume ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -2456,12 +2557,12 @@ var publicVolumeByIdContract = c15.router({
     description: "Get volume details by ID"
   }
 });
-var publicVolumeVersionsContract = c15.router({
+var publicVolumeVersionsContract = c16.router({
   list: {
     method: "GET",
     path: "/v1/volumes/:id/versions",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Volume ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -2474,19 +2575,19 @@ var publicVolumeVersionsContract = c15.router({
     description: "List all versions of a volume with pagination"
   }
 });
-var publicVolumeDownloadContract = c15.router({
+var publicVolumeDownloadContract = c16.router({
   download: {
     method: "GET",
     path: "/v1/volumes/:id/download",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Volume ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
     }),
-    query: z18.object({
-      version_id: z18.string().optional()
+    query: z19.object({
+      version_id: z19.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z18.undefined(),
+      302: z19.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -2586,6 +2687,16 @@ function getProviderDisplayName(provider) {
   return PROVIDER_DISPLAY_NAMES[provider];
 }
 
+// ../../packages/core/src/feature-switch.ts
+var PricingSwitch = {
+  key: "pricing" /* Pricing */,
+  maintainer: "ethan@vm0.ai",
+  enabled: false
+};
+var FEATURE_SWITCHES = {
+  ["pricing" /* Pricing */]: PricingSwitch
+};
+
 // src/lib/api/api-client.ts
 import { initClient } from "@ts-rest/core";
 var ApiClient = class {
@@ -3256,6 +3367,106 @@ var ApiClient = class {
     const message = errorBody.error?.message || `Volume "${id}" not found`;
     throw new Error(message);
   }
+  /**
+   * Get usage statistics
+   */
+  async getUsage(options) {
+    const baseUrl = await this.getBaseUrl();
+    const headers = await this.getHeaders();
+    const params = new URLSearchParams({
+      start_date: options.startDate,
+      end_date: options.endDate
+    });
+    const response = await fetch(`${baseUrl}/api/usage?${params}`, {
+      method: "GET",
+      headers
+    });
+    if (!response.ok) {
+      const error = await response.json();
+      throw new Error(error.error?.message || "Failed to fetch usage data");
+    }
+    return response.json();
+  }
+  /**
+   * List credentials (metadata only, no values)
+   */
+  async listCredentials() {
+    const baseUrl = await this.getBaseUrl();
+    const headers = await this.getHeaders();
+    const client = initClient(credentialsMainContract, {
+      baseUrl,
+      baseHeaders: headers,
+      jsonQuery: true
+    });
+    const result = await client.list();
+    if (result.status === 200) {
+      return result.body;
+    }
+    const errorBody = result.body;
+    const message = errorBody.error?.message || "Failed to list credentials";
+    throw new Error(message);
+  }
+  /**
+   * Get credential by name (metadata only, no value)
+   */
+  async getCredential(name) {
+    const baseUrl = await this.getBaseUrl();
+    const headers = await this.getHeaders();
+    const client = initClient(credentialsByNameContract, {
+      baseUrl,
+      baseHeaders: headers,
+      jsonQuery: true
+    });
+    const result = await client.get({
+      params: { name }
+    });
+    if (result.status === 200) {
+      return result.body;
+    }
+    const errorBody = result.body;
+    const message = errorBody.error?.message || `Credential "${name}" not found`;
+    throw new Error(message);
+  }
+  /**
+   * Set (create or update) a credential
+   */
+  async setCredential(body) {
+    const baseUrl = await this.getBaseUrl();
+    const headers = await this.getHeaders();
+    const client = initClient(credentialsMainContract, {
+      baseUrl,
+      baseHeaders: headers,
+      jsonQuery: true
+    });
+    const result = await client.set({ body });
+    if (result.status === 200 || result.status === 201) {
+      return result.body;
+    }
+    const errorBody = result.body;
+    const message = errorBody.error?.message || "Failed to set credential";
+    throw new Error(message);
+  }
+  /**
+   * Delete a credential by name
+   */
+  async deleteCredential(name) {
+    const baseUrl = await this.getBaseUrl();
+    const headers = await this.getHeaders();
+    const client = initClient(credentialsByNameContract, {
+      baseUrl,
+      baseHeaders: headers,
+      jsonQuery: true
+    });
+    const result = await client.delete({
+      params: { name }
+    });
+    if (result.status === 204) {
+      return;
+    }
+    const errorBody = result.body;
+    const message = errorBody.error?.message || `Credential "${name}" not found`;
+    throw new Error(message);
+  }
   /**
    * Generic GET request
    */
@@ -3327,7 +3538,7 @@ var ApiClient = class {
 var apiClient = new ApiClient();
 
 // src/lib/domain/yaml-validator.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // src/lib/domain/provider-config.ts
 var PROVIDER_DEFAULTS = {
@@ -3394,7 +3605,7 @@ function getDefaultImageWithApps(provider, apps) {
 }
 
 // src/lib/domain/yaml-validator.ts
-var cliAgentNameSchema = z19.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
+var cliAgentNameSchema = z20.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
   /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/,
   "Agent name must start and end with letter or number, and contain only letters, numbers, and hyphens"
 );
@@ -3407,14 +3618,14 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     const providerSupported = isProviderSupported(agent.provider);
     if (!agent.image && !providerSupported) {
       ctx.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z20.ZodIssueCode.custom,
         message: "Missing agent.image (required when provider is not auto-configured)",
         path: ["image"]
       });
     }
     if (!agent.working_dir && !providerSupported) {
       ctx.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z20.ZodIssueCode.custom,
         message: "Missing agent.working_dir (required when provider is not auto-configured)",
         path: ["working_dir"]
       });
@@ -3424,7 +3635,7 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
         const skillUrl = agent.skills[i];
         if (skillUrl && !validateGitHubTreeUrl(skillUrl)) {
           ctx.addIssue({
-            code: z19.ZodIssueCode.custom,
+            code: z20.ZodIssueCode.custom,
             message: `Invalid skill URL: ${skillUrl}. Expected format: https://github.com/{owner}/{repo}/tree/{branch}/{path}`,
             path: ["skills", i]
           });
@@ -3433,15 +3644,15 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     }
   }
 );
-var cliComposeSchema = z19.object({
-  version: z19.string().min(1, "Missing config.version"),
-  agents: z19.record(cliAgentNameSchema, cliAgentDefinitionSchema),
-  volumes: z19.record(z19.string(), volumeConfigSchema).optional()
+var cliComposeSchema = z20.object({
+  version: z20.string().min(1, "Missing config.version"),
+  agents: z20.record(cliAgentNameSchema, cliAgentDefinitionSchema),
+  volumes: z20.record(z20.string(), volumeConfigSchema).optional()
 }).superRefine((config, ctx) => {
   const agentKeys = Object.keys(config.agents);
   if (agentKeys.length === 0) {
     ctx.addIssue({
-      code: z19.ZodIssueCode.custom,
+      code: z20.ZodIssueCode.custom,
       message: "agents must have at least one agent defined",
       path: ["agents"]
     });
@@ -3449,7 +3660,7 @@ var cliComposeSchema = z19.object({
   }
   if (agentKeys.length > 1) {
     ctx.addIssue({
-      code: z19.ZodIssueCode.custom,
+      code: z20.ZodIssueCode.custom,
       message: "Multiple agents not supported yet. Only one agent allowed.",
       path: ["agents"]
     });
@@ -3461,7 +3672,7 @@ var cliComposeSchema = z19.object({
   if (agentVolumes && agentVolumes.length > 0) {
     if (!config.volumes) {
       ctx.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z20.ZodIssueCode.custom,
         message: "Agent references volumes but no volumes section defined. Each volume must have explicit name and version.",
         path: ["volumes"]
       });
@@ -3471,7 +3682,7 @@ var cliComposeSchema = z19.object({
       const parts = volDeclaration.split(":");
       if (parts.length !== 2) {
         ctx.addIssue({
-          code: z19.ZodIssueCode.custom,
+          code: z20.ZodIssueCode.custom,
           message: `Invalid volume declaration: ${volDeclaration}. Expected format: volume-key:/mount/path`,
           path: ["agents", agentName, "volumes"]
         });
@@ -3480,7 +3691,7 @@ var cliComposeSchema = z19.object({
       const volumeKey = parts[0].trim();
       if (!config.volumes[volumeKey]) {
         ctx.addIssue({
-          code: z19.ZodIssueCode.custom,
+          code: z20.ZodIssueCode.custom,
           message: `Volume "${volumeKey}" is not defined in volumes section. Each volume must have explicit name and version.`,
           path: ["volumes", volumeKey]
         });
@@ -4541,9 +4752,9 @@ var CodexEventParser = class {
       }
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const changes = item.changes.map((c16) => {
-        const action = c16.kind === "add" ? "Created" : c16.kind === "modify" ? "Modified" : "Deleted";
-        return `${action}: ${c16.path}`;
+      const changes = item.changes.map((c17) => {
+        const action = c17.kind === "add" ? "Created" : c17.kind === "modify" ? "Modified" : "Deleted";
+        return `${action}: ${c17.path}`;
       }).join("\n");
       return {
         type: "text",
@@ -4884,9 +5095,9 @@ var CodexEventRenderer = class {
       return;
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const summary = item.changes.map((c16) => {
-        const icon = c16.kind === "add" ? "+" : c16.kind === "delete" ? "-" : "~";
-        return `${icon}${c16.path}`;
+      const summary = item.changes.map((c17) => {
+        const icon = c17.kind === "add" ? "+" : c17.kind === "delete" ? "-" : "~";
+        return `${icon}${c17.path}`;
       }).join(", ");
       console.log(chalk4.green("[files]") + ` ${summary}`);
       return;
@@ -5103,7 +5314,7 @@ var runCmd = new Command2().name("run").description("Execute an agent").argument
 ).option(
   "--conversation <id>",
   "Resume from conversation ID (for fine-grained control)"
-).option("-v, --verbose", "Show verbose output with timing information").action(
+).option("-v, --verbose", "Show verbose output with timing information").option("--debug-no-mock-claude").action(
   async (identifier, prompt, options) => {
     const startTimestamp = /* @__PURE__ */ new Date();
     const verbose = options.verbose;
@@ -5204,7 +5415,8 @@ var runCmd = new Command2().name("run").description("Execute an agent").argument
         artifactName: options.artifactName,
         artifactVersion: options.artifactVersion,
         volumeVersions: Object.keys(options.volumeVersion).length > 0 ? options.volumeVersion : void 0,
-        conversationId: options.conversation
+        conversationId: options.conversation,
+        debugNoMockClaude: options.debugNoMockClaude || void 0
       });
       if (response.status === "failed") {
         console.error(chalk5.red("\u2717 Run preparation failed"));
@@ -5269,7 +5481,7 @@ runCmd.command("resume").description("Resume an agent run from a checkpoint (use
   "Volume version override (repeatable)",
   collectVolumeVersions,
   {}
-).option("-v, --verbose", "Show verbose output with timing information").action(
+).option("-v, --verbose", "Show verbose output with timing information").option("--debug-no-mock-claude").action(
   async (checkpointId, prompt, options, command) => {
     const startTimestamp = /* @__PURE__ */ new Date();
     const allOpts = command.optsWithGlobals();
@@ -5310,7 +5522,8 @@ runCmd.command("resume").description("Resume an agent run from a checkpoint (use
         prompt,
         vars: Object.keys(vars).length > 0 ? vars : void 0,
         secrets: loadedSecrets,
-        volumeVersions: Object.keys(allOpts.volumeVersion).length > 0 ? allOpts.volumeVersion : void 0
+        volumeVersions: Object.keys(allOpts.volumeVersion).length > 0 ? allOpts.volumeVersion : void 0,
+        debugNoMockClaude: options.debugNoMockClaude || allOpts.debugNoMockClaude || void 0
       });
       if (response.status === "failed") {
         console.error(chalk5.red("\u2717 Run preparation failed"));
@@ -5367,7 +5580,7 @@ runCmd.command("continue").description(
   "Volume version override (repeatable)",
   collectVolumeVersions,
   {}
-).option("-v, --verbose", "Show verbose output with timing information").action(
+).option("-v, --verbose", "Show verbose output with timing information").option("--debug-no-mock-claude").action(
   async (agentSessionId, prompt, options, command) => {
     const startTimestamp = /* @__PURE__ */ new Date();
     const allOpts = command.optsWithGlobals();
@@ -5409,7 +5622,8 @@ runCmd.command("continue").description(
         prompt,
         vars: Object.keys(vars).length > 0 ? vars : void 0,
         secrets: loadedSecrets,
-        volumeVersions: Object.keys(allOpts.volumeVersion).length > 0 ? allOpts.volumeVersion : void 0
+        volumeVersions: Object.keys(allOpts.volumeVersion).length > 0 ? allOpts.volumeVersion : void 0,
+        debugNoMockClaude: options.debugNoMockClaude || allOpts.debugNoMockClaude || void 0
       });
       if (response.status === "failed") {
         console.error(chalk5.red("\u2717 Run preparation failed"));
@@ -6731,180 +6945,186 @@ async function autoPullArtifact(runOutput, artifactDir) {
   }
 }
 var cookCmd = new Command17().name("cook").description("One-click agent preparation and execution from vm0.yaml");
-cookCmd.argument("[prompt]", "Prompt for the agent").option("-y, --yes", "Skip confirmation prompts").action(async (prompt, options) => {
-  const shouldExit = await checkAndUpgrade("5.7.2", prompt);
-  if (shouldExit) {
-    process.exit(0);
-  }
-  const cwd = process.cwd();
-  console.log(chalk21.bold(`Reading config: ${CONFIG_FILE3}`));
-  if (!existsSync8(CONFIG_FILE3)) {
-    console.error(chalk21.red(`\u2717 Config file not found: ${CONFIG_FILE3}`));
-    process.exit(1);
-  }
-  let config;
-  try {
-    const content = await readFile7(CONFIG_FILE3, "utf8");
-    config = parseYaml4(content);
-  } catch (error) {
-    console.error(chalk21.red("\u2717 Invalid YAML format"));
-    if (error instanceof Error) {
-      console.error(chalk21.dim(`  ${error.message}`));
+cookCmd.argument("[prompt]", "Prompt for the agent").option("-y, --yes", "Skip confirmation prompts").option("--debug-no-mock-claude").action(
+  async (prompt, options) => {
+    const shouldExit = await checkAndUpgrade("5.9.0", prompt);
+    if (shouldExit) {
+      process.exit(0);
     }
-    process.exit(1);
-  }
-  const validation = validateAgentCompose(config);
-  if (!validation.valid) {
-    console.error(chalk21.red(`\u2717 ${validation.error}`));
-    process.exit(1);
-  }
-  const agentNames = Object.keys(config.agents);
-  const agentName = agentNames[0];
-  const volumeCount = config.volumes ? Object.keys(config.volumes).length : 0;
-  console.log(
-    chalk21.green(`\u2713 Config validated: 1 agent, ${volumeCount} volume(s)`)
-  );
-  const requiredVarNames = extractRequiredVarNames(config);
-  if (requiredVarNames.length > 0) {
-    const envFilePath = path12.join(cwd, ".env");
-    const missingVars = checkMissingVariables(requiredVarNames, envFilePath);
-    if (missingVars.length > 0) {
-      await generateEnvPlaceholders(missingVars, envFilePath);
-      console.log();
-      console.log(
-        chalk21.yellow(
-          `\u26A0 Missing environment variables. Please fill in values in .env file:`
-        )
-      );
-      for (const varName of missingVars) {
-        console.log(chalk21.yellow(`    ${varName}`));
+    const cwd = process.cwd();
+    console.log(chalk21.bold(`Reading config: ${CONFIG_FILE3}`));
+    if (!existsSync8(CONFIG_FILE3)) {
+      console.error(chalk21.red(`\u2717 Config file not found: ${CONFIG_FILE3}`));
+      process.exit(1);
+    }
+    let config;
+    try {
+      const content = await readFile7(CONFIG_FILE3, "utf8");
+      config = parseYaml4(content);
+    } catch (error) {
+      console.error(chalk21.red("\u2717 Invalid YAML format"));
+      if (error instanceof Error) {
+        console.error(chalk21.dim(`  ${error.message}`));
       }
       process.exit(1);
     }
-  }
-  if (config.volumes && Object.keys(config.volumes).length > 0) {
-    console.log();
-    console.log(chalk21.bold("Processing volumes:"));
-    for (const volumeConfig of Object.values(config.volumes)) {
-      const volumeDir = path12.join(cwd, volumeConfig.name);
-      if (!existsSync8(volumeDir)) {
-        console.error(
-          chalk21.red(
-            `\u2717 Directory not found: ${volumeConfig.name}. Create the directory and add files first.`
+    const validation = validateAgentCompose(config);
+    if (!validation.valid) {
+      console.error(chalk21.red(`\u2717 ${validation.error}`));
+      process.exit(1);
+    }
+    const agentNames = Object.keys(config.agents);
+    const agentName = agentNames[0];
+    const volumeCount = config.volumes ? Object.keys(config.volumes).length : 0;
+    console.log(
+      chalk21.green(`\u2713 Config validated: 1 agent, ${volumeCount} volume(s)`)
+    );
+    const requiredVarNames = extractRequiredVarNames(config);
+    if (requiredVarNames.length > 0) {
+      const envFilePath = path12.join(cwd, ".env");
+      const missingVars = checkMissingVariables(
+        requiredVarNames,
+        envFilePath
+      );
+      if (missingVars.length > 0) {
+        await generateEnvPlaceholders(missingVars, envFilePath);
+        console.log();
+        console.log(
+          chalk21.yellow(
+            `\u26A0 Missing environment variables. Please fill in values in .env file:`
           )
         );
+        for (const varName of missingVars) {
+          console.log(chalk21.yellow(`    ${varName}`));
+        }
         process.exit(1);
       }
-      try {
-        printCommand(`cd ${volumeConfig.name}`);
-        const existingConfig = await readStorageConfig(volumeDir);
-        if (!existingConfig) {
-          printCommand(`vm0 volume init --name ${volumeConfig.name}`);
-          await execVm0Command(
-            ["volume", "init", "--name", volumeConfig.name],
-            {
-              cwd: volumeDir,
-              silent: true
-            }
+    }
+    if (config.volumes && Object.keys(config.volumes).length > 0) {
+      console.log();
+      console.log(chalk21.bold("Processing volumes:"));
+      for (const volumeConfig of Object.values(config.volumes)) {
+        const volumeDir = path12.join(cwd, volumeConfig.name);
+        if (!existsSync8(volumeDir)) {
+          console.error(
+            chalk21.red(
+              `\u2717 Directory not found: ${volumeConfig.name}. Create the directory and add files first.`
+            )
           );
+          process.exit(1);
         }
-        printCommand("vm0 volume push");
-        await execVm0Command(["volume", "push"], {
-          cwd: volumeDir,
-          silent: true
-        });
-        printCommand("cd ..");
-      } catch (error) {
-        console.error(chalk21.red(`\u2717 Failed`));
-        if (error instanceof Error) {
-          console.error(chalk21.dim(`  ${error.message}`));
+        try {
+          printCommand(`cd ${volumeConfig.name}`);
+          const existingConfig = await readStorageConfig(volumeDir);
+          if (!existingConfig) {
+            printCommand(`vm0 volume init --name ${volumeConfig.name}`);
+            await execVm0Command(
+              ["volume", "init", "--name", volumeConfig.name],
+              {
+                cwd: volumeDir,
+                silent: true
+              }
+            );
+          }
+          printCommand("vm0 volume push");
+          await execVm0Command(["volume", "push"], {
+            cwd: volumeDir,
+            silent: true
+          });
+          printCommand("cd ..");
+        } catch (error) {
+          console.error(chalk21.red(`\u2717 Failed`));
+          if (error instanceof Error) {
+            console.error(chalk21.dim(`  ${error.message}`));
+          }
+          process.exit(1);
         }
-        process.exit(1);
       }
     }
-  }
-  console.log();
-  console.log(chalk21.bold("Processing artifact:"));
-  const artifactDir = path12.join(cwd, ARTIFACT_DIR);
-  try {
-    if (!existsSync8(artifactDir)) {
-      printCommand(`mkdir ${ARTIFACT_DIR}`);
-      await mkdir6(artifactDir, { recursive: true });
-    }
-    printCommand(`cd ${ARTIFACT_DIR}`);
-    const existingConfig = await readStorageConfig(artifactDir);
-    if (!existingConfig) {
-      printCommand(`vm0 artifact init --name ${ARTIFACT_DIR}`);
-      await execVm0Command(["artifact", "init", "--name", ARTIFACT_DIR], {
+    console.log();
+    console.log(chalk21.bold("Processing artifact:"));
+    const artifactDir = path12.join(cwd, ARTIFACT_DIR);
+    try {
+      if (!existsSync8(artifactDir)) {
+        printCommand(`mkdir ${ARTIFACT_DIR}`);
+        await mkdir6(artifactDir, { recursive: true });
+      }
+      printCommand(`cd ${ARTIFACT_DIR}`);
+      const existingConfig = await readStorageConfig(artifactDir);
+      if (!existingConfig) {
+        printCommand(`vm0 artifact init --name ${ARTIFACT_DIR}`);
+        await execVm0Command(["artifact", "init", "--name", ARTIFACT_DIR], {
+          cwd: artifactDir,
+          silent: true
+        });
+      }
+      printCommand("vm0 artifact push");
+      await execVm0Command(["artifact", "push"], {
         cwd: artifactDir,
         silent: true
       });
+      printCommand("cd ..");
+    } catch (error) {
+      console.error(chalk21.red(`\u2717 Failed`));
+      if (error instanceof Error) {
+        console.error(chalk21.dim(`  ${error.message}`));
+      }
+      process.exit(1);
     }
-    printCommand("vm0 artifact push");
-    await execVm0Command(["artifact", "push"], {
-      cwd: artifactDir,
-      silent: true
-    });
-    printCommand("cd ..");
-  } catch (error) {
-    console.error(chalk21.red(`\u2717 Failed`));
-    if (error instanceof Error) {
-      console.error(chalk21.dim(`  ${error.message}`));
-    }
-    process.exit(1);
-  }
-  console.log();
-  console.log(chalk21.bold("Composing agent:"));
-  const composeArgs = options.yes ? ["compose", "--yes", CONFIG_FILE3] : ["compose", CONFIG_FILE3];
-  printCommand(`vm0 ${composeArgs.join(" ")}`);
-  try {
-    await execVm0Command(composeArgs, {
-      cwd
-    });
-  } catch (error) {
-    console.error(chalk21.red(`\u2717 Compose failed`));
-    if (error instanceof Error) {
-      console.error(chalk21.dim(`  ${error.message}`));
-    }
-    process.exit(1);
-  }
-  if (prompt) {
-    console.log();
-    console.log(chalk21.bold("Running agent:"));
-    printCommand(
-      `vm0 run ${agentName} --artifact-name ${ARTIFACT_DIR} "${prompt}"`
-    );
     console.log();
-    let runOutput;
+    console.log(chalk21.bold("Composing agent:"));
+    const composeArgs = options.yes ? ["compose", "--yes", CONFIG_FILE3] : ["compose", CONFIG_FILE3];
+    printCommand(`vm0 ${composeArgs.join(" ")}`);
     try {
-      const runArgs = [
-        "run",
-        agentName,
-        "--artifact-name",
-        ARTIFACT_DIR,
-        prompt
-      ];
-      runOutput = await execVm0RunWithCapture(runArgs, { cwd });
-    } catch {
+      await execVm0Command(composeArgs, {
+        cwd
+      });
+    } catch (error) {
+      console.error(chalk21.red(`\u2717 Compose failed`));
+      if (error instanceof Error) {
+        console.error(chalk21.dim(`  ${error.message}`));
+      }
       process.exit(1);
     }
-    const runIds = parseRunIdsFromOutput(runOutput);
-    if (runIds.runId || runIds.sessionId || runIds.checkpointId) {
-      await saveCookState({
-        lastRunId: runIds.runId,
-        lastSessionId: runIds.sessionId,
-        lastCheckpointId: runIds.checkpointId
-      });
+    if (prompt) {
+      console.log();
+      console.log(chalk21.bold("Running agent:"));
+      printCommand(
+        `vm0 run ${agentName} --artifact-name ${ARTIFACT_DIR} "${prompt}"`
+      );
+      console.log();
+      let runOutput;
+      try {
+        const runArgs = [
+          "run",
+          agentName,
+          "--artifact-name",
+          ARTIFACT_DIR,
+          ...options.debugNoMockClaude ? ["--debug-no-mock-claude"] : [],
+          prompt
+        ];
+        runOutput = await execVm0RunWithCapture(runArgs, { cwd });
+      } catch {
+        process.exit(1);
+      }
+      const runIds = parseRunIdsFromOutput(runOutput);
+      if (runIds.runId || runIds.sessionId || runIds.checkpointId) {
+        await saveCookState({
+          lastRunId: runIds.runId,
+          lastSessionId: runIds.sessionId,
+          lastCheckpointId: runIds.checkpointId
+        });
+      }
+      await autoPullArtifact(runOutput, artifactDir);
+    } else {
+      console.log();
+      console.log("To run your agent:");
+      printCommand(
+        `vm0 run ${agentName} --artifact-name ${ARTIFACT_DIR} "your prompt"`
+      );
     }
-    await autoPullArtifact(runOutput, artifactDir);
-  } else {
-    console.log();
-    console.log("To run your agent:");
-    printCommand(
-      `vm0 run ${agentName} --artifact-name ${ARTIFACT_DIR} "your prompt"`
-    );
   }
-});
+);
 cookCmd.command("logs").description("View logs from the last cook run").option("-a, --agent", "Show agent events (default)").option("-s, --system", "Show system log").option("-m, --metrics", "Show metrics").option("-n, --network", "Show network logs (proxy traffic)").option(
   "--since <time>",
   "Show logs since timestamp (e.g., 5m, 2h, 1d, 2024-01-15T10:30:00Z)"
@@ -6952,7 +7172,7 @@ cookCmd.command("logs").description("View logs from the last cook run").option("
 );
 cookCmd.command("continue").description(
   "Continue from the last session (latest conversation and artifact)"
-).argument("<prompt>", "Prompt for the continued agent").action(async (prompt) => {
+).argument("<prompt>", "Prompt for the continued agent").option("--debug-no-mock-claude").action(async (prompt, options) => {
   const state = await loadCookState();
   if (!state.lastSessionId) {
     console.error(chalk21.red("\u2717 No previous session found"));
@@ -6966,7 +7186,13 @@ cookCmd.command("continue").description(
   let runOutput;
   try {
     runOutput = await execVm0RunWithCapture(
-      ["run", "continue", state.lastSessionId, prompt],
+      [
+        "run",
+        "continue",
+        state.lastSessionId,
+        ...options.debugNoMockClaude ? ["--debug-no-mock-claude"] : [],
+        prompt
+      ],
       { cwd }
     );
   } catch {
@@ -6984,7 +7210,7 @@ cookCmd.command("continue").description(
 });
 cookCmd.command("resume").description(
   "Resume from the last checkpoint (snapshotted conversation and artifact)"
-).argument("<prompt>", "Prompt for the resumed agent").action(async (prompt) => {
+).argument("<prompt>", "Prompt for the resumed agent").option("--debug-no-mock-claude").action(async (prompt, options) => {
   const state = await loadCookState();
   if (!state.lastCheckpointId) {
     console.error(chalk21.red("\u2717 No previous checkpoint found"));
@@ -6998,7 +7224,13 @@ cookCmd.command("resume").description(
   let runOutput;
   try {
     runOutput = await execVm0RunWithCapture(
-      ["run", "resume", state.lastCheckpointId, prompt],
+      [
+        "run",
+        "resume",
+        state.lastCheckpointId,
+        ...options.debugNoMockClaude ? ["--debug-no-mock-claude"] : [],
+        prompt
+      ],
       { cwd }
     );
   } catch {
@@ -7394,10 +7626,10 @@ var setCommand = new Command20().name("set").description("Set your scope slug").
 // src/commands/scope/index.ts
 var scopeCommand = new Command21().name("scope").description("Manage your scope (namespace for images)").addCommand(statusCommand3).addCommand(setCommand);
 
-// src/commands/agents/index.ts
+// src/commands/agent/index.ts
 import { Command as Command24 } from "commander";
 
-// src/commands/agents/list.ts
+// src/commands/agent/list.ts
 import { Command as Command22 } from "commander";
 import chalk25 from "chalk";
 var listCommand3 = new Command22().name("list").alias("ls").description("List all agent composes").option("-s, --scope <scope>", "Scope to list composes from").action(async (options) => {
@@ -7416,7 +7648,7 @@ var listCommand3 = new Command22().name("list").alias("ls").description("List al
       );
       return;
     }
-    const nameWidth = Math.max(4, ...data.composes.map((c16) => c16.name.length));
+    const nameWidth = Math.max(4, ...data.composes.map((c17) => c17.name.length));
     const header = ["NAME".padEnd(nameWidth), "VERSION", "UPDATED"].join(
       "  "
     );
@@ -7443,7 +7675,7 @@ var listCommand3 = new Command22().name("list").alias("ls").description("List al
   }
 });
 
-// src/commands/agents/inspect.ts
+// src/commands/agent/inspect.ts
 import { Command as Command23 } from "commander";
 import chalk26 from "chalk";
 
@@ -7553,7 +7785,7 @@ async function deriveComposeVariableSources(content, options) {
   return results;
 }
 
-// src/commands/agents/inspect.ts
+// src/commands/agent/inspect.ts
 function formatComposeOutput(name, versionId, content, variableSources) {
   console.log(chalk26.bold("Name:") + `    ${name}`);
   console.log(chalk26.bold("Version:") + ` ${versionId}`);
@@ -7635,7 +7867,7 @@ var inspectCommand = new Command23().name("inspect").description("Inspect an age
       } catch (error) {
         if (error instanceof Error && error.message.includes("not found")) {
           console.error(chalk26.red(`\u2717 Agent compose not found: ${name}`));
-          console.error(chalk26.dim("  Run: vm0 agents list"));
+          console.error(chalk26.dim("  Run: vm0 agent list"));
           process.exit(1);
         }
         throw error;
@@ -7702,8 +7934,8 @@ var inspectCommand = new Command23().name("inspect").description("Inspect an age
   }
 );
 
-// src/commands/agents/index.ts
-var agentsCommand = new Command24().name("agents").description("Manage agent composes").addCommand(listCommand3).addCommand(inspectCommand);
+// src/commands/agent/index.ts
+var agentCommand = new Command24().name("agent").description("Manage agent composes").addCommand(listCommand3).addCommand(inspectCommand);
 
 // src/commands/init.ts
 import { Command as Command25 } from "commander";
@@ -9398,11 +9630,324 @@ var disableCommand = new Command33().name("disable").description("Disable a sche
 // src/commands/schedule/index.ts
 var scheduleCommand = new Command34().name("schedule").description("Manage agent schedules").addCommand(initCommand4).addCommand(deployCommand).addCommand(listCommand4).addCommand(statusCommand4).addCommand(deleteCommand).addCommand(enableCommand).addCommand(disableCommand);
 
+// src/commands/usage.ts
+import { Command as Command35 } from "commander";
+import chalk36 from "chalk";
+
+// src/lib/utils/duration-formatter.ts
+function formatDuration(ms) {
+  if (ms === null || ms === void 0 || ms === 0) {
+    return "-";
+  }
+  if (ms < 0) {
+    return "-";
+  }
+  const totalSeconds = Math.floor(ms / 1e3);
+  if (totalSeconds === 0) {
+    return "< 1s";
+  }
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
+  const seconds = totalSeconds % 60;
+  const parts = [];
+  if (hours > 0) {
+    parts.push(`${hours}h`);
+  }
+  if (minutes > 0) {
+    parts.push(`${minutes}m`);
+  }
+  if (seconds > 0) {
+    parts.push(`${seconds}s`);
+  }
+  return parts.join(" ");
+}
+
+// src/commands/usage.ts
+var MAX_RANGE_MS = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_RANGE_MS = 7 * 24 * 60 * 60 * 1e3;
+function formatDateDisplay(dateStr) {
+  const date = new Date(dateStr);
+  return date.toLocaleDateString("en-US", { month: "short", day: "numeric" });
+}
+function formatDateRange(start, end) {
+  const startDate = new Date(start);
+  const endDate = new Date(end);
+  endDate.setDate(endDate.getDate() - 1);
+  const startStr = startDate.toLocaleDateString("en-US", {
+    month: "short",
+    day: "numeric"
+  });
+  const endStr = endDate.toLocaleDateString("en-US", {
+    month: "short",
+    day: "numeric",
+    year: "numeric"
+  });
+  return `${startStr} - ${endStr}`;
+}
+function fillMissingDates(daily, startDate, endDate) {
+  const dateMap = /* @__PURE__ */ new Map();
+  for (const day of daily) {
+    dateMap.set(day.date, day);
+  }
+  const result = [];
+  const current = new Date(startDate);
+  current.setUTCHours(0, 0, 0, 0);
+  while (current < endDate) {
+    const dateStr = current.toISOString().split("T")[0];
+    const existing = dateMap.get(dateStr);
+    if (existing) {
+      result.push(existing);
+    } else {
+      result.push({ date: dateStr, run_count: 0, run_time_ms: 0 });
+    }
+    current.setDate(current.getDate() + 1);
+  }
+  result.sort((a, b) => b.date.localeCompare(a.date));
+  return result;
+}
+var usageCommand = new Command35().name("usage").description("View usage statistics").option("--since <date>", "Start date (ISO format or relative: 7d, 30d)").option(
+  "--until <date>",
+  "End date (ISO format or relative, defaults to now)"
+).action(async (options) => {
+  try {
+    const now = /* @__PURE__ */ new Date();
+    let endDate;
+    let startDate;
+    if (options.until) {
+      try {
+        const untilMs = parseTime(options.until);
+        endDate = new Date(untilMs);
+      } catch {
+        console.error(
+          chalk36.red(
+            "Error: Invalid --until format. Use ISO (2026-01-01) or relative (7d, 30d)"
+          )
+        );
+        process.exit(1);
+      }
+    } else {
+      endDate = now;
+    }
+    if (options.since) {
+      try {
+        const sinceMs = parseTime(options.since);
+        startDate = new Date(sinceMs);
+      } catch {
+        console.error(
+          chalk36.red(
+            "Error: Invalid --since format. Use ISO (2026-01-01) or relative (7d, 30d)"
+          )
+        );
+        process.exit(1);
+      }
+    } else {
+      startDate = new Date(endDate.getTime() - DEFAULT_RANGE_MS);
+    }
+    if (startDate >= endDate) {
+      console.error(chalk36.red("Error: --since must be before --until"));
+      process.exit(1);
+    }
+    const rangeMs = endDate.getTime() - startDate.getTime();
+    if (rangeMs > MAX_RANGE_MS) {
+      console.error(
+        chalk36.red(
+          "Error: Time range exceeds maximum of 30 days. Use --until to specify an end date."
+        )
+      );
+      process.exit(1);
+    }
+    const usage = await apiClient.getUsage({
+      startDate: startDate.toISOString(),
+      endDate: endDate.toISOString()
+    });
+    const filledDaily = fillMissingDates(
+      usage.daily,
+      new Date(usage.period.start),
+      new Date(usage.period.end)
+    );
+    console.log();
+    console.log(
+      chalk36.bold(
+        `Usage Summary (${formatDateRange(usage.period.start, usage.period.end)})`
+      )
+    );
+    console.log();
+    console.log(chalk36.dim("DATE        RUNS    RUN TIME"));
+    for (const day of filledDaily) {
+      const dateDisplay = formatDateDisplay(day.date).padEnd(10);
+      const runsDisplay = String(day.run_count).padStart(6);
+      const timeDisplay = formatDuration(day.run_time_ms);
+      console.log(`${dateDisplay}${runsDisplay}    ${timeDisplay}`);
+    }
+    console.log(chalk36.dim("\u2500".repeat(29)));
+    const totalRunsDisplay = String(usage.summary.total_runs).padStart(6);
+    const totalTimeDisplay = formatDuration(usage.summary.total_run_time_ms);
+    console.log(
+      `${"TOTAL".padEnd(10)}${totalRunsDisplay}    ${totalTimeDisplay}`
+    );
+    console.log();
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(
+          chalk36.red("Error: Not authenticated. Run: vm0 auth login")
+        );
+      } else {
+        console.error(chalk36.red(`Error: ${error.message}`));
+      }
+    } else {
+      console.error(chalk36.red("Error: An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/credential/index.ts
+import { Command as Command39 } from "commander";
+
+// src/commands/credential/list.ts
+import { Command as Command36 } from "commander";
+import chalk37 from "chalk";
+var listCommand5 = new Command36().name("list").description("List all credentials").option("--json", "Output in JSON format").action(async (options) => {
+  try {
+    const result = await apiClient.listCredentials();
+    if (options.json) {
+      console.log(JSON.stringify(result.credentials, null, 2));
+      return;
+    }
+    if (result.credentials.length === 0) {
+      console.log(chalk37.dim("No credentials found."));
+      console.log();
+      console.log("To add a credential:");
+      console.log(chalk37.cyan("  vm0 credential set MY_API_KEY <value>"));
+      return;
+    }
+    console.log(chalk37.bold("Credentials:"));
+    console.log();
+    for (const credential of result.credentials) {
+      console.log(`  ${chalk37.cyan(credential.name)}`);
+      if (credential.description) {
+        console.log(`    ${chalk37.dim(credential.description)}`);
+      }
+      console.log(
+        `    ${chalk37.dim(`Updated: ${new Date(credential.updatedAt).toLocaleString()}`)}`
+      );
+      console.log();
+    }
+    console.log(
+      chalk37.dim(`Total: ${result.credentials.length} credential(s)`)
+    );
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(chalk37.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk37.red(`\u2717 ${error.message}`));
+      }
+    } else {
+      console.error(chalk37.red("\u2717 An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/credential/set.ts
+import { Command as Command37 } from "commander";
+import chalk38 from "chalk";
+var setCommand2 = new Command37().name("set").description("Create or update a credential").argument("<name>", "Credential name (uppercase, e.g., MY_API_KEY)").argument("<value>", "Credential value").option("-d, --description <description>", "Optional description").action(
+  async (name, value, options) => {
+    try {
+      const credential = await apiClient.setCredential({
+        name,
+        value,
+        description: options.description
+      });
+      console.log(chalk38.green(`\u2713 Credential "${credential.name}" saved`));
+      console.log();
+      console.log("Use in vm0.yaml:");
+      console.log(chalk38.cyan(`  environment:`));
+      console.log(chalk38.cyan(`    ${name}: \${{ credentials.${name} }}`));
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message.includes("Not authenticated")) {
+          console.error(
+            chalk38.red("\u2717 Not authenticated. Run: vm0 auth login")
+          );
+        } else if (error.message.includes("must contain only uppercase")) {
+          console.error(chalk38.red(`\u2717 ${error.message}`));
+          console.log();
+          console.log("Examples of valid credential names:");
+          console.log(chalk38.dim("  MY_API_KEY"));
+          console.log(chalk38.dim("  GITHUB_TOKEN"));
+          console.log(chalk38.dim("  AWS_ACCESS_KEY_ID"));
+        } else {
+          console.error(chalk38.red(`\u2717 ${error.message}`));
+        }
+      } else {
+        console.error(chalk38.red("\u2717 An unexpected error occurred"));
+      }
+      process.exit(1);
+    }
+  }
+);
+
+// src/commands/credential/delete.ts
+import { Command as Command38 } from "commander";
+import chalk39 from "chalk";
+var deleteCommand2 = new Command38().name("delete").description("Delete a credential").argument("<name>", "Credential name to delete").option("-y, --yes", "Skip confirmation prompt").action(async (name, options) => {
+  try {
+    try {
+      await apiClient.getCredential(name);
+    } catch {
+      console.error(chalk39.red(`\u2717 Credential "${name}" not found`));
+      process.exit(1);
+    }
+    if (!options.yes) {
+      const readline2 = await import("readline");
+      const rl = readline2.createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      const confirmed = await new Promise((resolve2) => {
+        rl.question(
+          chalk39.yellow(
+            `Are you sure you want to delete credential "${name}"? (y/N) `
+          ),
+          (answer) => {
+            rl.close();
+            resolve2(answer.toLowerCase() === "y");
+          }
+        );
+      });
+      if (!confirmed) {
+        console.log(chalk39.dim("Cancelled."));
+        return;
+      }
+    }
+    await apiClient.deleteCredential(name);
+    console.log(chalk39.green(`\u2713 Credential "${name}" deleted`));
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(chalk39.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk39.red(`\u2717 ${error.message}`));
+      }
+    } else {
+      console.error(chalk39.red("\u2717 An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/credential/index.ts
+var credentialCommand = new Command39().name("experimental-credential").description("[Experimental] Manage stored credentials for agent runs").addCommand(listCommand5).addCommand(setCommand2).addCommand(deleteCommand2);
+
 // src/index.ts
-var program = new Command35();
-program.name("vm0").description("VM0 CLI - A modern build tool").version("5.7.2");
+var program = new Command40();
+program.name("vm0").description("VM0 CLI - A modern build tool").version("5.9.0");
 program.command("info").description("Display environment information").action(async () => {
-  console.log(chalk36.bold("System Information:"));
+  console.log(chalk40.bold("System Information:"));
   console.log(`Node Version: ${process.version}`);
   console.log(`Platform: ${process.platform}`);
   console.log(`Architecture: ${process.arch}`);
@@ -9429,10 +9974,12 @@ program.addCommand(artifactCommand);
 program.addCommand(cookCommand);
 program.addCommand(logsCommand);
 program.addCommand(scopeCommand);
-program.addCommand(agentsCommand);
+program.addCommand(agentCommand);
 program.addCommand(initCommand3);
 program.addCommand(setupGithubCommand);
 program.addCommand(scheduleCommand);
+program.addCommand(usageCommand);
+program.addCommand(credentialCommand);
 if (process.argv[1]?.endsWith("index.js") || process.argv[1]?.endsWith("index.ts") || process.argv[1]?.endsWith("vm0")) {
   program.parse();
 }