@vm0/cli 6.0.0 → 6.2.0

package/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command42 } from "commander";
-import chalk43 from "chalk";
+import { Command as Command47 } from "commander";
+import chalk47 from "chalk";
 
 // src/lib/api/auth.ts
 import chalk from "chalk";
@@ -641,6 +641,8 @@ var unifiedRunRequestSchema = z4.object({
   volumeVersions: z4.record(z4.string(), z4.string()).optional(),
   // Debug flag to force real Claude in mock environments (internal use only)
   debugNoMockClaude: z4.boolean().optional(),
+  // Model provider for automatic LLM credential injection
+  modelProvider: z4.string().optional(),
   // Required
   prompt: z4.string().min(1, "Missing prompt")
 });
@@ -1654,10 +1656,12 @@ var credentialNameSchema = z12.string().min(1, "Credential name is required").ma
   /^[A-Z][A-Z0-9_]*$/,
   "Credential name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_API_KEY)"
 );
+var credentialTypeSchema = z12.enum(["user", "model-provider"]);
 var credentialResponseSchema = z12.object({
   id: z12.string().uuid(),
   name: z12.string(),
   description: z12.string().nullable(),
+  type: credentialTypeSchema,
   createdAt: z12.string(),
   updatedAt: z12.string()
 });
@@ -1741,43 +1745,191 @@ var credentialsByNameContract = c10.router({
   }
 });
 
-// ../../packages/core/src/contracts/sessions.ts
+// ../../packages/core/src/contracts/model-providers.ts
 import { z as z13 } from "zod";
 var c11 = initContract();
-var sessionResponseSchema = z13.object({
-  id: z13.string(),
-  agentComposeId: z13.string(),
-  agentComposeVersionId: z13.string().nullable(),
-  conversationId: z13.string().nullable(),
-  artifactName: z13.string().nullable(),
-  vars: z13.record(z13.string(), z13.string()).nullable(),
-  secretNames: z13.array(z13.string()).nullable(),
-  volumeVersions: z13.record(z13.string(), z13.string()).nullable(),
+var MODEL_PROVIDER_TYPES = {
+  "claude-code-oauth-token": {
+    framework: "claude-code",
+    credentialName: "CLAUDE_CODE_OAUTH_TOKEN",
+    label: "Claude Code (OAuth Token)",
+    credentialLabel: "OAuth token"
+  },
+  "anthropic-api-key": {
+    framework: "claude-code",
+    credentialName: "ANTHROPIC_API_KEY",
+    label: "Anthropic API Key",
+    credentialLabel: "API key"
+  },
+  "openai-api-key": {
+    framework: "codex",
+    credentialName: "OPENAI_API_KEY",
+    label: "OpenAI API Key",
+    credentialLabel: "API key"
+  }
+};
+var modelProviderTypeSchema = z13.enum([
+  "claude-code-oauth-token",
+  "anthropic-api-key",
+  "openai-api-key"
+]);
+var modelProviderFrameworkSchema = z13.enum(["claude-code", "codex"]);
+var modelProviderResponseSchema = z13.object({
+  id: z13.string().uuid(),
+  type: modelProviderTypeSchema,
+  framework: modelProviderFrameworkSchema,
+  credentialName: z13.string(),
+  isDefault: z13.boolean(),
   createdAt: z13.string(),
   updatedAt: z13.string()
 });
-var agentComposeSnapshotSchema = z13.object({
-  agentComposeVersionId: z13.string(),
-  vars: z13.record(z13.string(), z13.string()).optional(),
-  secretNames: z13.array(z13.string()).optional()
+var modelProviderListResponseSchema = z13.object({
+  modelProviders: z13.array(modelProviderResponseSchema)
+});
+var upsertModelProviderRequestSchema = z13.object({
+  type: modelProviderTypeSchema,
+  credential: z13.string().min(1, "Credential is required"),
+  convert: z13.boolean().optional()
+});
+var upsertModelProviderResponseSchema = z13.object({
+  provider: modelProviderResponseSchema,
+  created: z13.boolean()
+});
+var checkCredentialResponseSchema = z13.object({
+  exists: z13.boolean(),
+  credentialName: z13.string(),
+  currentType: z13.enum(["user", "model-provider"]).optional()
+});
+var modelProvidersMainContract = c11.router({
+  list: {
+    method: "GET",
+    path: "/api/model-providers",
+    responses: {
+      200: modelProviderListResponseSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List all model providers"
+  },
+  upsert: {
+    method: "PUT",
+    path: "/api/model-providers",
+    body: upsertModelProviderRequestSchema,
+    responses: {
+      200: upsertModelProviderResponseSchema,
+      201: upsertModelProviderResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      409: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Create or update a model provider"
+  }
+});
+var modelProvidersCheckContract = c11.router({
+  check: {
+    method: "GET",
+    path: "/api/model-providers/check/:type",
+    pathParams: z13.object({
+      type: modelProviderTypeSchema
+    }),
+    responses: {
+      200: checkCredentialResponseSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Check if credential exists for a model provider type"
+  }
+});
+var modelProvidersByTypeContract = c11.router({
+  delete: {
+    method: "DELETE",
+    path: "/api/model-providers/:type",
+    pathParams: z13.object({
+      type: modelProviderTypeSchema
+    }),
+    responses: {
+      204: z13.undefined(),
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Delete a model provider"
+  }
+});
+var modelProvidersConvertContract = c11.router({
+  convert: {
+    method: "POST",
+    path: "/api/model-providers/:type/convert",
+    pathParams: z13.object({
+      type: modelProviderTypeSchema
+    }),
+    body: z13.undefined(),
+    responses: {
+      200: modelProviderResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Convert existing user credential to model provider"
+  }
+});
+var modelProvidersSetDefaultContract = c11.router({
+  setDefault: {
+    method: "POST",
+    path: "/api/model-providers/:type/set-default",
+    pathParams: z13.object({
+      type: modelProviderTypeSchema
+    }),
+    body: z13.undefined(),
+    responses: {
+      200: modelProviderResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Set a model provider as default for its framework"
+  }
+});
+
+// ../../packages/core/src/contracts/sessions.ts
+import { z as z14 } from "zod";
+var c12 = initContract();
+var sessionResponseSchema = z14.object({
+  id: z14.string(),
+  agentComposeId: z14.string(),
+  agentComposeVersionId: z14.string().nullable(),
+  conversationId: z14.string().nullable(),
+  artifactName: z14.string().nullable(),
+  vars: z14.record(z14.string(), z14.string()).nullable(),
+  secretNames: z14.array(z14.string()).nullable(),
+  volumeVersions: z14.record(z14.string(), z14.string()).nullable(),
+  createdAt: z14.string(),
+  updatedAt: z14.string()
+});
+var agentComposeSnapshotSchema = z14.object({
+  agentComposeVersionId: z14.string(),
+  vars: z14.record(z14.string(), z14.string()).optional(),
+  secretNames: z14.array(z14.string()).optional()
 });
-var artifactSnapshotSchema2 = z13.object({
-  artifactName: z13.string(),
-  artifactVersion: z13.string()
+var artifactSnapshotSchema2 = z14.object({
+  artifactName: z14.string(),
+  artifactVersion: z14.string()
 });
-var volumeVersionsSnapshotSchema2 = z13.object({
-  versions: z13.record(z13.string(), z13.string())
+var volumeVersionsSnapshotSchema2 = z14.object({
+  versions: z14.record(z14.string(), z14.string())
 });
-var checkpointResponseSchema = z13.object({
-  id: z13.string(),
-  runId: z13.string(),
-  conversationId: z13.string(),
+var checkpointResponseSchema = z14.object({
+  id: z14.string(),
+  runId: z14.string(),
+  conversationId: z14.string(),
   agentComposeSnapshot: agentComposeSnapshotSchema,
   artifactSnapshot: artifactSnapshotSchema2.nullable(),
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
-  createdAt: z13.string()
+  createdAt: z14.string()
 });
-var sessionsByIdContract = c11.router({
+var sessionsByIdContract = c12.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -1785,8 +1937,8 @@ var sessionsByIdContract = c11.router({
   getById: {
     method: "GET",
     path: "/api/agent/sessions/:id",
-    pathParams: z13.object({
-      id: z13.string().min(1, "Session ID is required")
+    pathParams: z14.object({
+      id: z14.string().min(1, "Session ID is required")
     }),
     responses: {
       200: sessionResponseSchema,
@@ -1797,7 +1949,7 @@ var sessionsByIdContract = c11.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c11.router({
+var checkpointsByIdContract = c12.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -1805,8 +1957,8 @@ var checkpointsByIdContract = c11.router({
   getById: {
     method: "GET",
     path: "/api/agent/checkpoints/:id",
-    pathParams: z13.object({
-      id: z13.string().min(1, "Checkpoint ID is required")
+    pathParams: z14.object({
+      id: z14.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
       200: checkpointResponseSchema,
@@ -1819,91 +1971,91 @@ var checkpointsByIdContract = c11.router({
 });
 
 // ../../packages/core/src/contracts/schedules.ts
-import { z as z14 } from "zod";
-var c12 = initContract();
-var scheduleTriggerSchema = z14.object({
-  cron: z14.string().optional(),
-  at: z14.string().optional(),
-  timezone: z14.string().default("UTC")
+import { z as z15 } from "zod";
+var c13 = initContract();
+var scheduleTriggerSchema = z15.object({
+  cron: z15.string().optional(),
+  at: z15.string().optional(),
+  timezone: z15.string().default("UTC")
 }).refine((data) => data.cron && !data.at || !data.cron && data.at, {
   message: "Exactly one of 'cron' or 'at' must be specified"
 });
-var scheduleRunConfigSchema = z14.object({
-  agent: z14.string().min(1, "Agent reference required"),
-  prompt: z14.string().min(1, "Prompt required"),
-  vars: z14.record(z14.string(), z14.string()).optional(),
-  secrets: z14.record(z14.string(), z14.string()).optional(),
-  artifactName: z14.string().optional(),
-  artifactVersion: z14.string().optional(),
-  volumeVersions: z14.record(z14.string(), z14.string()).optional()
+var scheduleRunConfigSchema = z15.object({
+  agent: z15.string().min(1, "Agent reference required"),
+  prompt: z15.string().min(1, "Prompt required"),
+  vars: z15.record(z15.string(), z15.string()).optional(),
+  secrets: z15.record(z15.string(), z15.string()).optional(),
+  artifactName: z15.string().optional(),
+  artifactVersion: z15.string().optional(),
+  volumeVersions: z15.record(z15.string(), z15.string()).optional()
 });
-var scheduleDefinitionSchema = z14.object({
+var scheduleDefinitionSchema = z15.object({
   on: scheduleTriggerSchema,
   run: scheduleRunConfigSchema
 });
-var scheduleYamlSchema = z14.object({
-  version: z14.literal("1.0"),
-  schedules: z14.record(z14.string(), scheduleDefinitionSchema)
-});
-var deployScheduleRequestSchema = z14.object({
-  name: z14.string().min(1).max(64, "Schedule name max 64 chars"),
-  cronExpression: z14.string().optional(),
-  atTime: z14.string().optional(),
-  timezone: z14.string().default("UTC"),
-  prompt: z14.string().min(1, "Prompt required"),
-  vars: z14.record(z14.string(), z14.string()).optional(),
-  secrets: z14.record(z14.string(), z14.string()).optional(),
-  artifactName: z14.string().optional(),
-  artifactVersion: z14.string().optional(),
-  volumeVersions: z14.record(z14.string(), z14.string()).optional(),
+var scheduleYamlSchema = z15.object({
+  version: z15.literal("1.0"),
+  schedules: z15.record(z15.string(), scheduleDefinitionSchema)
+});
+var deployScheduleRequestSchema = z15.object({
+  name: z15.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z15.string().optional(),
+  atTime: z15.string().optional(),
+  timezone: z15.string().default("UTC"),
+  prompt: z15.string().min(1, "Prompt required"),
+  vars: z15.record(z15.string(), z15.string()).optional(),
+  secrets: z15.record(z15.string(), z15.string()).optional(),
+  artifactName: z15.string().optional(),
+  artifactVersion: z15.string().optional(),
+  volumeVersions: z15.record(z15.string(), z15.string()).optional(),
   // Resolved agent compose ID (CLI resolves scope/name:version → composeId)
-  composeId: z14.string().uuid("Invalid compose ID")
+  composeId: z15.string().uuid("Invalid compose ID")
 }).refine(
   (data) => data.cronExpression && !data.atTime || !data.cronExpression && data.atTime,
   {
     message: "Exactly one of 'cronExpression' or 'atTime' must be specified"
   }
 );
-var scheduleResponseSchema = z14.object({
-  id: z14.string().uuid(),
-  composeId: z14.string().uuid(),
-  composeName: z14.string(),
-  scopeSlug: z14.string(),
-  name: z14.string(),
-  cronExpression: z14.string().nullable(),
-  atTime: z14.string().nullable(),
-  timezone: z14.string(),
-  prompt: z14.string(),
-  vars: z14.record(z14.string(), z14.string()).nullable(),
+var scheduleResponseSchema = z15.object({
+  id: z15.string().uuid(),
+  composeId: z15.string().uuid(),
+  composeName: z15.string(),
+  scopeSlug: z15.string(),
+  name: z15.string(),
+  cronExpression: z15.string().nullable(),
+  atTime: z15.string().nullable(),
+  timezone: z15.string(),
+  prompt: z15.string(),
+  vars: z15.record(z15.string(), z15.string()).nullable(),
   // Secret names only (values are never returned)
-  secretNames: z14.array(z14.string()).nullable(),
-  artifactName: z14.string().nullable(),
-  artifactVersion: z14.string().nullable(),
-  volumeVersions: z14.record(z14.string(), z14.string()).nullable(),
-  enabled: z14.boolean(),
-  nextRunAt: z14.string().nullable(),
-  createdAt: z14.string(),
-  updatedAt: z14.string()
-});
-var runSummarySchema = z14.object({
-  id: z14.string().uuid(),
-  status: z14.enum(["pending", "running", "completed", "failed", "timeout"]),
-  createdAt: z14.string(),
-  completedAt: z14.string().nullable(),
-  error: z14.string().nullable()
-});
-var scheduleRunsResponseSchema = z14.object({
-  runs: z14.array(runSummarySchema)
-});
-var scheduleListResponseSchema = z14.object({
-  schedules: z14.array(scheduleResponseSchema)
-});
-var deployScheduleResponseSchema = z14.object({
+  secretNames: z15.array(z15.string()).nullable(),
+  artifactName: z15.string().nullable(),
+  artifactVersion: z15.string().nullable(),
+  volumeVersions: z15.record(z15.string(), z15.string()).nullable(),
+  enabled: z15.boolean(),
+  nextRunAt: z15.string().nullable(),
+  createdAt: z15.string(),
+  updatedAt: z15.string()
+});
+var runSummarySchema = z15.object({
+  id: z15.string().uuid(),
+  status: z15.enum(["pending", "running", "completed", "failed", "timeout"]),
+  createdAt: z15.string(),
+  completedAt: z15.string().nullable(),
+  error: z15.string().nullable()
+});
+var scheduleRunsResponseSchema = z15.object({
+  runs: z15.array(runSummarySchema)
+});
+var scheduleListResponseSchema = z15.object({
+  schedules: z15.array(scheduleResponseSchema)
+});
+var deployScheduleResponseSchema = z15.object({
   schedule: scheduleResponseSchema,
-  created: z14.boolean()
+  created: z15.boolean()
   // true if created, false if updated
 });
-var schedulesMainContract = c12.router({
+var schedulesMainContract = c13.router({
   /**
    * POST /api/agent/schedules
    * Deploy (create or update) a schedule
@@ -1939,7 +2091,7 @@ var schedulesMainContract = c12.router({
     summary: "List all schedules"
   }
 });
-var schedulesByNameContract = c12.router({
+var schedulesByNameContract = c13.router({
   /**
    * GET /api/agent/schedules/:name
    * Get schedule by name
@@ -1947,11 +2099,11 @@ var schedulesByNameContract = c12.router({
   getByName: {
     method: "GET",
     path: "/api/agent/schedules/:name",
-    pathParams: z14.object({
-      name: z14.string().min(1, "Schedule name required")
+    pathParams: z15.object({
+      name: z15.string().min(1, "Schedule name required")
     }),
-    query: z14.object({
-      composeId: z14.string().uuid("Compose ID required")
+    query: z15.object({
+      composeId: z15.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -1967,21 +2119,21 @@ var schedulesByNameContract = c12.router({
   delete: {
     method: "DELETE",
     path: "/api/agent/schedules/:name",
-    pathParams: z14.object({
-      name: z14.string().min(1, "Schedule name required")
+    pathParams: z15.object({
+      name: z15.string().min(1, "Schedule name required")
     }),
-    query: z14.object({
-      composeId: z14.string().uuid("Compose ID required")
+    query: z15.object({
+      composeId: z15.string().uuid("Compose ID required")
     }),
     responses: {
-      204: z14.undefined(),
+      204: z15.undefined(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete schedule"
   }
 });
-var schedulesEnableContract = c12.router({
+var schedulesEnableContract = c13.router({
   /**
    * POST /api/agent/schedules/:name/enable
    * Enable a disabled schedule
@@ -1989,11 +2141,11 @@ var schedulesEnableContract = c12.router({
   enable: {
     method: "POST",
     path: "/api/agent/schedules/:name/enable",
-    pathParams: z14.object({
-      name: z14.string().min(1, "Schedule name required")
+    pathParams: z15.object({
+      name: z15.string().min(1, "Schedule name required")
     }),
-    body: z14.object({
-      composeId: z14.string().uuid("Compose ID required")
+    body: z15.object({
+      composeId: z15.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -2009,11 +2161,11 @@ var schedulesEnableContract = c12.router({
   disable: {
     method: "POST",
     path: "/api/agent/schedules/:name/disable",
-    pathParams: z14.object({
-      name: z14.string().min(1, "Schedule name required")
+    pathParams: z15.object({
+      name: z15.string().min(1, "Schedule name required")
     }),
-    body: z14.object({
-      composeId: z14.string().uuid("Compose ID required")
+    body: z15.object({
+      composeId: z15.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -2023,7 +2175,7 @@ var schedulesEnableContract = c12.router({
     summary: "Disable schedule"
   }
 });
-var scheduleRunsContract = c12.router({
+var scheduleRunsContract = c13.router({
   /**
    * GET /api/agent/schedules/:name/runs
    * List recent runs for a schedule
@@ -2031,12 +2183,12 @@ var scheduleRunsContract = c12.router({
   listRuns: {
     method: "GET",
     path: "/api/agent/schedules/:name/runs",
-    pathParams: z14.object({
-      name: z14.string().min(1, "Schedule name required")
+    pathParams: z15.object({
+      name: z15.string().min(1, "Schedule name required")
     }),
-    query: z14.object({
-      composeId: z14.string().uuid("Compose ID required"),
-      limit: z14.coerce.number().min(0).max(100).default(5)
+    query: z15.object({
+      composeId: z15.string().uuid("Compose ID required"),
+      limit: z15.coerce.number().min(0).max(100).default(5)
     }),
     responses: {
       200: scheduleRunsResponseSchema,
@@ -2048,18 +2200,18 @@ var scheduleRunsContract = c12.router({
 });
 
 // ../../packages/core/src/contracts/realtime.ts
-import { z as z15 } from "zod";
-var c13 = initContract();
-var ablyTokenRequestSchema = z15.object({
-  keyName: z15.string(),
-  ttl: z15.number().optional(),
-  timestamp: z15.number(),
-  capability: z15.string(),
-  clientId: z15.string().optional(),
-  nonce: z15.string(),
-  mac: z15.string()
-});
-var realtimeTokenContract = c13.router({
+import { z as z16 } from "zod";
+var c14 = initContract();
+var ablyTokenRequestSchema = z16.object({
+  keyName: z16.string(),
+  ttl: z16.number().optional(),
+  timestamp: z16.number(),
+  capability: z16.string(),
+  clientId: z16.string().optional(),
+  nonce: z16.string(),
+  mac: z16.string()
+});
+var realtimeTokenContract = c14.router({
   /**
    * POST /api/realtime/token
    * Get an Ably token to subscribe to a run's events channel
@@ -2067,8 +2219,8 @@ var realtimeTokenContract = c13.router({
   create: {
     method: "POST",
     path: "/api/realtime/token",
-    body: z15.object({
-      runId: z15.string().uuid("runId must be a valid UUID")
+    body: z16.object({
+      runId: z16.string().uuid("runId must be a valid UUID")
     }),
     responses: {
       200: ablyTokenRequestSchema,
@@ -2082,8 +2234,8 @@ var realtimeTokenContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/public/common.ts
-import { z as z16 } from "zod";
-var publicApiErrorTypeSchema = z16.enum([
+import { z as z17 } from "zod";
+var publicApiErrorTypeSchema = z17.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -2095,55 +2247,55 @@ var publicApiErrorTypeSchema = z16.enum([
   "conflict_error"
   // Resource conflict (409)
 ]);
-var publicApiErrorSchema = z16.object({
-  error: z16.object({
+var publicApiErrorSchema = z17.object({
+  error: z17.object({
     type: publicApiErrorTypeSchema,
-    code: z16.string(),
-    message: z16.string(),
-    param: z16.string().optional(),
-    doc_url: z16.string().url().optional()
+    code: z17.string(),
+    message: z17.string(),
+    param: z17.string().optional(),
+    doc_url: z17.string().url().optional()
   })
 });
-var paginationSchema = z16.object({
-  has_more: z16.boolean(),
-  next_cursor: z16.string().nullable()
+var paginationSchema = z17.object({
+  has_more: z17.boolean(),
+  next_cursor: z17.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z16.object({
-    data: z16.array(dataSchema),
+  return z17.object({
+    data: z17.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z16.object({
-  cursor: z16.string().optional(),
-  limit: z16.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z17.object({
+  cursor: z17.string().optional(),
+  limit: z17.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z16.string().uuid();
-var timestampSchema = z16.string().datetime();
+var requestIdSchema = z17.string().uuid();
+var timestampSchema = z17.string().datetime();
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z17 } from "zod";
-var c14 = initContract();
-var publicAgentSchema = z17.object({
-  id: z17.string(),
-  name: z17.string(),
-  current_version_id: z17.string().nullable(),
+import { z as z18 } from "zod";
+var c15 = initContract();
+var publicAgentSchema = z18.object({
+  id: z18.string(),
+  name: z18.string(),
+  current_version_id: z18.string().nullable(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var agentVersionSchema = z17.object({
-  id: z17.string(),
-  agent_id: z17.string(),
-  version_number: z17.number(),
+var agentVersionSchema = z18.object({
+  id: z18.string(),
+  agent_id: z18.string(),
+  version_number: z18.number(),
   created_at: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z17.string().optional()
+  name: z18.string().optional()
 });
-var publicAgentsListContract = c14.router({
+var publicAgentsListContract = c15.router({
   list: {
     method: "GET",
     path: "/v1/agents",
@@ -2157,12 +2309,12 @@ var publicAgentsListContract = c14.router({
     description: "List all agents in the current scope with pagination. Use the `name` query parameter to filter by agent name."
   }
 });
-var publicAgentByIdContract = c14.router({
+var publicAgentByIdContract = c15.router({
   get: {
     method: "GET",
     path: "/v1/agents/:id",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Agent ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -2174,12 +2326,12 @@ var publicAgentByIdContract = c14.router({
     description: "Get agent details by ID"
   }
 });
-var publicAgentVersionsContract = c14.router({
+var publicAgentVersionsContract = c15.router({
   list: {
     method: "GET",
     path: "/v1/agents/:id/versions",
-    pathParams: z17.object({
-      id: z17.string().min(1, "Agent ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -2194,9 +2346,9 @@ var publicAgentVersionsContract = c14.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z18 } from "zod";
-var c15 = initContract();
-var publicRunStatusSchema = z18.enum([
+import { z as z19 } from "zod";
+var c16 = initContract();
+var publicRunStatusSchema = z19.enum([
   "pending",
   "running",
   "completed",
@@ -2204,56 +2356,56 @@ var publicRunStatusSchema = z18.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z18.object({
-  id: z18.string(),
-  agent_id: z18.string(),
-  agent_name: z18.string(),
+var publicRunSchema = z19.object({
+  id: z19.string(),
+  agent_id: z19.string(),
+  agent_name: z19.string(),
   status: publicRunStatusSchema,
-  prompt: z18.string(),
+  prompt: z19.string(),
   created_at: timestampSchema,
   started_at: timestampSchema.nullable(),
   completed_at: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z18.string().nullable(),
-  execution_time_ms: z18.number().nullable(),
-  checkpoint_id: z18.string().nullable(),
-  session_id: z18.string().nullable(),
-  artifact_name: z18.string().nullable(),
-  artifact_version: z18.string().nullable(),
-  volumes: z18.record(z18.string(), z18.string()).optional()
+  error: z19.string().nullable(),
+  execution_time_ms: z19.number().nullable(),
+  checkpoint_id: z19.string().nullable(),
+  session_id: z19.string().nullable(),
+  artifact_name: z19.string().nullable(),
+  artifact_version: z19.string().nullable(),
+  volumes: z19.record(z19.string(), z19.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z18.object({
+var createRunRequestSchema = z19.object({
   // Agent identification (one of: agent, agent_id, session_id, checkpoint_id)
-  agent: z18.string().optional(),
+  agent: z19.string().optional(),
   // Agent name
-  agent_id: z18.string().optional(),
+  agent_id: z19.string().optional(),
   // Agent ID
-  agent_version: z18.string().optional(),
+  agent_version: z19.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  session_id: z18.string().optional(),
+  session_id: z19.string().optional(),
   // Resume from checkpoint
-  checkpoint_id: z18.string().optional(),
+  checkpoint_id: z19.string().optional(),
   // Required
-  prompt: z18.string().min(1, "Prompt is required"),
+  prompt: z19.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z18.record(z18.string(), z18.string()).optional(),
-  secrets: z18.record(z18.string(), z18.string()).optional(),
-  artifact_name: z18.string().optional(),
+  variables: z19.record(z19.string(), z19.string()).optional(),
+  secrets: z19.record(z19.string(), z19.string()).optional(),
+  artifact_name: z19.string().optional(),
   // Artifact name to mount
-  artifact_version: z18.string().optional(),
+  artifact_version: z19.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z18.record(z18.string(), z18.string()).optional()
+  volumes: z19.record(z19.string(), z19.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
-  agent_id: z18.string().optional(),
+  agent_id: z19.string().optional(),
   status: publicRunStatusSchema.optional(),
   since: timestampSchema.optional()
 });
-var publicRunsListContract = c15.router({
+var publicRunsListContract = c16.router({
   list: {
     method: "GET",
     path: "/v1/runs",
@@ -2282,12 +2434,12 @@ var publicRunsListContract = c15.router({
     description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
   }
 });
-var publicRunByIdContract = c15.router({
+var publicRunByIdContract = c16.router({
   get: {
     method: "GET",
     path: "/v1/runs/:id",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Run ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -2299,14 +2451,14 @@ var publicRunByIdContract = c15.router({
     description: "Get run details by ID"
   }
 });
-var publicRunCancelContract = c15.router({
+var publicRunCancelContract = c16.router({
   cancel: {
     method: "POST",
     path: "/v1/runs/:id/cancel",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Run ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Run ID is required")
     }),
-    body: z18.undefined(),
+    body: z19.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -2319,26 +2471,26 @@ var publicRunCancelContract = c15.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z18.object({
+var logEntrySchema = z19.object({
   timestamp: timestampSchema,
-  type: z18.enum(["agent", "system", "network"]),
-  level: z18.enum(["debug", "info", "warn", "error"]),
-  message: z18.string(),
-  metadata: z18.record(z18.string(), z18.unknown()).optional()
+  type: z19.enum(["agent", "system", "network"]),
+  level: z19.enum(["debug", "info", "warn", "error"]),
+  message: z19.string(),
+  metadata: z19.record(z19.string(), z19.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z18.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z19.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z18.enum(["asc", "desc"]).default("asc")
+  order: z19.enum(["asc", "desc"]).default("asc")
 });
-var publicRunLogsContract = c15.router({
+var publicRunLogsContract = c16.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Run ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -2351,29 +2503,29 @@ var publicRunLogsContract = c15.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z18.object({
+var metricPointSchema = z19.object({
   timestamp: timestampSchema,
-  cpu_percent: z18.number(),
-  memory_used_mb: z18.number(),
-  memory_total_mb: z18.number(),
-  disk_used_mb: z18.number(),
-  disk_total_mb: z18.number()
-});
-var metricsSummarySchema = z18.object({
-  avg_cpu_percent: z18.number(),
-  max_memory_used_mb: z18.number(),
-  total_duration_ms: z18.number().nullable()
-});
-var metricsResponseSchema2 = z18.object({
-  data: z18.array(metricPointSchema),
+  cpu_percent: z19.number(),
+  memory_used_mb: z19.number(),
+  memory_total_mb: z19.number(),
+  disk_used_mb: z19.number(),
+  disk_total_mb: z19.number()
+});
+var metricsSummarySchema = z19.object({
+  avg_cpu_percent: z19.number(),
+  max_memory_used_mb: z19.number(),
+  total_duration_ms: z19.number().nullable()
+});
+var metricsResponseSchema2 = z19.object({
+  data: z19.array(metricPointSchema),
   summary: metricsSummarySchema
 });
-var publicRunMetricsContract = c15.router({
+var publicRunMetricsContract = c16.router({
   getMetrics: {
     method: "GET",
     path: "/v1/runs/:id/metrics",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Run ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -2385,7 +2537,7 @@ var publicRunMetricsContract = c15.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z18.enum([
+var sseEventTypeSchema = z19.enum([
   "status",
   // Run status change
   "output",
@@ -2397,25 +2549,25 @@ var sseEventTypeSchema = z18.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z18.object({
+var sseEventSchema = z19.object({
   event: sseEventTypeSchema,
-  data: z18.unknown(),
-  id: z18.string().optional()
+  data: z19.unknown(),
+  id: z19.string().optional()
   // For Last-Event-ID reconnection
 });
-var publicRunEventsContract = c15.router({
+var publicRunEventsContract = c16.router({
   streamEvents: {
     method: "GET",
     path: "/v1/runs/:id/events",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Run ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Run ID is required")
     }),
-    query: z18.object({
-      last_event_id: z18.string().optional()
+    query: z19.object({
+      last_event_id: z19.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z18.any(),
+      200: z19.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -2427,28 +2579,28 @@ var publicRunEventsContract = c15.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z19 } from "zod";
-var c16 = initContract();
-var publicArtifactSchema = z19.object({
-  id: z19.string(),
-  name: z19.string(),
-  current_version_id: z19.string().nullable(),
-  size: z19.number(),
+import { z as z20 } from "zod";
+var c17 = initContract();
+var publicArtifactSchema = z20.object({
+  id: z20.string(),
+  name: z20.string(),
+  current_version_id: z20.string().nullable(),
+  size: z20.number(),
   // Total size in bytes
-  file_count: z19.number(),
+  file_count: z20.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var artifactVersionSchema = z19.object({
-  id: z19.string(),
+var artifactVersionSchema = z20.object({
+  id: z20.string(),
   // SHA-256 content hash
-  artifact_id: z19.string(),
-  size: z19.number(),
+  artifact_id: z20.string(),
+  size: z20.number(),
   // Size in bytes
-  file_count: z19.number(),
-  message: z19.string().nullable(),
+  file_count: z20.number(),
+  message: z20.string().nullable(),
   // Optional commit message
-  created_by: z19.string(),
+  created_by: z20.string(),
   created_at: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -2458,7 +2610,7 @@ var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchem
 var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
   artifactVersionSchema
 );
-var publicArtifactsListContract = c16.router({
+var publicArtifactsListContract = c17.router({
   list: {
     method: "GET",
     path: "/v1/artifacts",
@@ -2472,12 +2624,12 @@ var publicArtifactsListContract = c16.router({
     description: "List all artifacts in the current scope with pagination"
   }
 });
-var publicArtifactByIdContract = c16.router({
+var publicArtifactByIdContract = c17.router({
   get: {
     method: "GET",
     path: "/v1/artifacts/:id",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Artifact ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -2489,12 +2641,12 @@ var publicArtifactByIdContract = c16.router({
     description: "Get artifact details by ID"
   }
 });
-var publicArtifactVersionsContract = c16.router({
+var publicArtifactVersionsContract = c17.router({
   list: {
     method: "GET",
     path: "/v1/artifacts/:id/versions",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Artifact ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -2507,19 +2659,19 @@ var publicArtifactVersionsContract = c16.router({
     description: "List all versions of an artifact with pagination"
   }
 });
-var publicArtifactDownloadContract = c16.router({
+var publicArtifactDownloadContract = c17.router({
   download: {
     method: "GET",
     path: "/v1/artifacts/:id/download",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Artifact ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Artifact ID is required")
     }),
-    query: z19.object({
-      version_id: z19.string().optional()
+    query: z20.object({
+      version_id: z20.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z19.undefined(),
+      302: z20.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -2531,28 +2683,28 @@ var publicArtifactDownloadContract = c16.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z20 } from "zod";
-var c17 = initContract();
-var publicVolumeSchema = z20.object({
-  id: z20.string(),
-  name: z20.string(),
-  current_version_id: z20.string().nullable(),
-  size: z20.number(),
+import { z as z21 } from "zod";
+var c18 = initContract();
+var publicVolumeSchema = z21.object({
+  id: z21.string(),
+  name: z21.string(),
+  current_version_id: z21.string().nullable(),
+  size: z21.number(),
   // Total size in bytes
-  file_count: z20.number(),
+  file_count: z21.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var volumeVersionSchema = z20.object({
-  id: z20.string(),
+var volumeVersionSchema = z21.object({
+  id: z21.string(),
   // SHA-256 content hash
-  volume_id: z20.string(),
-  size: z20.number(),
+  volume_id: z21.string(),
+  size: z21.number(),
   // Size in bytes
-  file_count: z20.number(),
-  message: z20.string().nullable(),
+  file_count: z21.number(),
+  message: z21.string().nullable(),
   // Optional commit message
-  created_by: z20.string(),
+  created_by: z21.string(),
   created_at: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -2560,7 +2712,7 @@ var publicVolumeDetailSchema = publicVolumeSchema.extend({
 });
 var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
 var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
-var publicVolumesListContract = c17.router({
+var publicVolumesListContract = c18.router({
   list: {
     method: "GET",
     path: "/v1/volumes",
@@ -2574,12 +2726,12 @@ var publicVolumesListContract = c17.router({
     description: "List all volumes in the current scope with pagination"
   }
 });
-var publicVolumeByIdContract = c17.router({
+var publicVolumeByIdContract = c18.router({
   get: {
     method: "GET",
     path: "/v1/volumes/:id",
-    pathParams: z20.object({
-      id: z20.string().min(1, "Volume ID is required")
+    pathParams: z21.object({
+      id: z21.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -2591,12 +2743,12 @@ var publicVolumeByIdContract = c17.router({
     description: "Get volume details by ID"
   }
 });
-var publicVolumeVersionsContract = c17.router({
+var publicVolumeVersionsContract = c18.router({
   list: {
     method: "GET",
     path: "/v1/volumes/:id/versions",
-    pathParams: z20.object({
-      id: z20.string().min(1, "Volume ID is required")
+    pathParams: z21.object({
+      id: z21.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -2609,19 +2761,19 @@ var publicVolumeVersionsContract = c17.router({
     description: "List all versions of a volume with pagination"
   }
 });
-var publicVolumeDownloadContract = c17.router({
+var publicVolumeDownloadContract = c18.router({
   download: {
     method: "GET",
     path: "/v1/volumes/:id/download",
-    pathParams: z20.object({
-      id: z20.string().min(1, "Volume ID is required")
+    pathParams: z21.object({
+      id: z21.string().min(1, "Volume ID is required")
     }),
-    query: z20.object({
-      version_id: z20.string().optional()
+    query: z21.object({
+      version_id: z21.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z20.undefined(),
+      302: z21.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -3091,6 +3243,71 @@ async function deleteCredential(name) {
   handleError(result, `Credential "${name}" not found`);
 }
 
+// src/lib/api/domains/model-providers.ts
+import { initClient as initClient8 } from "@ts-rest/core";
+async function listModelProviders() {
+  const config = await getClientConfig();
+  const client = initClient8(modelProvidersMainContract, config);
+  const result = await client.list();
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to list model providers");
+}
+async function upsertModelProvider(body) {
+  const config = await getClientConfig();
+  const client = initClient8(modelProvidersMainContract, config);
+  const result = await client.upsert({ body });
+  if (result.status === 200 || result.status === 201) {
+    return result.body;
+  }
+  handleError(result, "Failed to set model provider");
+}
+async function checkModelProviderCredential(type) {
+  const config = await getClientConfig();
+  const client = initClient8(modelProvidersCheckContract, config);
+  const result = await client.check({
+    params: { type }
+  });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to check credential");
+}
+async function deleteModelProvider(type) {
+  const config = await getClientConfig();
+  const client = initClient8(modelProvidersByTypeContract, config);
+  const result = await client.delete({
+    params: { type }
+  });
+  if (result.status === 204) {
+    return;
+  }
+  handleError(result, `Model provider "${type}" not found`);
+}
+async function convertModelProviderCredential(type) {
+  const config = await getClientConfig();
+  const client = initClient8(modelProvidersConvertContract, config);
+  const result = await client.convert({
+    params: { type }
+  });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to convert credential");
+}
+async function setModelProviderDefault(type) {
+  const config = await getClientConfig();
+  const client = initClient8(modelProvidersSetDefaultContract, config);
+  const result = await client.setDefault({
+    params: { type }
+  });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to set default model provider");
+}
+
 // src/lib/api/domains/usage.ts
 async function getUsage(options) {
   const baseUrl = await getBaseUrl();
@@ -3111,7 +3328,7 @@ async function getUsage(options) {
 }
 
 // src/lib/domain/yaml-validator.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 
 // src/lib/domain/framework-config.ts
 var FRAMEWORK_DEFAULTS = {
@@ -3178,7 +3395,7 @@ function getDefaultImageWithApps(framework, apps) {
 }
 
 // src/lib/domain/yaml-validator.ts
-var cliAgentNameSchema = z21.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
+var cliAgentNameSchema = z22.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
   /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/,
   "Agent name must start and end with letter or number, and contain only letters, numbers, and hyphens"
 );
@@ -3191,14 +3408,14 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     const frameworkSupported = isFrameworkSupported(agent.framework);
     if (!agent.image && !frameworkSupported) {
       ctx.addIssue({
-        code: z21.ZodIssueCode.custom,
+        code: z22.ZodIssueCode.custom,
         message: "Missing agent.image (required when framework is not auto-configured)",
         path: ["image"]
       });
     }
     if (!agent.working_dir && !frameworkSupported) {
       ctx.addIssue({
-        code: z21.ZodIssueCode.custom,
+        code: z22.ZodIssueCode.custom,
         message: "Missing agent.working_dir (required when framework is not auto-configured)",
         path: ["working_dir"]
       });
@@ -3208,7 +3425,7 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
         const skillUrl = agent.skills[i];
         if (skillUrl && !validateGitHubTreeUrl(skillUrl)) {
           ctx.addIssue({
-            code: z21.ZodIssueCode.custom,
+            code: z22.ZodIssueCode.custom,
             message: `Invalid skill URL: ${skillUrl}. Expected format: https://github.com/{owner}/{repo}/tree/{branch}/{path}`,
             path: ["skills", i]
           });
@@ -3217,15 +3434,15 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     }
   }
 );
-var cliComposeSchema = z21.object({
-  version: z21.string().min(1, "Missing config.version"),
-  agents: z21.record(cliAgentNameSchema, cliAgentDefinitionSchema),
-  volumes: z21.record(z21.string(), volumeConfigSchema).optional()
+var cliComposeSchema = z22.object({
+  version: z22.string().min(1, "Missing config.version"),
+  agents: z22.record(cliAgentNameSchema, cliAgentDefinitionSchema),
+  volumes: z22.record(z22.string(), volumeConfigSchema).optional()
 }).superRefine((config, ctx) => {
   const agentKeys = Object.keys(config.agents);
   if (agentKeys.length === 0) {
     ctx.addIssue({
-      code: z21.ZodIssueCode.custom,
+      code: z22.ZodIssueCode.custom,
       message: "agents must have at least one agent defined",
       path: ["agents"]
     });
@@ -3233,7 +3450,7 @@ var cliComposeSchema = z21.object({
   }
   if (agentKeys.length > 1) {
     ctx.addIssue({
-      code: z21.ZodIssueCode.custom,
+      code: z22.ZodIssueCode.custom,
       message: "Multiple agents not supported yet. Only one agent allowed.",
       path: ["agents"]
     });
@@ -3245,7 +3462,7 @@ var cliComposeSchema = z21.object({
   if (agentVolumes && agentVolumes.length > 0) {
     if (!config.volumes) {
       ctx.addIssue({
-        code: z21.ZodIssueCode.custom,
+        code: z22.ZodIssueCode.custom,
         message: "Agent references volumes but no volumes section defined. Each volume must have explicit name and version.",
         path: ["volumes"]
       });
@@ -3255,7 +3472,7 @@ var cliComposeSchema = z21.object({
       const parts = volDeclaration.split(":");
       if (parts.length !== 2) {
         ctx.addIssue({
-          code: z21.ZodIssueCode.custom,
+          code: z22.ZodIssueCode.custom,
           message: `Invalid volume declaration: ${volDeclaration}. Expected format: volume-key:/mount/path`,
           path: ["agents", agentName, "volumes"]
         });
@@ -3264,7 +3481,7 @@ var cliComposeSchema = z21.object({
       const volumeKey = parts[0].trim();
       if (!config.volumes[volumeKey]) {
         ctx.addIssue({
-          code: z21.ZodIssueCode.custom,
+          code: z22.ZodIssueCode.custom,
           message: `Volume "${volumeKey}" is not defined in volumes section. Each volume must have explicit name and version.`,
           path: ["volumes", volumeKey]
         });
@@ -4085,7 +4302,7 @@ var composeCommand = new Command().name("compose").description("Create or update
 });
 
 // src/commands/run/run.ts
-import { Command as Command2 } from "commander";
+import { Command as Command2, Option } from "commander";
 import chalk6 from "chalk";
 
 // src/lib/events/event-renderer.ts
@@ -4540,9 +4757,9 @@ var CodexEventParser = class {
       }
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const changes = item.changes.map((c18) => {
-        const action = c18.kind === "add" ? "Created" : c18.kind === "modify" ? "Modified" : "Deleted";
-        return `${action}: ${c18.path}`;
+      const changes = item.changes.map((c19) => {
+        const action = c19.kind === "add" ? "Created" : c19.kind === "modify" ? "Modified" : "Deleted";
+        return `${action}: ${c19.path}`;
       }).join("\n");
       return {
         type: "text",
@@ -4695,9 +4912,9 @@ var CodexEventRenderer = class {
       return;
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const summary = item.changes.map((c18) => {
-        const icon = c18.kind === "add" ? "+" : c18.kind === "delete" ? "-" : "~";
-        return `${icon}${c18.path}`;
+      const summary = item.changes.map((c19) => {
+        const icon = c19.kind === "add" ? "+" : c19.kind === "delete" ? "-" : "~";
+        return `${icon}${c19.path}`;
       }).join(", ");
       console.log(chalk4.green("[files]") + ` ${summary}`);
       return;
@@ -4718,7 +4935,7 @@ var CodexEventRenderer = class {
 };
 
 // src/lib/api/api-client.ts
-import { initClient as initClient8 } from "@ts-rest/core";
+import { initClient as initClient9 } from "@ts-rest/core";
 var ApiClient = class {
   async getHeaders() {
     const token = await getToken();
@@ -4744,7 +4961,7 @@ var ApiClient = class {
   async getComposeByName(name, scope) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(composesMainContract, {
+    const client = initClient9(composesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4765,7 +4982,7 @@ var ApiClient = class {
   async getComposeById(id) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(composesByIdContract, {
+    const client = initClient9(composesByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4787,7 +5004,7 @@ var ApiClient = class {
   async getComposeVersion(composeId, version) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(composesVersionsContract, {
+    const client = initClient9(composesVersionsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4808,7 +5025,7 @@ var ApiClient = class {
   async createOrUpdateCompose(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(composesMainContract, {
+    const client = initClient9(composesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4831,7 +5048,7 @@ var ApiClient = class {
   async createRun(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(runsMainContract, {
+    const client = initClient9(runsMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4847,7 +5064,7 @@ var ApiClient = class {
   async getEvents(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(runEventsContract, {
+    const client = initClient9(runEventsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4869,7 +5086,7 @@ var ApiClient = class {
   async getSystemLog(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(runSystemLogContract, {
+    const client = initClient9(runSystemLogContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4892,7 +5109,7 @@ var ApiClient = class {
   async getMetrics(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(runMetricsContract, {
+    const client = initClient9(runMetricsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4915,7 +5132,7 @@ var ApiClient = class {
   async getAgentEvents(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(runAgentEventsContract, {
+    const client = initClient9(runAgentEventsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4938,7 +5155,7 @@ var ApiClient = class {
   async getNetworkLogs(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(runNetworkLogsContract, {
+    const client = initClient9(runNetworkLogsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4964,7 +5181,7 @@ var ApiClient = class {
   async getScope() {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(scopeContract, {
+    const client = initClient9(scopeContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -4983,7 +5200,7 @@ var ApiClient = class {
   async createScope(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(scopeContract, {
+    const client = initClient9(scopeContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5002,7 +5219,7 @@ var ApiClient = class {
   async updateScope(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(scopeContract, {
+    const client = initClient9(scopeContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5022,7 +5239,7 @@ var ApiClient = class {
   async getSession(sessionId) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(sessionsByIdContract, {
+    const client = initClient9(sessionsByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5044,7 +5261,7 @@ var ApiClient = class {
   async getCheckpoint(checkpointId) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(checkpointsByIdContract, {
+    const client = initClient9(checkpointsByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5065,7 +5282,7 @@ var ApiClient = class {
   async prepareStorage(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(storagesPrepareContract, {
+    const client = initClient9(storagesPrepareContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5084,7 +5301,7 @@ var ApiClient = class {
   async commitStorage(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(storagesCommitContract, {
+    const client = initClient9(storagesCommitContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5103,7 +5320,7 @@ var ApiClient = class {
   async getStorageDownload(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(storagesDownloadContract, {
+    const client = initClient9(storagesDownloadContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5128,7 +5345,7 @@ var ApiClient = class {
   async listStorages(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(storagesListContract, {
+    const client = initClient9(storagesListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5147,7 +5364,7 @@ var ApiClient = class {
   async deploySchedule(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(schedulesMainContract, {
+    const client = initClient9(schedulesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5166,7 +5383,7 @@ var ApiClient = class {
   async listSchedules() {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(schedulesMainContract, {
+    const client = initClient9(schedulesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5185,7 +5402,7 @@ var ApiClient = class {
   async getScheduleByName(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(schedulesByNameContract, {
+    const client = initClient9(schedulesByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5207,7 +5424,7 @@ var ApiClient = class {
   async deleteSchedule(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(schedulesByNameContract, {
+    const client = initClient9(schedulesByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5229,7 +5446,7 @@ var ApiClient = class {
   async enableSchedule(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(schedulesEnableContract, {
+    const client = initClient9(schedulesEnableContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5251,7 +5468,7 @@ var ApiClient = class {
   async disableSchedule(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(schedulesEnableContract, {
+    const client = initClient9(schedulesEnableContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5273,7 +5490,7 @@ var ApiClient = class {
   async listScheduleRuns(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(scheduleRunsContract, {
+    const client = initClient9(scheduleRunsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5298,7 +5515,7 @@ var ApiClient = class {
   async listPublicAgents(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(publicAgentsListContract, {
+    const client = initClient9(publicAgentsListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5317,7 +5534,7 @@ var ApiClient = class {
   async listPublicArtifacts(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(publicArtifactsListContract, {
+    const client = initClient9(publicArtifactsListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5336,7 +5553,7 @@ var ApiClient = class {
   async getPublicArtifact(id) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(publicArtifactByIdContract, {
+    const client = initClient9(publicArtifactByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5355,7 +5572,7 @@ var ApiClient = class {
   async listPublicVolumes(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(publicVolumesListContract, {
+    const client = initClient9(publicVolumesListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5374,7 +5591,7 @@ var ApiClient = class {
   async getPublicVolume(id) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(publicVolumeByIdContract, {
+    const client = initClient9(publicVolumeByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5413,7 +5630,7 @@ var ApiClient = class {
   async listCredentials() {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(credentialsMainContract, {
+    const client = initClient9(credentialsMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5432,7 +5649,7 @@ var ApiClient = class {
   async getCredential(name) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(credentialsByNameContract, {
+    const client = initClient9(credentialsByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5453,7 +5670,7 @@ var ApiClient = class {
   async setCredential(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(credentialsMainContract, {
+    const client = initClient9(credentialsMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5472,7 +5689,7 @@ var ApiClient = class {
   async deleteCredential(name) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(credentialsByNameContract, {
+    const client = initClient9(credentialsByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5493,7 +5710,7 @@ var ApiClient = class {
   async getRealtimeToken(runId) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient8(realtimeTokenContract, {
+    const client = initClient9(realtimeTokenContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -5924,7 +6141,10 @@ var mainRunCommand = new Command2().name("run").description("Execute an agent").
 ).option("-v, --verbose", "Show verbose output with timing information").option(
   "--experimental-realtime",
   "Use realtime event streaming instead of polling (experimental)"
-).option("--debug-no-mock-claude").action(
+).option(
+  "--model-provider <type>",
+  "Override model provider for LLM credentials (e.g., anthropic-api-key)"
+).addOption(new Option("--debug-no-mock-claude").hideHelp()).action(
   async (identifier, prompt, options) => {
     const startTimestamp = /* @__PURE__ */ new Date();
     const verbose = options.verbose;
@@ -6023,6 +6243,7 @@ var mainRunCommand = new Command2().name("run").description("Execute an agent").
         artifactVersion: options.artifactVersion,
         volumeVersions: Object.keys(options.volumeVersion).length > 0 ? options.volumeVersion : void 0,
         conversationId: options.conversation,
+        modelProvider: options.modelProvider,
         debugNoMockClaude: options.debugNoMockClaude || void 0
       });
       if (response.status === "failed") {
@@ -6084,7 +6305,7 @@ var mainRunCommand = new Command2().name("run").description("Execute an agent").
 );
 
 // src/commands/run/resume.ts
-import { Command as Command3 } from "commander";
+import { Command as Command3, Option as Option2 } from "commander";
 import chalk7 from "chalk";
 var resumeCommand = new Command3().name("resume").description("Resume an agent run from a checkpoint (uses all snapshot data)").argument("<checkpointId>", "Checkpoint ID to resume from").argument("<prompt>", "Prompt for the resumed agent").option(
   "--vars <KEY=value>",
@@ -6104,7 +6325,10 @@ var resumeCommand = new Command3().name("resume").description("Resume an agent r
 ).option("-v, --verbose", "Show verbose output with timing information").option(
   "--experimental-realtime",
   "Use realtime event streaming instead of polling (experimental)"
-).option("--debug-no-mock-claude").action(
+).option(
+  "--model-provider <type>",
+  "Override model provider for LLM credentials (e.g., anthropic-api-key)"
+).addOption(new Option2("--debug-no-mock-claude").hideHelp()).action(
   async (checkpointId, prompt, options, command) => {
     const startTimestamp = /* @__PURE__ */ new Date();
     const allOpts = command.optsWithGlobals();
@@ -6146,6 +6370,7 @@ var resumeCommand = new Command3().name("resume").description("Resume an agent r
         vars: Object.keys(vars).length > 0 ? vars : void 0,
         secrets: loadedSecrets,
         volumeVersions: Object.keys(allOpts.volumeVersion).length > 0 ? allOpts.volumeVersion : void 0,
+        modelProvider: options.modelProvider || allOpts.modelProvider,
         debugNoMockClaude: options.debugNoMockClaude || allOpts.debugNoMockClaude || void 0
       });
       if (response.status === "failed") {
@@ -6198,7 +6423,7 @@ var resumeCommand = new Command3().name("resume").description("Resume an agent r
 );
 
 // src/commands/run/continue.ts
-import { Command as Command4 } from "commander";
+import { Command as Command4, Option as Option3 } from "commander";
 import chalk8 from "chalk";
 var continueCommand = new Command4().name("continue").description(
   "Continue an agent run from a session (uses latest artifact version)"
@@ -6220,7 +6445,10 @@ var continueCommand = new Command4().name("continue").description(
 ).option("-v, --verbose", "Show verbose output with timing information").option(
   "--experimental-realtime",
   "Use realtime event streaming instead of polling (experimental)"
-).option("--debug-no-mock-claude").action(
+).option(
+  "--model-provider <type>",
+  "Override model provider for LLM credentials (e.g., anthropic-api-key)"
+).addOption(new Option3("--debug-no-mock-claude").hideHelp()).action(
   async (agentSessionId, prompt, options, command) => {
     const startTimestamp = /* @__PURE__ */ new Date();
     const allOpts = command.optsWithGlobals();
@@ -6263,6 +6491,7 @@ var continueCommand = new Command4().name("continue").description(
         vars: Object.keys(vars).length > 0 ? vars : void 0,
         secrets: loadedSecrets,
         volumeVersions: Object.keys(allOpts.volumeVersion).length > 0 ? allOpts.volumeVersion : void 0,
+        modelProvider: options.modelProvider || allOpts.modelProvider,
         debugNoMockClaude: options.debugNoMockClaude || allOpts.debugNoMockClaude || void 0
       });
       if (response.status === "failed") {
@@ -7258,7 +7487,7 @@ var cloneCommand2 = new Command17().name("clone").description("Clone a remote ar
 var artifactCommand = new Command18().name("artifact").description("Manage cloud artifacts (work products)").addCommand(initCommand2).addCommand(pushCommand2).addCommand(pullCommand2).addCommand(statusCommand2).addCommand(listCommand2).addCommand(cloneCommand2);
 
 // src/commands/cook.ts
-import { Command as Command19 } from "commander";
+import { Command as Command19, Option as Option4 } from "commander";
 import chalk24 from "chalk";
 import { readFile as readFile7, mkdir as mkdir6, writeFile as writeFile6, appendFile } from "fs/promises";
 import { existsSync as existsSync8, readFileSync } from "fs";
@@ -7590,9 +7819,9 @@ async function autoPullArtifact(runOutput, artifactDir) {
   }
 }
 var cookCmd = new Command19().name("cook").description("One-click agent preparation and execution from vm0.yaml");
-cookCmd.argument("[prompt]", "Prompt for the agent").option("-y, --yes", "Skip confirmation prompts").option("--debug-no-mock-claude").action(
+cookCmd.argument("[prompt]", "Prompt for the agent").option("-y, --yes", "Skip confirmation prompts").addOption(new Option4("--debug-no-mock-claude").hideHelp()).action(
   async (prompt, options) => {
-    const shouldExit = await checkAndUpgrade("6.0.0", prompt);
+    const shouldExit = await checkAndUpgrade("6.2.0", prompt);
     if (shouldExit) {
       process.exit(0);
     }
@@ -7817,7 +8046,7 @@ cookCmd.command("logs").description("View logs from the last cook run").option("
 );
 cookCmd.command("continue").description(
   "Continue from the last session (latest conversation and artifact)"
-).argument("<prompt>", "Prompt for the continued agent").option("--debug-no-mock-claude").action(async (prompt, options) => {
+).argument("<prompt>", "Prompt for the continued agent").addOption(new Option4("--debug-no-mock-claude").hideHelp()).action(async (prompt, options) => {
   const state = await loadCookState();
   if (!state.lastSessionId) {
     console.error(chalk24.red("\u2717 No previous session found"));
@@ -7855,7 +8084,7 @@ cookCmd.command("continue").description(
 });
 cookCmd.command("resume").description(
   "Resume from the last checkpoint (snapshotted conversation and artifact)"
-).argument("<prompt>", "Prompt for the resumed agent").option("--debug-no-mock-claude").action(async (prompt, options) => {
+).argument("<prompt>", "Prompt for the resumed agent").addOption(new Option4("--debug-no-mock-claude").hideHelp()).action(async (prompt, options) => {
   const state = await loadCookState();
   if (!state.lastCheckpointId) {
     console.error(chalk24.red("\u2717 No previous checkpoint found"));
@@ -8293,7 +8522,7 @@ var listCommand3 = new Command24().name("list").alias("ls").description("List al
       );
       return;
     }
-    const nameWidth = Math.max(4, ...data.composes.map((c18) => c18.name.length));
+    const nameWidth = Math.max(4, ...data.composes.map((c19) => c19.name.length));
     const header = ["NAME".padEnd(nameWidth), "VERSION", "UPDATED"].join(
       "  "
     );
@@ -10469,7 +10698,8 @@ var listCommand5 = new Command38().name("list").description("List all credential
     console.log(chalk40.bold("Credentials:"));
     console.log();
     for (const credential of result.credentials) {
-      console.log(`  ${chalk40.cyan(credential.name)}`);
+      const typeIndicator = credential.type === "model-provider" ? chalk40.dim(" [model-provider]") : "";
+      console.log(`  ${chalk40.cyan(credential.name)}${typeIndicator}`);
       if (credential.description) {
         console.log(`    ${chalk40.dim(credential.description)}`);
       }
@@ -10587,11 +10817,268 @@ var deleteCommand2 = new Command40().name("delete").description("Delete a creden
 // src/commands/credential/index.ts
 var credentialCommand = new Command41().name("experimental-credential").description("[Experimental] Manage stored credentials for agent runs").addCommand(listCommand5).addCommand(setCommand2).addCommand(deleteCommand2);
 
+// src/commands/model-provider/index.ts
+import { Command as Command46 } from "commander";
+
+// src/commands/model-provider/list.ts
+import { Command as Command42 } from "commander";
+import chalk43 from "chalk";
+var listCommand6 = new Command42().name("list").alias("ls").description("List all model providers").action(async () => {
+  try {
+    const result = await listModelProviders();
+    if (result.modelProviders.length === 0) {
+      console.log(chalk43.dim("No model providers configured."));
+      console.log();
+      console.log("To add a model provider:");
+      console.log(chalk43.cyan("  vm0 model-provider setup"));
+      return;
+    }
+    const byFramework = result.modelProviders.reduce(
+      (acc, p) => {
+        const fw = p.framework;
+        if (!acc[fw]) {
+          acc[fw] = [];
+        }
+        acc[fw].push(p);
+        return acc;
+      },
+      {}
+    );
+    console.log(chalk43.bold("Model Providers:"));
+    console.log();
+    for (const [framework, providers] of Object.entries(byFramework)) {
+      console.log(`  ${chalk43.cyan(framework)}:`);
+      for (const provider of providers) {
+        const defaultTag = provider.isDefault ? chalk43.green(" (default)") : "";
+        console.log(`    ${provider.type}${defaultTag}`);
+        console.log(
+          chalk43.dim(
+            `      Updated: ${new Date(provider.updatedAt).toLocaleString()}`
+          )
+        );
+      }
+      console.log();
+    }
+    console.log(
+      chalk43.dim(`Total: ${result.modelProviders.length} provider(s)`)
+    );
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(chalk43.red("x Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk43.red(`x ${error.message}`));
+      }
+    } else {
+      console.error(chalk43.red("x An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/model-provider/setup.ts
+import { Command as Command43 } from "commander";
+import chalk44 from "chalk";
+import prompts3 from "prompts";
+var providerChoices = Object.entries(MODEL_PROVIDER_TYPES).map(
+  ([type, config]) => ({
+    title: config.label,
+    value: type
+  })
+);
+var setupCommand = new Command43().name("setup").description("Configure a model provider").option("-t, --type <type>", "Provider type (for non-interactive mode)").option(
+  "-c, --credential <credential>",
+  "Credential value (for non-interactive mode)"
+).option("--convert", "Convert existing user credential to model provider").action(
+  async (options) => {
+    try {
+      let type;
+      let credential;
+      const shouldConvert = options.convert ?? false;
+      if (options.type && options.credential) {
+        if (!Object.keys(MODEL_PROVIDER_TYPES).includes(options.type)) {
+          console.error(chalk44.red(`x Invalid type "${options.type}"`));
+          console.log();
+          console.log("Valid types:");
+          for (const [t, config] of Object.entries(MODEL_PROVIDER_TYPES)) {
+            console.log(`  ${chalk44.cyan(t)} - ${config.label}`);
+          }
+          process.exit(1);
+        }
+        type = options.type;
+        credential = options.credential;
+      } else if (options.type || options.credential) {
+        console.error(
+          chalk44.red("x Both --type and --credential are required")
+        );
+        process.exit(1);
+      } else {
+        if (!isInteractive()) {
+          console.error(chalk44.red("x Interactive mode requires a TTY"));
+          console.log();
+          console.log("Use non-interactive mode:");
+          console.log(
+            chalk44.cyan(
+              '  vm0 model-provider setup --type <type> --credential "<value>"'
+            )
+          );
+          process.exit(1);
+        }
+        const typeResponse = await prompts3(
+          {
+            type: "select",
+            name: "type",
+            message: "Select provider type:",
+            choices: providerChoices
+          },
+          { onCancel: () => process.exit(0) }
+        );
+        type = typeResponse.type;
+        const checkResult = await checkModelProviderCredential(type);
+        if (checkResult.exists && checkResult.currentType === "user") {
+          const convertResponse = await prompts3(
+            {
+              type: "confirm",
+              name: "convert",
+              message: `Credential "${checkResult.credentialName}" already exists. Convert to model provider?`,
+              initial: true
+            },
+            { onCancel: () => process.exit(0) }
+          );
+          if (convertResponse.convert) {
+            const provider2 = await convertModelProviderCredential(type);
+            const defaultNote2 = provider2.isDefault ? ` (default for ${provider2.framework})` : "";
+            console.log(
+              chalk44.green(
+                `Done Converted "${checkResult.credentialName}" to model provider${defaultNote2}`
+              )
+            );
+            return;
+          } else {
+            console.log(chalk44.dim("Aborted."));
+            process.exit(0);
+          }
+        }
+        const config = MODEL_PROVIDER_TYPES[type];
+        const credentialResponse = await prompts3(
+          {
+            type: "password",
+            name: "credential",
+            message: `Enter your ${config.credentialLabel}:`,
+            validate: (value) => value.length > 0 || `${config.credentialLabel} is required`
+          },
+          { onCancel: () => process.exit(0) }
+        );
+        credential = credentialResponse.credential;
+      }
+      const { provider, created } = await upsertModelProvider({
+        type,
+        credential,
+        convert: shouldConvert
+      });
+      const action = created ? "created" : "updated";
+      const defaultNote = provider.isDefault ? ` (default for ${provider.framework})` : "";
+      console.log(
+        chalk44.green(`Done Model provider "${type}" ${action}${defaultNote}`)
+      );
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message.includes("already exists")) {
+          console.error(chalk44.red(`x ${error.message}`));
+          console.log();
+          console.log("To convert the existing credential, run:");
+          console.log(chalk44.cyan("  vm0 model-provider setup --convert"));
+        } else if (error.message.includes("Not authenticated")) {
+          console.error(
+            chalk44.red("x Not authenticated. Run: vm0 auth login")
+          );
+        } else {
+          console.error(chalk44.red(`x ${error.message}`));
+        }
+      } else {
+        console.error(chalk44.red("x An unexpected error occurred"));
+      }
+      process.exit(1);
+    }
+  }
+);
+
+// src/commands/model-provider/delete.ts
+import { Command as Command44 } from "commander";
+import chalk45 from "chalk";
+var deleteCommand3 = new Command44().name("delete").description("Delete a model provider").argument("<type>", "Model provider type to delete").action(async (type) => {
+  try {
+    if (!Object.keys(MODEL_PROVIDER_TYPES).includes(type)) {
+      console.error(chalk45.red(`x Invalid type "${type}"`));
+      console.log();
+      console.log("Valid types:");
+      for (const [t, config] of Object.entries(MODEL_PROVIDER_TYPES)) {
+        console.log(`  ${chalk45.cyan(t)} - ${config.label}`);
+      }
+      process.exit(1);
+    }
+    await deleteModelProvider(type);
+    console.log(chalk45.green(`Done Model provider "${type}" deleted`));
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("not found")) {
+        console.error(chalk45.red(`x Model provider "${type}" not found`));
+      } else if (error.message.includes("Not authenticated")) {
+        console.error(chalk45.red("x Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk45.red(`x ${error.message}`));
+      }
+    } else {
+      console.error(chalk45.red("x An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/model-provider/set-default.ts
+import { Command as Command45 } from "commander";
+import chalk46 from "chalk";
+var setDefaultCommand = new Command45().name("set-default").description("Set a model provider as default for its framework").argument("<type>", "Model provider type to set as default").action(async (type) => {
+  try {
+    if (!Object.keys(MODEL_PROVIDER_TYPES).includes(type)) {
+      console.error(chalk46.red(`x Invalid type "${type}"`));
+      console.log();
+      console.log("Valid types:");
+      for (const [t, config] of Object.entries(MODEL_PROVIDER_TYPES)) {
+        console.log(`  ${chalk46.cyan(t)} - ${config.label}`);
+      }
+      process.exit(1);
+    }
+    const provider = await setModelProviderDefault(type);
+    console.log(
+      chalk46.green(
+        `Done Default for ${provider.framework} set to "${provider.type}"`
+      )
+    );
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("not found")) {
+        console.error(chalk46.red(`x Model provider "${type}" not found`));
+      } else if (error.message.includes("Not authenticated")) {
+        console.error(chalk46.red("x Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk46.red(`x ${error.message}`));
+      }
+    } else {
+      console.error(chalk46.red("x An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/model-provider/index.ts
+var modelProviderCommand = new Command46().name("model-provider").description("Manage model providers for agent runs").addCommand(listCommand6).addCommand(setupCommand).addCommand(deleteCommand3).addCommand(setDefaultCommand);
+
 // src/index.ts
-var program = new Command42();
-program.name("vm0").description("VM0 CLI - A modern build tool").version("6.0.0");
+var program = new Command47();
+program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("6.2.0");
 program.command("info").description("Display environment information").action(async () => {
-  console.log(chalk43.bold("System Information:"));
+  console.log(chalk47.bold("System Information:"));
   console.log(`Node Version: ${process.version}`);
   console.log(`Platform: ${process.platform}`);
   console.log(`Architecture: ${process.arch}`);
@@ -10624,6 +11111,7 @@ program.addCommand(setupGithubCommand);
 program.addCommand(scheduleCommand);
 program.addCommand(usageCommand);
 program.addCommand(credentialCommand);
+program.addCommand(modelProviderCommand);
 if (process.argv[1]?.endsWith("index.js") || process.argv[1]?.endsWith("index.ts") || process.argv[1]?.endsWith("vm0")) {
   program.parse();
 }