@vm0/cli 9.145.6 → 9.145.8

package/{chunk-2LVWQ6RG.js → chunk-VMETWWKD.js}

@@ -74083,7 +74083,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.145.6",
+    release: "9.145.8",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -74102,7 +74102,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.145.6",
+    version: "9.145.8",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -102918,12 +102918,14 @@ var MODEL_PROVIDER_FIREWALL_CONFIGS = {
         permissions: [
           {
             name: "codex:api",
-            rules: [
-              "GET /models",
-              "GET /responses",
-              "POST /responses",
-              "POST /analytics-events/events"
-            ]
+            // Subtree-wildcard the codex backend: codex's path surface keeps
+            // growing (#12099 added /responses, then /responses/compact 403'd
+            // again). Method narrowing to GET/POST is the actual safety net —
+            // it blocks accidental DELETE/PUT/PATCH on the user's ChatGPT
+            // account if codex is ever prompt-injected. Base is already
+            // locked to /backend-api/codex, so the blast radius is just
+            // codex's own surface area.
+            rules: ["GET /{path*}", "POST /{path*}"]
           }
         ]
       },
@@ -119859,6 +119861,20 @@ var tokenBodySchema = external_exports.object({
   // far_field if absent.
   noiseReduction: external_exports.enum(["near_field", "far_field"]).optional()
 });
+var VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP = 2e5;
+var voiceChatUsageEventBodySchema = external_exports.object({
+  providerEventId: external_exports.string().min(1),
+  eventType: external_exports.enum(["response.done", "transcription.completed"]),
+  inputTextTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  inputAudioTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  inputCachedTextTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  inputCachedAudioTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  outputTextTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  outputAudioTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional()
+});
+var sessionEndedBodySchema = external_exports.object({
+  relaySessionId: external_exports.uuid()
+});
 var okResponseSchema = external_exports.object({ ok: external_exports.literal(true) });
 var zeroVoiceChatContract = c54.router({
   createSession: {
@@ -119987,6 +120003,46 @@ var zeroVoiceChatContract = c54.router({
       503: apiErrorSchema
     },
     summary: "Mint an ephemeral OpenAI realtime token for voice-chat"
+  },
+  postUsageEvent: {
+    method: "POST",
+    path: "/api/zero/voice-chat/:id/usage",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({ id: external_exports.uuid() }),
+    body: voiceChatUsageEventBodySchema,
+    responses: {
+      200: external_exports.object({ creditsExhausted: external_exports.boolean() }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Browser-reported voice-chat realtime usage event (Plan D \u2014 billing settler)"
+  },
+  sessionStarted: {
+    method: "POST",
+    path: "/api/zero/voice-chat/:id/session-started",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({ id: external_exports.uuid() }),
+    body: external_exports.object({}),
+    responses: {
+      200: external_exports.object({ id: external_exports.uuid().nullable() }),
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Mark a voice-chat realtime session active (audit; null id when billing OFF)"
+  },
+  sessionEnded: {
+    method: "POST",
+    path: "/api/zero/voice-chat/:id/session-ended",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({ id: external_exports.uuid() }),
+    body: sessionEndedBodySchema,
+    responses: {
+      200: okResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Mark a voice-chat realtime session ended (idempotent)"
   }
 });
 
@@ -120743,7 +120799,15 @@ var MODEL_DISPLAY_NAMES = Object.freeze({
   "glm-4.7": "GLM-4.7",
   "glm-4.5-air": "GLM-4.5 Air",
   "zai/glm-5-turbo": "GLM-5 Turbo",
-  "z-ai/glm-5.1": "GLM-5.1"
+  "z-ai/glm-5.1": "GLM-5.1",
+  // Minimax via OpenRouter
+  "minimax/minimax-m2.7": "MiniMax M2.7",
+  // OpenAI / Codex
+  "gpt-5.5": "GPT-5.5",
+  "gpt-5.4": "GPT-5.4",
+  "gpt-5.4-mini": "GPT-5.4 Mini",
+  "gpt-5.3-codex": "GPT-5.3 Codex",
+  "gpt-5.2": "GPT-5.2"
 });
 
 // ../../packages/core/src/log-utils.ts
@@ -122147,4 +122211,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-2LVWQ6RG.js.map
+//# sourceMappingURL=chunk-VMETWWKD.js.map