@vm0/cli 9.145.7 → 9.145.9

package/{chunk-7LZOYX2B.js → chunk-K4JU76G2.js}

@@ -74083,7 +74083,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.145.7",
+    release: "9.145.9",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -74102,7 +74102,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.145.7",
+    version: "9.145.9",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -102918,12 +102918,14 @@ var MODEL_PROVIDER_FIREWALL_CONFIGS = {
         permissions: [
           {
             name: "codex:api",
-            rules: [
-              "GET /models",
-              "GET /responses",
-              "POST /responses",
-              "POST /analytics-events/events"
-            ]
+            // Subtree-wildcard the codex backend: codex's path surface keeps
+            // growing (#12099 added /responses, then /responses/compact 403'd
+            // again). Method narrowing to GET/POST is the actual safety net —
+            // it blocks accidental DELETE/PUT/PATCH on the user's ChatGPT
+            // account if codex is ever prompt-injected. Base is already
+            // locked to /backend-api/codex, so the blast radius is just
+            // codex's own surface area.
+            rules: ["GET /{path*}", "POST /{path*}"]
           }
         ]
       },
@@ -118157,6 +118159,7 @@ var storageEntrySchema = external_exports.object({
   mountPath: external_exports.string(),
   vasStorageName: external_exports.string(),
   vasVersionId: external_exports.string(),
+  instructionsTargetFilename: external_exports.string().optional(),
   archiveUrl: external_exports.string()
 });
 var artifactEntrySchema = external_exports.object({
@@ -119859,6 +119862,20 @@ var tokenBodySchema = external_exports.object({
   // far_field if absent.
   noiseReduction: external_exports.enum(["near_field", "far_field"]).optional()
 });
+var VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP = 2e5;
+var voiceChatUsageEventBodySchema = external_exports.object({
+  providerEventId: external_exports.string().min(1),
+  eventType: external_exports.enum(["response.done", "transcription.completed"]),
+  inputTextTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  inputAudioTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  inputCachedTextTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  inputCachedAudioTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  outputTextTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional(),
+  outputAudioTokens: external_exports.number().int().nonnegative().max(VOICE_CHAT_USAGE_PER_EVENT_TOKEN_CAP).optional()
+});
+var sessionEndedBodySchema = external_exports.object({
+  relaySessionId: external_exports.uuid()
+});
 var okResponseSchema = external_exports.object({ ok: external_exports.literal(true) });
 var zeroVoiceChatContract = c54.router({
   createSession: {
@@ -119987,6 +120004,46 @@ var zeroVoiceChatContract = c54.router({
       503: apiErrorSchema
     },
     summary: "Mint an ephemeral OpenAI realtime token for voice-chat"
+  },
+  postUsageEvent: {
+    method: "POST",
+    path: "/api/zero/voice-chat/:id/usage",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({ id: external_exports.uuid() }),
+    body: voiceChatUsageEventBodySchema,
+    responses: {
+      200: external_exports.object({ creditsExhausted: external_exports.boolean() }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Browser-reported voice-chat realtime usage event (Plan D \u2014 billing settler)"
+  },
+  sessionStarted: {
+    method: "POST",
+    path: "/api/zero/voice-chat/:id/session-started",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({ id: external_exports.uuid() }),
+    body: external_exports.object({}),
+    responses: {
+      200: external_exports.object({ id: external_exports.uuid().nullable() }),
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Mark a voice-chat realtime session active (audit; null id when billing OFF)"
+  },
+  sessionEnded: {
+    method: "POST",
+    path: "/api/zero/voice-chat/:id/session-ended",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({ id: external_exports.uuid() }),
+    body: sessionEndedBodySchema,
+    responses: {
+      200: okResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Mark a voice-chat realtime session ended (idempotent)"
   }
 });
 
@@ -122155,4 +122212,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-7LZOYX2B.js.map
+//# sourceMappingURL=chunk-K4JU76G2.js.map