@vm0/cli 9.154.2 → 9.156.0

package/{chunk-4F34B6ZK.js → chunk-EESCNG6H.js}

@@ -74083,7 +74083,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.154.2",
+    release: "9.156.0",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -74102,7 +74102,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.154.2",
+    version: "9.156.0",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -88604,7 +88604,7 @@ var RUN_ERROR_GUIDANCE = {
   NO_MODEL_PROVIDER: {
     title: "No model provider configured",
     guidance: "Configure a model provider to start running agents.",
-    cliHint: "zero org model-provider setup"
+    cliHint: "zero model-provider set --help"
   },
   INSUFFICIENT_CREDITS: {
     title: "Credits depleted",
@@ -95561,11 +95561,32 @@ var SUPPORTED_RUN_MODELS = [
   "gpt-5.4",
   "gpt-5.4-mini"
 ];
+var VM0_MODEL_CREDIT_MULTIPLIER = Object.freeze({
+  "claude-opus-4-7": 1.7,
+  "claude-opus-4-6": 1.7,
+  "claude-sonnet-4-6": 1,
+  "claude-haiku-4-5": 0.3,
+  "deepseek-v4-pro": 0.06,
+  "deepseek-v4-flash": 0.02,
+  "kimi-k2.6": 0.3,
+  "kimi-k2.5": 0.2,
+  "MiniMax-M2.7": 0.1,
+  "glm-5.1": 0.4,
+  "gpt-5.5": 2,
+  "gpt-5.4": 1,
+  "gpt-5.4-mini": 0.3
+});
 var supportedRunModelSchema = external_exports.enum(SUPPORTED_RUN_MODELS);
 var modelProviderCredentialScopeSchema = external_exports.enum(["org", "member"]);
 var SUPPORTED_RUN_MODEL_SET = new Set(
   SUPPORTED_RUN_MODELS
 );
+function isSupportedRunModel(model) {
+  return typeof model === "string" && SUPPORTED_RUN_MODEL_SET.has(model);
+}
+function getVm0ModelMultiplier(model) {
+  return isSupportedRunModel(model) ? VM0_MODEL_CREDIT_MULTIPLIER[model] : void 0;
+}
 var VM0_MODEL_TO_PROVIDER = {
   "claude-opus-4-7": {
     concreteType: "anthropic-api-key",
@@ -96462,12 +96483,60 @@ async function deleteZeroOrgModelProvider(type) {
   handleError(result, `Org model provider "${type}" not found`);
 }
 
+// src/lib/api/domains/zero-model-policies.ts
+init_esm_shims();
+
+// ../../packages/api-contracts/src/contracts/zero-model-policies.ts
+init_esm_shims();
+var c14 = initContract();
+var zeroModelPoliciesMainContract = c14.router({
+  list: {
+    method: "GET",
+    path: "/api/zero/model-policies",
+    headers: authHeadersSchema,
+    responses: {
+      200: orgModelPoliciesResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List org model-first policies"
+  },
+  update: {
+    method: "PUT",
+    path: "/api/zero/model-policies",
+    headers: authHeadersSchema,
+    body: updateOrgModelPoliciesRequestSchema,
+    responses: {
+      200: orgModelPoliciesResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Update org model-first policies"
+  }
+});
+
+// src/lib/api/domains/zero-model-policies.ts
+async function listZeroModelPolicies() {
+  const config4 = await getClientConfig();
+  const client = initClient(zeroModelPoliciesMainContract, config4);
+  const result = await client.list({ headers: {} });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to list model policies");
+}
+
 // src/lib/api/domains/zero-agents.ts
 init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-agents.ts
 init_esm_shims();
-var c14 = initContract();
+var c15 = initContract();
 var zeroAgentVisibilitySchema = external_exports.enum(["public", "private"]);
 var zeroAgentCustomSkillNameSchema = external_exports.string().min(2).max(64).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/);
 var zeroAgentResponseSchema = external_exports.object({
@@ -96506,7 +96575,7 @@ var zeroAgentInstructionsResponseSchema = external_exports.object({
 var zeroAgentInstructionsRequestSchema = external_exports.object({
   content: external_exports.string()
 });
-var zeroAgentsMainContract = c14.router({
+var zeroAgentsMainContract = c15.router({
   create: {
     method: "POST",
     path: "/api/zero/agents",
@@ -96534,7 +96603,7 @@ var zeroAgentsMainContract = c14.router({
     summary: "List zero agents"
   }
 });
-var zeroAgentsByIdContract = c14.router({
+var zeroAgentsByIdContract = c15.router({
   get: {
     method: "GET",
     path: "/api/zero/agents/:id",
@@ -96586,9 +96655,9 @@ var zeroAgentsByIdContract = c14.router({
     path: "/api/zero/agents/:id",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
-    body: c14.noBody(),
+    body: c15.noBody(),
     responses: {
-      204: c14.noBody(),
+      204: c15.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -96601,7 +96670,7 @@ var zeroAgentPermissionPoliciesRequestSchema = external_exports.object({
   agentId: external_exports.string().uuid(),
   policies: firewallPoliciesSchema
 });
-var zeroAgentPermissionPoliciesContract = c14.router({
+var zeroAgentPermissionPoliciesContract = c15.router({
   update: {
     method: "PUT",
     path: "/api/zero/permission-policies",
@@ -96617,7 +96686,7 @@ var zeroAgentPermissionPoliciesContract = c14.router({
     summary: "Update zero agent permission policies (owner only)"
   }
 });
-var zeroAgentInstructionsContract = c14.router({
+var zeroAgentInstructionsContract = c15.router({
   get: {
     method: "GET",
     path: "/api/zero/agents/:id/instructions",
@@ -96707,7 +96776,7 @@ var zeroAgentSkillContentResponseSchema = external_exports.object({
 var zeroAgentSkillListResponseSchema = external_exports.array(
   zeroAgentCustomSkillSchema
 );
-var zeroSkillsCollectionContract = c14.router({
+var zeroSkillsCollectionContract = c15.router({
   list: {
     method: "GET",
     path: "/api/zero/skills",
@@ -96738,7 +96807,7 @@ var zeroSkillsCollectionContract = c14.router({
     summary: "Create a custom skill in the organization"
   }
 });
-var zeroSkillsDetailContract = c14.router({
+var zeroSkillsDetailContract = c15.router({
   get: {
     method: "GET",
     path: "/api/zero/skills/:name",
@@ -96772,9 +96841,9 @@ var zeroSkillsDetailContract = c14.router({
     path: "/api/zero/skills/:name",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ name: zeroAgentCustomSkillNameSchema }),
-    body: c14.noBody(),
+    body: c15.noBody(),
     responses: {
-      204: c14.noBody(),
+      204: c15.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -96817,7 +96886,7 @@ var resolvePermissionAccessRequestSchema = external_exports.object({
   requestId: external_exports.string().uuid(),
   action: external_exports.enum(["approve", "reject"])
 });
-var permissionAccessRequestsCreateContract = c14.router({
+var permissionAccessRequestsCreateContract = c15.router({
   create: {
     method: "POST",
     path: "/api/zero/permission-access-requests",
@@ -96838,7 +96907,7 @@ var permissionAccessRequestsListQuerySchema = external_exports.object({
   requestId: external_exports.string().optional(),
   status: external_exports.string().optional()
 });
-var permissionAccessRequestsListContract = c14.router({
+var permissionAccessRequestsListContract = c15.router({
   list: {
     method: "GET",
     path: "/api/zero/permission-access-requests",
@@ -96853,7 +96922,7 @@ var permissionAccessRequestsListContract = c14.router({
     summary: "List permission access requests for an agent"
   }
 });
-var permissionAccessRequestsResolveContract = c14.router({
+var permissionAccessRequestsResolveContract = c15.router({
   resolve: {
     method: "PUT",
     path: "/api/zero/permission-access-requests",
@@ -96872,11 +96941,11 @@ var permissionAccessRequestsResolveContract = c14.router({
 
 // ../../packages/api-contracts/src/contracts/user-connectors.ts
 init_esm_shims();
-var c15 = initContract();
+var c16 = initContract();
 var userConnectorEnabledTypesSchema = external_exports.object({
   enabledTypes: external_exports.array(external_exports.string())
 });
-var zeroUserConnectorsContract = c15.router({
+var zeroUserConnectorsContract = c16.router({
   get: {
     method: "GET",
     path: "/api/zero/agents/:id/user-connectors",
@@ -97241,6 +97310,43 @@ var anthropicManagedAgents = {
   }
 };
 
+// ../../packages/connectors/src/connectors/bentoml.ts
+init_esm_shims();
+var bentoml = {
+  bentoml: {
+    label: "BentoML",
+    category: "data-automation-infrastructure",
+    generation: ["text"],
+    tags: ["bentocloud", "model-serving", "mlops", "inference"],
+    environmentMapping: {
+      BENTO_CLOUD_API_KEY: "$secrets.BENTO_CLOUD_API_KEY",
+      BENTO_CLOUD_API_ENDPOINT: "$vars.BENTO_CLOUD_API_ENDPOINT"
+    },
+    helpText: "Connect your BentoCloud account to manage BentoML deployments and call protected deployment endpoints",
+    authMethods: {
+      "api-token": {
+        featureFlag: "bentomlConnector" /* BentomlConnector */,
+        label: "BentoCloud API Token",
+        helpText: "1. Log in to [BentoCloud](https://cloud.bentoml.com)\n2. Open your profile menu, then go to **API Tokens**\n3. Create a Personal or Organization API token with the access your workflow needs\n4. Copy the token and enter your organization endpoint, for example `https://your-org.cloud.bentoml.com`",
+        secrets: {
+          BENTO_CLOUD_API_KEY: {
+            label: "API Token",
+            required: true,
+            placeholder: "cur7h..."
+          },
+          BENTO_CLOUD_API_ENDPOINT: {
+            label: "BentoCloud Endpoint",
+            required: true,
+            placeholder: "https://your-org.cloud.bentoml.com",
+            type: "variable"
+          }
+        }
+      }
+    },
+    defaultAuthMethod: "api-token"
+  }
+};
+
 // ../../packages/connectors/src/connectors/github.ts
 init_esm_shims();
 var github = {
@@ -98993,6 +99099,48 @@ var reddit = {
   }
 };
 
+// ../../packages/connectors/src/connectors/reap.ts
+init_esm_shims();
+var reap = {
+  reap: {
+    label: "Reap",
+    category: "sales-crm-business-operations",
+    tags: [
+      "fintech",
+      "embedded-finance",
+      "cards",
+      "wallets",
+      "payments",
+      "compliance"
+    ],
+    environmentMapping: {
+      REAP_API_KEY: "$secrets.REAP_API_KEY",
+      REAP_API_BASE_URL: "$vars.REAP_API_BASE_URL"
+    },
+    helpText: "Connect your Reap project to manage users, companies, accounts, cards, virtual assets, activities, and reconciliations",
+    authMethods: {
+      "api-token": {
+        label: "API Key",
+        helpText: "1. Contact the Reap team to obtain an API key for your project\n2. Choose the matching API base URL for the key environment: `https://sandbox.api.reap.global/v1` or `https://prod.api.reap.global/v1`\n3. Copy the API key",
+        secrets: {
+          REAP_API_KEY: {
+            label: "API Key",
+            required: true,
+            placeholder: "YOUR_REAP_API_KEY"
+          },
+          REAP_API_BASE_URL: {
+            label: "API Base URL",
+            required: true,
+            placeholder: "https://sandbox.api.reap.global/v1",
+            type: "variable"
+          }
+        }
+      }
+    },
+    defaultAuthMethod: "api-token"
+  }
+};
+
 // ../../packages/connectors/src/connectors/strava.ts
 init_esm_shims();
 var strava = {
@@ -100065,13 +100213,14 @@ var stripe = {
       },
       "cli-auth": {
         featureFlag: "cliAuthStripe" /* CliAuthStripe */,
-        label: "Stripe CLI",
-        helpText: "Sign in with the Stripe CLI to import an API key.",
+        label: "Sign in with Stripe",
+        helpText: "Approve access in Stripe to import an API key.",
         secrets: {}
       }
     },
     defaultAuthMethod: "oauth",
     cliAuth: {
+      flow: "browser-verification",
       modes: [
         {
           value: "test",
@@ -103335,6 +103484,7 @@ var CONNECTOR_TYPES_DEF = {
   ...agentmail,
   ...airtable,
   ...anthropicManagedAgents,
+  ...bentoml,
   ...github,
   ...notion,
   ...gmail,
@@ -103387,6 +103537,7 @@ var CONNECTOR_TYPES_DEF = {
   ...serpapi,
   ...salesforce,
   ...reddit,
+  ...reap,
   ...strava,
   ...x,
   ...neon,
@@ -103581,8 +103732,8 @@ var computerConnectorCreateResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/zero-connectors.ts
-var c16 = initContract();
-var zeroConnectorsMainContract = c16.router({
+var c17 = initContract();
+var zeroConnectorsMainContract = c17.router({
   list: {
     method: "GET",
     path: "/api/zero/connectors",
@@ -103596,7 +103747,7 @@ var zeroConnectorsMainContract = c16.router({
     summary: "List all connectors (zero proxy)"
   }
 });
-var zeroConnectorsByTypeContract = c16.router({
+var zeroConnectorsByTypeContract = c17.router({
   get: {
     method: "GET",
     path: "/api/zero/connectors/:type",
@@ -103616,14 +103767,14 @@ var zeroConnectorsByTypeContract = c16.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ type: connectorTypeSchema }),
     responses: {
-      204: c16.noBody(),
+      204: c17.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Disconnect a connector (zero proxy)"
   }
 });
-var zeroConnectorScopeDiffContract = c16.router({
+var zeroConnectorScopeDiffContract = c17.router({
   getScopeDiff: {
     method: "GET",
     path: "/api/zero/connectors/:type/scope-diff",
@@ -103638,7 +103789,7 @@ var zeroConnectorScopeDiffContract = c16.router({
     summary: "Get scope diff for a connector"
   }
 });
-var zeroConnectorAuthorizeContract = c16.router({
+var zeroConnectorAuthorizeContract = c17.router({
   authorize: {
     method: "GET",
     path: "/api/zero/connectors/:type/authorize",
@@ -103646,9 +103797,9 @@ var zeroConnectorAuthorizeContract = c16.router({
     pathParams: external_exports.object({ type: external_exports.string() }),
     query: external_exports.object({ session: external_exports.string().optional() }),
     responses: {
-      307: c16.noBody(),
+      307: c17.noBody(),
       400: external_exports.object({ error: external_exports.string() }),
-      401: c16.noBody(),
+      401: c17.noBody(),
       500: external_exports.object({ error: external_exports.string() })
     },
     summary: "Start connector OAuth authorization (zero proxy)"
@@ -103669,7 +103820,7 @@ var connectorSearchItemSchema = external_exports.object({
 var connectorSearchResponseSchema = external_exports.object({
   connectors: external_exports.array(connectorSearchItemSchema)
 });
-var zeroConnectorsSearchContract = c16.router({
+var zeroConnectorsSearchContract = c17.router({
   search: {
     method: "GET",
     path: "/api/zero/connectors/search",
@@ -103683,7 +103834,7 @@ var zeroConnectorsSearchContract = c16.router({
     summary: "Search available connector types"
   }
 });
-var zeroConnectorSessionsContract = c16.router({
+var zeroConnectorSessionsContract = c17.router({
   create: {
     method: "POST",
     path: "/api/zero/connectors/:type/sessions",
@@ -103698,7 +103849,7 @@ var zeroConnectorSessionsContract = c16.router({
     summary: "Create connector session for device flow (zero proxy)"
   }
 });
-var zeroConnectorSessionByIdContract = c16.router({
+var zeroConnectorSessionByIdContract = c17.router({
   get: {
     method: "GET",
     path: "/api/zero/connectors/:type/sessions/:sessionId",
@@ -103716,7 +103867,7 @@ var zeroConnectorSessionByIdContract = c16.router({
     summary: "Get connector session status (zero proxy)"
   }
 });
-var zeroComputerConnectorContract = c16.router({
+var zeroComputerConnectorContract = c17.router({
   create: {
     method: "POST",
     path: "/api/zero/connectors/computer",
@@ -103747,14 +103898,14 @@ var zeroComputerConnectorContract = c16.router({
     path: "/api/zero/connectors/computer",
     headers: authHeadersSchema,
     responses: {
-      204: c16.noBody(),
+      204: c17.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete computer connector (zero proxy)"
   }
 });
-var zeroLocalAgentConnectorContract = c16.router({
+var zeroLocalAgentConnectorContract = c17.router({
   create: {
     method: "POST",
     path: "/api/zero/connectors/local-agent",
@@ -103770,7 +103921,7 @@ var zeroLocalAgentConnectorContract = c16.router({
     summary: "Connect local-agent connector"
   }
 });
-var zeroLocalBrowserConnectorContract = c16.router({
+var zeroLocalBrowserConnectorContract = c17.router({
   create: {
     method: "POST",
     path: "/api/zero/connectors/local-browser",
@@ -103832,7 +103983,7 @@ import { pipeline } from "stream/promises";
 
 // ../../packages/api-contracts/src/contracts/integrations.ts
 init_esm_shims();
-var c17 = initContract();
+var c18 = initContract();
 var sendSlackMessageBodySchema = external_exports.object({
   channel: external_exports.string().min(1, "Channel ID is required").optional(),
   user: external_exports.string().min(1, "User ID is required").optional(),
@@ -103850,7 +104001,7 @@ var sendSlackMessageResponseSchema = external_exports.object({
   ts: external_exports.string().optional(),
   channel: external_exports.string().optional()
 });
-var integrationsSlackMessageContract = c17.router({
+var integrationsSlackMessageContract = c18.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/slack/message",
@@ -103878,7 +104029,7 @@ var sendTelegramMessageResponseSchema = external_exports.object({
   messageId: external_exports.number().int(),
   chatId: external_exports.string()
 });
-var integrationsTelegramMessageContract = c17.router({
+var integrationsTelegramMessageContract = c18.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/telegram/message",
@@ -103906,7 +104057,7 @@ var sendPhoneMessageResponseSchema = external_exports.object({
   channel: external_exports.string().nullable(),
   toNumber: external_exports.string()
 });
-var integrationsPhoneMessageContract = c17.router({
+var integrationsPhoneMessageContract = c18.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/phone/message",
@@ -103926,14 +104077,14 @@ var integrationsPhoneMessageContract = c17.router({
 var phoneDownloadFileQuerySchema = external_exports.object({
   file_id: external_exports.string().min(1, "file_id query parameter is required")
 });
-var integrationsPhoneDownloadFileContract = c17.router({
+var integrationsPhoneDownloadFileContract = c18.router({
   download: {
     method: "GET",
     path: "/api/zero/integrations/phone/download-file",
     headers: authHeadersSchema,
     query: phoneDownloadFileQuerySchema,
     responses: {
-      200: c17.type(),
+      200: c18.type(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -103968,7 +104119,7 @@ var telegramBotListItemSchema = external_exports.object({
 var listTelegramBotsResponseSchema = external_exports.object({
   bots: external_exports.array(telegramBotListItemSchema)
 });
-var integrationsTelegramBotListContract = c17.router({
+var integrationsTelegramBotListContract = c18.router({
   listBots: {
     method: "GET",
     path: "/api/zero/integrations/telegram/bots",
@@ -103989,7 +104140,7 @@ var slackUploadInitResponseSchema = external_exports.object({
   uploadUrl: external_exports.string(),
   fileId: external_exports.string()
 });
-var integrationsSlackUploadInitContract = c17.router({
+var integrationsSlackUploadInitContract = c18.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/init",
@@ -104018,7 +104169,7 @@ var telegramUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsTelegramUploadInitContract = c17.router({
+var integrationsTelegramUploadInitContract = c18.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/init",
@@ -104050,7 +104201,7 @@ var telegramUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsTelegramUploadCompleteContract = c17.router({
+var integrationsTelegramUploadCompleteContract = c18.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/complete",
@@ -104080,7 +104231,7 @@ var phoneUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsPhoneUploadInitContract = c17.router({
+var integrationsPhoneUploadInitContract = c18.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/init",
@@ -104111,7 +104262,7 @@ var phoneUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsPhoneUploadCompleteContract = c17.router({
+var integrationsPhoneUploadCompleteContract = c18.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/complete",
@@ -104155,7 +104306,7 @@ var sendChatMessageResponseSchema = external_exports.object({
   threadId: external_exports.string(),
   createdAt: external_exports.string()
 });
-var integrationsChatMessageContract = c17.router({
+var integrationsChatMessageContract = c18.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/chat/message",
@@ -104171,7 +104322,7 @@ var integrationsChatMessageContract = c17.router({
     summary: "Send a message to a web chat thread"
   }
 });
-var integrationsSlackUploadCompleteContract = c17.router({
+var integrationsSlackUploadCompleteContract = c18.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/complete",
@@ -104439,7 +104590,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-schedules.ts
 init_esm_shims();
-var c18 = initContract();
+var c19 = initContract();
 var scheduleResponseSchema = external_exports.object({
   id: external_exports.string().uuid(),
   agentId: external_exports.string().uuid(),
@@ -104502,7 +104653,7 @@ var zeroDeployScheduleRequestSchema = external_exports.object({
     message: "Exactly one of 'cronExpression', 'atTime', or 'intervalSeconds' must be specified"
   }
 );
-var zeroSchedulesMainContract = c18.router({
+var zeroSchedulesMainContract = c19.router({
   deploy: {
     method: "POST",
     path: "/api/zero/schedules",
@@ -104530,7 +104681,7 @@ var zeroSchedulesMainContract = c18.router({
     summary: "List all schedules (zero proxy)"
   }
 });
-var zeroSchedulesByNameContract = c18.router({
+var zeroSchedulesByNameContract = c19.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/schedules/:name",
@@ -104542,7 +104693,7 @@ var zeroSchedulesByNameContract = c18.router({
       agentId: external_exports.string().uuid("Invalid agent ID")
     }),
     responses: {
-      204: c18.noBody(),
+      204: c19.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -104551,7 +104702,7 @@ var zeroSchedulesByNameContract = c18.router({
     summary: "Delete schedule (zero proxy)"
   }
 });
-var zeroSchedulesEnableContract = c18.router({
+var zeroSchedulesEnableContract = c19.router({
   enable: {
     method: "POST",
     path: "/api/zero/schedules/:name/enable",
@@ -104591,7 +104742,7 @@ var zeroSchedulesEnableContract = c18.router({
     summary: "Disable schedule (zero proxy)"
   }
 });
-var zeroScheduleRunContract = c18.router({
+var zeroScheduleRunContract = c19.router({
   run: {
     method: "POST",
     path: "/api/zero/schedules/run",
@@ -104717,7 +104868,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/runners.ts
 init_esm_shims();
-var c19 = initContract();
+var c20 = initContract();
 var runnerGroupSchema = external_exports.string().regex(
   /^[a-z0-9-]+\/[a-z0-9-]+$/,
   "Runner group must be in vm0/<name> format (e.g., vm0/production)"
@@ -104731,7 +104882,7 @@ var jobSchema = external_exports.object({
   checkpointId: external_exports.uuid().nullable(),
   experimentalProfile: external_exports.string().optional()
 });
-var runnersPollContract = c19.router({
+var runnersPollContract = c20.router({
   poll: {
     method: "POST",
     path: "/api/runners/poll",
@@ -104872,7 +105023,7 @@ var executionContextSchema = external_exports.object({
   billableFirewalls: external_exports.array(external_exports.string()).optional(),
   modelUsageProvider: external_exports.string().optional()
 });
-var runnersJobClaimContract = c19.router({
+var runnersJobClaimContract = c20.router({
   claim: {
     method: "POST",
     path: "/api/runners/jobs/:id/claim",
@@ -104909,7 +105060,7 @@ var heartbeatBodySchema = external_exports.object({
   heldSessions: external_exports.array(external_exports.string()),
   mode: external_exports.enum(["running", "draining", "stopping"])
 });
-var runnersHeartbeatContract = c19.router({
+var runnersHeartbeatContract = c20.router({
   heartbeat: {
     method: "POST",
     path: "/api/runners/heartbeat",
@@ -104926,17 +105077,17 @@ var runnersHeartbeatContract = c19.router({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks.ts
-var c20 = initContract();
+var c21 = initContract();
 var thirdPartyWebhookErrorSchema = external_exports.object({ error: external_exports.string() });
 var thirdPartyWebhookOkSchema = external_exports.union([
   external_exports.string(),
   external_exports.object({ message: external_exports.literal("pong") })
 ]);
-var webhookClerkContract = c20.router({
+var webhookClerkContract = c21.router({
   post: {
     method: "POST",
     path: "/api/webhooks/clerk",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema
@@ -104944,11 +105095,11 @@ var webhookClerkContract = c20.router({
     summary: "Handle Clerk organization and user webhooks"
   }
 });
-var webhookGithubContract = c20.router({
+var webhookGithubContract = c21.router({
   post: {
     method: "POST",
     path: "/api/webhooks/github",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -104958,11 +105109,11 @@ var webhookGithubContract = c20.router({
     summary: "Handle GitHub App webhooks"
   }
 });
-var webhookStripeContract = c20.router({
+var webhookStripeContract = c21.router({
   post: {
     method: "POST",
     path: "/api/webhooks/stripe",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema,
@@ -105012,7 +105163,7 @@ var firewallAuthResponseSchema = external_exports.object({
   refreshedConnectors: external_exports.array(external_exports.string()),
   refreshedSecrets: external_exports.array(external_exports.string())
 });
-var webhookFirewallAuthContract = c20.router({
+var webhookFirewallAuthContract = c21.router({
   /**
    * POST /api/webhooks/agent/firewall/auth
    * Resolve firewall auth templates and refresh OAuth tokens on demand.
@@ -105047,7 +105198,7 @@ var webhookFirewallAuthContract = c20.router({
     summary: "Resolve firewall auth templates"
   }
 });
-var webhookEventsContract = c20.router({
+var webhookEventsContract = c21.router({
   /**
    * POST /api/webhooks/agent/events
    * Receive agent events from sandbox
@@ -105074,7 +105225,7 @@ var webhookEventsContract = c20.router({
     summary: "Receive agent events from sandbox"
   }
 });
-var webhookCompleteContract = c20.router({
+var webhookCompleteContract = c21.router({
   /**
    * POST /api/webhooks/agent/complete
    * Handle agent run completion (success or failure)
@@ -105111,7 +105262,7 @@ var webhookCompleteContract = c20.router({
     summary: "Handle agent run completion"
   }
 });
-var webhookCheckpointsContract = c20.router({
+var webhookCheckpointsContract = c21.router({
   /**
    * POST /api/webhooks/agent/checkpoints
    * Create a recoverable checkpoint for an agent run.
@@ -105150,7 +105301,7 @@ var webhookCheckpointsContract = c20.router({
     summary: "Create checkpoint for agent run"
   }
 });
-var webhookCheckpointsPrepareHistoryContract = c20.router({
+var webhookCheckpointsPrepareHistoryContract = c21.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/checkpoints/prepare-history",
@@ -105173,7 +105324,7 @@ var webhookCheckpointsPrepareHistoryContract = c20.router({
     summary: "Get presigned URL for uploading session history to S3"
   }
 });
-var webhookHeartbeatContract = c20.router({
+var webhookHeartbeatContract = c21.router({
   /**
    * POST /api/webhooks/agent/heartbeat
    * Receive heartbeat signals from sandbox
@@ -105197,7 +105348,7 @@ var webhookHeartbeatContract = c20.router({
     summary: "Receive heartbeat from sandbox"
   }
 });
-var webhookStoragesContract = c20.router({
+var webhookStoragesContract = c21.router({
   /**
    * POST /api/webhooks/agent/storages
    * Create a new version of a storage from sandbox
@@ -105213,7 +105364,7 @@ var webhookStoragesContract = c20.router({
     path: "/api/webhooks/agent/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -105229,7 +105380,7 @@ var webhookStoragesContract = c20.router({
     summary: "Upload storage version from sandbox"
   }
 });
-var webhookStoragesIncrementalContract = c20.router({
+var webhookStoragesIncrementalContract = c21.router({
   /**
    * POST /api/webhooks/agent/storages/incremental
    * Create a new version using incremental upload
@@ -105247,7 +105398,7 @@ var webhookStoragesIncrementalContract = c20.router({
     path: "/api/webhooks/agent/storages/incremental",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -105285,7 +105436,7 @@ var sandboxOperationSchema = external_exports.object({
   success: external_exports.boolean(),
   error: external_exports.string().optional()
 });
-var webhookTelemetryContract = c20.router({
+var webhookTelemetryContract = c21.router({
   /**
    * POST /api/webhooks/agent/telemetry
    * Receive telemetry data (system log, metrics, network logs, and sandbox operations) from sandbox
@@ -105314,7 +105465,7 @@ var webhookTelemetryContract = c20.router({
     summary: "Receive telemetry data from sandbox"
   }
 });
-var webhookStoragesPrepareContract = c20.router({
+var webhookStoragesPrepareContract = c21.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/storages/prepare",
@@ -105348,7 +105499,7 @@ var webhookStoragesPrepareContract = c20.router({
     summary: "Prepare for direct S3 upload from sandbox"
   }
 });
-var webhookStoragesCommitContract = c20.router({
+var webhookStoragesCommitContract = c21.router({
   commit: {
     method: "POST",
     path: "/api/webhooks/agent/storages/commit",
@@ -105390,7 +105541,7 @@ var webhookUsageEventItemSchema = external_exports.object({
   category: external_exports.string().min(1).max(100),
   quantity: external_exports.number().int().min(0)
 }).strict();
-var webhookUsageEventContract = c20.router({
+var webhookUsageEventContract = c21.router({
   send: {
     method: "POST",
     path: "/api/webhooks/agent/usage-event",
@@ -105426,8 +105577,8 @@ var zeroRunRequestSchema = unifiedRunRequestSchema.omit({
   agentId: external_exports.string().optional(),
   modelProvider: external_exports.string().optional()
 });
-var c21 = initContract();
-var zeroRunsMainContract = c21.router({
+var c22 = initContract();
+var zeroRunsMainContract = c22.router({
   create: {
     method: "POST",
     path: "/api/zero/runs",
@@ -105446,7 +105597,7 @@ var zeroRunsMainContract = c21.router({
     summary: "Create and execute agent run (zero proxy)"
   }
 });
-var zeroRunsByIdContract = c21.router({
+var zeroRunsByIdContract = c22.router({
   getById: {
     method: "GET",
     path: "/api/zero/runs/:id",
@@ -105464,7 +105615,7 @@ var zeroRunsByIdContract = c21.router({
     summary: "Get agent run by ID (zero proxy)"
   }
 });
-var zeroRunsCancelContract = c21.router({
+var zeroRunsCancelContract = c22.router({
   cancel: {
     method: "POST",
     path: "/api/zero/runs/:id/cancel",
@@ -105483,7 +105634,7 @@ var zeroRunsCancelContract = c21.router({
     summary: "Cancel a pending or running run (zero proxy)"
   }
 });
-var zeroRunsQueueContract = c21.router({
+var zeroRunsQueueContract = c22.router({
   getQueue: {
     method: "GET",
     path: "/api/zero/runs/queue",
@@ -105496,7 +105647,7 @@ var zeroRunsQueueContract = c21.router({
     summary: "Get org run queue status (zero proxy)"
   }
 });
-var zeroRunAgentEventsContract = c21.router({
+var zeroRunAgentEventsContract = c22.router({
   getAgentEvents: {
     method: "GET",
     path: "/api/zero/runs/:id/telemetry/agent",
@@ -105558,7 +105709,7 @@ var runContextResponseSchema = external_exports.object({
   artifact: runContextArtifactSchema.nullable(),
   featureFlags: external_exports.record(external_exports.string(), external_exports.boolean()).nullable()
 });
-var zeroRunContextContract = c21.router({
+var zeroRunContextContract = c22.router({
   getContext: {
     method: "GET",
     path: "/api/zero/runs/:id/context",
@@ -105576,7 +105727,7 @@ var zeroRunContextContract = c21.router({
     summary: "Get run execution context snapshot for debugging"
   }
 });
-var zeroRunNetworkLogsContract = c21.router({
+var zeroRunNetworkLogsContract = c22.router({
   getNetworkLogs: {
     method: "GET",
     path: "/api/zero/runs/:id/network",
@@ -105602,7 +105753,7 @@ var zeroRunNetworkLogsContract = c21.router({
 var runRunnerResponseSchema = external_exports.object({
   sandboxReuseResult: sandboxReuseResultSchema.nullable()
 });
-var zeroRunRunnerContract = c21.router({
+var zeroRunRunnerContract = c22.router({
   getRunner: {
     method: "GET",
     path: "/api/zero/runs/:id/runner",
@@ -105620,7 +105771,7 @@ var zeroRunRunnerContract = c21.router({
     summary: "Get runner-level metadata for a run"
   }
 });
-var zeroLogsSearchContract = c21.router({
+var zeroLogsSearchContract = c22.router({
   searchLogs: {
     method: "GET",
     path: "/api/zero/logs/search",
@@ -105720,7 +105871,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/chat-threads.ts
 init_esm_shims();
-var c22 = initContract();
+var c23 = initContract();
 var attachFileSchema = external_exports.object({
   id: external_exports.string(),
   filename: external_exports.string(),
@@ -105885,10 +106036,9 @@ var chatThreadDetailSchema = external_exports.object({
   draftContent: external_exports.string().nullable().optional(),
   draftAttachments: external_exports.array(persistedAttachmentSchema).nullable().optional(),
   /**
-   * Per-thread model pin. Provider-first threads store modelProviderId +
-   * selectedModel together; model-first threads can store selectedModel with
-   * route metadata and a null modelProviderId. When set, the send route uses
-   * this pin instead of drifting with current defaults.
+   * Per-thread selected model pin. Provider route fields are retained for
+   * backwards-compatible responses but model-first sends re-resolve provider
+   * routing from current org policy.
    */
   modelProviderId: external_exports.string().nullable().optional(),
   modelProviderType: modelProviderTypeSchema.nullable().optional(),
@@ -105905,7 +106055,7 @@ var modelSelectionRequestSchema = external_exports.object({
   modelProviderId: external_exports.string().uuid(),
   selectedModel: external_exports.string().min(1)
 });
-var chatThreadsContract = c22.router({
+var chatThreadsContract = c23.router({
   create: {
     method: "POST",
     path: "/api/zero/chat-threads",
@@ -105941,7 +106091,7 @@ var chatThreadsContract = c22.router({
     summary: "List chat threads. When agentId is omitted, returns every thread the caller owns scoped by orgId."
   }
 });
-var chatThreadByIdContract = c22.router({
+var chatThreadByIdContract = c23.router({
   get: {
     method: "GET",
     path: "/api/zero/chat-threads/:id",
@@ -105964,7 +106114,7 @@ var chatThreadByIdContract = c22.router({
       draftAttachments: external_exports.array(persistedAttachmentSchema).nullable().optional()
     }),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -105976,21 +106126,21 @@ var chatThreadByIdContract = c22.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string() }),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete a chat thread",
-    body: c22.noBody()
+    body: c23.noBody()
   }
 });
-var chatThreadMarkReadContract = c22.router({
+var chatThreadMarkReadContract = c23.router({
   markRead: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/mark-read",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string() }),
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
       200: external_exports.object({
         lastReadMessageId: external_exports.string().nullable(),
@@ -106002,37 +106152,37 @@ var chatThreadMarkReadContract = c22.router({
     summary: "Mark a chat thread as read up to the latest message"
   }
 });
-var chatThreadPinContract = c22.router({
+var chatThreadPinContract = c23.router({
   pin: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/pin",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string() }),
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Pin a chat thread to the top of the sidebar"
   }
 });
-var chatThreadUnpinContract = c22.router({
+var chatThreadUnpinContract = c23.router({
   unpin: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/unpin",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string() }),
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Remove the pin from a chat thread"
   }
 });
-var chatThreadRenameContract = c22.router({
+var chatThreadRenameContract = c23.router({
   rename: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/rename",
@@ -106040,14 +106190,14 @@ var chatThreadRenameContract = c22.router({
     pathParams: external_exports.object({ id: external_exports.string() }),
     body: external_exports.object({ title: external_exports.string().min(1) }),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Rename a chat thread (suppresses automated title generation)"
   }
 });
-var chatMessagesContract = c22.router({
+var chatMessagesContract = c23.router({
   send: {
     method: "POST",
     path: "/api/zero/chat/messages",
@@ -106176,7 +106326,7 @@ var chatSearchResponseSchema = external_exports.object({
   results: external_exports.array(chatSearchResultSchema),
   hasMore: external_exports.boolean()
 });
-var chatSearchContract = c22.router({
+var chatSearchContract = c23.router({
   search: {
     method: "GET",
     path: "/api/zero/chat/search",
@@ -106198,7 +106348,7 @@ var chatSearchContract = c22.router({
     summary: "Search chat messages within caller's org (zero proxy)"
   }
 });
-var chatThreadMessagesContract = c22.router({
+var chatThreadMessagesContract = c23.router({
   list: {
     method: "GET",
     path: "/api/zero/chat-threads/:threadId/messages",
@@ -106220,7 +106370,7 @@ var chatThreadMessagesContract = c22.router({
     summary: "Get paginated chat messages for a thread"
   }
 });
-var chatThreadArtifactsContract = c22.router({
+var chatThreadArtifactsContract = c23.router({
   list: {
     method: "GET",
     path: "/api/zero/chat-threads/:threadId/artifacts",
@@ -106370,7 +106520,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-developer-support.ts
 init_esm_shims();
-var c23 = initContract();
+var c24 = initContract();
 var developerSupportBodySchema = external_exports.object({
   title: external_exports.string().min(1, "Title is required"),
   description: external_exports.string().min(1, "Description is required"),
@@ -106382,7 +106532,7 @@ var consentCodeResponseSchema = external_exports.object({
 var submitResponseSchema = external_exports.object({
   reference: external_exports.string()
 });
-var zeroDeveloperSupportContract = c23.router({
+var zeroDeveloperSupportContract = c24.router({
   submit: {
     method: "POST",
     path: "/api/zero/developer-support",
@@ -106419,7 +106569,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-computer-use.ts
 init_esm_shims();
-var c24 = initContract();
+var c25 = initContract();
 var registerResponseSchema = external_exports.object({
   id: external_exports.string(),
   domain: external_exports.string(),
@@ -106431,12 +106581,12 @@ var hostResponseSchema = external_exports.object({
   domain: external_exports.string(),
   token: external_exports.string()
 });
-var zeroComputerUseRegisterContract = c24.router({
+var zeroComputerUseRegisterContract = c25.router({
   register: {
     method: "POST",
     path: "/api/zero/computer-use/register",
     headers: authHeadersSchema,
-    body: c24.noBody(),
+    body: c25.noBody(),
     responses: {
       200: registerResponseSchema,
       401: apiErrorSchema,
@@ -106446,14 +106596,14 @@ var zeroComputerUseRegisterContract = c24.router({
     summary: "Register a computer-use host"
   }
 });
-var zeroComputerUseUnregisterContract = c24.router({
+var zeroComputerUseUnregisterContract = c25.router({
   unregister: {
     method: "DELETE",
     path: "/api/zero/computer-use/unregister",
     headers: authHeadersSchema,
-    body: c24.noBody(),
+    body: c25.noBody(),
     responses: {
-      204: c24.noBody(),
+      204: c25.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -106461,7 +106611,7 @@ var zeroComputerUseUnregisterContract = c24.router({
     summary: "Unregister a computer-use host"
   }
 });
-var zeroComputerUseHostContract = c24.router({
+var zeroComputerUseHostContract = c25.router({
   getHost: {
     method: "GET",
     path: "/api/zero/computer-use/host",
@@ -106516,7 +106666,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/realtime.ts
 init_esm_shims();
-var c25 = initContract();
+var c26 = initContract();
 var ablyTokenRequestSchema = external_exports.object({
   keyName: external_exports.string(),
   ttl: external_exports.number().optional(),
@@ -106526,7 +106676,7 @@ var ablyTokenRequestSchema = external_exports.object({
   nonce: external_exports.string(),
   mac: external_exports.string()
 });
-var runnerRealtimeTokenContract = c25.router({
+var runnerRealtimeTokenContract = c26.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -106548,7 +106698,7 @@ var runnerRealtimeTokenContract = c25.router({
     summary: "Get Ably token for runner group job notifications"
   }
 });
-var platformRealtimeTokenContract = c25.router({
+var platformRealtimeTokenContract = c26.router({
   /**
    * POST /api/zero/realtime/token
    * Get an Ably token to subscribe to the authenticated user's push channel
@@ -106568,7 +106718,7 @@ var platformRealtimeTokenContract = c25.router({
 });
 
 // ../../packages/api-contracts/src/contracts/zero-local-agent.ts
-var c26 = initContract();
+var c27 = initContract();
 var localAgentBackendSchema = external_exports.enum(["codex", "claude-code"]);
 var localAgentJobStatusSchema = external_exports.enum([
   "queued",
@@ -106671,7 +106821,7 @@ var localAgentHostStartResponseSchema = external_exports.object({
 var localAgentHostDeleteResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
-var zeroLocalAgentDeviceStartContract = c26.router({
+var zeroLocalAgentDeviceStartContract = c27.router({
   start: {
     method: "POST",
     path: "/api/zero/local-agent/device/start",
@@ -106686,7 +106836,7 @@ var zeroLocalAgentDeviceStartContract = c26.router({
     summary: "Start a local-agent device pairing flow"
   }
 });
-var zeroLocalAgentDevicePollContract = c26.router({
+var zeroLocalAgentDevicePollContract = c27.router({
   poll: {
     method: "POST",
     path: "/api/zero/local-agent/device/poll",
@@ -106701,7 +106851,7 @@ var zeroLocalAgentDevicePollContract = c26.router({
     summary: "Poll a local-agent device pairing flow"
   }
 });
-var zeroLocalAgentDeviceClaimContract = c26.router({
+var zeroLocalAgentDeviceClaimContract = c27.router({
   claim: {
     method: "POST",
     path: "/api/zero/local-agent/device/claim",
@@ -106720,7 +106870,7 @@ var zeroLocalAgentDeviceClaimContract = c26.router({
     summary: "Approve a local-agent device pairing flow"
   }
 });
-var zeroLocalAgentHeartbeatContract = c26.router({
+var zeroLocalAgentHeartbeatContract = c27.router({
   heartbeat: {
     method: "POST",
     path: "/api/zero/local-agent/heartbeat",
@@ -106737,7 +106887,7 @@ var zeroLocalAgentHeartbeatContract = c26.router({
     summary: "Refresh a linked local-agent host heartbeat"
   }
 });
-var zeroLocalAgentHostRealtimeContract = c26.router({
+var zeroLocalAgentHostRealtimeContract = c27.router({
   create: {
     method: "POST",
     path: "/api/zero/local-agent/host/realtime-token",
@@ -106750,7 +106900,7 @@ var zeroLocalAgentHostRealtimeContract = c26.router({
     summary: "Get Ably token for local-agent host job notifications"
   }
 });
-var zeroLocalAgentRunContract = c26.router({
+var zeroLocalAgentRunContract = c27.router({
   list: {
     method: "GET",
     path: "/api/zero/local-agent/runs",
@@ -106802,7 +106952,7 @@ var zeroLocalAgentRunContract = c26.router({
     summary: "Get a local-agent job"
   }
 });
-var zeroLocalAgentHostsContract = c26.router({
+var zeroLocalAgentHostsContract = c27.router({
   start: {
     method: "POST",
     path: "/api/zero/local-agent/hosts/start",
@@ -106839,7 +106989,7 @@ var zeroLocalAgentHostsContract = c26.router({
       hostId: external_exports.string().min(1)
     }),
     headers: authHeadersSchema,
-    body: c26.noBody(),
+    body: c27.noBody(),
     responses: {
       200: localAgentHostDeleteResponseSchema,
       401: apiErrorSchema,
@@ -106849,7 +106999,7 @@ var zeroLocalAgentHostsContract = c26.router({
     summary: "Delete a local-agent host"
   }
 });
-var zeroLocalAgentHostJobsContract = c26.router({
+var zeroLocalAgentHostJobsContract = c27.router({
   next: {
     method: "POST",
     path: "/api/zero/local-agent/host/jobs/next",
@@ -107064,7 +107214,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-local-browser.ts
 init_esm_shims();
-var c27 = initContract();
+var c28 = initContract();
 var localBrowserHostStatusSchema = external_exports.enum(["online", "offline"]);
 var localBrowserReadCommandKindSchema = external_exports.enum([
   "tabs.list",
@@ -107361,7 +107511,7 @@ var localBrowserCommandApprovalResponseSchema = external_exports.object({
   commandId: external_exports.string(),
   status: external_exports.enum(["queued", "failed"])
 });
-var zeroLocalBrowserDeviceStartContract = c27.router({
+var zeroLocalBrowserDeviceStartContract = c28.router({
   start: {
     method: "POST",
     path: "/api/zero/local-browser/device/start",
@@ -107373,7 +107523,7 @@ var zeroLocalBrowserDeviceStartContract = c27.router({
     summary: "Start a local-browser device pairing flow"
   }
 });
-var zeroLocalBrowserDevicePollContract = c27.router({
+var zeroLocalBrowserDevicePollContract = c28.router({
   poll: {
     method: "POST",
     path: "/api/zero/local-browser/device/poll",
@@ -107388,7 +107538,7 @@ var zeroLocalBrowserDevicePollContract = c27.router({
     summary: "Poll a local-browser device pairing flow"
   }
 });
-var zeroLocalBrowserDeviceClaimContract = c27.router({
+var zeroLocalBrowserDeviceClaimContract = c28.router({
   claim: {
     method: "POST",
     path: "/api/zero/local-browser/device/claim",
@@ -107407,7 +107557,7 @@ var zeroLocalBrowserDeviceClaimContract = c27.router({
     summary: "Approve a local-browser device pairing flow"
   }
 });
-var zeroLocalBrowserHeartbeatContract = c27.router({
+var zeroLocalBrowserHeartbeatContract = c28.router({
   heartbeat: {
     method: "POST",
     path: "/api/zero/local-browser/heartbeat",
@@ -107421,7 +107571,7 @@ var zeroLocalBrowserHeartbeatContract = c27.router({
     summary: "Refresh a linked local-browser host heartbeat"
   }
 });
-var zeroLocalBrowserHostRealtimeContract = c27.router({
+var zeroLocalBrowserHostRealtimeContract = c28.router({
   create: {
     method: "POST",
     path: "/api/zero/local-browser/host/realtime-token",
@@ -107434,7 +107584,7 @@ var zeroLocalBrowserHostRealtimeContract = c27.router({
     summary: "Get Ably token for local-browser command wakeups"
   }
 });
-var zeroLocalBrowserHostsContract = c27.router({
+var zeroLocalBrowserHostsContract = c28.router({
   start: {
     method: "POST",
     path: "/api/zero/local-browser/hosts/start",
@@ -107469,7 +107619,7 @@ var zeroLocalBrowserHostsContract = c27.router({
       hostId: external_exports.string().min(1)
     }),
     headers: authHeadersSchema,
-    body: c27.noBody(),
+    body: c28.noBody(),
     responses: {
       200: localBrowserHostDeleteResponseSchema,
       401: apiErrorSchema,
@@ -107479,7 +107629,7 @@ var zeroLocalBrowserHostsContract = c27.router({
     summary: "Delete a local-browser host"
   }
 });
-var zeroLocalBrowserAuditEventsContract = c27.router({
+var zeroLocalBrowserAuditEventsContract = c28.router({
   list: {
     method: "GET",
     path: "/api/zero/local-browser/audit-events",
@@ -107498,12 +107648,12 @@ var zeroLocalBrowserAuditEventsContract = c27.router({
     summary: "List local-browser write command audit events"
   }
 });
-var zeroLocalBrowserHostSelfContract = c27.router({
+var zeroLocalBrowserHostSelfContract = c28.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/local-browser/host",
     headers: authHeadersSchema,
-    body: c27.noBody(),
+    body: c28.noBody(),
     responses: {
       200: localBrowserHostDeleteResponseSchema,
       401: apiErrorSchema
@@ -107511,7 +107661,7 @@ var zeroLocalBrowserHostSelfContract = c27.router({
     summary: "Revoke the current local-browser host token"
   }
 });
-var zeroLocalBrowserCommandContract = c27.router({
+var zeroLocalBrowserCommandContract = c28.router({
   create: {
     method: "POST",
     path: "/api/zero/local-browser/commands",
@@ -107543,7 +107693,7 @@ var zeroLocalBrowserCommandContract = c27.router({
     summary: "Get a local-browser command result"
   }
 });
-var zeroLocalBrowserWriteCommandContract = c27.router({
+var zeroLocalBrowserWriteCommandContract = c28.router({
   create: {
     method: "POST",
     path: "/api/zero/local-browser/write-commands",
@@ -107560,7 +107710,7 @@ var zeroLocalBrowserWriteCommandContract = c27.router({
     summary: "Create an approved-write local-browser command"
   }
 });
-var zeroLocalBrowserCommandApprovalContract = c27.router({
+var zeroLocalBrowserCommandApprovalContract = c28.router({
   decide: {
     method: "POST",
     path: "/api/zero/local-browser/commands/:commandId/approval",
@@ -107583,7 +107733,7 @@ var zeroLocalBrowserCommandApprovalContract = c27.router({
     summary: "Approve or deny a pending local-browser write command"
   }
 });
-var zeroLocalBrowserHostCommandsContract = c27.router({
+var zeroLocalBrowserHostCommandsContract = c28.router({
   next: {
     method: "POST",
     path: "/api/zero/local-browser/host/commands/next",
@@ -108614,11 +108764,16 @@ function codexPermissionArgs(mode) {
   }
   throw new Error(`Unsupported Codex permission mode: ${mode}`);
 }
-function executionCommand(backend, prompt, permissionMode) {
+function executionCommand(backend, prompt, permissionMode, claudeArgs = []) {
   if (backend === "claude-code") {
     return {
       command: "claude",
-      args: ["-p", ...claudePermissionArgs(permissionMode), prompt]
+      args: [
+        "-p",
+        ...claudePermissionArgs(permissionMode),
+        ...claudeArgs,
+        prompt
+      ]
     };
   }
   return {
@@ -108637,7 +108792,8 @@ async function executeLocalAgentBackend(params) {
   const { command, args } = executionCommand(
     params.backend,
     params.prompt,
-    params.permissionMode
+    params.permissionMode,
+    params.claudeArgs
   );
   return new Promise((resolve2) => {
     const child = safeSpawn(command, args, {
@@ -109255,6 +109411,7 @@ async function runHostLoop(params) {
         backend: nextJob.job.backend,
         prompt: nextJob.job.prompt,
         workdir: params.workdir,
+        claudeArgs: params.claudeArgs,
         permissionMode: params.permissionMode
       });
       await completeLocalAgentHostJob({
@@ -109274,13 +109431,21 @@ async function runHostLoop(params) {
     process.removeListener("SIGTERM", onStop);
   }
 }
-var startCommand = new Command().name("start").description("Start the local-agent host daemon").option("--name <name>", "New host name, or a closed host name to reactivate").option("--workdir <path>", "Working directory for Codex/Claude jobs").option("--backend <backend>", "codex or claude-code for a new host").option("--permission-mode <mode>", "Permission mode for Codex/Claude jobs").option(
+var startCommand = new Command().name("start").description("Start the local-agent host daemon").option("--name <name>", "New host name, or a closed host name to reactivate").option("--workdir <path>", "Working directory for Codex/Claude jobs").option("--backend <backend>", "codex or claude-code for a new host").option(
+  "--claude-arg <arg>",
+  "Additional argument to pass to Claude Code jobs",
+  (value, previous) => {
+    return [...previous, value];
+  },
+  []
+).option("--permission-mode <mode>", "Permission mode for Codex/Claude jobs").option(
   "--host-id <id>",
   "Reactivate a closed host from vm0 local-agent list"
 ).option("--new", "Create a new host registration").action(
   withErrorHandler(async (options) => {
     const requestedHostName = options.name?.trim();
     const workdir = options.workdir?.trim() || process.cwd();
+    const claudeArgs = options.claudeArg ?? [];
     const savedHost = await getLocalAgentHost();
     const selection = await chooseHostForStart({
       requestedHostName,
@@ -109304,6 +109469,9 @@ var startCommand = new Command().name("start").description("Start the local-agen
       probes,
       requestedBackend: options.backend
     }) : await chooseBackend(probes, options.backend);
+    if (claudeArgs.length > 0 && selectedBackend !== "claude-code") {
+      throw new Error("--claude-arg can only be used with Claude Code jobs");
+    }
     const permissionMode = selection.restoredHost ? chooseRestoredPermissionMode({
       backend: selectedBackend,
       requestedPermissionMode: options.permissionMode,
@@ -109342,6 +109510,7 @@ var startCommand = new Command().name("start").description("Start the local-agen
       hostToken: started.hostToken,
       hostName: selection.hostName,
       supportedBackends,
+      claudeArgs,
       permissionMode,
       workdir
     });
@@ -112946,6 +113115,45 @@ var axiomFirewall = {
   ]
 };
 
+// ../../packages/connectors/src/firewalls/bentoml.generated.ts
+init_esm_shims();
+var bentomlFirewall = {
+  name: "bentoml",
+  description: "BentoCloud API and protected deployment endpoints",
+  placeholders: {
+    BENTO_CLOUD_API_KEY: "cur7hCoffeeSafeLocalCoffeeSafeLocalCoffeeSafe"
+  },
+  apis: [
+    {
+      base: "${{ vars.BENTO_CLOUD_API_ENDPOINT }}",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.BENTO_CLOUD_API_KEY }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://{deployment+}.bentoml.ai",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.BENTO_CLOUD_API_KEY }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://{deployment+}.cloud-apps.bentoml.com",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.BENTO_CLOUD_API_KEY }}"
+        }
+      },
+      permissions: []
+    }
+  ]
+};
+
 // ../../packages/connectors/src/firewalls/bitrix.generated.ts
 init_esm_shims();
 var bitrixFirewall = {
@@ -118268,6 +118476,44 @@ var redditFirewall = {
   ]
 };
 
+// ../../packages/connectors/src/firewalls/reap.generated.ts
+init_esm_shims();
+var reapFirewall = {
+  name: "reap",
+  description: "Reap API",
+  placeholders: {
+    REAP_API_KEY: "CoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocal"
+  },
+  apis: [
+    {
+      base: "${{ vars.REAP_API_BASE_URL }}",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.REAP_API_KEY }}",
+          "Reap-Version": "2025-02-14"
+        }
+      },
+      permissions: [
+        {
+          name: "read",
+          description: "Read Reap resources",
+          rules: ["GET /{path+}"]
+        },
+        {
+          name: "write",
+          description: "Create, update, and delete Reap resources",
+          rules: [
+            "POST /{path+}",
+            "PUT /{path+}",
+            "PATCH /{path+}",
+            "DELETE /{path+}"
+          ]
+        }
+      ]
+    }
+  ]
+};
+
 // ../../packages/connectors/src/firewalls/reportei.generated.ts
 init_esm_shims();
 var reporteiFirewall = {
@@ -121842,6 +122088,7 @@ var CONNECTOR_FIREWALLS = {
   attio: attioFirewall,
   atlassian: atlassianFirewall,
   axiom: axiomFirewall,
+  bentoml: bentomlFirewall,
   bitrix: bitrixFirewall,
   "brave-search": braveSearchFirewall,
   brevo: brevoFirewall,
@@ -121960,6 +122207,7 @@ var CONNECTOR_FIREWALLS = {
   qdrant: qdrantFirewall,
   qiita: qiitaFirewall,
   reddit: redditFirewall,
+  reap: reapFirewall,
   reportei: reporteiFirewall,
   replicate: replicateFirewall,
   resend: resendFirewall,
@@ -122109,11 +122357,11 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/health.ts
 init_esm_shims();
-var c28 = initContract();
+var c29 = initContract();
 var healthResponseSchema = external_exports.object({
   status: external_exports.literal("ok")
 });
-var healthContract = c28.router({
+var healthContract = c29.router({
   check: {
     method: "GET",
     path: "/health",
@@ -122123,7 +122371,7 @@ var healthContract = c28.router({
     summary: "Check API health"
   }
 });
-var healthAuthContract = c28.router({
+var healthAuthContract = c29.router({
   check: {
     method: "GET",
     path: "/health/auth",
@@ -122142,40 +122390,6 @@ var healthAuthContract = c28.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/zero-model-policies.ts
-init_esm_shims();
-var c29 = initContract();
-var zeroModelPoliciesMainContract = c29.router({
-  list: {
-    method: "GET",
-    path: "/api/zero/model-policies",
-    headers: authHeadersSchema,
-    responses: {
-      200: orgModelPoliciesResponseSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema,
-      500: apiErrorSchema
-    },
-    summary: "List org model-first policies"
-  },
-  update: {
-    method: "PUT",
-    path: "/api/zero/model-policies",
-    headers: authHeadersSchema,
-    body: updateOrgModelPoliciesRequestSchema,
-    responses: {
-      200: orgModelPoliciesResponseSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema,
-      500: apiErrorSchema
-    },
-    summary: "Update org model-first policies"
-  }
-});
-
 // ../../packages/api-contracts/src/contracts/zero-user-model-preference.ts
 init_esm_shims();
 var c30 = initContract();
@@ -124330,9 +124544,20 @@ var customConnectorResponseSchema = external_exports.object({
 var customConnectorListResponseSchema = external_exports.object({
   connectors: external_exports.array(customConnectorResponseSchema)
 });
+var customConnectorPrefixSchema = external_exports.string().min(1).refine(
+  (value) => {
+    try {
+      new URL(value);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  { message: "Invalid URL" }
+);
 var createCustomConnectorBodySchema = external_exports.object({
   displayName: external_exports.string().min(1).max(128),
-  prefixes: external_exports.array(external_exports.string().url()).min(1),
+  prefixes: external_exports.array(customConnectorPrefixSchema).min(1),
   headerName: external_exports.string().min(1).max(128),
   headerTemplate: external_exports.string().min(1),
   slug: external_exports.string().optional()
@@ -126868,6 +127093,11 @@ var FEATURE_SWITCHES = {
     description: "Enable the Ahrefs SEO connector",
     enabled: false
   },
+  ["bentomlConnector" /* BentomlConnector */]: {
+    maintainer: "ethan@vm0.ai",
+    description: "Enable the BentoML model serving connector",
+    enabled: false
+  },
   ["canvaConnector" /* CanvaConnector */]: {
     maintainer: "ethan@vm0.ai",
     description: "Enable the Canva design connector",
@@ -126961,7 +127191,8 @@ var FEATURE_SWITCHES = {
   ["cliAuthStripe" /* CliAuthStripe */]: {
     maintainer: "liangyou@vm0.ai",
     description: "Gate Stripe-specific CLI auth UI and API surfaces.",
-    enabled: false
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
   },
   ["posthogConnector" /* PosthogConnector */]: {
     maintainer: "ethan@vm0.ai",
@@ -128543,6 +128774,7 @@ export {
   listZeroOrgVariables,
   setZeroOrgVariable,
   deleteZeroOrgVariable,
+  getVm0ModelMultiplier,
   MODEL_PROVIDER_TYPES,
   getSelectableProviderTypes,
   hasAuthMethods,
@@ -128552,6 +128784,7 @@ export {
   listZeroOrgModelProviders,
   upsertZeroOrgModelProvider,
   deleteZeroOrgModelProvider,
+  listZeroModelPolicies,
   zeroAgentCustomSkillNameSchema,
   createZeroAgent,
   listZeroAgents,
@@ -128670,4 +128903,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-4F34B6ZK.js.map
+//# sourceMappingURL=chunk-EESCNG6H.js.map