@vm0/cli 9.17.1 → 9.18.0

package/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command59 } from "commander";
+import { Command as Command63 } from "commander";
 
 // src/commands/auth/index.ts
 import { Command as Command5 } from "commander";
@@ -237,7 +237,7 @@ var infoCommand = new Command6().name("info").description("Display environment i
 import { Command as Command7, Option } from "commander";
 import chalk4 from "chalk";
 import { readFile as readFile4 } from "fs/promises";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { dirname as dirname2 } from "path";
 import { parse as parseYaml2 } from "yaml";
 
@@ -1987,9 +1987,108 @@ var secretsByNameContract = c11.router({
   }
 });
 
-// ../../packages/core/src/contracts/model-providers.ts
+// ../../packages/core/src/contracts/variables.ts
 import { z as z15 } from "zod";
 var c12 = initContract();
+var variableNameSchema = z15.string().min(1, "Variable name is required").max(255, "Variable name must be at most 255 characters").regex(
+  /^[A-Z][A-Z0-9_]*$/,
+  "Variable name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_VAR)"
+);
+var variableResponseSchema = z15.object({
+  id: z15.string().uuid(),
+  name: z15.string(),
+  value: z15.string(),
+  description: z15.string().nullable(),
+  createdAt: z15.string(),
+  updatedAt: z15.string()
+});
+var variableListResponseSchema = z15.object({
+  variables: z15.array(variableResponseSchema)
+});
+var setVariableRequestSchema = z15.object({
+  name: variableNameSchema,
+  value: z15.string().min(1, "Variable value is required"),
+  description: z15.string().max(1e3).optional()
+});
+var variablesMainContract = c12.router({
+  /**
+   * GET /api/variables
+   * List all variables for the current user's scope (includes values)
+   */
+  list: {
+    method: "GET",
+    path: "/api/variables",
+    headers: authHeadersSchema,
+    responses: {
+      200: variableListResponseSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List all variables (includes values)"
+  },
+  /**
+   * PUT /api/variables
+   * Create or update a variable
+   */
+  set: {
+    method: "PUT",
+    path: "/api/variables",
+    headers: authHeadersSchema,
+    body: setVariableRequestSchema,
+    responses: {
+      200: variableResponseSchema,
+      201: variableResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Create or update a variable"
+  }
+});
+var variablesByNameContract = c12.router({
+  /**
+   * GET /api/variables/:name
+   * Get a variable by name (includes value)
+   */
+  get: {
+    method: "GET",
+    path: "/api/variables/:name",
+    headers: authHeadersSchema,
+    pathParams: z15.object({
+      name: variableNameSchema
+    }),
+    responses: {
+      200: variableResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get variable by name"
+  },
+  /**
+   * DELETE /api/variables/:name
+   * Delete a variable by name
+   */
+  delete: {
+    method: "DELETE",
+    path: "/api/variables/:name",
+    headers: authHeadersSchema,
+    pathParams: z15.object({
+      name: variableNameSchema
+    }),
+    responses: {
+      204: c12.noBody(),
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Delete a variable"
+  }
+});
+
+// ../../packages/core/src/contracts/model-providers.ts
+import { z as z16 } from "zod";
+var c13 = initContract();
 var MODEL_PROVIDER_TYPES = {
   "claude-code-oauth-token": {
     framework: "claude-code",
@@ -2109,6 +2208,41 @@ var MODEL_PROVIDER_TYPES = {
     models: ["GLM-4.7", "GLM-4.5-Air"],
     defaultModel: "GLM-4.7"
   },
+  "azure-foundry": {
+    framework: "claude-code",
+    label: "Azure Foundry",
+    helpText: "Run Claude on Microsoft Azure Foundry.\nSetup guide: https://code.claude.com/docs/en/microsoft-foundry",
+    authMethods: {
+      "api-key": {
+        label: "API Key",
+        helpText: "Use an Azure Foundry API key for authentication",
+        credentials: {
+          ANTHROPIC_FOUNDRY_API_KEY: {
+            label: "ANTHROPIC_FOUNDRY_API_KEY",
+            required: true,
+            helpText: "API key from Azure Foundry portal (Endpoints and keys)"
+          },
+          ANTHROPIC_FOUNDRY_RESOURCE: {
+            label: "ANTHROPIC_FOUNDRY_RESOURCE",
+            required: true,
+            placeholder: "my-resource",
+            helpText: "Azure resource name (from portal URL)"
+          }
+        }
+      }
+    },
+    defaultAuthMethod: "api-key",
+    environmentMapping: {
+      CLAUDE_CODE_USE_FOUNDRY: "1",
+      ANTHROPIC_FOUNDRY_API_KEY: "$credentials.ANTHROPIC_FOUNDRY_API_KEY",
+      ANTHROPIC_FOUNDRY_RESOURCE: "$credentials.ANTHROPIC_FOUNDRY_RESOURCE",
+      ANTHROPIC_MODEL: "$model"
+    },
+    models: [],
+    defaultModel: "",
+    allowCustomModel: true,
+    customModelPlaceholder: "claude-sonnet-4-5"
+  },
   "aws-bedrock": {
     framework: "claude-code",
     label: "AWS Bedrock",
@@ -2175,7 +2309,7 @@ var MODEL_PROVIDER_TYPES = {
     customModelPlaceholder: "anthropic.claude-sonnet-4-20250514-v1:0"
   }
 };
-var modelProviderTypeSchema = z15.enum([
+var modelProviderTypeSchema = z16.enum([
   "claude-code-oauth-token",
   "anthropic-api-key",
   "openrouter-api-key",
@@ -2183,9 +2317,10 @@ var modelProviderTypeSchema = z15.enum([
   "minimax-api-key",
   "deepseek-api-key",
   "zai-api-key",
+  "azure-foundry",
   "aws-bedrock"
 ]);
-var modelProviderFrameworkSchema = z15.enum(["claude-code", "codex"]);
+var modelProviderFrameworkSchema = z16.enum(["claude-code", "codex"]);
 function hasAuthMethods(type) {
   const config = MODEL_PROVIDER_TYPES[type];
   return "authMethods" in config;
@@ -2226,45 +2361,45 @@ function getCustomModelPlaceholder(type) {
   const config = MODEL_PROVIDER_TYPES[type];
   return "customModelPlaceholder" in config ? config.customModelPlaceholder : void 0;
 }
-var modelProviderResponseSchema = z15.object({
-  id: z15.string().uuid(),
+var modelProviderResponseSchema = z16.object({
+  id: z16.string().uuid(),
   type: modelProviderTypeSchema,
   framework: modelProviderFrameworkSchema,
-  credentialName: z15.string().nullable(),
+  credentialName: z16.string().nullable(),
   // Legacy single-credential (deprecated for multi-auth)
-  authMethod: z15.string().nullable(),
+  authMethod: z16.string().nullable(),
   // For multi-auth providers
-  credentialNames: z15.array(z15.string()).nullable(),
+  credentialNames: z16.array(z16.string()).nullable(),
   // For multi-auth providers
-  isDefault: z15.boolean(),
-  selectedModel: z15.string().nullable(),
-  createdAt: z15.string(),
-  updatedAt: z15.string()
+  isDefault: z16.boolean(),
+  selectedModel: z16.string().nullable(),
+  createdAt: z16.string(),
+  updatedAt: z16.string()
 });
-var modelProviderListResponseSchema = z15.object({
-  modelProviders: z15.array(modelProviderResponseSchema)
+var modelProviderListResponseSchema = z16.object({
+  modelProviders: z16.array(modelProviderResponseSchema)
 });
-var upsertModelProviderRequestSchema = z15.object({
+var upsertModelProviderRequestSchema = z16.object({
   type: modelProviderTypeSchema,
-  credential: z15.string().min(1).optional(),
+  credential: z16.string().min(1).optional(),
   // Legacy single credential
-  authMethod: z15.string().optional(),
+  authMethod: z16.string().optional(),
   // For multi-auth providers
-  credentials: z15.record(z15.string(), z15.string()).optional(),
+  credentials: z16.record(z16.string(), z16.string()).optional(),
   // For multi-auth providers
-  convert: z15.boolean().optional(),
-  selectedModel: z15.string().optional()
+  convert: z16.boolean().optional(),
+  selectedModel: z16.string().optional()
 });
-var upsertModelProviderResponseSchema = z15.object({
+var upsertModelProviderResponseSchema = z16.object({
   provider: modelProviderResponseSchema,
-  created: z15.boolean()
+  created: z16.boolean()
 });
-var checkCredentialResponseSchema = z15.object({
-  exists: z15.boolean(),
-  credentialName: z15.string(),
-  currentType: z15.enum(["user", "model-provider"]).optional()
+var checkCredentialResponseSchema = z16.object({
+  exists: z16.boolean(),
+  credentialName: z16.string(),
+  currentType: z16.enum(["user", "model-provider"]).optional()
 });
-var modelProvidersMainContract = c12.router({
+var modelProvidersMainContract = c13.router({
   list: {
     method: "GET",
     path: "/api/model-providers",
@@ -2292,12 +2427,12 @@ var modelProvidersMainContract = c12.router({
     summary: "Create or update a model provider"
   }
 });
-var modelProvidersCheckContract = c12.router({
+var modelProvidersCheckContract = c13.router({
   check: {
     method: "GET",
     path: "/api/model-providers/check/:type",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
     responses: {
@@ -2308,16 +2443,16 @@ var modelProvidersCheckContract = c12.router({
     summary: "Check if credential exists for a model provider type"
   }
 });
-var modelProvidersByTypeContract = c12.router({
+var modelProvidersByTypeContract = c13.router({
   delete: {
     method: "DELETE",
     path: "/api/model-providers/:type",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c12.noBody(),
+      204: c13.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -2325,15 +2460,15 @@ var modelProvidersByTypeContract = c12.router({
     summary: "Delete a model provider"
   }
 });
-var modelProvidersConvertContract = c12.router({
+var modelProvidersConvertContract = c13.router({
   convert: {
     method: "POST",
     path: "/api/model-providers/:type/convert",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
-    body: z15.undefined(),
+    body: z16.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       400: apiErrorSchema,
@@ -2344,15 +2479,15 @@ var modelProvidersConvertContract = c12.router({
     summary: "Convert existing user credential to model provider"
   }
 });
-var modelProvidersSetDefaultContract = c12.router({
+var modelProvidersSetDefaultContract = c13.router({
   setDefault: {
     method: "POST",
     path: "/api/model-providers/:type/set-default",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
-    body: z15.undefined(),
+    body: z16.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       401: apiErrorSchema,
@@ -2362,15 +2497,15 @@ var modelProvidersSetDefaultContract = c12.router({
     summary: "Set a model provider as default for its framework"
   }
 });
-var updateModelRequestSchema = z15.object({
-  selectedModel: z15.string().optional()
+var updateModelRequestSchema = z16.object({
+  selectedModel: z16.string().optional()
 });
-var modelProvidersUpdateModelContract = c12.router({
+var modelProvidersUpdateModelContract = c13.router({
   updateModel: {
     method: "PATCH",
     path: "/api/model-providers/:type/model",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
     body: updateModelRequestSchema,
@@ -2385,42 +2520,42 @@ var modelProvidersUpdateModelContract = c12.router({
 });
 
 // ../../packages/core/src/contracts/sessions.ts
-import { z as z16 } from "zod";
-var c13 = initContract();
-var sessionResponseSchema = z16.object({
-  id: z16.string(),
-  agentComposeId: z16.string(),
-  agentComposeVersionId: z16.string().nullable(),
-  conversationId: z16.string().nullable(),
-  artifactName: z16.string().nullable(),
-  vars: z16.record(z16.string(), z16.string()).nullable(),
-  secretNames: z16.array(z16.string()).nullable(),
-  volumeVersions: z16.record(z16.string(), z16.string()).nullable(),
-  createdAt: z16.string(),
-  updatedAt: z16.string()
+import { z as z17 } from "zod";
+var c14 = initContract();
+var sessionResponseSchema = z17.object({
+  id: z17.string(),
+  agentComposeId: z17.string(),
+  agentComposeVersionId: z17.string().nullable(),
+  conversationId: z17.string().nullable(),
+  artifactName: z17.string().nullable(),
+  vars: z17.record(z17.string(), z17.string()).nullable(),
+  secretNames: z17.array(z17.string()).nullable(),
+  volumeVersions: z17.record(z17.string(), z17.string()).nullable(),
+  createdAt: z17.string(),
+  updatedAt: z17.string()
 });
-var agentComposeSnapshotSchema = z16.object({
-  agentComposeVersionId: z16.string(),
-  vars: z16.record(z16.string(), z16.string()).optional(),
-  secretNames: z16.array(z16.string()).optional()
+var agentComposeSnapshotSchema = z17.object({
+  agentComposeVersionId: z17.string(),
+  vars: z17.record(z17.string(), z17.string()).optional(),
+  secretNames: z17.array(z17.string()).optional()
 });
-var artifactSnapshotSchema2 = z16.object({
-  artifactName: z16.string(),
-  artifactVersion: z16.string()
+var artifactSnapshotSchema2 = z17.object({
+  artifactName: z17.string(),
+  artifactVersion: z17.string()
 });
-var volumeVersionsSnapshotSchema2 = z16.object({
-  versions: z16.record(z16.string(), z16.string())
+var volumeVersionsSnapshotSchema2 = z17.object({
+  versions: z17.record(z17.string(), z17.string())
 });
-var checkpointResponseSchema = z16.object({
-  id: z16.string(),
-  runId: z16.string(),
-  conversationId: z16.string(),
+var checkpointResponseSchema = z17.object({
+  id: z17.string(),
+  runId: z17.string(),
+  conversationId: z17.string(),
   agentComposeSnapshot: agentComposeSnapshotSchema,
   artifactSnapshot: artifactSnapshotSchema2.nullable(),
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
-  createdAt: z16.string()
+  createdAt: z17.string()
 });
-var sessionsByIdContract = c13.router({
+var sessionsByIdContract = c14.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -2429,8 +2564,8 @@ var sessionsByIdContract = c13.router({
     method: "GET",
     path: "/api/agent/sessions/:id",
     headers: authHeadersSchema,
-    pathParams: z16.object({
-      id: z16.string().min(1, "Session ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Session ID is required")
     }),
     responses: {
       200: sessionResponseSchema,
@@ -2441,7 +2576,7 @@ var sessionsByIdContract = c13.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c13.router({
+var checkpointsByIdContract = c14.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -2450,8 +2585,8 @@ var checkpointsByIdContract = c13.router({
     method: "GET",
     path: "/api/agent/checkpoints/:id",
     headers: authHeadersSchema,
-    pathParams: z16.object({
-      id: z16.string().min(1, "Checkpoint ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
       200: checkpointResponseSchema,
@@ -2464,93 +2599,93 @@ var checkpointsByIdContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/schedules.ts
-import { z as z17 } from "zod";
-var c14 = initContract();
-var scheduleTriggerSchema = z17.object({
-  cron: z17.string().optional(),
-  at: z17.string().optional(),
-  timezone: z17.string().default("UTC")
+import { z as z18 } from "zod";
+var c15 = initContract();
+var scheduleTriggerSchema = z18.object({
+  cron: z18.string().optional(),
+  at: z18.string().optional(),
+  timezone: z18.string().default("UTC")
 }).refine((data) => data.cron && !data.at || !data.cron && data.at, {
   message: "Exactly one of 'cron' or 'at' must be specified"
 });
-var scheduleRunConfigSchema = z17.object({
-  agent: z17.string().min(1, "Agent reference required"),
-  prompt: z17.string().min(1, "Prompt required"),
-  vars: z17.record(z17.string(), z17.string()).optional(),
-  secrets: z17.record(z17.string(), z17.string()).optional(),
-  artifactName: z17.string().optional(),
-  artifactVersion: z17.string().optional(),
-  volumeVersions: z17.record(z17.string(), z17.string()).optional()
+var scheduleRunConfigSchema = z18.object({
+  agent: z18.string().min(1, "Agent reference required"),
+  prompt: z18.string().min(1, "Prompt required"),
+  vars: z18.record(z18.string(), z18.string()).optional(),
+  secrets: z18.record(z18.string(), z18.string()).optional(),
+  artifactName: z18.string().optional(),
+  artifactVersion: z18.string().optional(),
+  volumeVersions: z18.record(z18.string(), z18.string()).optional()
 });
-var scheduleDefinitionSchema = z17.object({
+var scheduleDefinitionSchema = z18.object({
   on: scheduleTriggerSchema,
   run: scheduleRunConfigSchema
 });
-var scheduleYamlSchema = z17.object({
-  version: z17.literal("1.0"),
-  schedules: z17.record(z17.string(), scheduleDefinitionSchema)
-});
-var deployScheduleRequestSchema = z17.object({
-  name: z17.string().min(1).max(64, "Schedule name max 64 chars"),
-  cronExpression: z17.string().optional(),
-  atTime: z17.string().optional(),
-  timezone: z17.string().default("UTC"),
-  prompt: z17.string().min(1, "Prompt required"),
-  vars: z17.record(z17.string(), z17.string()).optional(),
-  secrets: z17.record(z17.string(), z17.string()).optional(),
-  artifactName: z17.string().optional(),
-  artifactVersion: z17.string().optional(),
-  volumeVersions: z17.record(z17.string(), z17.string()).optional(),
+var scheduleYamlSchema = z18.object({
+  version: z18.literal("1.0"),
+  schedules: z18.record(z18.string(), scheduleDefinitionSchema)
+});
+var deployScheduleRequestSchema = z18.object({
+  name: z18.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z18.string().optional(),
+  atTime: z18.string().optional(),
+  timezone: z18.string().default("UTC"),
+  prompt: z18.string().min(1, "Prompt required"),
+  vars: z18.record(z18.string(), z18.string()).optional(),
+  secrets: z18.record(z18.string(), z18.string()).optional(),
+  artifactName: z18.string().optional(),
+  artifactVersion: z18.string().optional(),
+  volumeVersions: z18.record(z18.string(), z18.string()).optional(),
   // Resolved agent compose ID (CLI resolves scope/name:version → composeId)
-  composeId: z17.string().uuid("Invalid compose ID")
+  composeId: z18.string().uuid("Invalid compose ID")
 }).refine(
   (data) => data.cronExpression && !data.atTime || !data.cronExpression && data.atTime,
   {
     message: "Exactly one of 'cronExpression' or 'atTime' must be specified"
   }
 );
-var scheduleResponseSchema = z17.object({
-  id: z17.string().uuid(),
-  composeId: z17.string().uuid(),
-  composeName: z17.string(),
-  scopeSlug: z17.string(),
-  name: z17.string(),
-  cronExpression: z17.string().nullable(),
-  atTime: z17.string().nullable(),
-  timezone: z17.string(),
-  prompt: z17.string(),
-  vars: z17.record(z17.string(), z17.string()).nullable(),
+var scheduleResponseSchema = z18.object({
+  id: z18.string().uuid(),
+  composeId: z18.string().uuid(),
+  composeName: z18.string(),
+  scopeSlug: z18.string(),
+  name: z18.string(),
+  cronExpression: z18.string().nullable(),
+  atTime: z18.string().nullable(),
+  timezone: z18.string(),
+  prompt: z18.string(),
+  vars: z18.record(z18.string(), z18.string()).nullable(),
   // Secret names only (values are never returned)
-  secretNames: z17.array(z17.string()).nullable(),
-  artifactName: z17.string().nullable(),
-  artifactVersion: z17.string().nullable(),
-  volumeVersions: z17.record(z17.string(), z17.string()).nullable(),
-  enabled: z17.boolean(),
-  nextRunAt: z17.string().nullable(),
-  lastRunAt: z17.string().nullable(),
-  retryStartedAt: z17.string().nullable(),
-  createdAt: z17.string(),
-  updatedAt: z17.string()
-});
-var runSummarySchema = z17.object({
-  id: z17.string().uuid(),
-  status: z17.enum(["pending", "running", "completed", "failed", "timeout"]),
-  createdAt: z17.string(),
-  completedAt: z17.string().nullable(),
-  error: z17.string().nullable()
-});
-var scheduleRunsResponseSchema = z17.object({
-  runs: z17.array(runSummarySchema)
-});
-var scheduleListResponseSchema = z17.object({
-  schedules: z17.array(scheduleResponseSchema)
-});
-var deployScheduleResponseSchema = z17.object({
+  secretNames: z18.array(z18.string()).nullable(),
+  artifactName: z18.string().nullable(),
+  artifactVersion: z18.string().nullable(),
+  volumeVersions: z18.record(z18.string(), z18.string()).nullable(),
+  enabled: z18.boolean(),
+  nextRunAt: z18.string().nullable(),
+  lastRunAt: z18.string().nullable(),
+  retryStartedAt: z18.string().nullable(),
+  createdAt: z18.string(),
+  updatedAt: z18.string()
+});
+var runSummarySchema = z18.object({
+  id: z18.string().uuid(),
+  status: z18.enum(["pending", "running", "completed", "failed", "timeout"]),
+  createdAt: z18.string(),
+  completedAt: z18.string().nullable(),
+  error: z18.string().nullable()
+});
+var scheduleRunsResponseSchema = z18.object({
+  runs: z18.array(runSummarySchema)
+});
+var scheduleListResponseSchema = z18.object({
+  schedules: z18.array(scheduleResponseSchema)
+});
+var deployScheduleResponseSchema = z18.object({
   schedule: scheduleResponseSchema,
-  created: z17.boolean()
+  created: z18.boolean()
   // true if created, false if updated
 });
-var schedulesMainContract = c14.router({
+var schedulesMainContract = c15.router({
   /**
    * POST /api/agent/schedules
    * Deploy (create or update) a schedule
@@ -2588,7 +2723,7 @@ var schedulesMainContract = c14.router({
     summary: "List all schedules"
   }
 });
-var schedulesByNameContract = c14.router({
+var schedulesByNameContract = c15.router({
   /**
    * GET /api/agent/schedules/:name
    * Get schedule by name
@@ -2597,11 +2732,11 @@ var schedulesByNameContract = c14.router({
     method: "GET",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    query: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    query: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -2618,21 +2753,21 @@ var schedulesByNameContract = c14.router({
     method: "DELETE",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    query: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    query: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
-      204: c14.noBody(),
+      204: c15.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete schedule"
   }
 });
-var schedulesEnableContract = c14.router({
+var schedulesEnableContract = c15.router({
   /**
    * POST /api/agent/schedules/:name/enable
    * Enable a disabled schedule
@@ -2641,11 +2776,11 @@ var schedulesEnableContract = c14.router({
     method: "POST",
     path: "/api/agent/schedules/:name/enable",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    body: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    body: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -2662,11 +2797,11 @@ var schedulesEnableContract = c14.router({
     method: "POST",
     path: "/api/agent/schedules/:name/disable",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    body: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    body: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -2676,7 +2811,7 @@ var schedulesEnableContract = c14.router({
     summary: "Disable schedule"
   }
 });
-var scheduleRunsContract = c14.router({
+var scheduleRunsContract = c15.router({
   /**
    * GET /api/agent/schedules/:name/runs
    * List recent runs for a schedule
@@ -2685,12 +2820,12 @@ var scheduleRunsContract = c14.router({
     method: "GET",
     path: "/api/agent/schedules/:name/runs",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    query: z17.object({
-      composeId: z17.string().uuid("Compose ID required"),
-      limit: z17.coerce.number().min(0).max(100).default(5)
+    query: z18.object({
+      composeId: z18.string().uuid("Compose ID required"),
+      limit: z18.coerce.number().min(0).max(100).default(5)
     }),
     responses: {
       200: scheduleRunsResponseSchema,
@@ -2702,18 +2837,18 @@ var scheduleRunsContract = c14.router({
 });
 
 // ../../packages/core/src/contracts/realtime.ts
-import { z as z18 } from "zod";
-var c15 = initContract();
-var ablyTokenRequestSchema = z18.object({
-  keyName: z18.string(),
-  ttl: z18.number().optional(),
-  timestamp: z18.number(),
-  capability: z18.string(),
-  clientId: z18.string().optional(),
-  nonce: z18.string(),
-  mac: z18.string()
-});
-var realtimeTokenContract = c15.router({
+import { z as z19 } from "zod";
+var c16 = initContract();
+var ablyTokenRequestSchema = z19.object({
+  keyName: z19.string(),
+  ttl: z19.number().optional(),
+  timestamp: z19.number(),
+  capability: z19.string(),
+  clientId: z19.string().optional(),
+  nonce: z19.string(),
+  mac: z19.string()
+});
+var realtimeTokenContract = c16.router({
   /**
    * POST /api/realtime/token
    * Get an Ably token to subscribe to a run's events channel
@@ -2722,8 +2857,8 @@ var realtimeTokenContract = c15.router({
     method: "POST",
     path: "/api/realtime/token",
     headers: authHeadersSchema,
-    body: z18.object({
-      runId: z18.string().uuid("runId must be a valid UUID")
+    body: z19.object({
+      runId: z19.string().uuid("runId must be a valid UUID")
     }),
     responses: {
       200: ablyTokenRequestSchema,
@@ -2735,7 +2870,7 @@ var realtimeTokenContract = c15.router({
     summary: "Get Ably token for run event subscription"
   }
 });
-var runnerRealtimeTokenContract = c15.router({
+var runnerRealtimeTokenContract = c16.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -2744,7 +2879,7 @@ var runnerRealtimeTokenContract = c15.router({
     method: "POST",
     path: "/api/runners/realtime/token",
     headers: authHeadersSchema,
-    body: z18.object({
+    body: z19.object({
       group: runnerGroupSchema
     }),
     responses: {
@@ -2758,11 +2893,11 @@ var runnerRealtimeTokenContract = c15.router({
 });
 
 // ../../packages/core/src/contracts/platform.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 
 // ../../packages/core/src/contracts/public/common.ts
-import { z as z19 } from "zod";
-var publicApiErrorTypeSchema = z19.enum([
+import { z as z20 } from "zod";
+var publicApiErrorTypeSchema = z20.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -2776,40 +2911,40 @@ var publicApiErrorTypeSchema = z19.enum([
   "rate_limit_error"
   // Rate limit exceeded (429)
 ]);
-var publicApiErrorSchema = z19.object({
-  error: z19.object({
+var publicApiErrorSchema = z20.object({
+  error: z20.object({
     type: publicApiErrorTypeSchema,
-    code: z19.string(),
-    message: z19.string(),
-    param: z19.string().optional(),
-    docUrl: z19.string().url().optional()
+    code: z20.string(),
+    message: z20.string(),
+    param: z20.string().optional(),
+    docUrl: z20.string().url().optional()
   })
 });
-var paginationSchema = z19.object({
-  hasMore: z19.boolean(),
-  nextCursor: z19.string().nullable()
+var paginationSchema = z20.object({
+  hasMore: z20.boolean(),
+  nextCursor: z20.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z19.object({
-    data: z19.array(dataSchema),
+  return z20.object({
+    data: z20.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z19.object({
-  cursor: z19.string().optional(),
-  limit: z19.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z20.object({
+  cursor: z20.string().optional(),
+  limit: z20.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z19.string().uuid();
-var timestampSchema = z19.string().datetime();
+var requestIdSchema = z20.string().uuid();
+var timestampSchema = z20.string().datetime();
 
 // ../../packages/core/src/contracts/platform.ts
-var c16 = initContract();
-var platformPaginationSchema = z20.object({
-  hasMore: z20.boolean(),
-  nextCursor: z20.string().nullable(),
-  totalPages: z20.number()
+var c17 = initContract();
+var platformPaginationSchema = z21.object({
+  hasMore: z21.boolean(),
+  nextCursor: z21.string().nullable(),
+  totalPages: z21.number()
 });
-var platformLogStatusSchema = z20.enum([
+var platformLogStatusSchema = z21.enum([
   "pending",
   "running",
   "completed",
@@ -2817,41 +2952,41 @@ var platformLogStatusSchema = z20.enum([
   "timeout",
   "cancelled"
 ]);
-var platformLogEntrySchema = z20.object({
-  id: z20.string().uuid(),
-  sessionId: z20.string().nullable(),
-  agentName: z20.string(),
-  framework: z20.string().nullable(),
+var platformLogEntrySchema = z21.object({
+  id: z21.string().uuid(),
+  sessionId: z21.string().nullable(),
+  agentName: z21.string(),
+  framework: z21.string().nullable(),
   status: platformLogStatusSchema,
-  createdAt: z20.string()
+  createdAt: z21.string()
 });
-var platformLogsListResponseSchema = z20.object({
-  data: z20.array(platformLogEntrySchema),
+var platformLogsListResponseSchema = z21.object({
+  data: z21.array(platformLogEntrySchema),
   pagination: platformPaginationSchema
 });
-var artifactSchema = z20.object({
-  name: z20.string().nullable(),
-  version: z20.string().nullable()
+var artifactSchema = z21.object({
+  name: z21.string().nullable(),
+  version: z21.string().nullable()
 });
-var platformLogDetailSchema = z20.object({
-  id: z20.string().uuid(),
-  sessionId: z20.string().nullable(),
-  agentName: z20.string(),
-  framework: z20.string().nullable(),
+var platformLogDetailSchema = z21.object({
+  id: z21.string().uuid(),
+  sessionId: z21.string().nullable(),
+  agentName: z21.string(),
+  framework: z21.string().nullable(),
   status: platformLogStatusSchema,
-  prompt: z20.string(),
-  error: z20.string().nullable(),
-  createdAt: z20.string(),
-  startedAt: z20.string().nullable(),
-  completedAt: z20.string().nullable(),
+  prompt: z21.string(),
+  error: z21.string().nullable(),
+  createdAt: z21.string(),
+  startedAt: z21.string().nullable(),
+  completedAt: z21.string().nullable(),
   artifact: artifactSchema
 });
-var platformLogsListContract = c16.router({
+var platformLogsListContract = c17.router({
   list: {
     method: "GET",
     path: "/api/platform/logs",
     query: listQuerySchema.extend({
-      search: z20.string().optional()
+      search: z21.string().optional()
     }),
     responses: {
       200: platformLogsListResponseSchema,
@@ -2860,12 +2995,12 @@ var platformLogsListContract = c16.router({
     summary: "List agent run logs with pagination"
   }
 });
-var platformLogsByIdContract = c16.router({
+var platformLogsByIdContract = c17.router({
   getById: {
     method: "GET",
     path: "/api/platform/logs/:id",
-    pathParams: z20.object({
-      id: z20.string().uuid("Invalid log ID")
+    pathParams: z21.object({
+      id: z21.string().uuid("Invalid log ID")
     }),
     responses: {
       200: platformLogDetailSchema,
@@ -2875,17 +3010,17 @@ var platformLogsByIdContract = c16.router({
     summary: "Get agent run log details by ID"
   }
 });
-var artifactDownloadResponseSchema = z20.object({
-  url: z20.string().url(),
-  expiresAt: z20.string()
+var artifactDownloadResponseSchema = z21.object({
+  url: z21.string().url(),
+  expiresAt: z21.string()
 });
-var platformArtifactDownloadContract = c16.router({
+var platformArtifactDownloadContract = c17.router({
   getDownloadUrl: {
     method: "GET",
     path: "/api/platform/artifacts/download",
-    query: z20.object({
-      name: z20.string().min(1, "Artifact name is required"),
-      version: z20.string().optional()
+    query: z21.object({
+      name: z21.string().min(1, "Artifact name is required"),
+      version: z21.string().optional()
     }),
     responses: {
       200: artifactDownloadResponseSchema,
@@ -2897,29 +3032,29 @@ var platformArtifactDownloadContract = c16.router({
 });
 
 // ../../packages/core/src/contracts/llm.ts
-import { z as z21 } from "zod";
-var c17 = initContract();
-var messageRoleSchema = z21.enum(["user", "assistant", "system"]);
-var chatMessageSchema = z21.object({
+import { z as z22 } from "zod";
+var c18 = initContract();
+var messageRoleSchema = z22.enum(["user", "assistant", "system"]);
+var chatMessageSchema = z22.object({
   role: messageRoleSchema,
-  content: z21.string()
+  content: z22.string()
 });
-var tokenUsageSchema = z21.object({
-  promptTokens: z21.number(),
-  completionTokens: z21.number(),
-  totalTokens: z21.number()
+var tokenUsageSchema = z22.object({
+  promptTokens: z22.number(),
+  completionTokens: z22.number(),
+  totalTokens: z22.number()
 });
-var llmChatRequestSchema = z21.object({
-  model: z21.string().min(1).optional(),
-  messages: z21.array(chatMessageSchema).min(1, "At least one message is required"),
-  stream: z21.boolean().optional().default(false)
+var llmChatRequestSchema = z22.object({
+  model: z22.string().min(1).optional(),
+  messages: z22.array(chatMessageSchema).min(1, "At least one message is required"),
+  stream: z22.boolean().optional().default(false)
 });
-var llmChatResponseSchema = z21.object({
-  content: z21.string(),
-  model: z21.string(),
+var llmChatResponseSchema = z22.object({
+  content: z22.string(),
+  model: z22.string(),
   usage: tokenUsageSchema
 });
-var llmChatContract = c17.router({
+var llmChatContract = c18.router({
   chat: {
     method: "POST",
     path: "/api/llm/chat",
@@ -2935,28 +3070,28 @@ var llmChatContract = c17.router({
 });
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z22 } from "zod";
-var c18 = initContract();
-var publicAgentSchema = z22.object({
-  id: z22.string(),
-  name: z22.string(),
-  currentVersionId: z22.string().nullable(),
+import { z as z23 } from "zod";
+var c19 = initContract();
+var publicAgentSchema = z23.object({
+  id: z23.string(),
+  name: z23.string(),
+  currentVersionId: z23.string().nullable(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var agentVersionSchema = z22.object({
-  id: z22.string(),
-  agentId: z22.string(),
-  versionNumber: z22.number(),
+var agentVersionSchema = z23.object({
+  id: z23.string(),
+  agentId: z23.string(),
+  versionNumber: z23.number(),
   createdAt: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z22.string().optional()
+  name: z23.string().optional()
 });
-var publicAgentsListContract = c18.router({
+var publicAgentsListContract = c19.router({
   list: {
     method: "GET",
     path: "/v1/agents",
@@ -2971,13 +3106,13 @@ var publicAgentsListContract = c18.router({
     description: "List all agents in the current scope with pagination. Use the `name` query parameter to filter by agent name."
   }
 });
-var publicAgentByIdContract = c18.router({
+var publicAgentByIdContract = c19.router({
   get: {
     method: "GET",
     path: "/v1/agents/:id",
     headers: authHeadersSchema,
-    pathParams: z22.object({
-      id: z22.string().min(1, "Agent ID is required")
+    pathParams: z23.object({
+      id: z23.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -2989,13 +3124,13 @@ var publicAgentByIdContract = c18.router({
     description: "Get agent details by ID"
   }
 });
-var publicAgentVersionsContract = c18.router({
+var publicAgentVersionsContract = c19.router({
   list: {
     method: "GET",
     path: "/v1/agents/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z22.object({
-      id: z22.string().min(1, "Agent ID is required")
+    pathParams: z23.object({
+      id: z23.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -3010,9 +3145,9 @@ var publicAgentVersionsContract = c18.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z23 } from "zod";
-var c19 = initContract();
-var publicRunStatusSchema = z23.enum([
+import { z as z24 } from "zod";
+var c20 = initContract();
+var publicRunStatusSchema = z24.enum([
   "pending",
   "running",
   "completed",
@@ -3020,54 +3155,54 @@ var publicRunStatusSchema = z23.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z23.object({
-  id: z23.string(),
-  agentId: z23.string(),
-  agentName: z23.string(),
+var publicRunSchema = z24.object({
+  id: z24.string(),
+  agentId: z24.string(),
+  agentName: z24.string(),
   status: publicRunStatusSchema,
-  prompt: z23.string(),
+  prompt: z24.string(),
   createdAt: timestampSchema,
   startedAt: timestampSchema.nullable(),
   completedAt: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z23.string().nullable(),
-  executionTimeMs: z23.number().nullable(),
-  checkpointId: z23.string().nullable(),
-  sessionId: z23.string().nullable(),
-  artifactName: z23.string().nullable(),
-  artifactVersion: z23.string().nullable(),
-  volumes: z23.record(z23.string(), z23.string()).optional()
+  error: z24.string().nullable(),
+  executionTimeMs: z24.number().nullable(),
+  checkpointId: z24.string().nullable(),
+  sessionId: z24.string().nullable(),
+  artifactName: z24.string().nullable(),
+  artifactVersion: z24.string().nullable(),
+  volumes: z24.record(z24.string(), z24.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z23.object({
+var createRunRequestSchema = z24.object({
   // Agent identification (one of: agent, agentId, sessionId, checkpointId)
-  agent: z23.string().optional(),
+  agent: z24.string().optional(),
   // Agent name
-  agentId: z23.string().optional(),
+  agentId: z24.string().optional(),
   // Agent ID
-  agentVersion: z23.string().optional(),
+  agentVersion: z24.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  sessionId: z23.string().optional(),
+  sessionId: z24.string().optional(),
   // Resume from checkpoint
-  checkpointId: z23.string().optional(),
+  checkpointId: z24.string().optional(),
   // Required
-  prompt: z23.string().min(1, "Prompt is required"),
+  prompt: z24.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z23.record(z23.string(), z23.string()).optional(),
-  secrets: z23.record(z23.string(), z23.string()).optional(),
-  artifactName: z23.string().optional(),
+  variables: z24.record(z24.string(), z24.string()).optional(),
+  secrets: z24.record(z24.string(), z24.string()).optional(),
+  artifactName: z24.string().optional(),
   // Artifact name to mount
-  artifactVersion: z23.string().optional(),
+  artifactVersion: z24.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z23.record(z23.string(), z23.string()).optional()
+  volumes: z24.record(z24.string(), z24.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
   status: publicRunStatusSchema.optional()
 });
-var publicRunsListContract = c19.router({
+var publicRunsListContract = c20.router({
   list: {
     method: "GET",
     path: "/v1/runs",
@@ -3099,13 +3234,13 @@ var publicRunsListContract = c19.router({
     description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
   }
 });
-var publicRunByIdContract = c19.router({
+var publicRunByIdContract = c20.router({
   get: {
     method: "GET",
     path: "/v1/runs/:id",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -3117,15 +3252,15 @@ var publicRunByIdContract = c19.router({
     description: "Get run details by ID"
   }
 });
-var publicRunCancelContract = c19.router({
+var publicRunCancelContract = c20.router({
   cancel: {
     method: "POST",
     path: "/v1/runs/:id/cancel",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
-    body: z23.undefined(),
+    body: z24.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -3138,27 +3273,27 @@ var publicRunCancelContract = c19.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z23.object({
+var logEntrySchema = z24.object({
   timestamp: timestampSchema,
-  type: z23.enum(["agent", "system", "network"]),
-  level: z23.enum(["debug", "info", "warn", "error"]),
-  message: z23.string(),
-  metadata: z23.record(z23.string(), z23.unknown()).optional()
+  type: z24.enum(["agent", "system", "network"]),
+  level: z24.enum(["debug", "info", "warn", "error"]),
+  message: z24.string(),
+  metadata: z24.record(z24.string(), z24.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z23.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z24.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z23.enum(["asc", "desc"]).default("asc")
+  order: z24.enum(["asc", "desc"]).default("asc")
 });
-var publicRunLogsContract = c19.router({
+var publicRunLogsContract = c20.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -3171,30 +3306,30 @@ var publicRunLogsContract = c19.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z23.object({
+var metricPointSchema = z24.object({
   timestamp: timestampSchema,
-  cpuPercent: z23.number(),
-  memoryUsedMb: z23.number(),
-  memoryTotalMb: z23.number(),
-  diskUsedMb: z23.number(),
-  diskTotalMb: z23.number()
-});
-var metricsSummarySchema = z23.object({
-  avgCpuPercent: z23.number(),
-  maxMemoryUsedMb: z23.number(),
-  totalDurationMs: z23.number().nullable()
-});
-var metricsResponseSchema2 = z23.object({
-  data: z23.array(metricPointSchema),
+  cpuPercent: z24.number(),
+  memoryUsedMb: z24.number(),
+  memoryTotalMb: z24.number(),
+  diskUsedMb: z24.number(),
+  diskTotalMb: z24.number()
+});
+var metricsSummarySchema = z24.object({
+  avgCpuPercent: z24.number(),
+  maxMemoryUsedMb: z24.number(),
+  totalDurationMs: z24.number().nullable()
+});
+var metricsResponseSchema2 = z24.object({
+  data: z24.array(metricPointSchema),
   summary: metricsSummarySchema
 });
-var publicRunMetricsContract = c19.router({
+var publicRunMetricsContract = c20.router({
   getMetrics: {
     method: "GET",
     path: "/v1/runs/:id/metrics",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -3206,7 +3341,7 @@ var publicRunMetricsContract = c19.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z23.enum([
+var sseEventTypeSchema = z24.enum([
   "status",
   // Run status change
   "output",
@@ -3218,26 +3353,26 @@ var sseEventTypeSchema = z23.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z23.object({
+var sseEventSchema = z24.object({
   event: sseEventTypeSchema,
-  data: z23.unknown(),
-  id: z23.string().optional()
+  data: z24.unknown(),
+  id: z24.string().optional()
   // For Last-Event-ID reconnection
 });
-var publicRunEventsContract = c19.router({
+var publicRunEventsContract = c20.router({
   streamEvents: {
     method: "GET",
     path: "/v1/runs/:id/events",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
-    query: z23.object({
-      lastEventId: z23.string().optional()
+    query: z24.object({
+      lastEventId: z24.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z23.any(),
+      200: z24.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -3249,28 +3384,28 @@ var publicRunEventsContract = c19.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z24 } from "zod";
-var c20 = initContract();
-var publicArtifactSchema = z24.object({
-  id: z24.string(),
-  name: z24.string(),
-  currentVersionId: z24.string().nullable(),
-  size: z24.number(),
+import { z as z25 } from "zod";
+var c21 = initContract();
+var publicArtifactSchema = z25.object({
+  id: z25.string(),
+  name: z25.string(),
+  currentVersionId: z25.string().nullable(),
+  size: z25.number(),
   // Total size in bytes
-  fileCount: z24.number(),
+  fileCount: z25.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var artifactVersionSchema = z24.object({
-  id: z24.string(),
+var artifactVersionSchema = z25.object({
+  id: z25.string(),
   // SHA-256 content hash
-  artifactId: z24.string(),
-  size: z24.number(),
+  artifactId: z25.string(),
+  size: z25.number(),
   // Size in bytes
-  fileCount: z24.number(),
-  message: z24.string().nullable(),
+  fileCount: z25.number(),
+  message: z25.string().nullable(),
   // Optional commit message
-  createdBy: z24.string(),
+  createdBy: z25.string(),
   createdAt: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -3280,7 +3415,7 @@ var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchem
 var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
   artifactVersionSchema
 );
-var publicArtifactsListContract = c20.router({
+var publicArtifactsListContract = c21.router({
   list: {
     method: "GET",
     path: "/v1/artifacts",
@@ -3295,13 +3430,13 @@ var publicArtifactsListContract = c20.router({
     description: "List all artifacts in the current scope with pagination"
   }
 });
-var publicArtifactByIdContract = c20.router({
+var publicArtifactByIdContract = c21.router({
   get: {
     method: "GET",
     path: "/v1/artifacts/:id",
     headers: authHeadersSchema,
-    pathParams: z24.object({
-      id: z24.string().min(1, "Artifact ID is required")
+    pathParams: z25.object({
+      id: z25.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -3313,13 +3448,13 @@ var publicArtifactByIdContract = c20.router({
     description: "Get artifact details by ID"
   }
 });
-var publicArtifactVersionsContract = c20.router({
+var publicArtifactVersionsContract = c21.router({
   list: {
     method: "GET",
     path: "/v1/artifacts/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z24.object({
-      id: z24.string().min(1, "Artifact ID is required")
+    pathParams: z25.object({
+      id: z25.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -3332,20 +3467,20 @@ var publicArtifactVersionsContract = c20.router({
     description: "List all versions of an artifact with pagination"
   }
 });
-var publicArtifactDownloadContract = c20.router({
+var publicArtifactDownloadContract = c21.router({
   download: {
     method: "GET",
     path: "/v1/artifacts/:id/download",
     headers: authHeadersSchema,
-    pathParams: z24.object({
-      id: z24.string().min(1, "Artifact ID is required")
+    pathParams: z25.object({
+      id: z25.string().min(1, "Artifact ID is required")
     }),
-    query: z24.object({
-      versionId: z24.string().optional()
+    query: z25.object({
+      versionId: z25.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z24.undefined(),
+      302: z25.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -3357,28 +3492,28 @@ var publicArtifactDownloadContract = c20.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z25 } from "zod";
-var c21 = initContract();
-var publicVolumeSchema = z25.object({
-  id: z25.string(),
-  name: z25.string(),
-  currentVersionId: z25.string().nullable(),
-  size: z25.number(),
+import { z as z26 } from "zod";
+var c22 = initContract();
+var publicVolumeSchema = z26.object({
+  id: z26.string(),
+  name: z26.string(),
+  currentVersionId: z26.string().nullable(),
+  size: z26.number(),
   // Total size in bytes
-  fileCount: z25.number(),
+  fileCount: z26.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var volumeVersionSchema = z25.object({
-  id: z25.string(),
+var volumeVersionSchema = z26.object({
+  id: z26.string(),
   // SHA-256 content hash
-  volumeId: z25.string(),
-  size: z25.number(),
+  volumeId: z26.string(),
+  size: z26.number(),
   // Size in bytes
-  fileCount: z25.number(),
-  message: z25.string().nullable(),
+  fileCount: z26.number(),
+  message: z26.string().nullable(),
   // Optional commit message
-  createdBy: z25.string(),
+  createdBy: z26.string(),
   createdAt: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -3386,7 +3521,7 @@ var publicVolumeDetailSchema = publicVolumeSchema.extend({
 });
 var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
 var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
-var publicVolumesListContract = c21.router({
+var publicVolumesListContract = c22.router({
   list: {
     method: "GET",
     path: "/v1/volumes",
@@ -3401,13 +3536,13 @@ var publicVolumesListContract = c21.router({
     description: "List all volumes in the current scope with pagination"
   }
 });
-var publicVolumeByIdContract = c21.router({
+var publicVolumeByIdContract = c22.router({
   get: {
     method: "GET",
     path: "/v1/volumes/:id",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Volume ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -3419,13 +3554,13 @@ var publicVolumeByIdContract = c21.router({
     description: "Get volume details by ID"
   }
 });
-var publicVolumeVersionsContract = c21.router({
+var publicVolumeVersionsContract = c22.router({
   list: {
     method: "GET",
     path: "/v1/volumes/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Volume ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -3438,20 +3573,20 @@ var publicVolumeVersionsContract = c21.router({
     description: "List all versions of a volume with pagination"
   }
 });
-var publicVolumeDownloadContract = c21.router({
+var publicVolumeDownloadContract = c22.router({
   download: {
     method: "GET",
     path: "/v1/volumes/:id/download",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Volume ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Volume ID is required")
     }),
-    query: z25.object({
-      versionId: z25.string().optional()
+    query: z26.object({
+      versionId: z26.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z25.undefined(),
+      302: z26.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -3926,54 +4061,97 @@ async function listScheduleRuns(params) {
   handleError(result, `Failed to list runs for schedule "${params.name}"`);
 }
 
-// src/lib/api/domains/credentials.ts
+// src/lib/api/domains/secrets.ts
 import { initClient as initClient7 } from "@ts-rest/core";
-async function listCredentials() {
+async function listSecrets() {
   const config = await getClientConfig();
-  const client = initClient7(credentialsMainContract, config);
+  const client = initClient7(secretsMainContract, config);
   const result = await client.list({ headers: {} });
   if (result.status === 200) {
     return result.body;
   }
-  handleError(result, "Failed to list credentials");
+  handleError(result, "Failed to list secrets");
 }
-async function getCredential(name) {
+async function getSecret(name) {
   const config = await getClientConfig();
-  const client = initClient7(credentialsByNameContract, config);
+  const client = initClient7(secretsByNameContract, config);
   const result = await client.get({
     params: { name }
   });
   if (result.status === 200) {
     return result.body;
   }
-  handleError(result, `Credential "${name}" not found`);
+  handleError(result, `Secret "${name}" not found`);
 }
-async function setCredential(body) {
+async function setSecret(body) {
   const config = await getClientConfig();
-  const client = initClient7(credentialsMainContract, config);
+  const client = initClient7(secretsMainContract, config);
   const result = await client.set({ body });
   if (result.status === 200 || result.status === 201) {
     return result.body;
   }
-  handleError(result, "Failed to set credential");
+  handleError(result, "Failed to set secret");
 }
-async function deleteCredential(name) {
+async function deleteSecret(name) {
   const config = await getClientConfig();
-  const client = initClient7(credentialsByNameContract, config);
+  const client = initClient7(secretsByNameContract, config);
   const result = await client.delete({
     params: { name }
   });
   if (result.status === 204) {
     return;
   }
-  handleError(result, `Credential "${name}" not found`);
+  handleError(result, `Secret "${name}" not found`);
 }
 
-// src/lib/api/domains/model-providers.ts
+// src/lib/api/domains/variables.ts
 import { initClient as initClient8 } from "@ts-rest/core";
+async function listVariables() {
+  const config = await getClientConfig();
+  const client = initClient8(variablesMainContract, config);
+  const result = await client.list({ headers: {} });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to list variables");
+}
+async function getVariable(name) {
+  const config = await getClientConfig();
+  const client = initClient8(variablesByNameContract, config);
+  const result = await client.get({
+    params: { name }
+  });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, `Variable "${name}" not found`);
+}
+async function setVariable(body) {
+  const config = await getClientConfig();
+  const client = initClient8(variablesMainContract, config);
+  const result = await client.set({ body });
+  if (result.status === 200 || result.status === 201) {
+    return result.body;
+  }
+  handleError(result, "Failed to set variable");
+}
+async function deleteVariable(name) {
+  const config = await getClientConfig();
+  const client = initClient8(variablesByNameContract, config);
+  const result = await client.delete({
+    params: { name }
+  });
+  if (result.status === 204) {
+    return;
+  }
+  handleError(result, `Variable "${name}" not found`);
+}
+
+// src/lib/api/domains/model-providers.ts
+import { initClient as initClient9 } from "@ts-rest/core";
 async function listModelProviders() {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersMainContract, config);
+  const client = initClient9(modelProvidersMainContract, config);
   const result = await client.list({ headers: {} });
   if (result.status === 200) {
     return result.body;
@@ -3982,7 +4160,7 @@ async function listModelProviders() {
 }
 async function upsertModelProvider(body) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersMainContract, config);
+  const client = initClient9(modelProvidersMainContract, config);
   const result = await client.upsert({ body });
   if (result.status === 200 || result.status === 201) {
     return result.body;
@@ -3991,7 +4169,7 @@ async function upsertModelProvider(body) {
 }
 async function checkModelProviderCredential(type) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersCheckContract, config);
+  const client = initClient9(modelProvidersCheckContract, config);
   const result = await client.check({
     params: { type }
   });
@@ -4002,7 +4180,7 @@ async function checkModelProviderCredential(type) {
 }
 async function deleteModelProvider(type) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersByTypeContract, config);
+  const client = initClient9(modelProvidersByTypeContract, config);
   const result = await client.delete({
     params: { type }
   });
@@ -4013,7 +4191,7 @@ async function deleteModelProvider(type) {
 }
 async function convertModelProviderCredential(type) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersConvertContract, config);
+  const client = initClient9(modelProvidersConvertContract, config);
   const result = await client.convert({
     params: { type }
   });
@@ -4024,7 +4202,7 @@ async function convertModelProviderCredential(type) {
 }
 async function setModelProviderDefault(type) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersSetDefaultContract, config);
+  const client = initClient9(modelProvidersSetDefaultContract, config);
   const result = await client.setDefault({
     params: { type }
   });
@@ -4035,7 +4213,7 @@ async function setModelProviderDefault(type) {
 }
 async function updateModelProviderModel(type, selectedModel) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersUpdateModelContract, config);
+  const client = initClient9(modelProvidersUpdateModelContract, config);
   const result = await client.updateModel({
     params: { type },
     body: { selectedModel }
@@ -4066,8 +4244,8 @@ async function getUsage(options) {
 }
 
 // src/lib/domain/yaml-validator.ts
-import { z as z26 } from "zod";
-var cliAgentNameSchema = z26.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
+import { z as z27 } from "zod";
+var cliAgentNameSchema = z27.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
   /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/,
   "Agent name must start and end with letter or number, and contain only letters, numbers, and hyphens"
 );
@@ -4082,7 +4260,7 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
         const skillUrl = agent.skills[i];
         if (skillUrl && !validateGitHubTreeUrl(skillUrl)) {
           ctx.addIssue({
-            code: z26.ZodIssueCode.custom,
+            code: z27.ZodIssueCode.custom,
             message: `Invalid skill URL: ${skillUrl}. Expected format: https://github.com/{owner}/{repo}/tree/{branch}/{path}`,
             path: ["skills", i]
           });
@@ -4091,15 +4269,15 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     }
   }
 );
-var cliComposeSchema = z26.object({
-  version: z26.string().min(1, "Missing config.version"),
-  agents: z26.record(cliAgentNameSchema, cliAgentDefinitionSchema),
-  volumes: z26.record(z26.string(), volumeConfigSchema).optional()
+var cliComposeSchema = z27.object({
+  version: z27.string().min(1, "Missing config.version"),
+  agents: z27.record(cliAgentNameSchema, cliAgentDefinitionSchema),
+  volumes: z27.record(z27.string(), volumeConfigSchema).optional()
 }).superRefine((config, ctx) => {
   const agentKeys = Object.keys(config.agents);
   if (agentKeys.length === 0) {
     ctx.addIssue({
-      code: z26.ZodIssueCode.custom,
+      code: z27.ZodIssueCode.custom,
       message: "agents must have at least one agent defined",
       path: ["agents"]
     });
@@ -4107,7 +4285,7 @@ var cliComposeSchema = z26.object({
   }
   if (agentKeys.length > 1) {
     ctx.addIssue({
-      code: z26.ZodIssueCode.custom,
+      code: z27.ZodIssueCode.custom,
       message: "Multiple agents not supported yet. Only one agent allowed.",
       path: ["agents"]
     });
@@ -4119,7 +4297,7 @@ var cliComposeSchema = z26.object({
   if (agentVolumes && agentVolumes.length > 0) {
     if (!config.volumes) {
       ctx.addIssue({
-        code: z26.ZodIssueCode.custom,
+        code: z27.ZodIssueCode.custom,
         message: "Agent references volumes but no volumes section defined. Each volume must have explicit name and version.",
         path: ["volumes"]
       });
@@ -4129,7 +4307,7 @@ var cliComposeSchema = z26.object({
       const parts = volDeclaration.split(":");
       if (parts.length !== 2) {
         ctx.addIssue({
-          code: z26.ZodIssueCode.custom,
+          code: z27.ZodIssueCode.custom,
           message: `Invalid volume declaration: ${volDeclaration}. Expected format: volume-key:/mount/path`,
           path: ["agents", agentName, "volumes"]
         });
@@ -4138,7 +4316,7 @@ var cliComposeSchema = z26.object({
       const volumeKey = parts[0].trim();
       if (!config.volumes[volumeKey]) {
         ctx.addIssue({
-          code: z26.ZodIssueCode.custom,
+          code: z27.ZodIssueCode.custom,
           message: `Volume "${volumeKey}" is not defined in volumes section. Each volume must have explicit name and version.`,
           path: ["volumes", volumeKey]
         });
@@ -4349,6 +4527,17 @@ import * as tar2 from "tar";
 import * as fs2 from "fs";
 import * as path2 from "path";
 import * as tar from "tar";
+function checkDirectoryStatus(dirPath) {
+  if (!fs2.existsSync(dirPath)) {
+    return { exists: false, empty: true };
+  }
+  const stat = fs2.statSync(dirPath);
+  if (!stat.isDirectory()) {
+    return { exists: true, empty: false };
+  }
+  const entries = fs2.readdirSync(dirPath);
+  return { exists: true, empty: entries.length === 0 };
+}
 function formatBytes(bytes) {
   if (bytes === 0) return "0 B";
   const k = 1024;
@@ -4961,7 +5150,7 @@ function getSecretsFromComposeContent(content) {
   return new Set(grouped.secrets.map((r) => r.name));
 }
 async function loadAndValidateConfig(configFile) {
-  if (!existsSync3(configFile)) {
+  if (!existsSync4(configFile)) {
     console.error(chalk4.red(`\u2717 Config file not found: ${configFile}`));
     process.exit(1);
   }
@@ -5177,7 +5366,7 @@ var composeCommand = new Command7().name("compose").description("Create or updat
         )
       );
       if (options.autoUpdate !== false) {
-        await silentUpgradeAfterCommand("9.17.1");
+        await silentUpgradeAfterCommand("9.18.0");
       }
     } catch (error) {
       if (error instanceof Error) {
@@ -5932,9 +6121,9 @@ var CodexEventParser = class {
       }
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const changes = item.changes.map((c22) => {
-        const action = c22.kind === "add" ? "Created" : c22.kind === "modify" ? "Modified" : "Deleted";
-        return `${action}: ${c22.path}`;
+      const changes = item.changes.map((c23) => {
+        const action = c23.kind === "add" ? "Created" : c23.kind === "modify" ? "Modified" : "Deleted";
+        return `${action}: ${c23.path}`;
       }).join("\n");
       return {
         type: "text",
@@ -6088,9 +6277,9 @@ var CodexEventRenderer = class {
       return;
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const summary = item.changes.map((c22) => {
-        const icon = c22.kind === "add" ? "+" : c22.kind === "delete" ? "-" : "~";
-        return `${icon}${c22.path}`;
+      const summary = item.changes.map((c23) => {
+        const icon = c23.kind === "add" ? "+" : c23.kind === "delete" ? "-" : "~";
+        return `${icon}${c23.path}`;
       }).join(", ");
       console.log(chalk7.green("[files]") + ` ${summary}`);
       return;
@@ -6111,7 +6300,7 @@ var CodexEventRenderer = class {
 };
 
 // src/lib/api/api-client.ts
-import { initClient as initClient9 } from "@ts-rest/core";
+import { initClient as initClient10 } from "@ts-rest/core";
 var ApiClient = class {
   async getHeaders() {
     const token = await getToken();
@@ -6137,7 +6326,7 @@ var ApiClient = class {
   async getComposeByName(name, scope) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(composesMainContract, {
+    const client = initClient10(composesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6158,7 +6347,7 @@ var ApiClient = class {
   async getComposeById(id) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(composesByIdContract, {
+    const client = initClient10(composesByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6180,7 +6369,7 @@ var ApiClient = class {
   async getComposeVersion(composeId, version) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(composesVersionsContract, {
+    const client = initClient10(composesVersionsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6201,7 +6390,7 @@ var ApiClient = class {
   async createOrUpdateCompose(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(composesMainContract, {
+    const client = initClient10(composesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6224,7 +6413,7 @@ var ApiClient = class {
   async createRun(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runsMainContract, {
+    const client = initClient10(runsMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6240,7 +6429,7 @@ var ApiClient = class {
   async getEvents(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runEventsContract, {
+    const client = initClient10(runEventsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6262,7 +6451,7 @@ var ApiClient = class {
   async getSystemLog(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runSystemLogContract, {
+    const client = initClient10(runSystemLogContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6285,7 +6474,7 @@ var ApiClient = class {
   async getMetrics(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runMetricsContract, {
+    const client = initClient10(runMetricsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6308,7 +6497,7 @@ var ApiClient = class {
   async getAgentEvents(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runAgentEventsContract, {
+    const client = initClient10(runAgentEventsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6331,7 +6520,7 @@ var ApiClient = class {
   async getNetworkLogs(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runNetworkLogsContract, {
+    const client = initClient10(runNetworkLogsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6357,7 +6546,7 @@ var ApiClient = class {
   async getScope() {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(scopeContract, {
+    const client = initClient10(scopeContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6376,7 +6565,7 @@ var ApiClient = class {
   async createScope(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(scopeContract, {
+    const client = initClient10(scopeContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6395,7 +6584,7 @@ var ApiClient = class {
   async updateScope(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(scopeContract, {
+    const client = initClient10(scopeContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6415,7 +6604,7 @@ var ApiClient = class {
   async getSession(sessionId) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(sessionsByIdContract, {
+    const client = initClient10(sessionsByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6437,7 +6626,7 @@ var ApiClient = class {
   async getCheckpoint(checkpointId) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(checkpointsByIdContract, {
+    const client = initClient10(checkpointsByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6458,7 +6647,7 @@ var ApiClient = class {
   async prepareStorage(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(storagesPrepareContract, {
+    const client = initClient10(storagesPrepareContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6477,7 +6666,7 @@ var ApiClient = class {
   async commitStorage(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(storagesCommitContract, {
+    const client = initClient10(storagesCommitContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6496,7 +6685,7 @@ var ApiClient = class {
   async getStorageDownload(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(storagesDownloadContract, {
+    const client = initClient10(storagesDownloadContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6521,7 +6710,7 @@ var ApiClient = class {
   async listStorages(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(storagesListContract, {
+    const client = initClient10(storagesListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6540,7 +6729,7 @@ var ApiClient = class {
   async deploySchedule(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesMainContract, {
+    const client = initClient10(schedulesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6559,7 +6748,7 @@ var ApiClient = class {
   async listSchedules() {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesMainContract, {
+    const client = initClient10(schedulesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6578,7 +6767,7 @@ var ApiClient = class {
   async getScheduleByName(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesByNameContract, {
+    const client = initClient10(schedulesByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6600,7 +6789,7 @@ var ApiClient = class {
   async deleteSchedule(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesByNameContract, {
+    const client = initClient10(schedulesByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6622,7 +6811,7 @@ var ApiClient = class {
   async enableSchedule(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesEnableContract, {
+    const client = initClient10(schedulesEnableContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6644,7 +6833,7 @@ var ApiClient = class {
   async disableSchedule(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesEnableContract, {
+    const client = initClient10(schedulesEnableContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6666,7 +6855,7 @@ var ApiClient = class {
   async listScheduleRuns(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(scheduleRunsContract, {
+    const client = initClient10(scheduleRunsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6691,7 +6880,7 @@ var ApiClient = class {
   async listPublicAgents(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicAgentsListContract, {
+    const client = initClient10(publicAgentsListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6710,7 +6899,7 @@ var ApiClient = class {
   async listPublicArtifacts(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicArtifactsListContract, {
+    const client = initClient10(publicArtifactsListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6729,7 +6918,7 @@ var ApiClient = class {
   async getPublicArtifact(id) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicArtifactByIdContract, {
+    const client = initClient10(publicArtifactByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6748,7 +6937,7 @@ var ApiClient = class {
   async listPublicVolumes(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicVolumesListContract, {
+    const client = initClient10(publicVolumesListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6767,7 +6956,7 @@ var ApiClient = class {
   async getPublicVolume(id) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicVolumeByIdContract, {
+    const client = initClient10(publicVolumeByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6806,7 +6995,7 @@ var ApiClient = class {
   async listCredentials() {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(credentialsMainContract, {
+    const client = initClient10(credentialsMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6825,7 +7014,7 @@ var ApiClient = class {
   async getCredential(name) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(credentialsByNameContract, {
+    const client = initClient10(credentialsByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6846,7 +7035,7 @@ var ApiClient = class {
   async setCredential(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(credentialsMainContract, {
+    const client = initClient10(credentialsMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6865,7 +7054,7 @@ var ApiClient = class {
   async deleteCredential(name) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(credentialsByNameContract, {
+    const client = initClient10(credentialsByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6886,7 +7075,7 @@ var ApiClient = class {
   async getRealtimeToken(runId) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(realtimeTokenContract, {
+    const client = initClient10(realtimeTokenContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -7408,7 +7597,7 @@ var mainRunCommand = new Command8().name("run").description("Run an agent").argu
       }
       showNextSteps(result);
       if (options.autoUpdate !== false) {
-        await silentUpgradeAfterCommand("9.17.1");
+        await silentUpgradeAfterCommand("9.18.0");
       }
     } catch (error) {
       handleRunError(error, identifier);
@@ -7685,7 +7874,7 @@ import path6 from "path";
 
 // src/lib/storage/storage-utils.ts
 import { readFile as readFile5, writeFile as writeFile4, mkdir as mkdir4 } from "fs/promises";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { parse as parseYaml3, stringify as stringifyYaml } from "yaml";
 import path5 from "path";
 var CONFIG_DIR = ".vm0";
@@ -7701,9 +7890,9 @@ async function readStorageConfig(basePath = process.cwd()) {
   const configPath = path5.join(basePath, CONFIG_DIR, CONFIG_FILE);
   const legacyConfigPath = path5.join(basePath, CONFIG_DIR, "volume.yaml");
   let actualPath = null;
-  if (existsSync5(configPath)) {
+  if (existsSync6(configPath)) {
     actualPath = configPath;
-  } else if (existsSync5(legacyConfigPath)) {
+  } else if (existsSync6(legacyConfigPath)) {
     actualPath = legacyConfigPath;
   }
   if (!actualPath) {
@@ -7719,7 +7908,7 @@ async function readStorageConfig(basePath = process.cwd()) {
 async function writeStorageConfig(storageName, basePath = process.cwd(), type = "volume") {
   const configDir = path5.join(basePath, CONFIG_DIR);
   const configPath = path5.join(configDir, CONFIG_FILE);
-  if (!existsSync5(configDir)) {
+  if (!existsSync6(configDir)) {
     await mkdir4(configDir, { recursive: true });
   }
   const config = {
@@ -8058,8 +8247,9 @@ import * as os5 from "os";
 import * as tar4 from "tar";
 async function cloneStorage(name, type, destination, options = {}) {
   const typeLabel = type === "artifact" ? "artifact" : "volume";
-  if (fs7.existsSync(destination)) {
-    throw new Error(`Directory "${destination}" already exists`);
+  const dirStatus = checkDirectoryStatus(destination);
+  if (dirStatus.exists && !dirStatus.empty) {
+    throw new Error(`Directory "${destination}" is not empty`);
   }
   console.log(chalk20.dim(`Checking remote ${typeLabel}...`));
   const downloadInfo = await getStorageDownload({
@@ -8914,7 +9104,7 @@ var cookAction = new Command27().name("cook").description("Quick start: prepare,
 ).option("-y, --yes", "Skip confirmation prompts").option("-v, --verbose", "Show full tool inputs and outputs").addOption(new Option5("--debug-no-mock-claude").hideHelp()).addOption(new Option5("--no-auto-update").hideHelp()).action(
   async (prompt, options) => {
     if (options.autoUpdate !== false) {
-      const shouldExit = await checkAndUpgrade("9.17.1", prompt);
+      const shouldExit = await checkAndUpgrade("9.18.0", prompt);
       if (shouldExit) {
         process.exit(0);
       }
@@ -9494,7 +9684,7 @@ import { Command as Command38 } from "commander";
 // src/commands/agent/clone.ts
 import { Command as Command35 } from "commander";
 import chalk36 from "chalk";
-import { existsSync as existsSync10, mkdtempSync as mkdtempSync5 } from "fs";
+import { mkdtempSync as mkdtempSync5 } from "fs";
 import { mkdir as mkdir7, writeFile as writeFile6, readdir, copyFile, rm as rm3 } from "fs/promises";
 import { join as join7, dirname as dirname3 } from "path";
 import { tmpdir as tmpdir7 } from "os";
@@ -9552,8 +9742,9 @@ async function downloadInstructions(agentName, instructionsPath, destination) {
 var cloneCommand3 = new Command35().name("clone").description("Clone agent compose to local directory (latest version)").argument("<name>", "Agent compose name to clone").argument("[destination]", "Destination directory (default: agent name)").action(async (name, destination) => {
   try {
     const targetDir = destination || name;
-    if (existsSync10(targetDir)) {
-      console.error(chalk36.red(`\u2717 Directory "${targetDir}" already exists`));
+    const dirStatus = checkDirectoryStatus(targetDir);
+    if (dirStatus.exists && !dirStatus.empty) {
+      console.error(chalk36.red(`\u2717 Directory "${targetDir}" is not empty`));
       process.exit(1);
     }
     console.log(`Cloning agent compose: ${name}`);
@@ -9628,7 +9819,7 @@ var listCommand4 = new Command36().name("list").alias("ls").description("List al
       );
       return;
     }
-    const nameWidth = Math.max(4, ...data.composes.map((c22) => c22.name.length));
+    const nameWidth = Math.max(4, ...data.composes.map((c23) => c23.name.length));
     const header = ["NAME".padEnd(nameWidth), "VERSION", "UPDATED"].join(
       "  "
     );
@@ -9915,7 +10106,7 @@ var agentCommand = new Command38().name("agent").description("Manage agent compo
 import { Command as Command39 } from "commander";
 import chalk39 from "chalk";
 import path15 from "path";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { writeFile as writeFile7 } from "fs/promises";
 var VM0_YAML_FILE = "vm0.yaml";
 var AGENTS_MD_FILE = "AGENTS.md";
@@ -9947,8 +10138,8 @@ You are a HackerNews AI content curator.
 }
 function checkExistingFiles() {
   const existingFiles = [];
-  if (existsSync11(VM0_YAML_FILE)) existingFiles.push(VM0_YAML_FILE);
-  if (existsSync11(AGENTS_MD_FILE)) existingFiles.push(AGENTS_MD_FILE);
+  if (existsSync10(VM0_YAML_FILE)) existingFiles.push(VM0_YAML_FILE);
+  if (existsSync10(AGENTS_MD_FILE)) existingFiles.push(AGENTS_MD_FILE);
   return existingFiles;
 }
 var initCommand3 = new Command39().name("init").description("Initialize a new VM0 project in the current directory").option("-f, --force", "Overwrite existing files").option("-n, --name <name>", "Agent name (required in non-interactive mode)").action(async (options) => {
@@ -10170,7 +10361,6 @@ import chalk40 from "chalk";
 var defaultPromptDeps = {
   isInteractive,
   promptConfirm,
-  promptPassword,
   promptText
 };
 function parseKeyValuePairs(pairs) {
@@ -10185,25 +10375,23 @@ function parseKeyValuePairs(pairs) {
   }
   return result;
 }
-async function handleSecrets(optionSecrets, existingSecretNames, deps) {
-  if (optionSecrets.length > 0) {
-    return {
-      secrets: parseKeyValuePairs(optionSecrets),
-      preserveExistingSecrets: false
-    };
-  }
+async function handleExistingSecrets(existingSecretNames, deps) {
   if (existingSecretNames.length > 0 && deps.isInteractive()) {
     const keepSecrets = await deps.promptConfirm(
       `Keep existing secrets? (${existingSecretNames.join(", ")})`,
       true
     );
     if (keepSecrets) {
-      return { secrets: {}, preserveExistingSecrets: true };
+      return true;
     }
-    console.log(chalk40.dim("  Note: You'll need to provide new secret values"));
-    return { secrets: {}, preserveExistingSecrets: false };
+    console.log(
+      chalk40.dim(
+        "  Note: Secrets will be cleared. Use 'vm0 secret set' to add platform secrets."
+      )
+    );
+    return false;
   }
-  return { secrets: {}, preserveExistingSecrets: false };
+  return false;
 }
 async function handleVars(optionVars, existingVars, deps) {
   if (optionVars.length > 0) {
@@ -10221,29 +10409,24 @@ async function handleVars(optionVars, existingVars, deps) {
   return {};
 }
 function displayMissingRequirements(missingSecrets, missingVars) {
-  console.log(chalk40.yellow("\nAgent requires the following configuration:"));
   if (missingSecrets.length > 0) {
-    console.log(chalk40.dim("  Secrets:"));
+    console.log(chalk40.yellow("\nAgent requires the following secrets:"));
+    for (const name of missingSecrets) {
+      console.log(chalk40.dim(`  ${name}`));
+    }
+    console.log();
+    console.log("Set secrets using the platform:");
     for (const name of missingSecrets) {
-      console.log(chalk40.dim(`    ${name}`));
+      console.log(chalk40.cyan(`  vm0 secret set ${name} <value>`));
     }
+    console.log();
   }
   if (missingVars.length > 0) {
-    console.log(chalk40.dim("  Vars:"));
+    console.log(chalk40.yellow("\nAgent requires the following variables:"));
     for (const name of missingVars) {
-      console.log(chalk40.dim(`    ${name}`));
-    }
-  }
-  console.log("");
-}
-async function promptForMissingSecrets(missingSecrets, secrets, deps) {
-  for (const name of missingSecrets) {
-    const value = await deps.promptPassword(
-      `Enter value for secret ${chalk40.cyan(name)}`
-    );
-    if (value) {
-      secrets[name] = value;
+      console.log(chalk40.dim(`  ${name}`));
     }
+    console.log();
   }
 }
 async function promptForMissingVars(missingVars, vars, deps) {
@@ -10258,32 +10441,30 @@ async function promptForMissingVars(missingVars, vars, deps) {
   }
 }
 async function gatherConfiguration(params, deps = defaultPromptDeps) {
-  const { required, optionSecrets, optionVars, existingSchedule } = params;
+  const { required, optionVars, existingSchedule } = params;
   const existingSecretNames = existingSchedule?.secretNames ?? [];
   const existingVars = existingSchedule?.vars ?? null;
-  const { secrets, preserveExistingSecrets } = await handleSecrets(
-    optionSecrets,
+  const preserveExistingSecrets = await handleExistingSecrets(
     existingSecretNames,
     deps
   );
   const vars = await handleVars(optionVars, existingVars, deps);
   const effectiveExistingSecrets = preserveExistingSecrets ? existingSecretNames : [];
   const missingSecrets = required.secrets.filter(
-    (name) => !Object.keys(secrets).includes(name) && !effectiveExistingSecrets.includes(name)
+    (name) => !effectiveExistingSecrets.includes(name)
   );
   const missingVars = required.vars.filter(
     (name) => !Object.keys(vars).includes(name)
   );
   if (missingSecrets.length === 0 && missingVars.length === 0) {
-    return { secrets, vars, preserveExistingSecrets };
+    return { vars, preserveExistingSecrets };
   }
   if (!deps.isInteractive()) {
-    return { secrets, vars, preserveExistingSecrets };
+    return { vars, preserveExistingSecrets };
   }
   displayMissingRequirements(missingSecrets, missingVars);
-  await promptForMissingSecrets(missingSecrets, secrets, deps);
   await promptForMissingVars(missingVars, vars, deps);
-  return { secrets, vars, preserveExistingSecrets };
+  return { vars, preserveExistingSecrets };
 }
 
 // src/commands/schedule/setup.ts
@@ -10410,7 +10591,7 @@ async function gatherFrequency(optionFrequency, existingFrequency) {
     );
     process.exit(1);
   }
-  const defaultIndex = existingFrequency ? FREQUENCY_CHOICES.findIndex((c22) => c22.value === existingFrequency) : 0;
+  const defaultIndex = existingFrequency ? FREQUENCY_CHOICES.findIndex((c23) => c23.value === existingFrequency) : 0;
   frequency = await promptSelect(
     "Schedule frequency",
     FREQUENCY_CHOICES,
@@ -10439,7 +10620,7 @@ async function gatherDay(frequency, optionDay, existingDay) {
     process.exit(1);
   }
   if (frequency === "weekly") {
-    const defaultDayIndex = existingDay !== void 0 ? DAY_OF_WEEK_CHOICES.findIndex((c22) => c22.value === existingDay) : 0;
+    const defaultDayIndex = existingDay !== void 0 ? DAY_OF_WEEK_CHOICES.findIndex((c23) => c23.value === existingDay) : 0;
     const day2 = await promptSelect(
       "Day of week",
       DAY_OF_WEEK_CHOICES,
@@ -10688,7 +10869,7 @@ async function handleScheduleEnabling(params) {
     showEnableHint(agentName);
   }
 }
-var setupCommand = new Command40().name("setup").description("Create or edit a schedule for an agent").argument("<agent-name>", "Agent name to configure schedule for").option("-f, --frequency <type>", "Frequency: daily|weekly|monthly|once").option("-t, --time <HH:MM>", "Time to run (24-hour format)").option("-d, --day <day>", "Day of week (mon-sun) or day of month (1-31)").option("-z, --timezone <tz>", "IANA timezone").option("-p, --prompt <text>", "Prompt to run").option("--var <name=value>", "Variable (can be repeated)", collect, []).option("--secret <name=value>", "Secret (can be repeated)", collect, []).option("--artifact-name <name>", "Artifact name", "artifact").option("-e, --enable", "Enable schedule immediately after creation").action(async (agentName, options) => {
+var setupCommand = new Command40().name("setup").description("Create or edit a schedule for an agent").argument("<agent-name>", "Agent name to configure schedule for").option("-f, --frequency <type>", "Frequency: daily|weekly|monthly|once").option("-t, --time <HH:MM>", "Time to run (24-hour format)").option("-d, --day <day>", "Day of week (mon-sun) or day of month (1-31)").option("-z, --timezone <tz>", "IANA timezone").option("-p, --prompt <text>", "Prompt to run").option("--var <name=value>", "Variable (can be repeated)", collect, []).option("--artifact-name <name>", "Artifact name", "artifact").option("-e, --enable", "Enable schedule immediately after creation").action(async (agentName, options) => {
   try {
     const { composeId, scheduleName, composeContent } = await resolveAgent(agentName);
     const requiredConfig = extractRequiredConfiguration(composeContent);
@@ -10731,7 +10912,8 @@ var setupCommand = new Command40().name("setup").description("Create or edit a s
     }
     const config = await gatherConfiguration({
       required: requiredConfig,
-      optionSecrets: options.secret || [],
+      optionSecrets: [],
+      // Secrets are no longer passed via CLI
       optionVars: options.var || [],
       existingSchedule
     });
@@ -10746,7 +10928,8 @@ var setupCommand = new Command40().name("setup").description("Create or edit a s
       timezone,
       prompt: promptText_,
       vars: Object.keys(config.vars).length > 0 ? config.vars : void 0,
-      secrets: config.preserveExistingSecrets ? void 0 : Object.keys(config.secrets).length > 0 ? config.secrets : void 0,
+      secrets: void 0,
+      // Secrets managed via platform, not schedule
       artifactName: options.artifactName
     });
     displayDeployResult(agentName, deployResult);
@@ -11246,38 +11429,36 @@ var usageCommand = new Command47().name("usage").description("View usage statist
   }
 });
 
-// src/commands/credential/index.ts
+// src/commands/secret/index.ts
 import { Command as Command51 } from "commander";
 
-// src/commands/credential/list.ts
+// src/commands/secret/list.ts
 import { Command as Command48 } from "commander";
 import chalk48 from "chalk";
-var listCommand6 = new Command48().name("list").alias("ls").description("List all credentials").action(async () => {
+var listCommand6 = new Command48().name("list").alias("ls").description("List all secrets").action(async () => {
   try {
-    const result = await listCredentials();
-    if (result.credentials.length === 0) {
-      console.log(chalk48.dim("No credentials found"));
+    const result = await listSecrets();
+    if (result.secrets.length === 0) {
+      console.log(chalk48.dim("No secrets found"));
       console.log();
-      console.log("To add a credential:");
-      console.log(chalk48.cyan("  vm0 credential set MY_API_KEY <value>"));
+      console.log("To add a secret:");
+      console.log(chalk48.cyan("  vm0 secret set MY_API_KEY <value>"));
       return;
     }
-    console.log(chalk48.bold("Credentials:"));
+    console.log(chalk48.bold("Secrets:"));
     console.log();
-    for (const credential of result.credentials) {
-      const typeIndicator = credential.type === "model-provider" ? chalk48.dim(" [model-provider]") : "";
-      console.log(`  ${chalk48.cyan(credential.name)}${typeIndicator}`);
-      if (credential.description) {
-        console.log(`    ${chalk48.dim(credential.description)}`);
+    for (const secret of result.secrets) {
+      const typeIndicator = secret.type === "model-provider" ? chalk48.dim(" [model-provider]") : "";
+      console.log(`  ${chalk48.cyan(secret.name)}${typeIndicator}`);
+      if (secret.description) {
+        console.log(`    ${chalk48.dim(secret.description)}`);
       }
       console.log(
-        `    ${chalk48.dim(`Updated: ${new Date(credential.updatedAt).toLocaleString()}`)}`
+        `    ${chalk48.dim(`Updated: ${new Date(secret.updatedAt).toLocaleString()}`)}`
       );
       console.log();
     }
-    console.log(
-      chalk48.dim(`Total: ${result.credentials.length} credential(s)`)
-    );
+    console.log(chalk48.dim(`Total: ${result.secrets.length} secret(s)`));
   } catch (error) {
     if (error instanceof Error) {
       if (error.message.includes("Not authenticated")) {
@@ -11292,22 +11473,22 @@ var listCommand6 = new Command48().name("list").alias("ls").description("List al
   }
 });
 
-// src/commands/credential/set.ts
+// src/commands/secret/set.ts
 import { Command as Command49 } from "commander";
 import chalk49 from "chalk";
-var setCommand2 = new Command49().name("set").description("Create or update a credential").argument("<name>", "Credential name (uppercase, e.g., MY_API_KEY)").argument("<value>", "Credential value").option("-d, --description <description>", "Optional description").action(
+var setCommand2 = new Command49().name("set").description("Create or update a secret").argument("<name>", "Secret name (uppercase, e.g., MY_API_KEY)").argument("<value>", "Secret value").option("-d, --description <description>", "Optional description").action(
   async (name, value, options) => {
     try {
-      const credential = await setCredential({
+      const secret = await setSecret({
         name,
         value,
         description: options.description
       });
-      console.log(chalk49.green(`\u2713 Credential "${credential.name}" saved`));
+      console.log(chalk49.green(`\u2713 Secret "${secret.name}" saved`));
       console.log();
       console.log("Use in vm0.yaml:");
       console.log(chalk49.cyan(`  environment:`));
-      console.log(chalk49.cyan(`    ${name}: \${{ credentials.${name} }}`));
+      console.log(chalk49.cyan(`    ${name}: \${{ secrets.${name} }}`));
     } catch (error) {
       if (error instanceof Error) {
         if (error.message.includes("Not authenticated")) {
@@ -11317,7 +11498,7 @@ var setCommand2 = new Command49().name("set").description("Create or update a cr
         } else if (error.message.includes("must contain only uppercase")) {
           console.error(chalk49.red(`\u2717 ${error.message}`));
           console.log();
-          console.log("Examples of valid credential names:");
+          console.log("Examples of valid secret names:");
           console.log(chalk49.dim("  MY_API_KEY"));
           console.log(chalk49.dim("  GITHUB_TOKEN"));
           console.log(chalk49.dim("  AWS_ACCESS_KEY_ID"));
@@ -11332,15 +11513,15 @@ var setCommand2 = new Command49().name("set").description("Create or update a cr
   }
 );
 
-// src/commands/credential/delete.ts
+// src/commands/secret/delete.ts
 import { Command as Command50 } from "commander";
 import chalk50 from "chalk";
-var deleteCommand2 = new Command50().name("delete").description("Delete a credential").argument("<name>", "Credential name to delete").option("-y, --yes", "Skip confirmation prompt").action(async (name, options) => {
+var deleteCommand2 = new Command50().name("delete").description("Delete a secret").argument("<name>", "Secret name to delete").option("-y, --yes", "Skip confirmation prompt").action(async (name, options) => {
   try {
     try {
-      await getCredential(name);
+      await getSecret(name);
     } catch {
-      console.error(chalk50.red(`\u2717 Credential "${name}" not found`));
+      console.error(chalk50.red(`\u2717 Secret "${name}" not found`));
       process.exit(1);
     }
     if (!options.yes) {
@@ -11351,7 +11532,7 @@ var deleteCommand2 = new Command50().name("delete").description("Delete a creden
         process.exit(1);
       }
       const confirmed = await promptConfirm(
-        `Are you sure you want to delete credential "${name}"?`,
+        `Are you sure you want to delete secret "${name}"?`,
         false
       );
       if (!confirmed) {
@@ -11359,8 +11540,8 @@ var deleteCommand2 = new Command50().name("delete").description("Delete a creden
         return;
       }
     }
-    await deleteCredential(name);
-    console.log(chalk50.green(`\u2713 Credential "${name}" deleted`));
+    await deleteSecret(name);
+    console.log(chalk50.green(`\u2713 Secret "${name}" deleted`));
   } catch (error) {
     if (error instanceof Error) {
       if (error.message.includes("Not authenticated")) {
@@ -11375,23 +11556,162 @@ var deleteCommand2 = new Command50().name("delete").description("Delete a creden
   }
 });
 
-// src/commands/credential/index.ts
-var credentialCommand = new Command51().name("credential").description("Manage stored credentials for agent runs").addCommand(listCommand6).addCommand(setCommand2).addCommand(deleteCommand2);
+// src/commands/secret/index.ts
+var secretCommand = new Command51().name("secret").description("Manage stored secrets for agent runs").addCommand(listCommand6).addCommand(setCommand2).addCommand(deleteCommand2);
 
-// src/commands/model-provider/index.ts
-import { Command as Command56 } from "commander";
+// src/commands/variable/index.ts
+import { Command as Command55 } from "commander";
 
-// src/commands/model-provider/list.ts
+// src/commands/variable/list.ts
 import { Command as Command52 } from "commander";
 import chalk51 from "chalk";
-var listCommand7 = new Command52().name("list").alias("ls").description("List all model providers").action(async () => {
+function truncateValue(value, maxLength = 60) {
+  if (value.length <= maxLength) {
+    return value;
+  }
+  return value.slice(0, maxLength - 15) + "... [truncated]";
+}
+var listCommand7 = new Command52().name("list").alias("ls").description("List all variables").action(async () => {
+  try {
+    const result = await listVariables();
+    if (result.variables.length === 0) {
+      console.log(chalk51.dim("No variables found"));
+      console.log();
+      console.log("To add a variable:");
+      console.log(chalk51.cyan("  vm0 variable set MY_VAR <value>"));
+      return;
+    }
+    console.log(chalk51.bold("Variables:"));
+    console.log();
+    for (const variable of result.variables) {
+      const displayValue = truncateValue(variable.value);
+      console.log(`  ${chalk51.cyan(variable.name)} = ${displayValue}`);
+      if (variable.description) {
+        console.log(`    ${chalk51.dim(variable.description)}`);
+      }
+      console.log(
+        `    ${chalk51.dim(`Updated: ${new Date(variable.updatedAt).toLocaleString()}`)}`
+      );
+      console.log();
+    }
+    console.log(chalk51.dim(`Total: ${result.variables.length} variable(s)`));
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(chalk51.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk51.red(`\u2717 ${error.message}`));
+      }
+    } else {
+      console.error(chalk51.red("\u2717 An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/variable/set.ts
+import { Command as Command53 } from "commander";
+import chalk52 from "chalk";
+var setCommand3 = new Command53().name("set").description("Create or update a variable").argument("<name>", "Variable name (uppercase, e.g., MY_VAR)").argument("<value>", "Variable value").option("-d, --description <description>", "Optional description").action(
+  async (name, value, options) => {
+    try {
+      const variable = await setVariable({
+        name,
+        value,
+        description: options.description
+      });
+      console.log(chalk52.green(`\u2713 Variable "${variable.name}" saved`));
+      console.log();
+      console.log("Use in vm0.yaml:");
+      console.log(chalk52.cyan(`  environment:`));
+      console.log(chalk52.cyan(`    ${name}: \${{ vars.${name} }}`));
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message.includes("Not authenticated")) {
+          console.error(
+            chalk52.red("\u2717 Not authenticated. Run: vm0 auth login")
+          );
+        } else if (error.message.includes("must contain only uppercase")) {
+          console.error(chalk52.red(`\u2717 ${error.message}`));
+          console.log();
+          console.log("Examples of valid variable names:");
+          console.log(chalk52.dim("  MY_VAR"));
+          console.log(chalk52.dim("  API_URL"));
+          console.log(chalk52.dim("  DEBUG_MODE"));
+        } else {
+          console.error(chalk52.red(`\u2717 ${error.message}`));
+        }
+      } else {
+        console.error(chalk52.red("\u2717 An unexpected error occurred"));
+      }
+      process.exit(1);
+    }
+  }
+);
+
+// src/commands/variable/delete.ts
+import { Command as Command54 } from "commander";
+import chalk53 from "chalk";
+var deleteCommand3 = new Command54().name("delete").description("Delete a variable").argument("<name>", "Variable name to delete").option("-y, --yes", "Skip confirmation prompt").action(async (name, options) => {
+  try {
+    try {
+      await getVariable(name);
+    } catch (error) {
+      if (error instanceof Error && error.message.toLowerCase().includes("not found")) {
+        console.error(chalk53.red(`\u2717 Variable "${name}" not found`));
+        process.exit(1);
+      }
+      throw error;
+    }
+    if (!options.yes) {
+      if (!isInteractive()) {
+        console.error(
+          chalk53.red("\u2717 --yes flag is required in non-interactive mode")
+        );
+        process.exit(1);
+      }
+      const confirmed = await promptConfirm(
+        `Are you sure you want to delete variable "${name}"?`,
+        false
+      );
+      if (!confirmed) {
+        console.log(chalk53.dim("Cancelled"));
+        return;
+      }
+    }
+    await deleteVariable(name);
+    console.log(chalk53.green(`\u2713 Variable "${name}" deleted`));
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(chalk53.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk53.red(`\u2717 ${error.message}`));
+      }
+    } else {
+      console.error(chalk53.red("\u2717 An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/variable/index.ts
+var variableCommand = new Command55().name("variable").description("Manage stored variables for agent runs").addCommand(listCommand7).addCommand(setCommand3).addCommand(deleteCommand3);
+
+// src/commands/model-provider/index.ts
+import { Command as Command60 } from "commander";
+
+// src/commands/model-provider/list.ts
+import { Command as Command56 } from "commander";
+import chalk54 from "chalk";
+var listCommand8 = new Command56().name("list").alias("ls").description("List all model providers").action(async () => {
   try {
     const result = await listModelProviders();
     if (result.modelProviders.length === 0) {
-      console.log(chalk51.dim("No model providers configured"));
+      console.log(chalk54.dim("No model providers configured"));
       console.log();
       console.log("To add a model provider:");
-      console.log(chalk51.cyan("  vm0 model-provider setup"));
+      console.log(chalk54.cyan("  vm0 model-provider setup"));
       return;
     }
     const byFramework = result.modelProviders.reduce(
@@ -11405,16 +11725,16 @@ var listCommand7 = new Command52().name("list").alias("ls").description("List al
       },
       {}
     );
-    console.log(chalk51.bold("Model Providers:"));
+    console.log(chalk54.bold("Model Providers:"));
     console.log();
     for (const [framework, providers] of Object.entries(byFramework)) {
-      console.log(`  ${chalk51.cyan(framework)}:`);
+      console.log(`  ${chalk54.cyan(framework)}:`);
       for (const provider of providers) {
-        const defaultTag = provider.isDefault ? chalk51.green(" (default)") : "";
-        const modelTag = provider.selectedModel ? chalk51.dim(` [${provider.selectedModel}]`) : "";
+        const defaultTag = provider.isDefault ? chalk54.green(" (default)") : "";
+        const modelTag = provider.selectedModel ? chalk54.dim(` [${provider.selectedModel}]`) : "";
         console.log(`    ${provider.type}${defaultTag}${modelTag}`);
         console.log(
-          chalk51.dim(
+          chalk54.dim(
             `      Updated: ${new Date(provider.updatedAt).toLocaleString()}`
           )
         );
@@ -11422,33 +11742,33 @@ var listCommand7 = new Command52().name("list").alias("ls").description("List al
       console.log();
     }
     console.log(
-      chalk51.dim(`Total: ${result.modelProviders.length} provider(s)`)
+      chalk54.dim(`Total: ${result.modelProviders.length} provider(s)`)
     );
   } catch (error) {
     if (error instanceof Error) {
       if (error.message.includes("Not authenticated")) {
-        console.error(chalk51.red("\u2717 Not authenticated. Run: vm0 auth login"));
+        console.error(chalk54.red("\u2717 Not authenticated. Run: vm0 auth login"));
       } else {
-        console.error(chalk51.red(`\u2717 ${error.message}`));
+        console.error(chalk54.red(`\u2717 ${error.message}`));
       }
     } else {
-      console.error(chalk51.red("\u2717 An unexpected error occurred"));
+      console.error(chalk54.red("\u2717 An unexpected error occurred"));
     }
     process.exit(1);
   }
 });
 
 // src/commands/model-provider/setup.ts
-import { Command as Command53 } from "commander";
-import chalk52 from "chalk";
+import { Command as Command57 } from "commander";
+import chalk55 from "chalk";
 import prompts2 from "prompts";
 function validateProviderType(typeStr) {
   if (!Object.keys(MODEL_PROVIDER_TYPES).includes(typeStr)) {
-    console.error(chalk52.red(`\u2717 Invalid type "${typeStr}"`));
+    console.error(chalk55.red(`\u2717 Invalid type "${typeStr}"`));
     console.log();
     console.log("Valid types:");
     for (const [t, config] of Object.entries(MODEL_PROVIDER_TYPES)) {
-      console.log(`  ${chalk52.cyan(t)} - ${config.label}`);
+      console.log(`  ${chalk55.cyan(t)} - ${config.label}`);
     }
     process.exit(1);
   }
@@ -11460,11 +11780,11 @@ function validateModel(type, modelStr) {
     return modelStr;
   }
   if (models && !models.includes(modelStr)) {
-    console.error(chalk52.red(`\u2717 Invalid model "${modelStr}"`));
+    console.error(chalk55.red(`\u2717 Invalid model "${modelStr}"`));
     console.log();
     console.log("Valid models:");
     for (const m of models) {
-      console.log(`  ${chalk52.cyan(m)}`);
+      console.log(`  ${chalk55.cyan(m)}`);
     }
     process.exit(1);
   }
@@ -11473,12 +11793,12 @@ function validateModel(type, modelStr) {
 function validateAuthMethod(type, authMethodStr) {
   const authMethods = getAuthMethodsForType(type);
   if (!authMethods || !(authMethodStr in authMethods)) {
-    console.error(chalk52.red(`\u2717 Invalid auth method "${authMethodStr}"`));
+    console.error(chalk55.red(`\u2717 Invalid auth method "${authMethodStr}"`));
     console.log();
     console.log("Valid auth methods:");
     if (authMethods) {
       for (const [method, config] of Object.entries(authMethods)) {
-        console.log(`  ${chalk52.cyan(method)} - ${config.label}`);
+        console.log(`  ${chalk55.cyan(method)} - ${config.label}`);
       }
     }
     process.exit(1);
@@ -11488,7 +11808,7 @@ function validateAuthMethod(type, authMethodStr) {
 function parseCredentials(type, authMethod, credentialArgs) {
   const credentialsConfig = getCredentialsForAuthMethod(type, authMethod);
   if (!credentialsConfig) {
-    console.error(chalk52.red(`\u2717 Invalid auth method "${authMethod}"`));
+    console.error(chalk55.red(`\u2717 Invalid auth method "${authMethod}"`));
     process.exit(1);
   }
   const credentialNames = Object.keys(credentialsConfig);
@@ -11496,7 +11816,7 @@ function parseCredentials(type, authMethod, credentialArgs) {
   if (credentialArgs.length === 1 && firstArg && !firstArg.includes("=")) {
     if (credentialNames.length !== 1) {
       console.error(
-        chalk52.red(
+        chalk55.red(
           "\u2717 Must use KEY=VALUE format for multi-credential auth methods"
         )
       );
@@ -11504,13 +11824,13 @@ function parseCredentials(type, authMethod, credentialArgs) {
       console.log("Required credentials:");
       for (const [name, fieldConfig] of Object.entries(credentialsConfig)) {
         const requiredNote = fieldConfig.required ? " (required)" : "";
-        console.log(`  ${chalk52.cyan(name)}${requiredNote}`);
+        console.log(`  ${chalk55.cyan(name)}${requiredNote}`);
       }
       process.exit(1);
     }
     const firstCredentialName = credentialNames[0];
     if (!firstCredentialName) {
-      console.error(chalk52.red("\u2717 No credentials defined for this auth method"));
+      console.error(chalk55.red("\u2717 No credentials defined for this auth method"));
       process.exit(1);
     }
     return { [firstCredentialName]: firstArg };
@@ -11519,7 +11839,7 @@ function parseCredentials(type, authMethod, credentialArgs) {
   for (const arg of credentialArgs) {
     const eqIndex = arg.indexOf("=");
     if (eqIndex === -1) {
-      console.error(chalk52.red(`\u2717 Invalid credential format "${arg}"`));
+      console.error(chalk55.red(`\u2717 Invalid credential format "${arg}"`));
       console.log();
       console.log("Use KEY=VALUE format (e.g., AWS_REGION=us-east-1)");
       process.exit(1);
@@ -11533,17 +11853,17 @@ function parseCredentials(type, authMethod, credentialArgs) {
 function validateCredentials(type, authMethod, credentials) {
   const credentialsConfig = getCredentialsForAuthMethod(type, authMethod);
   if (!credentialsConfig) {
-    console.error(chalk52.red(`\u2717 Invalid auth method "${authMethod}"`));
+    console.error(chalk55.red(`\u2717 Invalid auth method "${authMethod}"`));
     process.exit(1);
   }
   for (const [name, fieldConfig] of Object.entries(credentialsConfig)) {
     if (fieldConfig.required && !credentials[name]) {
-      console.error(chalk52.red(`\u2717 Missing required credential: ${name}`));
+      console.error(chalk55.red(`\u2717 Missing required credential: ${name}`));
       console.log();
       console.log("Required credentials:");
       for (const [n, fc] of Object.entries(credentialsConfig)) {
         if (fc.required) {
-          console.log(`  ${chalk52.cyan(n)} - ${fc.label}`);
+          console.log(`  ${chalk55.cyan(n)} - ${fc.label}`);
         }
       }
       process.exit(1);
@@ -11551,12 +11871,12 @@ function validateCredentials(type, authMethod, credentials) {
   }
   for (const name of Object.keys(credentials)) {
     if (!(name in credentialsConfig)) {
-      console.error(chalk52.red(`\u2717 Unknown credential: ${name}`));
+      console.error(chalk55.red(`\u2717 Unknown credential: ${name}`));
       console.log();
       console.log("Valid credentials:");
       for (const [n, fc] of Object.entries(credentialsConfig)) {
         const requiredNote = fc.required ? " (required)" : " (optional)";
-        console.log(`  ${chalk52.cyan(n)}${requiredNote}`);
+        console.log(`  ${chalk55.cyan(n)}${requiredNote}`);
       }
       process.exit(1);
     }
@@ -11579,7 +11899,7 @@ function handleNonInteractiveMode(options) {
       const defaultAuthMethod = getDefaultAuthMethod(type);
       const authMethods = getAuthMethodsForType(type);
       if (!defaultAuthMethod || !authMethods) {
-        console.error(chalk52.red(`\u2717 Provider "${type}" requires --auth-method`));
+        console.error(chalk55.red(`\u2717 Provider "${type}" requires --auth-method`));
         process.exit(1);
       }
       const authMethodNames = Object.keys(authMethods);
@@ -11587,7 +11907,7 @@ function handleNonInteractiveMode(options) {
         authMethod = authMethodNames[0];
       } else {
         console.error(
-          chalk52.red(
+          chalk55.red(
             `\u2717 --auth-method is required for "${type}" (multiple auth methods available)`
           )
         );
@@ -11596,13 +11916,13 @@ function handleNonInteractiveMode(options) {
         for (const [method, config] of Object.entries(authMethods)) {
           const defaultNote = method === defaultAuthMethod ? " (default)" : "";
           console.log(
-            `  ${chalk52.cyan(method)} - ${config.label}${defaultNote}`
+            `  ${chalk55.cyan(method)} - ${config.label}${defaultNote}`
           );
         }
         console.log();
         console.log("Example:");
         console.log(
-          chalk52.cyan(
+          chalk55.cyan(
             `  vm0 model-provider setup --type ${type} --auth-method ${authMethodNames[0]} --credential KEY=VALUE`
           )
         );
@@ -11622,7 +11942,7 @@ function handleNonInteractiveMode(options) {
   const credentialArgs = options.credential;
   const firstArg = credentialArgs[0];
   if (!firstArg) {
-    console.error(chalk52.red("\u2717 Credential is required"));
+    console.error(chalk55.red("\u2717 Credential is required"));
     process.exit(1);
   }
   let credential;
@@ -11671,7 +11991,7 @@ async function promptForModelSelection(type) {
   if (selected === "__custom__") {
     const placeholder = getCustomModelPlaceholder(type);
     if (placeholder) {
-      console.log(chalk52.dim(`Example: ${placeholder}`));
+      console.log(chalk55.dim(`Example: ${placeholder}`));
     }
     const customResponse = await prompts2(
       {
@@ -11716,13 +12036,13 @@ function isSecretCredential(name) {
 async function promptForCredentials(type, authMethod) {
   const credentialsConfig = getCredentialsForAuthMethod(type, authMethod);
   if (!credentialsConfig) {
-    console.error(chalk52.red(`\u2717 Invalid auth method "${authMethod}"`));
+    console.error(chalk55.red(`\u2717 Invalid auth method "${authMethod}"`));
     process.exit(1);
   }
   const credentials = {};
   for (const [name, fieldConfig] of Object.entries(credentialsConfig)) {
     if (fieldConfig.helpText) {
-      console.log(chalk52.dim(fieldConfig.helpText));
+      console.log(chalk55.dim(fieldConfig.helpText));
     }
     const isSecret = isSecretCredential(name);
     const placeholder = "placeholder" in fieldConfig ? fieldConfig.placeholder : "";
@@ -11757,11 +12077,11 @@ async function promptForCredentials(type, authMethod) {
 }
 async function handleInteractiveMode() {
   if (!isInteractive()) {
-    console.error(chalk52.red("\u2717 Interactive mode requires a TTY"));
+    console.error(chalk55.red("\u2717 Interactive mode requires a TTY"));
     console.log();
     console.log("Use non-interactive mode:");
     console.log(
-      chalk52.cyan(
+      chalk55.cyan(
         '  vm0 model-provider setup --type <type> --credential "<value>"'
       )
     );
@@ -11778,7 +12098,7 @@ async function handleInteractiveMode() {
         title = `${title} \u2713`;
       }
       if (isExperimental) {
-        title = `${title} ${chalk52.dim("(experimental)")}`;
+        title = `${title} ${chalk55.dim("(experimental)")}`;
       }
       return {
         title,
@@ -11811,14 +12131,14 @@ async function handleInteractiveMode() {
       const provider = await convertModelProviderCredential(type);
       const defaultNote = provider.isDefault ? ` (default for ${provider.framework})` : "";
       console.log(
-        chalk52.green(
+        chalk55.green(
           `\u2713 Converted "${checkResult.credentialName}" to model provider${defaultNote}`
         )
       );
       await promptSetAsDefault(type, provider.framework, provider.isDefault);
       return null;
     }
-    console.log(chalk52.dim("Aborted"));
+    console.log(chalk55.dim("Aborted"));
     process.exit(0);
   }
   if (checkResult.exists && checkResult.currentType === "model-provider") {
@@ -11849,7 +12169,7 @@ async function handleInteractiveMode() {
   }
   const config = MODEL_PROVIDER_TYPES[type];
   console.log();
-  console.log(chalk52.dim(config.helpText));
+  console.log(chalk55.dim(config.helpText));
   console.log();
   if (hasAuthMethods(type)) {
     const authMethod = await promptForAuthMethod(type);
@@ -11880,17 +12200,17 @@ async function handleInteractiveMode() {
 function handleSetupError2(error) {
   if (error instanceof Error) {
     if (error.message.includes("already exists")) {
-      console.error(chalk52.red(`\u2717 ${error.message}`));
+      console.error(chalk55.red(`\u2717 ${error.message}`));
       console.log();
       console.log("To convert the existing credential, run:");
-      console.log(chalk52.cyan("  vm0 model-provider setup --convert"));
+      console.log(chalk55.cyan("  vm0 model-provider setup --convert"));
     } else if (error.message.includes("Not authenticated")) {
-      console.error(chalk52.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      console.error(chalk55.red("\u2717 Not authenticated. Run: vm0 auth login"));
     } else {
-      console.error(chalk52.red(`\u2717 ${error.message}`));
+      console.error(chalk55.red(`\u2717 ${error.message}`));
     }
   } else {
-    console.error(chalk52.red("\u2717 An unexpected error occurred"));
+    console.error(chalk55.red("\u2717 An unexpected error occurred"));
   }
   process.exit(1);
 }
@@ -11907,13 +12227,13 @@ async function promptSetAsDefault(type, framework, isDefault) {
   );
   if (response.setDefault) {
     await setModelProviderDefault(type);
-    console.log(chalk52.green(`\u2713 Default for ${framework} set to "${type}"`));
+    console.log(chalk55.green(`\u2713 Default for ${framework} set to "${type}"`));
   }
 }
 function collectCredentials(value, previous) {
   return previous.concat([value]);
 }
-var setupCommand2 = new Command53().name("setup").description("Configure a model provider").option("-t, --type <type>", "Provider type (for non-interactive mode)").option(
+var setupCommand2 = new Command57().name("setup").description("Configure a model provider").option("-t, --type <type>", "Provider type (for non-interactive mode)").option(
   "-c, --credential <value>",
   "Credential value (can be used multiple times, supports VALUE or KEY=VALUE format)",
   collectCredentials,
@@ -11936,7 +12256,7 @@ var setupCommand2 = new Command53().name("setup").description("Configure a model
         });
       } else if (options.type || credentialArgs.length > 0) {
         console.error(
-          chalk52.red("\u2717 Both --type and --credential are required")
+          chalk55.red("\u2717 Both --type and --credential are required")
         );
         process.exit(1);
       } else {
@@ -11955,11 +12275,11 @@ var setupCommand2 = new Command53().name("setup").description("Configure a model
         const modelNote2 = provider2.selectedModel ? ` with model: ${provider2.selectedModel}` : "";
         if (!hasModelSelection(input.type)) {
           console.log(
-            chalk52.green(`\u2713 Model provider "${input.type}" unchanged`)
+            chalk55.green(`\u2713 Model provider "${input.type}" unchanged`)
           );
         } else {
           console.log(
-            chalk52.green(
+            chalk55.green(
               `\u2713 Model provider "${input.type}" updated${defaultNote2}${modelNote2}`
             )
           );
@@ -11985,7 +12305,7 @@ var setupCommand2 = new Command53().name("setup").description("Configure a model
       const defaultNote = provider.isDefault ? ` (default for ${provider.framework})` : "";
       const modelNote = provider.selectedModel ? ` with model: ${provider.selectedModel}` : "";
       console.log(
-        chalk52.green(
+        chalk55.green(
           `\u2713 Model provider "${input.type}" ${action}${defaultNote}${modelNote}`
         )
       );
@@ -12003,96 +12323,96 @@ var setupCommand2 = new Command53().name("setup").description("Configure a model
 );
 
 // src/commands/model-provider/delete.ts
-import { Command as Command54 } from "commander";
-import chalk53 from "chalk";
-var deleteCommand3 = new Command54().name("delete").description("Delete a model provider").argument("<type>", "Model provider type to delete").action(async (type) => {
+import { Command as Command58 } from "commander";
+import chalk56 from "chalk";
+var deleteCommand4 = new Command58().name("delete").description("Delete a model provider").argument("<type>", "Model provider type to delete").action(async (type) => {
   try {
     if (!Object.keys(MODEL_PROVIDER_TYPES).includes(type)) {
-      console.error(chalk53.red(`\u2717 Invalid type "${type}"`));
+      console.error(chalk56.red(`\u2717 Invalid type "${type}"`));
       console.log();
       console.log("Valid types:");
       for (const [t, config] of Object.entries(MODEL_PROVIDER_TYPES)) {
-        console.log(`  ${chalk53.cyan(t)} - ${config.label}`);
+        console.log(`  ${chalk56.cyan(t)} - ${config.label}`);
       }
       process.exit(1);
     }
     await deleteModelProvider(type);
-    console.log(chalk53.green(`\u2713 Model provider "${type}" deleted`));
+    console.log(chalk56.green(`\u2713 Model provider "${type}" deleted`));
   } catch (error) {
     if (error instanceof Error) {
       if (error.message.includes("not found")) {
-        console.error(chalk53.red(`\u2717 Model provider "${type}" not found`));
+        console.error(chalk56.red(`\u2717 Model provider "${type}" not found`));
       } else if (error.message.includes("Not authenticated")) {
-        console.error(chalk53.red("\u2717 Not authenticated. Run: vm0 auth login"));
+        console.error(chalk56.red("\u2717 Not authenticated. Run: vm0 auth login"));
       } else {
-        console.error(chalk53.red(`\u2717 ${error.message}`));
+        console.error(chalk56.red(`\u2717 ${error.message}`));
       }
     } else {
-      console.error(chalk53.red("\u2717 An unexpected error occurred"));
+      console.error(chalk56.red("\u2717 An unexpected error occurred"));
     }
     process.exit(1);
   }
 });
 
 // src/commands/model-provider/set-default.ts
-import { Command as Command55 } from "commander";
-import chalk54 from "chalk";
-var setDefaultCommand = new Command55().name("set-default").description("Set a model provider as default for its framework").argument("<type>", "Model provider type to set as default").action(async (type) => {
+import { Command as Command59 } from "commander";
+import chalk57 from "chalk";
+var setDefaultCommand = new Command59().name("set-default").description("Set a model provider as default for its framework").argument("<type>", "Model provider type to set as default").action(async (type) => {
   try {
     if (!Object.keys(MODEL_PROVIDER_TYPES).includes(type)) {
-      console.error(chalk54.red(`\u2717 Invalid type "${type}"`));
+      console.error(chalk57.red(`\u2717 Invalid type "${type}"`));
       console.log();
       console.log("Valid types:");
       for (const [t, config] of Object.entries(MODEL_PROVIDER_TYPES)) {
-        console.log(`  ${chalk54.cyan(t)} - ${config.label}`);
+        console.log(`  ${chalk57.cyan(t)} - ${config.label}`);
       }
       process.exit(1);
     }
     const provider = await setModelProviderDefault(type);
     console.log(
-      chalk54.green(
+      chalk57.green(
         `\u2713 Default for ${provider.framework} set to "${provider.type}"`
       )
     );
   } catch (error) {
     if (error instanceof Error) {
       if (error.message.includes("not found")) {
-        console.error(chalk54.red(`\u2717 Model provider "${type}" not found`));
+        console.error(chalk57.red(`\u2717 Model provider "${type}" not found`));
       } else if (error.message.includes("Not authenticated")) {
-        console.error(chalk54.red("\u2717 Not authenticated. Run: vm0 auth login"));
+        console.error(chalk57.red("\u2717 Not authenticated. Run: vm0 auth login"));
       } else {
-        console.error(chalk54.red(`\u2717 ${error.message}`));
+        console.error(chalk57.red(`\u2717 ${error.message}`));
       }
     } else {
-      console.error(chalk54.red("\u2717 An unexpected error occurred"));
+      console.error(chalk57.red("\u2717 An unexpected error occurred"));
     }
     process.exit(1);
   }
 });
 
 // src/commands/model-provider/index.ts
-var modelProviderCommand = new Command56().name("model-provider").description("Manage model providers for agent runs").addCommand(listCommand7).addCommand(setupCommand2).addCommand(deleteCommand3).addCommand(setDefaultCommand);
+var modelProviderCommand = new Command60().name("model-provider").description("Manage model providers for agent runs").addCommand(listCommand8).addCommand(setupCommand2).addCommand(deleteCommand4).addCommand(setDefaultCommand);
 
 // src/commands/onboard/index.ts
-import { Command as Command57 } from "commander";
-import chalk58 from "chalk";
+import { Command as Command61 } from "commander";
+import chalk61 from "chalk";
 import { mkdir as mkdir8 } from "fs/promises";
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 
 // src/lib/ui/welcome-box.ts
-import chalk55 from "chalk";
+import chalk58 from "chalk";
 var gradientColors = [
-  chalk55.hex("#FFAB5E"),
+  chalk58.hex("#FFAB5E"),
   // Line 1 - lightest
-  chalk55.hex("#FF9642"),
+  chalk58.hex("#FF9642"),
   // Line 2
-  chalk55.hex("#FF8228"),
+  chalk58.hex("#FF8228"),
   // Line 3
-  chalk55.hex("#FF6D0A"),
+  chalk58.hex("#FF6D0A"),
   // Line 4
-  chalk55.hex("#E85D00"),
+  chalk58.hex("#E85D00"),
   // Line 5
-  chalk55.hex("#CC4E00")
+  chalk58.hex("#CC4E00")
   // Line 6 - darkest
 ];
 var vm0LogoLines = [
@@ -12114,15 +12434,15 @@ function renderVm0Banner() {
 function renderOnboardWelcome() {
   renderVm0Banner();
   console.log(`  Build agentic workflows using natural language.`);
-  console.log(`  ${chalk55.dim("Currently in beta, enjoy it free.")}`);
+  console.log(`  ${chalk58.dim("Currently in beta, enjoy it free.")}`);
   console.log(
-    `  ${chalk55.dim("Star us on GitHub: https://github.com/vm0-ai/vm0")}`
+    `  ${chalk58.dim("Star us on GitHub: https://github.com/vm0-ai/vm0")}`
   );
   console.log();
 }
 
 // src/lib/ui/step-runner.ts
-import chalk56 from "chalk";
+import chalk59 from "chalk";
 function createStepRunner(options = true) {
   const opts = typeof options === "boolean" ? { interactive: options } : options;
   const interactive = opts.interactive ?? true;
@@ -12137,25 +12457,25 @@ function createStepRunner(options = true) {
     }
     for (const [i, step] of completedSteps.entries()) {
       if (step.failed) {
-        console.log(chalk56.red(`\u2717 ${step.label}`));
+        console.log(chalk59.red(`\u2717 ${step.label}`));
       } else {
-        console.log(chalk56.green(`\u25CF ${step.label}`));
+        console.log(chalk59.green(`\u25CF ${step.label}`));
       }
       const isLastStep = i === completedSteps.length - 1;
       if (!isLastStep || !isFinal) {
-        console.log(chalk56.dim("\u2502"));
+        console.log(chalk59.dim("\u2502"));
       }
     }
   }
   async function executeStep(label, fn, isFinal) {
     let stepFailed = false;
-    console.log(chalk56.yellow(`\u25CB ${label}`));
+    console.log(chalk59.yellow(`\u25CB ${label}`));
     const ctx = {
       connector() {
-        console.log(chalk56.dim("\u2502"));
+        console.log(chalk59.dim("\u2502"));
       },
       detail(message) {
-        console.log(`${chalk56.dim("\u2502")} ${message}`);
+        console.log(`${chalk59.dim("\u2502")} ${message}`);
       },
       async prompt(promptFn) {
         return await promptFn();
@@ -12172,12 +12492,12 @@ function createStepRunner(options = true) {
         redrawCompletedSteps(isFinal);
       } else {
         if (stepFailed) {
-          console.log(chalk56.red(`\u2717 ${label}`));
+          console.log(chalk59.red(`\u2717 ${label}`));
         } else {
-          console.log(chalk56.green(`\u25CF ${label}`));
+          console.log(chalk59.green(`\u25CF ${label}`));
         }
         if (!isFinal) {
-          console.log(chalk56.dim("\u2502"));
+          console.log(chalk59.dim("\u2502"));
         }
       }
     }
@@ -12335,7 +12655,7 @@ async function setupModelProvider(type, credential, options) {
 
 // src/lib/domain/onboard/claude-setup.ts
 import { spawn as spawn3 } from "child_process";
-import chalk57 from "chalk";
+import chalk60 from "chalk";
 var MARKETPLACE_NAME = "vm0-skills";
 var MARKETPLACE_REPO = "vm0-ai/vm0-skills";
 var PLUGIN_ID = "vm0@vm0-skills";
@@ -12372,12 +12692,12 @@ async function runClaudeCommand(args, cwd) {
 }
 function handlePluginError(error, context) {
   const displayContext = context ?? "Claude plugin";
-  console.error(chalk57.red(`Failed to install ${displayContext}`));
+  console.error(chalk60.red(`Failed to install ${displayContext}`));
   if (error instanceof Error) {
-    console.error(chalk57.red(error.message));
+    console.error(chalk60.red(error.message));
   }
   console.error(
-    chalk57.dim("Please ensure Claude CLI is installed and accessible.")
+    chalk60.dim("Please ensure Claude CLI is installed and accessible.")
   );
   process.exit(1);
 }
@@ -12420,7 +12740,7 @@ async function updateMarketplace() {
   ]);
   if (!result.success) {
     console.warn(
-      chalk57.yellow(
+      chalk60.yellow(
         `Warning: Could not update marketplace: ${result.error ?? "unknown error"}`
       )
     );
@@ -12458,7 +12778,7 @@ async function handleAuthentication(ctx) {
       return;
     }
     if (!ctx.interactive) {
-      console.error(chalk58.red("Error: Not authenticated"));
+      console.error(chalk61.red("Error: Not authenticated"));
       console.error("Run 'vm0 auth login' first or set VM0_TOKEN");
       process.exit(1);
     }
@@ -12466,16 +12786,16 @@ async function handleAuthentication(ctx) {
       onInitiating: () => {
       },
       onDeviceCodeReady: (url, code, expiresIn) => {
-        step.detail(`Copy code: ${chalk58.cyan.bold(code)}`);
-        step.detail(`Open: ${chalk58.cyan(url)}`);
-        step.detail(chalk58.dim(`Expires in ${expiresIn} minutes`));
+        step.detail(`Copy code: ${chalk61.cyan.bold(code)}`);
+        step.detail(`Open: ${chalk61.cyan(url)}`);
+        step.detail(chalk61.dim(`Expires in ${expiresIn} minutes`));
       },
       onPolling: () => {
       },
       onSuccess: () => {
       },
       onError: (error) => {
-        console.error(chalk58.red(`
+        console.error(chalk61.red(`
 ${error.message}`));
         process.exit(1);
       }
@@ -12489,7 +12809,7 @@ async function handleModelProvider(ctx) {
       return;
     }
     if (!ctx.interactive) {
-      console.error(chalk58.red("Error: No model provider configured"));
+      console.error(chalk61.red("Error: No model provider configured"));
       console.error("Run 'vm0 model-provider setup' first");
       process.exit(1);
     }
@@ -12498,19 +12818,19 @@ async function handleModelProvider(ctx) {
     const providerType = await step.prompt(
       () => promptSelect(
         "Select provider type:",
-        choices.map((c22) => ({
-          title: c22.label,
-          value: c22.type
+        choices.map((c23) => ({
+          title: c23.label,
+          value: c23.type
         }))
       )
     );
     if (!providerType) {
       process.exit(0);
     }
-    const selectedChoice = choices.find((c22) => c22.type === providerType);
+    const selectedChoice = choices.find((c23) => c23.type === providerType);
     if (selectedChoice?.helpText) {
       for (const line of selectedChoice.helpText.split("\n")) {
-        step.detail(chalk58.dim(line));
+        step.detail(chalk61.dim(line));
       }
     }
     const credential = await step.prompt(
@@ -12519,7 +12839,7 @@ async function handleModelProvider(ctx) {
       )
     );
     if (!credential) {
-      console.log(chalk58.dim("Cancelled"));
+      console.log(chalk61.dim("Cancelled"));
       process.exit(0);
     }
     let selectedModel;
@@ -12538,7 +12858,7 @@ async function handleModelProvider(ctx) {
         () => promptSelect("Select model:", modelChoices)
       );
       if (modelSelection === void 0) {
-        console.log(chalk58.dim("Cancelled"));
+        console.log(chalk61.dim("Cancelled"));
         process.exit(0);
       }
       selectedModel = modelSelection === "" ? void 0 : modelSelection;
@@ -12548,7 +12868,7 @@ async function handleModelProvider(ctx) {
     });
     const modelNote = result.provider.selectedModel ? ` with model: ${result.provider.selectedModel}` : "";
     step.detail(
-      chalk58.green(
+      chalk61.green(
         `${providerType} ${result.created ? "created" : "updated"}${result.isDefault ? ` (default for ${result.framework})` : ""}${modelNote}`
       )
     );
@@ -12577,9 +12897,9 @@ async function handleAgentCreation(ctx) {
           process.exit(0);
         }
         agentName = inputName;
-        if (existsSync12(agentName)) {
+        if (existsSync11(agentName)) {
           step.detail(
-            chalk58.yellow(`${agentName}/ already exists, choose another name`)
+            chalk61.yellow(`${agentName}/ already exists, choose another name`)
           );
         } else {
           folderExists = false;
@@ -12588,22 +12908,22 @@ async function handleAgentCreation(ctx) {
     } else {
       if (!validateAgentName(agentName)) {
         console.error(
-          chalk58.red(
+          chalk61.red(
             "Invalid agent name: must be 3-64 chars, alphanumeric + hyphens"
           )
         );
         process.exit(1);
       }
-      if (existsSync12(agentName)) {
-        console.error(chalk58.red(`${agentName}/ already exists`));
+      if (existsSync11(agentName)) {
+        console.error(chalk61.red(`${agentName}/ already exists`));
         console.log();
         console.log("Remove it first or choose a different name:");
-        console.log(chalk58.cyan(`  rm -rf ${agentName}`));
+        console.log(chalk61.cyan(`  rm -rf ${agentName}`));
         process.exit(1);
       }
     }
     await mkdir8(agentName, { recursive: true });
-    step.detail(chalk58.green(`Created ${agentName}/`));
+    step.detail(chalk61.green(`Created ${agentName}/`));
   });
   return agentName;
 }
@@ -12619,7 +12939,7 @@ async function handlePluginInstallation(ctx, agentName) {
       shouldInstall = confirmed ?? true;
     }
     if (!shouldInstall) {
-      step.detail(chalk58.dim("Skipped"));
+      step.detail(chalk61.dim("Skipped"));
       return;
     }
     const scope = "project";
@@ -12627,7 +12947,7 @@ async function handlePluginInstallation(ctx, agentName) {
       const agentDir = `${process.cwd()}/${agentName}`;
       const result = await installVm0Plugin(scope, agentDir);
       step.detail(
-        chalk58.green(`Installed ${result.pluginId} (scope: ${result.scope})`)
+        chalk61.green(`Installed ${result.pluginId} (scope: ${result.scope})`)
       );
       pluginInstalled = true;
     } catch (error) {
@@ -12638,18 +12958,18 @@ async function handlePluginInstallation(ctx, agentName) {
 }
 function printNextSteps(agentName, pluginInstalled) {
   console.log();
-  console.log(chalk58.bold("Next step:"));
+  console.log(chalk61.bold("Next step:"));
   console.log();
   if (pluginInstalled) {
     console.log(
-      `  ${chalk58.cyan(`cd ${agentName} && claude "/${PRIMARY_SKILL_NAME} let's build an agent"`)}`
+      `  ${chalk61.cyan(`cd ${agentName} && claude "/${PRIMARY_SKILL_NAME} let's build an agent"`)}`
     );
   } else {
-    console.log(`  ${chalk58.cyan(`cd ${agentName} && vm0 init`)}`);
+    console.log(`  ${chalk61.cyan(`cd ${agentName} && vm0 init`)}`);
   }
   console.log();
 }
-var onboardCommand = new Command57().name("onboard").description("Guided setup for new VM0 users").option("-y, --yes", "Skip confirmation prompts").option("--name <name>", `Agent name (default: ${DEFAULT_AGENT_NAME})`).action(async (options) => {
+var onboardCommand = new Command61().name("onboard").description("Guided setup for new VM0 users").option("-y, --yes", "Skip confirmation prompts").option("--name <name>", `Agent name (default: ${DEFAULT_AGENT_NAME})`).action(async (options) => {
   const interactive = isInteractive();
   if (interactive) {
     process.stdout.write("\x1B[2J\x1B[H");
@@ -12672,15 +12992,15 @@ var onboardCommand = new Command57().name("onboard").description("Guided setup f
 });
 
 // src/commands/setup-claude/index.ts
-import { Command as Command58 } from "commander";
-import chalk59 from "chalk";
-var setupClaudeCommand = new Command58().name("setup-claude").description("Install VM0 Claude Plugin").option("--agent-dir <dir>", "Agent directory to run install in").option("--scope <scope>", "Installation scope (user or project)", "project").action(async (options) => {
-  console.log(chalk59.dim("Installing VM0 Claude Plugin..."));
+import { Command as Command62 } from "commander";
+import chalk62 from "chalk";
+var setupClaudeCommand = new Command62().name("setup-claude").description("Install VM0 Claude Plugin").option("--agent-dir <dir>", "Agent directory to run install in").option("--scope <scope>", "Installation scope (user or project)", "project").action(async (options) => {
+  console.log(chalk62.dim("Installing VM0 Claude Plugin..."));
   const scope = options.scope === "user" ? "user" : "project";
   try {
     const result = await installVm0Plugin(scope, options.agentDir);
     console.log(
-      chalk59.green(`\u2713 Installed ${result.pluginId} (scope: ${result.scope})`)
+      chalk62.green(`\u2713 Installed ${result.pluginId} (scope: ${result.scope})`)
     );
   } catch (error) {
     handlePluginError(error);
@@ -12689,15 +13009,15 @@ var setupClaudeCommand = new Command58().name("setup-claude").description("Insta
   console.log("Next step:");
   const cdPrefix = options.agentDir ? `cd ${options.agentDir} && ` : "";
   console.log(
-    chalk59.cyan(
+    chalk62.cyan(
       `  ${cdPrefix}claude "/${PRIMARY_SKILL_NAME} let's build a workflow"`
     )
   );
 });
 
 // src/index.ts
-var program = new Command59();
-program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.17.1");
+var program = new Command63();
+program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.18.0");
 program.addCommand(authCommand);
 program.addCommand(infoCommand);
 program.addCommand(composeCommand);
@@ -12711,7 +13031,8 @@ program.addCommand(agentCommand);
 program.addCommand(initCommand3);
 program.addCommand(scheduleCommand);
 program.addCommand(usageCommand);
-program.addCommand(credentialCommand);
+program.addCommand(secretCommand);
+program.addCommand(variableCommand);
 program.addCommand(modelProviderCommand);
 program.addCommand(onboardCommand);
 program.addCommand(setupClaudeCommand);