@vm0/cli 9.17.2 → 9.18.0

package/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command59 } from "commander";
+import { Command as Command63 } from "commander";
 
 // src/commands/auth/index.ts
 import { Command as Command5 } from "commander";
@@ -1987,9 +1987,108 @@ var secretsByNameContract = c11.router({
   }
 });
 
-// ../../packages/core/src/contracts/model-providers.ts
+// ../../packages/core/src/contracts/variables.ts
 import { z as z15 } from "zod";
 var c12 = initContract();
+var variableNameSchema = z15.string().min(1, "Variable name is required").max(255, "Variable name must be at most 255 characters").regex(
+  /^[A-Z][A-Z0-9_]*$/,
+  "Variable name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_VAR)"
+);
+var variableResponseSchema = z15.object({
+  id: z15.string().uuid(),
+  name: z15.string(),
+  value: z15.string(),
+  description: z15.string().nullable(),
+  createdAt: z15.string(),
+  updatedAt: z15.string()
+});
+var variableListResponseSchema = z15.object({
+  variables: z15.array(variableResponseSchema)
+});
+var setVariableRequestSchema = z15.object({
+  name: variableNameSchema,
+  value: z15.string().min(1, "Variable value is required"),
+  description: z15.string().max(1e3).optional()
+});
+var variablesMainContract = c12.router({
+  /**
+   * GET /api/variables
+   * List all variables for the current user's scope (includes values)
+   */
+  list: {
+    method: "GET",
+    path: "/api/variables",
+    headers: authHeadersSchema,
+    responses: {
+      200: variableListResponseSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List all variables (includes values)"
+  },
+  /**
+   * PUT /api/variables
+   * Create or update a variable
+   */
+  set: {
+    method: "PUT",
+    path: "/api/variables",
+    headers: authHeadersSchema,
+    body: setVariableRequestSchema,
+    responses: {
+      200: variableResponseSchema,
+      201: variableResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Create or update a variable"
+  }
+});
+var variablesByNameContract = c12.router({
+  /**
+   * GET /api/variables/:name
+   * Get a variable by name (includes value)
+   */
+  get: {
+    method: "GET",
+    path: "/api/variables/:name",
+    headers: authHeadersSchema,
+    pathParams: z15.object({
+      name: variableNameSchema
+    }),
+    responses: {
+      200: variableResponseSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get variable by name"
+  },
+  /**
+   * DELETE /api/variables/:name
+   * Delete a variable by name
+   */
+  delete: {
+    method: "DELETE",
+    path: "/api/variables/:name",
+    headers: authHeadersSchema,
+    pathParams: z15.object({
+      name: variableNameSchema
+    }),
+    responses: {
+      204: c12.noBody(),
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Delete a variable"
+  }
+});
+
+// ../../packages/core/src/contracts/model-providers.ts
+import { z as z16 } from "zod";
+var c13 = initContract();
 var MODEL_PROVIDER_TYPES = {
   "claude-code-oauth-token": {
     framework: "claude-code",
@@ -2210,7 +2309,7 @@ var MODEL_PROVIDER_TYPES = {
     customModelPlaceholder: "anthropic.claude-sonnet-4-20250514-v1:0"
   }
 };
-var modelProviderTypeSchema = z15.enum([
+var modelProviderTypeSchema = z16.enum([
   "claude-code-oauth-token",
   "anthropic-api-key",
   "openrouter-api-key",
@@ -2221,7 +2320,7 @@ var modelProviderTypeSchema = z15.enum([
   "azure-foundry",
   "aws-bedrock"
 ]);
-var modelProviderFrameworkSchema = z15.enum(["claude-code", "codex"]);
+var modelProviderFrameworkSchema = z16.enum(["claude-code", "codex"]);
 function hasAuthMethods(type) {
   const config = MODEL_PROVIDER_TYPES[type];
   return "authMethods" in config;
@@ -2262,45 +2361,45 @@ function getCustomModelPlaceholder(type) {
   const config = MODEL_PROVIDER_TYPES[type];
   return "customModelPlaceholder" in config ? config.customModelPlaceholder : void 0;
 }
-var modelProviderResponseSchema = z15.object({
-  id: z15.string().uuid(),
+var modelProviderResponseSchema = z16.object({
+  id: z16.string().uuid(),
   type: modelProviderTypeSchema,
   framework: modelProviderFrameworkSchema,
-  credentialName: z15.string().nullable(),
+  credentialName: z16.string().nullable(),
   // Legacy single-credential (deprecated for multi-auth)
-  authMethod: z15.string().nullable(),
+  authMethod: z16.string().nullable(),
   // For multi-auth providers
-  credentialNames: z15.array(z15.string()).nullable(),
+  credentialNames: z16.array(z16.string()).nullable(),
   // For multi-auth providers
-  isDefault: z15.boolean(),
-  selectedModel: z15.string().nullable(),
-  createdAt: z15.string(),
-  updatedAt: z15.string()
+  isDefault: z16.boolean(),
+  selectedModel: z16.string().nullable(),
+  createdAt: z16.string(),
+  updatedAt: z16.string()
 });
-var modelProviderListResponseSchema = z15.object({
-  modelProviders: z15.array(modelProviderResponseSchema)
+var modelProviderListResponseSchema = z16.object({
+  modelProviders: z16.array(modelProviderResponseSchema)
 });
-var upsertModelProviderRequestSchema = z15.object({
+var upsertModelProviderRequestSchema = z16.object({
   type: modelProviderTypeSchema,
-  credential: z15.string().min(1).optional(),
+  credential: z16.string().min(1).optional(),
   // Legacy single credential
-  authMethod: z15.string().optional(),
+  authMethod: z16.string().optional(),
   // For multi-auth providers
-  credentials: z15.record(z15.string(), z15.string()).optional(),
+  credentials: z16.record(z16.string(), z16.string()).optional(),
   // For multi-auth providers
-  convert: z15.boolean().optional(),
-  selectedModel: z15.string().optional()
+  convert: z16.boolean().optional(),
+  selectedModel: z16.string().optional()
 });
-var upsertModelProviderResponseSchema = z15.object({
+var upsertModelProviderResponseSchema = z16.object({
   provider: modelProviderResponseSchema,
-  created: z15.boolean()
+  created: z16.boolean()
 });
-var checkCredentialResponseSchema = z15.object({
-  exists: z15.boolean(),
-  credentialName: z15.string(),
-  currentType: z15.enum(["user", "model-provider"]).optional()
+var checkCredentialResponseSchema = z16.object({
+  exists: z16.boolean(),
+  credentialName: z16.string(),
+  currentType: z16.enum(["user", "model-provider"]).optional()
 });
-var modelProvidersMainContract = c12.router({
+var modelProvidersMainContract = c13.router({
   list: {
     method: "GET",
     path: "/api/model-providers",
@@ -2328,12 +2427,12 @@ var modelProvidersMainContract = c12.router({
     summary: "Create or update a model provider"
   }
 });
-var modelProvidersCheckContract = c12.router({
+var modelProvidersCheckContract = c13.router({
   check: {
     method: "GET",
     path: "/api/model-providers/check/:type",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
     responses: {
@@ -2344,16 +2443,16 @@ var modelProvidersCheckContract = c12.router({
     summary: "Check if credential exists for a model provider type"
   }
 });
-var modelProvidersByTypeContract = c12.router({
+var modelProvidersByTypeContract = c13.router({
   delete: {
     method: "DELETE",
     path: "/api/model-providers/:type",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c12.noBody(),
+      204: c13.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -2361,15 +2460,15 @@ var modelProvidersByTypeContract = c12.router({
     summary: "Delete a model provider"
   }
 });
-var modelProvidersConvertContract = c12.router({
+var modelProvidersConvertContract = c13.router({
   convert: {
     method: "POST",
     path: "/api/model-providers/:type/convert",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
-    body: z15.undefined(),
+    body: z16.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       400: apiErrorSchema,
@@ -2380,15 +2479,15 @@ var modelProvidersConvertContract = c12.router({
     summary: "Convert existing user credential to model provider"
   }
 });
-var modelProvidersSetDefaultContract = c12.router({
+var modelProvidersSetDefaultContract = c13.router({
   setDefault: {
     method: "POST",
     path: "/api/model-providers/:type/set-default",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
-    body: z15.undefined(),
+    body: z16.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       401: apiErrorSchema,
@@ -2398,15 +2497,15 @@ var modelProvidersSetDefaultContract = c12.router({
     summary: "Set a model provider as default for its framework"
   }
 });
-var updateModelRequestSchema = z15.object({
-  selectedModel: z15.string().optional()
+var updateModelRequestSchema = z16.object({
+  selectedModel: z16.string().optional()
 });
-var modelProvidersUpdateModelContract = c12.router({
+var modelProvidersUpdateModelContract = c13.router({
   updateModel: {
     method: "PATCH",
     path: "/api/model-providers/:type/model",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       type: modelProviderTypeSchema
     }),
     body: updateModelRequestSchema,
@@ -2421,42 +2520,42 @@ var modelProvidersUpdateModelContract = c12.router({
 });
 
 // ../../packages/core/src/contracts/sessions.ts
-import { z as z16 } from "zod";
-var c13 = initContract();
-var sessionResponseSchema = z16.object({
-  id: z16.string(),
-  agentComposeId: z16.string(),
-  agentComposeVersionId: z16.string().nullable(),
-  conversationId: z16.string().nullable(),
-  artifactName: z16.string().nullable(),
-  vars: z16.record(z16.string(), z16.string()).nullable(),
-  secretNames: z16.array(z16.string()).nullable(),
-  volumeVersions: z16.record(z16.string(), z16.string()).nullable(),
-  createdAt: z16.string(),
-  updatedAt: z16.string()
+import { z as z17 } from "zod";
+var c14 = initContract();
+var sessionResponseSchema = z17.object({
+  id: z17.string(),
+  agentComposeId: z17.string(),
+  agentComposeVersionId: z17.string().nullable(),
+  conversationId: z17.string().nullable(),
+  artifactName: z17.string().nullable(),
+  vars: z17.record(z17.string(), z17.string()).nullable(),
+  secretNames: z17.array(z17.string()).nullable(),
+  volumeVersions: z17.record(z17.string(), z17.string()).nullable(),
+  createdAt: z17.string(),
+  updatedAt: z17.string()
 });
-var agentComposeSnapshotSchema = z16.object({
-  agentComposeVersionId: z16.string(),
-  vars: z16.record(z16.string(), z16.string()).optional(),
-  secretNames: z16.array(z16.string()).optional()
+var agentComposeSnapshotSchema = z17.object({
+  agentComposeVersionId: z17.string(),
+  vars: z17.record(z17.string(), z17.string()).optional(),
+  secretNames: z17.array(z17.string()).optional()
 });
-var artifactSnapshotSchema2 = z16.object({
-  artifactName: z16.string(),
-  artifactVersion: z16.string()
+var artifactSnapshotSchema2 = z17.object({
+  artifactName: z17.string(),
+  artifactVersion: z17.string()
 });
-var volumeVersionsSnapshotSchema2 = z16.object({
-  versions: z16.record(z16.string(), z16.string())
+var volumeVersionsSnapshotSchema2 = z17.object({
+  versions: z17.record(z17.string(), z17.string())
 });
-var checkpointResponseSchema = z16.object({
-  id: z16.string(),
-  runId: z16.string(),
-  conversationId: z16.string(),
+var checkpointResponseSchema = z17.object({
+  id: z17.string(),
+  runId: z17.string(),
+  conversationId: z17.string(),
   agentComposeSnapshot: agentComposeSnapshotSchema,
   artifactSnapshot: artifactSnapshotSchema2.nullable(),
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
-  createdAt: z16.string()
+  createdAt: z17.string()
 });
-var sessionsByIdContract = c13.router({
+var sessionsByIdContract = c14.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -2465,8 +2564,8 @@ var sessionsByIdContract = c13.router({
     method: "GET",
     path: "/api/agent/sessions/:id",
     headers: authHeadersSchema,
-    pathParams: z16.object({
-      id: z16.string().min(1, "Session ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Session ID is required")
     }),
     responses: {
       200: sessionResponseSchema,
@@ -2477,7 +2576,7 @@ var sessionsByIdContract = c13.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c13.router({
+var checkpointsByIdContract = c14.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -2486,8 +2585,8 @@ var checkpointsByIdContract = c13.router({
     method: "GET",
     path: "/api/agent/checkpoints/:id",
     headers: authHeadersSchema,
-    pathParams: z16.object({
-      id: z16.string().min(1, "Checkpoint ID is required")
+    pathParams: z17.object({
+      id: z17.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
       200: checkpointResponseSchema,
@@ -2500,93 +2599,93 @@ var checkpointsByIdContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/schedules.ts
-import { z as z17 } from "zod";
-var c14 = initContract();
-var scheduleTriggerSchema = z17.object({
-  cron: z17.string().optional(),
-  at: z17.string().optional(),
-  timezone: z17.string().default("UTC")
+import { z as z18 } from "zod";
+var c15 = initContract();
+var scheduleTriggerSchema = z18.object({
+  cron: z18.string().optional(),
+  at: z18.string().optional(),
+  timezone: z18.string().default("UTC")
 }).refine((data) => data.cron && !data.at || !data.cron && data.at, {
   message: "Exactly one of 'cron' or 'at' must be specified"
 });
-var scheduleRunConfigSchema = z17.object({
-  agent: z17.string().min(1, "Agent reference required"),
-  prompt: z17.string().min(1, "Prompt required"),
-  vars: z17.record(z17.string(), z17.string()).optional(),
-  secrets: z17.record(z17.string(), z17.string()).optional(),
-  artifactName: z17.string().optional(),
-  artifactVersion: z17.string().optional(),
-  volumeVersions: z17.record(z17.string(), z17.string()).optional()
+var scheduleRunConfigSchema = z18.object({
+  agent: z18.string().min(1, "Agent reference required"),
+  prompt: z18.string().min(1, "Prompt required"),
+  vars: z18.record(z18.string(), z18.string()).optional(),
+  secrets: z18.record(z18.string(), z18.string()).optional(),
+  artifactName: z18.string().optional(),
+  artifactVersion: z18.string().optional(),
+  volumeVersions: z18.record(z18.string(), z18.string()).optional()
 });
-var scheduleDefinitionSchema = z17.object({
+var scheduleDefinitionSchema = z18.object({
   on: scheduleTriggerSchema,
   run: scheduleRunConfigSchema
 });
-var scheduleYamlSchema = z17.object({
-  version: z17.literal("1.0"),
-  schedules: z17.record(z17.string(), scheduleDefinitionSchema)
-});
-var deployScheduleRequestSchema = z17.object({
-  name: z17.string().min(1).max(64, "Schedule name max 64 chars"),
-  cronExpression: z17.string().optional(),
-  atTime: z17.string().optional(),
-  timezone: z17.string().default("UTC"),
-  prompt: z17.string().min(1, "Prompt required"),
-  vars: z17.record(z17.string(), z17.string()).optional(),
-  secrets: z17.record(z17.string(), z17.string()).optional(),
-  artifactName: z17.string().optional(),
-  artifactVersion: z17.string().optional(),
-  volumeVersions: z17.record(z17.string(), z17.string()).optional(),
+var scheduleYamlSchema = z18.object({
+  version: z18.literal("1.0"),
+  schedules: z18.record(z18.string(), scheduleDefinitionSchema)
+});
+var deployScheduleRequestSchema = z18.object({
+  name: z18.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z18.string().optional(),
+  atTime: z18.string().optional(),
+  timezone: z18.string().default("UTC"),
+  prompt: z18.string().min(1, "Prompt required"),
+  vars: z18.record(z18.string(), z18.string()).optional(),
+  secrets: z18.record(z18.string(), z18.string()).optional(),
+  artifactName: z18.string().optional(),
+  artifactVersion: z18.string().optional(),
+  volumeVersions: z18.record(z18.string(), z18.string()).optional(),
   // Resolved agent compose ID (CLI resolves scope/name:version → composeId)
-  composeId: z17.string().uuid("Invalid compose ID")
+  composeId: z18.string().uuid("Invalid compose ID")
 }).refine(
   (data) => data.cronExpression && !data.atTime || !data.cronExpression && data.atTime,
   {
     message: "Exactly one of 'cronExpression' or 'atTime' must be specified"
   }
 );
-var scheduleResponseSchema = z17.object({
-  id: z17.string().uuid(),
-  composeId: z17.string().uuid(),
-  composeName: z17.string(),
-  scopeSlug: z17.string(),
-  name: z17.string(),
-  cronExpression: z17.string().nullable(),
-  atTime: z17.string().nullable(),
-  timezone: z17.string(),
-  prompt: z17.string(),
-  vars: z17.record(z17.string(), z17.string()).nullable(),
+var scheduleResponseSchema = z18.object({
+  id: z18.string().uuid(),
+  composeId: z18.string().uuid(),
+  composeName: z18.string(),
+  scopeSlug: z18.string(),
+  name: z18.string(),
+  cronExpression: z18.string().nullable(),
+  atTime: z18.string().nullable(),
+  timezone: z18.string(),
+  prompt: z18.string(),
+  vars: z18.record(z18.string(), z18.string()).nullable(),
   // Secret names only (values are never returned)
-  secretNames: z17.array(z17.string()).nullable(),
-  artifactName: z17.string().nullable(),
-  artifactVersion: z17.string().nullable(),
-  volumeVersions: z17.record(z17.string(), z17.string()).nullable(),
-  enabled: z17.boolean(),
-  nextRunAt: z17.string().nullable(),
-  lastRunAt: z17.string().nullable(),
-  retryStartedAt: z17.string().nullable(),
-  createdAt: z17.string(),
-  updatedAt: z17.string()
-});
-var runSummarySchema = z17.object({
-  id: z17.string().uuid(),
-  status: z17.enum(["pending", "running", "completed", "failed", "timeout"]),
-  createdAt: z17.string(),
-  completedAt: z17.string().nullable(),
-  error: z17.string().nullable()
-});
-var scheduleRunsResponseSchema = z17.object({
-  runs: z17.array(runSummarySchema)
-});
-var scheduleListResponseSchema = z17.object({
-  schedules: z17.array(scheduleResponseSchema)
-});
-var deployScheduleResponseSchema = z17.object({
+  secretNames: z18.array(z18.string()).nullable(),
+  artifactName: z18.string().nullable(),
+  artifactVersion: z18.string().nullable(),
+  volumeVersions: z18.record(z18.string(), z18.string()).nullable(),
+  enabled: z18.boolean(),
+  nextRunAt: z18.string().nullable(),
+  lastRunAt: z18.string().nullable(),
+  retryStartedAt: z18.string().nullable(),
+  createdAt: z18.string(),
+  updatedAt: z18.string()
+});
+var runSummarySchema = z18.object({
+  id: z18.string().uuid(),
+  status: z18.enum(["pending", "running", "completed", "failed", "timeout"]),
+  createdAt: z18.string(),
+  completedAt: z18.string().nullable(),
+  error: z18.string().nullable()
+});
+var scheduleRunsResponseSchema = z18.object({
+  runs: z18.array(runSummarySchema)
+});
+var scheduleListResponseSchema = z18.object({
+  schedules: z18.array(scheduleResponseSchema)
+});
+var deployScheduleResponseSchema = z18.object({
   schedule: scheduleResponseSchema,
-  created: z17.boolean()
+  created: z18.boolean()
   // true if created, false if updated
 });
-var schedulesMainContract = c14.router({
+var schedulesMainContract = c15.router({
   /**
    * POST /api/agent/schedules
    * Deploy (create or update) a schedule
@@ -2624,7 +2723,7 @@ var schedulesMainContract = c14.router({
     summary: "List all schedules"
   }
 });
-var schedulesByNameContract = c14.router({
+var schedulesByNameContract = c15.router({
   /**
    * GET /api/agent/schedules/:name
    * Get schedule by name
@@ -2633,11 +2732,11 @@ var schedulesByNameContract = c14.router({
     method: "GET",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    query: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    query: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -2654,21 +2753,21 @@ var schedulesByNameContract = c14.router({
     method: "DELETE",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    query: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    query: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
-      204: c14.noBody(),
+      204: c15.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete schedule"
   }
 });
-var schedulesEnableContract = c14.router({
+var schedulesEnableContract = c15.router({
   /**
    * POST /api/agent/schedules/:name/enable
    * Enable a disabled schedule
@@ -2677,11 +2776,11 @@ var schedulesEnableContract = c14.router({
     method: "POST",
     path: "/api/agent/schedules/:name/enable",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    body: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    body: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -2698,11 +2797,11 @@ var schedulesEnableContract = c14.router({
     method: "POST",
     path: "/api/agent/schedules/:name/disable",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    body: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    body: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -2712,7 +2811,7 @@ var schedulesEnableContract = c14.router({
     summary: "Disable schedule"
   }
 });
-var scheduleRunsContract = c14.router({
+var scheduleRunsContract = c15.router({
   /**
    * GET /api/agent/schedules/:name/runs
    * List recent runs for a schedule
@@ -2721,12 +2820,12 @@ var scheduleRunsContract = c14.router({
     method: "GET",
     path: "/api/agent/schedules/:name/runs",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    query: z17.object({
-      composeId: z17.string().uuid("Compose ID required"),
-      limit: z17.coerce.number().min(0).max(100).default(5)
+    query: z18.object({
+      composeId: z18.string().uuid("Compose ID required"),
+      limit: z18.coerce.number().min(0).max(100).default(5)
     }),
     responses: {
       200: scheduleRunsResponseSchema,
@@ -2738,18 +2837,18 @@ var scheduleRunsContract = c14.router({
 });
 
 // ../../packages/core/src/contracts/realtime.ts
-import { z as z18 } from "zod";
-var c15 = initContract();
-var ablyTokenRequestSchema = z18.object({
-  keyName: z18.string(),
-  ttl: z18.number().optional(),
-  timestamp: z18.number(),
-  capability: z18.string(),
-  clientId: z18.string().optional(),
-  nonce: z18.string(),
-  mac: z18.string()
-});
-var realtimeTokenContract = c15.router({
+import { z as z19 } from "zod";
+var c16 = initContract();
+var ablyTokenRequestSchema = z19.object({
+  keyName: z19.string(),
+  ttl: z19.number().optional(),
+  timestamp: z19.number(),
+  capability: z19.string(),
+  clientId: z19.string().optional(),
+  nonce: z19.string(),
+  mac: z19.string()
+});
+var realtimeTokenContract = c16.router({
   /**
    * POST /api/realtime/token
    * Get an Ably token to subscribe to a run's events channel
@@ -2758,8 +2857,8 @@ var realtimeTokenContract = c15.router({
     method: "POST",
     path: "/api/realtime/token",
     headers: authHeadersSchema,
-    body: z18.object({
-      runId: z18.string().uuid("runId must be a valid UUID")
+    body: z19.object({
+      runId: z19.string().uuid("runId must be a valid UUID")
     }),
     responses: {
       200: ablyTokenRequestSchema,
@@ -2771,7 +2870,7 @@ var realtimeTokenContract = c15.router({
     summary: "Get Ably token for run event subscription"
   }
 });
-var runnerRealtimeTokenContract = c15.router({
+var runnerRealtimeTokenContract = c16.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -2780,7 +2879,7 @@ var runnerRealtimeTokenContract = c15.router({
     method: "POST",
     path: "/api/runners/realtime/token",
     headers: authHeadersSchema,
-    body: z18.object({
+    body: z19.object({
       group: runnerGroupSchema
     }),
     responses: {
@@ -2794,11 +2893,11 @@ var runnerRealtimeTokenContract = c15.router({
 });
 
 // ../../packages/core/src/contracts/platform.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 
 // ../../packages/core/src/contracts/public/common.ts
-import { z as z19 } from "zod";
-var publicApiErrorTypeSchema = z19.enum([
+import { z as z20 } from "zod";
+var publicApiErrorTypeSchema = z20.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -2812,40 +2911,40 @@ var publicApiErrorTypeSchema = z19.enum([
   "rate_limit_error"
   // Rate limit exceeded (429)
 ]);
-var publicApiErrorSchema = z19.object({
-  error: z19.object({
+var publicApiErrorSchema = z20.object({
+  error: z20.object({
     type: publicApiErrorTypeSchema,
-    code: z19.string(),
-    message: z19.string(),
-    param: z19.string().optional(),
-    docUrl: z19.string().url().optional()
+    code: z20.string(),
+    message: z20.string(),
+    param: z20.string().optional(),
+    docUrl: z20.string().url().optional()
   })
 });
-var paginationSchema = z19.object({
-  hasMore: z19.boolean(),
-  nextCursor: z19.string().nullable()
+var paginationSchema = z20.object({
+  hasMore: z20.boolean(),
+  nextCursor: z20.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z19.object({
-    data: z19.array(dataSchema),
+  return z20.object({
+    data: z20.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z19.object({
-  cursor: z19.string().optional(),
-  limit: z19.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z20.object({
+  cursor: z20.string().optional(),
+  limit: z20.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z19.string().uuid();
-var timestampSchema = z19.string().datetime();
+var requestIdSchema = z20.string().uuid();
+var timestampSchema = z20.string().datetime();
 
 // ../../packages/core/src/contracts/platform.ts
-var c16 = initContract();
-var platformPaginationSchema = z20.object({
-  hasMore: z20.boolean(),
-  nextCursor: z20.string().nullable(),
-  totalPages: z20.number()
+var c17 = initContract();
+var platformPaginationSchema = z21.object({
+  hasMore: z21.boolean(),
+  nextCursor: z21.string().nullable(),
+  totalPages: z21.number()
 });
-var platformLogStatusSchema = z20.enum([
+var platformLogStatusSchema = z21.enum([
   "pending",
   "running",
   "completed",
@@ -2853,41 +2952,41 @@ var platformLogStatusSchema = z20.enum([
   "timeout",
   "cancelled"
 ]);
-var platformLogEntrySchema = z20.object({
-  id: z20.string().uuid(),
-  sessionId: z20.string().nullable(),
-  agentName: z20.string(),
-  framework: z20.string().nullable(),
+var platformLogEntrySchema = z21.object({
+  id: z21.string().uuid(),
+  sessionId: z21.string().nullable(),
+  agentName: z21.string(),
+  framework: z21.string().nullable(),
   status: platformLogStatusSchema,
-  createdAt: z20.string()
+  createdAt: z21.string()
 });
-var platformLogsListResponseSchema = z20.object({
-  data: z20.array(platformLogEntrySchema),
+var platformLogsListResponseSchema = z21.object({
+  data: z21.array(platformLogEntrySchema),
   pagination: platformPaginationSchema
 });
-var artifactSchema = z20.object({
-  name: z20.string().nullable(),
-  version: z20.string().nullable()
+var artifactSchema = z21.object({
+  name: z21.string().nullable(),
+  version: z21.string().nullable()
 });
-var platformLogDetailSchema = z20.object({
-  id: z20.string().uuid(),
-  sessionId: z20.string().nullable(),
-  agentName: z20.string(),
-  framework: z20.string().nullable(),
+var platformLogDetailSchema = z21.object({
+  id: z21.string().uuid(),
+  sessionId: z21.string().nullable(),
+  agentName: z21.string(),
+  framework: z21.string().nullable(),
   status: platformLogStatusSchema,
-  prompt: z20.string(),
-  error: z20.string().nullable(),
-  createdAt: z20.string(),
-  startedAt: z20.string().nullable(),
-  completedAt: z20.string().nullable(),
+  prompt: z21.string(),
+  error: z21.string().nullable(),
+  createdAt: z21.string(),
+  startedAt: z21.string().nullable(),
+  completedAt: z21.string().nullable(),
   artifact: artifactSchema
 });
-var platformLogsListContract = c16.router({
+var platformLogsListContract = c17.router({
   list: {
     method: "GET",
     path: "/api/platform/logs",
     query: listQuerySchema.extend({
-      search: z20.string().optional()
+      search: z21.string().optional()
     }),
     responses: {
       200: platformLogsListResponseSchema,
@@ -2896,12 +2995,12 @@ var platformLogsListContract = c16.router({
     summary: "List agent run logs with pagination"
   }
 });
-var platformLogsByIdContract = c16.router({
+var platformLogsByIdContract = c17.router({
   getById: {
     method: "GET",
     path: "/api/platform/logs/:id",
-    pathParams: z20.object({
-      id: z20.string().uuid("Invalid log ID")
+    pathParams: z21.object({
+      id: z21.string().uuid("Invalid log ID")
     }),
     responses: {
       200: platformLogDetailSchema,
@@ -2911,17 +3010,17 @@ var platformLogsByIdContract = c16.router({
     summary: "Get agent run log details by ID"
   }
 });
-var artifactDownloadResponseSchema = z20.object({
-  url: z20.string().url(),
-  expiresAt: z20.string()
+var artifactDownloadResponseSchema = z21.object({
+  url: z21.string().url(),
+  expiresAt: z21.string()
 });
-var platformArtifactDownloadContract = c16.router({
+var platformArtifactDownloadContract = c17.router({
   getDownloadUrl: {
     method: "GET",
     path: "/api/platform/artifacts/download",
-    query: z20.object({
-      name: z20.string().min(1, "Artifact name is required"),
-      version: z20.string().optional()
+    query: z21.object({
+      name: z21.string().min(1, "Artifact name is required"),
+      version: z21.string().optional()
     }),
     responses: {
       200: artifactDownloadResponseSchema,
@@ -2933,29 +3032,29 @@ var platformArtifactDownloadContract = c16.router({
 });
 
 // ../../packages/core/src/contracts/llm.ts
-import { z as z21 } from "zod";
-var c17 = initContract();
-var messageRoleSchema = z21.enum(["user", "assistant", "system"]);
-var chatMessageSchema = z21.object({
+import { z as z22 } from "zod";
+var c18 = initContract();
+var messageRoleSchema = z22.enum(["user", "assistant", "system"]);
+var chatMessageSchema = z22.object({
   role: messageRoleSchema,
-  content: z21.string()
+  content: z22.string()
 });
-var tokenUsageSchema = z21.object({
-  promptTokens: z21.number(),
-  completionTokens: z21.number(),
-  totalTokens: z21.number()
+var tokenUsageSchema = z22.object({
+  promptTokens: z22.number(),
+  completionTokens: z22.number(),
+  totalTokens: z22.number()
 });
-var llmChatRequestSchema = z21.object({
-  model: z21.string().min(1).optional(),
-  messages: z21.array(chatMessageSchema).min(1, "At least one message is required"),
-  stream: z21.boolean().optional().default(false)
+var llmChatRequestSchema = z22.object({
+  model: z22.string().min(1).optional(),
+  messages: z22.array(chatMessageSchema).min(1, "At least one message is required"),
+  stream: z22.boolean().optional().default(false)
 });
-var llmChatResponseSchema = z21.object({
-  content: z21.string(),
-  model: z21.string(),
+var llmChatResponseSchema = z22.object({
+  content: z22.string(),
+  model: z22.string(),
   usage: tokenUsageSchema
 });
-var llmChatContract = c17.router({
+var llmChatContract = c18.router({
   chat: {
     method: "POST",
     path: "/api/llm/chat",
@@ -2971,28 +3070,28 @@ var llmChatContract = c17.router({
 });
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z22 } from "zod";
-var c18 = initContract();
-var publicAgentSchema = z22.object({
-  id: z22.string(),
-  name: z22.string(),
-  currentVersionId: z22.string().nullable(),
+import { z as z23 } from "zod";
+var c19 = initContract();
+var publicAgentSchema = z23.object({
+  id: z23.string(),
+  name: z23.string(),
+  currentVersionId: z23.string().nullable(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var agentVersionSchema = z22.object({
-  id: z22.string(),
-  agentId: z22.string(),
-  versionNumber: z22.number(),
+var agentVersionSchema = z23.object({
+  id: z23.string(),
+  agentId: z23.string(),
+  versionNumber: z23.number(),
   createdAt: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z22.string().optional()
+  name: z23.string().optional()
 });
-var publicAgentsListContract = c18.router({
+var publicAgentsListContract = c19.router({
   list: {
     method: "GET",
     path: "/v1/agents",
@@ -3007,13 +3106,13 @@ var publicAgentsListContract = c18.router({
     description: "List all agents in the current scope with pagination. Use the `name` query parameter to filter by agent name."
   }
 });
-var publicAgentByIdContract = c18.router({
+var publicAgentByIdContract = c19.router({
   get: {
     method: "GET",
     path: "/v1/agents/:id",
     headers: authHeadersSchema,
-    pathParams: z22.object({
-      id: z22.string().min(1, "Agent ID is required")
+    pathParams: z23.object({
+      id: z23.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -3025,13 +3124,13 @@ var publicAgentByIdContract = c18.router({
     description: "Get agent details by ID"
   }
 });
-var publicAgentVersionsContract = c18.router({
+var publicAgentVersionsContract = c19.router({
   list: {
     method: "GET",
     path: "/v1/agents/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z22.object({
-      id: z22.string().min(1, "Agent ID is required")
+    pathParams: z23.object({
+      id: z23.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -3046,9 +3145,9 @@ var publicAgentVersionsContract = c18.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z23 } from "zod";
-var c19 = initContract();
-var publicRunStatusSchema = z23.enum([
+import { z as z24 } from "zod";
+var c20 = initContract();
+var publicRunStatusSchema = z24.enum([
   "pending",
   "running",
   "completed",
@@ -3056,54 +3155,54 @@ var publicRunStatusSchema = z23.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z23.object({
-  id: z23.string(),
-  agentId: z23.string(),
-  agentName: z23.string(),
+var publicRunSchema = z24.object({
+  id: z24.string(),
+  agentId: z24.string(),
+  agentName: z24.string(),
   status: publicRunStatusSchema,
-  prompt: z23.string(),
+  prompt: z24.string(),
   createdAt: timestampSchema,
   startedAt: timestampSchema.nullable(),
   completedAt: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z23.string().nullable(),
-  executionTimeMs: z23.number().nullable(),
-  checkpointId: z23.string().nullable(),
-  sessionId: z23.string().nullable(),
-  artifactName: z23.string().nullable(),
-  artifactVersion: z23.string().nullable(),
-  volumes: z23.record(z23.string(), z23.string()).optional()
+  error: z24.string().nullable(),
+  executionTimeMs: z24.number().nullable(),
+  checkpointId: z24.string().nullable(),
+  sessionId: z24.string().nullable(),
+  artifactName: z24.string().nullable(),
+  artifactVersion: z24.string().nullable(),
+  volumes: z24.record(z24.string(), z24.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z23.object({
+var createRunRequestSchema = z24.object({
   // Agent identification (one of: agent, agentId, sessionId, checkpointId)
-  agent: z23.string().optional(),
+  agent: z24.string().optional(),
   // Agent name
-  agentId: z23.string().optional(),
+  agentId: z24.string().optional(),
   // Agent ID
-  agentVersion: z23.string().optional(),
+  agentVersion: z24.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  sessionId: z23.string().optional(),
+  sessionId: z24.string().optional(),
   // Resume from checkpoint
-  checkpointId: z23.string().optional(),
+  checkpointId: z24.string().optional(),
   // Required
-  prompt: z23.string().min(1, "Prompt is required"),
+  prompt: z24.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z23.record(z23.string(), z23.string()).optional(),
-  secrets: z23.record(z23.string(), z23.string()).optional(),
-  artifactName: z23.string().optional(),
+  variables: z24.record(z24.string(), z24.string()).optional(),
+  secrets: z24.record(z24.string(), z24.string()).optional(),
+  artifactName: z24.string().optional(),
   // Artifact name to mount
-  artifactVersion: z23.string().optional(),
+  artifactVersion: z24.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z23.record(z23.string(), z23.string()).optional()
+  volumes: z24.record(z24.string(), z24.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
   status: publicRunStatusSchema.optional()
 });
-var publicRunsListContract = c19.router({
+var publicRunsListContract = c20.router({
   list: {
     method: "GET",
     path: "/v1/runs",
@@ -3135,13 +3234,13 @@ var publicRunsListContract = c19.router({
     description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
   }
 });
-var publicRunByIdContract = c19.router({
+var publicRunByIdContract = c20.router({
   get: {
     method: "GET",
     path: "/v1/runs/:id",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -3153,15 +3252,15 @@ var publicRunByIdContract = c19.router({
     description: "Get run details by ID"
   }
 });
-var publicRunCancelContract = c19.router({
+var publicRunCancelContract = c20.router({
   cancel: {
     method: "POST",
     path: "/v1/runs/:id/cancel",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
-    body: z23.undefined(),
+    body: z24.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -3174,27 +3273,27 @@ var publicRunCancelContract = c19.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z23.object({
+var logEntrySchema = z24.object({
   timestamp: timestampSchema,
-  type: z23.enum(["agent", "system", "network"]),
-  level: z23.enum(["debug", "info", "warn", "error"]),
-  message: z23.string(),
-  metadata: z23.record(z23.string(), z23.unknown()).optional()
+  type: z24.enum(["agent", "system", "network"]),
+  level: z24.enum(["debug", "info", "warn", "error"]),
+  message: z24.string(),
+  metadata: z24.record(z24.string(), z24.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z23.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z24.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z23.enum(["asc", "desc"]).default("asc")
+  order: z24.enum(["asc", "desc"]).default("asc")
 });
-var publicRunLogsContract = c19.router({
+var publicRunLogsContract = c20.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -3207,30 +3306,30 @@ var publicRunLogsContract = c19.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z23.object({
+var metricPointSchema = z24.object({
   timestamp: timestampSchema,
-  cpuPercent: z23.number(),
-  memoryUsedMb: z23.number(),
-  memoryTotalMb: z23.number(),
-  diskUsedMb: z23.number(),
-  diskTotalMb: z23.number()
-});
-var metricsSummarySchema = z23.object({
-  avgCpuPercent: z23.number(),
-  maxMemoryUsedMb: z23.number(),
-  totalDurationMs: z23.number().nullable()
-});
-var metricsResponseSchema2 = z23.object({
-  data: z23.array(metricPointSchema),
+  cpuPercent: z24.number(),
+  memoryUsedMb: z24.number(),
+  memoryTotalMb: z24.number(),
+  diskUsedMb: z24.number(),
+  diskTotalMb: z24.number()
+});
+var metricsSummarySchema = z24.object({
+  avgCpuPercent: z24.number(),
+  maxMemoryUsedMb: z24.number(),
+  totalDurationMs: z24.number().nullable()
+});
+var metricsResponseSchema2 = z24.object({
+  data: z24.array(metricPointSchema),
   summary: metricsSummarySchema
 });
-var publicRunMetricsContract = c19.router({
+var publicRunMetricsContract = c20.router({
   getMetrics: {
     method: "GET",
     path: "/v1/runs/:id/metrics",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -3242,7 +3341,7 @@ var publicRunMetricsContract = c19.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z23.enum([
+var sseEventTypeSchema = z24.enum([
   "status",
   // Run status change
   "output",
@@ -3254,26 +3353,26 @@ var sseEventTypeSchema = z23.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z23.object({
+var sseEventSchema = z24.object({
   event: sseEventTypeSchema,
-  data: z23.unknown(),
-  id: z23.string().optional()
+  data: z24.unknown(),
+  id: z24.string().optional()
   // For Last-Event-ID reconnection
 });
-var publicRunEventsContract = c19.router({
+var publicRunEventsContract = c20.router({
   streamEvents: {
     method: "GET",
     path: "/v1/runs/:id/events",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
-    query: z23.object({
-      lastEventId: z23.string().optional()
+    query: z24.object({
+      lastEventId: z24.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z23.any(),
+      200: z24.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -3285,28 +3384,28 @@ var publicRunEventsContract = c19.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z24 } from "zod";
-var c20 = initContract();
-var publicArtifactSchema = z24.object({
-  id: z24.string(),
-  name: z24.string(),
-  currentVersionId: z24.string().nullable(),
-  size: z24.number(),
+import { z as z25 } from "zod";
+var c21 = initContract();
+var publicArtifactSchema = z25.object({
+  id: z25.string(),
+  name: z25.string(),
+  currentVersionId: z25.string().nullable(),
+  size: z25.number(),
   // Total size in bytes
-  fileCount: z24.number(),
+  fileCount: z25.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var artifactVersionSchema = z24.object({
-  id: z24.string(),
+var artifactVersionSchema = z25.object({
+  id: z25.string(),
   // SHA-256 content hash
-  artifactId: z24.string(),
-  size: z24.number(),
+  artifactId: z25.string(),
+  size: z25.number(),
   // Size in bytes
-  fileCount: z24.number(),
-  message: z24.string().nullable(),
+  fileCount: z25.number(),
+  message: z25.string().nullable(),
   // Optional commit message
-  createdBy: z24.string(),
+  createdBy: z25.string(),
   createdAt: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -3316,7 +3415,7 @@ var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchem
 var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
   artifactVersionSchema
 );
-var publicArtifactsListContract = c20.router({
+var publicArtifactsListContract = c21.router({
   list: {
     method: "GET",
     path: "/v1/artifacts",
@@ -3331,13 +3430,13 @@ var publicArtifactsListContract = c20.router({
     description: "List all artifacts in the current scope with pagination"
   }
 });
-var publicArtifactByIdContract = c20.router({
+var publicArtifactByIdContract = c21.router({
   get: {
     method: "GET",
     path: "/v1/artifacts/:id",
     headers: authHeadersSchema,
-    pathParams: z24.object({
-      id: z24.string().min(1, "Artifact ID is required")
+    pathParams: z25.object({
+      id: z25.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -3349,13 +3448,13 @@ var publicArtifactByIdContract = c20.router({
     description: "Get artifact details by ID"
   }
 });
-var publicArtifactVersionsContract = c20.router({
+var publicArtifactVersionsContract = c21.router({
   list: {
     method: "GET",
     path: "/v1/artifacts/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z24.object({
-      id: z24.string().min(1, "Artifact ID is required")
+    pathParams: z25.object({
+      id: z25.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -3368,20 +3467,20 @@ var publicArtifactVersionsContract = c20.router({
     description: "List all versions of an artifact with pagination"
   }
 });
-var publicArtifactDownloadContract = c20.router({
+var publicArtifactDownloadContract = c21.router({
   download: {
     method: "GET",
     path: "/v1/artifacts/:id/download",
     headers: authHeadersSchema,
-    pathParams: z24.object({
-      id: z24.string().min(1, "Artifact ID is required")
+    pathParams: z25.object({
+      id: z25.string().min(1, "Artifact ID is required")
     }),
-    query: z24.object({
-      versionId: z24.string().optional()
+    query: z25.object({
+      versionId: z25.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z24.undefined(),
+      302: z25.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -3393,28 +3492,28 @@ var publicArtifactDownloadContract = c20.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z25 } from "zod";
-var c21 = initContract();
-var publicVolumeSchema = z25.object({
-  id: z25.string(),
-  name: z25.string(),
-  currentVersionId: z25.string().nullable(),
-  size: z25.number(),
+import { z as z26 } from "zod";
+var c22 = initContract();
+var publicVolumeSchema = z26.object({
+  id: z26.string(),
+  name: z26.string(),
+  currentVersionId: z26.string().nullable(),
+  size: z26.number(),
   // Total size in bytes
-  fileCount: z25.number(),
+  fileCount: z26.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var volumeVersionSchema = z25.object({
-  id: z25.string(),
+var volumeVersionSchema = z26.object({
+  id: z26.string(),
   // SHA-256 content hash
-  volumeId: z25.string(),
-  size: z25.number(),
+  volumeId: z26.string(),
+  size: z26.number(),
   // Size in bytes
-  fileCount: z25.number(),
-  message: z25.string().nullable(),
+  fileCount: z26.number(),
+  message: z26.string().nullable(),
   // Optional commit message
-  createdBy: z25.string(),
+  createdBy: z26.string(),
   createdAt: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -3422,7 +3521,7 @@ var publicVolumeDetailSchema = publicVolumeSchema.extend({
 });
 var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
 var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
-var publicVolumesListContract = c21.router({
+var publicVolumesListContract = c22.router({
   list: {
     method: "GET",
     path: "/v1/volumes",
@@ -3437,13 +3536,13 @@ var publicVolumesListContract = c21.router({
     description: "List all volumes in the current scope with pagination"
   }
 });
-var publicVolumeByIdContract = c21.router({
+var publicVolumeByIdContract = c22.router({
   get: {
     method: "GET",
     path: "/v1/volumes/:id",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Volume ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -3455,13 +3554,13 @@ var publicVolumeByIdContract = c21.router({
     description: "Get volume details by ID"
   }
 });
-var publicVolumeVersionsContract = c21.router({
+var publicVolumeVersionsContract = c22.router({
   list: {
     method: "GET",
     path: "/v1/volumes/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Volume ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -3474,20 +3573,20 @@ var publicVolumeVersionsContract = c21.router({
     description: "List all versions of a volume with pagination"
   }
 });
-var publicVolumeDownloadContract = c21.router({
+var publicVolumeDownloadContract = c22.router({
   download: {
     method: "GET",
     path: "/v1/volumes/:id/download",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Volume ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Volume ID is required")
     }),
-    query: z25.object({
-      versionId: z25.string().optional()
+    query: z26.object({
+      versionId: z26.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z25.undefined(),
+      302: z26.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -4005,11 +4104,54 @@ async function deleteSecret(name) {
   handleError(result, `Secret "${name}" not found`);
 }
 
-// src/lib/api/domains/model-providers.ts
+// src/lib/api/domains/variables.ts
 import { initClient as initClient8 } from "@ts-rest/core";
+async function listVariables() {
+  const config = await getClientConfig();
+  const client = initClient8(variablesMainContract, config);
+  const result = await client.list({ headers: {} });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to list variables");
+}
+async function getVariable(name) {
+  const config = await getClientConfig();
+  const client = initClient8(variablesByNameContract, config);
+  const result = await client.get({
+    params: { name }
+  });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, `Variable "${name}" not found`);
+}
+async function setVariable(body) {
+  const config = await getClientConfig();
+  const client = initClient8(variablesMainContract, config);
+  const result = await client.set({ body });
+  if (result.status === 200 || result.status === 201) {
+    return result.body;
+  }
+  handleError(result, "Failed to set variable");
+}
+async function deleteVariable(name) {
+  const config = await getClientConfig();
+  const client = initClient8(variablesByNameContract, config);
+  const result = await client.delete({
+    params: { name }
+  });
+  if (result.status === 204) {
+    return;
+  }
+  handleError(result, `Variable "${name}" not found`);
+}
+
+// src/lib/api/domains/model-providers.ts
+import { initClient as initClient9 } from "@ts-rest/core";
 async function listModelProviders() {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersMainContract, config);
+  const client = initClient9(modelProvidersMainContract, config);
   const result = await client.list({ headers: {} });
   if (result.status === 200) {
     return result.body;
@@ -4018,7 +4160,7 @@ async function listModelProviders() {
 }
 async function upsertModelProvider(body) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersMainContract, config);
+  const client = initClient9(modelProvidersMainContract, config);
   const result = await client.upsert({ body });
   if (result.status === 200 || result.status === 201) {
     return result.body;
@@ -4027,7 +4169,7 @@ async function upsertModelProvider(body) {
 }
 async function checkModelProviderCredential(type) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersCheckContract, config);
+  const client = initClient9(modelProvidersCheckContract, config);
   const result = await client.check({
     params: { type }
   });
@@ -4038,7 +4180,7 @@ async function checkModelProviderCredential(type) {
 }
 async function deleteModelProvider(type) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersByTypeContract, config);
+  const client = initClient9(modelProvidersByTypeContract, config);
   const result = await client.delete({
     params: { type }
   });
@@ -4049,7 +4191,7 @@ async function deleteModelProvider(type) {
 }
 async function convertModelProviderCredential(type) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersConvertContract, config);
+  const client = initClient9(modelProvidersConvertContract, config);
   const result = await client.convert({
     params: { type }
   });
@@ -4060,7 +4202,7 @@ async function convertModelProviderCredential(type) {
 }
 async function setModelProviderDefault(type) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersSetDefaultContract, config);
+  const client = initClient9(modelProvidersSetDefaultContract, config);
   const result = await client.setDefault({
     params: { type }
   });
@@ -4071,7 +4213,7 @@ async function setModelProviderDefault(type) {
 }
 async function updateModelProviderModel(type, selectedModel) {
   const config = await getClientConfig();
-  const client = initClient8(modelProvidersUpdateModelContract, config);
+  const client = initClient9(modelProvidersUpdateModelContract, config);
   const result = await client.updateModel({
     params: { type },
     body: { selectedModel }
@@ -4102,8 +4244,8 @@ async function getUsage(options) {
 }
 
 // src/lib/domain/yaml-validator.ts
-import { z as z26 } from "zod";
-var cliAgentNameSchema = z26.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
+import { z as z27 } from "zod";
+var cliAgentNameSchema = z27.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
   /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/,
   "Agent name must start and end with letter or number, and contain only letters, numbers, and hyphens"
 );
@@ -4118,7 +4260,7 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
         const skillUrl = agent.skills[i];
         if (skillUrl && !validateGitHubTreeUrl(skillUrl)) {
           ctx.addIssue({
-            code: z26.ZodIssueCode.custom,
+            code: z27.ZodIssueCode.custom,
             message: `Invalid skill URL: ${skillUrl}. Expected format: https://github.com/{owner}/{repo}/tree/{branch}/{path}`,
             path: ["skills", i]
           });
@@ -4127,15 +4269,15 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     }
   }
 );
-var cliComposeSchema = z26.object({
-  version: z26.string().min(1, "Missing config.version"),
-  agents: z26.record(cliAgentNameSchema, cliAgentDefinitionSchema),
-  volumes: z26.record(z26.string(), volumeConfigSchema).optional()
+var cliComposeSchema = z27.object({
+  version: z27.string().min(1, "Missing config.version"),
+  agents: z27.record(cliAgentNameSchema, cliAgentDefinitionSchema),
+  volumes: z27.record(z27.string(), volumeConfigSchema).optional()
 }).superRefine((config, ctx) => {
   const agentKeys = Object.keys(config.agents);
   if (agentKeys.length === 0) {
     ctx.addIssue({
-      code: z26.ZodIssueCode.custom,
+      code: z27.ZodIssueCode.custom,
       message: "agents must have at least one agent defined",
       path: ["agents"]
     });
@@ -4143,7 +4285,7 @@ var cliComposeSchema = z26.object({
   }
   if (agentKeys.length > 1) {
     ctx.addIssue({
-      code: z26.ZodIssueCode.custom,
+      code: z27.ZodIssueCode.custom,
       message: "Multiple agents not supported yet. Only one agent allowed.",
       path: ["agents"]
     });
@@ -4155,7 +4297,7 @@ var cliComposeSchema = z26.object({
   if (agentVolumes && agentVolumes.length > 0) {
     if (!config.volumes) {
       ctx.addIssue({
-        code: z26.ZodIssueCode.custom,
+        code: z27.ZodIssueCode.custom,
         message: "Agent references volumes but no volumes section defined. Each volume must have explicit name and version.",
         path: ["volumes"]
       });
@@ -4165,7 +4307,7 @@ var cliComposeSchema = z26.object({
       const parts = volDeclaration.split(":");
       if (parts.length !== 2) {
         ctx.addIssue({
-          code: z26.ZodIssueCode.custom,
+          code: z27.ZodIssueCode.custom,
           message: `Invalid volume declaration: ${volDeclaration}. Expected format: volume-key:/mount/path`,
           path: ["agents", agentName, "volumes"]
         });
@@ -4174,7 +4316,7 @@ var cliComposeSchema = z26.object({
       const volumeKey = parts[0].trim();
       if (!config.volumes[volumeKey]) {
         ctx.addIssue({
-          code: z26.ZodIssueCode.custom,
+          code: z27.ZodIssueCode.custom,
           message: `Volume "${volumeKey}" is not defined in volumes section. Each volume must have explicit name and version.`,
           path: ["volumes", volumeKey]
         });
@@ -5224,7 +5366,7 @@ var composeCommand = new Command7().name("compose").description("Create or updat
         )
       );
       if (options.autoUpdate !== false) {
-        await silentUpgradeAfterCommand("9.17.2");
+        await silentUpgradeAfterCommand("9.18.0");
       }
     } catch (error) {
       if (error instanceof Error) {
@@ -5979,9 +6121,9 @@ var CodexEventParser = class {
       }
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const changes = item.changes.map((c22) => {
-        const action = c22.kind === "add" ? "Created" : c22.kind === "modify" ? "Modified" : "Deleted";
-        return `${action}: ${c22.path}`;
+      const changes = item.changes.map((c23) => {
+        const action = c23.kind === "add" ? "Created" : c23.kind === "modify" ? "Modified" : "Deleted";
+        return `${action}: ${c23.path}`;
       }).join("\n");
       return {
         type: "text",
@@ -6135,9 +6277,9 @@ var CodexEventRenderer = class {
       return;
     }
     if (itemType === "file_change" && item.changes && item.changes.length > 0) {
-      const summary = item.changes.map((c22) => {
-        const icon = c22.kind === "add" ? "+" : c22.kind === "delete" ? "-" : "~";
-        return `${icon}${c22.path}`;
+      const summary = item.changes.map((c23) => {
+        const icon = c23.kind === "add" ? "+" : c23.kind === "delete" ? "-" : "~";
+        return `${icon}${c23.path}`;
       }).join(", ");
       console.log(chalk7.green("[files]") + ` ${summary}`);
       return;
@@ -6158,7 +6300,7 @@ var CodexEventRenderer = class {
 };
 
 // src/lib/api/api-client.ts
-import { initClient as initClient9 } from "@ts-rest/core";
+import { initClient as initClient10 } from "@ts-rest/core";
 var ApiClient = class {
   async getHeaders() {
     const token = await getToken();
@@ -6184,7 +6326,7 @@ var ApiClient = class {
   async getComposeByName(name, scope) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(composesMainContract, {
+    const client = initClient10(composesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6205,7 +6347,7 @@ var ApiClient = class {
   async getComposeById(id) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(composesByIdContract, {
+    const client = initClient10(composesByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6227,7 +6369,7 @@ var ApiClient = class {
   async getComposeVersion(composeId, version) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(composesVersionsContract, {
+    const client = initClient10(composesVersionsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6248,7 +6390,7 @@ var ApiClient = class {
   async createOrUpdateCompose(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(composesMainContract, {
+    const client = initClient10(composesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6271,7 +6413,7 @@ var ApiClient = class {
   async createRun(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runsMainContract, {
+    const client = initClient10(runsMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6287,7 +6429,7 @@ var ApiClient = class {
   async getEvents(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runEventsContract, {
+    const client = initClient10(runEventsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6309,7 +6451,7 @@ var ApiClient = class {
   async getSystemLog(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runSystemLogContract, {
+    const client = initClient10(runSystemLogContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6332,7 +6474,7 @@ var ApiClient = class {
   async getMetrics(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runMetricsContract, {
+    const client = initClient10(runMetricsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6355,7 +6497,7 @@ var ApiClient = class {
   async getAgentEvents(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runAgentEventsContract, {
+    const client = initClient10(runAgentEventsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6378,7 +6520,7 @@ var ApiClient = class {
   async getNetworkLogs(runId, options) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(runNetworkLogsContract, {
+    const client = initClient10(runNetworkLogsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6404,7 +6546,7 @@ var ApiClient = class {
   async getScope() {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(scopeContract, {
+    const client = initClient10(scopeContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6423,7 +6565,7 @@ var ApiClient = class {
   async createScope(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(scopeContract, {
+    const client = initClient10(scopeContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6442,7 +6584,7 @@ var ApiClient = class {
   async updateScope(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(scopeContract, {
+    const client = initClient10(scopeContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6462,7 +6604,7 @@ var ApiClient = class {
   async getSession(sessionId) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(sessionsByIdContract, {
+    const client = initClient10(sessionsByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6484,7 +6626,7 @@ var ApiClient = class {
   async getCheckpoint(checkpointId) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(checkpointsByIdContract, {
+    const client = initClient10(checkpointsByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6505,7 +6647,7 @@ var ApiClient = class {
   async prepareStorage(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(storagesPrepareContract, {
+    const client = initClient10(storagesPrepareContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6524,7 +6666,7 @@ var ApiClient = class {
   async commitStorage(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(storagesCommitContract, {
+    const client = initClient10(storagesCommitContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6543,7 +6685,7 @@ var ApiClient = class {
   async getStorageDownload(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(storagesDownloadContract, {
+    const client = initClient10(storagesDownloadContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6568,7 +6710,7 @@ var ApiClient = class {
   async listStorages(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(storagesListContract, {
+    const client = initClient10(storagesListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6587,7 +6729,7 @@ var ApiClient = class {
   async deploySchedule(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesMainContract, {
+    const client = initClient10(schedulesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6606,7 +6748,7 @@ var ApiClient = class {
   async listSchedules() {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesMainContract, {
+    const client = initClient10(schedulesMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6625,7 +6767,7 @@ var ApiClient = class {
   async getScheduleByName(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesByNameContract, {
+    const client = initClient10(schedulesByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6647,7 +6789,7 @@ var ApiClient = class {
   async deleteSchedule(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesByNameContract, {
+    const client = initClient10(schedulesByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6669,7 +6811,7 @@ var ApiClient = class {
   async enableSchedule(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesEnableContract, {
+    const client = initClient10(schedulesEnableContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6691,7 +6833,7 @@ var ApiClient = class {
   async disableSchedule(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(schedulesEnableContract, {
+    const client = initClient10(schedulesEnableContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6713,7 +6855,7 @@ var ApiClient = class {
   async listScheduleRuns(params) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(scheduleRunsContract, {
+    const client = initClient10(scheduleRunsContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6738,7 +6880,7 @@ var ApiClient = class {
   async listPublicAgents(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicAgentsListContract, {
+    const client = initClient10(publicAgentsListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6757,7 +6899,7 @@ var ApiClient = class {
   async listPublicArtifacts(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicArtifactsListContract, {
+    const client = initClient10(publicArtifactsListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6776,7 +6918,7 @@ var ApiClient = class {
   async getPublicArtifact(id) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicArtifactByIdContract, {
+    const client = initClient10(publicArtifactByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6795,7 +6937,7 @@ var ApiClient = class {
   async listPublicVolumes(query) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicVolumesListContract, {
+    const client = initClient10(publicVolumesListContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6814,7 +6956,7 @@ var ApiClient = class {
   async getPublicVolume(id) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(publicVolumeByIdContract, {
+    const client = initClient10(publicVolumeByIdContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6853,7 +6995,7 @@ var ApiClient = class {
   async listCredentials() {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(credentialsMainContract, {
+    const client = initClient10(credentialsMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6872,7 +7014,7 @@ var ApiClient = class {
   async getCredential(name) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(credentialsByNameContract, {
+    const client = initClient10(credentialsByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6893,7 +7035,7 @@ var ApiClient = class {
   async setCredential(body) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(credentialsMainContract, {
+    const client = initClient10(credentialsMainContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6912,7 +7054,7 @@ var ApiClient = class {
   async deleteCredential(name) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(credentialsByNameContract, {
+    const client = initClient10(credentialsByNameContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -6933,7 +7075,7 @@ var ApiClient = class {
   async getRealtimeToken(runId) {
     const baseUrl = await this.getBaseUrl();
     const headers = await this.getHeaders();
-    const client = initClient9(realtimeTokenContract, {
+    const client = initClient10(realtimeTokenContract, {
       baseUrl,
       baseHeaders: headers,
       jsonQuery: true
@@ -7455,7 +7597,7 @@ var mainRunCommand = new Command8().name("run").description("Run an agent").argu
       }
       showNextSteps(result);
       if (options.autoUpdate !== false) {
-        await silentUpgradeAfterCommand("9.17.2");
+        await silentUpgradeAfterCommand("9.18.0");
       }
     } catch (error) {
       handleRunError(error, identifier);
@@ -8962,7 +9104,7 @@ var cookAction = new Command27().name("cook").description("Quick start: prepare,
 ).option("-y, --yes", "Skip confirmation prompts").option("-v, --verbose", "Show full tool inputs and outputs").addOption(new Option5("--debug-no-mock-claude").hideHelp()).addOption(new Option5("--no-auto-update").hideHelp()).action(
   async (prompt, options) => {
     if (options.autoUpdate !== false) {
-      const shouldExit = await checkAndUpgrade("9.17.2", prompt);
+      const shouldExit = await checkAndUpgrade("9.18.0", prompt);
       if (shouldExit) {
         process.exit(0);
       }
@@ -9677,7 +9819,7 @@ var listCommand4 = new Command36().name("list").alias("ls").description("List al
       );
       return;
     }
-    const nameWidth = Math.max(4, ...data.composes.map((c22) => c22.name.length));
+    const nameWidth = Math.max(4, ...data.composes.map((c23) => c23.name.length));
     const header = ["NAME".padEnd(nameWidth), "VERSION", "UPDATED"].join(
       "  "
     );
@@ -10449,7 +10591,7 @@ async function gatherFrequency(optionFrequency, existingFrequency) {
     );
     process.exit(1);
   }
-  const defaultIndex = existingFrequency ? FREQUENCY_CHOICES.findIndex((c22) => c22.value === existingFrequency) : 0;
+  const defaultIndex = existingFrequency ? FREQUENCY_CHOICES.findIndex((c23) => c23.value === existingFrequency) : 0;
   frequency = await promptSelect(
     "Schedule frequency",
     FREQUENCY_CHOICES,
@@ -10478,7 +10620,7 @@ async function gatherDay(frequency, optionDay, existingDay) {
     process.exit(1);
   }
   if (frequency === "weekly") {
-    const defaultDayIndex = existingDay !== void 0 ? DAY_OF_WEEK_CHOICES.findIndex((c22) => c22.value === existingDay) : 0;
+    const defaultDayIndex = existingDay !== void 0 ? DAY_OF_WEEK_CHOICES.findIndex((c23) => c23.value === existingDay) : 0;
     const day2 = await promptSelect(
       "Day of week",
       DAY_OF_WEEK_CHOICES,
@@ -11417,20 +11559,159 @@ var deleteCommand2 = new Command50().name("delete").description("Delete a secret
 // src/commands/secret/index.ts
 var secretCommand = new Command51().name("secret").description("Manage stored secrets for agent runs").addCommand(listCommand6).addCommand(setCommand2).addCommand(deleteCommand2);
 
-// src/commands/model-provider/index.ts
-import { Command as Command56 } from "commander";
+// src/commands/variable/index.ts
+import { Command as Command55 } from "commander";
 
-// src/commands/model-provider/list.ts
+// src/commands/variable/list.ts
 import { Command as Command52 } from "commander";
 import chalk51 from "chalk";
-var listCommand7 = new Command52().name("list").alias("ls").description("List all model providers").action(async () => {
+function truncateValue(value, maxLength = 60) {
+  if (value.length <= maxLength) {
+    return value;
+  }
+  return value.slice(0, maxLength - 15) + "... [truncated]";
+}
+var listCommand7 = new Command52().name("list").alias("ls").description("List all variables").action(async () => {
+  try {
+    const result = await listVariables();
+    if (result.variables.length === 0) {
+      console.log(chalk51.dim("No variables found"));
+      console.log();
+      console.log("To add a variable:");
+      console.log(chalk51.cyan("  vm0 variable set MY_VAR <value>"));
+      return;
+    }
+    console.log(chalk51.bold("Variables:"));
+    console.log();
+    for (const variable of result.variables) {
+      const displayValue = truncateValue(variable.value);
+      console.log(`  ${chalk51.cyan(variable.name)} = ${displayValue}`);
+      if (variable.description) {
+        console.log(`    ${chalk51.dim(variable.description)}`);
+      }
+      console.log(
+        `    ${chalk51.dim(`Updated: ${new Date(variable.updatedAt).toLocaleString()}`)}`
+      );
+      console.log();
+    }
+    console.log(chalk51.dim(`Total: ${result.variables.length} variable(s)`));
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(chalk51.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk51.red(`\u2717 ${error.message}`));
+      }
+    } else {
+      console.error(chalk51.red("\u2717 An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/variable/set.ts
+import { Command as Command53 } from "commander";
+import chalk52 from "chalk";
+var setCommand3 = new Command53().name("set").description("Create or update a variable").argument("<name>", "Variable name (uppercase, e.g., MY_VAR)").argument("<value>", "Variable value").option("-d, --description <description>", "Optional description").action(
+  async (name, value, options) => {
+    try {
+      const variable = await setVariable({
+        name,
+        value,
+        description: options.description
+      });
+      console.log(chalk52.green(`\u2713 Variable "${variable.name}" saved`));
+      console.log();
+      console.log("Use in vm0.yaml:");
+      console.log(chalk52.cyan(`  environment:`));
+      console.log(chalk52.cyan(`    ${name}: \${{ vars.${name} }}`));
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message.includes("Not authenticated")) {
+          console.error(
+            chalk52.red("\u2717 Not authenticated. Run: vm0 auth login")
+          );
+        } else if (error.message.includes("must contain only uppercase")) {
+          console.error(chalk52.red(`\u2717 ${error.message}`));
+          console.log();
+          console.log("Examples of valid variable names:");
+          console.log(chalk52.dim("  MY_VAR"));
+          console.log(chalk52.dim("  API_URL"));
+          console.log(chalk52.dim("  DEBUG_MODE"));
+        } else {
+          console.error(chalk52.red(`\u2717 ${error.message}`));
+        }
+      } else {
+        console.error(chalk52.red("\u2717 An unexpected error occurred"));
+      }
+      process.exit(1);
+    }
+  }
+);
+
+// src/commands/variable/delete.ts
+import { Command as Command54 } from "commander";
+import chalk53 from "chalk";
+var deleteCommand3 = new Command54().name("delete").description("Delete a variable").argument("<name>", "Variable name to delete").option("-y, --yes", "Skip confirmation prompt").action(async (name, options) => {
+  try {
+    try {
+      await getVariable(name);
+    } catch (error) {
+      if (error instanceof Error && error.message.toLowerCase().includes("not found")) {
+        console.error(chalk53.red(`\u2717 Variable "${name}" not found`));
+        process.exit(1);
+      }
+      throw error;
+    }
+    if (!options.yes) {
+      if (!isInteractive()) {
+        console.error(
+          chalk53.red("\u2717 --yes flag is required in non-interactive mode")
+        );
+        process.exit(1);
+      }
+      const confirmed = await promptConfirm(
+        `Are you sure you want to delete variable "${name}"?`,
+        false
+      );
+      if (!confirmed) {
+        console.log(chalk53.dim("Cancelled"));
+        return;
+      }
+    }
+    await deleteVariable(name);
+    console.log(chalk53.green(`\u2713 Variable "${name}" deleted`));
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message.includes("Not authenticated")) {
+        console.error(chalk53.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      } else {
+        console.error(chalk53.red(`\u2717 ${error.message}`));
+      }
+    } else {
+      console.error(chalk53.red("\u2717 An unexpected error occurred"));
+    }
+    process.exit(1);
+  }
+});
+
+// src/commands/variable/index.ts
+var variableCommand = new Command55().name("variable").description("Manage stored variables for agent runs").addCommand(listCommand7).addCommand(setCommand3).addCommand(deleteCommand3);
+
+// src/commands/model-provider/index.ts
+import { Command as Command60 } from "commander";
+
+// src/commands/model-provider/list.ts
+import { Command as Command56 } from "commander";
+import chalk54 from "chalk";
+var listCommand8 = new Command56().name("list").alias("ls").description("List all model providers").action(async () => {
   try {
     const result = await listModelProviders();
     if (result.modelProviders.length === 0) {
-      console.log(chalk51.dim("No model providers configured"));
+      console.log(chalk54.dim("No model providers configured"));
       console.log();
       console.log("To add a model provider:");
-      console.log(chalk51.cyan("  vm0 model-provider setup"));
+      console.log(chalk54.cyan("  vm0 model-provider setup"));
       return;
     }
     const byFramework = result.modelProviders.reduce(
@@ -11444,16 +11725,16 @@ var listCommand7 = new Command52().name("list").alias("ls").description("List al
       },
       {}
     );
-    console.log(chalk51.bold("Model Providers:"));
+    console.log(chalk54.bold("Model Providers:"));
     console.log();
     for (const [framework, providers] of Object.entries(byFramework)) {
-      console.log(`  ${chalk51.cyan(framework)}:`);
+      console.log(`  ${chalk54.cyan(framework)}:`);
       for (const provider of providers) {
-        const defaultTag = provider.isDefault ? chalk51.green(" (default)") : "";
-        const modelTag = provider.selectedModel ? chalk51.dim(` [${provider.selectedModel}]`) : "";
+        const defaultTag = provider.isDefault ? chalk54.green(" (default)") : "";
+        const modelTag = provider.selectedModel ? chalk54.dim(` [${provider.selectedModel}]`) : "";
         console.log(`    ${provider.type}${defaultTag}${modelTag}`);
         console.log(
-          chalk51.dim(
+          chalk54.dim(
             `      Updated: ${new Date(provider.updatedAt).toLocaleString()}`
           )
         );
@@ -11461,33 +11742,33 @@ var listCommand7 = new Command52().name("list").alias("ls").description("List al
       console.log();
     }
     console.log(
-      chalk51.dim(`Total: ${result.modelProviders.length} provider(s)`)
+      chalk54.dim(`Total: ${result.modelProviders.length} provider(s)`)
     );
   } catch (error) {
     if (error instanceof Error) {
       if (error.message.includes("Not authenticated")) {
-        console.error(chalk51.red("\u2717 Not authenticated. Run: vm0 auth login"));
+        console.error(chalk54.red("\u2717 Not authenticated. Run: vm0 auth login"));
       } else {
-        console.error(chalk51.red(`\u2717 ${error.message}`));
+        console.error(chalk54.red(`\u2717 ${error.message}`));
       }
     } else {
-      console.error(chalk51.red("\u2717 An unexpected error occurred"));
+      console.error(chalk54.red("\u2717 An unexpected error occurred"));
     }
     process.exit(1);
   }
 });
 
 // src/commands/model-provider/setup.ts
-import { Command as Command53 } from "commander";
-import chalk52 from "chalk";
+import { Command as Command57 } from "commander";
+import chalk55 from "chalk";
 import prompts2 from "prompts";
 function validateProviderType(typeStr) {
   if (!Object.keys(MODEL_PROVIDER_TYPES).includes(typeStr)) {
-    console.error(chalk52.red(`\u2717 Invalid type "${typeStr}"`));
+    console.error(chalk55.red(`\u2717 Invalid type "${typeStr}"`));
     console.log();
     console.log("Valid types:");
     for (const [t, config] of Object.entries(MODEL_PROVIDER_TYPES)) {
-      console.log(`  ${chalk52.cyan(t)} - ${config.label}`);
+      console.log(`  ${chalk55.cyan(t)} - ${config.label}`);
     }
     process.exit(1);
   }
@@ -11499,11 +11780,11 @@ function validateModel(type, modelStr) {
     return modelStr;
   }
   if (models && !models.includes(modelStr)) {
-    console.error(chalk52.red(`\u2717 Invalid model "${modelStr}"`));
+    console.error(chalk55.red(`\u2717 Invalid model "${modelStr}"`));
     console.log();
     console.log("Valid models:");
     for (const m of models) {
-      console.log(`  ${chalk52.cyan(m)}`);
+      console.log(`  ${chalk55.cyan(m)}`);
     }
     process.exit(1);
   }
@@ -11512,12 +11793,12 @@ function validateModel(type, modelStr) {
 function validateAuthMethod(type, authMethodStr) {
   const authMethods = getAuthMethodsForType(type);
   if (!authMethods || !(authMethodStr in authMethods)) {
-    console.error(chalk52.red(`\u2717 Invalid auth method "${authMethodStr}"`));
+    console.error(chalk55.red(`\u2717 Invalid auth method "${authMethodStr}"`));
     console.log();
     console.log("Valid auth methods:");
     if (authMethods) {
       for (const [method, config] of Object.entries(authMethods)) {
-        console.log(`  ${chalk52.cyan(method)} - ${config.label}`);
+        console.log(`  ${chalk55.cyan(method)} - ${config.label}`);
       }
     }
     process.exit(1);
@@ -11527,7 +11808,7 @@ function validateAuthMethod(type, authMethodStr) {
 function parseCredentials(type, authMethod, credentialArgs) {
   const credentialsConfig = getCredentialsForAuthMethod(type, authMethod);
   if (!credentialsConfig) {
-    console.error(chalk52.red(`\u2717 Invalid auth method "${authMethod}"`));
+    console.error(chalk55.red(`\u2717 Invalid auth method "${authMethod}"`));
     process.exit(1);
   }
   const credentialNames = Object.keys(credentialsConfig);
@@ -11535,7 +11816,7 @@ function parseCredentials(type, authMethod, credentialArgs) {
   if (credentialArgs.length === 1 && firstArg && !firstArg.includes("=")) {
     if (credentialNames.length !== 1) {
       console.error(
-        chalk52.red(
+        chalk55.red(
           "\u2717 Must use KEY=VALUE format for multi-credential auth methods"
         )
       );
@@ -11543,13 +11824,13 @@ function parseCredentials(type, authMethod, credentialArgs) {
       console.log("Required credentials:");
       for (const [name, fieldConfig] of Object.entries(credentialsConfig)) {
         const requiredNote = fieldConfig.required ? " (required)" : "";
-        console.log(`  ${chalk52.cyan(name)}${requiredNote}`);
+        console.log(`  ${chalk55.cyan(name)}${requiredNote}`);
       }
       process.exit(1);
     }
     const firstCredentialName = credentialNames[0];
     if (!firstCredentialName) {
-      console.error(chalk52.red("\u2717 No credentials defined for this auth method"));
+      console.error(chalk55.red("\u2717 No credentials defined for this auth method"));
       process.exit(1);
     }
     return { [firstCredentialName]: firstArg };
@@ -11558,7 +11839,7 @@ function parseCredentials(type, authMethod, credentialArgs) {
   for (const arg of credentialArgs) {
     const eqIndex = arg.indexOf("=");
     if (eqIndex === -1) {
-      console.error(chalk52.red(`\u2717 Invalid credential format "${arg}"`));
+      console.error(chalk55.red(`\u2717 Invalid credential format "${arg}"`));
       console.log();
       console.log("Use KEY=VALUE format (e.g., AWS_REGION=us-east-1)");
       process.exit(1);
@@ -11572,17 +11853,17 @@ function parseCredentials(type, authMethod, credentialArgs) {
 function validateCredentials(type, authMethod, credentials) {
   const credentialsConfig = getCredentialsForAuthMethod(type, authMethod);
   if (!credentialsConfig) {
-    console.error(chalk52.red(`\u2717 Invalid auth method "${authMethod}"`));
+    console.error(chalk55.red(`\u2717 Invalid auth method "${authMethod}"`));
     process.exit(1);
   }
   for (const [name, fieldConfig] of Object.entries(credentialsConfig)) {
     if (fieldConfig.required && !credentials[name]) {
-      console.error(chalk52.red(`\u2717 Missing required credential: ${name}`));
+      console.error(chalk55.red(`\u2717 Missing required credential: ${name}`));
       console.log();
       console.log("Required credentials:");
       for (const [n, fc] of Object.entries(credentialsConfig)) {
         if (fc.required) {
-          console.log(`  ${chalk52.cyan(n)} - ${fc.label}`);
+          console.log(`  ${chalk55.cyan(n)} - ${fc.label}`);
         }
       }
       process.exit(1);
@@ -11590,12 +11871,12 @@ function validateCredentials(type, authMethod, credentials) {
   }
   for (const name of Object.keys(credentials)) {
     if (!(name in credentialsConfig)) {
-      console.error(chalk52.red(`\u2717 Unknown credential: ${name}`));
+      console.error(chalk55.red(`\u2717 Unknown credential: ${name}`));
       console.log();
       console.log("Valid credentials:");
       for (const [n, fc] of Object.entries(credentialsConfig)) {
         const requiredNote = fc.required ? " (required)" : " (optional)";
-        console.log(`  ${chalk52.cyan(n)}${requiredNote}`);
+        console.log(`  ${chalk55.cyan(n)}${requiredNote}`);
       }
       process.exit(1);
     }
@@ -11618,7 +11899,7 @@ function handleNonInteractiveMode(options) {
       const defaultAuthMethod = getDefaultAuthMethod(type);
       const authMethods = getAuthMethodsForType(type);
       if (!defaultAuthMethod || !authMethods) {
-        console.error(chalk52.red(`\u2717 Provider "${type}" requires --auth-method`));
+        console.error(chalk55.red(`\u2717 Provider "${type}" requires --auth-method`));
         process.exit(1);
       }
       const authMethodNames = Object.keys(authMethods);
@@ -11626,7 +11907,7 @@ function handleNonInteractiveMode(options) {
         authMethod = authMethodNames[0];
       } else {
         console.error(
-          chalk52.red(
+          chalk55.red(
             `\u2717 --auth-method is required for "${type}" (multiple auth methods available)`
           )
         );
@@ -11635,13 +11916,13 @@ function handleNonInteractiveMode(options) {
         for (const [method, config] of Object.entries(authMethods)) {
           const defaultNote = method === defaultAuthMethod ? " (default)" : "";
           console.log(
-            `  ${chalk52.cyan(method)} - ${config.label}${defaultNote}`
+            `  ${chalk55.cyan(method)} - ${config.label}${defaultNote}`
           );
         }
         console.log();
         console.log("Example:");
         console.log(
-          chalk52.cyan(
+          chalk55.cyan(
             `  vm0 model-provider setup --type ${type} --auth-method ${authMethodNames[0]} --credential KEY=VALUE`
           )
         );
@@ -11661,7 +11942,7 @@ function handleNonInteractiveMode(options) {
   const credentialArgs = options.credential;
   const firstArg = credentialArgs[0];
   if (!firstArg) {
-    console.error(chalk52.red("\u2717 Credential is required"));
+    console.error(chalk55.red("\u2717 Credential is required"));
     process.exit(1);
   }
   let credential;
@@ -11710,7 +11991,7 @@ async function promptForModelSelection(type) {
   if (selected === "__custom__") {
     const placeholder = getCustomModelPlaceholder(type);
     if (placeholder) {
-      console.log(chalk52.dim(`Example: ${placeholder}`));
+      console.log(chalk55.dim(`Example: ${placeholder}`));
     }
     const customResponse = await prompts2(
       {
@@ -11755,13 +12036,13 @@ function isSecretCredential(name) {
 async function promptForCredentials(type, authMethod) {
   const credentialsConfig = getCredentialsForAuthMethod(type, authMethod);
   if (!credentialsConfig) {
-    console.error(chalk52.red(`\u2717 Invalid auth method "${authMethod}"`));
+    console.error(chalk55.red(`\u2717 Invalid auth method "${authMethod}"`));
     process.exit(1);
   }
   const credentials = {};
   for (const [name, fieldConfig] of Object.entries(credentialsConfig)) {
     if (fieldConfig.helpText) {
-      console.log(chalk52.dim(fieldConfig.helpText));
+      console.log(chalk55.dim(fieldConfig.helpText));
     }
     const isSecret = isSecretCredential(name);
     const placeholder = "placeholder" in fieldConfig ? fieldConfig.placeholder : "";
@@ -11796,11 +12077,11 @@ async function promptForCredentials(type, authMethod) {
 }
 async function handleInteractiveMode() {
   if (!isInteractive()) {
-    console.error(chalk52.red("\u2717 Interactive mode requires a TTY"));
+    console.error(chalk55.red("\u2717 Interactive mode requires a TTY"));
     console.log();
     console.log("Use non-interactive mode:");
     console.log(
-      chalk52.cyan(
+      chalk55.cyan(
         '  vm0 model-provider setup --type <type> --credential "<value>"'
       )
     );
@@ -11817,7 +12098,7 @@ async function handleInteractiveMode() {
         title = `${title} \u2713`;
       }
       if (isExperimental) {
-        title = `${title} ${chalk52.dim("(experimental)")}`;
+        title = `${title} ${chalk55.dim("(experimental)")}`;
       }
       return {
         title,
@@ -11850,14 +12131,14 @@ async function handleInteractiveMode() {
       const provider = await convertModelProviderCredential(type);
       const defaultNote = provider.isDefault ? ` (default for ${provider.framework})` : "";
       console.log(
-        chalk52.green(
+        chalk55.green(
           `\u2713 Converted "${checkResult.credentialName}" to model provider${defaultNote}`
         )
       );
       await promptSetAsDefault(type, provider.framework, provider.isDefault);
       return null;
     }
-    console.log(chalk52.dim("Aborted"));
+    console.log(chalk55.dim("Aborted"));
     process.exit(0);
   }
   if (checkResult.exists && checkResult.currentType === "model-provider") {
@@ -11888,7 +12169,7 @@ async function handleInteractiveMode() {
   }
   const config = MODEL_PROVIDER_TYPES[type];
   console.log();
-  console.log(chalk52.dim(config.helpText));
+  console.log(chalk55.dim(config.helpText));
   console.log();
   if (hasAuthMethods(type)) {
     const authMethod = await promptForAuthMethod(type);
@@ -11919,17 +12200,17 @@ async function handleInteractiveMode() {
 function handleSetupError2(error) {
   if (error instanceof Error) {
     if (error.message.includes("already exists")) {
-      console.error(chalk52.red(`\u2717 ${error.message}`));
+      console.error(chalk55.red(`\u2717 ${error.message}`));
       console.log();
       console.log("To convert the existing credential, run:");
-      console.log(chalk52.cyan("  vm0 model-provider setup --convert"));
+      console.log(chalk55.cyan("  vm0 model-provider setup --convert"));
     } else if (error.message.includes("Not authenticated")) {
-      console.error(chalk52.red("\u2717 Not authenticated. Run: vm0 auth login"));
+      console.error(chalk55.red("\u2717 Not authenticated. Run: vm0 auth login"));
     } else {
-      console.error(chalk52.red(`\u2717 ${error.message}`));
+      console.error(chalk55.red(`\u2717 ${error.message}`));
     }
   } else {
-    console.error(chalk52.red("\u2717 An unexpected error occurred"));
+    console.error(chalk55.red("\u2717 An unexpected error occurred"));
   }
   process.exit(1);
 }
@@ -11946,13 +12227,13 @@ async function promptSetAsDefault(type, framework, isDefault) {
   );
   if (response.setDefault) {
     await setModelProviderDefault(type);
-    console.log(chalk52.green(`\u2713 Default for ${framework} set to "${type}"`));
+    console.log(chalk55.green(`\u2713 Default for ${framework} set to "${type}"`));
   }
 }
 function collectCredentials(value, previous) {
   return previous.concat([value]);
 }
-var setupCommand2 = new Command53().name("setup").description("Configure a model provider").option("-t, --type <type>", "Provider type (for non-interactive mode)").option(
+var setupCommand2 = new Command57().name("setup").description("Configure a model provider").option("-t, --type <type>", "Provider type (for non-interactive mode)").option(
   "-c, --credential <value>",
   "Credential value (can be used multiple times, supports VALUE or KEY=VALUE format)",
   collectCredentials,
@@ -11975,7 +12256,7 @@ var setupCommand2 = new Command53().name("setup").description("Configure a model
         });
       } else if (options.type || credentialArgs.length > 0) {
         console.error(
-          chalk52.red("\u2717 Both --type and --credential are required")
+          chalk55.red("\u2717 Both --type and --credential are required")
         );
         process.exit(1);
       } else {
@@ -11994,11 +12275,11 @@ var setupCommand2 = new Command53().name("setup").description("Configure a model
         const modelNote2 = provider2.selectedModel ? ` with model: ${provider2.selectedModel}` : "";
         if (!hasModelSelection(input.type)) {
           console.log(
-            chalk52.green(`\u2713 Model provider "${input.type}" unchanged`)
+            chalk55.green(`\u2713 Model provider "${input.type}" unchanged`)
           );
         } else {
           console.log(
-            chalk52.green(
+            chalk55.green(
               `\u2713 Model provider "${input.type}" updated${defaultNote2}${modelNote2}`
             )
           );
@@ -12024,7 +12305,7 @@ var setupCommand2 = new Command53().name("setup").description("Configure a model
       const defaultNote = provider.isDefault ? ` (default for ${provider.framework})` : "";
       const modelNote = provider.selectedModel ? ` with model: ${provider.selectedModel}` : "";
       console.log(
-        chalk52.green(
+        chalk55.green(
           `\u2713 Model provider "${input.type}" ${action}${defaultNote}${modelNote}`
         )
       );
@@ -12042,96 +12323,96 @@ var setupCommand2 = new Command53().name("setup").description("Configure a model
 );
 
 // src/commands/model-provider/delete.ts
-import { Command as Command54 } from "commander";
-import chalk53 from "chalk";
-var deleteCommand3 = new Command54().name("delete").description("Delete a model provider").argument("<type>", "Model provider type to delete").action(async (type) => {
+import { Command as Command58 } from "commander";
+import chalk56 from "chalk";
+var deleteCommand4 = new Command58().name("delete").description("Delete a model provider").argument("<type>", "Model provider type to delete").action(async (type) => {
   try {
     if (!Object.keys(MODEL_PROVIDER_TYPES).includes(type)) {
-      console.error(chalk53.red(`\u2717 Invalid type "${type}"`));
+      console.error(chalk56.red(`\u2717 Invalid type "${type}"`));
       console.log();
       console.log("Valid types:");
       for (const [t, config] of Object.entries(MODEL_PROVIDER_TYPES)) {
-        console.log(`  ${chalk53.cyan(t)} - ${config.label}`);
+        console.log(`  ${chalk56.cyan(t)} - ${config.label}`);
       }
       process.exit(1);
     }
     await deleteModelProvider(type);
-    console.log(chalk53.green(`\u2713 Model provider "${type}" deleted`));
+    console.log(chalk56.green(`\u2713 Model provider "${type}" deleted`));
   } catch (error) {
     if (error instanceof Error) {
       if (error.message.includes("not found")) {
-        console.error(chalk53.red(`\u2717 Model provider "${type}" not found`));
+        console.error(chalk56.red(`\u2717 Model provider "${type}" not found`));
       } else if (error.message.includes("Not authenticated")) {
-        console.error(chalk53.red("\u2717 Not authenticated. Run: vm0 auth login"));
+        console.error(chalk56.red("\u2717 Not authenticated. Run: vm0 auth login"));
       } else {
-        console.error(chalk53.red(`\u2717 ${error.message}`));
+        console.error(chalk56.red(`\u2717 ${error.message}`));
       }
     } else {
-      console.error(chalk53.red("\u2717 An unexpected error occurred"));
+      console.error(chalk56.red("\u2717 An unexpected error occurred"));
     }
     process.exit(1);
   }
 });
 
 // src/commands/model-provider/set-default.ts
-import { Command as Command55 } from "commander";
-import chalk54 from "chalk";
-var setDefaultCommand = new Command55().name("set-default").description("Set a model provider as default for its framework").argument("<type>", "Model provider type to set as default").action(async (type) => {
+import { Command as Command59 } from "commander";
+import chalk57 from "chalk";
+var setDefaultCommand = new Command59().name("set-default").description("Set a model provider as default for its framework").argument("<type>", "Model provider type to set as default").action(async (type) => {
   try {
     if (!Object.keys(MODEL_PROVIDER_TYPES).includes(type)) {
-      console.error(chalk54.red(`\u2717 Invalid type "${type}"`));
+      console.error(chalk57.red(`\u2717 Invalid type "${type}"`));
       console.log();
       console.log("Valid types:");
       for (const [t, config] of Object.entries(MODEL_PROVIDER_TYPES)) {
-        console.log(`  ${chalk54.cyan(t)} - ${config.label}`);
+        console.log(`  ${chalk57.cyan(t)} - ${config.label}`);
       }
       process.exit(1);
     }
     const provider = await setModelProviderDefault(type);
     console.log(
-      chalk54.green(
+      chalk57.green(
         `\u2713 Default for ${provider.framework} set to "${provider.type}"`
       )
     );
   } catch (error) {
     if (error instanceof Error) {
       if (error.message.includes("not found")) {
-        console.error(chalk54.red(`\u2717 Model provider "${type}" not found`));
+        console.error(chalk57.red(`\u2717 Model provider "${type}" not found`));
       } else if (error.message.includes("Not authenticated")) {
-        console.error(chalk54.red("\u2717 Not authenticated. Run: vm0 auth login"));
+        console.error(chalk57.red("\u2717 Not authenticated. Run: vm0 auth login"));
       } else {
-        console.error(chalk54.red(`\u2717 ${error.message}`));
+        console.error(chalk57.red(`\u2717 ${error.message}`));
       }
     } else {
-      console.error(chalk54.red("\u2717 An unexpected error occurred"));
+      console.error(chalk57.red("\u2717 An unexpected error occurred"));
     }
     process.exit(1);
   }
 });
 
 // src/commands/model-provider/index.ts
-var modelProviderCommand = new Command56().name("model-provider").description("Manage model providers for agent runs").addCommand(listCommand7).addCommand(setupCommand2).addCommand(deleteCommand3).addCommand(setDefaultCommand);
+var modelProviderCommand = new Command60().name("model-provider").description("Manage model providers for agent runs").addCommand(listCommand8).addCommand(setupCommand2).addCommand(deleteCommand4).addCommand(setDefaultCommand);
 
 // src/commands/onboard/index.ts
-import { Command as Command57 } from "commander";
-import chalk58 from "chalk";
+import { Command as Command61 } from "commander";
+import chalk61 from "chalk";
 import { mkdir as mkdir8 } from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
 
 // src/lib/ui/welcome-box.ts
-import chalk55 from "chalk";
+import chalk58 from "chalk";
 var gradientColors = [
-  chalk55.hex("#FFAB5E"),
+  chalk58.hex("#FFAB5E"),
   // Line 1 - lightest
-  chalk55.hex("#FF9642"),
+  chalk58.hex("#FF9642"),
   // Line 2
-  chalk55.hex("#FF8228"),
+  chalk58.hex("#FF8228"),
   // Line 3
-  chalk55.hex("#FF6D0A"),
+  chalk58.hex("#FF6D0A"),
   // Line 4
-  chalk55.hex("#E85D00"),
+  chalk58.hex("#E85D00"),
   // Line 5
-  chalk55.hex("#CC4E00")
+  chalk58.hex("#CC4E00")
   // Line 6 - darkest
 ];
 var vm0LogoLines = [
@@ -12153,15 +12434,15 @@ function renderVm0Banner() {
 function renderOnboardWelcome() {
   renderVm0Banner();
   console.log(`  Build agentic workflows using natural language.`);
-  console.log(`  ${chalk55.dim("Currently in beta, enjoy it free.")}`);
+  console.log(`  ${chalk58.dim("Currently in beta, enjoy it free.")}`);
   console.log(
-    `  ${chalk55.dim("Star us on GitHub: https://github.com/vm0-ai/vm0")}`
+    `  ${chalk58.dim("Star us on GitHub: https://github.com/vm0-ai/vm0")}`
   );
   console.log();
 }
 
 // src/lib/ui/step-runner.ts
-import chalk56 from "chalk";
+import chalk59 from "chalk";
 function createStepRunner(options = true) {
   const opts = typeof options === "boolean" ? { interactive: options } : options;
   const interactive = opts.interactive ?? true;
@@ -12176,25 +12457,25 @@ function createStepRunner(options = true) {
     }
     for (const [i, step] of completedSteps.entries()) {
       if (step.failed) {
-        console.log(chalk56.red(`\u2717 ${step.label}`));
+        console.log(chalk59.red(`\u2717 ${step.label}`));
       } else {
-        console.log(chalk56.green(`\u25CF ${step.label}`));
+        console.log(chalk59.green(`\u25CF ${step.label}`));
       }
       const isLastStep = i === completedSteps.length - 1;
       if (!isLastStep || !isFinal) {
-        console.log(chalk56.dim("\u2502"));
+        console.log(chalk59.dim("\u2502"));
       }
     }
   }
   async function executeStep(label, fn, isFinal) {
     let stepFailed = false;
-    console.log(chalk56.yellow(`\u25CB ${label}`));
+    console.log(chalk59.yellow(`\u25CB ${label}`));
     const ctx = {
       connector() {
-        console.log(chalk56.dim("\u2502"));
+        console.log(chalk59.dim("\u2502"));
       },
       detail(message) {
-        console.log(`${chalk56.dim("\u2502")} ${message}`);
+        console.log(`${chalk59.dim("\u2502")} ${message}`);
       },
       async prompt(promptFn) {
         return await promptFn();
@@ -12211,12 +12492,12 @@ function createStepRunner(options = true) {
         redrawCompletedSteps(isFinal);
       } else {
         if (stepFailed) {
-          console.log(chalk56.red(`\u2717 ${label}`));
+          console.log(chalk59.red(`\u2717 ${label}`));
         } else {
-          console.log(chalk56.green(`\u25CF ${label}`));
+          console.log(chalk59.green(`\u25CF ${label}`));
         }
         if (!isFinal) {
-          console.log(chalk56.dim("\u2502"));
+          console.log(chalk59.dim("\u2502"));
         }
       }
     }
@@ -12374,7 +12655,7 @@ async function setupModelProvider(type, credential, options) {
 
 // src/lib/domain/onboard/claude-setup.ts
 import { spawn as spawn3 } from "child_process";
-import chalk57 from "chalk";
+import chalk60 from "chalk";
 var MARKETPLACE_NAME = "vm0-skills";
 var MARKETPLACE_REPO = "vm0-ai/vm0-skills";
 var PLUGIN_ID = "vm0@vm0-skills";
@@ -12411,12 +12692,12 @@ async function runClaudeCommand(args, cwd) {
 }
 function handlePluginError(error, context) {
   const displayContext = context ?? "Claude plugin";
-  console.error(chalk57.red(`Failed to install ${displayContext}`));
+  console.error(chalk60.red(`Failed to install ${displayContext}`));
   if (error instanceof Error) {
-    console.error(chalk57.red(error.message));
+    console.error(chalk60.red(error.message));
   }
   console.error(
-    chalk57.dim("Please ensure Claude CLI is installed and accessible.")
+    chalk60.dim("Please ensure Claude CLI is installed and accessible.")
   );
   process.exit(1);
 }
@@ -12459,7 +12740,7 @@ async function updateMarketplace() {
   ]);
   if (!result.success) {
     console.warn(
-      chalk57.yellow(
+      chalk60.yellow(
         `Warning: Could not update marketplace: ${result.error ?? "unknown error"}`
       )
     );
@@ -12497,7 +12778,7 @@ async function handleAuthentication(ctx) {
       return;
     }
     if (!ctx.interactive) {
-      console.error(chalk58.red("Error: Not authenticated"));
+      console.error(chalk61.red("Error: Not authenticated"));
       console.error("Run 'vm0 auth login' first or set VM0_TOKEN");
       process.exit(1);
     }
@@ -12505,16 +12786,16 @@ async function handleAuthentication(ctx) {
       onInitiating: () => {
       },
       onDeviceCodeReady: (url, code, expiresIn) => {
-        step.detail(`Copy code: ${chalk58.cyan.bold(code)}`);
-        step.detail(`Open: ${chalk58.cyan(url)}`);
-        step.detail(chalk58.dim(`Expires in ${expiresIn} minutes`));
+        step.detail(`Copy code: ${chalk61.cyan.bold(code)}`);
+        step.detail(`Open: ${chalk61.cyan(url)}`);
+        step.detail(chalk61.dim(`Expires in ${expiresIn} minutes`));
       },
       onPolling: () => {
       },
       onSuccess: () => {
       },
       onError: (error) => {
-        console.error(chalk58.red(`
+        console.error(chalk61.red(`
 ${error.message}`));
         process.exit(1);
       }
@@ -12528,7 +12809,7 @@ async function handleModelProvider(ctx) {
       return;
     }
     if (!ctx.interactive) {
-      console.error(chalk58.red("Error: No model provider configured"));
+      console.error(chalk61.red("Error: No model provider configured"));
       console.error("Run 'vm0 model-provider setup' first");
       process.exit(1);
     }
@@ -12537,19 +12818,19 @@ async function handleModelProvider(ctx) {
     const providerType = await step.prompt(
       () => promptSelect(
         "Select provider type:",
-        choices.map((c22) => ({
-          title: c22.label,
-          value: c22.type
+        choices.map((c23) => ({
+          title: c23.label,
+          value: c23.type
         }))
       )
     );
     if (!providerType) {
       process.exit(0);
     }
-    const selectedChoice = choices.find((c22) => c22.type === providerType);
+    const selectedChoice = choices.find((c23) => c23.type === providerType);
     if (selectedChoice?.helpText) {
       for (const line of selectedChoice.helpText.split("\n")) {
-        step.detail(chalk58.dim(line));
+        step.detail(chalk61.dim(line));
       }
     }
     const credential = await step.prompt(
@@ -12558,7 +12839,7 @@ async function handleModelProvider(ctx) {
       )
     );
     if (!credential) {
-      console.log(chalk58.dim("Cancelled"));
+      console.log(chalk61.dim("Cancelled"));
       process.exit(0);
     }
     let selectedModel;
@@ -12577,7 +12858,7 @@ async function handleModelProvider(ctx) {
         () => promptSelect("Select model:", modelChoices)
       );
       if (modelSelection === void 0) {
-        console.log(chalk58.dim("Cancelled"));
+        console.log(chalk61.dim("Cancelled"));
         process.exit(0);
       }
       selectedModel = modelSelection === "" ? void 0 : modelSelection;
@@ -12587,7 +12868,7 @@ async function handleModelProvider(ctx) {
     });
     const modelNote = result.provider.selectedModel ? ` with model: ${result.provider.selectedModel}` : "";
     step.detail(
-      chalk58.green(
+      chalk61.green(
         `${providerType} ${result.created ? "created" : "updated"}${result.isDefault ? ` (default for ${result.framework})` : ""}${modelNote}`
       )
     );
@@ -12618,7 +12899,7 @@ async function handleAgentCreation(ctx) {
         agentName = inputName;
         if (existsSync11(agentName)) {
           step.detail(
-            chalk58.yellow(`${agentName}/ already exists, choose another name`)
+            chalk61.yellow(`${agentName}/ already exists, choose another name`)
           );
         } else {
           folderExists = false;
@@ -12627,22 +12908,22 @@ async function handleAgentCreation(ctx) {
     } else {
       if (!validateAgentName(agentName)) {
         console.error(
-          chalk58.red(
+          chalk61.red(
             "Invalid agent name: must be 3-64 chars, alphanumeric + hyphens"
           )
         );
         process.exit(1);
       }
       if (existsSync11(agentName)) {
-        console.error(chalk58.red(`${agentName}/ already exists`));
+        console.error(chalk61.red(`${agentName}/ already exists`));
         console.log();
         console.log("Remove it first or choose a different name:");
-        console.log(chalk58.cyan(`  rm -rf ${agentName}`));
+        console.log(chalk61.cyan(`  rm -rf ${agentName}`));
         process.exit(1);
       }
     }
     await mkdir8(agentName, { recursive: true });
-    step.detail(chalk58.green(`Created ${agentName}/`));
+    step.detail(chalk61.green(`Created ${agentName}/`));
   });
   return agentName;
 }
@@ -12658,7 +12939,7 @@ async function handlePluginInstallation(ctx, agentName) {
       shouldInstall = confirmed ?? true;
     }
     if (!shouldInstall) {
-      step.detail(chalk58.dim("Skipped"));
+      step.detail(chalk61.dim("Skipped"));
       return;
     }
     const scope = "project";
@@ -12666,7 +12947,7 @@ async function handlePluginInstallation(ctx, agentName) {
       const agentDir = `${process.cwd()}/${agentName}`;
       const result = await installVm0Plugin(scope, agentDir);
       step.detail(
-        chalk58.green(`Installed ${result.pluginId} (scope: ${result.scope})`)
+        chalk61.green(`Installed ${result.pluginId} (scope: ${result.scope})`)
       );
       pluginInstalled = true;
     } catch (error) {
@@ -12677,18 +12958,18 @@ async function handlePluginInstallation(ctx, agentName) {
 }
 function printNextSteps(agentName, pluginInstalled) {
   console.log();
-  console.log(chalk58.bold("Next step:"));
+  console.log(chalk61.bold("Next step:"));
   console.log();
   if (pluginInstalled) {
     console.log(
-      `  ${chalk58.cyan(`cd ${agentName} && claude "/${PRIMARY_SKILL_NAME} let's build an agent"`)}`
+      `  ${chalk61.cyan(`cd ${agentName} && claude "/${PRIMARY_SKILL_NAME} let's build an agent"`)}`
     );
   } else {
-    console.log(`  ${chalk58.cyan(`cd ${agentName} && vm0 init`)}`);
+    console.log(`  ${chalk61.cyan(`cd ${agentName} && vm0 init`)}`);
   }
   console.log();
 }
-var onboardCommand = new Command57().name("onboard").description("Guided setup for new VM0 users").option("-y, --yes", "Skip confirmation prompts").option("--name <name>", `Agent name (default: ${DEFAULT_AGENT_NAME})`).action(async (options) => {
+var onboardCommand = new Command61().name("onboard").description("Guided setup for new VM0 users").option("-y, --yes", "Skip confirmation prompts").option("--name <name>", `Agent name (default: ${DEFAULT_AGENT_NAME})`).action(async (options) => {
   const interactive = isInteractive();
   if (interactive) {
     process.stdout.write("\x1B[2J\x1B[H");
@@ -12711,15 +12992,15 @@ var onboardCommand = new Command57().name("onboard").description("Guided setup f
 });
 
 // src/commands/setup-claude/index.ts
-import { Command as Command58 } from "commander";
-import chalk59 from "chalk";
-var setupClaudeCommand = new Command58().name("setup-claude").description("Install VM0 Claude Plugin").option("--agent-dir <dir>", "Agent directory to run install in").option("--scope <scope>", "Installation scope (user or project)", "project").action(async (options) => {
-  console.log(chalk59.dim("Installing VM0 Claude Plugin..."));
+import { Command as Command62 } from "commander";
+import chalk62 from "chalk";
+var setupClaudeCommand = new Command62().name("setup-claude").description("Install VM0 Claude Plugin").option("--agent-dir <dir>", "Agent directory to run install in").option("--scope <scope>", "Installation scope (user or project)", "project").action(async (options) => {
+  console.log(chalk62.dim("Installing VM0 Claude Plugin..."));
   const scope = options.scope === "user" ? "user" : "project";
   try {
     const result = await installVm0Plugin(scope, options.agentDir);
     console.log(
-      chalk59.green(`\u2713 Installed ${result.pluginId} (scope: ${result.scope})`)
+      chalk62.green(`\u2713 Installed ${result.pluginId} (scope: ${result.scope})`)
     );
   } catch (error) {
     handlePluginError(error);
@@ -12728,15 +13009,15 @@ var setupClaudeCommand = new Command58().name("setup-claude").description("Insta
   console.log("Next step:");
   const cdPrefix = options.agentDir ? `cd ${options.agentDir} && ` : "";
   console.log(
-    chalk59.cyan(
+    chalk62.cyan(
       `  ${cdPrefix}claude "/${PRIMARY_SKILL_NAME} let's build a workflow"`
     )
   );
 });
 
 // src/index.ts
-var program = new Command59();
-program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.17.2");
+var program = new Command63();
+program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.18.0");
 program.addCommand(authCommand);
 program.addCommand(infoCommand);
 program.addCommand(composeCommand);
@@ -12751,6 +13032,7 @@ program.addCommand(initCommand3);
 program.addCommand(scheduleCommand);
 program.addCommand(usageCommand);
 program.addCommand(secretCommand);
+program.addCommand(variableCommand);
 program.addCommand(modelProviderCommand);
 program.addCommand(onboardCommand);
 program.addCommand(setupClaudeCommand);