@vm0/cli 9.241.9 → 9.241.10

package/{doctor-PGH6KBWK.js → connector-ZRKGMLQV.js}

@@ -3,31 +3,40 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   findFirewallMetadataPermission
-} from "./chunk-HYARATBX.js";
+} from "./chunk-CCNJ3TMS.js";
+import {
+  availableConnectorRefs,
+  findConnectorStatusItem,
+  resolveAgentContext,
+  resolveManualGrantAuthMethod,
+  searchPublicConnectorCatalog
+} from "./chunk-6NDKQYQ7.js";
 import {
   getPlatformOrigin,
   toPlatformUrl
-} from "./chunk-D7WBYCFZ.js";
+} from "./chunk-WUYQH7P6.js";
 import {
   UNKNOWN_PERMISSION_GRANT,
+  connectZeroConnectorManualGrant,
   createComputerUseAuthorizationRequest,
+  customConnectorProposalSchema,
   diagnoseZeroConnectorCheck,
-  diagnoseZeroConnectorPermissionDeny,
+  getZeroAgent,
+  getZeroAgentCustomConnectors,
   getZeroAgentUserConnectors,
-  getZeroBillingStatus,
   getZeroConnector,
   getZeroConnectorCatalogPermissions,
-  getZeroOrg,
-  getZeroOrgMembers,
-  hasUnsafeFirewallPath
-} from "./chunk-PM36DYSC.js";
+  getZeroCustomConnector,
+  listZeroConnectorCatalogStatus,
+  listZeroCustomConnectors
+} from "./chunk-SIG5BQU7.js";
 import "./chunk-LTDQISD7.js";
 import {
   ApiRequestError,
   getApiUrl,
   source_default,
   withErrorHandler
-} from "./chunk-XG3T3KKC.js";
+} from "./chunk-44EKQ5HS.js";
 import "./chunk-LRHXR7JT.js";
 import {
   Command,
@@ -37,11 +46,35 @@ import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
 
-// src/commands/zero/doctor/index.ts
+// src/commands/zero/connector/index.ts
+init_esm_shims();
+
+// src/commands/zero/connector/check.ts
 init_esm_shims();
 
-// src/commands/zero/doctor/check-connector.ts
+// src/commands/zero/connector/computer-use-guidance.ts
 init_esm_shims();
+var COMPUTER_USE_CONNECTOR_REF = "computer-use";
+var COMPUTER_USE_CAPABILITY = "computer-use:write";
+var COMPUTER_USE_PATH_PREFIX = "/computer-use";
+var COMPUTER_USE_PATH_PREFIX_WITH_SLASH = `${COMPUTER_USE_PATH_PREFIX}/`;
+function isComputerUsePermissionTarget(target) {
+  return target.connectorRef === COMPUTER_USE_CONNECTOR_REF || target.permission === COMPUTER_USE_CAPABILITY || target.path === COMPUTER_USE_PATH_PREFIX || target.path?.startsWith(COMPUTER_USE_PATH_PREFIX_WITH_SLASH) === true;
+}
+function printComputerUsePermissionGuidance() {
+  console.log("Computer Use access is not managed as a connector permission.");
+  console.log(
+    "The current run token needs computer-use:write, which is issued only when a Zero Desktop Computer Use host is selected for the chat or thread before the run starts."
+  );
+  console.log(
+    "Open Zero Desktop, make sure Computer Use is online, select the Computer Use host for this chat/thread, then start a new run. Existing run tokens cannot be upgraded in place."
+  );
+  console.log(
+    "Run `zero whoami` to confirm whether the current ZERO_TOKEN includes computer-use:write."
+  );
+}
+
+// src/commands/zero/connector/check.ts
 function stripUrlQueryAndFragment(url) {
   const queryIndex = url.indexOf("?");
   const fragmentIndex = url.indexOf("#");
@@ -74,7 +107,21 @@ function connectorSelectionCommand(url, method, connectorRef) {
   if (method !== "GET") {
     args.push(`--method ${shellQuoteArg(method)}`);
   }
-  return `zero doctor check-connector ${args.join(" ")}`;
+  return `zero connector check ${args.join(" ")}`;
+}
+function rawPathFromUrl(url) {
+  const sanitizedUrl = stripUrlQueryAndFragment(url);
+  const schemeEnd = sanitizedUrl.indexOf("://");
+  if (schemeEnd === -1) return void 0;
+  const pathStart = sanitizedUrl.indexOf("/", schemeEnd + 3);
+  return pathStart === -1 ? "/" : sanitizedUrl.slice(pathStart);
+}
+function isComputerUseCheckTarget(opts) {
+  return isComputerUsePermissionTarget({
+    connectorRef: opts.connector ?? "",
+    path: opts.url === void 0 ? void 0 : rawPathFromUrl(opts.url),
+    permission: opts.checkPermission
+  });
 }
 function validateCheckConnectorOptions(opts, command) {
   const hasUrl = opts.url !== void 0;
@@ -141,15 +188,15 @@ function unsafeInputError(reason) {
   switch (reason) {
     case "invalid-method":
       return new Error(
-        "check-connector requires --method to be a supported HTTP method."
+        "connector check requires --method to be a supported HTTP method."
       );
     case "invalid-url":
       return new Error(
-        "check-connector requires --url to be a valid absolute http or https URL."
+        "connector check requires --url to be a valid absolute http or https URL."
       );
     case "unsafe-path":
       return new Error(
-        "check-connector cannot diagnose unsafe URL paths because they are blocked before permission policy evaluation."
+        "connector check cannot diagnose unsafe URL paths because they are blocked before permission policy evaluation."
       );
   }
 }
@@ -433,7 +480,7 @@ function printUnavailablePolicy(policy) {
       return;
   }
 }
-function printNamedPolicyResult(permission, policy) {
+function printNamedPolicyResult(connectorRef, permission, policy) {
   switch (policy.outcome) {
     case "allow": {
       switch (policy.basis) {
@@ -464,19 +511,25 @@ function printNamedPolicyResult(permission, policy) {
       console.log(
         policy.basis === "deny-list" ? `Result: "${permission}" is in the deny list \u2014 denied.` : `Result: The unknown-endpoint policy denies "${permission}".`
       );
+      console.log(
+        `To request this permission, run: ${permissionRequestCommand(connectorRef, permission)}`
+      );
       return;
     case "ask":
       console.log(
         policy.basis === "ask-list" ? `Result: "${permission}" is in the ask list \u2014 blocked until approval.` : `Result: The unknown-endpoint policy blocks "${permission}" until approval.`
       );
+      console.log(
+        `To request this permission, run: ${permissionRequestCommand(connectorRef, permission)}`
+      );
       return;
     case "unavailable":
       printUnavailablePolicy(policy);
       return;
   }
 }
-function unknownPermissionChangeCommand(connectorRef) {
-  return `zero doctor permission-change ${connectorRef} --permission __unknown__ --enable --duration 1h`;
+function permissionRequestCommand(connectorRef, permission) {
+  return `zero connector permission-request ${connectorRef} --permission ${permission} --duration 1h`;
 }
 function printUnknownEndpointPolicy(connectorRef, policy) {
   switch (policy.outcome) {
@@ -490,7 +543,7 @@ function printUnknownEndpointPolicy(connectorRef, policy) {
         "Result: No permission matched. The unknown endpoint policy denies this request."
       );
       console.log(
-        `To allow unknown endpoints, run: ${unknownPermissionChangeCommand(connectorRef)}`
+        `To request access to unknown endpoints, run: ${permissionRequestCommand(connectorRef, "__unknown__")}`
       );
       return;
     case "ask":
@@ -498,7 +551,7 @@ function printUnknownEndpointPolicy(connectorRef, policy) {
         "Result: No permission matched. The unknown endpoint policy requires approval."
       );
       console.log(
-        `To allow unknown endpoints, run: ${unknownPermissionChangeCommand(connectorRef)}`
+        `To request access to unknown endpoints, run: ${permissionRequestCommand(connectorRef, "__unknown__")}`
       );
       return;
     case "unavailable":
@@ -521,7 +574,11 @@ function printUrlPermissionDiagnostic(result) {
     );
     console.log("");
     for (const permission of result.permission.permissions) {
-      printNamedPolicyResult(permission.name, permission.policy);
+      printNamedPolicyResult(
+        result.connector.connectorRef,
+        permission.name,
+        permission.policy
+      );
     }
   } else {
     console.log(
@@ -550,7 +607,11 @@ function printEnvironmentPermissionDiagnostic(result, permissionName) {
     `Checking permission: "${permissionName}" for the ${result.connector.label} connector.`
   );
   console.log("");
-  printNamedPolicyResult(permissionName, result.permission);
+  printNamedPolicyResult(
+    result.connector.connectorRef,
+    permissionName,
+    result.permission
+  );
   console.log("");
 }
 function printRediagnoseHint(opts, method) {
@@ -573,10 +634,10 @@ function printRediagnoseHint(opts, method) {
     args.push(`--check-permission ${shellQuoteArg(opts.checkPermission)}`);
   }
   console.log(
-    `To re-diagnose after changes, run: zero doctor check-connector ${args.join(" ")}`
+    `To re-diagnose after changes, run: zero connector check ${args.join(" ")}`
   );
 }
-var checkConnectorCommand = new Command().name("check-connector").description(
+var checkConnectorCommand = new Command().name("check").description(
   "Diagnose connector health: environment names, connector configuration, and permission policies"
 ).addOption(
   new Option(
@@ -596,7 +657,7 @@ var checkConnectorCommand = new Command().name("check-connector").description(
 ).addOption(
   new Option(
     "--method <METHOD>",
-    "HTTP method to use when matching permissions with --url (default: GET)"
+    "HTTP method to use when matching permissions with --url"
   ).default("GET")
 ).addOption(
   new Option(
@@ -607,11 +668,11 @@ var checkConnectorCommand = new Command().name("check-connector").description(
   "after",
   `
 Examples:
-  zero doctor check-connector --env-name GITHUB_TOKEN
-  zero doctor check-connector --url https://api.github.com/repos/owner/repo
-  zero doctor check-connector --url https://api.accounts.nintendo.com/2.0.0/users/me --connector nintendo-store
-  zero doctor check-connector --url https://slack.com/api/chat.postMessage --method POST
-  zero doctor check-connector --env-name SLACK_TOKEN --check-permission chat:write
+  zero connector check --env-name GITHUB_TOKEN
+  zero connector check --url https://api.github.com/repos/owner/repo
+  zero connector check --url https://api.accounts.nintendo.com/2.0.0/users/me --connector nintendo-store
+  zero connector check --url https://slack.com/api/chat.postMessage --method POST
+  zero connector check --env-name SLACK_TOKEN --check-permission chat:write
 
 How connectors work:
   A Connector holds the real credentials for an external service. These credentials
@@ -623,6 +684,10 @@ How connectors work:
 ).action(
   withErrorHandler(async (opts, command) => {
     validateCheckConnectorOptions(opts, command);
+    if (isComputerUseCheckTarget(opts)) {
+      printComputerUsePermissionGuidance();
+      return;
+    }
     const method = opts.method.toUpperCase();
     const request = buildDiagnosticRequest(opts, method);
     const diagnostic = await diagnoseZeroConnectorCheck(request);
@@ -665,254 +730,522 @@ How connectors work:
   })
 );
 
-// src/commands/zero/doctor/permission-deny.ts
-init_esm_shims();
-
-// src/commands/zero/doctor/computer-use-guidance.ts
+// src/commands/zero/connector/connect.ts
 init_esm_shims();
-var COMPUTER_USE_CONNECTOR_REF = "computer-use";
-var COMPUTER_USE_CAPABILITY = "computer-use:write";
-var COMPUTER_USE_PATH_PREFIX = "/computer-use";
-var COMPUTER_USE_PATH_PREFIX_WITH_SLASH = `${COMPUTER_USE_PATH_PREFIX}/`;
-function isComputerUsePermissionTarget(target) {
-  return target.connectorRef === COMPUTER_USE_CONNECTOR_REF || target.permission === COMPUTER_USE_CAPABILITY || target.path === COMPUTER_USE_PATH_PREFIX || target.path?.startsWith(COMPUTER_USE_PATH_PREFIX_WITH_SLASH) === true;
+function collectValue(value, previous) {
+  return [...previous, value];
 }
-function printComputerUsePermissionGuidance() {
-  console.log("Computer Use access is not managed as a connector permission.");
-  console.log(
-    "The current run token needs computer-use:write, which is issued only when a Zero Desktop Computer Use host is selected for the chat or thread before the run starts."
-  );
-  console.log(
-    "Open Zero Desktop, make sure Computer Use is online, select the Computer Use host for this chat/thread, then start a new run. Existing run tokens cannot be upgraded in place."
-  );
-  console.log(
-    "Run `zero whoami` to confirm whether the current ZERO_TOKEN includes computer-use:write."
-  );
+function parseConnectorValues(rawValues) {
+  if (!rawValues || rawValues.length === 0) {
+    throw new Error("At least one --value NAME=VALUE is required", {
+      cause: new Error(
+        "Example: zero connector connect zendesk --value apiToken=token"
+      )
+    });
+  }
+  const values = {};
+  for (const rawValue of rawValues) {
+    const separatorIndex = rawValue.indexOf("=");
+    if (separatorIndex <= 0) {
+      throw new Error("Invalid --value format", {
+        cause: new Error("Use --value NAME=VALUE")
+      });
+    }
+    const name = rawValue.slice(0, separatorIndex);
+    if (!name.trim()) {
+      throw new Error("Invalid --value format", {
+        cause: new Error("Field name cannot be empty")
+      });
+    }
+    values[name] = rawValue.slice(separatorIndex + 1);
+  }
+  return values;
 }
+var connectCommand = new Command().name("connect").description("Connect a connector with manual grant values").argument("<type>", "Connector type (e.g., zendesk)").option("--auth-method <method>", "Connector auth method to use").option(
+  "--value <name=value>",
+  "Connector field value; repeat for multiple fields",
+  collectValue,
+  []
+).option("--json", "Print the connector response as JSON").action(
+  withErrorHandler(async (type, options) => {
+    const values = parseConnectorValues(options.value);
+    const catalog = await listZeroConnectorCatalogStatus();
+    const connectorMetadata = findConnectorStatusItem(
+      catalog.connectors,
+      type
+    );
+    if (!connectorMetadata) {
+      throw new Error(`Unknown or unavailable connector: ${type}`, {
+        cause: new Error(
+          `Available connectors: ${availableConnectorRefs(catalog.connectors)}`
+        )
+      });
+    }
+    const authMethod = resolveManualGrantAuthMethod(
+      connectorMetadata,
+      options.authMethod
+    );
+    const connector = await connectZeroConnectorManualGrant(
+      connectorMetadata.connectorRef,
+      authMethod.id,
+      values
+    );
+    if (options.json) {
+      console.log(JSON.stringify(connector, null, 2));
+      return;
+    }
+    console.log(source_default.green(`\u2713 ${connectorMetadata.label} connected`));
+    console.log(source_default.dim(`  Type: ${connector.type}`));
+    console.log(source_default.dim(`  Auth Method: ${connector.authMethod}`));
+    console.log(source_default.dim(`  Run: zero connector status ${connector.type}`));
+  })
+);
 
-// src/commands/zero/doctor/permission-deny.ts
-var VALID_DENIED_METHODS = /* @__PURE__ */ new Set([
-  "GET",
-  "POST",
-  "PUT",
-  "PATCH",
-  "DELETE",
-  "HEAD",
-  "OPTIONS"
-]);
-function unknownPermissionChangeCommand2(connectorRef) {
-  return `zero doctor permission-change ${connectorRef} --permission ${UNKNOWN_PERMISSION_GRANT} --enable --duration 1h`;
-}
-function pathOnlyError() {
-  return new Error(
-    "permission-deny now requires --url because method/path alone can match the wrong API base."
-  );
-}
-function invalidUrlError() {
-  return new Error(
-    "permission-deny requires --url to be a valid absolute http or https URL."
-  );
-}
-function invalidMethodError() {
-  return new Error(
-    "permission-deny requires --method to be one of GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS."
-  );
-}
-function unsafePathError() {
-  return new Error(
-    "permission-deny cannot diagnose unsafe URL paths because they are blocked before permission policy evaluation."
-  );
-}
-function parseDeniedMethod(method) {
-  const upperMethod = method.toUpperCase();
-  if (!VALID_DENIED_METHODS.has(upperMethod)) {
-    throw invalidMethodError();
+// src/commands/zero/connector/list.ts
+init_esm_shims();
+
+// src/commands/zero/connector/connected-as.ts
+init_esm_shims();
+function renderIdentity(connector) {
+  if (connector.connection?.externalUsername) {
+    return `@${connector.connection.externalUsername}`;
   }
-  return upperMethod;
+  if (connector.connection?.externalEmail)
+    return connector.connection.externalEmail;
+  return "-";
 }
-function rawAuthorityFromDeniedUrl(url) {
-  const schemeEnd = url.indexOf("://");
-  if (schemeEnd === -1) return null;
-  const authorityStart = schemeEnd + 3;
-  let authorityEnd = url.length;
-  for (const delimiter of ["/", "?", "#"]) {
-    const index = url.indexOf(delimiter, authorityStart);
-    if (index !== -1) authorityEnd = Math.min(authorityEnd, index);
+function renderConnectedAsCell(connector) {
+  if (!connector || connector.connectionStatus === "not-connected") {
+    return source_default.dim("(not connected)");
   }
-  return url.slice(authorityStart, authorityEnd);
-}
-function rawAuthorityHasUnsafeSyntax(url) {
-  const authority = rawAuthorityFromDeniedUrl(url);
-  if (authority === null) return false;
-  return authority === "" || authority.includes("\\") || authority.includes("%") || [...authority].some((char) => {
-    return char.charCodeAt(0) > 127;
-  });
-}
-function validateDeniedUrl(url) {
-  if (!url.includes("://") || /\s/.test(url) || rawAuthorityHasUnsafeSyntax(url)) {
-    throw invalidUrlError();
+  const identity = renderIdentity(connector);
+  if (connector.connectionStatus === "reconnect-required") {
+    return source_default.yellow(`${identity} (reconnect needed)`);
   }
-  try {
-    const parsed = new URL(url);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw invalidUrlError();
-    }
-    if (parsed.username !== "" || parsed.password !== "") {
-      throw invalidUrlError();
-    }
-  } catch {
-    throw invalidUrlError();
+  if (connector.scopeMismatch || connector.connectionStatus === "scope-mismatch") {
+    return source_default.yellow(`${identity} (permissions update available)`);
   }
+  return identity;
 }
-function stripUrlQueryAndFragment2(url) {
-  const queryIndex = url.indexOf("?");
-  const fragmentIndex = url.indexOf("#");
-  let end = url.length;
-  if (queryIndex !== -1) end = Math.min(end, queryIndex);
-  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);
-  return url.slice(0, end);
+var ESC = "\x1B";
+var ANSI_PATTERN = new RegExp(`${ESC}\\[[0-9;]*m`, "g");
+function stripAnsi(s) {
+  return s.replace(ANSI_PATTERN, "");
 }
-function rawPathFromDeniedUrl(url) {
-  const urlWithoutQuery = stripUrlQueryAndFragment2(url);
-  const schemeEnd = urlWithoutQuery.indexOf("://");
-  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;
-  const pathStart = urlWithoutQuery.indexOf("/", authorityStart);
-  return pathStart === -1 ? "/" : urlWithoutQuery.slice(pathStart);
+function padEndAnsi(s, width) {
+  const visible = stripAnsi(s).length;
+  return s + " ".repeat(Math.max(0, width - visible));
 }
-function printPermissionChangeGuidance(connectorRef, permissions) {
-  const sortedPermissions = [...permissions].sort();
-  if (sortedPermissions.length === 1) {
-    const permission = sortedPermissions[0];
-    console.log(`This is covered by the "${permission}" permission.`);
+
+// src/commands/zero/connector/list.ts
+var listCommand = new Command().name("list").alias("ls").description("List all connectors and their status").option("--agent <id>", "Show per-agent authorization column").action(
+  withErrorHandler(async (options) => {
+    const [{ connectors }, agentCtx] = await Promise.all([
+      listZeroConnectorCatalogStatus(),
+      resolveAgentContext(options.agent)
+    ]);
+    const allTypes = connectors.map((connector) => {
+      return connector.connectorRef;
+    });
+    const typeWidth = Math.max(
+      4,
+      ...allTypes.map((t) => {
+        return t.length;
+      })
+    );
+    const connectedAsHeader = "CONNECTED AS";
+    const connectedCells = connectors.map((connector) => {
+      return renderConnectedAsCell(connector);
+    });
+    const connectedAsWidth = Math.max(
+      connectedAsHeader.length,
+      ...connectedCells.map((c) => {
+        return stripAnsi(c).length;
+      })
+    );
+    const authorizedHeader = agentCtx ? `AUTHORIZED FOR ${agentCtx.displayName}` : null;
+    const headerParts = [
+      "TYPE".padEnd(typeWidth),
+      connectedAsHeader.padEnd(connectedAsWidth)
+    ];
+    if (authorizedHeader) headerParts.push(authorizedHeader);
+    console.log(source_default.dim(headerParts.join("  ")));
+    for (let i = 0; i < allTypes.length; i++) {
+      const type = allTypes[i];
+      const connectedCell = padEndAnsi(connectedCells[i], connectedAsWidth);
+      const parts = [type.padEnd(typeWidth), connectedCell];
+      if (agentCtx) {
+        parts.push(
+          agentCtx.authorizedTypes.has(type) ? source_default.green("\u2713") : source_default.dim("-")
+        );
+      }
+      console.log(parts.join("  "));
+    }
+  })
+);
+
+// src/commands/zero/connector/search.ts
+init_esm_shims();
+var DEFAULT_LIMIT = 5;
+var EXACT_MATCH_THRESHOLD = 80;
+function parseLimit(raw) {
+  const trimmed = raw.trim();
+  const n = Number(trimmed);
+  if (!/^\d+$/.test(trimmed) || !Number.isSafeInteger(n) || n <= 0) {
+    throw new Error(`--limit must be a positive integer, got "${raw}".`);
+  }
+  return n;
+}
+var searchCommand = new Command().name("search").description(
+  "Search connectors by type, label, category, generation type, or tag"
+).argument("<keyword>", "Search keyword (case-insensitive)").option("--agent <id>", "Show per-agent authorization column").option(
+  "--limit <n>",
+  `Maximum number of results to display (default ${DEFAULT_LIMIT})`,
+  parseLimit,
+  DEFAULT_LIMIT
+).action(
+  withErrorHandler(
+    async (keyword, options) => {
+      const trimmed = keyword.trim();
+      if (!trimmed) {
+        throw new Error("Keyword cannot be empty.");
+      }
+      const [{ connectors }, agentCtx] = await Promise.all([
+        listZeroConnectorCatalogStatus(),
+        resolveAgentContext(options.agent)
+      ]);
+      const { results, total } = searchPublicConnectorCatalog(
+        connectors,
+        trimmed,
+        options.limit
+      );
+      if (results.length === 0) {
+        console.log("No matches found.");
+        return;
+      }
+      const topScore = results[0].score;
+      if (topScore < EXACT_MATCH_THRESHOLD) {
+        console.log("No exact match. Showing closest:");
+      }
+      if (total > options.limit) {
+        console.log(`Too many results (top ${options.limit} of ${total}):`);
+      }
+      const typeHeader = "TYPE";
+      const connectedAsHeader = "CONNECTED AS";
+      const connectedCells = results.map((r) => {
+        return renderConnectedAsCell(r.connector);
+      });
+      const typeWidth = Math.max(
+        typeHeader.length,
+        ...results.map((r) => {
+          return r.connector.connectorRef.length;
+        })
+      );
+      const connectedAsWidth = Math.max(
+        connectedAsHeader.length,
+        ...connectedCells.map((c) => {
+          return stripAnsi(c).length;
+        })
+      );
+      const headerParts = [
+        typeHeader.padEnd(typeWidth),
+        connectedAsHeader.padEnd(connectedAsWidth)
+      ];
+      if (agentCtx) {
+        headerParts.push(`AUTHORIZED FOR ${agentCtx.displayName}`);
+      }
+      console.log(source_default.dim(headerParts.join("  ")));
+      for (let i = 0; i < results.length; i++) {
+        const result = results[i];
+        const parts = [
+          result.connector.connectorRef.padEnd(typeWidth),
+          padEndAnsi(connectedCells[i], connectedAsWidth)
+        ];
+        if (agentCtx) {
+          parts.push(
+            agentCtx.authorizedTypes.has(result.connector.connectorRef) ? source_default.green("\u2713") : source_default.dim("-")
+          );
+        }
+        console.log(parts.join("  "));
+      }
+    }
+  )
+);
+
+// src/commands/zero/connector/status.ts
+init_esm_shims();
+var LABEL_WIDTH = 16;
+function printConnectorDetails(connector) {
+  if (connector.connectionStatus === "not-connected") {
     console.log(
-      `To allow this permission, run: zero doctor permission-change ${connectorRef} --permission ${permission} --enable --duration 1h`
+      `${"Status:".padEnd(LABEL_WIDTH)}${source_default.dim("not connected")}`
     );
     return;
   }
   console.log(
-    `This is covered by these permissions: ${sortedPermissions.join(", ")}.`
+    `${"Status:".padEnd(LABEL_WIDTH)}${connector.connectionStatus === "reconnect-required" ? source_default.yellow("reconnect needed") : source_default.green("connected")}`
   );
-  for (const permission of sortedPermissions) {
+  if (connector.connection?.externalUsername) {
+    console.log(
+      `${"Account:".padEnd(LABEL_WIDTH)}@${connector.connection.externalUsername}`
+    );
+  } else if (connector.connection?.externalEmail) {
+    console.log(
+      `${"Account:".padEnd(LABEL_WIDTH)}${connector.connection.externalEmail}`
+    );
+  }
+  if (connector.connection?.authMethod) {
     console.log(
-      `To allow ${permission}, run: zero doctor permission-change ${connectorRef} --permission ${permission} --enable --duration 1h`
+      `${"Auth Method:".padEnd(LABEL_WIDTH)}${connector.connection.authMethod}`
+    );
+  }
+  if (connector.scopeMismatch) {
+    console.log(
+      `${"Permissions:".padEnd(LABEL_WIDTH)}${source_default.yellow("update available")}`
+    );
+  }
+  if (connector.tokenExpiresAt) {
+    console.log(
+      `${"Token Expires:".padEnd(LABEL_WIDTH)}${connector.tokenExpiresAt}`
     );
   }
 }
-function printFilteredRequest(label, method, relativePath, base) {
-  console.log(
-    `The ${label} permission filtered ${method} ${relativePath} relative to base URL ${base}.`
-  );
+async function printAgentAction(connector, agentCtx) {
+  const connectorRef = connector.connectorRef;
+  const authorized = agentCtx.authorizedTypes.has(connectorRef);
+  const isConnected = connector.connected;
+  const needsReconnect = connector.connectionStatus === "reconnect-required";
+  const agentLabel = agentCtx.displayName === agentCtx.agentId ? agentCtx.agentId : `${agentCtx.displayName} (${agentCtx.agentId})`;
+  console.log();
+  if (needsReconnect) {
+    const origin = await getPlatformOrigin();
+    const url = `${origin}/connectors`;
+    console.log(
+      `The ${connectorRef} connector is connected but needs to be reconnected before agent ${agentLabel} can use it.`
+    );
+    console.log(`Reconnect it at: [Reconnect ${connectorRef}](${url})`);
+  } else if (authorized && !isConnected) {
+    const origin = await getPlatformOrigin();
+    const url = `${origin}/connectors/${connectorRef}/connect?agentId=${agentCtx.agentId}`;
+    console.log(
+      `The ${connectorRef} connector is authorized for agent ${agentLabel}, but it is not connected.`
+    );
+    console.log(`Connect it at: [Connect ${connectorRef}](${url})`);
+  } else if (authorized) {
+    console.log(
+      `The ${connectorRef} connector is authorized for agent ${agentLabel}.`
+    );
+  } else if (!isConnected) {
+    const origin = await getPlatformOrigin();
+    const url = `${origin}/connectors/${connectorRef}/connect?agentId=${agentCtx.agentId}`;
+    console.log(
+      `The ${connectorRef} connector is not connected. Once connected, it will be authorized for agent ${agentLabel}.`
+    );
+    console.log(
+      `Connect and authorize it at: [Connect ${connectorRef}](${url})`
+    );
+  } else {
+    const origin = await getPlatformOrigin();
+    const url = `${origin}/connectors/${connectorRef}/authorize?agentId=${agentCtx.agentId}`;
+    console.log(
+      `The ${connectorRef} connector is not authorized for agent ${agentLabel}.`
+    );
+    console.log(`Authorize it at: [Authorize ${connectorRef}](${url})`);
+  }
 }
-function unsafeInputError2(reason) {
-  switch (reason) {
-    case "invalid-method":
-      return invalidMethodError();
-    case "invalid-url":
-      return invalidUrlError();
-    case "unsafe-path":
-      return unsafePathError();
+async function printStandaloneAction(connector) {
+  const connectorRef = connector.connectorRef;
+  if (connector.connectionStatus === "connected" || connector.connectionStatus === "scope-mismatch") {
+    return;
+  }
+  const origin = await getPlatformOrigin();
+  console.log();
+  if (connector.connectionStatus === "reconnect-required") {
+    const url = `${origin}/connectors`;
+    console.log(
+      `The ${connectorRef} connector is connected but needs to be reconnected.`
+    );
+    console.log(`Reconnect it at: [Reconnect ${connectorRef}](${url})`);
+  } else {
+    const url = `${origin}/connectors/${connectorRef}/connect`;
+    console.log(`Connect it at: [Connect ${connectorRef}](${url})`);
   }
 }
-function handleDiagnosticResult(connectorRef, method, result) {
-  switch (result.outcome) {
-    case "matched":
-      printFilteredRequest(
-        result.label,
-        method,
-        result.relativePath,
-        result.base
-      );
-      printPermissionChangeGuidance(connectorRef, result.permissions);
-      return;
-    case "unknown-endpoint":
-      printFilteredRequest(
-        result.label,
-        method,
-        result.relativePath,
-        result.base
-      );
-      console.log("No named permission was found covering this request.");
-      console.log("This request is governed by the unknown endpoint policy.");
+var statusCommand = new Command().name("status").description("Show detailed status of a connector").argument("<type>", "Connector type (e.g., github)").option("--agent <id>", "Show authorization state for the given agent").action(
+  withErrorHandler(async (type, options) => {
+    const [catalog, agentCtx] = await Promise.all([
+      listZeroConnectorCatalogStatus(),
+      resolveAgentContext(options.agent)
+    ]);
+    const connector = findConnectorStatusItem(catalog.connectors, type);
+    if (!connector) {
+      throw new Error(`Unknown or unavailable connector: ${type}`, {
+        cause: new Error(
+          `Available connectors: ${availableConnectorRefs(catalog.connectors)}`
+        )
+      });
+    }
+    console.log(`Connector: ${source_default.cyan(connector.connectorRef)}`);
+    console.log();
+    printConnectorDetails(connector);
+    if (agentCtx) {
+      await printAgentAction(connector, agentCtx);
+    } else {
+      await printStandaloneAction(connector);
+    }
+  })
+);
+
+// src/commands/zero/connector/custom/index.ts
+init_esm_shims();
+import { readFile } from "fs/promises";
+var LABEL_WIDTH2 = 18;
+function renderConnected(connector) {
+  if (connector.connected) {
+    return source_default.green("connected");
+  }
+  if (connector.missingRequiredFields.length === 0) {
+    return source_default.dim("not connected");
+  }
+  return source_default.yellow(`missing ${connector.missingRequiredFields.join(", ")}`);
+}
+function encodeBase64UrlJson(value) {
+  return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+}
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function resolveCustomAgentContext(agentId) {
+  const resolvedAgentId = agentId ?? process.env.ZERO_AGENT_ID;
+  if (!resolvedAgentId) {
+    return null;
+  }
+  const [agent, enabledIds] = await Promise.all([
+    getZeroAgent(resolvedAgentId),
+    getZeroAgentCustomConnectors(resolvedAgentId)
+  ]);
+  return {
+    agentId: agent.agentId,
+    displayName: agent.displayName ?? agent.agentId,
+    authorizedIds: new Set(enabledIds)
+  };
+}
+var listCommand2 = new Command().name("list").alias("ls").description("List org custom connectors").option("--agent <id>", "Show per-agent authorization column").action(
+  withErrorHandler(async (options) => {
+    const [connectors, agentCtx] = await Promise.all([
+      listZeroCustomConnectors(),
+      resolveCustomAgentContext(options.agent)
+    ]);
+    const idWidth = Math.max(
+      2,
+      ...connectors.map((connector) => {
+        return connector.id.length;
+      })
+    );
+    const nameWidth = Math.max(
+      4,
+      ...connectors.map((connector) => {
+        return connector.displayName.length;
+      })
+    );
+    const header = ["ID".padEnd(idWidth), "NAME".padEnd(nameWidth), "STATUS"];
+    if (agentCtx) {
+      header.push(`AUTHORIZED FOR ${agentCtx.displayName}`);
+    }
+    console.log(source_default.dim(header.join("  ")));
+    for (const connector of connectors) {
+      const row = [
+        connector.id.padEnd(idWidth),
+        connector.displayName.padEnd(nameWidth),
+        renderConnected(connector)
+      ];
+      if (agentCtx) {
+        row.push(
+          agentCtx.authorizedIds.has(connector.id) ? source_default.green("\u2713") : source_default.dim("-")
+        );
+      }
+      console.log(row.join("  "));
+    }
+  })
+);
+var statusCommand2 = new Command().name("status").description("Show detailed status of a custom connector").argument("<connector-id>", "Custom connector id").option("--agent <id>", "Show authorization state for the given agent").action(
+  withErrorHandler(
+    async (connectorId, options) => {
+      const [connector, agentCtx] = await Promise.all([
+        getZeroCustomConnector(connectorId),
+        resolveCustomAgentContext(options.agent)
+      ]);
+      if (!connector) {
+        throw new Error(`Custom connector not found: ${connectorId}`);
+      }
+      console.log(`Custom connector: ${source_default.cyan(connector.displayName)}`);
+      console.log();
+      console.log(`${"ID:".padEnd(LABEL_WIDTH2)}${connector.id}`);
       console.log(
-        `To allow unknown endpoints, run: ${unknownPermissionChangeCommand2(connectorRef)}`
+        `${"Status:".padEnd(LABEL_WIDTH2)}${renderConnected(connector)}`
       );
-      return;
-    case "unknown-connector":
-      throw new Error(`Unknown connector type: ${connectorRef}`);
-    case "no-matching-base":
-      throw new Error(
-        `No registered ${result.label} base URL matches the provided URL.`
+      console.log(
+        `${"Prefixes:".padEnd(LABEL_WIDTH2)}${connector.prefixTemplates.join(", ")}`
       );
-    case "unresolved-dynamic-base":
-      throw new Error(
-        `No authoritative ${result.label} base URL is available for this diagnostic. Verify the ${connectorRef} connector configuration for the affected context and retry.`
+      console.log(
+        `${"Fields:".padEnd(LABEL_WIDTH2)}${connector.fields.map((field) => {
+          return `${field.kind}:${field.key}${field.required ? "" : "?"}`;
+        }).join(", ")}`
       );
-    case "unsafe-input":
-      throw unsafeInputError2(result.reason);
-  }
-  const exhaustiveResult = result;
-  return exhaustiveResult;
-}
-var permissionDenyCommand = new Command().name("permission-deny").description(
-  "Diagnose a permission denial and find the permission that covers it"
-).argument("<connector-ref>", "The connector type (e.g. github)").addOption(
-  new Option(
-    "--method <method>",
-    "The denied HTTP method"
-  ).makeOptionMandatory()
-).addOption(
-  new Option(
-    "--url <url>",
-    "The denied request URL; query strings are ignored (required)"
-  )
-).addOption(new Option("--path <path>", "Deprecated: use --url").hideHelp()).addHelpText(
-  "after",
-  `
-Examples:
-  zero doctor permission-deny github --method GET --url https://api.github.com/repos/owner/repo/pulls
-  zero doctor permission-deny slack --method POST --url https://slack.com/api/chat.postMessage
-  zero doctor permission-deny youtube --method PUT --url https://youtube.googleapis.com/upload/youtube/v3/videos
-
-Notes:
-  - Identifies which named permission covers a denied request
-  - If the firewall denial response includes a url field, pass that value to --url
-  - Requires the denied URL origin and path because method/path alone can match the wrong API base
-  - Query strings and fragments are ignored for matching; omit them when they may contain secrets
-  - Use permission-change to request or enable the permission
-  - Permission-change enable requests default to --duration 1h; pick 24h, 7d, or always only when appropriate`
-).action(
-  withErrorHandler(
-    async (connectorRef, opts) => {
-      if (opts.path !== void 0) {
-        throw pathOnlyError();
+      if (connector.headerInjections.length > 0) {
+        console.log(
+          `${"Headers:".padEnd(LABEL_WIDTH2)}${connector.headerInjections.map((header) => {
+            return header.name;
+          }).join(", ")}`
+        );
       }
-      if (!opts.url) {
-        throw pathOnlyError();
+      if (connector.queryInjections.length > 0) {
+        console.log(
+          `${"Query params:".padEnd(LABEL_WIDTH2)}${connector.queryInjections.map((query) => {
+            return query.name;
+          }).join(", ")}`
+        );
       }
-      const method = parseDeniedMethod(opts.method);
-      validateDeniedUrl(opts.url);
-      const deniedPath = rawPathFromDeniedUrl(opts.url);
-      if (hasUnsafeFirewallPath(deniedPath)) {
-        throw unsafePathError();
+      if (agentCtx) {
+        console.log(
+          `${"Authorized:".padEnd(LABEL_WIDTH2)}${agentCtx.authorizedIds.has(connector.id) ? source_default.green("yes") : source_default.yellow("no")}`
+        );
       }
-      if (isComputerUsePermissionTarget({
-        connectorRef,
-        path: deniedPath
-      })) {
-        printComputerUsePermissionGuidance();
-        return;
+    }
+  )
+);
+var proposeCommand = new Command().name("propose").description("Create a browser save link for a custom connector proposal").requiredOption("--proposal-file <path>", "JSON proposal file").option("--connector-id <id>", "Override connector id for update proposals").option("--agent <id>", "Authorize this agent when the proposal is saved").action(
+  withErrorHandler(
+    async (options) => {
+      const raw = await readFile(options.proposalFile, "utf8");
+      const proposalJson = JSON.parse(raw);
+      if (!isJsonObject(proposalJson)) {
+        throw new Error("Proposal file must contain a JSON object");
       }
-      const result = await diagnoseZeroConnectorPermissionDeny(
-        connectorRef,
-        method,
-        stripUrlQueryAndFragment2(opts.url)
+      const parsed = customConnectorProposalSchema.parse({
+        ...proposalJson,
+        ...options.connectorId ? { connectorId: options.connectorId } : {}
+      });
+      const origin = await getPlatformOrigin();
+      const params = new URLSearchParams({
+        p: encodeBase64UrlJson(parsed)
+      });
+      const agentId = options.agent ?? process.env.ZERO_AGENT_ID;
+      if (agentId) {
+        params.set("agentId", agentId);
+      }
+      const url = `${origin}/connectors/custom/proposal?${params.toString()}`;
+      console.log(`[Configure ${parsed.displayName}](${url})`);
+      console.log();
+      console.log(
+        "Open this link to review, save values, and authorize the connector."
       );
-      handleDiagnosticResult(connectorRef, method, result);
     }
   )
 );
+var customConnectorCommand = new Command().name("custom").description("Inspect and propose org custom connectors").addCommand(listCommand2).addCommand(statusCommand2).addCommand(proposeCommand);
 
-// src/commands/zero/doctor/permission-change.ts
+// src/commands/zero/connector/permission-request.ts
 init_esm_shims();
 var DEFAULT_PERMISSION_GRANT_DURATION = "1h";
 var PERMISSION_GRANT_DURATIONS = [
@@ -924,8 +1257,7 @@ var PERMISSION_GRANT_DURATIONS = [
 function permissionDescription(permission) {
   return permission === UNKNOWN_PERMISSION_GRANT ? "unknown endpoints" : `the "${permission}" permission`;
 }
-function printSensitivePermissionGuidance(connectorRef, permission, action) {
-  if (action !== "enable") return;
+function printSensitivePermissionGuidance(connectorRef, permission) {
   if (connectorRef === "slack" && permission === "chat:write") {
     console.log("");
     console.log(
@@ -953,16 +1285,13 @@ function printSensitivePermissionGuidance(connectorRef, permission, action) {
     console.log("");
   }
 }
-function printPermissionActionMessage(args) {
-  const grantAction = args.action === "enable" ? "allow" : "deny";
+function printPermissionRequestMessage(args) {
   console.log(
-    `You can ${grantAction} ${permissionDescription(args.permission)} for your connector access: [Manage ${args.label} permissions](${args.url})`
+    `You can allow ${permissionDescription(args.permission)} for your connector access: [Manage ${args.label} permissions](${args.url})`
+  );
+  console.log(
+    `Requested duration: ${args.duration}. Use --duration 1h|24h|7d|always to choose a different grant lifetime.`
   );
-  if (args.duration) {
-    console.log(
-      `Requested duration: ${args.duration}. Use --duration 1h|24h|7d|always to choose a different grant lifetime.`
-    );
-  }
 }
 function printComputerUseAuthorizationLink(args) {
   console.log(
@@ -976,11 +1305,7 @@ function printComputerUseAuthorizationLink(args) {
     `This link expires at ${args.expiresAt}. Existing run tokens cannot be upgraded in place; start a new run after authorization.`
   );
 }
-async function printComputerUsePermissionChangeMessage(action) {
-  if (action !== "enable") {
-    printComputerUsePermissionGuidance();
-    return;
-  }
+async function printComputerUsePermissionRequestMessage() {
   if (!process.env.ZERO_TOKEN) {
     printComputerUsePermissionGuidance();
     return;
@@ -1004,49 +1329,34 @@ async function printComputerUsePermissionChangeMessage(action) {
     printComputerUsePermissionGuidance();
   }
 }
-async function outputPermissionChangeMessage(connectorRef, label, permission, action, duration, agentId) {
+async function outputPermissionRequestMessage(connectorRef, label, permission, duration, agentId) {
   const platformOrigin = await getPlatformOrigin();
   const urlParams = new URLSearchParams({
     ref: connectorRef,
     permission,
-    action: action === "enable" ? "allow" : "deny"
+    action: "allow",
+    expiresIn: duration
   });
-  if (action === "enable") {
-    urlParams.set("expiresIn", duration ?? DEFAULT_PERMISSION_GRANT_DURATION);
-  }
   const pagePath = agentId ? `/agents/${agentId}/permissions` : "/agents";
   const url = `${platformOrigin}${pagePath}?${urlParams.toString()}`;
-  printSensitivePermissionGuidance(connectorRef, permission, action);
-  printPermissionActionMessage({
-    action,
+  printSensitivePermissionGuidance(connectorRef, permission);
+  printPermissionRequestMessage({
     permission,
     label,
     url,
-    duration: action === "enable" ? duration ?? DEFAULT_PERMISSION_GRANT_DURATION : void 0
+    duration
   });
 }
-var permissionChangeCommand = new Command().name("permission-change").description("Change or request a permission (enable or disable)").argument("<connector-ref>", "The connector type (e.g. github)").addOption(
+var permissionRequestCommand2 = new Command().name("permission-request").description("Request permission to use a connector capability").argument("<connector-ref>", "The connector type (e.g. github)").addOption(
   new Option(
     "--permission <name>",
-    "The permission name to change"
+    "The permission name to request"
   ).makeOptionMandatory()
-).addOption(
-  new Option(
-    "--enable",
-    "Enable or request enabling the permission"
-  ).conflicts("disable")
-).addOption(
-  new Option(
-    "--disable",
-    "Disable or request disabling the permission"
-  ).conflicts("enable")
 ).addOption(
   new Option(
     "--duration <duration>",
-    "Requested allow duration: 1h, 24h, 7d, or always (default: 1h)"
-  ).choices([...PERMISSION_GRANT_DURATIONS])
-).addOption(
-  new Option("--reason <text>", "Brief reason for the permission change")
+    "Requested allow duration: 1h, 24h, 7d, or always"
+  ).choices([...PERMISSION_GRANT_DURATIONS]).default(DEFAULT_PERMISSION_GRANT_DURATION)
 ).addOption(
   new Option(
     "--agent <id>",
@@ -1056,36 +1366,27 @@ var permissionChangeCommand = new Command().name("permission-change").descriptio
   "after",
   `
 Examples:
-  zero doctor permission-change github --permission contents:read --enable
-  zero doctor permission-change github --permission contents:write --enable --duration 24h
-  zero doctor permission-change gmail --permission messages.write --enable --agent <agent-id>
-  zero doctor permission-change slack --permission chat:write --disable
-  zero doctor permission-change cloudflare --permission __unknown__ --disable
-  zero doctor permission-change computer-use --permission computer-use:write --enable
+  zero connector permission-request github --permission contents:read
+  zero connector permission-request github --permission contents:write --duration 24h
+  zero connector permission-request gmail --permission messages.write --agent <agent-id>
+  zero connector permission-request cloudflare --permission __unknown__
+  zero connector permission-request computer-use --permission computer-use:write
 
 Notes:
-  - Outputs a platform URL for the user to adjust the permission
-  - Use --permission __unknown__ to change unknown endpoint policy
+  - Outputs a platform URL for the user to allow the permission
+  - Use --permission __unknown__ to request access to unknown endpoints
   - Use --agent to request a permission for another agent; defaults to ZERO_AGENT_ID
-  - Enable requests default to --duration 1h; use 24h or 7d for longer user-approved work
+  - Requests default to --duration 1h; use 24h or 7d for longer user-approved work
   - Use --duration always only when the user explicitly asks for persistent access
-  - Permission changes update the current user's connector grants`
+  - Permission requests update the current user's connector grants after confirmation`
 ).action(
   withErrorHandler(
     async (connectorRef, opts) => {
-      if (!opts.enable && !opts.disable) {
-        throw new Error("Either --enable or --disable is required");
-      }
-      if (opts.disable && opts.duration !== void 0) {
-        throw new Error("--duration is only supported with --enable");
-      }
       if (isComputerUsePermissionTarget({
         connectorRef,
         permission: opts.permission
       })) {
-        await printComputerUsePermissionChangeMessage(
-          opts.enable ? "enable" : "disable"
-        );
+        await printComputerUsePermissionRequestMessage();
         return;
       }
       const metadata = await getZeroConnectorCatalogPermissions(connectorRef);
@@ -1097,12 +1398,10 @@ Notes:
           `Unknown permission "${opts.permission}" for ${connectorRef}`
         );
       }
-      const action = opts.enable ? "enable" : "disable";
-      await outputPermissionChangeMessage(
+      await outputPermissionRequestMessage(
         connectorRef,
         metadata.label,
         opts.permission,
-        action,
         opts.duration,
         opts.agent ?? process.env.ZERO_AGENT_ID
       );
@@ -1110,85 +1409,9 @@ Notes:
   )
 );
 
-// src/commands/zero/doctor/credit.ts
-init_esm_shims();
-function memberName(member) {
-  const name = [member.firstName, member.lastName].filter(Boolean).join(" ");
-  return name ? `${name} <${member.email}>` : member.email;
-}
-var creditCommand = new Command().name("credit").description("Diagnose current organization credit and purchase access").action(
-  withErrorHandler(async () => {
-    const [org, billing, members] = await Promise.all([
-      getZeroOrg(),
-      getZeroBillingStatus(),
-      getZeroOrgMembers()
-    ]);
-    const admins = members.members.filter((member) => {
-      return member.role === "admin";
-    });
-    const isAdmin = members.role === "admin";
-    const canPurchaseCredits = isAdmin;
-    console.log(source_default.bold("Credit diagnostics:"));
-    console.log(`  Org: ${source_default.green(org.slug)}`);
-    console.log(`  Tier: ${source_default.cyan(billing.tier)}`);
-    console.log(
-      `  Available credits: ${source_default.cyan(billing.credits.toLocaleString())}`
-    );
-    console.log(`  Current user role: ${source_default.cyan(members.role)}`);
-    console.log(
-      `  Can purchase credits: ${canPurchaseCredits ? source_default.green("yes") : source_default.yellow("no")}`
-    );
-    console.log(
-      `  Auto-recharge: ${billing.autoRecharge.enabled ? source_default.green("enabled") : "disabled"}`
-    );
-    if (billing.autoRecharge.enabled) {
-      console.log(
-        `    Threshold: ${billing.autoRecharge.threshold?.toLocaleString() ?? "not set"}`
-      );
-      console.log(
-        `    Amount: ${billing.autoRecharge.amount?.toLocaleString() ?? "not set"}`
-      );
-    }
-    if (!isAdmin) {
-      console.log(source_default.bold("\nOrganization admins:"));
-      for (const admin of admins) {
-        console.log(`  - ${memberName(admin)}`);
-      }
-      console.log(
-        source_default.yellow(
-          "\nAsk an organization admin to buy credits or upgrade the plan."
-        )
-      );
-    } else if (billing.tier === "free") {
-      console.log(
-        "\nFree-tier admins can upgrade to Pro from billing or buy credits with `zero credit <credits>`."
-      );
-    } else {
-      console.log("\nUse `zero credit <credits>` to buy more credits.");
-    }
-  })
-);
-
-// src/commands/zero/doctor/index.ts
-var zeroDoctorCommand = new Command().name("doctor").description("Diagnose runtime issues (connector health, permission denials)").addCommand(checkConnectorCommand).addCommand(creditCommand).addCommand(permissionDenyCommand).addCommand(permissionChangeCommand).addHelpText(
-  "after",
-  `
-Examples:
-  Check a connector?     zero doctor check-connector --env-name GITHUB_TOKEN
-  Check a URL?           zero doctor check-connector --url https://api.github.com/repos/owner/repo
-  Check credits?         zero doctor credit
-  Check with permission? zero doctor check-connector --env-name SLACK_TOKEN --check-permission chat:write
-  Permission denied?     zero doctor permission-deny github --method GET --url https://api.github.com/repos/owner/repo
-  Change a permission?   zero doctor permission-change github --permission contents:read --enable --duration 1h
-  Disable unknown URLs?  zero doctor permission-change cloudflare --permission __unknown__ --disable
-
-Notes:
-  - Use zero doctor credit when a run or generation fails because the org has insufficient credits, when a user asks how to recharge, or before trying to buy credits
-  - Use this when your task fails due to a missing connector environment name or permission denial
-  - Use zero generate <type> (no --prompt) to see every provider available for a given generation type
-  - The doctor will identify the issue and give the user a link to resolve it`
-);
+// src/commands/zero/connector/index.ts
+var zeroConnectorCommand = new Command().name("connector").description("Manage and diagnose third-party service connections").addCommand(checkConnectorCommand).addCommand(customConnectorCommand).addCommand(connectCommand).addCommand(listCommand).addCommand(searchCommand).addCommand(statusCommand).addCommand(permissionRequestCommand2);
 export {
-  zeroDoctorCommand
+  zeroConnectorCommand
 };
-//# sourceMappingURL=doctor-PGH6KBWK.js.map
+//# sourceMappingURL=connector-ZRKGMLQV.js.map