@vm0/cli 9.62.6 → 9.63.0

package/index.js

@@ -45,7 +45,7 @@ if (DSN) {
   Sentry.init({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.62.6",
+    release: "9.63.0",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -64,7 +64,7 @@ if (DSN) {
     }
   });
   Sentry.setContext("cli", {
-    version: "9.62.6",
+    version: "9.63.0",
     command: process.argv.slice(2).join(" ")
   });
   Sentry.setContext("runtime", {
@@ -673,7 +673,7 @@ function getConfigPath() {
   return join2(homedir2(), ".vm0", "config.json");
 }
 var infoCommand = new Command6().name("info").description("Display environment and debug information").action(async () => {
-  console.log(chalk4.bold(`VM0 CLI v${"9.62.6"}`));
+  console.log(chalk4.bold(`VM0 CLI v${"9.63.0"}`));
   console.log();
   const config = await loadConfig();
   const hasEnvToken = !!process.env.VM0_TOKEN;
@@ -864,6 +864,15 @@ var agentDefinitionSchema = z4.object({
       "Runner group must be in org/name format (e.g., acme/production)"
     )
   }).optional(),
+  /**
+   * VM profile for resource allocation (e.g., "vm0/default", "vm0/browser").
+   * Determines rootfs image and VM resources (vCPU, memory).
+   * Defaults to "vm0/default" when omitted.
+   */
+  experimental_profile: z4.string().regex(
+    /^[a-z0-9-]+\/[a-z0-9-]+$/,
+    "Profile must be in org/name format (e.g., vm0/default)"
+  ).optional(),
   /**
    * External firewall rules for proxy-side token replacement.
    * CLI input: map format { slack: { permissions: [...] | "all" } }
@@ -2638,8 +2647,7 @@ var MODEL_PROVIDER_TYPES = {
       ANTHROPIC_AUTH_TOKEN: "$secret",
       ANTHROPIC_BASE_URL: "https://ai-gateway.vercel.sh",
       ANTHROPIC_API_KEY: "",
-      ANTHROPIC_MODEL: "moonshotai/kimi-k2.5",
-      ANTHROPIC_CUSTOM_HEADERS: "x-ai-gateway-providers-only: moonshot"
+      ANTHROPIC_MODEL: "anthropic/claude-sonnet-4.6"
     }
   },
   "azure-foundry": {
@@ -3091,30 +3099,120 @@ var checkpointsByIdContract = c12.router({
   }
 });
 
-// ../../packages/core/src/contracts/runners.ts
+// ../../packages/core/src/contracts/chat-threads.ts
 import { z as z16 } from "zod";
 var c13 = initContract();
-var runnerGroupSchema = z16.string().regex(
+var chatThreadListItemSchema = z16.object({
+  id: z16.string(),
+  title: z16.string().nullable(),
+  preview: z16.string().nullable(),
+  createdAt: z16.string(),
+  updatedAt: z16.string()
+});
+var storedChatMessageSchema2 = z16.object({
+  role: z16.enum(["user", "assistant"]),
+  content: z16.string(),
+  runId: z16.string().optional(),
+  createdAt: z16.string()
+});
+var chatThreadDetailSchema = z16.object({
+  id: z16.string(),
+  title: z16.string().nullable(),
+  agentComposeId: z16.string(),
+  chatMessages: z16.array(storedChatMessageSchema2),
+  latestSessionId: z16.string().nullable(),
+  activeRunId: z16.string().nullable(),
+  activeRunPrompt: z16.string().nullable(),
+  createdAt: z16.string(),
+  updatedAt: z16.string()
+});
+var chatThreadsContract = c13.router({
+  create: {
+    method: "POST",
+    path: "/api/chat-threads",
+    headers: authHeadersSchema,
+    body: z16.object({
+      agentComposeId: z16.string().min(1),
+      title: z16.string().optional()
+    }),
+    responses: {
+      201: z16.object({ id: z16.string(), createdAt: z16.string() }),
+      401: apiErrorSchema
+    },
+    summary: "Create a new chat thread"
+  },
+  list: {
+    method: "GET",
+    path: "/api/chat-threads",
+    headers: authHeadersSchema,
+    query: z16.object({
+      agentComposeId: z16.string().min(1, "agentComposeId is required")
+    }),
+    responses: {
+      200: z16.object({ threads: z16.array(chatThreadListItemSchema) }),
+      401: apiErrorSchema
+    },
+    summary: "List chat threads for an agent"
+  }
+});
+var chatThreadByIdContract = c13.router({
+  get: {
+    method: "GET",
+    path: "/api/chat-threads/:id",
+    headers: authHeadersSchema,
+    pathParams: z16.object({ id: z16.string() }),
+    responses: {
+      200: chatThreadDetailSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get chat thread detail with messages"
+  }
+});
+var chatThreadRunsContract = c13.router({
+  addRun: {
+    method: "POST",
+    path: "/api/chat-threads/:id/runs",
+    headers: authHeadersSchema,
+    pathParams: z16.object({ id: z16.string() }),
+    body: z16.object({
+      runId: z16.string().min(1)
+    }),
+    responses: {
+      204: z16.void(),
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Associate a run to a chat thread"
+  }
+});
+
+// ../../packages/core/src/contracts/runners.ts
+import { z as z17 } from "zod";
+var c14 = initContract();
+var runnerGroupSchema = z17.string().regex(
   /^[a-z0-9-]+\/[a-z0-9-]+$/,
   "Runner group must be in org/name format (e.g., acme/production)"
 );
-var jobSchema = z16.object({
-  runId: z16.uuid(),
-  prompt: z16.string(),
-  agentComposeVersionId: z16.string().nullable(),
-  vars: z16.record(z16.string(), z16.string()).nullable(),
-  checkpointId: z16.uuid().nullable()
+var jobSchema = z17.object({
+  runId: z17.uuid(),
+  prompt: z17.string(),
+  agentComposeVersionId: z17.string().nullable(),
+  vars: z17.record(z17.string(), z17.string()).nullable(),
+  checkpointId: z17.uuid().nullable(),
+  experimentalProfile: z17.string().optional()
 });
-var runnersPollContract = c13.router({
+var runnersPollContract = c14.router({
   poll: {
     method: "POST",
     path: "/api/runners/poll",
     headers: authHeadersSchema,
-    body: z16.object({
-      group: runnerGroupSchema
+    body: z17.object({
+      group: runnerGroupSchema,
+      profiles: z17.array(z17.string()).optional()
     }),
     responses: {
-      200: z16.object({
+      200: z17.object({
         job: jobSchema.nullable()
       }),
       400: apiErrorSchema,
@@ -3124,94 +3222,98 @@ var runnersPollContract = c13.router({
     summary: "Poll for pending jobs (long-polling with 30s timeout)"
   }
 });
-var storageEntrySchema = z16.object({
-  mountPath: z16.string(),
-  archiveUrl: z16.string().nullable()
+var storageEntrySchema = z17.object({
+  mountPath: z17.string(),
+  archiveUrl: z17.string().nullable()
 });
-var artifactEntrySchema = z16.object({
-  mountPath: z16.string(),
-  archiveUrl: z16.string().nullable(),
-  vasStorageName: z16.string(),
-  vasVersionId: z16.string()
+var artifactEntrySchema = z17.object({
+  mountPath: z17.string(),
+  archiveUrl: z17.string().nullable(),
+  vasStorageName: z17.string(),
+  vasVersionId: z17.string()
 });
-var storageManifestSchema = z16.object({
-  storages: z16.array(storageEntrySchema),
+var storageManifestSchema = z17.object({
+  storages: z17.array(storageEntrySchema),
   artifact: artifactEntrySchema.nullable(),
   memory: artifactEntrySchema.nullable()
 });
-var resumeSessionSchema = z16.object({
-  sessionId: z16.string(),
-  sessionHistory: z16.string()
+var resumeSessionSchema = z17.object({
+  sessionId: z17.string(),
+  sessionHistory: z17.string()
 });
-var storedExecutionContextSchema = z16.object({
-  workingDir: z16.string(),
+var storedExecutionContextSchema = z17.object({
+  workingDir: z17.string(),
   storageManifest: storageManifestSchema.nullable(),
-  environment: z16.record(z16.string(), z16.string()).nullable(),
+  environment: z17.record(z17.string(), z17.string()).nullable(),
   resumeSession: resumeSessionSchema.nullable(),
-  encryptedSecrets: z16.string().nullable(),
+  encryptedSecrets: z17.string().nullable(),
   // AES-256-GCM encrypted Record<string, string> (secret name → value)
   // Maps secret names to OAuth connector types for runtime token refresh (e.g. { "GMAIL_ACCESS_TOKEN": "gmail" })
-  secretConnectorMap: z16.record(z16.string(), z16.string()).nullable().optional(),
-  cliAgentType: z16.string(),
+  secretConnectorMap: z17.record(z17.string(), z17.string()).nullable().optional(),
+  cliAgentType: z17.string(),
   // Debug flag to force real Claude in mock environments (internal use only)
-  debugNoMockClaude: z16.boolean().optional(),
+  debugNoMockClaude: z17.boolean().optional(),
   // Dispatch timestamp for E2E timing metrics
-  apiStartTime: z16.number().optional(),
+  apiStartTime: z17.number().optional(),
   // User's timezone preference (IANA format, e.g., "Asia/Shanghai")
-  userTimezone: z16.string().optional(),
+  userTimezone: z17.string().optional(),
   // Agent metadata for VM0_AGENT_NAME and VM0_AGENT_ORG env vars
-  agentName: z16.string().optional(),
-  agentOrgSlug: z16.string().optional(),
+  agentName: z17.string().optional(),
+  agentOrgSlug: z17.string().optional(),
   // Memory storage name (for first-run when manifest.memory is null)
-  memoryName: z16.string().optional(),
+  memoryName: z17.string().optional(),
   // Experimental firewall for proxy-side token replacement
   experimentalFirewalls: experimentalFirewallsSchema.optional(),
   // Experimental capabilities for agent permission enforcement
-  experimentalCapabilities: z16.array(z16.enum(VALID_CAPABILITIES)).optional()
+  experimentalCapabilities: z17.array(z17.enum(VALID_CAPABILITIES)).optional(),
+  // VM profile for resource allocation (e.g., "vm0/default", "vm0/browser")
+  experimentalProfile: z17.string().optional()
 });
-var executionContextSchema = z16.object({
-  runId: z16.uuid(),
-  prompt: z16.string(),
-  agentComposeVersionId: z16.string().nullable(),
-  vars: z16.record(z16.string(), z16.string()).nullable(),
-  checkpointId: z16.uuid().nullable(),
-  sandboxToken: z16.string(),
+var executionContextSchema = z17.object({
+  runId: z17.uuid(),
+  prompt: z17.string(),
+  agentComposeVersionId: z17.string().nullable(),
+  vars: z17.record(z17.string(), z17.string()).nullable(),
+  checkpointId: z17.uuid().nullable(),
+  sandboxToken: z17.string(),
   // New fields for E2B parity:
-  workingDir: z16.string(),
+  workingDir: z17.string(),
   storageManifest: storageManifestSchema.nullable(),
-  environment: z16.record(z16.string(), z16.string()).nullable(),
+  environment: z17.record(z17.string(), z17.string()).nullable(),
   resumeSession: resumeSessionSchema.nullable(),
-  secretValues: z16.array(z16.string()).nullable(),
+  secretValues: z17.array(z17.string()).nullable(),
   // AES-256-GCM encrypted Record<string, string> — passed through to mitm-addon for auth resolution
-  encryptedSecrets: z16.string().nullable(),
+  encryptedSecrets: z17.string().nullable(),
   // Maps secret names to OAuth connector types for runtime token refresh
-  secretConnectorMap: z16.record(z16.string(), z16.string()).nullable().optional(),
-  cliAgentType: z16.string(),
+  secretConnectorMap: z17.record(z17.string(), z17.string()).nullable().optional(),
+  cliAgentType: z17.string(),
   // Debug flag to force real Claude in mock environments (internal use only)
-  debugNoMockClaude: z16.boolean().optional(),
+  debugNoMockClaude: z17.boolean().optional(),
   // Dispatch timestamp for E2E timing metrics
-  apiStartTime: z16.number().optional(),
+  apiStartTime: z17.number().optional(),
   // User's timezone preference (IANA format, e.g., "Asia/Shanghai")
-  userTimezone: z16.string().optional(),
+  userTimezone: z17.string().optional(),
   // Agent metadata
-  agentName: z16.string().optional(),
-  agentOrgSlug: z16.string().optional(),
+  agentName: z17.string().optional(),
+  agentOrgSlug: z17.string().optional(),
   // Memory storage name (for first-run when manifest.memory is null)
-  memoryName: z16.string().optional(),
+  memoryName: z17.string().optional(),
   // Experimental firewall for proxy-side token replacement
   experimentalFirewalls: experimentalFirewallsSchema.optional(),
   // Experimental capabilities for agent permission enforcement
-  experimentalCapabilities: z16.array(z16.enum(VALID_CAPABILITIES)).optional()
+  experimentalCapabilities: z17.array(z17.enum(VALID_CAPABILITIES)).optional(),
+  // VM profile for resource allocation (e.g., "vm0/default", "vm0/browser")
+  experimentalProfile: z17.string().optional()
 });
-var runnersJobClaimContract = c13.router({
+var runnersJobClaimContract = c14.router({
   claim: {
     method: "POST",
     path: "/api/runners/jobs/:id/claim",
     headers: authHeadersSchema,
-    pathParams: z16.object({
-      id: z16.uuid()
+    pathParams: z17.object({
+      id: z17.uuid()
     }),
-    body: z16.object({}),
+    body: z17.object({}),
     responses: {
       200: executionContextSchema,
       400: apiErrorSchema,
@@ -3228,13 +3330,13 @@ var runnersJobClaimContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/schedules.ts
-import { z as z17 } from "zod";
-var c14 = initContract();
-var scheduleTriggerSchema = z17.object({
-  cron: z17.string().optional(),
-  at: z17.string().optional(),
-  loop: z17.object({ interval: z17.number().int().min(0) }).optional(),
-  timezone: z17.string().default("UTC")
+import { z as z18 } from "zod";
+var c15 = initContract();
+var scheduleTriggerSchema = z18.object({
+  cron: z18.string().optional(),
+  at: z18.string().optional(),
+  loop: z18.object({ interval: z18.number().int().min(0) }).optional(),
+  timezone: z18.string().default("UTC")
 }).refine(
   (data) => {
     const triggers = [data.cron, data.at, data.loop].filter(Boolean);
@@ -3244,41 +3346,41 @@ var scheduleTriggerSchema = z17.object({
     message: "Exactly one of 'cron', 'at', or 'loop' must be specified"
   }
 );
-var scheduleRunConfigSchema = z17.object({
-  agent: z17.string().min(1, "Agent reference required"),
-  prompt: z17.string().min(1, "Prompt required"),
-  vars: z17.record(z17.string(), z17.string()).optional(),
-  secrets: z17.record(z17.string(), z17.string()).optional(),
-  artifactName: z17.string().optional(),
-  artifactVersion: z17.string().optional(),
-  volumeVersions: z17.record(z17.string(), z17.string()).optional()
+var scheduleRunConfigSchema = z18.object({
+  agent: z18.string().min(1, "Agent reference required"),
+  prompt: z18.string().min(1, "Prompt required"),
+  vars: z18.record(z18.string(), z18.string()).optional(),
+  secrets: z18.record(z18.string(), z18.string()).optional(),
+  artifactName: z18.string().optional(),
+  artifactVersion: z18.string().optional(),
+  volumeVersions: z18.record(z18.string(), z18.string()).optional()
 });
-var scheduleDefinitionSchema = z17.object({
+var scheduleDefinitionSchema = z18.object({
   on: scheduleTriggerSchema,
   run: scheduleRunConfigSchema
 });
-var scheduleYamlSchema = z17.object({
-  version: z17.literal("1.0"),
-  schedules: z17.record(z17.string(), scheduleDefinitionSchema)
+var scheduleYamlSchema = z18.object({
+  version: z18.literal("1.0"),
+  schedules: z18.record(z18.string(), scheduleDefinitionSchema)
 });
-var deployScheduleRequestSchema = z17.object({
-  name: z17.string().min(1).max(64, "Schedule name max 64 chars"),
-  cronExpression: z17.string().optional(),
-  atTime: z17.string().optional(),
-  intervalSeconds: z17.number().int().min(0).optional(),
-  timezone: z17.string().default("UTC"),
-  prompt: z17.string().min(1, "Prompt required"),
+var deployScheduleRequestSchema = z18.object({
+  name: z18.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z18.string().optional(),
+  atTime: z18.string().optional(),
+  intervalSeconds: z18.number().int().min(0).optional(),
+  timezone: z18.string().default("UTC"),
+  prompt: z18.string().min(1, "Prompt required"),
   // vars and secrets removed - now managed via platform tables
-  artifactName: z17.string().optional(),
-  artifactVersion: z17.string().optional(),
-  volumeVersions: z17.record(z17.string(), z17.string()).optional(),
+  artifactName: z18.string().optional(),
+  artifactVersion: z18.string().optional(),
+  volumeVersions: z18.record(z18.string(), z18.string()).optional(),
   // Resolved agent compose ID (CLI resolves org/name:version → composeId)
-  composeId: z17.string().uuid("Invalid compose ID"),
+  composeId: z18.string().uuid("Invalid compose ID"),
   // Enable schedule immediately upon creation
-  enabled: z17.boolean().optional(),
+  enabled: z18.boolean().optional(),
   // Per-schedule notification control (AND'd with user global preferences)
-  notifyEmail: z17.boolean().optional(),
-  notifySlack: z17.boolean().optional()
+  notifyEmail: z18.boolean().optional(),
+  notifySlack: z18.boolean().optional()
 }).refine(
   (data) => {
     const triggers = [
@@ -3292,38 +3394,38 @@ var deployScheduleRequestSchema = z17.object({
     message: "Exactly one of 'cronExpression', 'atTime', or 'intervalSeconds' must be specified"
   }
 );
-var scheduleResponseSchema = z17.object({
-  id: z17.uuid(),
-  composeId: z17.uuid(),
-  composeName: z17.string(),
-  orgSlug: z17.string(),
-  userId: z17.string(),
-  name: z17.string(),
-  triggerType: z17.enum(["cron", "once", "loop"]),
-  cronExpression: z17.string().nullable(),
-  atTime: z17.string().nullable(),
-  intervalSeconds: z17.number().nullable(),
-  timezone: z17.string(),
-  prompt: z17.string(),
-  vars: z17.record(z17.string(), z17.string()).nullable(),
+var scheduleResponseSchema = z18.object({
+  id: z18.uuid(),
+  composeId: z18.uuid(),
+  composeName: z18.string(),
+  orgSlug: z18.string(),
+  userId: z18.string(),
+  name: z18.string(),
+  triggerType: z18.enum(["cron", "once", "loop"]),
+  cronExpression: z18.string().nullable(),
+  atTime: z18.string().nullable(),
+  intervalSeconds: z18.number().nullable(),
+  timezone: z18.string(),
+  prompt: z18.string(),
+  vars: z18.record(z18.string(), z18.string()).nullable(),
   // Secret names only (values are never returned)
-  secretNames: z17.array(z17.string()).nullable(),
-  artifactName: z17.string().nullable(),
-  artifactVersion: z17.string().nullable(),
-  volumeVersions: z17.record(z17.string(), z17.string()).nullable(),
-  enabled: z17.boolean(),
-  notifyEmail: z17.boolean(),
-  notifySlack: z17.boolean(),
-  nextRunAt: z17.string().nullable(),
-  lastRunAt: z17.string().nullable(),
-  retryStartedAt: z17.string().nullable(),
-  consecutiveFailures: z17.number(),
-  createdAt: z17.string(),
-  updatedAt: z17.string()
+  secretNames: z18.array(z18.string()).nullable(),
+  artifactName: z18.string().nullable(),
+  artifactVersion: z18.string().nullable(),
+  volumeVersions: z18.record(z18.string(), z18.string()).nullable(),
+  enabled: z18.boolean(),
+  notifyEmail: z18.boolean(),
+  notifySlack: z18.boolean(),
+  nextRunAt: z18.string().nullable(),
+  lastRunAt: z18.string().nullable(),
+  retryStartedAt: z18.string().nullable(),
+  consecutiveFailures: z18.number(),
+  createdAt: z18.string(),
+  updatedAt: z18.string()
 });
-var runSummarySchema = z17.object({
-  id: z17.uuid(),
-  status: z17.enum([
+var runSummarySchema = z18.object({
+  id: z18.uuid(),
+  status: z18.enum([
     "queued",
     "pending",
     "running",
@@ -3331,22 +3433,22 @@ var runSummarySchema = z17.object({
     "failed",
     "timeout"
   ]),
-  createdAt: z17.string(),
-  completedAt: z17.string().nullable(),
-  error: z17.string().nullable()
+  createdAt: z18.string(),
+  completedAt: z18.string().nullable(),
+  error: z18.string().nullable()
 });
-var scheduleRunsResponseSchema = z17.object({
-  runs: z17.array(runSummarySchema)
+var scheduleRunsResponseSchema = z18.object({
+  runs: z18.array(runSummarySchema)
 });
-var scheduleListResponseSchema = z17.object({
-  schedules: z17.array(scheduleResponseSchema)
+var scheduleListResponseSchema = z18.object({
+  schedules: z18.array(scheduleResponseSchema)
 });
-var deployScheduleResponseSchema = z17.object({
+var deployScheduleResponseSchema = z18.object({
   schedule: scheduleResponseSchema,
-  created: z17.boolean()
+  created: z18.boolean()
   // true if created, false if updated
 });
-var schedulesMainContract = c14.router({
+var schedulesMainContract = c15.router({
   /**
    * POST /api/agent/schedules
    * Deploy (create or update) a schedule
@@ -3384,7 +3486,7 @@ var schedulesMainContract = c14.router({
     summary: "List all schedules"
   }
 });
-var schedulesByNameContract = c14.router({
+var schedulesByNameContract = c15.router({
   /**
    * GET /api/agent/schedules/:name
    * Get schedule by name
@@ -3393,11 +3495,11 @@ var schedulesByNameContract = c14.router({
     method: "GET",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    query: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    query: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -3415,14 +3517,14 @@ var schedulesByNameContract = c14.router({
     method: "DELETE",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    query: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    query: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
-      204: c14.noBody(),
+      204: c15.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -3430,7 +3532,7 @@ var schedulesByNameContract = c14.router({
     summary: "Delete schedule"
   }
 });
-var schedulesEnableContract = c14.router({
+var schedulesEnableContract = c15.router({
   /**
    * POST /api/agent/schedules/:name/enable
    * Enable a disabled schedule
@@ -3439,11 +3541,11 @@ var schedulesEnableContract = c14.router({
     method: "POST",
     path: "/api/agent/schedules/:name/enable",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    body: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    body: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -3461,11 +3563,11 @@ var schedulesEnableContract = c14.router({
     method: "POST",
     path: "/api/agent/schedules/:name/disable",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    body: z17.object({
-      composeId: z17.string().uuid("Compose ID required")
+    body: z18.object({
+      composeId: z18.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -3476,7 +3578,7 @@ var schedulesEnableContract = c14.router({
     summary: "Disable schedule"
   }
 });
-var scheduleRunsContract = c14.router({
+var scheduleRunsContract = c15.router({
   /**
    * GET /api/agent/schedules/:name/runs
    * List recent runs for a schedule
@@ -3485,12 +3587,12 @@ var scheduleRunsContract = c14.router({
     method: "GET",
     path: "/api/agent/schedules/:name/runs",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      name: z17.string().min(1, "Schedule name required")
+    pathParams: z18.object({
+      name: z18.string().min(1, "Schedule name required")
     }),
-    query: z17.object({
-      composeId: z17.string().uuid("Compose ID required"),
-      limit: z17.coerce.number().min(0).max(100).default(5)
+    query: z18.object({
+      composeId: z18.string().uuid("Compose ID required"),
+      limit: z18.coerce.number().min(0).max(100).default(5)
     }),
     responses: {
       200: scheduleRunsResponseSchema,
@@ -3503,18 +3605,18 @@ var scheduleRunsContract = c14.router({
 });
 
 // ../../packages/core/src/contracts/realtime.ts
-import { z as z18 } from "zod";
-var c15 = initContract();
-var ablyTokenRequestSchema = z18.object({
-  keyName: z18.string(),
-  ttl: z18.number().optional(),
-  timestamp: z18.number(),
-  capability: z18.string(),
-  clientId: z18.string().optional(),
-  nonce: z18.string(),
-  mac: z18.string()
+import { z as z19 } from "zod";
+var c16 = initContract();
+var ablyTokenRequestSchema = z19.object({
+  keyName: z19.string(),
+  ttl: z19.number().optional(),
+  timestamp: z19.number(),
+  capability: z19.string(),
+  clientId: z19.string().optional(),
+  nonce: z19.string(),
+  mac: z19.string()
 });
-var runnerRealtimeTokenContract = c15.router({
+var runnerRealtimeTokenContract = c16.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -3523,7 +3625,7 @@ var runnerRealtimeTokenContract = c15.router({
     method: "POST",
     path: "/api/runners/realtime/token",
     headers: authHeadersSchema,
-    body: z18.object({
+    body: z19.object({
       group: runnerGroupSchema
     }),
     responses: {
@@ -3537,22 +3639,22 @@ var runnerRealtimeTokenContract = c15.router({
 });
 
 // ../../packages/core/src/contracts/platform.ts
-import { z as z19 } from "zod";
-var paginationSchema = z19.object({
-  hasMore: z19.boolean(),
-  nextCursor: z19.string().nullable()
+import { z as z20 } from "zod";
+var paginationSchema = z20.object({
+  hasMore: z20.boolean(),
+  nextCursor: z20.string().nullable()
 });
-var listQuerySchema = z19.object({
-  cursor: z19.string().optional(),
-  limit: z19.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z20.object({
+  cursor: z20.string().optional(),
+  limit: z20.coerce.number().min(1).max(100).default(20)
 });
-var c16 = initContract();
-var platformPaginationSchema = z19.object({
-  hasMore: z19.boolean(),
-  nextCursor: z19.string().nullable(),
-  totalPages: z19.number()
+var c17 = initContract();
+var platformPaginationSchema = z20.object({
+  hasMore: z20.boolean(),
+  nextCursor: z20.string().nullable(),
+  totalPages: z20.number()
 });
-var platformLogStatusSchema = z19.enum([
+var platformLogStatusSchema = z20.enum([
   "queued",
   "pending",
   "running",
@@ -3561,47 +3663,47 @@ var platformLogStatusSchema = z19.enum([
   "timeout",
   "cancelled"
 ]);
-var platformLogEntrySchema = z19.object({
-  id: z19.uuid(),
-  sessionId: z19.string().nullable(),
-  agentName: z19.string(),
-  orgSlug: z19.string().nullable(),
-  framework: z19.string().nullable(),
+var platformLogEntrySchema = z20.object({
+  id: z20.uuid(),
+  sessionId: z20.string().nullable(),
+  agentName: z20.string(),
+  orgSlug: z20.string().nullable(),
+  framework: z20.string().nullable(),
   status: platformLogStatusSchema,
-  createdAt: z19.string(),
-  startedAt: z19.string().nullable(),
-  completedAt: z19.string().nullable()
+  createdAt: z20.string(),
+  startedAt: z20.string().nullable(),
+  completedAt: z20.string().nullable()
 });
-var platformLogsListResponseSchema = z19.object({
-  data: z19.array(platformLogEntrySchema),
+var platformLogsListResponseSchema = z20.object({
+  data: z20.array(platformLogEntrySchema),
   pagination: platformPaginationSchema
 });
-var artifactSchema = z19.object({
-  name: z19.string().nullable(),
-  version: z19.string().nullable()
+var artifactSchema = z20.object({
+  name: z20.string().nullable(),
+  version: z20.string().nullable()
 });
-var platformLogDetailSchema = z19.object({
-  id: z19.uuid(),
-  sessionId: z19.string().nullable(),
-  agentName: z19.string(),
-  framework: z19.string().nullable(),
+var platformLogDetailSchema = z20.object({
+  id: z20.uuid(),
+  sessionId: z20.string().nullable(),
+  agentName: z20.string(),
+  framework: z20.string().nullable(),
   status: platformLogStatusSchema,
-  prompt: z19.string(),
-  error: z19.string().nullable(),
-  createdAt: z19.string(),
-  startedAt: z19.string().nullable(),
-  completedAt: z19.string().nullable(),
+  prompt: z20.string(),
+  error: z20.string().nullable(),
+  createdAt: z20.string(),
+  startedAt: z20.string().nullable(),
+  completedAt: z20.string().nullable(),
   artifact: artifactSchema
 });
-var platformLogsListContract = c16.router({
+var platformLogsListContract = c17.router({
   list: {
     method: "GET",
     path: "/api/platform/logs",
     query: listQuerySchema.extend({
-      search: z19.string().optional(),
-      agent: z19.string().optional(),
-      name: z19.string().optional(),
-      org: z19.string().optional(),
+      search: z20.string().optional(),
+      agent: z20.string().optional(),
+      name: z20.string().optional(),
+      org: z20.string().optional(),
       status: platformLogStatusSchema.optional()
     }),
     responses: {
@@ -3611,13 +3713,13 @@ var platformLogsListContract = c16.router({
     summary: "List agent run logs with pagination"
   }
 });
-var platformLogsByIdContract = c16.router({
+var platformLogsByIdContract = c17.router({
   getById: {
     method: "GET",
     path: "/api/platform/logs/:id",
     headers: authHeadersSchema,
-    pathParams: z19.object({
-      id: z19.string().uuid("Invalid log ID")
+    pathParams: z20.object({
+      id: z20.string().uuid("Invalid log ID")
     }),
     responses: {
       200: platformLogDetailSchema,
@@ -3627,17 +3729,17 @@ var platformLogsByIdContract = c16.router({
     summary: "Get agent run log details by ID"
   }
 });
-var artifactDownloadResponseSchema = z19.object({
-  url: z19.url(),
-  expiresAt: z19.string()
+var artifactDownloadResponseSchema = z20.object({
+  url: z20.url(),
+  expiresAt: z20.string()
 });
-var platformArtifactDownloadContract = c16.router({
+var platformArtifactDownloadContract = c17.router({
   getDownloadUrl: {
     method: "GET",
     path: "/api/platform/artifacts/download",
-    query: z19.object({
-      name: z19.string().min(1, "Artifact name is required"),
-      version: z19.string().optional()
+    query: z20.object({
+      name: z20.string().min(1, "Artifact name is required"),
+      version: z20.string().optional()
     }),
     responses: {
       200: artifactDownloadResponseSchema,
@@ -3649,43 +3751,43 @@ var platformArtifactDownloadContract = c16.router({
 });
 
 // ../../packages/core/src/contracts/compose-jobs.ts
-import { z as z20 } from "zod";
-var c17 = initContract();
-var composeJobStatusSchema = z20.enum([
+import { z as z21 } from "zod";
+var c18 = initContract();
+var composeJobStatusSchema = z21.enum([
   "pending",
   "running",
   "completed",
   "failed"
 ]);
-var composeJobResultSchema = z20.object({
-  composeId: z20.string(),
-  composeName: z20.string(),
-  versionId: z20.string(),
-  warnings: z20.array(z20.string())
+var composeJobResultSchema = z21.object({
+  composeId: z21.string(),
+  composeName: z21.string(),
+  versionId: z21.string(),
+  warnings: z21.array(z21.string())
 });
-var composeJobSourceSchema = z20.enum(["github", "platform", "slack"]);
-var createComposeJobRequestSchema = z20.union([
-  z20.object({
-    githubUrl: z20.url().check(z20.startsWith("https://github.com/")),
-    overwrite: z20.boolean().optional().default(false)
+var composeJobSourceSchema = z21.enum(["github", "platform", "slack"]);
+var createComposeJobRequestSchema = z21.union([
+  z21.object({
+    githubUrl: z21.url().check(z21.startsWith("https://github.com/")),
+    overwrite: z21.boolean().optional().default(false)
   }),
-  z20.object({
-    content: z20.record(z20.string(), z20.unknown()),
-    instructions: z20.string().optional()
+  z21.object({
+    content: z21.record(z21.string(), z21.unknown()),
+    instructions: z21.string().optional()
   })
 ]);
-var composeJobResponseSchema = z20.object({
-  jobId: z20.string(),
+var composeJobResponseSchema = z21.object({
+  jobId: z21.string(),
   status: composeJobStatusSchema,
-  githubUrl: z20.string().optional(),
+  githubUrl: z21.string().optional(),
   source: composeJobSourceSchema.optional(),
   result: composeJobResultSchema.optional(),
-  error: z20.string().optional(),
-  createdAt: z20.string(),
-  startedAt: z20.string().optional(),
-  completedAt: z20.string().optional()
+  error: z21.string().optional(),
+  createdAt: z21.string(),
+  startedAt: z21.string().optional(),
+  completedAt: z21.string().optional()
 });
-var composeJobsMainContract = c17.router({
+var composeJobsMainContract = c18.router({
   /**
    * POST /api/compose/jobs
    * Create a new compose job from GitHub URL or platform content
@@ -3705,7 +3807,7 @@ var composeJobsMainContract = c17.router({
     summary: "Create compose job"
   }
 });
-var composeJobsByIdContract = c17.router({
+var composeJobsByIdContract = c18.router({
   /**
    * GET /api/compose/jobs/:jobId
    * Get compose job status and result
@@ -3714,8 +3816,8 @@ var composeJobsByIdContract = c17.router({
     method: "GET",
     path: "/api/compose/jobs/:jobId",
     headers: authHeadersSchema,
-    pathParams: z20.object({
-      jobId: z20.uuid()
+    pathParams: z21.object({
+      jobId: z21.uuid()
     }),
     responses: {
       200: composeJobResponseSchema,
@@ -3725,7 +3827,7 @@ var composeJobsByIdContract = c17.router({
     summary: "Get compose job status"
   }
 });
-var webhookComposeCompleteContract = c17.router({
+var webhookComposeCompleteContract = c18.router({
   /**
    * POST /api/webhooks/compose/complete
    * Handle compose job completion from sandbox
@@ -3734,16 +3836,16 @@ var webhookComposeCompleteContract = c17.router({
     method: "POST",
     path: "/api/webhooks/compose/complete",
     headers: authHeadersSchema,
-    body: z20.object({
-      jobId: z20.uuid(),
-      success: z20.boolean(),
+    body: z21.object({
+      jobId: z21.uuid(),
+      success: z21.boolean(),
       // Result from CLI compose command
       result: composeJobResultSchema.optional(),
-      error: z20.string().optional()
+      error: z21.string().optional()
     }),
     responses: {
-      200: z20.object({
-        success: z20.boolean()
+      200: z21.object({
+        success: z21.boolean()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -3754,8 +3856,8 @@ var webhookComposeCompleteContract = c17.router({
 });
 
 // ../../packages/core/src/contracts/connectors.ts
-import { z as z21 } from "zod";
-var c18 = initContract();
+import { z as z22 } from "zod";
+var c19 = initContract();
 var CONNECTOR_TYPES_DEF = {
   axiom: {
     label: "Axiom",
@@ -6245,7 +6347,7 @@ var CONNECTOR_TYPES_DEF = {
   }
 };
 var CONNECTOR_TYPES = CONNECTOR_TYPES_DEF;
-var connectorTypeSchema = z21.enum([
+var connectorTypeSchema = z22.enum([
   "agentmail",
   "ahrefs",
   "atlassian",
@@ -6373,23 +6475,24 @@ function getConnectorDerivedNames(secretName) {
   }
   return null;
 }
-var connectorResponseSchema = z21.object({
-  id: z21.uuid().nullable(),
+var connectorResponseSchema = z22.object({
+  id: z22.uuid().nullable(),
   type: connectorTypeSchema,
-  authMethod: z21.string(),
-  externalId: z21.string().nullable(),
-  externalUsername: z21.string().nullable(),
-  externalEmail: z21.string().nullable(),
-  oauthScopes: z21.array(z21.string()).nullable(),
-  createdAt: z21.string(),
-  updatedAt: z21.string()
+  authMethod: z22.string(),
+  externalId: z22.string().nullable(),
+  externalUsername: z22.string().nullable(),
+  externalEmail: z22.string().nullable(),
+  oauthScopes: z22.array(z22.string()).nullable(),
+  needsReconnect: z22.boolean(),
+  createdAt: z22.string(),
+  updatedAt: z22.string()
 });
-var connectorListResponseSchema = z21.object({
-  connectors: z21.array(connectorResponseSchema),
-  configuredTypes: z21.array(connectorTypeSchema),
-  connectorProvidedSecretNames: z21.array(z21.string())
+var connectorListResponseSchema = z22.object({
+  connectors: z22.array(connectorResponseSchema),
+  configuredTypes: z22.array(connectorTypeSchema),
+  connectorProvidedSecretNames: z22.array(z22.string())
 });
-var connectorsMainContract = c18.router({
+var connectorsMainContract = c19.router({
   list: {
     method: "GET",
     path: "/api/connectors",
@@ -6402,12 +6505,12 @@ var connectorsMainContract = c18.router({
     summary: "List all connectors for the authenticated user"
   }
 });
-var connectorsByTypeContract = c18.router({
+var connectorsByTypeContract = c19.router({
   get: {
     method: "GET",
     path: "/api/connectors/:type",
     headers: authHeadersSchema,
-    pathParams: z21.object({
+    pathParams: z22.object({
       type: connectorTypeSchema
     }),
     responses: {
@@ -6422,11 +6525,11 @@ var connectorsByTypeContract = c18.router({
     method: "DELETE",
     path: "/api/connectors/:type",
     headers: authHeadersSchema,
-    pathParams: z21.object({
+    pathParams: z22.object({
       type: connectorTypeSchema
     }),
     responses: {
-      204: c18.noBody(),
+      204: c19.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -6434,27 +6537,27 @@ var connectorsByTypeContract = c18.router({
     summary: "Disconnect a connector"
   }
 });
-var connectorSessionStatusSchema = z21.enum([
+var connectorSessionStatusSchema = z22.enum([
   "pending",
   "complete",
   "expired",
   "error"
 ]);
-var connectorSessionResponseSchema = z21.object({
-  id: z21.uuid(),
-  code: z21.string(),
+var connectorSessionResponseSchema = z22.object({
+  id: z22.uuid(),
+  code: z22.string(),
   type: connectorTypeSchema,
   status: connectorSessionStatusSchema,
-  verificationUrl: z21.string(),
-  expiresIn: z21.number(),
-  interval: z21.number(),
-  errorMessage: z21.string().nullable().optional()
+  verificationUrl: z22.string(),
+  expiresIn: z22.number(),
+  interval: z22.number(),
+  errorMessage: z22.string().nullable().optional()
 });
-var connectorSessionStatusResponseSchema = z21.object({
+var connectorSessionStatusResponseSchema = z22.object({
   status: connectorSessionStatusSchema,
-  errorMessage: z21.string().nullable().optional()
+  errorMessage: z22.string().nullable().optional()
 });
-var connectorSessionsContract = c18.router({
+var connectorSessionsContract = c19.router({
   /**
    * POST /api/connectors/:type/sessions
    * Create a new connector session for CLI device flow
@@ -6463,10 +6566,10 @@ var connectorSessionsContract = c18.router({
     method: "POST",
     path: "/api/connectors/:type/sessions",
     headers: authHeadersSchema,
-    pathParams: z21.object({
+    pathParams: z22.object({
       type: connectorTypeSchema
     }),
-    body: z21.object({}).optional(),
+    body: z22.object({}).optional(),
     responses: {
       200: connectorSessionResponseSchema,
       400: apiErrorSchema,
@@ -6476,7 +6579,7 @@ var connectorSessionsContract = c18.router({
     summary: "Create connector session for CLI device flow"
   }
 });
-var connectorSessionByIdContract = c18.router({
+var connectorSessionByIdContract = c19.router({
   /**
    * GET /api/connectors/:type/sessions/:sessionId
    * Get connector session status (for CLI polling)
@@ -6485,9 +6588,9 @@ var connectorSessionByIdContract = c18.router({
     method: "GET",
     path: "/api/connectors/:type/sessions/:sessionId",
     headers: authHeadersSchema,
-    pathParams: z21.object({
+    pathParams: z22.object({
       type: connectorTypeSchema,
-      sessionId: z21.uuid()
+      sessionId: z22.uuid()
     }),
     responses: {
       200: connectorSessionStatusResponseSchema,
@@ -6499,19 +6602,19 @@ var connectorSessionByIdContract = c18.router({
     summary: "Get connector session status"
   }
 });
-var computerConnectorCreateResponseSchema = z21.object({
-  id: z21.uuid(),
-  ngrokToken: z21.string(),
-  bridgeToken: z21.string(),
-  endpointPrefix: z21.string(),
-  domain: z21.string()
+var computerConnectorCreateResponseSchema = z22.object({
+  id: z22.uuid(),
+  ngrokToken: z22.string(),
+  bridgeToken: z22.string(),
+  endpointPrefix: z22.string(),
+  domain: z22.string()
 });
-var computerConnectorContract = c18.router({
+var computerConnectorContract = c19.router({
   create: {
     method: "POST",
     path: "/api/connectors/computer",
     headers: authHeadersSchema,
-    body: z21.object({}).optional(),
+    body: z22.object({}).optional(),
     responses: {
       200: computerConnectorCreateResponseSchema,
       400: apiErrorSchema,
@@ -6537,7 +6640,7 @@ var computerConnectorContract = c18.router({
     path: "/api/connectors/computer",
     headers: authHeadersSchema,
     responses: {
-      204: c18.noBody(),
+      204: c19.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -6666,7 +6769,7 @@ function resolveFirewallRef(input) {
 }
 
 // ../../packages/core/src/firewall-loader.ts
-var MAX_RESPONSE_SIZE = 64 * 1024;
+var MAX_RESPONSE_SIZE = 128 * 1024;
 function buildFirewallYamlUrl(ref) {
   const url = resolveFirewallRef(ref);
   const parsed = parseGitHubTreeUrl(url);
@@ -6752,7 +6855,8 @@ function validateRule(rule, permName, serviceName) {
     const seg = segments[i];
     if (seg.startsWith("{") && seg.endsWith("}")) {
       const name = seg.slice(1, -1);
-      const baseName = name.endsWith("+") ? name.slice(0, -1) : name;
+      const isGreedy = name.endsWith("+") || name.endsWith("*");
+      const baseName = isGreedy ? name.slice(0, -1) : name;
       if (!baseName) {
         throw new Error(
           `Invalid rule "${rule}" in permission "${permName}" of firewall "${serviceName}": empty parameter name`
@@ -6764,7 +6868,7 @@ function validateRule(rule, permName, serviceName) {
         );
       }
       paramNames.add(baseName);
-      if (name.endsWith("+") && i !== segments.length - 1) {
+      if (isGreedy && i !== segments.length - 1) {
         throw new Error(
           `Invalid rule "${rule}" in permission "${permName}" of firewall "${serviceName}": {${name}} must be the last segment`
         );
@@ -6888,21 +6992,21 @@ async function expandFirewallConfigs(config, fetchFn) {
 }
 
 // ../../packages/core/src/contracts/user-preferences.ts
-import { z as z22 } from "zod";
-var c19 = initContract();
-var sendModeSchema = z22.enum(["enter", "cmd-enter"]);
-var userPreferencesResponseSchema = z22.object({
-  timezone: z22.string().nullable(),
-  notifyEmail: z22.boolean(),
-  notifySlack: z22.boolean(),
-  pinnedAgentIds: z22.array(z22.string()),
+import { z as z23 } from "zod";
+var c20 = initContract();
+var sendModeSchema = z23.enum(["enter", "cmd-enter"]);
+var userPreferencesResponseSchema = z23.object({
+  timezone: z23.string().nullable(),
+  notifyEmail: z23.boolean(),
+  notifySlack: z23.boolean(),
+  pinnedAgentIds: z23.array(z23.string()),
   sendMode: sendModeSchema
 });
-var updateUserPreferencesRequestSchema = z22.object({
-  timezone: z22.string().min(1).optional(),
-  notifyEmail: z22.boolean().optional(),
-  notifySlack: z22.boolean().optional(),
-  pinnedAgentIds: z22.array(z22.string()).max(4).optional(),
+var updateUserPreferencesRequestSchema = z23.object({
+  timezone: z23.string().min(1).optional(),
+  notifyEmail: z23.boolean().optional(),
+  notifySlack: z23.boolean().optional(),
+  pinnedAgentIds: z23.array(z23.string()).max(4).optional(),
   sendMode: sendModeSchema.optional()
 }).refine(
   (data) => data.timezone !== void 0 || data.notifyEmail !== void 0 || data.notifySlack !== void 0 || data.pinnedAgentIds !== void 0 || data.sendMode !== void 0,
@@ -6910,7 +7014,7 @@ var updateUserPreferencesRequestSchema = z22.object({
     message: "At least one preference must be provided"
   }
 );
-var userPreferencesContract = c19.router({
+var userPreferencesContract = c20.router({
   /**
    * GET /api/user/preferences
    * Get current user's preferences
@@ -6946,17 +7050,17 @@ var userPreferencesContract = c19.router({
 });
 
 // ../../packages/core/src/contracts/org-list.ts
-import { z as z23 } from "zod";
-var c20 = initContract();
-var orgListItemSchema = z23.object({
-  slug: z23.string(),
-  role: z23.string()
+import { z as z24 } from "zod";
+var c21 = initContract();
+var orgListItemSchema = z24.object({
+  slug: z24.string(),
+  role: z24.string()
 });
-var orgListResponseSchema = z23.object({
-  orgs: z23.array(orgListItemSchema),
-  active: z23.string().optional()
+var orgListResponseSchema = z24.object({
+  orgs: z24.array(orgListItemSchema),
+  active: z24.string().optional()
 });
-var orgListContract = c20.router({
+var orgListContract = c21.router({
   /**
    * GET /api/org/list
    * List all orgs accessible to the user
@@ -6975,31 +7079,31 @@ var orgListContract = c20.router({
 });
 
 // ../../packages/core/src/contracts/org-members.ts
-import { z as z24 } from "zod";
-var c21 = initContract();
-var orgRoleSchema = z24.enum(["admin", "member"]);
-var orgMemberSchema = z24.object({
-  userId: z24.string(),
-  email: z24.string(),
+import { z as z25 } from "zod";
+var c22 = initContract();
+var orgRoleSchema = z25.enum(["admin", "member"]);
+var orgMemberSchema = z25.object({
+  userId: z25.string(),
+  email: z25.string(),
   role: orgRoleSchema,
-  joinedAt: z24.string()
+  joinedAt: z25.string()
 });
-var orgMembersResponseSchema = z24.object({
-  slug: z24.string(),
+var orgMembersResponseSchema = z25.object({
+  slug: z25.string(),
   role: orgRoleSchema,
-  members: z24.array(orgMemberSchema),
-  createdAt: z24.string()
+  members: z25.array(orgMemberSchema),
+  createdAt: z25.string()
 });
-var inviteOrgMemberRequestSchema = z24.object({
-  email: z24.string().email()
+var inviteOrgMemberRequestSchema = z25.object({
+  email: z25.string().email()
 });
-var removeOrgMemberRequestSchema = z24.object({
-  email: z24.string().email()
+var removeOrgMemberRequestSchema = z25.object({
+  email: z25.string().email()
 });
-var orgMessageResponseSchema = z24.object({
-  message: z24.string()
+var orgMessageResponseSchema = z25.object({
+  message: z25.string()
 });
-var orgMembersContract = c21.router({
+var orgMembersContract = c22.router({
   /**
    * GET /api/org/members
    * Get org members and status
@@ -7044,7 +7148,7 @@ var orgMembersContract = c21.router({
     method: "POST",
     path: "/api/org/leave",
     headers: authHeadersSchema,
-    body: z24.object({}),
+    body: z25.object({}),
     responses: {
       200: orgMessageResponseSchema,
       401: apiErrorSchema,
@@ -7074,22 +7178,22 @@ var orgMembersContract = c21.router({
 });
 
 // ../../packages/core/src/contracts/onboarding.ts
-import { z as z25 } from "zod";
-var c22 = initContract();
-var onboardingStatusResponseSchema = z25.object({
-  needsOnboarding: z25.boolean(),
-  hasOrg: z25.boolean(),
-  hasModelProvider: z25.boolean(),
-  hasDefaultAgent: z25.boolean(),
-  defaultAgentName: z25.string().nullable(),
-  defaultAgentComposeId: z25.string().nullable(),
-  defaultAgentMetadata: z25.object({
-    displayName: z25.string().optional(),
-    description: z25.string().optional(),
-    sound: z25.string().optional()
+import { z as z26 } from "zod";
+var c23 = initContract();
+var onboardingStatusResponseSchema = z26.object({
+  needsOnboarding: z26.boolean(),
+  hasOrg: z26.boolean(),
+  hasModelProvider: z26.boolean(),
+  hasDefaultAgent: z26.boolean(),
+  defaultAgentName: z26.string().nullable(),
+  defaultAgentComposeId: z26.string().nullable(),
+  defaultAgentMetadata: z26.object({
+    displayName: z26.string().optional(),
+    description: z26.string().optional(),
+    sound: z26.string().optional()
   }).nullable()
 });
-var onboardingStatusContract = c22.router({
+var onboardingStatusContract = c23.router({
   getStatus: {
     method: "GET",
     path: "/api/onboarding/status",
@@ -7103,31 +7207,31 @@ var onboardingStatusContract = c22.router({
 });
 
 // ../../packages/core/src/contracts/skills.ts
-import { z as z26 } from "zod";
-var c23 = initContract();
-var skillFrontmatterSchema = z26.object({
-  name: z26.string().optional(),
-  description: z26.string().optional(),
-  vm0_secrets: z26.array(z26.string()).optional(),
-  vm0_vars: z26.array(z26.string()).optional()
+import { z as z27 } from "zod";
+var c24 = initContract();
+var skillFrontmatterSchema = z27.object({
+  name: z27.string().optional(),
+  description: z27.string().optional(),
+  vm0_secrets: z27.array(z27.string()).optional(),
+  vm0_vars: z27.array(z27.string()).optional()
 });
-var resolvedSkillSchema = z26.object({
-  storageName: z26.string(),
-  versionHash: z26.string(),
+var resolvedSkillSchema = z27.object({
+  storageName: z27.string(),
+  versionHash: z27.string(),
   frontmatter: skillFrontmatterSchema
 });
-var skillsResolveContract = c23.router({
+var skillsResolveContract = c24.router({
   resolve: {
     method: "POST",
     path: "/api/skills/resolve",
     headers: authHeadersSchema,
-    body: z26.object({
-      skills: z26.array(z26.url()).min(1).max(100)
+    body: z27.object({
+      skills: z27.array(z27.url()).min(1).max(100)
     }),
     responses: {
-      200: z26.object({
-        resolved: z26.record(z26.string(), resolvedSkillSchema),
-        unresolved: z26.array(z26.string())
+      200: z27.object({
+        resolved: z27.record(z27.string(), resolvedSkillSchema),
+        unresolved: z27.array(z27.string())
       }),
       400: apiErrorSchema,
       401: apiErrorSchema
@@ -8225,8 +8329,8 @@ async function resolveSkills(skillUrls) {
 }
 
 // src/lib/domain/yaml-validator.ts
-import { z as z27 } from "zod";
-var cliAgentNameSchema = z27.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
+import { z as z28 } from "zod";
+var cliAgentNameSchema = z28.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
   /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/,
   "Agent name must start and end with letter or number, and contain only letters, numbers, and hyphens"
 );
@@ -8240,7 +8344,7 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
             resolveSkillRef(skillRef);
           } catch (error) {
             ctx.addIssue({
-              code: z27.ZodIssueCode.custom,
+              code: z28.ZodIssueCode.custom,
               message: error instanceof Error ? error.message : `Invalid skill reference: ${skillRef}`,
               path: ["skills", i]
             });
@@ -8250,15 +8354,15 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     }
   }
 );
-var cliComposeSchema = z27.object({
-  version: z27.string().min(1, "Missing config.version"),
-  agents: z27.record(cliAgentNameSchema, cliAgentDefinitionSchema),
-  volumes: z27.record(z27.string(), volumeConfigSchema).optional()
+var cliComposeSchema = z28.object({
+  version: z28.string().min(1, "Missing config.version"),
+  agents: z28.record(cliAgentNameSchema, cliAgentDefinitionSchema),
+  volumes: z28.record(z28.string(), volumeConfigSchema).optional()
 }).superRefine((config, ctx) => {
   const agentKeys = Object.keys(config.agents);
   if (agentKeys.length === 0) {
     ctx.addIssue({
-      code: z27.ZodIssueCode.custom,
+      code: z28.ZodIssueCode.custom,
       message: "agents must have at least one agent defined",
       path: ["agents"]
     });
@@ -8266,7 +8370,7 @@ var cliComposeSchema = z27.object({
   }
   if (agentKeys.length > 1) {
     ctx.addIssue({
-      code: z27.ZodIssueCode.custom,
+      code: z28.ZodIssueCode.custom,
       message: "Multiple agents not supported yet. Only one agent allowed.",
       path: ["agents"]
     });
@@ -8278,7 +8382,7 @@ var cliComposeSchema = z27.object({
   if (agentVolumes && agentVolumes.length > 0) {
     if (!config.volumes) {
       ctx.addIssue({
-        code: z27.ZodIssueCode.custom,
+        code: z28.ZodIssueCode.custom,
         message: "Agent references volumes but no volumes section defined. Each volume must have explicit name and version.",
         path: ["volumes"]
       });
@@ -8288,7 +8392,7 @@ var cliComposeSchema = z27.object({
       const parts = volDeclaration.split(":");
       if (parts.length !== 2) {
         ctx.addIssue({
-          code: z27.ZodIssueCode.custom,
+          code: z28.ZodIssueCode.custom,
           message: `Invalid volume declaration: ${volDeclaration}. Expected format: volume-key:/mount/path`,
           path: ["agents", agentName, "volumes"]
         });
@@ -8297,7 +8401,7 @@ var cliComposeSchema = z27.object({
       const volumeKey = parts[0].trim();
       if (!config.volumes[volumeKey]) {
         ctx.addIssue({
-          code: z27.ZodIssueCode.custom,
+          code: z28.ZodIssueCode.custom,
           message: `Volume "${volumeKey}" is not defined in volumes section. Each volume must have explicit name and version.`,
           path: ["volumes", volumeKey]
         });
@@ -9534,7 +9638,7 @@ var composeCommand = new Command7().name("compose").description("Create or updat
         options.autoUpdate = false;
       }
       if (options.autoUpdate !== false) {
-        await startSilentUpgrade("9.62.6");
+        await startSilentUpgrade("9.63.0");
       }
       try {
         let result;
@@ -10356,7 +10460,7 @@ var mainRunCommand = new Command8().name("run").description("Run an agent").argu
   withErrorHandler(
     async (identifier, prompt, options) => {
       if (options.autoUpdate !== false) {
-        await startSilentUpgrade("9.62.6");
+        await startSilentUpgrade("9.63.0");
       }
       const { org, name, version } = parseIdentifier(identifier);
       let composeId;
@@ -12076,7 +12180,7 @@ var cookAction = new Command35().name("cook").description("Quick start: prepare,
   withErrorHandler(
     async (prompt, options) => {
       if (options.autoUpdate !== false) {
-        const shouldExit = await checkAndUpgrade("9.62.6", prompt);
+        const shouldExit = await checkAndUpgrade("9.63.0", prompt);
         if (shouldExit) {
           process.exit(0);
         }
@@ -13684,7 +13788,7 @@ var listCommand6 = new Command52().name("list").alias("ls").description("List al
       );
       return;
     }
-    const nameWidth = Math.max(4, ...data.composes.map((c24) => c24.name.length));
+    const nameWidth = Math.max(4, ...data.composes.map((c25) => c25.name.length));
     const header = ["NAME".padEnd(nameWidth), "VERSION", "UPDATED"].join(
       "  "
     );
@@ -14288,7 +14392,7 @@ async function gatherFrequency(optionFrequency, existingFrequency) {
   if (!isInteractive()) {
     throw new Error("--frequency is required (daily|weekly|monthly|once|loop)");
   }
-  const defaultIndex = existingFrequency ? FREQUENCY_CHOICES.findIndex((c24) => c24.value === existingFrequency) : 0;
+  const defaultIndex = existingFrequency ? FREQUENCY_CHOICES.findIndex((c25) => c25.value === existingFrequency) : 0;
   frequency = await promptSelect(
     "Schedule frequency",
     FREQUENCY_CHOICES,
@@ -14313,7 +14417,7 @@ async function gatherDay(frequency, optionDay, existingDay) {
     throw new Error("--day is required for weekly/monthly");
   }
   if (frequency === "weekly") {
-    const defaultDayIndex = existingDay !== void 0 ? DAY_OF_WEEK_CHOICES.findIndex((c24) => c24.value === existingDay) : 0;
+    const defaultDayIndex = existingDay !== void 0 ? DAY_OF_WEEK_CHOICES.findIndex((c25) => c25.value === existingDay) : 0;
     const day2 = await promptSelect(
       "Day of week",
       DAY_OF_WEEK_CHOICES,
@@ -16315,7 +16419,7 @@ import chalk69 from "chalk";
 var listCommand11 = new Command78().name("list").alias("ls").description("List all connectors and their status").action(
   withErrorHandler(async () => {
     const result = await listConnectors();
-    const connectedMap = new Map(result.connectors.map((c24) => [c24.type, c24]));
+    const connectedMap = new Map(result.connectors.map((c25) => [c25.type, c25]));
     const allTypesRaw = Object.keys(CONNECTOR_TYPES);
     const allTypes = [];
     for (const type2 of allTypesRaw) {
@@ -16337,8 +16441,8 @@ var listCommand11 = new Command78().name("list").alias("ls").description("List a
     console.log(chalk69.dim(header));
     for (const type2 of allTypes) {
       const connector = connectedMap.get(type2);
-      const status = connector ? chalk69.green("\u2713".padEnd(statusWidth)) : chalk69.dim("-".padEnd(statusWidth));
-      const account = connector?.externalUsername ? `@${connector.externalUsername}` : chalk69.dim("-");
+      const status = connector ? connector.needsReconnect ? chalk69.yellow("!".padEnd(statusWidth)) : chalk69.green("\u2713".padEnd(statusWidth)) : chalk69.dim("-".padEnd(statusWidth));
+      const account = connector?.needsReconnect ? chalk69.yellow("(reconnect needed)") : connector?.externalUsername ? `@${connector.externalUsername}` : chalk69.dim("-");
       const row = [type2.padEnd(typeWidth), status, account].join("  ");
       console.log(row);
     }
@@ -16847,16 +16951,16 @@ async function handleModelProvider(ctx) {
     const providerType = await step.prompt(
       () => promptSelect(
         "Select provider type:",
-        choices.map((c24) => ({
-          title: c24.label,
-          value: c24.type
+        choices.map((c25) => ({
+          title: c25.label,
+          value: c25.type
         }))
       )
     );
     if (!providerType) {
       process.exit(0);
     }
-    const selectedChoice = choices.find((c24) => c24.type === providerType);
+    const selectedChoice = choices.find((c25) => c25.type === providerType);
     if (selectedChoice?.helpText) {
       for (const line of selectedChoice.helpText.split("\n")) {
         step.detail(chalk75.dim(line));
@@ -17210,13 +17314,13 @@ var upgradeCommand = new Command86().name("upgrade").description("Upgrade vm0 CL
     if (latestVersion === null) {
       throw new Error("Could not check for updates. Please try again later.");
     }
-    if (latestVersion === "9.62.6") {
-      console.log(chalk79.green(`\u2713 Already up to date (${"9.62.6"})`));
+    if (latestVersion === "9.63.0") {
+      console.log(chalk79.green(`\u2713 Already up to date (${"9.63.0"})`));
       return;
     }
     console.log(
       chalk79.yellow(
-        `Current version: ${"9.62.6"} -> Latest version: ${latestVersion}`
+        `Current version: ${"9.63.0"} -> Latest version: ${latestVersion}`
       )
     );
     console.log();
@@ -17243,7 +17347,7 @@ var upgradeCommand = new Command86().name("upgrade").description("Upgrade vm0 CL
     const success = await performUpgrade(packageManager);
     if (success) {
       console.log(
-        chalk79.green(`\u2713 Upgraded from ${"9.62.6"} to ${latestVersion}`)
+        chalk79.green(`\u2713 Upgraded from ${"9.63.0"} to ${latestVersion}`)
       );
       return;
     }
@@ -17257,7 +17361,7 @@ var upgradeCommand = new Command86().name("upgrade").description("Upgrade vm0 CL
 
 // src/index.ts
 var program = new Command87();
-program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.62.6");
+program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.63.0");
 program.addCommand(authCommand);
 program.addCommand(infoCommand);
 program.addCommand(composeCommand);