@vm0/cli 9.70.3 → 9.72.0

package/index.js

@@ -45,7 +45,7 @@ if (DSN) {
   Sentry.init({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.70.3",
+    release: "9.72.0",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -64,7 +64,7 @@ if (DSN) {
     }
   });
   Sentry.setContext("cli", {
-    version: "9.70.3",
+    version: "9.72.0",
     command: process.argv.slice(2).join(" ")
   });
   Sentry.setContext("runtime", {
@@ -675,7 +675,7 @@ function getConfigPath() {
   return join2(homedir2(), ".vm0", "config.json");
 }
 var infoCommand = new Command6().name("info").description("Display environment and debug information").action(async () => {
-  console.log(chalk4.bold(`VM0 CLI v${"9.70.3"}`));
+  console.log(chalk4.bold(`VM0 CLI v${"9.72.0"}`));
   console.log();
   const config = await loadConfig();
   const hasEnvToken = !!process.env.VM0_TOKEN;
@@ -1162,7 +1162,7 @@ var logDetailSchema = z5.object({
 var logsListContract = c2.router({
   list: {
     method: "GET",
-    path: "/api/app/logs",
+    path: "/api/zero/logs",
     query: listQuerySchema.extend({
       search: z5.string().optional(),
       agent: z5.string().optional(),
@@ -1180,7 +1180,7 @@ var logsListContract = c2.router({
 var logsByIdContract = c2.router({
   getById: {
     method: "GET",
-    path: "/api/app/logs/:id",
+    path: "/api/zero/logs/:id",
     headers: authHeadersSchema,
     pathParams: z5.object({
       id: z5.string().uuid("Invalid log ID")
@@ -1373,14 +1373,14 @@ var orgContract = c4.router({
 });
 var orgDefaultAgentContract = c4.router({
   /**
-   * PUT /api/orgs/default-agent?org={slug}
+   * PUT /api/zero/default-agent?org={slug}
    * Set or unset the default agent for an org.
    * Only org admins can perform this action.
    * The agent must belong to the same org.
    */
   setDefaultAgent: {
     method: "PUT",
-    path: "/api/orgs/default-agent",
+    path: "/api/zero/default-agent",
     headers: authHeadersSchema,
     query: z7.object({
       org: z7.string().optional()
@@ -1440,6 +1440,10 @@ var unifiedRunRequestSchema = z8.object({
   appendSystemPrompt: z8.string().optional(),
   // Optional list of tools to disable in Claude CLI (passed as --disallowed-tools)
   disallowedTools: z8.array(z8.string()).optional(),
+  // Optional list of tools to make available in Claude CLI (passed as --tools)
+  tools: z8.array(z8.string()).optional(),
+  // Settings JSON to pass to Claude CLI (passed as --settings)
+  settings: z8.string().optional(),
   // How the run was triggered (defaults to "cli" on the server if not provided)
   triggerSource: triggerSourceSchema.optional()
 });
@@ -1654,17 +1658,22 @@ var agentEventsResponseSchema = z8.object({
 });
 var networkLogEntrySchema = z8.object({
   timestamp: z8.string(),
-  mode: z8.literal("mitm").optional(),
   action: z8.enum(["ALLOW", "DENY"]).optional(),
   host: z8.string().optional(),
   port: z8.number().optional(),
-  rule_matched: z8.string().nullable().optional(),
   method: z8.string().optional(),
   url: z8.string().optional(),
   status: z8.number().optional(),
   latency_ms: z8.number().optional(),
   request_size: z8.number().optional(),
-  response_size: z8.number().optional()
+  response_size: z8.number().optional(),
+  firewall_base: z8.string().optional(),
+  firewall_name: z8.string().optional(),
+  firewall_ref: z8.string().optional(),
+  firewall_permission: z8.string().optional(),
+  firewall_rule_match: z8.string().optional(),
+  firewall_params: z8.record(z8.string(), z8.string()).optional(),
+  firewall_error: z8.string().optional()
 });
 var networkLogsResponseSchema = z8.object({
   networkLogs: z8.array(networkLogEntrySchema),
@@ -3393,7 +3402,7 @@ var chatThreadDetailSchema = z18.object({
 var chatThreadsContract = c14.router({
   create: {
     method: "POST",
-    path: "/api/chat-threads",
+    path: "/api/zero/chat-threads",
     headers: authHeadersSchema,
     body: z18.object({
       agentComposeId: z18.string().min(1),
@@ -3407,7 +3416,7 @@ var chatThreadsContract = c14.router({
   },
   list: {
     method: "GET",
-    path: "/api/chat-threads",
+    path: "/api/zero/chat-threads",
     headers: authHeadersSchema,
     query: z18.object({
       agentComposeId: z18.string().min(1, "agentComposeId is required")
@@ -3422,7 +3431,7 @@ var chatThreadsContract = c14.router({
 var chatThreadByIdContract = c14.router({
   get: {
     method: "GET",
-    path: "/api/chat-threads/:id",
+    path: "/api/zero/chat-threads/:id",
     headers: authHeadersSchema,
     pathParams: z18.object({ id: z18.string() }),
     responses: {
@@ -3436,7 +3445,7 @@ var chatThreadByIdContract = c14.router({
 var chatThreadRunsContract = c14.router({
   addRun: {
     method: "POST",
-    path: "/api/chat-threads/:id/runs",
+    path: "/api/zero/chat-threads/:id/runs",
     headers: authHeadersSchema,
     pathParams: z18.object({ id: z18.string() }),
     body: z18.object({
@@ -3534,6 +3543,10 @@ var storedExecutionContextSchema = z19.object({
   experimentalCapabilities: z19.array(z19.enum(VALID_CAPABILITIES)).optional(),
   // Tools to disable in Claude CLI (passed as --disallowed-tools)
   disallowedTools: z19.array(z19.string()).optional(),
+  // Tools to make available in Claude CLI (passed as --tools)
+  tools: z19.array(z19.string()).optional(),
+  // Settings JSON to pass to Claude CLI (passed as --settings)
+  settings: z19.string().optional(),
   // VM profile for resource allocation (e.g., "vm0/default")
   experimentalProfile: z19.string().optional()
 });
@@ -3574,6 +3587,10 @@ var executionContextSchema = z19.object({
   experimentalCapabilities: z19.array(z19.enum(VALID_CAPABILITIES)).optional(),
   // Tools to disable in Claude CLI (passed as --disallowed-tools)
   disallowedTools: z19.array(z19.string()).optional(),
+  // Tools to make available in Claude CLI (passed as --tools)
+  tools: z19.array(z19.string()).optional(),
+  // Settings JSON to pass to Claude CLI (passed as --settings)
+  settings: z19.string().optional(),
   // VM profile for resource allocation (e.g., "vm0/default")
   experimentalProfile: z19.string().optional()
 });
@@ -7768,7 +7785,7 @@ var onboardingStatusResponseSchema = z25.object({
 var onboardingStatusContract = c21.router({
   getStatus: {
     method: "GET",
-    path: "/api/onboarding/status",
+    path: "/api/zero/onboarding/status",
     headers: authHeadersSchema,
     responses: {
       200: onboardingStatusResponseSchema,
@@ -8551,6 +8568,27 @@ var zeroVariablesContract = c34.router({
   }
 });
 
+// ../../packages/core/src/contracts/zero-sessions.ts
+import { z as z36 } from "zod";
+var c35 = initContract();
+var zeroSessionsByIdContract = c35.router({
+  getById: {
+    method: "GET",
+    path: "/api/zero/sessions/:id",
+    headers: authHeadersSchema,
+    pathParams: z36.object({
+      id: z36.string().min(1, "Session ID is required")
+    }),
+    responses: {
+      200: sessionResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get session by ID (zero proxy)"
+  }
+});
+
 // ../../packages/core/src/storage-names.ts
 function getInstructionsStorageName(agentName) {
   return `agent-instructions@${agentName}`;
@@ -9602,8 +9640,8 @@ async function resolveSkills(skillUrls) {
 }
 
 // src/lib/domain/yaml-validator.ts
-import { z as z36 } from "zod";
-var cliAgentNameSchema = z36.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
+import { z as z37 } from "zod";
+var cliAgentNameSchema = z37.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
   /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/,
   "Agent name must start and end with letter or number, and contain only letters, numbers, and hyphens"
 );
@@ -9617,7 +9655,7 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
             resolveSkillRef(skillRef);
           } catch (error) {
             ctx.addIssue({
-              code: z36.ZodIssueCode.custom,
+              code: z37.ZodIssueCode.custom,
               message: error instanceof Error ? error.message : `Invalid skill reference: ${skillRef}`,
               path: ["skills", i]
             });
@@ -9627,15 +9665,15 @@ var cliAgentDefinitionSchema = agentDefinitionSchema.superRefine(
     }
   }
 );
-var cliComposeSchema = z36.object({
-  version: z36.string().min(1, "Missing config.version"),
-  agents: z36.record(cliAgentNameSchema, cliAgentDefinitionSchema),
-  volumes: z36.record(z36.string(), volumeConfigSchema).optional()
+var cliComposeSchema = z37.object({
+  version: z37.string().min(1, "Missing config.version"),
+  agents: z37.record(cliAgentNameSchema, cliAgentDefinitionSchema),
+  volumes: z37.record(z37.string(), volumeConfigSchema).optional()
 }).superRefine((config, ctx) => {
   const agentKeys = Object.keys(config.agents);
   if (agentKeys.length === 0) {
     ctx.addIssue({
-      code: z36.ZodIssueCode.custom,
+      code: z37.ZodIssueCode.custom,
       message: "agents must have at least one agent defined",
       path: ["agents"]
     });
@@ -9643,7 +9681,7 @@ var cliComposeSchema = z36.object({
   }
   if (agentKeys.length > 1) {
     ctx.addIssue({
-      code: z36.ZodIssueCode.custom,
+      code: z37.ZodIssueCode.custom,
       message: "Multiple agents not supported yet. Only one agent allowed.",
       path: ["agents"]
     });
@@ -9655,7 +9693,7 @@ var cliComposeSchema = z36.object({
   if (agentVolumes && agentVolumes.length > 0) {
     if (!config.volumes) {
       ctx.addIssue({
-        code: z36.ZodIssueCode.custom,
+        code: z37.ZodIssueCode.custom,
         message: "Agent references volumes but no volumes section defined. Each volume must have explicit name and version.",
         path: ["volumes"]
       });
@@ -9665,7 +9703,7 @@ var cliComposeSchema = z36.object({
       const parts = volDeclaration.split(":");
       if (parts.length !== 2) {
         ctx.addIssue({
-          code: z36.ZodIssueCode.custom,
+          code: z37.ZodIssueCode.custom,
           message: `Invalid volume declaration: ${volDeclaration}. Expected format: volume-key:/mount/path`,
           path: ["agents", agentName, "volumes"]
         });
@@ -9674,7 +9712,7 @@ var cliComposeSchema = z36.object({
       const volumeKey = parts[0].trim();
       if (!config.volumes[volumeKey]) {
         ctx.addIssue({
-          code: z36.ZodIssueCode.custom,
+          code: z37.ZodIssueCode.custom,
           message: `Volume "${volumeKey}" is not defined in volumes section. Each volume must have explicit name and version.`,
           path: ["volumes", volumeKey]
         });
@@ -10873,7 +10911,7 @@ var composeCommand = new Command7().name("compose").description("Create or updat
         options.autoUpdate = false;
       }
       if (options.autoUpdate !== false) {
-        await startSilentUpgrade("9.70.3");
+        await startSilentUpgrade("9.72.0");
       }
       try {
         let result;
@@ -11694,11 +11732,17 @@ var mainRunCommand = new Command8().name("run").description("Run an agent").argu
 ).option(
   "--disallowed-tools <tools...>",
   "Tools to disable in Claude CLI (e.g., CronCreate WebSearch)"
+).option(
+  "--tools <tools...>",
+  "Built-in tools to make available in Claude CLI (e.g., Bash Edit Read)"
+).option(
+  "--settings <json>",
+  "Settings JSON to pass to Claude CLI (e.g., hooks, permissions)"
 ).option("--verbose", "Show full tool inputs and outputs").option("--check-env", "Validate secrets and vars before running").addOption(new Option2("--debug-no-mock-claude").hideHelp()).addOption(new Option2("--no-auto-update").hideHelp()).action(
   withErrorHandler(
     async (identifier, prompt, options) => {
       if (options.autoUpdate !== false) {
-        await startSilentUpgrade("9.70.3");
+        await startSilentUpgrade("9.72.0");
       }
       const { org, name, version } = parseIdentifier(identifier);
       let composeId;
@@ -11752,6 +11796,8 @@ var mainRunCommand = new Command8().name("run").description("Run an agent").argu
         modelProvider: options.modelProvider,
         appendSystemPrompt: options.appendSystemPrompt,
         disallowedTools: options.disallowedTools,
+        tools: options.tools,
+        settings: options.settings,
         checkEnv: options.checkEnv || void 0,
         debugNoMockClaude: options.debugNoMockClaude || void 0
       });
@@ -11805,6 +11851,12 @@ var resumeCommand = new Command9().name("resume").description("Resume an agent r
 ).option(
   "--disallowed-tools <tools...>",
   "Tools to disable in Claude CLI (e.g., CronCreate WebSearch)"
+).option(
+  "--tools <tools...>",
+  "Built-in tools to make available in Claude CLI (e.g., Bash Edit Read)"
+).option(
+  "--settings <json>",
+  "Settings JSON to pass to Claude CLI (e.g., hooks, permissions)"
 ).option("--verbose", "Show full tool inputs and outputs").option("--check-env", "Validate secrets and vars before running").addOption(new Option3("--debug-no-mock-claude").hideHelp()).action(
   withErrorHandler(
     async (checkpointId, prompt, options, command) => {
@@ -11829,6 +11881,8 @@ var resumeCommand = new Command9().name("resume").description("Resume an agent r
         modelProvider: options.modelProvider || allOpts.modelProvider,
         appendSystemPrompt: options.appendSystemPrompt || allOpts.appendSystemPrompt,
         disallowedTools: options.disallowedTools || allOpts.disallowedTools,
+        tools: options.tools || allOpts.tools,
+        settings: options.settings || allOpts.settings,
         checkEnv: options.checkEnv || allOpts.checkEnv || void 0,
         debugNoMockClaude: options.debugNoMockClaude || allOpts.debugNoMockClaude || void 0
       });
@@ -11875,6 +11929,12 @@ var continueCommand = new Command10().name("continue").description(
 ).option(
   "--disallowed-tools <tools...>",
   "Tools to disable in Claude CLI (e.g., CronCreate WebSearch)"
+).option(
+  "--tools <tools...>",
+  "Built-in tools to make available in Claude CLI (e.g., Bash Edit Read)"
+).option(
+  "--settings <json>",
+  "Settings JSON to pass to Claude CLI (e.g., hooks, permissions)"
 ).option("--verbose", "Show full tool inputs and outputs").option("--check-env", "Validate secrets and vars before running").addOption(new Option4("--debug-no-mock-claude").hideHelp()).action(
   withErrorHandler(
     async (agentSessionId, prompt, options, command) => {
@@ -11899,6 +11959,8 @@ var continueCommand = new Command10().name("continue").description(
         modelProvider: options.modelProvider || allOpts.modelProvider,
         appendSystemPrompt: options.appendSystemPrompt || allOpts.appendSystemPrompt,
         disallowedTools: options.disallowedTools || allOpts.disallowedTools,
+        tools: options.tools || allOpts.tools,
+        settings: options.settings || allOpts.settings,
         checkEnv: options.checkEnv || allOpts.checkEnv || void 0,
         debugNoMockClaude: options.debugNoMockClaude || allOpts.debugNoMockClaude || void 0
       });
@@ -13436,7 +13498,7 @@ var cookAction = new Command35().name("cook").description("Quick start: prepare,
   withErrorHandler(
     async (prompt, options) => {
       if (options.autoUpdate !== false) {
-        const shouldExit = await checkAndUpgrade("9.70.3", prompt);
+        const shouldExit = await checkAndUpgrade("9.72.0", prompt);
         if (shouldExit) {
           process.exit(0);
         }
@@ -14414,7 +14476,13 @@ function formatMetric(metric) {
   const diskPercent = (metric.disk_used / metric.disk_total * 100).toFixed(1);
   return `[${metric.ts}] CPU: ${metric.cpu.toFixed(1)}% | Mem: ${formatBytes(metric.mem_used)}/${formatBytes(metric.mem_total)} (${memPercent}%) | Disk: ${formatBytes(metric.disk_used)}/${formatBytes(metric.disk_total)} (${diskPercent}%)`;
 }
-function formatNetworkLog(entry) {
+function formatNetworkDeny(entry) {
+  const method = entry.method || "???";
+  const url = entry.url || entry.host || "unknown";
+  const firewall = entry.firewall_name ? ` ${chalk36.cyan(`[${entry.firewall_name}]`)}` : "";
+  return `[${entry.timestamp}] ${method.padEnd(6)} ${chalk36.red.bold("DENY")} ${chalk36.dim(url)}${firewall}`;
+}
+function formatNetworkRequest(entry) {
   let statusColor;
   const status = entry.status || 0;
   if (status >= 200 && status < 300) {
@@ -14439,7 +14507,13 @@ function formatNetworkLog(entry) {
   const requestSize = entry.request_size || 0;
   const responseSize = entry.response_size || 0;
   const url = entry.url || entry.host || "unknown";
-  return `[${entry.timestamp}] ${method.padEnd(6)} ${statusColor(status)} ${latencyColor(latencyMs + "ms")} ${formatBytes(requestSize)}/${formatBytes(responseSize)} ${chalk36.dim(url)}`;
+  const firewall = entry.firewall_name ? ` ${chalk36.cyan(`[${entry.firewall_name}]`)}` : "";
+  const error = entry.firewall_error ? ` ${chalk36.red(entry.firewall_error)}` : "";
+  return `[${entry.timestamp}] ${method.padEnd(6)} ${statusColor(status)} ${latencyColor(latencyMs + "ms")} ${formatBytes(requestSize)}/${formatBytes(responseSize)} ${chalk36.dim(url)}${firewall}${error}`;
+}
+function formatNetworkLog(entry) {
+  if (entry.action === "DENY") return formatNetworkDeny(entry);
+  return formatNetworkRequest(entry);
 }
 function createLogRenderer(verbose) {
   return new EventRenderer({
@@ -15788,7 +15862,7 @@ var listCommand9 = new Command65().name("list").alias("ls").description("List al
       );
       return;
     }
-    const nameWidth = Math.max(4, ...data.composes.map((c35) => c35.name.length));
+    const nameWidth = Math.max(4, ...data.composes.map((c36) => c36.name.length));
     const header = ["NAME".padEnd(nameWidth), "VERSION", "UPDATED"].join(
       "  "
     );
@@ -16389,7 +16463,7 @@ async function gatherFrequency(optionFrequency, existingFrequency) {
   if (!isInteractive()) {
     throw new Error("--frequency is required (daily|weekly|monthly|once|loop)");
   }
-  const defaultIndex = existingFrequency ? FREQUENCY_CHOICES.findIndex((c35) => c35.value === existingFrequency) : 0;
+  const defaultIndex = existingFrequency ? FREQUENCY_CHOICES.findIndex((c36) => c36.value === existingFrequency) : 0;
   frequency = await promptSelect(
     "Schedule frequency",
     FREQUENCY_CHOICES,
@@ -16414,7 +16488,7 @@ async function gatherDay(frequency, optionDay, existingDay) {
     throw new Error("--day is required for weekly/monthly");
   }
   if (frequency === "weekly") {
-    const defaultDayIndex = existingDay !== void 0 ? DAY_OF_WEEK_CHOICES.findIndex((c35) => c35.value === existingDay) : 0;
+    const defaultDayIndex = existingDay !== void 0 ? DAY_OF_WEEK_CHOICES.findIndex((c36) => c36.value === existingDay) : 0;
     const day2 = await promptSelect(
       "Day of week",
       DAY_OF_WEEK_CHOICES,
@@ -17864,7 +17938,7 @@ import chalk76 from "chalk";
 var listCommand13 = new Command86().name("list").alias("ls").description("List all connectors and their status").action(
   withErrorHandler(async () => {
     const result = await listConnectors();
-    const connectedMap = new Map(result.connectors.map((c35) => [c35.type, c35]));
+    const connectedMap = new Map(result.connectors.map((c36) => [c36.type, c36]));
     const allTypesRaw = Object.keys(CONNECTOR_TYPES);
     const allTypes = [];
     for (const type2 of allTypesRaw) {
@@ -18425,16 +18499,16 @@ async function handleModelProvider(ctx) {
     const providerType = await step.prompt(
       () => promptSelect(
         "Select provider type:",
-        choices.map((c35) => ({
-          title: c35.label,
-          value: c35.type
+        choices.map((c36) => ({
+          title: c36.label,
+          value: c36.type
         }))
       )
     );
     if (!providerType) {
       process.exit(0);
     }
-    const selectedChoice = choices.find((c35) => c35.type === providerType);
+    const selectedChoice = choices.find((c36) => c36.type === providerType);
     if (selectedChoice?.helpText) {
       for (const line of selectedChoice.helpText.split("\n")) {
         step.detail(chalk82.dim(line));
@@ -18788,13 +18862,13 @@ var upgradeCommand = new Command94().name("upgrade").description("Upgrade vm0 CL
     if (latestVersion === null) {
       throw new Error("Could not check for updates. Please try again later.");
     }
-    if (latestVersion === "9.70.3") {
-      console.log(chalk86.green(`\u2713 Already up to date (${"9.70.3"})`));
+    if (latestVersion === "9.72.0") {
+      console.log(chalk86.green(`\u2713 Already up to date (${"9.72.0"})`));
       return;
     }
     console.log(
       chalk86.yellow(
-        `Current version: ${"9.70.3"} -> Latest version: ${latestVersion}`
+        `Current version: ${"9.72.0"} -> Latest version: ${latestVersion}`
       )
     );
     console.log();
@@ -18821,7 +18895,7 @@ var upgradeCommand = new Command94().name("upgrade").description("Upgrade vm0 CL
     const success = await performUpgrade(packageManager);
     if (success) {
       console.log(
-        chalk86.green(`\u2713 Upgraded from ${"9.70.3"} to ${latestVersion}`)
+        chalk86.green(`\u2713 Upgraded from ${"9.72.0"} to ${latestVersion}`)
       );
       return;
     }
@@ -18895,7 +18969,7 @@ var whoamiCommand = new Command95().name("whoami").description("Show current ide
 
 // src/index.ts
 var program = new Command96();
-program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.70.3");
+program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.72.0");
 program.addCommand(authCommand);
 program.addCommand(infoCommand);
 program.addCommand(composeCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vm0/cli",
-  "version": "9.70.3",
+  "version": "9.72.0",
   "description": "CLI application",
   "repository": {
     "type": "git",