@vm0/cli 9.79.3 → 9.81.0

package/zero.js

@@ -1,19 +1,2921 @@
 #!/usr/bin/env node
 import {
-  agentCommand,
+  ApiRequestError,
+  CONNECTOR_TYPES,
+  MODEL_PROVIDER_TYPES,
+  allowsCustomModel,
   configureGlobalProxyFromEnv,
-  zeroConnectorCommand,
-  zeroOrgCommand,
-  zeroPreferenceCommand,
-  zeroScheduleCommand,
-  zeroSecretCommand,
-  zeroVariableCommand
-} from "./chunk-MKJBEFRH.js";
+  connectorTypeSchema,
+  createZeroAgent,
+  createZeroComputerConnector,
+  createZeroConnectorSession,
+  decodeZeroTokenPayload,
+  deleteZeroAgent,
+  deleteZeroComputerConnector,
+  deleteZeroConnector,
+  deleteZeroOrg,
+  deleteZeroOrgModelProvider,
+  deleteZeroOrgSecret,
+  deleteZeroOrgVariable,
+  deleteZeroSchedule,
+  deleteZeroSecret,
+  deleteZeroVariable,
+  deployZeroSchedule,
+  disableZeroSchedule,
+  enableZeroSchedule,
+  getActiveOrg,
+  getApiUrl,
+  getAuthMethodsForType,
+  getBaseUrl,
+  getComposeByName,
+  getConnectorDerivedNames,
+  getCustomModelPlaceholder,
+  getDefaultAuthMethod,
+  getDefaultModel,
+  getModels,
+  getScopeDiff,
+  getSecretsForAuthMethod,
+  getSelectableProviderTypes,
+  getToken,
+  getZeroAgent,
+  getZeroAgentInstructions,
+  getZeroConnector,
+  getZeroConnectorSession,
+  getZeroOrg,
+  getZeroOrgMembers,
+  getZeroUserPreferences,
+  hasAuthMethods,
+  hasModelSelection,
+  hasRequiredScopes,
+  inviteZeroOrgMember,
+  isFeatureEnabled,
+  isInteractive,
+  leaveZeroOrg,
+  listZeroAgents,
+  listZeroConnectors,
+  listZeroOrgModelProviders,
+  listZeroOrgSecrets,
+  listZeroOrgVariables,
+  listZeroOrgs,
+  listZeroSchedules,
+  listZeroSecrets,
+  listZeroVariables,
+  promptConfirm,
+  promptPassword,
+  promptSelect,
+  promptText,
+  removeZeroOrgMember,
+  resolveZeroScheduleByAgent,
+  saveConfig,
+  setZeroOrgModelProviderDefault,
+  setZeroOrgSecret,
+  setZeroOrgVariable,
+  setZeroSecret,
+  setZeroVariable,
+  updateZeroAgent,
+  updateZeroAgentInstructions,
+  updateZeroOrg,
+  updateZeroOrgModelProviderModel,
+  updateZeroUserPreferences,
+  upsertZeroOrgModelProvider,
+  withErrorHandler
+} from "./chunk-3EOIDO3I.js";
 
 // src/zero.ts
+import { Command as Command52 } from "commander";
+
+// src/commands/zero/org/index.ts
+import { Command as Command23 } from "commander";
+
+// src/commands/zero/org/status.ts
 import { Command } from "commander";
-var program = new Command();
-program.name("zero").description("Zero CLI - Manage your zero platform").version("9.79.3");
+import chalk from "chalk";
+var statusCommand = new Command().name("status").description("View current organization status").action(
+  withErrorHandler(async () => {
+    try {
+      const org = await getZeroOrg();
+      console.log(chalk.bold("Organization Information:"));
+      console.log(`  Slug: ${chalk.green(org.slug)}`);
+    } catch (error) {
+      if (error instanceof ApiRequestError && error.status === 404) {
+        throw new Error("No organization configured", {
+          cause: new Error("Set your organization with: zero org set <slug>")
+        });
+      }
+      throw error;
+    }
+  })
+);
+
+// src/commands/zero/org/set.ts
+import { Command as Command2 } from "commander";
+import chalk2 from "chalk";
+var setCommand = new Command2().name("set").description("Rename your organization slug").argument("<slug>", "The new organization slug").option(
+  "--force",
+  "Force change existing organization (may break references)"
+).action(
+  withErrorHandler(async (slug, options) => {
+    try {
+      const existingOrg = await getZeroOrg();
+      if (!options.force) {
+        throw new Error(
+          `You already have an organization: ${existingOrg.slug}`,
+          {
+            cause: new Error(`To change, use: zero org set ${slug} --force`)
+          }
+        );
+      }
+      const org = await updateZeroOrg({ slug, force: true });
+      await saveConfig({ activeOrg: org.slug });
+      console.log(chalk2.green(`\u2713 Organization updated to ${org.slug}`));
+      console.log();
+      console.log("Your agents will now be namespaced as:");
+      console.log(chalk2.cyan(`  ${org.slug}/<agent-name>`));
+    } catch (error) {
+      if (error instanceof Error && error.message.includes("already exists")) {
+        throw new Error(
+          `Organization "${slug}" is already taken. Please choose a different slug.`
+        );
+      }
+      throw error;
+    }
+  })
+);
+
+// src/commands/zero/org/list.ts
+import { Command as Command3 } from "commander";
+import chalk3 from "chalk";
+var listCommand = new Command3().name("list").description("List all accessible organizations").action(
+  withErrorHandler(async () => {
+    const result = await listZeroOrgs();
+    const activeOrg = await getActiveOrg();
+    console.log(chalk3.bold("Available organizations:"));
+    for (const org of result.orgs) {
+      const isCurrent = org.slug === activeOrg;
+      const marker = isCurrent ? chalk3.green("* ") : "  ";
+      const roleLabel = org.role ? ` (${org.role})` : "";
+      const currentLabel = isCurrent ? chalk3.dim(" \u2190 current") : "";
+      console.log(`${marker}${org.slug}${roleLabel}${currentLabel}`);
+    }
+  })
+);
+
+// src/commands/zero/org/use.ts
+import { Command as Command4 } from "commander";
+import chalk4 from "chalk";
+var useCommand = new Command4().name("use").description("Switch to a different organization").argument("<slug>", "Organization slug to switch to").action(
+  withErrorHandler(async (slug) => {
+    const orgList = await listZeroOrgs();
+    const target = orgList.orgs.find((s) => s.slug === slug);
+    if (!target) {
+      throw new Error(`Organization '${slug}' not found or not accessible.`);
+    }
+    await saveConfig({ activeOrg: slug });
+    console.log(chalk4.green(`\u2713 Switched to organization: ${slug}`));
+  })
+);
+
+// src/commands/zero/org/members.ts
+import { Command as Command5 } from "commander";
+import chalk5 from "chalk";
+var membersCommand = new Command5().name("members").description("View organization members").action(
+  withErrorHandler(async () => {
+    const status = await getZeroOrgMembers();
+    console.log(chalk5.bold(`Organization: ${status.slug}`));
+    console.log(`  Role: ${status.role}`);
+    console.log(
+      `  Created: ${new Date(status.createdAt).toLocaleDateString()}`
+    );
+    console.log();
+    console.log(chalk5.bold("Members:"));
+    for (const member of status.members) {
+      const roleTag = member.role === "admin" ? chalk5.yellow(` (${member.role})`) : chalk5.dim(` (${member.role})`);
+      console.log(`  ${member.email}${roleTag}`);
+    }
+  })
+);
+
+// src/commands/zero/org/invite.ts
+import { Command as Command6 } from "commander";
+import chalk6 from "chalk";
+var inviteCommand = new Command6().name("invite").description("Invite a member to the current organization").requiredOption("--email <email>", "Email address of the member to invite").action(
+  withErrorHandler(async (options) => {
+    await inviteZeroOrgMember(options.email);
+    console.log(chalk6.green(`\u2713 Invitation sent to ${options.email}`));
+  })
+);
+
+// src/commands/zero/org/remove.ts
+import { Command as Command7 } from "commander";
+import chalk7 from "chalk";
+var removeCommand = new Command7().name("remove").description("Remove a member from the current organization").argument("<email>", "Email address of the member to remove").action(
+  withErrorHandler(async (email) => {
+    await removeZeroOrgMember(email);
+    console.log(chalk7.green(`\u2713 Removed ${email} from organization`));
+  })
+);
+
+// src/commands/zero/org/leave.ts
+import { Command as Command8 } from "commander";
+import chalk8 from "chalk";
+var leaveCommand = new Command8().name("leave").description("Leave the current organization").action(
+  withErrorHandler(async () => {
+    await leaveZeroOrg();
+    const { orgs } = await listZeroOrgs();
+    if (orgs.length === 0) {
+      await saveConfig({ activeOrg: void 0 });
+      console.log(chalk8.green("\u2713 Left organization."));
+      console.log(
+        chalk8.yellow("No remaining organizations. Run: vm0 auth login")
+      );
+      return;
+    }
+    const nextOrg = orgs[0].slug;
+    await saveConfig({ activeOrg: nextOrg });
+    console.log(chalk8.green(`\u2713 Left organization. Switched to: ${nextOrg}`));
+  })
+);
+
+// src/commands/zero/org/delete.ts
+import { Command as Command9 } from "commander";
+import chalk9 from "chalk";
+var deleteCommand = new Command9().name("delete").description("Delete the current organization (admin only)").argument("<slug>", "Organization slug to confirm deletion").action(
+  withErrorHandler(async (slug) => {
+    await deleteZeroOrg(slug);
+    console.log(chalk9.green(`\u2713 Organization '${slug}' has been deleted.`));
+  })
+);
+
+// src/commands/zero/org/secret/index.ts
+import { Command as Command13 } from "commander";
+
+// src/commands/zero/org/secret/list.ts
+import { Command as Command10 } from "commander";
+import chalk10 from "chalk";
+var listCommand2 = new Command10().name("list").alias("ls").description("List all org-level secrets").action(
+  withErrorHandler(async () => {
+    const result = await listZeroOrgSecrets();
+    if (result.secrets.length === 0) {
+      console.log(chalk10.dim("No org secrets found"));
+      console.log();
+      console.log("To add an org secret:");
+      console.log(
+        chalk10.cyan("  zero org secret set MY_API_KEY --body <value>")
+      );
+      return;
+    }
+    console.log(chalk10.bold("Org Secrets:"));
+    console.log();
+    for (const secret of result.secrets) {
+      console.log(`  ${chalk10.cyan(secret.name)}`);
+      if (secret.description) {
+        console.log(`    ${chalk10.dim(secret.description)}`);
+      }
+      console.log(
+        `    ${chalk10.dim(`Updated: ${new Date(secret.updatedAt).toLocaleString()}`)}`
+      );
+      console.log();
+    }
+    console.log(chalk10.dim(`Total: ${result.secrets.length} secret(s)`));
+  })
+);
+
+// src/commands/zero/org/secret/set.ts
+import { Command as Command11 } from "commander";
+import chalk11 from "chalk";
+var setCommand2 = new Command11().name("set").description("Create or update an org-level secret (admin only)").argument("<name>", "Secret name (uppercase, e.g., MY_API_KEY)").option(
+  "-b, --body <value>",
+  "Secret value (required in non-interactive mode)"
+).option("-d, --description <description>", "Optional description").action(
+  withErrorHandler(
+    async (name, options) => {
+      let value;
+      if (options.body !== void 0) {
+        value = options.body;
+      } else if (isInteractive()) {
+        const prompted = await promptPassword("Enter secret value:");
+        if (prompted === void 0) {
+          process.exit(0);
+        }
+        value = prompted;
+      } else {
+        throw new Error("--body is required in non-interactive mode", {
+          cause: new Error(
+            `Usage: zero org secret set ${name} --body "your-secret-value"`
+          )
+        });
+      }
+      let secret;
+      try {
+        secret = await setZeroOrgSecret({
+          name,
+          value,
+          description: options.description
+        });
+      } catch (error) {
+        if (error instanceof Error && error.message.includes("must contain only uppercase")) {
+          throw new Error(error.message, {
+            cause: new Error(
+              "Examples of valid secret names: MY_API_KEY, GITHUB_TOKEN, AWS_ACCESS_KEY_ID"
+            )
+          });
+        }
+        throw error;
+      }
+      console.log(chalk11.green(`\u2713 Org secret "${secret.name}" saved`));
+    }
+  )
+);
+
+// src/commands/zero/org/secret/remove.ts
+import { Command as Command12 } from "commander";
+import chalk12 from "chalk";
+var removeCommand2 = new Command12().name("remove").description("Delete an org-level secret (admin only)").argument("<name>", "Secret name to delete").option("-y, --yes", "Skip confirmation prompt").action(
+  withErrorHandler(async (name, options) => {
+    if (!options.yes) {
+      if (!isInteractive()) {
+        throw new Error("--yes flag is required in non-interactive mode");
+      }
+      const confirmed = await promptConfirm(
+        `Are you sure you want to delete org secret "${name}"?`,
+        false
+      );
+      if (!confirmed) {
+        console.log(chalk12.dim("Cancelled"));
+        return;
+      }
+    }
+    await deleteZeroOrgSecret(name);
+    console.log(chalk12.green(`\u2713 Org secret "${name}" deleted`));
+  })
+);
+
+// src/commands/zero/org/secret/index.ts
+var zeroOrgSecretCommand = new Command13().name("secret").description("Manage org-level secrets (admin)").addCommand(listCommand2).addCommand(setCommand2).addCommand(removeCommand2);
+
+// src/commands/zero/org/variable/index.ts
+import { Command as Command17 } from "commander";
+
+// src/commands/zero/org/variable/list.ts
+import { Command as Command14 } from "commander";
+import chalk13 from "chalk";
+function truncateValue(value, maxLength = 60) {
+  if (value.length <= maxLength) {
+    return value;
+  }
+  return value.slice(0, maxLength - 15) + "... [truncated]";
+}
+var listCommand3 = new Command14().name("list").alias("ls").description("List all org-level variables").action(
+  withErrorHandler(async () => {
+    const result = await listZeroOrgVariables();
+    if (result.variables.length === 0) {
+      console.log(chalk13.dim("No org variables found"));
+      console.log();
+      console.log("To add an org variable:");
+      console.log(chalk13.cyan("  zero org variable set MY_VAR <value>"));
+      return;
+    }
+    console.log(chalk13.bold("Org Variables:"));
+    console.log();
+    for (const variable of result.variables) {
+      const displayValue = truncateValue(variable.value);
+      console.log(`  ${chalk13.cyan(variable.name)} = ${displayValue}`);
+      if (variable.description) {
+        console.log(`    ${chalk13.dim(variable.description)}`);
+      }
+      console.log(
+        `    ${chalk13.dim(`Updated: ${new Date(variable.updatedAt).toLocaleString()}`)}`
+      );
+      console.log();
+    }
+    console.log(chalk13.dim(`Total: ${result.variables.length} variable(s)`));
+  })
+);
+
+// src/commands/zero/org/variable/set.ts
+import { Command as Command15 } from "commander";
+import chalk14 from "chalk";
+var setCommand3 = new Command15().name("set").description("Create or update an org-level variable (admin only)").argument("<name>", "Variable name (uppercase, e.g., MY_VAR)").argument("<value>", "Variable value").option("-d, --description <description>", "Optional description").action(
+  withErrorHandler(
+    async (name, value, options) => {
+      let variable;
+      try {
+        variable = await setZeroOrgVariable({
+          name,
+          value,
+          description: options.description
+        });
+      } catch (error) {
+        if (error instanceof Error && error.message.includes("must contain only uppercase")) {
+          throw new Error(error.message, {
+            cause: new Error(
+              "Examples of valid variable names: MY_VAR, API_URL, DEBUG_MODE"
+            )
+          });
+        }
+        throw error;
+      }
+      console.log(chalk14.green(`\u2713 Org variable "${variable.name}" saved`));
+    }
+  )
+);
+
+// src/commands/zero/org/variable/remove.ts
+import { Command as Command16 } from "commander";
+import chalk15 from "chalk";
+var removeCommand3 = new Command16().name("remove").description("Delete an org-level variable (admin only)").argument("<name>", "Variable name to delete").option("-y, --yes", "Skip confirmation prompt").action(
+  withErrorHandler(async (name, options) => {
+    if (!options.yes) {
+      if (!isInteractive()) {
+        throw new Error("--yes flag is required in non-interactive mode");
+      }
+      const confirmed = await promptConfirm(
+        `Are you sure you want to delete org variable "${name}"?`,
+        false
+      );
+      if (!confirmed) {
+        console.log(chalk15.dim("Cancelled"));
+        return;
+      }
+    }
+    await deleteZeroOrgVariable(name);
+    console.log(chalk15.green(`\u2713 Org variable "${name}" deleted`));
+  })
+);
+
+// src/commands/zero/org/variable/index.ts
+var zeroOrgVariableCommand = new Command17().name("variable").description("Manage org-level variables (admin)").addCommand(listCommand3).addCommand(setCommand3).addCommand(removeCommand3);
+
+// src/commands/zero/org/model-provider/index.ts
+import { Command as Command22 } from "commander";
+
+// src/commands/zero/org/model-provider/list.ts
+import { Command as Command18 } from "commander";
+import chalk16 from "chalk";
+var listCommand4 = new Command18().name("list").alias("ls").description("List all org-level model providers").action(
+  withErrorHandler(async () => {
+    const result = await listZeroOrgModelProviders();
+    if (result.modelProviders.length === 0) {
+      console.log(chalk16.dim("No org-level model providers configured"));
+      console.log();
+      console.log("To add an org-level model provider:");
+      console.log(chalk16.cyan("  zero org model-provider setup"));
+      return;
+    }
+    const byFramework = result.modelProviders.reduce(
+      (acc, p) => {
+        const fw = p.framework;
+        if (!acc[fw]) {
+          acc[fw] = [];
+        }
+        acc[fw].push(p);
+        return acc;
+      },
+      {}
+    );
+    console.log(chalk16.bold("Org Model Providers:"));
+    console.log();
+    for (const [framework, providers] of Object.entries(byFramework)) {
+      console.log(`  ${chalk16.cyan(framework)}:`);
+      for (const provider of providers) {
+        const defaultTag = provider.isDefault ? chalk16.green(" (default)") : "";
+        const modelTag = provider.selectedModel ? chalk16.dim(` [${provider.selectedModel}]`) : "";
+        console.log(`    ${provider.type}${defaultTag}${modelTag}`);
+        console.log(
+          chalk16.dim(
+            `      Updated: ${new Date(provider.updatedAt).toLocaleString()}`
+          )
+        );
+      }
+      console.log();
+    }
+    console.log(
+      chalk16.dim(`Total: ${result.modelProviders.length} provider(s)`)
+    );
+  })
+);
+
+// src/commands/zero/org/model-provider/setup.ts
+import { Command as Command19 } from "commander";
+import chalk18 from "chalk";
+import prompts2 from "prompts";
+
+// src/lib/domain/model-provider/shared.ts
+import chalk17 from "chalk";
+import prompts from "prompts";
+function validateProviderType(typeStr) {
+  if (!Object.keys(MODEL_PROVIDER_TYPES).includes(typeStr)) {
+    const validTypes = Object.keys(MODEL_PROVIDER_TYPES).join(", ");
+    throw new Error(`Invalid type "${typeStr}"`, {
+      cause: new Error(`Valid types: ${validTypes}`)
+    });
+  }
+  return typeStr;
+}
+function validateModel(type, modelStr) {
+  const models = getModels(type);
+  if (allowsCustomModel(type)) {
+    return modelStr;
+  }
+  if (models && !models.includes(modelStr)) {
+    throw new Error(`Invalid model "${modelStr}"`, {
+      cause: new Error(`Valid models: ${models.join(", ")}`)
+    });
+  }
+  return modelStr;
+}
+function validateAuthMethod(type, authMethodStr) {
+  const authMethods = getAuthMethodsForType(type);
+  if (!authMethods || !(authMethodStr in authMethods)) {
+    const validMethods = authMethods ? Object.keys(authMethods).join(", ") : "none";
+    throw new Error(`Invalid auth method "${authMethodStr}"`, {
+      cause: new Error(`Valid auth methods: ${validMethods}`)
+    });
+  }
+  return authMethodStr;
+}
+function parseSecrets(type, authMethod, secretArgs) {
+  const secretsConfig = getSecretsForAuthMethod(type, authMethod);
+  if (!secretsConfig) {
+    throw new Error(`Invalid auth method "${authMethod}"`);
+  }
+  const secretNames = Object.keys(secretsConfig);
+  const firstArg = secretArgs[0];
+  if (secretArgs.length === 1 && firstArg && !firstArg.includes("=")) {
+    if (secretNames.length !== 1) {
+      throw new Error(
+        "Must use KEY=VALUE format for multi-secret auth methods",
+        { cause: new Error(`Required secrets: ${secretNames.join(", ")}`) }
+      );
+    }
+    const firstSecretName = secretNames[0];
+    if (!firstSecretName) {
+      throw new Error("No secrets defined for this auth method");
+    }
+    return { [firstSecretName]: firstArg };
+  }
+  const secrets = {};
+  for (const arg of secretArgs) {
+    const eqIndex = arg.indexOf("=");
+    if (eqIndex === -1) {
+      throw new Error(`Invalid secret format "${arg}"`, {
+        cause: new Error("Use KEY=VALUE format (e.g., AWS_REGION=us-east-1)")
+      });
+    }
+    const key = arg.slice(0, eqIndex);
+    const value = arg.slice(eqIndex + 1);
+    secrets[key] = value;
+  }
+  return secrets;
+}
+function validateSecrets(type, authMethod, secrets) {
+  const secretsConfig = getSecretsForAuthMethod(type, authMethod);
+  if (!secretsConfig) {
+    throw new Error(`Invalid auth method "${authMethod}"`);
+  }
+  for (const [name, fieldConfig] of Object.entries(secretsConfig)) {
+    if (fieldConfig.required && !secrets[name]) {
+      const requiredNames = Object.entries(secretsConfig).filter(([, fc]) => fc.required).map(([n]) => n).join(", ");
+      throw new Error(`Missing required secret: ${name}`, {
+        cause: new Error(`Required secrets: ${requiredNames}`)
+      });
+    }
+  }
+  for (const name of Object.keys(secrets)) {
+    if (!(name in secretsConfig)) {
+      const validNames = Object.keys(secretsConfig).join(", ");
+      throw new Error(`Unknown secret: ${name}`, {
+        cause: new Error(`Valid secrets: ${validNames}`)
+      });
+    }
+  }
+}
+function handleNonInteractiveMode(options) {
+  const type = validateProviderType(options.type);
+  const cmdPrefix = options.commandPrefix ?? "zero org model-provider setup";
+  let selectedModel;
+  if (options.model) {
+    selectedModel = validateModel(type, options.model);
+  } else if (hasModelSelection(type)) {
+    const defaultModel = getDefaultModel(type);
+    selectedModel = defaultModel || void 0;
+  }
+  if (hasAuthMethods(type)) {
+    let authMethod;
+    if (options.authMethod) {
+      authMethod = validateAuthMethod(type, options.authMethod);
+    } else {
+      const defaultAuthMethod = getDefaultAuthMethod(type);
+      const authMethods = getAuthMethodsForType(type);
+      if (!defaultAuthMethod || !authMethods) {
+        throw new Error(`Provider "${type}" requires --auth-method`);
+      }
+      const authMethodNames = Object.keys(authMethods);
+      if (authMethodNames.length === 1) {
+        authMethod = authMethodNames[0];
+      } else {
+        const methods = authMethodNames.join(", ");
+        throw new Error(
+          `--auth-method is required for "${type}" (multiple auth methods available)`,
+          {
+            cause: new Error(
+              `Available: ${methods}. Example: ${cmdPrefix} --type ${type} --auth-method ${authMethodNames[0]} --secret KEY=VALUE`
+            )
+          }
+        );
+      }
+    }
+    const secrets = parseSecrets(type, authMethod, options.secret);
+    validateSecrets(type, authMethod, secrets);
+    return {
+      type,
+      authMethod,
+      secrets,
+      selectedModel,
+      isInteractiveMode: false
+    };
+  }
+  const secretArgs = options.secret;
+  const firstArg = secretArgs[0];
+  if (!firstArg) {
+    throw new Error("Secret is required");
+  }
+  let secret;
+  if (firstArg.includes("=")) {
+    secret = firstArg.slice(firstArg.indexOf("=") + 1);
+  } else {
+    secret = firstArg;
+  }
+  return {
+    type,
+    secret,
+    selectedModel,
+    isInteractiveMode: false
+  };
+}
+async function promptForModelSelection(type) {
+  if (!hasModelSelection(type)) {
+    return void 0;
+  }
+  const models = getModels(type) ?? [];
+  const defaultModel = getDefaultModel(type);
+  const supportsCustomModel = allowsCustomModel(type);
+  const modelChoices = [];
+  if (defaultModel === "") {
+    modelChoices.push({ title: "auto (Recommended)", value: "" });
+  }
+  for (const model of models) {
+    modelChoices.push({
+      title: model === defaultModel ? `${model} (Recommended)` : model,
+      value: model
+    });
+  }
+  if (supportsCustomModel) {
+    modelChoices.push({ title: "Custom model ID", value: "__custom__" });
+  }
+  const modelResponse = await prompts(
+    {
+      type: "select",
+      name: "model",
+      message: "Select model:",
+      choices: modelChoices
+    },
+    { onCancel: () => process.exit(0) }
+  );
+  const selected = modelResponse.model;
+  if (selected === "__custom__") {
+    const placeholder = getCustomModelPlaceholder(type);
+    if (placeholder) {
+      console.log(chalk17.dim(`Example: ${placeholder}`));
+    }
+    const customResponse = await prompts(
+      {
+        type: "text",
+        name: "customModel",
+        message: "Enter model ID:",
+        validate: (value) => value.length > 0 || "Model ID is required"
+      },
+      { onCancel: () => process.exit(0) }
+    );
+    return customResponse.customModel;
+  }
+  return selected === "" ? void 0 : selected;
+}
+async function promptForAuthMethod(type) {
+  const authMethods = getAuthMethodsForType(type);
+  const defaultAuthMethod = getDefaultAuthMethod(type);
+  if (!authMethods) {
+    return "default";
+  }
+  const choices = Object.entries(authMethods).map(([method, config]) => ({
+    title: method === defaultAuthMethod ? `${config.label} (Recommended)` : config.label,
+    value: method
+  }));
+  const response = await prompts(
+    {
+      type: "select",
+      name: "authMethod",
+      message: "Select authentication method:",
+      choices
+    },
+    { onCancel: () => process.exit(0) }
+  );
+  return response.authMethod;
+}
+function isSensitiveSecret(name) {
+  const nonSecretPatterns = ["REGION", "ENDPOINT", "URL"];
+  return !nonSecretPatterns.some(
+    (pattern) => name.toUpperCase().includes(pattern)
+  );
+}
+async function promptForSecrets(type, authMethod) {
+  const secretsConfig = getSecretsForAuthMethod(type, authMethod);
+  if (!secretsConfig) {
+    throw new Error(`Invalid auth method "${authMethod}"`);
+  }
+  const secrets = {};
+  for (const [name, fieldConfig] of Object.entries(secretsConfig)) {
+    if (fieldConfig.helpText) {
+      console.log(chalk17.dim(fieldConfig.helpText));
+    }
+    const isSensitive = isSensitiveSecret(name);
+    const placeholder = "placeholder" in fieldConfig ? fieldConfig.placeholder : "";
+    if (fieldConfig.required) {
+      const response = await prompts(
+        {
+          type: isSensitive ? "password" : "text",
+          name: "value",
+          message: `${fieldConfig.label}:`,
+          initial: placeholder ? "" : void 0,
+          validate: (value) => value.length > 0 || `${fieldConfig.label} is required`
+        },
+        { onCancel: () => process.exit(0) }
+      );
+      secrets[name] = response.value;
+    } else {
+      const response = await prompts(
+        {
+          type: isSensitive ? "password" : "text",
+          name: "value",
+          message: `${fieldConfig.label} (optional):`
+        },
+        { onCancel: () => process.exit(0) }
+      );
+      const value = response.value;
+      if (value && value.trim()) {
+        secrets[name] = value.trim();
+      }
+    }
+  }
+  return secrets;
+}
+function collectSecrets(value, previous) {
+  return previous.concat([value]);
+}
+
+// src/commands/zero/org/model-provider/setup.ts
+async function handleInteractiveMode() {
+  if (!isInteractive()) {
+    throw new Error("Interactive mode requires a TTY", {
+      cause: new Error(
+        'Use non-interactive mode: zero org model-provider setup --type <type> --secret "<value>"'
+      )
+    });
+  }
+  const { modelProviders: configuredProviders } = await listZeroOrgModelProviders();
+  const configuredTypes = new Set(configuredProviders.map((p) => p.type));
+  const annotatedChoices = getSelectableProviderTypes().map((type2) => {
+    const config2 = MODEL_PROVIDER_TYPES[type2];
+    const isConfigured = configuredTypes.has(type2);
+    const isExperimental = hasAuthMethods(type2);
+    let title = config2.label;
+    if (isConfigured) {
+      title = `${title} \u2713`;
+    }
+    if (isExperimental) {
+      title = `${title} ${chalk18.dim("(experimental)")}`;
+    }
+    return {
+      title,
+      value: type2
+    };
+  });
+  const typeResponse = await prompts2(
+    {
+      type: "select",
+      name: "type",
+      message: "Select provider type:",
+      choices: annotatedChoices
+    },
+    { onCancel: () => process.exit(0) }
+  );
+  const type = typeResponse.type;
+  const existingProvider = configuredProviders.find((p) => p.type === type);
+  if (existingProvider) {
+    console.log();
+    console.log(`"${type}" is already configured`);
+    console.log();
+    const actionResponse = await prompts2(
+      {
+        type: "select",
+        name: "action",
+        message: "",
+        choices: [
+          { title: "Keep existing secret", value: "keep" },
+          { title: "Update secret", value: "update" }
+        ]
+      },
+      { onCancel: () => process.exit(0) }
+    );
+    if (actionResponse.action === "keep") {
+      const selectedModel2 = await promptForModelSelection(type);
+      return {
+        type,
+        keepExistingSecret: true,
+        selectedModel: selectedModel2,
+        isInteractiveMode: true
+      };
+    }
+  }
+  const config = MODEL_PROVIDER_TYPES[type];
+  console.log();
+  if ("helpText" in config) {
+    console.log(chalk18.dim(config.helpText));
+  }
+  console.log();
+  if (hasAuthMethods(type)) {
+    const authMethod = await promptForAuthMethod(type);
+    const secrets = await promptForSecrets(type, authMethod);
+    const selectedModel2 = await promptForModelSelection(type);
+    return {
+      type,
+      authMethod,
+      secrets,
+      selectedModel: selectedModel2,
+      isInteractiveMode: true
+    };
+  }
+  const secretLabel = "secretLabel" in config ? config.secretLabel : "secret";
+  const secretResponse = await prompts2(
+    {
+      type: "password",
+      name: "secret",
+      message: `Enter your ${secretLabel}:`,
+      validate: (value) => value.length > 0 || `${secretLabel} is required`
+    },
+    { onCancel: () => process.exit(0) }
+  );
+  const secret = secretResponse.secret;
+  const selectedModel = await promptForModelSelection(type);
+  return { type, secret, selectedModel, isInteractiveMode: true };
+}
+async function promptSetAsDefault(type, framework, isDefault) {
+  if (isDefault) return;
+  const response = await prompts2(
+    {
+      type: "confirm",
+      name: "setDefault",
+      message: "Set this provider as default?",
+      initial: false
+    },
+    { onCancel: () => process.exit(0) }
+  );
+  if (response.setDefault) {
+    await setZeroOrgModelProviderDefault(type);
+    console.log(chalk18.green(`\u2713 Default for ${framework} set to "${type}"`));
+  }
+}
+var setupCommand = new Command19().name("setup").description("Configure an org-level model provider").option("-t, --type <type>", "Provider type (for non-interactive mode)").option(
+  "-s, --secret <value>",
+  "Secret value (can be used multiple times, supports VALUE or KEY=VALUE format)",
+  collectSecrets,
+  []
+).option(
+  "-a, --auth-method <method>",
+  "Auth method (required for multi-auth providers like aws-bedrock)"
+).option("-m, --model <model>", "Model selection (for non-interactive mode)").action(
+  withErrorHandler(
+    async (options) => {
+      let input;
+      const secretArgs = options.secret ?? [];
+      if (options.type && secretArgs.length > 0) {
+        input = handleNonInteractiveMode({
+          type: options.type,
+          secret: secretArgs,
+          authMethod: options.authMethod,
+          model: options.model,
+          commandPrefix: "zero org model-provider setup"
+        });
+      } else if (options.type || secretArgs.length > 0) {
+        throw new Error("Both --type and --secret are required");
+      } else {
+        const result = await handleInteractiveMode();
+        if (result === null) {
+          return;
+        }
+        input = result;
+      }
+      if (input.keepExistingSecret) {
+        const provider2 = await updateZeroOrgModelProviderModel(
+          input.type,
+          input.selectedModel
+        );
+        const defaultNote2 = provider2.isDefault ? ` (default for ${provider2.framework})` : "";
+        const modelNote2 = provider2.selectedModel ? ` with model: ${provider2.selectedModel}` : "";
+        if (!hasModelSelection(input.type)) {
+          console.log(
+            chalk18.green(`\u2713 Org model provider "${input.type}" unchanged`)
+          );
+        } else {
+          console.log(
+            chalk18.green(
+              `\u2713 Org model provider "${input.type}" updated${defaultNote2}${modelNote2}`
+            )
+          );
+        }
+        if (input.isInteractiveMode) {
+          await promptSetAsDefault(
+            input.type,
+            provider2.framework,
+            provider2.isDefault
+          );
+        }
+        return;
+      }
+      const { provider, created } = await upsertZeroOrgModelProvider({
+        type: input.type,
+        secret: input.secret,
+        authMethod: input.authMethod,
+        secrets: input.secrets,
+        selectedModel: input.selectedModel
+      });
+      const action = created ? "created" : "updated";
+      const defaultNote = provider.isDefault ? ` (default for ${provider.framework})` : "";
+      const modelNote = provider.selectedModel ? ` with model: ${provider.selectedModel}` : "";
+      console.log(
+        chalk18.green(
+          `\u2713 Org model provider "${input.type}" ${action}${defaultNote}${modelNote}`
+        )
+      );
+      if (input.isInteractiveMode) {
+        await promptSetAsDefault(
+          input.type,
+          provider.framework,
+          provider.isDefault
+        );
+      }
+    }
+  )
+);
+
+// src/commands/zero/org/model-provider/remove.ts
+import { Command as Command20 } from "commander";
+import chalk19 from "chalk";
+var removeCommand4 = new Command20().name("remove").description("Remove an org-level model provider").argument("<type>", "Model provider type to remove").action(
+  withErrorHandler(async (type) => {
+    if (!Object.keys(MODEL_PROVIDER_TYPES).includes(type)) {
+      const validTypes = Object.keys(MODEL_PROVIDER_TYPES).join(", ");
+      throw new Error(`Invalid type "${type}"`, {
+        cause: new Error(`Valid types: ${validTypes}`)
+      });
+    }
+    await deleteZeroOrgModelProvider(type);
+    console.log(chalk19.green(`\u2713 Org model provider "${type}" removed`));
+  })
+);
+
+// src/commands/zero/org/model-provider/set-default.ts
+import { Command as Command21 } from "commander";
+import chalk20 from "chalk";
+var setDefaultCommand = new Command21().name("set-default").description("Set an org-level model provider as default for its framework").argument("<type>", "Model provider type to set as default").action(
+  withErrorHandler(async (type) => {
+    if (!Object.keys(MODEL_PROVIDER_TYPES).includes(type)) {
+      const validTypes = Object.keys(MODEL_PROVIDER_TYPES).join(", ");
+      throw new Error(`Invalid type "${type}"`, {
+        cause: new Error(`Valid types: ${validTypes}`)
+      });
+    }
+    const provider = await setZeroOrgModelProviderDefault(
+      type
+    );
+    console.log(
+      chalk20.green(
+        `\u2713 Default for ${provider.framework} set to "${provider.type}"`
+      )
+    );
+  })
+);
+
+// src/commands/zero/org/model-provider/index.ts
+var zeroOrgModelProviderCommand = new Command22().name("model-provider").description("Manage org-level model providers").addCommand(listCommand4).addCommand(setupCommand).addCommand(removeCommand4).addCommand(setDefaultCommand);
+
+// src/commands/zero/org/index.ts
+var zeroOrgCommand = new Command23().name("org").description("Manage your organization").addCommand(statusCommand).addCommand(setCommand).addCommand(listCommand).addCommand(useCommand).addCommand(membersCommand).addCommand(inviteCommand).addCommand(removeCommand).addCommand(leaveCommand).addCommand(deleteCommand).addCommand(zeroOrgSecretCommand).addCommand(zeroOrgVariableCommand).addCommand(zeroOrgModelProviderCommand);
+
+// src/commands/zero/agent/index.ts
+import { Command as Command29 } from "commander";
+
+// src/commands/zero/agent/create.ts
+import { Command as Command24 } from "commander";
+import { readFileSync } from "fs";
+import chalk21 from "chalk";
+var createCommand = new Command24().name("create").description("Create a new zero agent").requiredOption(
+  "--connectors <items>",
+  "Comma-separated connector short names (e.g. github,linear)"
+).option("--display-name <name>", "Agent display name").option("--description <text>", "Agent description").option(
+  "--sound <tone>",
+  "Agent tone: professional, friendly, direct, supportive"
+).option("--instructions-file <path>", "Path to instructions file").action(
+  withErrorHandler(
+    async (options) => {
+      const connectors = options.connectors.split(",").map((s) => s.trim());
+      const agent = await createZeroAgent({
+        connectors,
+        displayName: options.displayName,
+        description: options.description,
+        sound: options.sound
+      });
+      if (options.instructionsFile) {
+        const content = readFileSync(options.instructionsFile, "utf-8");
+        await updateZeroAgentInstructions(agent.agentId, content);
+      }
+      console.log(chalk21.green(`\u2713 Zero agent '${agent.agentId}' created`));
+      console.log(`  Agent ID:     ${agent.agentId}`);
+      console.log(`  Connectors:   ${agent.connectors.join(", ")}`);
+      if (agent.displayName) {
+        console.log(`  Display Name: ${agent.displayName}`);
+      }
+    }
+  )
+);
+
+// src/commands/zero/agent/edit.ts
+import { Command as Command25 } from "commander";
+import { readFileSync as readFileSync2 } from "fs";
+import chalk22 from "chalk";
+var editCommand = new Command25().name("edit").description("Edit a zero agent").argument("<agent-id>", "Agent ID").option(
+  "--connectors <items>",
+  "Comma-separated connector short names (e.g. github,linear)"
+).option("--display-name <name>", "New display name").option("--description <text>", "New description").option(
+  "--sound <tone>",
+  "New tone: professional, friendly, direct, supportive"
+).option("--instructions-file <path>", "Path to new instructions file").action(
+  withErrorHandler(
+    async (agentId, options) => {
+      const hasAgentUpdate = options.connectors !== void 0 || options.displayName !== void 0 || options.description !== void 0 || options.sound !== void 0;
+      if (!hasAgentUpdate && !options.instructionsFile) {
+        throw new Error(
+          "At least one option is required (--connectors, --display-name, --description, --sound, --instructions-file)"
+        );
+      }
+      if (hasAgentUpdate) {
+        const current = await getZeroAgent(agentId);
+        const connectors = options.connectors ? options.connectors.split(",").map((s) => s.trim()) : current.connectors;
+        await updateZeroAgent(agentId, {
+          connectors,
+          displayName: options.displayName !== void 0 ? options.displayName : current.displayName ?? void 0,
+          description: options.description !== void 0 ? options.description : current.description ?? void 0,
+          sound: options.sound !== void 0 ? options.sound : current.sound ?? void 0
+        });
+      }
+      if (options.instructionsFile) {
+        const content = readFileSync2(options.instructionsFile, "utf-8");
+        await updateZeroAgentInstructions(agentId, content);
+      }
+      console.log(chalk22.green(`\u2713 Zero agent '${agentId}' updated`));
+    }
+  )
+);
+
+// src/commands/zero/agent/view.ts
+import { Command as Command26 } from "commander";
+import chalk23 from "chalk";
+var viewCommand = new Command26().name("view").description("View a zero agent").argument("<agent-id>", "Agent ID").option("--instructions", "Also show instructions content").action(
+  withErrorHandler(
+    async (agentId, options) => {
+      const agent = await getZeroAgent(agentId);
+      console.log(chalk23.bold(agent.agentId));
+      if (agent.displayName) console.log(chalk23.dim(agent.displayName));
+      console.log();
+      console.log(`Agent ID:     ${agent.agentId}`);
+      console.log(`Connectors:   ${agent.connectors.join(", ") || "-"}`);
+      if (agent.description)
+        console.log(`Description:  ${agent.description}`);
+      if (agent.sound) console.log(`Sound:        ${agent.sound}`);
+      if (options.instructions) {
+        console.log();
+        const result = await getZeroAgentInstructions(agentId);
+        if (result.content) {
+          console.log(chalk23.dim("\u2500\u2500 Instructions \u2500\u2500"));
+          console.log(result.content);
+        } else {
+          console.log(chalk23.dim("No instructions set"));
+        }
+      }
+    }
+  )
+);
+
+// src/commands/zero/agent/list.ts
+import { Command as Command27 } from "commander";
+import chalk24 from "chalk";
+var listCommand5 = new Command27().name("list").alias("ls").description("List all zero agents").action(
+  withErrorHandler(async () => {
+    const agents = await listZeroAgents();
+    if (agents.length === 0) {
+      console.log(chalk24.dim("No zero agents found"));
+      console.log(
+        chalk24.dim(
+          '  Create one with: zero agent create --connectors github --display-name "My Agent"'
+        )
+      );
+      return;
+    }
+    const idWidth = Math.max(8, ...agents.map((a) => a.agentId.length));
+    const displayWidth = Math.max(
+      12,
+      ...agents.map((a) => (a.displayName ?? "").length)
+    );
+    const header = [
+      "AGENT ID".padEnd(idWidth),
+      "DISPLAY NAME".padEnd(displayWidth),
+      "CONNECTORS"
+    ].join("  ");
+    console.log(chalk24.dim(header));
+    for (const agent of agents) {
+      const row = [
+        agent.agentId.padEnd(idWidth),
+        (agent.displayName ?? "-").padEnd(displayWidth),
+        agent.connectors.join(", ") || "-"
+      ].join("  ");
+      console.log(row);
+    }
+  })
+);
+
+// src/commands/zero/agent/delete.ts
+import { Command as Command28 } from "commander";
+import chalk25 from "chalk";
+var deleteCommand2 = new Command28().name("delete").alias("rm").description("Delete a zero agent").argument("<agent-id>", "Agent ID").option("-y, --yes", "Skip confirmation prompt").action(
+  withErrorHandler(async (agentId, options) => {
+    await getZeroAgent(agentId);
+    if (!options.yes) {
+      if (!isInteractive()) {
+        throw new Error("--yes flag is required in non-interactive mode");
+      }
+      const confirmed = await promptConfirm(
+        `Delete zero agent '${agentId}'?`,
+        false
+      );
+      if (!confirmed) {
+        console.log(chalk25.dim("Cancelled"));
+        return;
+      }
+    }
+    await deleteZeroAgent(agentId);
+    console.log(chalk25.green(`\u2713 Zero agent '${agentId}' deleted`));
+  })
+);
+
+// src/commands/zero/agent/index.ts
+var agentCommand = new Command29("agent").description("Manage zero agents").addCommand(createCommand).addCommand(editCommand).addCommand(viewCommand).addCommand(listCommand5).addCommand(deleteCommand2);
+
+// src/commands/zero/connector/index.ts
+import { Command as Command34 } from "commander";
+
+// src/commands/zero/connector/connect.ts
+import { Command as Command30 } from "commander";
+import chalk27 from "chalk";
+
+// src/lib/computer/start-services.ts
+import { spawn } from "child_process";
+import { access, constants } from "fs/promises";
+import { createServer } from "net";
+import { homedir } from "os";
+import { join } from "path";
+import chalk26 from "chalk";
+
+// src/lib/computer/ngrok.ts
+import ngrok from "@ngrok/ngrok";
+async function startNgrokTunnels(ngrokToken, endpointPrefix, webdavPort, cdpPort) {
+  await ngrok.forward({
+    addr: `localhost:${webdavPort}`,
+    authtoken: ngrokToken,
+    domain: `webdav.${endpointPrefix}.internal`
+  });
+  await ngrok.forward({
+    addr: `localhost:${cdpPort}`,
+    authtoken: ngrokToken,
+    domain: `chrome.${endpointPrefix}.internal`
+  });
+}
+async function stopNgrokTunnels() {
+  await ngrok.kill();
+}
+
+// src/lib/computer/start-services.ts
+var CHROME_CANDIDATES = [
+  // macOS absolute paths
+  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+  "/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary",
+  "/Applications/Chromium.app/Contents/MacOS/Chromium",
+  // Linux / PATH-based
+  "google-chrome",
+  "google-chrome-stable",
+  "chromium-browser",
+  "chromium",
+  "chrome"
+];
+async function getRandomPort() {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address();
+      server.close(() => resolve(port));
+    });
+    server.on("error", reject);
+  });
+}
+async function findBinary(...candidates) {
+  for (const candidate of candidates) {
+    if (candidate.startsWith("/")) {
+      try {
+        await access(candidate, constants.X_OK);
+        return candidate;
+      } catch {
+      }
+    } else {
+      const found = await new Promise((resolve) => {
+        const child = spawn("which", [candidate]);
+        child.on("close", (code) => resolve(code === 0));
+      });
+      if (found) return candidate;
+    }
+  }
+  return null;
+}
+async function checkComputerDependencies() {
+  const wsgidavBinary = await findBinary("wsgidav");
+  if (!wsgidavBinary) {
+    throw new Error(
+      "wsgidav not found\n\nInstall with: pip install wsgidav[cheroot]"
+    );
+  }
+  const chromeBinary = await findBinary(...CHROME_CANDIDATES);
+  if (!chromeBinary) {
+    throw new Error("Chrome not found\n\nInstall Google Chrome or Chromium");
+  }
+}
+async function startComputerServices(credentials) {
+  console.log(chalk26.cyan("Starting computer connector services..."));
+  const wsgidavBinary = await findBinary("wsgidav");
+  if (!wsgidavBinary) {
+    throw new Error(
+      "wsgidav not found\n\nInstall with: pip install wsgidav[cheroot]"
+    );
+  }
+  const chromeBinary = await findBinary(...CHROME_CANDIDATES);
+  if (!chromeBinary) {
+    throw new Error("Chrome not found\n\nInstall Google Chrome or Chromium");
+  }
+  const webdavPort = await getRandomPort();
+  const cdpPort = await getRandomPort();
+  const downloadsPath = join(homedir(), "Downloads");
+  const wsgidav = spawn(
+    wsgidavBinary,
+    [
+      "--host=127.0.0.1",
+      `--port=${webdavPort}`,
+      `--root=${downloadsPath}`,
+      "--auth=anonymous",
+      "--no-config"
+    ],
+    { stdio: ["ignore", "pipe", "pipe"] }
+  );
+  wsgidav.stdout?.on("data", (data) => process.stdout.write(data));
+  wsgidav.stderr?.on("data", (data) => process.stderr.write(data));
+  console.log(chalk26.green("\u2713 WebDAV server started"));
+  const chrome = spawn(
+    chromeBinary,
+    [
+      `--remote-debugging-port=${cdpPort}`,
+      "--remote-debugging-address=127.0.0.1",
+      "--headless=new",
+      "--no-sandbox",
+      "--disable-gpu"
+    ],
+    { stdio: ["ignore", "pipe", "pipe"] }
+  );
+  chrome.stdout?.on("data", (data) => process.stdout.write(data));
+  chrome.stderr?.on("data", (data) => process.stderr.write(data));
+  console.log(chalk26.green("\u2713 Chrome started"));
+  try {
+    await startNgrokTunnels(
+      credentials.ngrokToken,
+      credentials.endpointPrefix,
+      webdavPort,
+      cdpPort
+    );
+    console.log(
+      chalk26.green(
+        `\u2713 ngrok tunnels: webdav.${credentials.domain}, chrome.${credentials.domain}`
+      )
+    );
+    console.log();
+    console.log(chalk26.green("\u2713 Computer connector active"));
+    console.log(`  WebDAV:     ~/Downloads \u2192 webdav.${credentials.domain}`);
+    console.log(
+      `  Chrome CDP: port ${cdpPort}   \u2192 chrome.${credentials.domain}`
+    );
+    console.log();
+    console.log(chalk26.dim("Press ^C twice to disconnect"));
+    console.log();
+    let sigintCount = 0;
+    await new Promise((resolve) => {
+      const keepAlive = setInterval(() => {
+      }, 6e4);
+      const done = () => {
+        clearInterval(keepAlive);
+        process.removeListener("SIGINT", onSigint);
+        resolve();
+      };
+      const onSigint = () => {
+        sigintCount++;
+        if (sigintCount === 1) {
+          console.log(chalk26.dim("\nPress ^C again to disconnect and exit..."));
+        } else {
+          done();
+        }
+      };
+      process.on("SIGINT", onSigint);
+      process.once("SIGTERM", done);
+    });
+  } finally {
+    console.log();
+    console.log(chalk26.cyan("Stopping services..."));
+    wsgidav.kill("SIGTERM");
+    chrome.kill("SIGTERM");
+    await stopNgrokTunnels();
+    console.log(chalk26.green("\u2713 Services stopped"));
+  }
+}
+
+// src/commands/zero/connector/connect.ts
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function renderHelpText(text) {
+  return text.replace(
+    /\[([^\]]+)\]\(([^)]+)\)/g,
+    (_m, label, url) => `${label} (${chalk27.cyan(url)})`
+  ).replace(/\*\*([^*]+)\*\*/g, (_m, content) => chalk27.bold(content)).replace(
+    /^> (.+)$/gm,
+    (_m, content) => chalk27.yellow(`  ${content}`)
+  );
+}
+async function connectViaApiToken(connectorType, tokenValue) {
+  const config = CONNECTOR_TYPES[connectorType];
+  const apiTokenConfig = config.authMethods["api-token"];
+  if (!apiTokenConfig) {
+    throw new Error(
+      `${config.label} does not support API token authentication`
+    );
+  }
+  const secretEntries = Object.entries(apiTokenConfig.secrets);
+  const inputSecrets = {};
+  if (tokenValue && secretEntries.length === 1) {
+    const [secretName] = secretEntries[0];
+    inputSecrets[secretName] = tokenValue;
+  } else {
+    if (apiTokenConfig.helpText) {
+      console.log();
+      console.log(renderHelpText(apiTokenConfig.helpText));
+      console.log();
+    }
+    for (const [secretName, secretConfig] of secretEntries) {
+      if (!secretConfig.required) continue;
+      const value = await promptPassword(
+        `${secretConfig.label}${secretConfig.placeholder ? chalk27.dim(` (${secretConfig.placeholder})`) : ""}:`
+      );
+      if (!value) {
+        throw new Error("Cancelled");
+      }
+      inputSecrets[secretName] = value;
+    }
+  }
+  for (const [name, value] of Object.entries(inputSecrets)) {
+    await setZeroSecret({
+      name,
+      value,
+      description: `API token for ${config.label} connector`
+    });
+  }
+  console.log(
+    chalk27.green(`
+\u2713 ${config.label} connected successfully via API token!`)
+  );
+}
+async function connectComputer() {
+  await checkComputerDependencies();
+  console.log(chalk27.cyan("Setting up computer connector..."));
+  const credentials = await createZeroComputerConnector();
+  await startComputerServices(credentials);
+  console.log(chalk27.cyan("Disconnecting computer connector..."));
+  await deleteZeroComputerConnector();
+  console.log(chalk27.green("\u2713 Disconnected computer"));
+}
+async function resolveAuthMethod(connectorType, tokenFlag) {
+  const config = CONNECTOR_TYPES[connectorType];
+  const oauthFlag = CONNECTOR_TYPES[connectorType].featureFlag;
+  const oauthAvailable = "oauth" in config.authMethods && (!oauthFlag || await isFeatureEnabled(oauthFlag));
+  const apiTokenAvailable = "api-token" in config.authMethods;
+  if (tokenFlag) {
+    if (!apiTokenAvailable) {
+      throw new Error(
+        `${config.label} does not support API token authentication`
+      );
+    }
+    return "api-token";
+  }
+  if (oauthAvailable && apiTokenAvailable) {
+    const selected = await promptSelect(
+      `How would you like to connect ${config.label}?`,
+      [
+        { title: "OAuth (Sign in with browser)", value: "oauth" },
+        {
+          title: `API Token (${config.authMethods["api-token"].label})`,
+          value: "api-token"
+        }
+      ]
+    );
+    if (!selected) {
+      throw new Error("Cancelled");
+    }
+    return selected;
+  }
+  if (apiTokenAvailable) return "api-token";
+  if (oauthAvailable) return "oauth";
+  throw new Error(
+    `${config.label} has no available auth methods. OAuth may not be enabled yet.`
+  );
+}
+async function connectViaOAuth(connectorType) {
+  console.log(`Connecting ${chalk27.cyan(connectorType)}...`);
+  const session = await createZeroConnectorSession(connectorType);
+  const apiUrl = await getBaseUrl();
+  const verificationUrl = `${apiUrl}${session.verificationUrl}`;
+  console.log(chalk27.green("\nSession created"));
+  console.log(chalk27.cyan(`
+To connect, visit: ${verificationUrl}`));
+  console.log(
+    `
+The session expires in ${Math.floor(session.expiresIn / 60)} minutes.`
+  );
+  console.log("\nWaiting for authorization...");
+  const startTime = Date.now();
+  const maxWaitTime = session.expiresIn * 1e3;
+  const pollInterval = (session.interval || 5) * 1e3;
+  let isFirstPoll = true;
+  while (Date.now() - startTime < maxWaitTime) {
+    if (!isFirstPoll) {
+      await delay(pollInterval);
+    }
+    isFirstPoll = false;
+    const status = await getZeroConnectorSession(connectorType, session.id);
+    switch (status.status) {
+      case "complete":
+        console.log(
+          chalk27.green(`
+
+${connectorType} connected successfully!`)
+        );
+        return;
+      case "expired":
+        throw new Error("Session expired, please try again");
+      case "error":
+        throw new Error(
+          `Connection failed: ${status.errorMessage || "Unknown error"}`
+        );
+      case "pending":
+        process.stdout.write(chalk27.dim("."));
+        break;
+    }
+  }
+  throw new Error("Session timed out, please try again");
+}
+var connectCommand = new Command30().name("connect").description("Connect a third-party service (e.g., GitHub)").argument("<type>", "Connector type (e.g., github)").option("--token <value>", "API token value (skip interactive prompt)").action(
+  withErrorHandler(async (type, options) => {
+    const parseResult = connectorTypeSchema.safeParse(type);
+    if (!parseResult.success) {
+      const available = Object.keys(CONNECTOR_TYPES).join(", ");
+      throw new Error(`Unknown connector type: ${type}`, {
+        cause: new Error(`Available connectors: ${available}`)
+      });
+    }
+    const connectorType = parseResult.data;
+    if (connectorType === "computer") {
+      await connectComputer();
+      return;
+    }
+    const authMethod = await resolveAuthMethod(connectorType, options.token);
+    if (authMethod === "api-token") {
+      await connectViaApiToken(connectorType, options.token);
+      return;
+    }
+    await connectViaOAuth(connectorType);
+  })
+);
+
+// src/commands/zero/connector/list.ts
+import { Command as Command31 } from "commander";
+import chalk28 from "chalk";
+var listCommand6 = new Command31().name("list").alias("ls").description("List all connectors and their status").action(
+  withErrorHandler(async () => {
+    const result = await listZeroConnectors();
+    const connectedMap = new Map(result.connectors.map((c) => [c.type, c]));
+    const allTypesRaw = Object.keys(CONNECTOR_TYPES);
+    const allTypes = [];
+    for (const type of allTypesRaw) {
+      const flag = CONNECTOR_TYPES[type].featureFlag;
+      const hasApiToken = "api-token" in CONNECTOR_TYPES[type].authMethods;
+      if (flag && !await isFeatureEnabled(flag) && !hasApiToken) {
+        continue;
+      }
+      allTypes.push(type);
+    }
+    const typeWidth = Math.max(4, ...allTypes.map((t) => t.length));
+    const statusText = "STATUS";
+    const statusWidth = statusText.length;
+    const header = [
+      "TYPE".padEnd(typeWidth),
+      statusText.padEnd(statusWidth),
+      "ACCOUNT"
+    ].join("  ");
+    console.log(chalk28.dim(header));
+    for (const type of allTypes) {
+      const connector = connectedMap.get(type);
+      const scopeMismatch = connector !== void 0 && connector.authMethod === "oauth" && !hasRequiredScopes(type, connector.oauthScopes);
+      const status = connector ? connector.needsReconnect ? chalk28.yellow("!".padEnd(statusWidth)) : scopeMismatch ? chalk28.yellow("!".padEnd(statusWidth)) : chalk28.green("\u2713".padEnd(statusWidth)) : chalk28.dim("-".padEnd(statusWidth));
+      const account = connector?.needsReconnect ? chalk28.yellow("(reconnect needed)") : scopeMismatch ? chalk28.yellow("(permissions update available)") : connector?.externalUsername ? `@${connector.externalUsername}` : chalk28.dim("-");
+      const row = [type.padEnd(typeWidth), status, account].join("  ");
+      console.log(row);
+    }
+    console.log();
+    console.log(chalk28.dim("To connect a service:"));
+    console.log(chalk28.dim("  zero connector connect <type>"));
+  })
+);
+
+// src/commands/zero/connector/status.ts
+import { Command as Command32 } from "commander";
+import chalk29 from "chalk";
+
+// src/lib/domain/schedule-utils.ts
+function formatRelativeTime(dateStr) {
+  if (!dateStr) return "-";
+  const date = new Date(dateStr);
+  const now = /* @__PURE__ */ new Date();
+  const diffMs = date.getTime() - now.getTime();
+  const diffAbs = Math.abs(diffMs);
+  const minutes = Math.floor(diffAbs / (1e3 * 60));
+  const hours = Math.floor(diffAbs / (1e3 * 60 * 60));
+  const days = Math.floor(diffAbs / (1e3 * 60 * 60 * 24));
+  const isPast = diffMs < 0;
+  if (days > 0) {
+    return isPast ? `${days}d ago` : `in ${days}d`;
+  } else if (hours > 0) {
+    return isPast ? `${hours}h ago` : `in ${hours}h`;
+  } else if (minutes > 0) {
+    return isPast ? `${minutes}m ago` : `in ${minutes}m`;
+  } else {
+    return isPast ? "just now" : "soon";
+  }
+}
+function formatDateTime(dateStr) {
+  if (!dateStr) return "-";
+  const date = new Date(dateStr);
+  const year = date.getFullYear();
+  const month = String(date.getMonth() + 1).padStart(2, "0");
+  const day = String(date.getDate()).padStart(2, "0");
+  const hours = String(date.getHours()).padStart(2, "0");
+  const minutes = String(date.getMinutes()).padStart(2, "0");
+  const formatted = `${year}-${month}-${day} ${hours}:${minutes}`;
+  const relative = formatRelativeTime(dateStr);
+  return `${formatted} (${relative})`;
+}
+function generateCronExpression(frequency, time, day) {
+  const [hourStr, minuteStr] = time.split(":");
+  const hour = parseInt(hourStr ?? "0", 10);
+  const minute = parseInt(minuteStr ?? "0", 10);
+  switch (frequency) {
+    case "daily":
+      return `${minute} ${hour} * * *`;
+    case "weekly":
+      return `${minute} ${hour} * * ${day ?? 1}`;
+    case "monthly":
+      return `${minute} ${hour} ${day ?? 1} * *`;
+  }
+}
+function detectTimezone() {
+  return Intl.DateTimeFormat().resolvedOptions().timeZone;
+}
+function validateTimeFormat(time) {
+  const match = time.match(/^(\d{1,2}):(\d{2})$/);
+  if (!match) {
+    return "Invalid format. Use HH:MM (e.g., 09:00)";
+  }
+  const hour = parseInt(match[1], 10);
+  const minute = parseInt(match[2], 10);
+  if (hour < 0 || hour > 23) {
+    return "Hour must be 0-23";
+  }
+  if (minute < 0 || minute > 59) {
+    return "Minute must be 0-59";
+  }
+  if (minute % 5 !== 0) {
+    return "Minute must be a multiple of 5 (0, 5, 10, ..., 55)";
+  }
+  return true;
+}
+function validateDateFormat(date) {
+  const match = date.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+  if (!match) {
+    return "Invalid format. Use YYYY-MM-DD (e.g., 2025-01-15)";
+  }
+  const year = parseInt(match[1], 10);
+  const month = parseInt(match[2], 10);
+  const day = parseInt(match[3], 10);
+  if (year < 2e3 || year > 2100) {
+    return "Year must be between 2000 and 2100";
+  }
+  if (month < 1 || month > 12) {
+    return "Month must be 1-12";
+  }
+  if (day < 1 || day > 31) {
+    return "Day must be 1-31";
+  }
+  const testDate = new Date(year, month - 1, day);
+  if (testDate.getFullYear() !== year || testDate.getMonth() !== month - 1 || testDate.getDate() !== day) {
+    return "Invalid date";
+  }
+  return true;
+}
+function getTomorrowDateLocal() {
+  const tomorrow = /* @__PURE__ */ new Date();
+  tomorrow.setDate(tomorrow.getDate() + 1);
+  const year = tomorrow.getFullYear();
+  const month = String(tomorrow.getMonth() + 1).padStart(2, "0");
+  const day = String(tomorrow.getDate()).padStart(2, "0");
+  return `${year}-${month}-${day}`;
+}
+function getCurrentTimeLocal() {
+  const now = /* @__PURE__ */ new Date();
+  const hours = String(now.getHours()).padStart(2, "0");
+  const minutes = String(now.getMinutes()).padStart(2, "0");
+  return `${hours}:${minutes}`;
+}
+function toISODateTime(dateTimeStr) {
+  if (dateTimeStr.includes("T") && dateTimeStr.endsWith("Z")) {
+    return dateTimeStr;
+  }
+  const isoStr = dateTimeStr.replace(" ", "T") + ":00";
+  const date = new Date(isoStr);
+  return date.toISOString();
+}
+
+// src/commands/zero/connector/status.ts
+var LABEL_WIDTH = 16;
+var statusCommand2 = new Command32().name("status").description("Show detailed status of a connector").argument("<type>", "Connector type (e.g., github)").action(
+  withErrorHandler(async (type) => {
+    const parseResult = connectorTypeSchema.safeParse(type);
+    if (!parseResult.success) {
+      const available = Object.keys(CONNECTOR_TYPES).join(", ");
+      throw new Error(`Unknown connector type: ${type}`, {
+        cause: new Error(`Available connectors: ${available}`)
+      });
+    }
+    const connector = await getZeroConnector(parseResult.data);
+    console.log(`Connector: ${chalk29.cyan(type)}`);
+    console.log();
+    if (connector) {
+      console.log(
+        `${"Status:".padEnd(LABEL_WIDTH)}${chalk29.green("connected")}`
+      );
+      console.log(
+        `${"Account:".padEnd(LABEL_WIDTH)}@${connector.externalUsername}`
+      );
+      console.log(
+        `${"Auth Method:".padEnd(LABEL_WIDTH)}${connector.authMethod}`
+      );
+      if (connector.oauthScopes && connector.oauthScopes.length > 0) {
+        console.log(
+          `${"OAuth Scopes:".padEnd(LABEL_WIDTH)}${connector.oauthScopes.join(", ")}`
+        );
+      }
+      if (connector.authMethod === "oauth" && !hasRequiredScopes(parseResult.data, connector.oauthScopes)) {
+        const diff = getScopeDiff(parseResult.data, connector.oauthScopes);
+        console.log(
+          `${"Permissions:".padEnd(LABEL_WIDTH)}${chalk29.yellow("update available")}`
+        );
+        if (diff.addedScopes.length > 0) {
+          console.log(
+            `${"  Added:".padEnd(LABEL_WIDTH)}${diff.addedScopes.join(", ")}`
+          );
+        }
+        if (diff.removedScopes.length > 0) {
+          console.log(
+            `${"  Removed:".padEnd(LABEL_WIDTH)}${diff.removedScopes.join(", ")}`
+          );
+        }
+      }
+      console.log(
+        `${"Connected:".padEnd(LABEL_WIDTH)}${formatDateTime(connector.createdAt)}`
+      );
+      if (connector.updatedAt !== connector.createdAt) {
+        console.log(
+          `${"Last Updated:".padEnd(LABEL_WIDTH)}${formatDateTime(connector.updatedAt)}`
+        );
+      }
+      console.log();
+      console.log(chalk29.dim("To disconnect:"));
+      console.log(chalk29.dim(`  zero connector disconnect ${type}`));
+    } else {
+      console.log(
+        `${"Status:".padEnd(LABEL_WIDTH)}${chalk29.dim("not connected")}`
+      );
+      console.log();
+      console.log(chalk29.dim("To connect:"));
+      console.log(chalk29.dim(`  zero connector connect ${type}`));
+    }
+  })
+);
+
+// src/commands/zero/connector/disconnect.ts
+import { Command as Command33 } from "commander";
+import chalk30 from "chalk";
+var disconnectCommand = new Command33().name("disconnect").description("Disconnect a third-party service").argument("<type>", "Connector type to disconnect (e.g., github)").action(
+  withErrorHandler(async (type) => {
+    const parseResult = connectorTypeSchema.safeParse(type);
+    if (!parseResult.success) {
+      const available = Object.keys(CONNECTOR_TYPES).join(", ");
+      throw new Error(`Unknown connector type: ${type}`, {
+        cause: new Error(`Available connectors: ${available}`)
+      });
+    }
+    const connectorType = parseResult.data;
+    await deleteZeroConnector(connectorType);
+    console.log(chalk30.green(`\u2713 Disconnected ${type}`));
+  })
+);
+
+// src/commands/zero/connector/index.ts
+var zeroConnectorCommand = new Command34().name("connector").description("Manage third-party service connections (zero)").addCommand(listCommand6).addCommand(statusCommand2).addCommand(connectCommand).addCommand(disconnectCommand);
+
+// src/commands/zero/preference/index.ts
+import { Command as Command35 } from "commander";
+import chalk31 from "chalk";
+function detectTimezone2() {
+  return Intl.DateTimeFormat().resolvedOptions().timeZone;
+}
+function isValidTimezone(timezone) {
+  try {
+    Intl.DateTimeFormat(void 0, { timeZone: timezone });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function parseOnOff(flag, value) {
+  const lower = value.toLowerCase();
+  if (lower === "on" || lower === "true" || lower === "1") return true;
+  if (lower === "off" || lower === "false" || lower === "0") return false;
+  throw new Error(
+    `Invalid value for --${flag}: "${value}". Use "on" or "off".`
+  );
+}
+function displayPreferences(prefs) {
+  console.log(chalk31.bold("Current preferences:"));
+  console.log(
+    `  Timezone:      ${prefs.timezone ? chalk31.cyan(prefs.timezone) : chalk31.dim("not set")}`
+  );
+  console.log(
+    `  Email notify:  ${prefs.notifyEmail ? chalk31.green("on") : chalk31.dim("off")}`
+  );
+  console.log(
+    `  Slack notify:  ${prefs.notifySlack ? chalk31.green("on") : chalk31.dim("off")}`
+  );
+}
+function buildUpdates(opts) {
+  const hasTimezone = opts.timezone !== void 0;
+  const hasNotifyEmail = opts.notifyEmail !== void 0;
+  const hasNotifySlack = opts.notifySlack !== void 0;
+  if (!hasTimezone && !hasNotifyEmail && !hasNotifySlack) return null;
+  const updates = {};
+  if (hasTimezone) {
+    if (!isValidTimezone(opts.timezone)) {
+      throw new Error(`Invalid timezone: ${opts.timezone}`, {
+        cause: new Error(
+          "Use an IANA timezone identifier (e.g., America/New_York, Asia/Shanghai)"
+        )
+      });
+    }
+    updates.timezone = opts.timezone;
+  }
+  if (hasNotifyEmail) {
+    updates.notifyEmail = parseOnOff("notify-email", opts.notifyEmail);
+  }
+  if (hasNotifySlack) {
+    updates.notifySlack = parseOnOff("notify-slack", opts.notifySlack);
+  }
+  return updates;
+}
+function printUpdateResult(updates, result) {
+  if (updates.timezone !== void 0) {
+    console.log(
+      chalk31.green(
+        `Timezone set to ${chalk31.cyan(result.timezone ?? updates.timezone)}`
+      )
+    );
+  }
+  if (updates.notifyEmail !== void 0) {
+    console.log(
+      chalk31.green(
+        `Email notifications ${result.notifyEmail ? "enabled" : "disabled"}`
+      )
+    );
+  }
+  if (updates.notifySlack !== void 0) {
+    console.log(
+      chalk31.green(
+        `Slack notifications ${result.notifySlack ? "enabled" : "disabled"}`
+      )
+    );
+  }
+}
+async function interactiveSetup(prefs) {
+  if (!prefs.timezone) {
+    const detectedTz = detectTimezone2();
+    console.log(chalk31.dim(`
+System timezone detected: ${detectedTz}`));
+    const tz = await promptText(
+      "Set timezone? (enter timezone or leave empty to skip)",
+      detectedTz
+    );
+    if (tz?.trim()) {
+      if (!isValidTimezone(tz.trim())) {
+        throw new Error(`Invalid timezone: ${tz.trim()}`);
+      }
+      await updateZeroUserPreferences({ timezone: tz.trim() });
+      console.log(chalk31.green(`Timezone set to ${chalk31.cyan(tz.trim())}`));
+    }
+  }
+  if (!prefs.notifyEmail) {
+    const enable = await promptConfirm(
+      "\nEnable email notifications for scheduled runs?",
+      false
+    );
+    if (enable) {
+      await updateZeroUserPreferences({ notifyEmail: true });
+      console.log(chalk31.green("Email notifications enabled"));
+    }
+  }
+}
+var zeroPreferenceCommand = new Command35().name("preference").description("View or update your preferences").option("--timezone <timezone>", "IANA timezone (e.g., America/New_York)").option("--notify-email <on|off>", "Enable or disable email notifications").option("--notify-slack <on|off>", "Enable or disable Slack notifications").action(
+  withErrorHandler(async (opts) => {
+    const updates = buildUpdates(opts);
+    if (updates) {
+      const result = await updateZeroUserPreferences(updates);
+      printUpdateResult(updates, result);
+      return;
+    }
+    const prefs = await getZeroUserPreferences();
+    displayPreferences(prefs);
+    if (isInteractive()) {
+      await interactiveSetup(prefs);
+    } else if (!prefs.timezone) {
+      console.log();
+      console.log(
+        `To set timezone: ${chalk31.cyan("zero preference --timezone <timezone>")}`
+      );
+      console.log(
+        chalk31.dim("Example: zero preference --timezone America/New_York")
+      );
+    }
+  })
+);
+
+// src/commands/zero/schedule/index.ts
+import { Command as Command42 } from "commander";
+
+// src/commands/zero/schedule/setup.ts
+import { Command as Command36 } from "commander";
+import chalk32 from "chalk";
+var FREQUENCY_CHOICES = [
+  { title: "Daily", value: "daily", description: "Run every day" },
+  {
+    title: "Weekly",
+    value: "weekly",
+    description: "Run once per week"
+  },
+  {
+    title: "Monthly",
+    value: "monthly",
+    description: "Run once per month"
+  },
+  {
+    title: "One-time",
+    value: "once",
+    description: "Run once at specific time"
+  },
+  {
+    title: "Loop",
+    value: "loop",
+    description: "Run repeatedly at fixed intervals"
+  }
+];
+var DAY_OF_WEEK_CHOICES = [
+  { title: "Monday", value: 1 },
+  { title: "Tuesday", value: 2 },
+  { title: "Wednesday", value: 3 },
+  { title: "Thursday", value: 4 },
+  { title: "Friday", value: 5 },
+  { title: "Saturday", value: 6 },
+  { title: "Sunday", value: 0 }
+];
+function parseDayOption(day, frequency) {
+  if (frequency === "weekly") {
+    const dayMap = {
+      sun: 0,
+      mon: 1,
+      tue: 2,
+      wed: 3,
+      thu: 4,
+      fri: 5,
+      sat: 6
+    };
+    return dayMap[day.toLowerCase()];
+  } else if (frequency === "monthly") {
+    const num = parseInt(day, 10);
+    if (num >= 1 && num <= 31) {
+      return num;
+    }
+  }
+  return void 0;
+}
+function formatInTimezone(isoDate, timezone) {
+  const date = new Date(isoDate);
+  const parts = new Intl.DateTimeFormat("en-CA", {
+    timeZone: timezone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    hour12: false
+  }).formatToParts(date);
+  const get = (type) => parts.find((p) => p.type === type)?.value ?? "";
+  return `${get("year")}-${get("month")}-${get("day")} ${get("hour")}:${get("minute")}`;
+}
+function parseFrequencyFromCron(cron) {
+  const parts = cron.split(" ");
+  if (parts.length !== 5) return null;
+  const [minute, hour, dayOfMonth, , dayOfWeek] = parts;
+  const time = `${hour.padStart(2, "0")}:${minute.padStart(2, "0")}`;
+  if (dayOfMonth === "*" && dayOfWeek === "*") {
+    return { frequency: "daily", time };
+  } else if (dayOfMonth === "*" && dayOfWeek !== "*") {
+    return { frequency: "weekly", day: parseInt(dayOfWeek, 10), time };
+  } else if (dayOfMonth !== "*" && dayOfWeek === "*") {
+    return { frequency: "monthly", day: parseInt(dayOfMonth, 10), time };
+  }
+  return null;
+}
+function getExistingDefaults(existingSchedule) {
+  const defaults = {};
+  if (existingSchedule?.triggerType === "loop") {
+    defaults.frequency = "loop";
+    defaults.intervalSeconds = existingSchedule.intervalSeconds ?? void 0;
+  } else if (existingSchedule?.cronExpression) {
+    const parsed = parseFrequencyFromCron(existingSchedule.cronExpression);
+    if (parsed) {
+      defaults.frequency = parsed.frequency;
+      defaults.day = parsed.day;
+      defaults.time = parsed.time;
+    }
+  } else if (existingSchedule?.atTime) {
+    defaults.frequency = "once";
+  }
+  return defaults;
+}
+async function gatherFrequency(optionFrequency, existingFrequency) {
+  let frequency = optionFrequency;
+  if (frequency && ["daily", "weekly", "monthly", "once", "loop"].includes(frequency)) {
+    return frequency;
+  }
+  if (!isInteractive()) {
+    throw new Error("--frequency is required (daily|weekly|monthly|once|loop)");
+  }
+  const defaultIndex = existingFrequency ? FREQUENCY_CHOICES.findIndex((c) => c.value === existingFrequency) : 0;
+  frequency = await promptSelect(
+    "Schedule frequency",
+    FREQUENCY_CHOICES,
+    defaultIndex >= 0 ? defaultIndex : 0
+  );
+  return frequency || null;
+}
+async function gatherDay(frequency, optionDay, existingDay) {
+  if (frequency !== "weekly" && frequency !== "monthly") {
+    return null;
+  }
+  if (optionDay) {
+    const day2 = parseDayOption(optionDay, frequency);
+    if (day2 === void 0) {
+      throw new Error(
+        `Invalid day: ${optionDay}. Use mon-sun for weekly or 1-31 for monthly.`
+      );
+    }
+    return day2;
+  }
+  if (!isInteractive()) {
+    throw new Error("--day is required for weekly/monthly");
+  }
+  if (frequency === "weekly") {
+    const defaultDayIndex = existingDay !== void 0 ? DAY_OF_WEEK_CHOICES.findIndex((c) => c.value === existingDay) : 0;
+    const day2 = await promptSelect(
+      "Day of week",
+      DAY_OF_WEEK_CHOICES,
+      defaultDayIndex >= 0 ? defaultDayIndex : 0
+    );
+    return day2 ?? null;
+  }
+  const dayStr = await promptText(
+    "Day of month (1-31)",
+    existingDay?.toString() || "1"
+  );
+  if (!dayStr) return null;
+  const day = parseInt(dayStr, 10);
+  if (isNaN(day) || day < 1 || day > 31) {
+    throw new Error("Day must be between 1 and 31");
+  }
+  return day;
+}
+async function gatherRecurringTime(optionTime, existingTime) {
+  if (optionTime) {
+    const validation = validateTimeFormat(optionTime);
+    if (validation !== true) {
+      throw new Error(`Invalid time: ${validation}`);
+    }
+    return optionTime;
+  }
+  if (!isInteractive()) {
+    throw new Error("--time is required (HH:MM format)");
+  }
+  return await promptText(
+    "Time (HH:MM)",
+    existingTime || "09:00",
+    validateTimeFormat
+  );
+}
+async function gatherOneTimeSchedule(optionDay, optionTime, existingTime) {
+  if (optionDay && optionTime) {
+    if (!validateDateFormat(optionDay)) {
+      throw new Error(
+        `Invalid date format: ${optionDay}. Use YYYY-MM-DD format.`
+      );
+    }
+    if (!validateTimeFormat(optionTime)) {
+      throw new Error(`Invalid time format: ${optionTime}. Use HH:MM format.`);
+    }
+    return `${optionDay} ${optionTime}`;
+  }
+  if (!isInteractive()) {
+    throw new Error("One-time schedules require interactive mode", {
+      cause: new Error(
+        "Or provide --day (YYYY-MM-DD) and --time (HH:MM) flags"
+      )
+    });
+  }
+  const tomorrowDate = getTomorrowDateLocal();
+  const date = await promptText(
+    "Date (YYYY-MM-DD, default tomorrow)",
+    tomorrowDate,
+    validateDateFormat
+  );
+  if (!date) return null;
+  const currentTime = getCurrentTimeLocal();
+  const time = await promptText(
+    "Time (HH:MM)",
+    existingTime || currentTime,
+    validateTimeFormat
+  );
+  if (!time) return null;
+  return `${date} ${time}`;
+}
+async function gatherTimezone(optionTimezone, existingTimezone) {
+  if (optionTimezone) return optionTimezone;
+  let userTimezone = null;
+  try {
+    const prefs = await getZeroUserPreferences();
+    userTimezone = prefs.timezone;
+  } catch {
+    console.log(
+      chalk32.dim("Could not fetch timezone preference, using detected timezone")
+    );
+  }
+  const defaultTimezone = userTimezone || detectTimezone();
+  if (!isInteractive()) {
+    return defaultTimezone;
+  }
+  return await promptText("Timezone", existingTimezone || defaultTimezone);
+}
+async function gatherPromptText(optionPrompt, existingPrompt) {
+  if (optionPrompt) return optionPrompt;
+  if (!isInteractive()) {
+    throw new Error("--prompt is required");
+  }
+  return await promptText(
+    "Prompt to run",
+    existingPrompt || "let's start working."
+  );
+}
+async function gatherNotificationPreferences(optionNotifyEmail, optionNotifySlack, existingSchedule) {
+  if (optionNotifyEmail !== void 0 && optionNotifySlack !== void 0) {
+    return {
+      notifyEmail: optionNotifyEmail,
+      notifySlack: optionNotifySlack
+    };
+  }
+  if (!isInteractive()) {
+    return {
+      notifyEmail: optionNotifyEmail,
+      notifySlack: optionNotifySlack
+    };
+  }
+  const notifyEmail = optionNotifyEmail ?? await promptConfirm(
+    "Enable email notifications?",
+    existingSchedule?.notifyEmail ?? true
+  );
+  const notifySlack = optionNotifySlack ?? await promptConfirm(
+    "Enable Slack notifications?",
+    existingSchedule?.notifySlack ?? true
+  );
+  return { notifyEmail, notifySlack };
+}
+async function gatherInterval(optionInterval, existingInterval) {
+  if (optionInterval) {
+    const val = parseInt(optionInterval, 10);
+    if (isNaN(val) || val < 0) {
+      throw new Error(
+        "Invalid interval. Must be a non-negative integer (seconds)"
+      );
+    }
+    return val;
+  }
+  if (!isInteractive()) {
+    throw new Error("--interval is required for loop schedules (seconds)");
+  }
+  const defaultVal = existingInterval !== void 0 ? String(existingInterval) : "300";
+  const result = await promptText(
+    "Interval in seconds (time between runs)",
+    defaultVal,
+    (v) => {
+      const n = parseInt(v, 10);
+      if (isNaN(n) || n < 0) return "Must be a non-negative integer";
+      return true;
+    }
+  );
+  if (!result) return null;
+  return parseInt(result, 10);
+}
+async function gatherTiming(frequency, options, defaults) {
+  if (frequency === "loop") {
+    const intervalSeconds = await gatherInterval(
+      options.interval,
+      defaults.intervalSeconds
+    );
+    if (intervalSeconds === null) return null;
+    return {
+      day: void 0,
+      time: void 0,
+      atTime: void 0,
+      intervalSeconds
+    };
+  }
+  if (frequency === "once") {
+    const result = await gatherOneTimeSchedule(
+      options.day,
+      options.time,
+      defaults.time
+    );
+    if (!result) return null;
+    return {
+      day: void 0,
+      time: void 0,
+      atTime: result,
+      intervalSeconds: void 0
+    };
+  }
+  const day = await gatherDay(frequency, options.day, defaults.day) ?? void 0;
+  if (day === null && (frequency === "weekly" || frequency === "monthly")) {
+    return null;
+  }
+  const time = await gatherRecurringTime(options.time, defaults.time);
+  if (!time) return null;
+  return { day, time, atTime: void 0, intervalSeconds: void 0 };
+}
+async function findExistingSchedule(agentId, scheduleName) {
+  const { schedules } = await listZeroSchedules();
+  return schedules.find(
+    (s) => s.agentId === agentId && s.name === scheduleName
+  );
+}
+async function buildAndDeploy(params) {
+  let cronExpression;
+  let atTimeISO;
+  if (params.frequency === "loop") {
+  } else if (params.atTime) {
+    atTimeISO = toISODateTime(params.atTime);
+  } else if (params.time && params.frequency !== "once") {
+    cronExpression = generateCronExpression(
+      params.frequency,
+      params.time,
+      params.day
+    );
+  }
+  console.log(
+    `
+Deploying schedule for agent ${chalk32.cyan(params.agentName)}...`
+  );
+  const deployResult = await deployZeroSchedule({
+    name: params.scheduleName,
+    agentId: params.agentId,
+    cronExpression,
+    atTime: atTimeISO,
+    intervalSeconds: params.intervalSeconds,
+    timezone: params.timezone,
+    prompt: params.prompt,
+    artifactName: params.artifactName,
+    ...params.notifyEmail !== void 0 && {
+      notifyEmail: params.notifyEmail
+    },
+    ...params.notifySlack !== void 0 && {
+      notifySlack: params.notifySlack
+    }
+  });
+  return deployResult;
+}
+function displayDeployResult(agentName, deployResult) {
+  if (deployResult.created) {
+    console.log(
+      chalk32.green(`\u2713 Created schedule for agent ${chalk32.cyan(agentName)}`)
+    );
+  } else {
+    console.log(
+      chalk32.green(`\u2713 Updated schedule for agent ${chalk32.cyan(agentName)}`)
+    );
+  }
+  console.log(chalk32.dim(`  Timezone: ${deployResult.schedule.timezone}`));
+  if (deployResult.schedule.triggerType === "loop" && deployResult.schedule.intervalSeconds != null) {
+    console.log(
+      chalk32.dim(
+        `  Mode: Loop (interval ${deployResult.schedule.intervalSeconds}s)`
+      )
+    );
+  } else if (deployResult.schedule.cronExpression) {
+    console.log(chalk32.dim(`  Cron: ${deployResult.schedule.cronExpression}`));
+    if (deployResult.schedule.nextRunAt) {
+      const nextRun = formatInTimezone(
+        deployResult.schedule.nextRunAt,
+        deployResult.schedule.timezone
+      );
+      console.log(chalk32.dim(`  Next run: ${nextRun}`));
+    }
+  } else if (deployResult.schedule.atTime) {
+    const atTimeFormatted = formatInTimezone(
+      deployResult.schedule.atTime,
+      deployResult.schedule.timezone
+    );
+    console.log(chalk32.dim(`  At: ${atTimeFormatted}`));
+  }
+}
+async function tryEnableSchedule(scheduleName, agentId, agentName) {
+  try {
+    await enableZeroSchedule({ name: scheduleName, agentId });
+    console.log(
+      chalk32.green(`\u2713 Enabled schedule for agent ${chalk32.cyan(agentName)}`)
+    );
+  } catch (error) {
+    console.error(chalk32.yellow("\u26A0 Failed to enable schedule"));
+    if (error instanceof ApiRequestError) {
+      if (error.code === "SCHEDULE_PAST") {
+        console.error(chalk32.dim("  Scheduled time has already passed"));
+      } else {
+        console.error(chalk32.dim(`  ${error.message}`));
+      }
+    } else if (error instanceof Error) {
+      console.error(chalk32.dim(`  ${error.message}`));
+    }
+    console.log(
+      `  To enable manually: ${chalk32.cyan(`zero schedule enable ${agentName}`)}`
+    );
+  }
+}
+function showEnableHint(agentName) {
+  console.log();
+  console.log(
+    `  To enable: ${chalk32.cyan(`zero schedule enable ${agentName}`)}`
+  );
+}
+async function handleScheduleEnabling(params) {
+  const { scheduleName, agentId, agentName, enableFlag, shouldPromptEnable } = params;
+  if (enableFlag) {
+    await tryEnableSchedule(scheduleName, agentId, agentName);
+    return;
+  }
+  if (shouldPromptEnable && isInteractive()) {
+    const enableNow = await promptConfirm("Enable this schedule?", true);
+    if (enableNow) {
+      await tryEnableSchedule(scheduleName, agentId, agentName);
+    } else {
+      showEnableHint(agentName);
+    }
+    return;
+  }
+  if (shouldPromptEnable) {
+    showEnableHint(agentName);
+  }
+}
+var setupCommand2 = new Command36().name("setup").description("Create or edit a schedule for a zero agent").argument("<agent-name>", "Agent name to configure schedule for").option("-n, --name <schedule-name>", 'Schedule name (default: "default")').option("-f, --frequency <type>", "Frequency: daily|weekly|monthly|once|loop").option("-t, --time <HH:MM>", "Time to run (24-hour format)").option("-d, --day <day>", "Day of week (mon-sun) or day of month (1-31)").option("-i, --interval <seconds>", "Interval in seconds for loop mode").option("-z, --timezone <tz>", "IANA timezone").option("-p, --prompt <text>", "Prompt to run").option("--artifact-name <name>", "Artifact name", "artifact").option("-e, --enable", "Enable schedule immediately after creation").option("--notify-email", "Enable email notifications (default: true)").option("--no-notify-email", "Disable email notifications").option("--notify-slack", "Enable Slack notifications (default: true)").option("--no-notify-slack", "Disable Slack notifications").action(
+  withErrorHandler(async (agentName, options) => {
+    const compose = await getComposeByName(agentName);
+    if (!compose) {
+      throw new Error(`Agent not found: ${agentName}`);
+    }
+    const agentId = compose.id;
+    const scheduleName = options.name || "default";
+    const existingSchedule = await findExistingSchedule(
+      agentId,
+      scheduleName
+    );
+    console.log(
+      chalk32.dim(
+        existingSchedule ? `Editing existing schedule for agent ${agentName}` : `Creating new schedule for agent ${agentName}`
+      )
+    );
+    const defaults = getExistingDefaults(existingSchedule);
+    const frequency = await gatherFrequency(
+      options.frequency,
+      defaults.frequency
+    );
+    if (!frequency) {
+      console.log(chalk32.dim("Cancelled"));
+      return;
+    }
+    const timing = await gatherTiming(frequency, options, defaults);
+    if (!timing) {
+      console.log(chalk32.dim("Cancelled"));
+      return;
+    }
+    const { day, time, atTime, intervalSeconds } = timing;
+    const timezone = await gatherTimezone(
+      options.timezone,
+      existingSchedule?.timezone
+    );
+    if (!timezone) {
+      console.log(chalk32.dim("Cancelled"));
+      return;
+    }
+    const promptText_ = await gatherPromptText(
+      options.prompt,
+      existingSchedule?.prompt
+    );
+    if (!promptText_) {
+      console.log(chalk32.dim("Cancelled"));
+      return;
+    }
+    const { notifyEmail, notifySlack } = await gatherNotificationPreferences(
+      options.notifyEmail,
+      options.notifySlack,
+      existingSchedule
+    );
+    const deployResult = await buildAndDeploy({
+      scheduleName,
+      agentId,
+      agentName,
+      frequency,
+      time,
+      day,
+      atTime,
+      intervalSeconds,
+      timezone,
+      prompt: promptText_,
+      artifactName: options.artifactName,
+      notifyEmail,
+      notifySlack
+    });
+    displayDeployResult(agentName, deployResult);
+    const shouldPromptEnable = deployResult.created || existingSchedule !== void 0 && !existingSchedule.enabled;
+    await handleScheduleEnabling({
+      scheduleName,
+      agentId,
+      agentName,
+      enableFlag: options.enable ?? false,
+      shouldPromptEnable
+    });
+  })
+);
+
+// src/commands/zero/schedule/list.ts
+import { Command as Command37 } from "commander";
+import chalk33 from "chalk";
+var listCommand7 = new Command37().name("list").alias("ls").description("List all zero schedules").action(
+  withErrorHandler(async () => {
+    const result = await listZeroSchedules();
+    if (result.schedules.length === 0) {
+      console.log(chalk33.dim("No schedules found"));
+      console.log(
+        chalk33.dim("  Create one with: zero schedule setup <agent-name>")
+      );
+      return;
+    }
+    const agentWidth = Math.max(
+      5,
+      ...result.schedules.map((s) => s.agentId.length)
+    );
+    const scheduleWidth = Math.max(
+      8,
+      ...result.schedules.map((s) => s.name.length)
+    );
+    const triggerWidth = Math.max(
+      7,
+      ...result.schedules.map(
+        (s) => s.cronExpression ? s.cronExpression.length + s.timezone.length + 3 : s.atTime?.length || 0
+      )
+    );
+    const header = [
+      "AGENT".padEnd(agentWidth),
+      "SCHEDULE".padEnd(scheduleWidth),
+      "TRIGGER".padEnd(triggerWidth),
+      "STATUS".padEnd(8),
+      "NEXT RUN"
+    ].join("  ");
+    console.log(chalk33.dim(header));
+    for (const schedule of result.schedules) {
+      const trigger = schedule.cronExpression ? `${schedule.cronExpression} (${schedule.timezone})` : schedule.atTime || "-";
+      const status = schedule.enabled ? chalk33.green("enabled") : chalk33.yellow("disabled");
+      const nextRun = schedule.enabled ? formatRelativeTime(schedule.nextRunAt) : "-";
+      const row = [
+        schedule.agentId.padEnd(agentWidth),
+        schedule.name.padEnd(scheduleWidth),
+        trigger.padEnd(triggerWidth),
+        status.padEnd(8 + (schedule.enabled ? 0 : 2)),
+        nextRun
+      ].join("  ");
+      console.log(row);
+    }
+  })
+);
+
+// src/commands/zero/schedule/status.ts
+import { Command as Command38 } from "commander";
+import chalk34 from "chalk";
+function formatDateTimeStyled(dateStr) {
+  if (!dateStr) return chalk34.dim("-");
+  const formatted = formatDateTime(dateStr);
+  return formatted.replace(/\(([^)]+)\)$/, chalk34.dim("($1)"));
+}
+function formatTrigger(schedule) {
+  if (schedule.triggerType === "loop" && schedule.intervalSeconds !== null) {
+    return `interval ${schedule.intervalSeconds}s ${chalk34.dim("(loop)")}`;
+  }
+  if (schedule.cronExpression) {
+    return schedule.cronExpression;
+  }
+  if (schedule.atTime) {
+    return `${schedule.atTime} ${chalk34.dim("(one-time)")}`;
+  }
+  return chalk34.dim("-");
+}
+function printRunConfiguration(schedule) {
+  const statusText = schedule.enabled ? chalk34.green("enabled") : chalk34.yellow("disabled");
+  console.log(`${"Status:".padEnd(16)}${statusText}`);
+  console.log(
+    `${"Agent:".padEnd(16)}${schedule.agentId} ${chalk34.dim(`(${schedule.orgSlug})`)}`
+  );
+  const promptPreview = schedule.prompt.length > 60 ? schedule.prompt.slice(0, 57) + "..." : schedule.prompt;
+  console.log(`${"Prompt:".padEnd(16)}${chalk34.dim(promptPreview)}`);
+  if (schedule.vars && Object.keys(schedule.vars).length > 0) {
+    console.log(
+      `${"Variables:".padEnd(16)}${Object.keys(schedule.vars).join(", ")}`
+    );
+  }
+  if (schedule.secretNames && schedule.secretNames.length > 0) {
+    console.log(`${"Secrets:".padEnd(16)}${schedule.secretNames.join(", ")}`);
+  }
+  if (schedule.artifactName) {
+    const artifactInfo = schedule.artifactVersion ? `${schedule.artifactName}:${schedule.artifactVersion}` : schedule.artifactName;
+    console.log(`${"Artifact:".padEnd(16)}${artifactInfo}`);
+  }
+  if (schedule.volumeVersions && Object.keys(schedule.volumeVersions).length > 0) {
+    console.log(
+      `${"Volumes:".padEnd(16)}${Object.keys(schedule.volumeVersions).join(", ")}`
+    );
+  }
+}
+function printTimeSchedule(schedule) {
+  console.log();
+  console.log(`${"Trigger:".padEnd(16)}${formatTrigger(schedule)}`);
+  console.log(`${"Timezone:".padEnd(16)}${detectTimezone()}`);
+  if (schedule.enabled) {
+    console.log(
+      `${"Next Run:".padEnd(16)}${formatDateTimeStyled(schedule.nextRunAt)}`
+    );
+  }
+  if (schedule.triggerType === "loop") {
+    const failureText = schedule.consecutiveFailures > 0 ? chalk34.yellow(`${schedule.consecutiveFailures}/3`) : chalk34.dim("0/3");
+    console.log(`${"Failures:".padEnd(16)}${failureText}`);
+  }
+}
+var statusCommand3 = new Command38().name("status").description("Show detailed status of a zero schedule").argument("<agent-name>", "Agent name").option(
+  "-n, --name <schedule-name>",
+  "Schedule name (required when agent has multiple schedules)"
+).action(
+  withErrorHandler(async (agentName, options) => {
+    const schedule = await resolveZeroScheduleByAgent(
+      agentName,
+      options.name
+    );
+    console.log();
+    console.log(`Schedule for agent: ${chalk34.cyan(agentName)}`);
+    console.log(chalk34.dim("\u2501".repeat(50)));
+    printRunConfiguration(schedule);
+    printTimeSchedule(schedule);
+    console.log();
+  })
+);
+
+// src/commands/zero/schedule/delete.ts
+import { Command as Command39 } from "commander";
+import chalk35 from "chalk";
+var deleteCommand3 = new Command39().name("delete").alias("rm").description("Delete a zero schedule").argument("<agent-name>", "Agent name").option(
+  "-n, --name <schedule-name>",
+  "Schedule name (required when agent has multiple schedules)"
+).option("-y, --yes", "Skip confirmation prompt").action(
+  withErrorHandler(
+    async (agentName, options) => {
+      const resolved = await resolveZeroScheduleByAgent(
+        agentName,
+        options.name
+      );
+      if (!options.yes) {
+        if (!isInteractive()) {
+          throw new Error("--yes flag is required in non-interactive mode");
+        }
+        const confirmed = await promptConfirm(
+          `Delete schedule for agent ${chalk35.cyan(agentName)}?`,
+          false
+        );
+        if (!confirmed) {
+          console.log(chalk35.dim("Cancelled"));
+          return;
+        }
+      }
+      await deleteZeroSchedule({
+        name: resolved.name,
+        agentId: resolved.agentId
+      });
+      console.log(
+        chalk35.green(`\u2713 Deleted schedule for agent ${chalk35.cyan(agentName)}`)
+      );
+    }
+  )
+);
+
+// src/commands/zero/schedule/enable.ts
+import { Command as Command40 } from "commander";
+import chalk36 from "chalk";
+var enableCommand = new Command40().name("enable").description("Enable a zero schedule").argument("<agent-name>", "Agent name").option(
+  "-n, --name <schedule-name>",
+  "Schedule name (required when agent has multiple schedules)"
+).action(
+  withErrorHandler(async (agentName, options) => {
+    const resolved = await resolveZeroScheduleByAgent(
+      agentName,
+      options.name
+    );
+    await enableZeroSchedule({
+      name: resolved.name,
+      agentId: resolved.agentId
+    });
+    console.log(
+      chalk36.green(`\u2713 Enabled schedule for agent ${chalk36.cyan(agentName)}`)
+    );
+  })
+);
+
+// src/commands/zero/schedule/disable.ts
+import { Command as Command41 } from "commander";
+import chalk37 from "chalk";
+var disableCommand = new Command41().name("disable").description("Disable a zero schedule").argument("<agent-name>", "Agent name").option(
+  "-n, --name <schedule-name>",
+  "Schedule name (required when agent has multiple schedules)"
+).action(
+  withErrorHandler(async (agentName, options) => {
+    const resolved = await resolveZeroScheduleByAgent(
+      agentName,
+      options.name
+    );
+    await disableZeroSchedule({
+      name: resolved.name,
+      agentId: resolved.agentId
+    });
+    console.log(
+      chalk37.green(`\u2713 Disabled schedule for agent ${chalk37.cyan(agentName)}`)
+    );
+  })
+);
+
+// src/commands/zero/schedule/index.ts
+var zeroScheduleCommand = new Command42().name("schedule").description("Manage zero agent schedules").addCommand(setupCommand2).addCommand(listCommand7).addCommand(statusCommand3).addCommand(deleteCommand3).addCommand(enableCommand).addCommand(disableCommand);
+
+// src/commands/zero/secret/index.ts
+import { Command as Command46 } from "commander";
+
+// src/commands/zero/secret/list.ts
+import { Command as Command43 } from "commander";
+import chalk38 from "chalk";
+var listCommand8 = new Command43().name("list").alias("ls").description("List all secrets").action(
+  withErrorHandler(async () => {
+    const result = await listZeroSecrets();
+    if (result.secrets.length === 0) {
+      console.log(chalk38.dim("No secrets found"));
+      console.log();
+      console.log("To add a secret:");
+      console.log(chalk38.cyan("  zero secret set MY_API_KEY --body <value>"));
+      return;
+    }
+    console.log(chalk38.bold("Secrets:"));
+    console.log();
+    for (const secret of result.secrets) {
+      let typeIndicator = "";
+      let derivedLine = null;
+      if (secret.type === "model-provider") {
+        typeIndicator = chalk38.dim(" [model-provider]");
+      } else if (secret.type === "connector") {
+        const derived = getConnectorDerivedNames(secret.name);
+        if (derived) {
+          typeIndicator = chalk38.dim(` [${derived.connectorLabel} connector]`);
+          derivedLine = chalk38.dim(
+            `Available as: ${derived.envVarNames.join(", ")}`
+          );
+        } else {
+          typeIndicator = chalk38.dim(" [connector]");
+        }
+      } else if (secret.type === "user") {
+        const derived = getConnectorDerivedNames(secret.name);
+        if (derived) {
+          typeIndicator = chalk38.dim(` [${derived.connectorLabel} connector]`);
+          derivedLine = chalk38.dim(
+            `Available as: ${derived.envVarNames.join(", ")}`
+          );
+        }
+      }
+      console.log(`  ${chalk38.cyan(secret.name)}${typeIndicator}`);
+      if (derivedLine) {
+        console.log(`    ${derivedLine}`);
+      }
+      if (secret.description) {
+        console.log(`    ${chalk38.dim(secret.description)}`);
+      }
+      console.log(
+        `    ${chalk38.dim(`Updated: ${new Date(secret.updatedAt).toLocaleString()}`)}`
+      );
+      console.log();
+    }
+    console.log(chalk38.dim(`Total: ${result.secrets.length} secret(s)`));
+  })
+);
+
+// src/commands/zero/secret/set.ts
+import { Command as Command44 } from "commander";
+import chalk39 from "chalk";
+var setCommand4 = new Command44().name("set").description("Create or update a secret").argument("<name>", "Secret name (uppercase, e.g., MY_API_KEY)").option(
+  "-b, --body <value>",
+  "Secret value (required in non-interactive mode)"
+).option("-d, --description <description>", "Optional description").action(
+  withErrorHandler(
+    async (name, options) => {
+      let value;
+      if (options.body !== void 0) {
+        value = options.body;
+      } else if (isInteractive()) {
+        const prompted = await promptPassword("Enter secret value:");
+        if (prompted === void 0) {
+          process.exit(0);
+        }
+        value = prompted;
+      } else {
+        throw new Error("--body is required in non-interactive mode", {
+          cause: new Error(
+            `Usage: zero secret set ${name} --body "your-secret-value"`
+          )
+        });
+      }
+      let secret;
+      try {
+        secret = await setZeroSecret({
+          name,
+          value,
+          description: options.description
+        });
+      } catch (error) {
+        if (error instanceof Error && error.message.includes("must contain only uppercase")) {
+          throw new Error(error.message, {
+            cause: new Error(
+              "Examples of valid secret names: MY_API_KEY, GITHUB_TOKEN, AWS_ACCESS_KEY_ID"
+            )
+          });
+        }
+        throw error;
+      }
+      console.log(chalk39.green(`\u2713 Secret "${secret.name}" saved`));
+    }
+  )
+);
+
+// src/commands/zero/secret/delete.ts
+import { Command as Command45 } from "commander";
+import chalk40 from "chalk";
+var deleteCommand4 = new Command45().name("delete").description("Delete a secret").argument("<name>", "Secret name to delete").option("-y, --yes", "Skip confirmation prompt").action(
+  withErrorHandler(async (name, options) => {
+    if (!options.yes) {
+      if (!isInteractive()) {
+        throw new Error("--yes flag is required in non-interactive mode");
+      }
+      const confirmed = await promptConfirm(
+        `Are you sure you want to delete secret "${name}"?`,
+        false
+      );
+      if (!confirmed) {
+        console.log(chalk40.dim("Cancelled"));
+        return;
+      }
+    }
+    await deleteZeroSecret(name);
+    console.log(chalk40.green(`\u2713 Secret "${name}" deleted`));
+  })
+);
+
+// src/commands/zero/secret/index.ts
+var zeroSecretCommand = new Command46().name("secret").description("Manage secrets").addCommand(listCommand8).addCommand(setCommand4).addCommand(deleteCommand4);
+
+// src/commands/zero/variable/index.ts
+import { Command as Command50 } from "commander";
+
+// src/commands/zero/variable/list.ts
+import { Command as Command47 } from "commander";
+import chalk41 from "chalk";
+function truncateValue2(value, maxLength = 60) {
+  if (value.length <= maxLength) {
+    return value;
+  }
+  return value.slice(0, maxLength - 15) + "... [truncated]";
+}
+var listCommand9 = new Command47().name("list").alias("ls").description("List all variables").action(
+  withErrorHandler(async () => {
+    const result = await listZeroVariables();
+    if (result.variables.length === 0) {
+      console.log(chalk41.dim("No variables found"));
+      console.log();
+      console.log("To add a variable:");
+      console.log(chalk41.cyan("  zero variable set MY_VAR <value>"));
+      return;
+    }
+    console.log(chalk41.bold("Variables:"));
+    console.log();
+    for (const variable of result.variables) {
+      const displayValue = truncateValue2(variable.value);
+      console.log(`  ${chalk41.cyan(variable.name)} = ${displayValue}`);
+      if (variable.description) {
+        console.log(`    ${chalk41.dim(variable.description)}`);
+      }
+      console.log(
+        `    ${chalk41.dim(`Updated: ${new Date(variable.updatedAt).toLocaleString()}`)}`
+      );
+      console.log();
+    }
+    console.log(chalk41.dim(`Total: ${result.variables.length} variable(s)`));
+  })
+);
+
+// src/commands/zero/variable/set.ts
+import { Command as Command48 } from "commander";
+import chalk42 from "chalk";
+var setCommand5 = new Command48().name("set").description("Create or update a variable").argument("<name>", "Variable name (uppercase, e.g., MY_VAR)").argument("<value>", "Variable value").option("-d, --description <description>", "Optional description").action(
+  withErrorHandler(
+    async (name, value, options) => {
+      let variable;
+      try {
+        variable = await setZeroVariable({
+          name,
+          value,
+          description: options.description
+        });
+      } catch (error) {
+        if (error instanceof Error && error.message.includes("must contain only uppercase")) {
+          throw new Error(error.message, {
+            cause: new Error(
+              "Examples of valid variable names: MY_VAR, API_URL, DEBUG_MODE"
+            )
+          });
+        }
+        throw error;
+      }
+      console.log(chalk42.green(`\u2713 Variable "${variable.name}" saved`));
+    }
+  )
+);
+
+// src/commands/zero/variable/delete.ts
+import { Command as Command49 } from "commander";
+import chalk43 from "chalk";
+var deleteCommand5 = new Command49().name("delete").description("Delete a variable").argument("<name>", "Variable name to delete").option("-y, --yes", "Skip confirmation prompt").action(
+  withErrorHandler(async (name, options) => {
+    if (!options.yes) {
+      if (!isInteractive()) {
+        throw new Error("--yes flag is required in non-interactive mode");
+      }
+      const confirmed = await promptConfirm(
+        `Are you sure you want to delete variable "${name}"?`,
+        false
+      );
+      if (!confirmed) {
+        console.log(chalk43.dim("Cancelled"));
+        return;
+      }
+    }
+    await deleteZeroVariable(name);
+    console.log(chalk43.green(`\u2713 Variable "${name}" deleted`));
+  })
+);
+
+// src/commands/zero/variable/index.ts
+var zeroVariableCommand = new Command50().name("variable").description("Manage variables").addCommand(listCommand9).addCommand(setCommand5).addCommand(deleteCommand5);
+
+// src/commands/zero/whoami.ts
+import { Command as Command51 } from "commander";
+import chalk44 from "chalk";
+function isInsideSandbox() {
+  return !!process.env.ZERO_AGENT_ID;
+}
+async function showSandboxInfo() {
+  const agentId = process.env.ZERO_AGENT_ID;
+  const payload = decodeZeroTokenPayload();
+  console.log(chalk44.bold("Agent:"));
+  console.log(`  ID:           ${agentId}`);
+  console.log();
+  console.log(chalk44.bold("Run:"));
+  console.log(`  ID:           ${payload?.runId ?? chalk44.dim("unavailable")}`);
+  console.log(`  Org:          ${payload?.orgId ?? chalk44.dim("unavailable")}`);
+  if (payload?.capabilities?.length) {
+    console.log();
+    console.log(chalk44.bold("Capabilities:"));
+    console.log(`  ${payload.capabilities.join(", ")}`);
+  }
+}
+async function showLocalInfo() {
+  const token = await getToken();
+  const apiUrl = await getApiUrl();
+  const activeOrg = await getActiveOrg();
+  console.log(chalk44.bold("Auth:"));
+  if (token) {
+    const tokenSource = process.env.ZERO_TOKEN ? "ZERO_TOKEN env var" : process.env.VM0_TOKEN ? "VM0_TOKEN env var" : "config file";
+    console.log(
+      `  Status:     ${chalk44.green("Authenticated")} (via ${tokenSource})`
+    );
+  } else {
+    console.log(`  Status:     ${chalk44.dim("Not authenticated")}`);
+  }
+  console.log(`  API:        ${apiUrl}`);
+  console.log();
+  if (activeOrg) {
+    console.log(chalk44.bold("Org:"));
+    console.log(`  Active:     ${activeOrg}`);
+  }
+}
+var zeroWhoamiCommand = new Command51().name("whoami").description("Show current identity and environment information").action(
+  withErrorHandler(async () => {
+    if (isInsideSandbox()) {
+      await showSandboxInfo();
+    } else {
+      await showLocalInfo();
+    }
+  })
+);
+
+// src/zero.ts
+var program = new Command52();
+program.name("zero").description("Zero CLI - Manage your zero platform").version("9.81.0");
 program.addCommand(zeroOrgCommand);
 program.addCommand(agentCommand);
 program.addCommand(zeroConnectorCommand);
@@ -21,6 +2923,7 @@ program.addCommand(zeroPreferenceCommand);
 program.addCommand(zeroScheduleCommand);
 program.addCommand(zeroSecretCommand);
 program.addCommand(zeroVariableCommand);
+program.addCommand(zeroWhoamiCommand);
 if (process.argv[1]?.endsWith("zero.js") || process.argv[1]?.endsWith("zero.ts") || process.argv[1]?.endsWith("zero")) {
   process.stdout.on("error", (err) => {
     if (err.code === "EPIPE") process.exit(0);