@vm0/cli 9.88.0 → 9.90.0

package/{chunk-NM4FYPVK.js → chunk-KEYG4DHY.js}

@@ -47,7 +47,7 @@ if (DSN) {
   Sentry.init({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.88.0",
+    release: "9.90.0",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -66,7 +66,7 @@ if (DSN) {
     }
   });
   Sentry.setContext("cli", {
-    version: "9.88.0",
+    version: "9.90.0",
     command: process.argv.slice(2).join(" ")
   });
   Sentry.setContext("runtime", {
@@ -810,6 +810,7 @@ var logEntrySchema = z5.object({
   orgSlug: z5.string().nullable(),
   framework: z5.string().nullable(),
   triggerSource: triggerSourceSchema.nullable(),
+  triggerAgentName: z5.string().nullable(),
   scheduleId: z5.string().nullable(),
   status: logStatusSchema,
   createdAt: z5.string(),
@@ -837,7 +838,9 @@ var logDetailSchema = z5.object({
   displayName: z5.string().nullable(),
   framework: z5.string().nullable(),
   modelProvider: z5.string().nullable(),
+  selectedModel: z5.string().nullable(),
   triggerSource: triggerSourceSchema.nullable(),
+  triggerAgentName: z5.string().nullable(),
   scheduleId: z5.string().nullable(),
   status: logStatusSchema,
   prompt: z5.string(),
@@ -3226,10 +3229,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://app.ahrefs.com/api/auth",
       tokenUrl: "https://app.ahrefs.com/api/token",
-      scopes: ["api"],
-      environmentMapping: {
-        AHREFS_TOKEN: "$secrets.AHREFS_ACCESS_TOKEN"
-      }
+      scopes: ["api"]
     }
   },
   agentmail: {
@@ -3287,10 +3287,7 @@ var CONNECTOR_TYPES_DEF = {
         "schema.bases:read",
         "schema.bases:write",
         "user.email:read"
-      ],
-      environmentMapping: {
-        AIRTABLE_TOKEN: "$secrets.AIRTABLE_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   github: {
@@ -3316,11 +3313,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://github.com/login/oauth/authorize",
       tokenUrl: "https://github.com/login/oauth/access_token",
-      scopes: ["repo", "project"],
-      environmentMapping: {
-        GH_TOKEN: "$secrets.GITHUB_ACCESS_TOKEN",
-        GITHUB_TOKEN: "$secrets.GITHUB_ACCESS_TOKEN"
-      }
+      scopes: ["repo", "project"]
     }
   },
   notion: {
@@ -3349,10 +3342,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
       tokenUrl: "https://api.notion.com/v1/oauth/token",
-      scopes: [],
-      environmentMapping: {
-        NOTION_TOKEN: "$secrets.NOTION_ACCESS_TOKEN"
-      }
+      scopes: []
     }
   },
   gmail: {
@@ -3381,10 +3371,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
-      scopes: ["https://www.googleapis.com/auth/gmail.modify"],
-      environmentMapping: {
-        GMAIL_TOKEN: "$secrets.GMAIL_ACCESS_TOKEN"
-      }
+      scopes: ["https://www.googleapis.com/auth/gmail.modify"]
     }
   },
   "google-sheets": {
@@ -3416,10 +3403,7 @@ var CONNECTOR_TYPES_DEF = {
       scopes: [
         "https://www.googleapis.com/auth/spreadsheets",
         "https://www.googleapis.com/auth/userinfo.email"
-      ],
-      environmentMapping: {
-        GOOGLE_SHEETS_TOKEN: "$secrets.GOOGLE_SHEETS_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   "google-docs": {
@@ -3451,10 +3435,7 @@ var CONNECTOR_TYPES_DEF = {
       scopes: [
         "https://www.googleapis.com/auth/documents",
         "https://www.googleapis.com/auth/userinfo.email"
-      ],
-      environmentMapping: {
-        GOOGLE_DOCS_TOKEN: "$secrets.GOOGLE_DOCS_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   "google-drive": {
@@ -3486,10 +3467,7 @@ var CONNECTOR_TYPES_DEF = {
       scopes: [
         "https://www.googleapis.com/auth/drive",
         "https://www.googleapis.com/auth/userinfo.email"
-      ],
-      environmentMapping: {
-        GOOGLE_DRIVE_TOKEN: "$secrets.GOOGLE_DRIVE_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   "google-calendar": {
@@ -3521,10 +3499,7 @@ var CONNECTOR_TYPES_DEF = {
       scopes: [
         "https://www.googleapis.com/auth/calendar",
         "https://www.googleapis.com/auth/userinfo.email"
-      ],
-      environmentMapping: {
-        GOOGLE_CALENDAR_TOKEN: "$secrets.GOOGLE_CALENDAR_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   close: {
@@ -3554,10 +3529,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://app.close.com/oauth2/authorize/",
       tokenUrl: "https://api.close.com/oauth2/token/",
-      scopes: ["all.full_access", "offline_access"],
-      environmentMapping: {
-        CLOSE_TOKEN: "$secrets.CLOSE_ACCESS_TOKEN"
-      }
+      scopes: ["all.full_access", "offline_access"]
     }
   },
   "hugging-face": {
@@ -3660,10 +3632,7 @@ var CONNECTOR_TYPES_DEF = {
         "crm.lists.read",
         "crm.schemas.contacts.read",
         "settings.users.read"
-      ],
-      environmentMapping: {
-        HUBSPOT_TOKEN: "$secrets.HUBSPOT_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   computer: {
@@ -3694,11 +3663,7 @@ var CONNECTOR_TYPES_DEF = {
         }
       }
     },
-    defaultAuthMethod: "api",
-    bridgeMapping: {
-      COMPUTER_CONNECTOR_BRIDGE_TOKEN: "$secrets.COMPUTER_CONNECTOR_BRIDGE_TOKEN",
-      COMPUTER_CONNECTOR_DOMAIN: "$secrets.COMPUTER_CONNECTOR_DOMAIN"
-    }
+    defaultAuthMethod: "api"
   },
   slack: {
     label: "Slack",
@@ -3763,10 +3728,7 @@ var CONNECTOR_TYPES_DEF = {
         "team:read",
         // Custom emoji (low priority)
         "emoji:read"
-      ],
-      environmentMapping: {
-        SLACK_TOKEN: "$secrets.SLACK_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   docusign: {
@@ -3796,10 +3758,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://account.docusign.com/oauth/auth",
       tokenUrl: "https://account.docusign.com/oauth/token",
-      scopes: ["signature", "extended", "openid"],
-      environmentMapping: {
-        DOCUSIGN_TOKEN: "$secrets.DOCUSIGN_ACCESS_TOKEN"
-      }
+      scopes: ["signature", "extended", "openid"]
     }
   },
   dropbox: {
@@ -3843,10 +3802,7 @@ var CONNECTOR_TYPES_DEF = {
         "account_info.read",
         "files.metadata.read",
         "files.content.read"
-      ],
-      environmentMapping: {
-        DROPBOX_TOKEN: "$secrets.DROPBOX_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   linear: {
@@ -3881,10 +3837,7 @@ var CONNECTOR_TYPES_DEF = {
         "issues:create",
         "comments:create",
         "timeSchedule:write"
-      ],
-      environmentMapping: {
-        LINEAR_TOKEN: "$secrets.LINEAR_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   intercom: {
@@ -4158,10 +4111,7 @@ var CONNECTOR_TYPES_DEF = {
         "time-off:write",
         "invoice-adjustments:read",
         "invoice-adjustments:write"
-      ],
-      environmentMapping: {
-        DEEL_TOKEN: "$secrets.DEEL_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   deepseek: {
@@ -4367,10 +4317,7 @@ var CONNECTOR_TYPES_DEF = {
         "file_comments:write",
         "library_assets:read",
         "library_content:read"
-      ],
-      environmentMapping: {
-        FIGMA_TOKEN: "$secrets.FIGMA_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   mercury: {
@@ -4411,10 +4358,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://oauth2.mercury.com/oauth2/auth",
       tokenUrl: "https://oauth2.mercury.com/oauth2/token",
-      scopes: ["offline_access"],
-      environmentMapping: {
-        MERCURY_TOKEN: "$secrets.MERCURY_ACCESS_TOKEN"
-      }
+      scopes: ["offline_access"]
     }
   },
   minimax: {
@@ -4532,10 +4476,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://www.reddit.com/api/v1/authorize",
       tokenUrl: "https://www.reddit.com/api/v1/access_token",
-      scopes: ["identity", "read"],
-      environmentMapping: {
-        REDDIT_TOKEN: "$secrets.REDDIT_ACCESS_TOKEN"
-      }
+      scopes: ["identity", "read"]
     }
   },
   strava: {
@@ -4569,10 +4510,7 @@ var CONNECTOR_TYPES_DEF = {
         "profile:read_all",
         "activity:read_all",
         "activity:write"
-      ],
-      environmentMapping: {
-        STRAVA_TOKEN: "$secrets.STRAVA_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   x: {
@@ -4647,10 +4585,7 @@ var CONNECTOR_TYPES_DEF = {
         // Send and manage Direct Messages for you.
         "media.write"
         // Upload media.
-      ],
-      environmentMapping: {
-        X_TOKEN: "$secrets.X_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   neon: {
@@ -4697,10 +4632,7 @@ var CONNECTOR_TYPES_DEF = {
         "urn:neoncloud:projects:create",
         "urn:neoncloud:projects:update",
         "urn:neoncloud:projects:delete"
-      ],
-      environmentMapping: {
-        NEON_TOKEN: "$secrets.NEON_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   gamma: {
@@ -4751,10 +4683,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://connect.garmin.com/oauth2Confirm",
       tokenUrl: "https://diauth.garmin.com/di-oauth2-service/oauth/token",
-      scopes: [],
-      environmentMapping: {
-        GARMIN_CONNECT_TOKEN: "$secrets.GARMIN_CONNECT_ACCESS_TOKEN"
-      }
+      scopes: []
     }
   },
   vercel: {
@@ -4778,10 +4707,7 @@ var CONNECTOR_TYPES_DEF = {
     defaultAuthMethod: "oauth",
     oauth: {
       tokenUrl: "https://api.vercel.com/v2/oauth/access_token",
-      scopes: [],
-      environmentMapping: {
-        VERCEL_TOKEN: "$secrets.VERCEL_ACCESS_TOKEN"
-      }
+      scopes: []
     }
   },
   sentry: {
@@ -4817,10 +4743,7 @@ var CONNECTOR_TYPES_DEF = {
         "member:read",
         "event:read",
         "event:write"
-      ],
-      environmentMapping: {
-        SENTRY_TOKEN: "$secrets.SENTRY_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   posthog: {
@@ -4885,10 +4808,7 @@ var CONNECTOR_TYPES_DEF = {
         "survey:read",
         "survey:write",
         "error_tracking:read"
-      ],
-      environmentMapping: {
-        POSTHOG_TOKEN: "$secrets.POSTHOG_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   productlane: {
@@ -4913,6 +4833,9 @@ var CONNECTOR_TYPES_DEF = {
   },
   "intervals-icu": {
     label: "Intervals.icu",
+    environmentMapping: {
+      INTERVALS_ICU_TOKEN: "$secrets.INTERVALS_ICU_ACCESS_TOKEN"
+    },
     helpText: "Connect your Intervals.icu account to access training, activity, wellness, and calendar data",
     authMethods: {
       oauth: {
@@ -4930,10 +4853,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://intervals.icu/oauth/authorize",
       tokenUrl: "https://intervals.icu/api/oauth/token",
-      scopes: ["ACTIVITY", "WELLNESS", "CALENDAR", "SETTINGS", "LIBRARY"],
-      environmentMapping: {
-        INTERVALS_ICU_TOKEN: "$secrets.INTERVALS_ICU_ACCESS_TOKEN"
-      }
+      scopes: ["ACTIVITY", "WELLNESS", "CALENDAR", "SETTINGS", "LIBRARY"]
     }
   },
   monday: {
@@ -4977,10 +4897,7 @@ var CONNECTOR_TYPES_DEF = {
         "assets:read",
         "tags:read",
         "teams:read"
-      ],
-      environmentMapping: {
-        MONDAY_TOKEN: "$secrets.MONDAY_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   calendly: {
@@ -5044,10 +4961,7 @@ var CONNECTOR_TYPES_DEF = {
         "folder:read",
         "folder:write",
         "profile:read"
-      ],
-      environmentMapping: {
-        CANVA_TOKEN: "$secrets.CANVA_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   "cal-com": {
@@ -5120,10 +5034,7 @@ var CONNECTOR_TYPES_DEF = {
         "files",
         "assets",
         "projects"
-      ],
-      environmentMapping: {
-        XERO_TOKEN: "$secrets.XERO_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   supabase: {
@@ -5176,10 +5087,7 @@ var CONNECTOR_TYPES_DEF = {
         "analytics:read",
         "environment:read",
         "domains:read"
-      ],
-      environmentMapping: {
-        SUPABASE_TOKEN: "$secrets.SUPABASE_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   todoist: {
@@ -5204,10 +5112,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://todoist.com/oauth/authorize",
       tokenUrl: "https://todoist.com/oauth/access_token",
-      scopes: ["data:read_write", "data:delete", "project:delete"],
-      environmentMapping: {
-        TODOIST_TOKEN: "$secrets.TODOIST_ACCESS_TOKEN"
-      }
+      scopes: ["data:read_write", "data:delete", "project:delete"]
     }
   },
   webflow: {
@@ -5259,10 +5164,7 @@ var CONNECTOR_TYPES_DEF = {
         "workspace:read",
         "custom_code:read",
         "custom_code:write"
-      ],
-      environmentMapping: {
-        WEBFLOW_TOKEN: "$secrets.WEBFLOW_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   wrike: {
@@ -5311,10 +5213,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
       tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-      scopes: ["Mail.ReadWrite", "Mail.Send", "User.Read", "offline_access"],
-      environmentMapping: {
-        OUTLOOK_MAIL_TOKEN: "$secrets.OUTLOOK_MAIL_ACCESS_TOKEN"
-      }
+      scopes: ["Mail.ReadWrite", "Mail.Send", "User.Read", "offline_access"]
     }
   },
   "outlook-calendar": {
@@ -5344,10 +5243,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
       tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-      scopes: ["Calendars.ReadWrite", "User.Read", "offline_access"],
-      environmentMapping: {
-        OUTLOOK_CALENDAR_TOKEN: "$secrets.OUTLOOK_CALENDAR_ACCESS_TOKEN"
-      }
+      scopes: ["Calendars.ReadWrite", "User.Read", "offline_access"]
     }
   },
   asana: {
@@ -5376,10 +5272,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://app.asana.com/-/oauth_authorize",
       tokenUrl: "https://app.asana.com/-/oauth_token",
-      scopes: [],
-      environmentMapping: {
-        ASANA_TOKEN: "$secrets.ASANA_ACCESS_TOKEN"
-      }
+      scopes: []
     }
   },
   atlassian: {
@@ -5442,10 +5335,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://www.facebook.com/v22.0/dialog/oauth",
       tokenUrl: "https://graph.facebook.com/v22.0/oauth/access_token",
-      scopes: ["ads_management", "ads_read", "business_management"],
-      environmentMapping: {
-        META_ADS_TOKEN: "$secrets.META_ADS_ACCESS_TOKEN"
-      }
+      scopes: ["ads_management", "ads_read", "business_management"]
     }
   },
   stripe: {
@@ -5475,10 +5365,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://connect.stripe.com/oauth/authorize",
       tokenUrl: "https://connect.stripe.com/oauth/token",
-      scopes: ["read_write"],
-      environmentMapping: {
-        STRIPE_TOKEN: "$secrets.STRIPE_ACCESS_TOKEN"
-      }
+      scopes: ["read_write"]
     }
   },
   openai: {
@@ -5593,11 +5480,7 @@ var CONNECTOR_TYPES_DEF = {
     oauth: {
       authorizationUrl: "https://login.mailchimp.com/oauth2/authorize",
       tokenUrl: "https://login.mailchimp.com/oauth2/token",
-      scopes: [],
-      environmentMapping: {
-        MAILCHIMP_TOKEN: "$secrets.MAILCHIMP_ACCESS_TOKEN",
-        MAILCHIMP_DC: "$vars.MAILCHIMP_DC"
-      }
+      scopes: []
     }
   },
   chatwoot: {
@@ -6584,6 +6467,9 @@ var CONNECTOR_TYPES_DEF = {
   },
   spotify: {
     label: "Spotify",
+    environmentMapping: {
+      SPOTIFY_TOKEN: "$secrets.SPOTIFY_ACCESS_TOKEN"
+    },
     featureFlag: "spotifyConnector" /* SpotifyConnector */,
     helpText: "Connect your Spotify account to manage playlists, control playback, and access music data",
     authMethods: {
@@ -6626,10 +6512,7 @@ var CONNECTOR_TYPES_DEF = {
         "user-library-read",
         "user-read-email",
         "user-read-private"
-      ],
-      environmentMapping: {
-        SPOTIFY_TOKEN: "$secrets.SPOTIFY_ACCESS_TOKEN"
-      }
+      ]
     }
   },
   "slack-webhook": {
@@ -6725,8 +6608,7 @@ var connectorTypeSchema = z21.enum(
   Object.keys(CONNECTOR_TYPES_DEF)
 );
 function getConnectorEnvironmentMapping(type) {
-  const config = CONNECTOR_TYPES[type];
-  return config.environmentMapping ?? config.oauth?.environmentMapping ?? config.bridgeMapping ?? {};
+  return CONNECTOR_TYPES[type].environmentMapping;
 }
 function getConnectorDerivedNames(secretName) {
   const allTypes = Object.keys(CONNECTOR_TYPES);
@@ -16457,10 +16339,70 @@ var EXPANDED_CONNECTOR_FIREWALLS = Object.fromEntries(
     expandPlaceholders(firewall, type)
   ])
 );
+function isFirewallConnectorType(type) {
+  return type in CONNECTOR_FIREWALLS;
+}
+function getConnectorFirewall(type) {
+  return EXPANDED_CONNECTOR_FIREWALLS[type];
+}
 
 // ../../packages/core/src/firewall-loader.ts
 var MAX_RESPONSE_SIZE = 128 * 1024;
 
+// ../../packages/core/src/contracts/firewall-rule-matcher.ts
+var PARAM_SEG = /^\{([^}]+)\}$/;
+function matchFirewallPath(path, pattern) {
+  const pathSegs = path.split("/").filter(Boolean);
+  const patternSegs = pattern.split("/").filter(Boolean);
+  const params = {};
+  let pi = 0;
+  for (const seg of patternSegs) {
+    const m = PARAM_SEG.exec(seg);
+    if (m) {
+      const name = m[1];
+      if (name.endsWith("+")) {
+        if (pi >= pathSegs.length) return null;
+        params[name.slice(0, -1)] = pathSegs.slice(pi).join("/");
+        return params;
+      }
+      if (name.endsWith("*")) {
+        params[name.slice(0, -1)] = pathSegs.slice(pi).join("/");
+        return params;
+      }
+      if (pi >= pathSegs.length) return null;
+      params[name] = pathSegs[pi];
+      pi++;
+    } else {
+      if (pi >= pathSegs.length || pathSegs[pi] !== seg) return null;
+      pi++;
+    }
+  }
+  if (pi !== pathSegs.length) return null;
+  return params;
+}
+function findMatchingPermissions(method, path, config) {
+  const upperMethod = method.toUpperCase();
+  const matched = /* @__PURE__ */ new Set();
+  for (const api of config.apis) {
+    if (!api.permissions) continue;
+    for (const perm of api.permissions) {
+      if (matched.has(perm.name)) continue;
+      for (const rule of perm.rules) {
+        const spaceIdx = rule.indexOf(" ");
+        if (spaceIdx === -1) continue;
+        const ruleMethod = rule.slice(0, spaceIdx).toUpperCase();
+        const rulePath = rule.slice(spaceIdx + 1);
+        if (ruleMethod !== "ANY" && ruleMethod !== upperMethod) continue;
+        if (matchFirewallPath(path, rulePath) !== null) {
+          matched.add(perm.name);
+          break;
+        }
+      }
+    }
+  }
+  return [...matched];
+}
+
 // ../../packages/core/src/contracts/zero-user-preferences.ts
 import { z as z22 } from "zod";
 var c14 = initContract();
@@ -16595,6 +16537,7 @@ var skillsResolveContract = c16.router({
 // ../../packages/core/src/contracts/zero-agents.ts
 import { z as z26 } from "zod";
 var c17 = initContract();
+var zeroAgentCustomSkillNameSchema = z26.string().min(2).max(64).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/);
 var zeroAgentResponseSchema = z26.object({
   agentId: z26.string(),
   description: z26.string().nullable(),
@@ -16608,7 +16551,8 @@ var zeroAgentRequestSchema = z26.object({
   description: z26.string().optional(),
   displayName: z26.string().optional(),
   sound: z26.string().optional(),
-  avatarUrl: z26.string().optional()
+  avatarUrl: z26.string().optional(),
+  customSkills: z26.array(zeroAgentCustomSkillNameSchema).optional()
 });
 var zeroAgentMetadataRequestSchema = z26.object({
   displayName: z26.string().optional(),
@@ -16760,7 +16704,6 @@ var zeroAgentInstructionsContract = c17.router({
     summary: "Update zero agent instructions"
   }
 });
-var zeroAgentCustomSkillNameSchema = z26.string().min(2).max(64).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/);
 var zeroAgentCustomSkillSchema = z26.object({
   name: zeroAgentCustomSkillNameSchema,
   displayName: z26.string().max(256).nullable(),
@@ -16865,6 +16808,83 @@ var zeroAgentSkillsDetailContract = c17.router({
     summary: "Delete custom skill"
   }
 });
+var firewallAccessRequestStatusSchema = z26.enum([
+  "pending",
+  "approved",
+  "rejected"
+]);
+var firewallAccessRequestResponseSchema = z26.object({
+  id: z26.string().uuid(),
+  agentId: z26.string().uuid(),
+  firewallRef: z26.string(),
+  permission: z26.string(),
+  method: z26.string().nullable(),
+  path: z26.string().nullable(),
+  reason: z26.string().nullable(),
+  status: firewallAccessRequestStatusSchema,
+  requesterUserId: z26.string(),
+  resolvedBy: z26.string().nullable(),
+  resolvedAt: z26.string().nullable(),
+  createdAt: z26.string()
+});
+var createFirewallAccessRequestSchema = z26.object({
+  agentId: z26.string().uuid(),
+  firewallRef: z26.string(),
+  permission: z26.string(),
+  method: z26.string().optional(),
+  path: z26.string().optional(),
+  reason: z26.string().optional()
+});
+var resolveFirewallAccessRequestSchema = z26.object({
+  requestId: z26.string().uuid(),
+  action: z26.enum(["approve", "reject"])
+});
+var firewallAccessRequestsCreateContract = c17.router({
+  create: {
+    method: "POST",
+    path: "/api/zero/firewall-access-requests",
+    headers: authHeadersSchema,
+    body: createFirewallAccessRequestSchema,
+    responses: {
+      201: firewallAccessRequestResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Create firewall access request"
+  }
+});
+var firewallAccessRequestsListContract = c17.router({
+  list: {
+    method: "GET",
+    path: "/api/zero/firewall-access-requests",
+    headers: authHeadersSchema,
+    responses: {
+      200: z26.array(firewallAccessRequestResponseSchema),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema
+    },
+    summary: "List firewall access requests for an agent"
+  }
+});
+var firewallAccessRequestsResolveContract = c17.router({
+  resolve: {
+    method: "PUT",
+    path: "/api/zero/firewall-access-requests",
+    headers: authHeadersSchema,
+    body: resolveFirewallAccessRequestSchema,
+    responses: {
+      200: firewallAccessRequestResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Resolve (approve/reject) a firewall access request (admin only)"
+  }
+});
 
 // ../../packages/core/src/contracts/user-connectors.ts
 import { z as z27 } from "zod";
@@ -17473,6 +17493,61 @@ var zeroRunAgentEventsContract = c25.router({
     summary: "Get agent events with pagination (zero proxy)"
   }
 });
+var runContextVolumeSchema = z31.object({
+  name: z31.string(),
+  mountPath: z31.string(),
+  vasStorageName: z31.string(),
+  vasVersionId: z31.string()
+});
+var runContextArtifactSchema = z31.object({
+  mountPath: z31.string(),
+  vasStorageName: z31.string(),
+  vasVersionId: z31.string()
+});
+var runContextFirewallSchema = z31.object({
+  name: z31.string(),
+  ref: z31.string(),
+  apis: z31.array(
+    z31.object({
+      base: z31.string(),
+      permissions: z31.array(
+        z31.object({
+          name: z31.string(),
+          description: z31.string().optional(),
+          rules: z31.array(z31.string())
+        })
+      ).optional()
+    })
+  )
+});
+var runContextResponseSchema = z31.object({
+  prompt: z31.string(),
+  appendSystemPrompt: z31.string().nullable(),
+  secretNames: z31.array(z31.string()),
+  vars: z31.record(z31.string(), z31.string()).nullable(),
+  environment: z31.record(z31.string(), z31.string()),
+  firewalls: z31.array(runContextFirewallSchema),
+  volumes: z31.array(runContextVolumeSchema),
+  artifact: runContextArtifactSchema.nullable(),
+  memory: runContextArtifactSchema.nullable()
+});
+var zeroRunContextContract = c25.router({
+  getContext: {
+    method: "GET",
+    path: "/api/zero/runs/:id/context",
+    headers: authHeadersSchema,
+    pathParams: z31.object({
+      id: z31.string().min(1, "Run ID is required")
+    }),
+    responses: {
+      200: runContextResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get run execution context snapshot for debugging"
+  }
+});
 
 // ../../packages/core/src/contracts/zero-schedules.ts
 import { z as z32 } from "zod";
@@ -18621,6 +18696,17 @@ var FEATURE_SWITCHES = {
   ["creditAddOn" /* CreditAddOn */]: {
     maintainer: "ethan@vm0.ai",
     enabled: false
+  },
+  ["modelDetail" /* ModelDetail */]: {
+    maintainer: "ethan@vm0.ai",
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
+  },
+  ["runContext" /* RunContext */]: {
+    maintainer: "ethan@vm0.ai",
+    enabled: false,
+    enabledUserHashes: STAFF_USER_HASHES,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
   }
 };
 async function isFeatureEnabled(key, ctx) {
@@ -19529,11 +19615,49 @@ async function updateZeroAgentInstructions(id, content) {
   handleError(result, `Failed to update instructions for zero agent "${id}"`);
 }
 
-// src/lib/api/domains/integrations-slack.ts
+// src/lib/api/domains/zero-agent-skills.ts
 import { initClient as initClient16 } from "@ts-rest/core";
+async function listAgentSkills(agentId) {
+  const config = await getClientConfig();
+  const client = initClient16(zeroAgentSkillsCollectionContract, config);
+  const result = await client.list({ params: { id: agentId } });
+  if (result.status === 200) return result.body;
+  handleError(result, `Failed to list skills for agent "${agentId}"`);
+}
+async function createAgentSkill(agentId, body) {
+  const config = await getClientConfig();
+  const client = initClient16(zeroAgentSkillsCollectionContract, config);
+  const result = await client.create({ params: { id: agentId }, body });
+  if (result.status === 201) return result.body;
+  handleError(result, `Failed to create skill "${body.name}"`);
+}
+async function getAgentSkill(agentId, name) {
+  const config = await getClientConfig();
+  const client = initClient16(zeroAgentSkillsDetailContract, config);
+  const result = await client.get({ params: { id: agentId, name } });
+  if (result.status === 200) return result.body;
+  handleError(result, `Skill "${name}" not found`);
+}
+async function updateAgentSkill(agentId, name, body) {
+  const config = await getClientConfig();
+  const client = initClient16(zeroAgentSkillsDetailContract, config);
+  const result = await client.update({ params: { id: agentId, name }, body });
+  if (result.status === 200) return result.body;
+  handleError(result, `Failed to update skill "${name}"`);
+}
+async function deleteAgentSkill(agentId, name) {
+  const config = await getClientConfig();
+  const client = initClient16(zeroAgentSkillsDetailContract, config);
+  const result = await client.delete({ params: { id: agentId, name } });
+  if (result.status === 204) return;
+  handleError(result, `Skill "${name}" not found`);
+}
+
+// src/lib/api/domains/integrations-slack.ts
+import { initClient as initClient17 } from "@ts-rest/core";
 async function sendSlackMessage(body) {
   const config = await getClientConfig();
-  const client = initClient16(integrationsSlackMessageContract, config);
+  const client = initClient17(integrationsSlackMessageContract, config);
   const result = await client.sendMessage({ body, headers: {} });
   if (result.status === 200) {
     return result.body;
@@ -19542,10 +19666,10 @@ async function sendSlackMessage(body) {
 }
 
 // src/lib/api/domains/zero-schedules.ts
-import { initClient as initClient17 } from "@ts-rest/core";
+import { initClient as initClient18 } from "@ts-rest/core";
 async function deployZeroSchedule(body) {
   const config = await getClientConfig();
-  const client = initClient17(zeroSchedulesMainContract, config);
+  const client = initClient18(zeroSchedulesMainContract, config);
   const result = await client.deploy({ body });
   if (result.status === 200 || result.status === 201) {
     return result.body;
@@ -19554,7 +19678,7 @@ async function deployZeroSchedule(body) {
 }
 async function listZeroSchedules() {
   const config = await getClientConfig();
-  const client = initClient17(zeroSchedulesMainContract, config);
+  const client = initClient18(zeroSchedulesMainContract, config);
   const result = await client.list({ headers: {} });
   if (result.status === 200) {
     return result.body;
@@ -19563,7 +19687,7 @@ async function listZeroSchedules() {
 }
 async function deleteZeroSchedule(params) {
   const config = await getClientConfig();
-  const client = initClient17(zeroSchedulesByNameContract, config);
+  const client = initClient18(zeroSchedulesByNameContract, config);
   const result = await client.delete({
     params: { name: params.name },
     query: { agentId: params.agentId }
@@ -19575,7 +19699,7 @@ async function deleteZeroSchedule(params) {
 }
 async function enableZeroSchedule(params) {
   const config = await getClientConfig();
-  const client = initClient17(zeroSchedulesEnableContract, config);
+  const client = initClient18(zeroSchedulesEnableContract, config);
   const result = await client.enable({
     params: { name: params.name },
     body: { agentId: params.agentId }
@@ -19587,7 +19711,7 @@ async function enableZeroSchedule(params) {
 }
 async function disableZeroSchedule(params) {
   const config = await getClientConfig();
-  const client = initClient17(zeroSchedulesEnableContract, config);
+  const client = initClient18(zeroSchedulesEnableContract, config);
   const result = await client.disable({
     params: { name: params.name },
     body: { agentId: params.agentId }
@@ -19627,24 +19751,24 @@ async function resolveZeroScheduleByAgent(agentIdentifier, scheduleName) {
 }
 
 // src/lib/api/domains/zero-runs.ts
-import { initClient as initClient18 } from "@ts-rest/core";
+import { initClient as initClient19 } from "@ts-rest/core";
 async function createZeroRun(body) {
   const config = await getClientConfig();
-  const client = initClient18(zeroRunsMainContract, config);
+  const client = initClient19(zeroRunsMainContract, config);
   const result = await client.create({ body });
   if (result.status === 201) return result.body;
   handleError(result, "Failed to create zero run");
 }
 async function getZeroRun(id) {
   const config = await getClientConfig();
-  const client = initClient18(zeroRunsByIdContract, config);
+  const client = initClient19(zeroRunsByIdContract, config);
   const result = await client.getById({ params: { id } });
   if (result.status === 200) return result.body;
   handleError(result, `Failed to get zero run "${id}"`);
 }
 async function getZeroRunAgentEvents(id, options) {
   const config = await getClientConfig();
-  const client = initClient18(zeroRunAgentEventsContract, config);
+  const client = initClient19(zeroRunAgentEventsContract, config);
   const result = await client.getAgentEvents({
     params: { id },
     query: {
@@ -19658,17 +19782,17 @@ async function getZeroRunAgentEvents(id, options) {
 }
 
 // src/lib/api/domains/zero-ask-user.ts
-import { initClient as initClient19 } from "@ts-rest/core";
+import { initClient as initClient20 } from "@ts-rest/core";
 async function postAskUserQuestion(body) {
   const config = await getClientConfig();
-  const client = initClient19(zeroAskUserQuestionContract, config);
+  const client = initClient20(zeroAskUserQuestionContract, config);
   const result = await client.postQuestion({ body, headers: {} });
   if (result.status === 200) return result.body;
   handleError(result, "Failed to post question");
 }
 async function getAskUserAnswer(pendingId) {
   const config = await getClientConfig();
-  const client = initClient19(zeroAskUserAnswerContract, config);
+  const client = initClient20(zeroAskUserAnswerContract, config);
   const result = await client.getAnswer({
     query: { pendingId },
     headers: {}
@@ -20559,6 +20683,9 @@ export {
   parseGitHubTreeUrl,
   parseGitHubUrl,
   resolveSkillRef,
+  isFirewallConnectorType,
+  getConnectorFirewall,
+  findMatchingPermissions,
   getInstructionsStorageName,
   getSkillStorageName,
   getInstructionsFilename,
@@ -20620,6 +20747,11 @@ export {
   getZeroAgentUserConnectors,
   setZeroAgentUserConnectors,
   updateZeroAgentInstructions,
+  listAgentSkills,
+  createAgentSkill,
+  getAgentSkill,
+  updateAgentSkill,
+  deleteAgentSkill,
   listZeroConnectors,
   getZeroConnector,
   deleteZeroConnector,
@@ -20664,4 +20796,4 @@ export {
   pollEvents,
   showNextSteps
 };
-//# sourceMappingURL=chunk-NM4FYPVK.js.map
+//# sourceMappingURL=chunk-KEYG4DHY.js.map