@zeroxyz/cli 0.0.29 → 0.0.32

package/dist/index.js

@@ -6,7 +6,7 @@ import { Command as Command12 } from "commander";
 // package.json
 var package_default = {
   name: "@zeroxyz/cli",
-  version: "0.0.29",
+  version: "0.0.32",
   type: "module",
   bin: {
     zero: "dist/index.js",
@@ -119,10 +119,14 @@ var capabilityResponseSchema = z.object({
     state: z.enum(["unrated", "rated"]).optional()
   }),
   priceObserved: z.object({
-    medianCents: z.string(),
-    p95Cents: z.string(),
+    minCents: z.string().nullable(),
+    medianCents: z.string().nullable(),
+    maxCents: z.string().nullable(),
+    // Deprecated alias for maxCents; kept for backward compat.
+    p95Cents: z.string().nullable(),
     sampleCount: z.number(),
-    varies: z.boolean()
+    varies: z.boolean(),
+    failureChargeRate: z.number().nullable()
   }).nullable().optional(),
   paymentMethods: z.array(
     z.object({
@@ -149,7 +153,31 @@ var createRunResponseSchema = z.object({
 });
 var createReviewResponseSchema = z.object({
   reviewId: z.string(),
-  recorded: z.boolean()
+  recorded: z.boolean(),
+  updated: z.boolean().optional()
+});
+var batchReviewResponseSchema = z.object({
+  results: z.array(
+    z.union([
+      z.object({
+        runId: z.string(),
+        ok: z.literal(true),
+        reviewId: z.string(),
+        updated: z.boolean()
+      }),
+      z.object({
+        runId: z.string(),
+        ok: z.literal(false),
+        status: z.number(),
+        error: z.string()
+      })
+    ])
+  ),
+  summary: z.object({
+    total: z.number(),
+    ok: z.number(),
+    failed: z.number()
+  })
 });
 var BUG_REPORT_CATEGORIES = [
   "search_relevance",
@@ -275,6 +303,10 @@ var ApiService = class {
     const json = await this.request("POST", "/v1/reviews", data);
     return createReviewResponseSchema.parse(json);
   };
+  createReviewsBatch = async (reviews) => {
+    const json = await this.request("POST", "/v1/reviews/batch", { reviews });
+    return batchReviewResponseSchema.parse(json);
+  };
   createBugReport = async (data) => {
     const json = await this.request("POST", "/v1/bug-reports", data);
     return createBugReportResponseSchema.parse(json);
@@ -582,6 +614,8 @@ var configCommand = (_appContext) => new Command2("config").description("View or
 });
 
 // src/commands/fetch-command.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { resolve as resolvePath } from "path";
 import { Command as Command3 } from "commander";
 import { formatUnits as formatUnits2 } from "viem";
 
@@ -595,7 +629,7 @@ import {
 } from "@relayprotocol/relay-sdk";
 import { x402Client as X402Client } from "@x402/core/client";
 import { decodePaymentResponseHeader, x402HTTPClient } from "@x402/core/http";
-import { ExactEvmScheme } from "@x402/evm/exact/client";
+import { registerExactEvmScheme } from "@x402/evm/exact/client";
 import { createSIWxClientHook } from "@x402/extensions/sign-in-with-x";
 import { wrapFetchWithPayment } from "@x402/fetch";
 import { Challenge, Receipt } from "mppx";
@@ -626,7 +660,9 @@ var PATHUSD_TEMPO = "0x20c0000000000000000000000000000000000000";
 var BASE_CHAIN_ID = 8453;
 var TEMPO_CHAIN_ID = 4217;
 var TEMPO_TESTNET_CHAIN_ID = 42431;
-var DEFAULT_MAX_DEPOSIT = "100";
+var DEFAULT_PREFUND_NO_COST_INFO = "1";
+var ADAPTIVE_PREFUND_MULTIPLIER = 10;
+var ADAPTIVE_PREFUND_CEILING = "100";
 var KNOWN_EIP712_DOMAINS = {
   // USDC on Base
   [USDC_BASE.toLowerCase()]: { name: "USDC", version: "2" },
@@ -643,6 +679,16 @@ var calculateBuffer = (baseBalance) => {
   const twoDollars = 2000000n;
   return twentyFivePercent < twoDollars ? twentyFivePercent : twoDollars;
 };
+var resolveDefaultPrefund = (displayCostAmount) => {
+  const floor = Number.parseFloat(DEFAULT_PREFUND_NO_COST_INFO);
+  const ceiling = Number.parseFloat(ADAPTIVE_PREFUND_CEILING);
+  if (!displayCostAmount) return DEFAULT_PREFUND_NO_COST_INFO;
+  const cost = Number.parseFloat(displayCostAmount);
+  if (!Number.isFinite(cost) || cost <= 0) return DEFAULT_PREFUND_NO_COST_INFO;
+  const scaled = cost * ADAPTIVE_PREFUND_MULTIPLIER;
+  const bounded = scaled < floor ? floor : scaled > ceiling ? ceiling : scaled;
+  return bounded.toFixed(6).replace(/\.?0+$/, "");
+};
 var tempoChain = {
   id: TEMPO_CHAIN_ID,
   name: "Tempo",
@@ -723,7 +769,7 @@ var PaymentService = class {
     const bridgeAmount = requiredAmount + buffer;
     if (baseBalance < bridgeAmount) {
       throw new Error(
-        `Insufficient Base USDC to bridge: have ${formatUnits(baseBalance, 6)}, need ${formatUnits(bridgeAmount, 6)} (${formatUnits(requiredAmount, 6)} + ${formatUnits(buffer, 6)} buffer)`
+        `Insufficient Base USDC to bridge: have ${formatUnits(baseBalance, 6)}, need ${formatUnits(bridgeAmount, 6)} (${formatUnits(requiredAmount, 6)} + ${formatUnits(buffer, 6)} buffer). This gateway uses an MPP payment channel, which is pre-funded up front. Either fund your wallet on Base, or pass \`--max-pay <amount>\` to use a smaller channel (e.g. \`--max-pay 0.05\` for a ~5-cent channel sized for a single cheap call).`
       );
     }
     onProgress?.(
@@ -759,7 +805,7 @@ var PaymentService = class {
     });
     return bridgeTxHash;
   };
-  handlePayment = async (url, request, paymentRequirement, maxPay, onProgress) => {
+  handlePayment = async (url, request, paymentRequirement, maxPay, onProgress, displayCostAmount) => {
     if (!this.account) {
       throw new Error(
         "No wallet configured \u2014 run `zero init` or set ZERO_PRIVATE_KEY"
@@ -776,7 +822,8 @@ var PaymentService = class {
         request,
         paymentRequirement.raw,
         maxPay,
-        onProgress
+        onProgress,
+        displayCostAmount
       );
     }
     throw new Error("Unrecognized 402 payment protocol");
@@ -784,10 +831,9 @@ var PaymentService = class {
   payX402 = async (url, request, _raw, maxPay) => {
     if (!this.account) throw new Error("No wallet configured");
     let capturedAmount = "0";
-    const client = new X402Client().register(
-      "eip155:*",
-      new ExactEvmScheme(this.account)
-    );
+    const client = registerExactEvmScheme(new X402Client(), {
+      signer: this.account
+    });
     client.onBeforePaymentCreation(async (context) => {
       const selected = context.selectedRequirements;
       if (selected && (!selected.extra?.name || !selected.extra?.version)) {
@@ -798,7 +844,9 @@ var PaymentService = class {
       }
       const requirement = context.paymentRequired.accepts[0];
       if (!requirement) return;
-      capturedAmount = formatUnits(BigInt(requirement.amount), 6);
+      const rawAmount = requirement.amount ?? requirement.maxAmountRequired;
+      if (!rawAmount) return;
+      capturedAmount = formatUnits(BigInt(rawAmount), 6);
       if (maxPay && Number.parseFloat(capturedAmount) > Number.parseFloat(maxPay)) {
         return {
           abort: true,
@@ -840,15 +888,14 @@ var PaymentService = class {
    * BEFORE mppx signs a credential — so balance/bridge logic runs in-band
    * without adding a pre-probe round-trip.
    */
-  prepareTempoFunds = async (challenge, maxPay, onProgress) => {
+  prepareTempoFunds = async (challenge, maxPay, onProgress, displayCostAmount) => {
     const challengeRequest = challenge.request;
     let requiredRaw;
     if (challenge.intent === "session") {
       const suggestedDeposit = challengeRequest.suggestedDeposit;
+      const defaultPrefund = resolveDefaultPrefund(displayCostAmount);
       requiredRaw = suggestedDeposit ? BigInt(suggestedDeposit) : BigInt(
-        Math.floor(
-          Number.parseFloat(maxPay ?? DEFAULT_MAX_DEPOSIT) * 1e6
-        )
+        Math.floor(Number.parseFloat(maxPay ?? defaultPrefund) * 1e6)
       );
     } else {
       requiredRaw = BigInt(challengeRequest.amount);
@@ -889,7 +936,7 @@ var PaymentService = class {
    * the extra state and return `410 "channel not found"` on the close.
    * This mirrors the working production v0.0.21 single-fetch flow.
    */
-  payMpp = async (url, request, _raw, maxPay, onProgress) => {
+  payMpp = async (url, request, _raw, maxPay, onProgress, displayCostAmount) => {
     const account = this.account;
     if (!account) throw new Error("No wallet configured");
     let capturedAmount = "0";
@@ -901,7 +948,7 @@ var PaymentService = class {
       methods: [
         tempo({
           account,
-          maxDeposit: maxPay ?? DEFAULT_MAX_DEPOSIT,
+          maxDeposit: maxPay ?? resolveDefaultPrefund(displayCostAmount),
           onChannelUpdate: (entry) => {
             channelEntry = {
               channelId: entry.channelId,
@@ -917,7 +964,8 @@ var PaymentService = class {
         capturedAmount = await this.prepareTempoFunds(
           challenge,
           maxPay,
-          onProgress
+          onProgress,
+          displayCostAmount
         );
         return void 0;
       }
@@ -1167,6 +1215,40 @@ var isTextContentType = (contentType) => {
   if (ct === "application/x-www-form-urlencoded") return true;
   return false;
 };
+var isJsonContentType = (contentType) => {
+  if (!contentType) return false;
+  const ct = contentType.toLowerCase().split(";")[0]?.trim() ?? "";
+  return ct === "application/json" || ct.endsWith("+json");
+};
+var MAX_REQUEST_BODY_BYTES = 10 * 1024 * 1024;
+var resolveRequestBody = (rawData, readStdin) => {
+  const fromFile = (spec) => {
+    if (spec === "@-") return readFileSync3(0);
+    return readFileSync3(resolvePath(spec.slice(1)));
+  };
+  if (readStdin && rawData !== void 0) {
+    throw new Error(
+      "Conflicting body sources: use either --data-stdin or -d, not both."
+    );
+  }
+  let body;
+  if (readStdin) {
+    body = readFileSync3(0);
+  } else if (rawData?.startsWith("@")) {
+    body = fromFile(rawData);
+  } else {
+    body = rawData;
+  }
+  if (body !== void 0) {
+    const bytes = Buffer.isBuffer(body) ? body.length : Buffer.byteLength(body, "utf8");
+    if (bytes > MAX_REQUEST_BODY_BYTES) {
+      throw new Error(
+        `Request body is ${bytes} bytes \u2014 exceeds the ${MAX_REQUEST_BODY_BYTES} byte limit. Split the payload, compress it, or contact the capability owner about raising the cap.`
+      );
+    }
+  }
+  return body;
+};
 var looksLikeX402V1Body = (body) => {
   if (!body || typeof body !== "object") return false;
   const b = body;
@@ -1201,15 +1283,26 @@ var detectPaymentRequirement = async (response) => {
   }
   return { protocol: "unknown", raw: {} };
 };
-var fetchCommand = (appContext) => new Command3("fetch").description("Fetch a capability URL with automatic payment handling").argument("<url>", "URL to fetch").option(
+var fetchCommand = (appContext) => new Command3("fetch").description(
+  "Fetch a capability URL, handling 402 challenges automatically"
+).argument("<url>", "URL to fetch").option(
   "-X, --method <method>",
   "HTTP method (GET, POST, PUT, PATCH, DELETE). Defaults to POST when -d is set, otherwise GET"
-).option("-d, --data <body>", "Request body (JSON string)").option("-H, --header <header...>", "Headers in Key:Value format").option("--max-pay <amount>", "Maximum amount willing to pay (USDC)").option(
+).option(
+  "-d, --data <body>",
+  "Request body. Pass a literal JSON string, or `@path/to/file` to read from a file, or `@-` to read from stdin."
+).option(
+  "--data-stdin",
+  "Read the request body from stdin (equivalent to `-d @-`)."
+).option("-H, --header <header...>", "Headers in Key:Value format").option("--max-pay <amount>", "Maximum per-call spend limit (USDC)").option(
   "--capability <id>",
   "Bind this fetch to a capability (uid or slug) so a reviewable run is recorded even without a prior `zero search`"
 ).option(
   "--json",
-  "Emit {runId, status, latencyMs, payment, body} as JSON on stdout (for batch/non-TTY use)"
+  "Emit {runId, ok, status, latencyMs, payment, body, bodyRaw} as JSON on stdout (for batch/non-TTY use)"
+).option(
+  "--raw-body",
+  "With --json: keep `body` as the raw response string instead of parsing JSON. `bodyRaw` still reflects the raw text."
 ).option(
   "--agent <name>",
   "Identify your agent host for this invocation (e.g. claude-web, codex). Overrides auto-detect for this call only."
@@ -1224,6 +1317,19 @@ var fetchCommand = (appContext) => new Command3("fetch").description("Fetch a ca
         walletService
       } = appContext.services;
       const startTime = Date.now();
+      let resolvedBody;
+      try {
+        resolvedBody = resolveRequestBody(
+          options.data,
+          options.dataStdin ?? false
+        );
+      } catch (err) {
+        console.error(
+          err instanceof Error ? err.message : "Failed to read request body"
+        );
+        process.exitCode = 1;
+        return;
+      }
       const headers = {};
       if (options.header) {
         for (const h of options.header) {
@@ -1236,15 +1342,15 @@ var fetchCommand = (appContext) => new Command3("fetch").description("Fetch a ca
       const hasContentType = Object.keys(headers).some(
         (k) => k.toLowerCase() === "content-type"
       );
-      if (options.data && !hasContentType) {
-        headers["content-type"] = "application/json";
+      if (resolvedBody && !hasContentType) {
+        headers["content-type"] = Buffer.isBuffer(resolvedBody) ? "application/octet-stream" : "application/json";
       }
       const log = (msg) => console.error(`  ${msg}`);
-      const method = options.method ? options.method.toUpperCase() : options.data ? "POST" : "GET";
+      const method = options.method ? options.method.toUpperCase() : resolvedBody ? "POST" : "GET";
       const requestInit = {
         method,
         headers,
-        body: options.data
+        body: resolvedBody
       };
       const lastSearch = stateService.loadLastSearch();
       const matchedCapability = lastSearch?.capabilities.find(
@@ -1283,7 +1389,8 @@ var fetchCommand = (appContext) => new Command3("fetch").description("Fetch a ca
             requestInit,
             paymentReq,
             options.maxPay,
-            log
+            log,
+            matchedCapability?.displayCostAmount
           );
           finalResponse = result.response;
           paymentMeta = {
@@ -1384,8 +1491,8 @@ var fetchCommand = (appContext) => new Command3("fetch").description("Fetch a ca
       if (capabilityId && apiService.walletAddress) {
         let requestSchema;
         let responseSchema;
-        if (options.data) {
-          const parsedReq = tryParseJson(options.data);
+        if (typeof resolvedBody === "string") {
+          const parsedReq = tryParseJson(resolvedBody);
           if (parsedReq !== null && typeof parsedReq === "object") {
             requestSchema = inferSchema(parsedReq);
           }
@@ -1440,14 +1547,30 @@ var fetchCommand = (appContext) => new Command3("fetch").description("Fetch a ca
         console.error(`  Fetch failed: ${fetchError.message}`);
       }
       if (options.json) {
-        const jsonBody = !finalResponse ? null : bodyIsBinary ? (bodyBytes ?? Buffer.alloc(0)).toString("base64") : body;
+        const responseStatus = finalResponse?.status ?? null;
+        const ok = responseStatus !== null && responseStatus >= 200 && responseStatus < 300;
+        const responseCt = finalResponse?.headers.get("content-type") ?? null;
+        const bodyString = bodyIsBinary ? (bodyBytes ?? Buffer.alloc(0)).toString("base64") : body;
+        let parsedBody = null;
+        if (finalResponse && !bodyIsBinary && !options.rawBody) {
+          if (isJsonContentType(responseCt)) {
+            const parsed = tryParseJson(body);
+            parsedBody = parsed === null ? body : parsed;
+          } else {
+            parsedBody = body;
+          }
+        } else if (finalResponse) {
+          parsedBody = bodyString;
+        }
         console.log(
           JSON.stringify({
             runId,
-            status: finalResponse?.status ?? null,
+            ok,
+            status: responseStatus,
             latencyMs,
             payment: paymentMeta ?? null,
-            body: jsonBody,
+            body: parsedBody,
+            bodyRaw: finalResponse ? bodyString : null,
             ...bodyIsBinary && { bodyEncoding: "base64" },
             ...fetchError && { error: fetchError.message },
             ...skipReasons.length > 0 && {
@@ -1508,6 +1631,30 @@ var formatTrustComponent = (label, value) => {
   const display = value != null ? `${value}/100` : "--";
   return `    ${label.padEnd(22)}${display}`;
 };
+var centsToDollars = (cents) => {
+  const value = Number.parseFloat(cents) / 100;
+  if (value < 0.01) return value.toFixed(4);
+  if (value < 1) return value.toFixed(3);
+  return value.toFixed(2);
+};
+var formatCost = (capability) => {
+  const lines = [];
+  const observed = capability.priceObserved;
+  if (observed && observed.sampleCount > 0 && observed.varies && observed.minCents && observed.maxCents) {
+    const min = centsToDollars(observed.minCents);
+    const max = centsToDollars(observed.maxCents);
+    const median = observed.medianCents ? centsToDollars(observed.medianCents) : null;
+    const detail = median ? `median $${median}, n=${observed.sampleCount}` : `n=${observed.sampleCount}`;
+    lines.push(`  Cost: $${min}\u2013$${max}/call (${detail})`);
+  } else {
+    lines.push(`  Cost: $${capability.displayCostAmount}/call`);
+  }
+  if (observed?.failureChargeRate != null && observed.failureChargeRate > 0) {
+    const pct = Math.round(observed.failureChargeRate * 100);
+    lines.push(`  \u26A0  ~${pct}% of failed runs still charged the wallet`);
+  }
+  return lines;
+};
 var formatRating = (rating) => {
   if (rating.state === "unrated") return "unrated";
   const successPct = `${Math.round(Number.parseFloat(rating.successRate) * 100)}%`;
@@ -1517,6 +1664,81 @@ var formatRating = (rating) => {
   }
   return `${successPct} success, ${reviews} reviews`;
 };
+var asNode = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : null;
+var placeholderFor = (fieldName, propSchema) => {
+  const node = asNode(propSchema);
+  const example = node?.example ?? node?.default;
+  if (typeof example === "string") return example;
+  if (typeof example === "number" || typeof example === "boolean") {
+    return String(example);
+  }
+  return `<${fieldName.toUpperCase()}>`;
+};
+var extractInputEnvelope = (bodySchema, method) => {
+  if (!bodySchema) return {};
+  const props = asNode(bodySchema.properties);
+  if (!props) return {};
+  const inputProps = asNode(asNode(props.input)?.properties);
+  if (inputProps) {
+    return {
+      queryParams: asNode(asNode(inputProps.queryParams)?.properties) ?? void 0,
+      body: asNode(asNode(inputProps.body)?.properties) ?? void 0
+    };
+  }
+  const upperMethod = method.toUpperCase();
+  const isGetLike = upperMethod === "GET" || upperMethod === "DELETE";
+  return isGetLike ? { queryParams: props } : { body: props };
+};
+var buildTryItExample = (capability) => {
+  const method = capability.method.toUpperCase();
+  const lines = ["", "Try it:"];
+  const { queryParams, body } = extractInputEnvelope(
+    capability.bodySchema,
+    capability.method
+  );
+  const callerHeaders = Object.entries(capability.headers ?? {});
+  const headerFlags = callerHeaders.map(
+    ([k, v]) => `-H "${k}: ${v}"  # [caller-provided]`
+  );
+  if (method === "GET" || queryParams && !body) {
+    const qs = queryParams ? Object.entries(queryParams).map(
+      ([k, schema]) => `${encodeURIComponent(k)}=${encodeURIComponent(placeholderFor(k, schema))}`
+    ).join("&") : "";
+    const url = qs ? `${capability.url}?${qs}` : capability.url;
+    const urlLine = `  zero fetch "${url}"`;
+    if (headerFlags.length === 0) {
+      lines.push(urlLine);
+    } else {
+      lines.push(`  zero fetch \\`);
+      for (const h of headerFlags) lines.push(`    ${h} \\`);
+      lines.push(`    "${url}"`);
+    }
+    if (!queryParams && method === "GET") {
+      lines.push(
+        "  # bodySchema did not expose queryParams \u2014 call the URL as-is or inspect the raw schema above."
+      );
+    }
+    return lines;
+  }
+  const samplePayload = body ? Object.fromEntries(
+    Object.entries(body).map(([k, schema]) => [
+      k,
+      placeholderFor(k, schema)
+    ])
+  ) : null;
+  const bodyJson = samplePayload ? JSON.stringify(samplePayload) : "<BODY_JSON>";
+  lines.push(`  zero fetch \\`);
+  if (method !== "POST") lines.push(`    -X ${method} \\`);
+  for (const h of headerFlags) lines.push(`    ${h} \\`);
+  lines.push(`    -d '${bodyJson}' \\`);
+  lines.push(`    ${capability.url}`);
+  if (!body) {
+    lines.push(
+      "  # bodySchema did not expose input.body \u2014 replace <BODY_JSON> with the exact shape shown above."
+    );
+  }
+  return lines;
+};
 var formatCapability = (capability) => {
   const lines = [];
   lines.push(capability.name);
@@ -1543,9 +1765,10 @@ var formatCapability = (capability) => {
   }
   lines.push(`  Rating: ${formatRating(capability.rating)}`);
   lines.push(`  Status: ${capability.availabilityStatus ?? "unknown"}`);
-  lines.push(`  Cost: $${capability.displayCostAmount}/call`);
+  lines.push(...formatCost(capability));
   lines.push(`  URL: ${capability.url}`);
   lines.push(`  Method: ${capability.method}`);
+  lines.push(...buildTryItExample(capability));
   return lines.join("\n");
 };
 var getCommand = (appContext) => new Command4("get").description(
@@ -1609,21 +1832,153 @@ var getCommand = (appContext) => new Command4("get").description(
 // src/commands/init-command.ts
 import { createHash as createHash3 } from "crypto";
 import {
-  chmodSync,
+  chmodSync as chmodSync2,
   cpSync,
   existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync3,
   readdirSync,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   rmSync,
   statSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname, join as join2, relative } from "path";
 import { fileURLToPath } from "url";
 import { Command as Command5 } from "commander";
 import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
+
+// src/util/install-banner.ts
+var ZEROMAN_ART = `
+                                                      :++-.
+                                   .:--==+===--:.     +@%@#+-
+                             .-+*%@@@@%%%%%%@@@@@%#*=.-# #%-=*=
+                          :+#@@@#+-:.        .-+#@@@@@%#. %#  =#:
+                       :+%@@#=:                  :+@%%@@%=+@:  .#=
+                     -*@@#=.                       :%%%%@@%%+    #=
+                   :#@@#-             .:-====--.    :%%%%%@@+     %:
+                  +@@#-          .-+#%@@@@@@@@@@%*-  *@%%%%%+     =#
+                .#@@=    ..   .-*%@@@@%%@%*+#%%%@@@#:=@%%%%@-      %.
+               .%@%:     :#=:+%@@@%@%%@@+:-+*%%%%%%@%#%%%%%%       %-
+               #@%:       .%%@@%%%%#%%*--+=%@@%%%%%%@@%%%%@-       %-
+              +@%:       :#* :%%%%@==+=*=  .%%%%%%%%%%%%%@*        %:
+             .%%+       :%@-  %#.%%@==@#    #@%%%%%%%%%%@#        -#
+     .:::::  -@%:      .%%%*   .-%%%+ ..   =%%%%%%%%%%%@#         #+.
+  .+=-::..-* -@%       +@%%@*=-+%%%@@#-..-*@%%%%%%%%%@@+         -@%%%#+:
+  %-   .:::*=*%%       #%%%%@@@@@@@%%%@@@@@%%%%%%%%%@%-         :%%%%@@@@#-
+ ++     ..*- %@@-      *@%%%%%%#-.     .-#@%%%%%%%@%+.         :@@@@@@%%%@@-
+:#    .:--*:-%%%%.     .%@%%%%%=:----:   :#%%%%@@%+.          -#-:.:-#@@@%@%
+.#        *#+=@%@%-     .#@@@@@%@@@@@@%*-.=%@@@%+.           +*      +%%%%%%=
+ =*   .====-*:#%%@@#=.    .=*#%@%%%%%%%@@@@@%*-            -#=     -*:..   .:*:
+  -*-.     :%*##:-#@@@%#*+==+*#%%%@@@@@@%#+-             :*+.    .-*+:.    .:#-
+   .*+=--+#@@@@@%: .-+#%@@@@@@@@@@%%#+=:.              -*+.     =+:          -*
+      ..:+*###*+=**.     .:::::::.                  .-+=.      =#  -          #:
+                  :*+.                           .=*%%:        .+==*-         #.
+                  -#@@#=:.                  .:=*#%@@%%%=         %-   .-  .+-*=
+                 *@@%%@@@#+==-:::...:::--==+=-=#@@%%%%%@*        .+=-=++-==-:.
+                =@%%%%%%-  .::---====---:.      :#@%%%%%@*
+                =@%%%%%%.                         *@%%%%%@+
+                 #%%%%%@%.                         #@%%%%%@:
+            .-=++*%%%%%%@*                         :%%%%%%%#---:.
+          .*%@@@@@%%%%%%%@:                         %%%%%%%@@@@@%*:
+          %@@@@@@@@@@@@@%%.                        .%@@@@@@@@@@@@@@:
+          -==++++====--:.                           -==+++++++++++=.
+`;
+var ZERO_BANNER = [
+  "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557   \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ",
+  "\u255A\u2550\u2550\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 \u2588\u2588\u2554\u2550\u2588\u2588\u2588\u2588\u2557",
+  "  \u2588\u2588\u2588\u2554\u255D \u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2551",
+  " \u2588\u2588\u2588\u2554\u255D  \u2588\u2588\u2554\u2550\u2550\u255D  \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551",
+  "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551  \u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D",
+  "\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u2550\u2550\u255D "
+].join("\n");
+var colorsEnabled = () => {
+  if (process.env.NO_COLOR) return false;
+  if (process.env.FORCE_COLOR) return true;
+  return Boolean(process.stdout.isTTY);
+};
+var wrap = (code, text) => colorsEnabled() ? `\x1B[${code}m${text}\x1B[0m` : text;
+var color = {
+  bold: (s) => wrap("1", s),
+  dim: (s) => wrap("2", s),
+  cyan: (s) => wrap("36", s),
+  magenta: (s) => wrap("35", s),
+  green: (s) => wrap("32", s),
+  yellow: (s) => wrap("33", s),
+  gray: (s) => wrap("90", s),
+  boldCyan: (s) => wrap("1;36", s),
+  boldMagenta: (s) => wrap("1;35", s),
+  boldGreen: (s) => wrap("1;32", s)
+};
+var printZeroBanner = () => {
+  console.log("");
+  console.log(ZEROMAN_ART);
+  console.log(color.boldCyan(ZERO_BANNER));
+  console.log("");
+  console.log(`  ${color.dim("The search engine for AI agents.")}`);
+  console.log("");
+  console.log(color.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log("");
+};
+var supportsUnicode = () => {
+  if (process.platform !== "win32") return true;
+  return Boolean(
+    process.env.WT_SESSION || process.env.TERM_PROGRAM === "vscode"
+  );
+};
+var SYMBOLS = supportsUnicode() ? { check: "\u2713", arrow: "\u203A", warn: "!" } : { check: "OK", arrow: ">", warn: "!" };
+var stepSuccess = (label, detail) => {
+  const line = detail ? `  ${color.boldGreen(SYMBOLS.check)} ${label}  ${color.dim(detail)}` : `  ${color.boldGreen(SYMBOLS.check)} ${label}`;
+  console.log(line);
+};
+var stepWarn = (label, detail) => {
+  const line = detail ? `  ${color.yellow(SYMBOLS.warn)} ${label}  ${color.dim(detail)}` : `  ${color.yellow(SYMBOLS.warn)} ${label}`;
+  console.log(line);
+};
+var stepSkip = (label, detail) => {
+  const line = detail ? `  ${color.gray(SYMBOLS.arrow)} ${color.dim(`${label}  ${detail}`)}` : `  ${color.gray(SYMBOLS.arrow)} ${color.dim(label)}`;
+  console.log(line);
+};
+var stepInfo = (message) => {
+  console.log(`      ${color.gray("\xB7")} ${color.dim(message)}`);
+};
+var sectionDivider = () => {
+  console.log("");
+  console.log(color.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log("");
+};
+var printReadyFooter = () => {
+  const lines = [
+    "",
+    `  ${color.boldGreen("Zero is ready!")} Run ${color.cyan("`zero search`")} to find capabilities.`,
+    "",
+    `  ${color.dim("Try:")}`,
+    `    ${color.cyan('zero search "translate text to Spanish"')}`,
+    `    ${color.cyan('zero search "generate an image"')}`,
+    `    ${color.cyan('zero search "weather forecast"')}`,
+    "",
+    `  ${color.dim("By using Zero, you agree to our Terms of Service:")}`,
+    `    ${color.dim("https://zero.xyz/terms-of-service")}`,
+    `  ${color.dim("Run `zero terms` to view the full terms.")}`,
+    ""
+  ];
+  return lines.join("\n");
+};
+
+// src/util/secure-config.ts
+import { chmodSync, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+var SECURE_DIR_MODE = 448;
+var SECURE_FILE_MODE = 384;
+var ensureSecureDir = (path) => {
+  mkdirSync2(path, { recursive: true, mode: SECURE_DIR_MODE });
+  chmodSync(path, SECURE_DIR_MODE);
+};
+var writeSecureFile = (path, contents) => {
+  writeFileSync2(path, contents, { mode: SECURE_FILE_MODE });
+  chmodSync(path, SECURE_FILE_MODE);
+};
+
+// src/commands/init-command.ts
 var AGENT_TOOLS = [
   { name: "Claude Code", detectDir: ".claude", skillsDir: ".claude/skills" },
   { name: "Codex", detectDir: ".codex", skillsDir: ".agents/skills" },
@@ -1634,21 +1989,29 @@ var AGENT_TOOLS = [
   },
   { name: "Cursor", detectDir: ".cursor", skillsDir: ".cursor/skills" }
 ];
-var getPackageRoot = () => {
-  let dir;
-  if (import.meta.url) {
-    dir = dirname(fileURLToPath(import.meta.url));
-  } else {
-    dir = __dirname;
+var findResourceDir = (startDir, resourceName) => {
+  let current = startDir;
+  while (true) {
+    const candidate = join2(current, resourceName);
+    if (existsSync2(candidate)) {
+      return candidate;
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      throw new Error(
+        `Could not locate bundled '${resourceName}' directory from ${startDir}`
+      );
+    }
+    current = parent;
   }
-  while (!existsSync2(join2(dir, "package.json"))) {
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
+};
+var getCliModuleDir = () => {
+  if (import.meta.url) {
+    return dirname(fileURLToPath(import.meta.url));
   }
-  return dir;
+  return __dirname;
 };
-var sha256File = (filePath) => createHash3("sha256").update(readFileSync3(filePath)).digest("hex");
+var sha256File = (filePath) => createHash3("sha256").update(readFileSync4(filePath)).digest("hex");
 var verifyFileCopy = (src, dest) => {
   if (!existsSync2(dest)) return false;
   return sha256File(src) === sha256File(dest);
@@ -1666,50 +2029,69 @@ var collectAllFiles = (dir) => {
   return files;
 };
 var copyDirRecursive = (src, dest) => {
-  mkdirSync2(dest, { recursive: true });
+  mkdirSync3(dest, { recursive: true });
   for (const entry of readdirSync(src, { withFileTypes: true })) {
     const srcPath = join2(src, entry.name);
     const destPath = join2(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirRecursive(srcPath, destPath);
     } else {
-      const data = readFileSync3(srcPath);
-      writeFileSync2(destPath, data);
+      const data = readFileSync4(srcPath);
+      writeFileSync3(destPath, data);
       try {
         const mode = statSync(srcPath).mode;
-        chmodSync(destPath, mode);
+        chmodSync2(destPath, mode);
       } catch {
       }
     }
   }
 };
-var installHook = (home) => {
+var installHook = (home, verbose = false) => {
   const claudeDir = join2(home, ".claude");
   if (!existsSync2(claudeDir)) {
+    if (verbose) {
+      stepInfo(`~/.claude not found \u2014 Claude Code not installed, skipping`);
+    }
     return false;
   }
   const zeroHooksDir = join2(home, ".zero", "hooks");
-  mkdirSync2(zeroHooksDir, { recursive: true });
+  mkdirSync3(zeroHooksDir, { recursive: true });
+  if (verbose) stepInfo(`staged hook dir at ${zeroHooksDir}`);
   const hookFiles = ["auto-approve-zero.sh", "zero-context.sh"];
   const hookDests = {};
+  const hooksSourceDir = findResourceDir(getCliModuleDir(), "hooks");
   for (const hookFile of hookFiles) {
-    const hookSource = join2(getPackageRoot(), "hooks", hookFile);
+    const hookSource = join2(hooksSourceDir, hookFile);
     const hookDest = join2(zeroHooksDir, hookFile);
     cpSync(hookSource, hookDest);
-    chmodSync(hookDest, 493);
+    chmodSync2(hookDest, 493);
     if (!verifyFileCopy(hookSource, hookDest)) {
       throw new Error(
         `Integrity check failed: ${hookDest} does not match source`
       );
     }
     hookDests[hookFile] = hookDest;
+    if (verbose) stepInfo(`copied ${hookFile} \u2192 ${hookDest} (verified)`);
   }
   const settingsPath = join2(claudeDir, "settings.json");
   let settings = {};
+  let settingsExisted = false;
+  let settingsCorrupted = false;
   if (existsSync2(settingsPath)) {
+    settingsExisted = true;
     try {
-      settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+      settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
     } catch {
+      settingsCorrupted = true;
+    }
+  }
+  if (verbose) {
+    if (!settingsExisted) {
+      stepInfo(`${settingsPath} did not exist \u2014 creating`);
+    } else if (settingsCorrupted) {
+      stepInfo(`${settingsPath} was unparseable JSON \u2014 rewriting from scratch`);
+    } else {
+      stepInfo(`merging into existing ${settingsPath}`);
     }
   }
   if (!settings.hooks || typeof settings.hooks !== "object") {
@@ -1738,8 +2120,10 @@ var installHook = (home) => {
   });
   if (existingIdx >= 0) {
     preToolUse[existingIdx] = zeroHookEntry;
+    if (verbose) stepInfo(`PreToolUse auto-approve-zero entry replaced`);
   } else {
     preToolUse.push(zeroHookEntry);
+    if (verbose) stepInfo(`PreToolUse auto-approve-zero entry appended`);
   }
   if (!Array.isArray(hooks.UserPromptSubmit)) {
     hooks.UserPromptSubmit = [];
@@ -1762,8 +2146,10 @@ var installHook = (home) => {
   });
   if (existingContextIdx >= 0) {
     userPromptSubmit[existingContextIdx] = contextHookEntry;
+    if (verbose) stepInfo(`UserPromptSubmit zero-context entry replaced`);
   } else {
     userPromptSubmit.push(contextHookEntry);
+    if (verbose) stepInfo(`UserPromptSubmit zero-context entry appended`);
   }
   if (!settings.sandbox || typeof settings.sandbox !== "object") {
     settings.sandbox = {};
@@ -1780,12 +2166,15 @@ var installHook = (home) => {
   const zeroDomain = "*.zero.xyz";
   if (!allowedDomains.includes(zeroDomain)) {
     allowedDomains.push(zeroDomain);
+    if (verbose) stepInfo(`sandbox.network.allowedDomains += ${zeroDomain}`);
+  } else if (verbose) {
+    stepInfo(`${zeroDomain} already in sandbox allowlist \u2014 not modified`);
   }
-  writeFileSync2(settingsPath, `${JSON.stringify(settings, null, 2)}
+  writeFileSync3(settingsPath, `${JSON.stringify(settings, null, 2)}
 `);
   return true;
 };
-var CONFLICTING_SKILL_PATTERNS = ["zam", "tempo"];
+var CONFLICTING_SKILL_PATTERNS = ["zam"];
 var findConflictingSkills = (home) => {
   const found = [];
   for (const tool of AGENT_TOOLS) {
@@ -1815,22 +2204,38 @@ var removeConflictingSkills = (home) => {
   }
   return removed;
 };
-var installSkills = (home) => {
-  const skillsSourceDir = join2(getPackageRoot(), "skills");
+var installSkills = (home, verbose = false) => {
+  const skillsSourceDir = findResourceDir(getCliModuleDir(), "skills");
   const skillDirs = readdirSync(skillsSourceDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  if (verbose) {
+    stepInfo(
+      `found ${skillDirs.length} bundled skill(s): ${skillDirs.join(", ")}`
+    );
+  }
   const installed = [];
   const errors = [];
   for (const tool of AGENT_TOOLS) {
     const toolDetectPath = join2(home, tool.detectDir);
     if (!existsSync2(toolDetectPath)) {
+      if (verbose) {
+        stepInfo(
+          `${tool.name}: ~/${tool.detectDir} not found \u2014 skipping install`
+        );
+      }
       continue;
     }
+    if (verbose) {
+      stepInfo(
+        `${tool.name}: detected at ~/${tool.detectDir} \u2014 installing to ~/${tool.skillsDir}`
+      );
+    }
     try {
       const toolSkillsPath = join2(home, tool.skillsDir);
-      mkdirSync2(toolSkillsPath, { recursive: true });
+      mkdirSync3(toolSkillsPath, { recursive: true });
       for (const skillDir of skillDirs) {
         const src = join2(skillsSourceDir, skillDir);
         const dest = join2(toolSkillsPath, skillDir);
+        const existed = existsSync2(dest);
         copyDirRecursive(src, dest);
         for (const srcFile of collectAllFiles(src)) {
           const relPath = relative(src, srcFile);
@@ -1842,6 +2247,11 @@ var installSkills = (home) => {
           }
         }
         installed.push(`${tool.name}: ${dest}`);
+        if (verbose) {
+          stepInfo(
+            `${tool.name}: ${existed ? "updated" : "installed"} skill '${skillDir}'`
+          );
+        }
       }
     } catch (err) {
       errors.push({
@@ -1853,11 +2263,13 @@ var installSkills = (home) => {
   return { installed, errors };
 };
 var runInit = async (appContext, options = {}) => {
+  const verbose = options.verbose ?? false;
   appContext.services.analyticsService.capture("init_started", {
     force: options.force ?? false
   });
   let currentStep = "wallet";
   try {
+    printZeroBanner();
     const home = homedir2();
     const zeroDir = join2(home, ".zero");
     const configPath = join2(zeroDir, "config.json");
@@ -1866,7 +2278,7 @@ var runInit = async (appContext, options = {}) => {
     const walletExists = (() => {
       if (!existsSync2(configPath)) return false;
       try {
-        const existing = JSON.parse(readFileSync3(configPath, "utf8"));
+        const existing = JSON.parse(readFileSync4(configPath, "utf8"));
         return !!existing.privateKey;
       } catch {
         return false;
@@ -1875,9 +2287,9 @@ var runInit = async (appContext, options = {}) => {
     if (!walletExists || options.force) {
       const privateKey = generatePrivateKey();
       const account = privateKeyToAccount(privateKey);
-      mkdirSync2(zeroDir, { recursive: true });
-      const existing = existsSync2(configPath) ? JSON.parse(readFileSync3(configPath, "utf8")) : {};
-      writeFileSync2(
+      ensureSecureDir(zeroDir);
+      const existing = existsSync2(configPath) ? JSON.parse(readFileSync4(configPath, "utf8")) : {};
+      writeSecureFile(
         configPath,
         JSON.stringify(
           { ...existing, privateKey, lowBalanceWarning: 1 },
@@ -1887,14 +2299,32 @@ var runInit = async (appContext, options = {}) => {
       );
       walletCreated = true;
       walletAddress = account.address;
-      console.log(`Wallet address: ${account.address}`);
+      stepSuccess("Wallet created", account.address);
+      if (verbose) {
+        if (options.force) {
+          stepInfo(
+            `--force passed \u2014 generated a new key and overwrote ${configPath}`
+          );
+        } else {
+          stepInfo(`no wallet found at ${configPath} \u2014 generated a new key`);
+        }
+      }
     } else {
       try {
-        const existing = JSON.parse(readFileSync3(configPath, "utf8"));
+        const existing = JSON.parse(readFileSync4(configPath, "utf8"));
         const account = privateKeyToAccount(existing.privateKey);
         walletAddress = account.address;
       } catch {
       }
+      stepSkip(
+        "Wallet already configured",
+        walletAddress ?? "run `zero init --force` to reset"
+      );
+      if (verbose) {
+        stepInfo(
+          `existing wallet at ${configPath} was preserved \u2014 pass --force to regenerate`
+        );
+      }
     }
     const agentsDetected = [];
     const agentsWithSkills = [];
@@ -1906,9 +2336,20 @@ var runInit = async (appContext, options = {}) => {
         agentsDetected.push(tool.name);
       }
     }
+    if (verbose) {
+      const missing = AGENT_TOOLS.filter(
+        (t) => !agentsDetected.includes(t.name)
+      ).map((t) => t.name);
+      stepInfo(
+        `agents detected: ${agentsDetected.length > 0 ? agentsDetected.join(", ") : "none"}`
+      );
+      if (missing.length > 0) {
+        stepInfo(`agents not detected: ${missing.join(", ")}`);
+      }
+    }
     currentStep = "skills";
     try {
-      const { installed, errors } = installSkills(home);
+      const { installed, errors } = installSkills(home, verbose);
       for (const entry of installed) {
         const toolName = entry.split(":")[0];
         if (toolName && !agentsWithSkills.includes(toolName)) {
@@ -1927,27 +2368,45 @@ var runInit = async (appContext, options = {}) => {
       skillsError = err instanceof Error ? err.message : "unknown skills error";
       console.error(`Warning: skills install failed: ${skillsError}`);
     }
+    if (agentsWithSkills.length > 0) {
+      stepSuccess("Skills installed");
+    } else if (agentsDetected.length === 0) {
+      stepSkip("No agent tools detected");
+    } else if (skillsError) {
+      stepWarn("Skills install had errors", skillsError);
+    }
     currentStep = "hook";
     try {
-      hookInstalled = installHook(home);
+      hookInstalled = installHook(home, verbose);
     } catch (err) {
       hookError = err instanceof Error ? err.message : "unknown hook error";
     }
+    if (hookInstalled) {
+      stepSuccess("Agents configured");
+    } else if (hookError) {
+      stepWarn("Agent config failed", hookError);
+    }
     currentStep = "cleanup_scan";
     const conflictingSkills = findConflictingSkills(home);
+    if (verbose) {
+      stepInfo(
+        `scanning agent skill dirs for deprecated skills matching [${CONFLICTING_SKILL_PATTERNS.join(", ")}]`
+      );
+    }
     if (conflictingSkills.length > 0) {
       const skillList = conflictingSkills.map((s) => `  - ${s.tool}: ${s.skillName}`).join("\n");
       console.error(
         `
-Found deprecated skills that may conflict with Zero:
+${color.yellow("Found deprecated skills that may conflict with Zero:")}
 ${skillList}
 
-To remove them, run: zero init cleanup`
+To remove them, run: ${color.cyan("zero init cleanup")}`
       );
+    } else if (verbose) {
+      stepInfo(`no deprecated skills found`);
     }
-    console.error(
-      'Zero is ready! Run `zero search` to find capabilities.\n\nBy using Zero, you agree to our Terms of Service:\n  https://zero.xyz/terms-of-service\n\nRun `zero terms` to view the full terms.\n\nTry:\n  zero search "translate text to Spanish"\n  zero search "generate an image"\n  zero search "weather forecast"'
-    );
+    sectionDivider();
+    console.error(printReadyFooter());
     currentStep = "complete";
     appContext.services.analyticsService.capture("wallet_initialized", {
       // biome-ignore lint/style/useNamingConvention: snake_case for analytics
@@ -1982,12 +2441,13 @@ To remove them, run: zero init cleanup`
     throw err;
   }
 };
-var initCommand = (appContext) => new Command5("init").description("Initialize Zero CLI for usage").option("--force", "Overwrite existing configuration").action(async (options) => {
+var initCommand = (appContext) => new Command5("init").description("Initialize Zero CLI for usage").option("--force", "Overwrite existing configuration").option(
+  "-v, --verbose",
+  "Explain why each install step was taken or skipped"
+).action(async (options) => {
   await runInit(appContext, options);
 }).addCommand(
-  new Command5("cleanup").description(
-    "Remove deprecated skills (zam, tempo) that conflict with Zero"
-  ).action(() => {
+  new Command5("cleanup").description("Remove deprecated skills (zam) that conflict with Zero").action(() => {
     const home = homedir2();
     const removed = removeConflictingSkills(home);
     if (removed.length === 0) {
@@ -2007,7 +2467,7 @@ ${removedList}`);
 );
 
 // src/commands/review-command.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { Command as Command6 } from "commander";
 import { z as z3 } from "zod";
 var bulkEntrySchema2 = z3.object({
@@ -2049,35 +2509,66 @@ Examples:
     try {
       const { analyticsService, apiService } = appContext.services;
       if (options.fromFile) {
-        const contents = readFileSync4(options.fromFile, "utf8");
+        const contents = readFileSync5(options.fromFile, "utf8");
         const lines = contents.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
-        let ok = 0;
-        let failed = 0;
+        const parsed = [];
+        let parseFailures = 0;
         for (const [idx, line] of lines.entries()) {
           const lineNum = idx + 1;
           try {
-            const parsed = bulkEntrySchema2.parse(JSON.parse(line));
-            const result2 = await apiService.createReview(parsed);
-            ok += 1;
-            console.log(
-              `[${lineNum}] ${parsed.runId} -> ${result2.reviewId}`
-            );
-            analyticsService.capture("review_submitted", {
-              runId: parsed.runId,
-              success: parsed.success,
-              accuracy: parsed.accuracy,
-              value: parsed.value,
-              reliability: parsed.reliability,
-              hasContent: !!parsed.content,
-              bulk: true
+            parsed.push({
+              lineNum,
+              entry: bulkEntrySchema2.parse(JSON.parse(line))
             });
           } catch (err) {
-            failed += 1;
+            parseFailures += 1;
             console.error(
-              `[${lineNum}] FAILED: ${err instanceof Error ? err.message : String(err)}`
+              `[${lineNum}] PARSE FAILED: ${err instanceof Error ? err.message : String(err)}`
             );
           }
         }
+        if (parsed.length === 0) {
+          console.error("No valid review lines found in file.");
+          process.exitCode = 1;
+          return;
+        }
+        const Chunk = 100;
+        let ok = 0;
+        let failed = parseFailures;
+        for (let i = 0; i < parsed.length; i += Chunk) {
+          const chunk = parsed.slice(i, i + Chunk);
+          const response = await apiService.createReviewsBatch(
+            chunk.map((p) => p.entry)
+          );
+          for (const [chunkIdx, item] of response.results.entries()) {
+            const lineNum = chunk[chunkIdx]?.lineNum ?? i + chunkIdx + 1;
+            if (item.ok) {
+              ok += 1;
+              const suffix = item.updated ? " (updated)" : "";
+              console.log(
+                `[${lineNum}] ${item.runId} -> ${item.reviewId}${suffix}`
+              );
+              const entry = chunk[chunkIdx]?.entry;
+              if (entry) {
+                analyticsService.capture("review_submitted", {
+                  runId: entry.runId,
+                  success: entry.success,
+                  accuracy: entry.accuracy,
+                  value: entry.value,
+                  reliability: entry.reliability,
+                  hasContent: !!entry.content,
+                  bulk: true,
+                  updated: item.updated
+                });
+              }
+            } else {
+              failed += 1;
+              console.error(
+                `[${lineNum}] FAILED (${item.status}): ${item.error}`
+              );
+            }
+          }
+        }
         console.log(`
 Bulk review complete: ${ok} ok, ${failed} failed`);
         if (failed > 0) process.exitCode = 1;
@@ -2116,7 +2607,7 @@ Bulk review complete: ${ok} ok, ${failed} failed`);
         }
         if (list.runs.length > 1) {
           console.error(
-            `Multiple un-reviewed runs for "${options.capability}". Run "zero runs --capability ${options.capability} --unreviewed" and pass the runId explicitly.`
+            `Multiple un-reviewed runs for "${options.capability}". Either pass a runId explicitly (see "zero runs --capability ${options.capability} --unreviewed"), or review them in one call via "zero review --from-file <reviews.jsonl>".`
           );
           process.exitCode = 1;
           return;
@@ -2330,7 +2821,8 @@ var searchCommand = (appContext) => new Command8("search").description("Search f
         capabilities: result.capabilities.map((c) => ({
           position: c.position,
           id: c.id,
-          url: c.url
+          url: c.url,
+          displayCostAmount: c.cost.amount
         }))
       });
       console.log(formatSearchResults(result.capabilities));
@@ -2373,7 +2865,7 @@ Read the full terms at: ${TERMS_URL}
 });
 
 // src/commands/wallet-command.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
 import { Command as Command10 } from "commander";
@@ -2395,6 +2887,9 @@ var walletBalanceCommand = (appContext) => new Command10("balance").description(
   console.log(`${balance.amount} ${balance.asset}`);
 });
 var walletFundCommand = (appContext) => new Command10("fund").description("Fund your wallet").argument("[amount]", "Amount to fund in USDC").option("--manual", "Show wallet address for manual transfer").option(
+  "--no-open",
+  "Print the funding URL instead of opening a browser (for agents \u2014 funding links are one-time use, hand the URL to the user)"
+).option(
   "--use <provider>",
   "Onramp provider: coinbase or stripe",
   "coinbase"
@@ -2422,12 +2917,19 @@ ${address}`);
       provider
     );
     if (url) {
-      await open(url);
-      console.log("Opened funding page in your browser.");
-      console.log(`If it didn't open, visit: ${url}`);
+      if (options.open) {
+        await open(url);
+        console.log("Opened funding page in your browser.");
+        console.log(`If it didn't open, visit: ${url}`);
+      } else {
+        console.log(
+          "Funding URL (one-time use \u2014 open it in a browser to fund):"
+        );
+        console.log(url);
+      }
       console.log(`Your wallet address: ${address}`);
       analyticsService.capture("wallet_funded", {
-        method: "browser",
+        method: options.open ? "browser" : "url",
         amount
       });
     } else {
@@ -2468,7 +2970,7 @@ var walletSetCommand = (appContext) => new Command10("set").description("Set wal
   const configPath = join3(zeroDir, "config.json");
   if (!options.force && existsSync3(configPath)) {
     try {
-      const existing2 = JSON.parse(readFileSync5(configPath, "utf8"));
+      const existing2 = JSON.parse(readFileSync6(configPath, "utf8"));
       if (existing2.privateKey) {
         console.error(
           "Wallet already configured. Use --force to overwrite."
@@ -2479,9 +2981,9 @@ var walletSetCommand = (appContext) => new Command10("set").description("Set wal
     } catch {
     }
   }
-  mkdirSync3(zeroDir, { recursive: true });
-  const existing = existsSync3(configPath) ? JSON.parse(readFileSync5(configPath, "utf8")) : {};
-  writeFileSync3(
+  ensureSecureDir(zeroDir);
+  const existing = existsSync3(configPath) ? JSON.parse(readFileSync6(configPath, "utf8")) : {};
+  writeSecureFile(
     configPath,
     JSON.stringify(
       {
@@ -2510,7 +3012,7 @@ var walletCommand = (appContext) => {
 };
 
 // src/commands/welcome-command.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join4 } from "path";
 import { Command as Command11 } from "commander";
@@ -2521,7 +3023,7 @@ var readPrivateKey = () => {
   const configPath = join4(homedir4(), ".zero", "config.json");
   if (!existsSync4(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync6(configPath, "utf8"));
+    const config = JSON.parse(readFileSync7(configPath, "utf8"));
     if (typeof config.privateKey === "string") {
       return config.privateKey;
     }
@@ -2573,7 +3075,7 @@ If your browser didn't open, paste the URL above.`
 // src/app.ts
 var createApp = (appContext) => {
   const { analyticsService } = appContext.services;
-  const program = new Command12().name("zero").description("Zero CLI \u2014 Search engine and payment platform for AI agents").version(package_default.version, "-v, --version").exitOverride().hook("preAction", async (_thisCommand, actionCommand) => {
+  const program = new Command12().name("zero").description("Zero CLI \u2014 Search engine for AI agents").version(package_default.version, "-v, --version").exitOverride().hook("preAction", async (_thisCommand, actionCommand) => {
     const agentFlag = actionCommand.opts().agent;
     if (typeof agentFlag === "string" && agentFlag.trim().length > 0) {
       analyticsService.setAgentHost(agentFlag.trim());
@@ -2620,14 +3122,14 @@ var getEnv = () => {
 
 // src/app/app-services.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join6 } from "path";
 import { privateKeyToAccount as privateKeyToAccount4 } from "viem/accounts";
 
 // src/services/analytics-service.ts
 import { randomUUID } from "crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname2 } from "path";
 import { PostHog } from "posthog-node";
 var POSTHOG_API_KEY = "phc_B2vLyNxAf2mnqvdPQajf4d4b2iXc35dep2ZrvebMJLuX";
@@ -2650,7 +3152,7 @@ var AnalyticsService = class {
     let persistedAnonId;
     try {
       if (existsSync5(opts.configPath)) {
-        const config = JSON.parse(readFileSync7(opts.configPath, "utf8"));
+        const config = JSON.parse(readFileSync8(opts.configPath, "utf8"));
         if (config.telemetry === false) {
           telemetryEnabled = false;
         }
@@ -2675,7 +3177,7 @@ var AnalyticsService = class {
       try {
         const dir = dirname2(opts.configPath);
         mkdirSync4(dir, { recursive: true });
-        const existing = existsSync5(opts.configPath) ? JSON.parse(readFileSync7(opts.configPath, "utf8")) : {};
+        const existing = existsSync5(opts.configPath) ? JSON.parse(readFileSync8(opts.configPath, "utf8")) : {};
         writeFileSync4(
           opts.configPath,
           JSON.stringify({ ...existing, anonId: newAnonId }, null, 2)
@@ -2711,7 +3213,7 @@ var AnalyticsService = class {
     if (anonId === walletAddress) return;
     let aliasedTo;
     try {
-      const config = JSON.parse(readFileSync7(configPath, "utf8"));
+      const config = JSON.parse(readFileSync8(configPath, "utf8"));
       if (typeof config.aliasedTo === "string") {
         aliasedTo = config.aliasedTo;
       }
@@ -2720,7 +3222,7 @@ var AnalyticsService = class {
     if (aliasedTo === walletAddress) return;
     this.posthog.alias({ distinctId: walletAddress, alias: anonId });
     try {
-      const config = existsSync5(configPath) ? JSON.parse(readFileSync7(configPath, "utf8")) : {};
+      const config = existsSync5(configPath) ? JSON.parse(readFileSync8(configPath, "utf8")) : {};
       writeFileSync4(
         configPath,
         JSON.stringify({ ...config, aliasedTo: walletAddress }, null, 2)
@@ -2763,7 +3265,7 @@ var AnalyticsService = class {
 };
 
 // src/services/state-service.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
 import { join as join5 } from "path";
 var StateService = class {
   constructor(zeroDir) {
@@ -2778,7 +3280,7 @@ var StateService = class {
   loadLastSearch = () => {
     try {
       if (!existsSync6(this.lastSearchPath)) return null;
-      const raw = readFileSync8(this.lastSearchPath, "utf8");
+      const raw = readFileSync9(this.lastSearchPath, "utf8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -2831,7 +3333,7 @@ var getServices = (env) => {
   if (!privateKey) {
     try {
       if (existsSync7(configPath)) {
-        const config = JSON.parse(readFileSync9(configPath, "utf8"));
+        const config = JSON.parse(readFileSync10(configPath, "utf8"));
         if (typeof config.privateKey === "string") {
           privateKey = config.privateKey;
         }
@@ -2843,7 +3345,7 @@ var getServices = (env) => {
   let lowBalanceWarning = 1;
   try {
     if (existsSync7(configPath)) {
-      const config = JSON.parse(readFileSync9(configPath, "utf8"));
+      const config = JSON.parse(readFileSync10(configPath, "utf8"));
       if (typeof config.lowBalanceWarning === "number") {
         lowBalanceWarning = config.lowBalanceWarning;
       }