@zeroxyz/cli 1.5.0 → 1.7.0

package/dist/index.js

@@ -6,7 +6,7 @@ import * as nc from 'crypto';
 import nc__default, { randomUUID, randomBytes as randomBytes$1, createHash } from 'crypto';
 import os, { homedir } from 'os';
 import y2, { stdin, stdout } from 'process';
-import childProcess, { execFile as execFile$1 } from 'child_process';
+import childProcess, { execFile as execFile$1, spawnSync } from 'child_process';
 import fs5, { constants } from 'fs/promises';
 import util2, { promisify } from 'util';
 import fs3, { createReadStream, existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readlinkSync, rmSync, readdirSync } from 'fs';
@@ -76582,7 +76582,7 @@ init_esm_shims();
 
 // package.json
 var package_default = {
-  version: "1.5.0"};
+  version: "1.7.0"};
 
 // src/app.ts
 init_esm_shims();
@@ -77563,6 +77563,18 @@ var authExchangeCommand = (appContext) => new Command("exchange").description(
     process.exitCode = 1;
   }
 });
+var ensureAuthenticated = async (client, shouldOpen = true) => {
+  const session4 = readConfig(getConfigPath()).session;
+  if (session4) return;
+  process.stdout.write(
+    "\nZero requires authentication before handing off to Claude.\n\n"
+  );
+  await runInteractive(client, shouldOpen);
+  if (!readConfig(getConfigPath()).session) {
+    process.exitCode = 1;
+    process.exit(1);
+  }
+};
 var authCommand = (appContext) => {
   const cmd = new Command("auth").description("Authentication commands");
   cmd.addCommand(authLoginCommand(appContext));
@@ -77578,7 +77590,7 @@ init_esm_shims();
 // ../sdk/dist/index.js
 init_esm_shims();
 
-// ../sdk/dist/chunk-RPL7VC32.js
+// ../sdk/dist/chunk-3YKWO4B2.js
 init_esm_shims();
 
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/index.js
@@ -143069,6 +143081,76 @@ var ZeroConfigurationError = class extends ZeroError {
     this.name = "ZeroConfigurationError";
   }
 };
+var asSchemaNode = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : null;
+var extractInputEnvelope = (bodySchema, method) => {
+  const root = asSchemaNode(bodySchema);
+  if (!root) return {};
+  const props = asSchemaNode(root.properties);
+  if (!props) return {};
+  const inputProps = asSchemaNode(asSchemaNode(props.input)?.properties);
+  if (inputProps) {
+    return {
+      queryParams: asSchemaNode(inputProps.queryParams) ?? void 0,
+      body: asSchemaNode(inputProps.body) ?? void 0
+    };
+  }
+  const upperMethod = method.toUpperCase();
+  const isGetLike = upperMethod === "GET" || upperMethod === "DELETE";
+  return isGetLike ? { queryParams: root } : { body: root };
+};
+var unwrapTransportEnvelope = (request22) => {
+  const input = asSchemaNode(asSchemaNode(request22)?.input);
+  if (!input || input.type !== "http") return request22;
+  const body = input.body;
+  const hasBody = body !== void 0 && body !== null && !(typeof body === "object" && Object.keys(body).length === 0);
+  if (hasBody) return body;
+  const qp = asSchemaNode(input.queryParams);
+  if (qp && Object.keys(qp).length > 0) return qp;
+  return null;
+};
+var GET_LIKE = /* @__PURE__ */ new Set(["GET", "HEAD", "DELETE"]);
+var appendQueryParams = (url4, params) => {
+  const entries = Object.entries(params).filter(([, v]) => v != null);
+  if (entries.length === 0) return url4;
+  try {
+    const u2 = new URL(url4);
+    for (const [k3, v] of entries) u2.searchParams.set(k3, String(v));
+    return u2.toString();
+  } catch {
+    const qs = entries.map(
+      ([k3, v]) => `${encodeURIComponent(k3)}=${encodeURIComponent(String(v))}`
+    ).join("&");
+    return url4.includes("?") ? `${url4}&${qs}` : `${url4}?${qs}`;
+  }
+};
+var normalizeTransportEnvelopeRequest = (url4, opts) => {
+  const { method, body } = opts;
+  if (typeof body !== "string") return { url: url4, method, body };
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return { url: url4, method, body };
+  }
+  const input = asSchemaNode(asSchemaNode(parsed)?.input);
+  if (!input || input.type !== "http") return { url: url4, method, body };
+  const innerBody = input.body;
+  const hasInnerBody = innerBody !== void 0 && innerBody !== null && !(typeof innerBody === "object" && Object.keys(innerBody).length === 0);
+  const verb = (method ?? (typeof input.method === "string" ? input.method : void 0) ?? (hasInnerBody ? "POST" : "GET")).toUpperCase();
+  if (GET_LIKE.has(verb)) {
+    const qp = asSchemaNode(input.queryParams);
+    return {
+      url: qp ? appendQueryParams(url4, qp) : url4,
+      method: verb,
+      body: void 0
+    };
+  }
+  return {
+    url: url4,
+    method: verb,
+    body: hasInnerBody ? JSON.stringify(innerBody) : void 0
+  };
+};
 var KNOWN_EIP712_DOMAINS = {
   // Base mainnet USDC. On-chain `name()` is "USD Coin" (NOT "USDC")
   // — verified via the contract's name() / version().
@@ -144080,7 +144162,7 @@ var Payments = class {
   };
 };
 var package_default2 = {
-  version: "0.4.0"
+  version: "0.6.0"
 };
 var SDK_VERSION2 = package_default2.version;
 var userWalletDtoSchema = external_exports3.object({
@@ -144726,6 +144808,11 @@ var capabilityResponseSchema = external_exports3.object({
   lastUsedAt: external_exports3.string().nullable().optional(),
   lastSuccessfullyRanAt: external_exports3.string().nullable().optional()
 });
+var resolveCapabilityResponseSchema = external_exports3.object({
+  capabilityId: external_exports3.string(),
+  capabilitySlug: external_exports3.string(),
+  matchedVia: external_exports3.enum(["exact", "template"])
+});
 var Capabilities = class {
   constructor(client) {
     this.client = client;
@@ -144740,6 +144827,31 @@ var Capabilities = class {
     },
     capabilityResponseSchema
   );
+  // Resolve a raw endpoint URL + method back to the capability that owns it,
+  // for the `zero fetch <url>` case where the client has no local search
+  // context to match against (a memoized/cross-session URL). Returns null on
+  // 404 — i.e. no match or an ambiguous multi-match, both of which the server
+  // reports as 404 (resolveByUrl fails closed rather than mis-attribute).
+  // The URL travels in the POST body so it stays out of access logs and is
+  // never stored; the caller uses the returned capabilityId to record an
+  // attributed run without the URL ever touching the run row (ZERO-335).
+  resolveByUrl = async (url4, method, opts = {}) => {
+    try {
+      return await request2(
+        this.client,
+        {
+          method: "POST",
+          path: "/v1/capabilities/resolve",
+          body: { url: url4, method },
+          signal: opts.signal
+        },
+        resolveCapabilityResponseSchema
+      );
+    } catch (err) {
+      if (err instanceof ZeroApiError && err.status === 404) return null;
+      throw err;
+    }
+  };
 };
 var createRunResponseSchema = external_exports3.object({
   runId: external_exports3.string()
@@ -144765,6 +144877,30 @@ var listRunsResponseSchema = external_exports3.object({
   runs: external_exports3.array(runListItemSchema),
   nextCursor: external_exports3.string().nullable()
 });
+var runDetailSchema = external_exports3.object({
+  runId: external_exports3.string(),
+  status: external_exports3.number().nullable(),
+  latencyMs: external_exports3.number().nullable(),
+  errorClass: external_exports3.string().nullable(),
+  createdAt: external_exports3.coerce.date(),
+  cost: external_exports3.object({ amount: external_exports3.string(), asset: external_exports3.string().nullable() }).nullable(),
+  payment: external_exports3.object({
+    protocol: external_exports3.string(),
+    chain: external_exports3.string().nullable(),
+    txHash: external_exports3.string().nullable(),
+    mode: external_exports3.string().nullable()
+  }).nullable(),
+  capability: external_exports3.object({
+    uid: external_exports3.string(),
+    slug: external_exports3.string(),
+    name: external_exports3.string(),
+    url: external_exports3.string(),
+    method: external_exports3.string(),
+    whatItDoes: external_exports3.string().nullable(),
+    tags: external_exports3.array(external_exports3.string())
+  }),
+  reviewed: external_exports3.boolean()
+});
 var createReviewResponseSchema = external_exports3.object({
   reviewId: external_exports3.string(),
   recorded: external_exports3.boolean(),
@@ -144844,6 +144980,15 @@ var Runs = class {
       listRunsResponseSchema
     );
   };
+  get = (runId, opts = {}) => request2(
+    this.client,
+    {
+      method: "GET",
+      path: `/v1/runs/${runId}`,
+      signal: opts.signal
+    },
+    runDetailSchema
+  );
   review = (input, opts = {}) => request2(
     this.client,
     {
@@ -145312,14 +145457,17 @@ var resolveRecordingClient = (client, opts) => {
   const canRecord = opts.account !== void 0 || credentials.kind === "account" || credentials.kind === "session";
   return { recordingClient, canRecord };
 };
-var recordErrorFetchRun = async (client, opts, result) => {
-  if (opts.capabilityId === void 0) return;
+var recordErrorFetchRun = async (client, opts, result, capabilityIdOverride) => {
+  const effectiveCapId = opts.capabilityId;
+  if (effectiveCapId === void 0) return;
   const { recordingClient, canRecord } = resolveRecordingClient(client, opts);
   if (!canRecord) return;
+  const fetchOriginForRecord = opts.capabilityId === void 0 ? "direct_url" : opts.fetchOrigin;
   try {
     const created = await recordingClient.runs.create({
-      capabilityId: opts.capabilityId,
+      capabilityId: effectiveCapId,
       ...opts.searchId && { searchId: opts.searchId },
+      ...fetchOriginForRecord && { fetchOrigin: fetchOriginForRecord },
       ...result.status !== null && { status: result.status },
       latencyMs: result.latencyMs,
       ...opts.requestSchema && { requestSchema: opts.requestSchema }
@@ -145329,7 +145477,7 @@ var recordErrorFetchRun = async (client, opts, result) => {
   } catch {
   }
 };
-var recordTimeoutRun = async (client, opts, err, startedAt, capabilityIdRequested) => {
+var recordTimeoutRun = async (client, opts, err, startedAt, capabilityIdRequested, capabilityIdOverride) => {
   const result = errorFetchResult(
     startedAt,
     err.message,
@@ -145365,12 +145513,23 @@ var withDefaultContentType = (headers, body) => {
 var clientFetch = async (client, url4, opts = {}) => {
   const startedAt = Date.now();
   const capabilityIdRequested = opts.capabilityId !== void 0;
-  const method = opts.method ?? (opts.body !== void 0 ? "POST" : "GET");
-  const probeHeaders = withDefaultContentType(opts.headers, opts.body);
+  const normalized = normalizeTransportEnvelopeRequest(url4, {
+    method: opts.method,
+    body: opts.body
+  });
+  const requestUrl = normalized.url;
+  const requestBody = normalized.body;
+  const method = normalized.method ?? (requestBody !== void 0 ? "POST" : "GET");
+  const { canRecord: canRecordForResolve } = resolveRecordingClient(
+    client,
+    opts
+  );
+  const resolvePromise = !capabilityIdRequested && canRecordForResolve ? client.capabilities.resolveByUrl(redactUrl2(requestUrl), method).catch(() => null) : Promise.resolve(null);
+  const probeHeaders = withDefaultContentType(opts.headers, requestBody);
   const requestInit = {
     method,
     headers: probeHeaders,
-    body: opts.body,
+    body: requestBody,
     signal: opts.signal
   };
   const configuredFetch = buildConfiguredFetch(client, {
@@ -145381,7 +145540,7 @@ var clientFetch = async (client, url4, opts = {}) => {
   const skipReasons = [];
   const warnings = [];
   try {
-    response = await configuredFetch(url4, requestInit);
+    response = await configuredFetch(requestUrl, requestInit);
   } catch (err) {
     if (err instanceof ZeroTimeoutError) {
       await recordTimeoutRun(
@@ -145411,13 +145570,13 @@ var clientFetch = async (client, url4, opts = {}) => {
       const payCall = requirement.protocol === "x402" ? client.payments.pay : client.payments.payMpp;
       try {
         const paid = await payCall({
-          url: url4,
+          url: requestUrl,
           method,
           // Fresh clone for the paid retry — same rationale as
           // the probe-side clone above. Re-derives the default
           // Content-Type so the paid leg matches the probe.
-          headers: withDefaultContentType(opts.headers, opts.body),
-          body: opts.body,
+          headers: withDefaultContentType(opts.headers, requestBody),
+          body: requestBody,
           maxPay: opts.maxPay,
           account: opts.account,
           signal: opts.signal,
@@ -145557,7 +145716,15 @@ var clientFetch = async (client, url4, opts = {}) => {
     else if (closeFailed)
       skipReasons.push(FETCH_SKIP_REASONS.mppSessionCloseFailedNotRecorded);
   }
-  if (opts.capabilityId !== void 0 && !paidButStill402 && !closeFailed) {
+  const resolvedCap = await resolvePromise;
+  const effectiveCapabilityId = opts.capabilityId ?? resolvedCap?.capabilityId;
+  const capabilityResolution = !capabilityIdRequested && canRecordForResolve ? resolvedCap !== null ? {
+    resolved: true,
+    capabilityId: resolvedCap.capabilityId,
+    capabilitySlug: resolvedCap.capabilitySlug,
+    matchedVia: resolvedCap.matchedVia
+  } : { resolved: false } : void 0;
+  if (effectiveCapabilityId !== void 0 && !paidButStill402 && !closeFailed) {
     const { recordingClient, canRecord } = resolveRecordingClient(client, opts);
     if (!canRecord) {
       skipReasons.push("no_credentials");
@@ -145577,8 +145744,11 @@ var clientFetch = async (client, url4, opts = {}) => {
           }
         }
         const result2 = await recordingClient.runs.create({
-          capabilityId: opts.capabilityId,
+          capabilityId: effectiveCapabilityId,
           searchId: opts.searchId,
+          // Auto-resolved runs are always direct_url — they only fire when
+          // no capabilityId was supplied (the direct_url path by definition).
+          ...opts.capabilityId === void 0 ? { fetchOrigin: "direct_url" } : opts.fetchOrigin && { fetchOrigin: opts.fetchOrigin },
           status: response.status,
           latencyMs,
           ...opts.requestSchema && { requestSchema: opts.requestSchema },
@@ -145611,7 +145781,7 @@ var clientFetch = async (client, url4, opts = {}) => {
           message: "Failed to record run for fetch",
           meta: {
             url: redactUrl2(url4),
-            capabilityId: opts.capabilityId,
+            capabilityId: effectiveCapabilityId,
             error: errorMessage22,
             errorCode: code
           }
@@ -145639,6 +145809,8 @@ var clientFetch = async (client, url4, opts = {}) => {
     result.runTrackingSkipped = skipReasons;
   }
   if (warnings.length > 0) result.warnings = warnings;
+  if (capabilityResolution !== void 0)
+    result.capabilityResolution = capabilityResolution;
   return result;
 };
 var searchResultSchema = external_exports3.object({
@@ -146582,7 +146754,7 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         headers["content-type"] = Buffer.isBuffer(resolvedBody) ? sniffJsonShape(resolvedBody) ? "application/json" : "application/octet-stream" : "application/json";
       }
       const log2 = (msg) => console.error(`  ${msg}`);
-      const method = options.method ? options.method.toUpperCase() : resolvedMethodFromCapability && !resolvedBody ? resolvedMethodFromCapability.toUpperCase() : resolvedBody ? "POST" : "GET";
+      const method = options.method ? options.method.toUpperCase() : resolvedMethodFromCapability ? resolvedMethodFromCapability.toUpperCase() : resolvedBody ? "POST" : "GET";
       const explicitCapabilityCtx = options.capability ? stateService.findSearchContextByCapability(options.capability) : null;
       const urlCtx = stateService.findSearchContextByUrl(resolvedUrl, {
         matchTemplate: (template) => {
@@ -146595,8 +146767,8 @@ var fetchCommand = (appContext) => new Command("fetch").description(
       });
       const matchCtx = explicitCapabilityCtx ?? urlCtx;
       const capabilityId = options.capability ?? matchCtx?.capabilityId ?? null;
-      const capabilityUid = matchCtx?.capabilityUid ?? null;
-      const capabilitySlug = matchCtx?.capabilitySlug ?? null;
+      let capabilityUid = matchCtx?.capabilityUid ?? null;
+      let capabilitySlug = matchCtx?.capabilitySlug ?? null;
       const searchId = matchCtx?.searchId;
       const resultRank = matchCtx?.resultRank;
       const fetchOrigin = matchCtx ? "from_search" : options.capability ? "direct_slug" : "direct_url";
@@ -146607,23 +146779,10 @@ var fetchCommand = (appContext) => new Command("fetch").description(
           "no wallet configured (run `zero auth login`, or `zero wallet set <key>` / set ZERO_PRIVATE_KEY)"
         );
       }
-      if (!capabilityId) {
+      if (!capabilityId && !walletAddress) {
         cliSkipReasons.push(
           "no capability resolved \u2014 pass --capability <uid|slug> or run `zero search` first so the URL can be matched"
         );
-        if (!options.capability) {
-          const lastSearch = stateService.loadLastSearch();
-          const cached2 = lastSearch?.capabilities ?? [];
-          analyticsService.capture("capability_resolution_missed", {
-            url: redactUrl(resolvedUrl),
-            method,
-            hasLastSearch: lastSearch !== null,
-            lastSearchSize: cached2.length,
-            lastSearchHasTemplates: cached2.some(
-              (c) => Boolean(c.urlTemplate)
-            )
-          });
-        }
       }
       let requestSchema;
       if (typeof resolvedBody === "string") {
@@ -146659,6 +146818,11 @@ var fetchCommand = (appContext) => new Command("fetch").description(
           // and omitting here keeps result.runTrackingSkipped clean.
           ...capabilityId && walletAddress && { capabilityId },
           ...searchId && { searchId },
+          // Stamp how the agent arrived (from_search | direct_slug |
+          // direct_url) onto the run's metadata so direct execution is
+          // distinguishable from search-driven runs server-side. Only
+          // when a run is actually recorded (capabilityId + wallet).
+          ...capabilityId && walletAddress && { fetchOrigin },
           ...requestSchema && { requestSchema },
           deriveRunMetadata: ({ bodyRaw: bodyRaw2, bodyEncoding: bodyEncoding2 }) => {
             if (bodyRaw2 && bodyEncoding2 !== "base64") {
@@ -146693,7 +146857,8 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         upstreamError,
         warnings: sdkWarnings,
         runTrackingSkipped: sdkSkipReasons,
-        error: resultError
+        error: resultError,
+        capabilityResolution
       } = result;
       const isBinary = bodyEncoding === "base64";
       const bodyBytes = isBinary && bodyRaw ? Buffer.from(bodyRaw, "base64") : void 0;
@@ -146765,6 +146930,36 @@ var fetchCommand = (appContext) => new Command("fetch").description(
           log2(`Warning: ${w2}`);
         }
       }
+      if (fetchOrigin === "direct_url") {
+        if (capabilityResolution?.resolved) {
+          capabilityUid = capabilityResolution.capabilityId ?? capabilityUid;
+          capabilitySlug = capabilityResolution.capabilitySlug ?? capabilitySlug;
+          analyticsService.capture("capability_resolution_recovered", {
+            url: redactUrl(resolvedUrl),
+            method,
+            capabilityUid: capabilityResolution.capabilityId,
+            capabilitySlug: capabilityResolution.capabilitySlug,
+            matchedVia: capabilityResolution.matchedVia
+          });
+        } else {
+          if (walletAddress && !runId) {
+            cliSkipReasons.push(
+              "no capability resolved \u2014 pass --capability <uid|slug> or run `zero search` first so the URL can be matched"
+            );
+          }
+          const lastSearch = stateService.loadLastSearch();
+          const cached2 = lastSearch?.capabilities ?? [];
+          analyticsService.capture("capability_resolution_missed", {
+            url: redactUrl(resolvedUrl),
+            method,
+            hasLastSearch: lastSearch !== null,
+            lastSearchSize: cached2.length,
+            lastSearchHasTemplates: cached2.some(
+              (c) => Boolean(c.urlTemplate)
+            )
+          });
+        }
+      }
       analyticsService.capture("fetch_executed", {
         url: redactUrl(resolvedUrl),
         status: status ?? void 0,
@@ -146897,6 +147092,8 @@ var fetchCommand = (appContext) => new Command("fetch").description(
             `    --value     1-5            Was it worth the price? (1 = overpriced, 5 = great deal)`,
             `    --reliability 1-5          Did it respond quickly and without errors? (1 = flaky, 5 = rock solid)`,
             `    --content                  Free-text is optional but helps other agents pick the best capability.`,
+            `                               Published publicly \u2014 do not include personal or identifying`,
+            `                               information (names, emails, phone numbers, addresses, keys, SSNs).`,
             ``
           ].join("\n")
         );
@@ -147049,22 +147246,6 @@ var sampleValueFor = (fieldName, propSchema, depth = 0) => {
   }
 };
 var placeholderFor = (fieldName, propSchema) => String(sampleValueFor(fieldName, propSchema));
-var extractInputEnvelope = (bodySchema, method) => {
-  const root = asNode(bodySchema);
-  if (!root) return {};
-  const props = asNode(root.properties);
-  if (!props) return {};
-  const inputProps = asNode(asNode(props.input)?.properties);
-  if (inputProps) {
-    return {
-      queryParams: asNode(inputProps.queryParams) ?? void 0,
-      body: asNode(inputProps.body) ?? void 0
-    };
-  }
-  const upperMethod = method.toUpperCase();
-  const isGetLike = upperMethod === "GET" || upperMethod === "DELETE";
-  return isGetLike ? { queryParams: root } : { body: root };
-};
 var schemaTypeLabel = (node) => {
   const t = node.type;
   if (typeof t === "string") return t;
@@ -147206,7 +147387,9 @@ var buildResponseSection = (capability) => {
 var buildVerifiedExampleSection = (capability) => {
   const req = capability.example?.request;
   if (req === void 0 || req === null) return [];
-  const json3 = typeof req === "string" ? req : JSON.stringify(req);
+  const shown = unwrapTransportEnvelope(req);
+  if (shown === void 0 || shown === null) return [];
+  const json3 = typeof shown === "string" ? shown : JSON.stringify(shown);
   const truncated = json3.length > 600 ? `${json3.slice(0, 600)}\u2026` : json3;
   return ["", "Verified example (request):", `  ${truncated}`];
 };
@@ -147293,7 +147476,7 @@ var getCommand = (appContext) => new Command("get").description(
 ).argument(
   "<identifier>",
   "Position number from search results, or a capability slug"
-).option("--formatted", "Output formatted capability details").option(
+).option("--formatted", "Output formatted capability details").option("--json", "Output raw JSON to stdout (default)").option(
   "--agent <name>",
   "Identify your agent host for this invocation. Overrides auto-detect for this call only."
 ).action(async (identifier, options) => {
@@ -147330,7 +147513,7 @@ var getCommand = (appContext) => new Command("get").description(
     const capability = await client.capabilities.get(capabilityId, {
       searchId
     });
-    if (options.formatted) {
+    if (options.formatted && !options.json) {
       console.log(formatCapability(capability));
     } else {
       console.log(JSON.stringify(capability, null, 2));
@@ -147665,6 +147848,8 @@ Tips for a great review:
   --value     1-5            Was it worth the price? (1 = overpriced, 5 = great deal)
   --reliability 1-5          Did it respond quickly and without errors? (1 = flaky, 5 = rock solid)
   --content                  Free-text is optional but helps other agents pick the best capability.
+                             Published publicly \u2014 do not include personal or identifying information
+                             (names, emails, phone numbers, addresses, keys, SSNs).
 
 Examples:
   zero review run_abc123 --success --accuracy 5 --value 4 --reliability 5 --content "Fast, accurate translation"
@@ -147834,6 +148019,109 @@ Bulk review complete: ${ok} ok, ${failed} failed`);
   }
 );
 
+// src/commands/run-command.ts
+init_esm_shims();
+var readSkillMd = async (webBase) => {
+  const home = homedir();
+  for (const dir of SKILL_DIRS) {
+    const path3 = join(home, dir, "zero", "SKILL.md");
+    if (existsSync(path3)) return readFileSync(path3, "utf8");
+  }
+  const res = await fetch(`${webBase}/SKILL.md`);
+  if (!res.ok) throw new Error(`Failed to fetch SKILL.md: ${res.status}`);
+  return res.text();
+};
+var installCodexSkill = (skill) => {
+  const dir = join(homedir(), ".codex", "skills", "zero");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, "SKILL.md"), skill, "utf8");
+};
+var resolveZeroBinary = () => {
+  const runner = process.env.ZERO_RUNNER;
+  if (runner && existsSync(runner)) return runner;
+  const fallback2 = join(homedir(), ".zero", "runtime", "bin", "zero");
+  if (existsSync(fallback2)) return fallback2;
+  return "zero";
+};
+var prepareHandoff = async (appContext, opts) => {
+  const { client } = appContext.services;
+  const webBase = appContext.env.ZERO_WEB_URL;
+  const apiUrl = appContext.env.ZERO_API_URL;
+  await ensureAuthenticated(client, opts.open);
+  const skill = await readSkillMd(webBase);
+  const zeroBin = resolveZeroBinary();
+  const { ZERO_ENV: _drop, ...parentEnv } = process.env;
+  const childEnv = { ...parentEnv };
+  childEnv.ZERO_RUNNER = zeroBin !== "zero" ? zeroBin : childEnv.ZERO_RUNNER ?? "zero";
+  if (zeroBin !== "zero") {
+    childEnv.PATH = `${dirname(zeroBin)}:${process.env.PATH ?? ""}`;
+  }
+  for (let i = 0; i < 20; i++) {
+    try {
+      const res = await fetch(`${apiUrl}/health`, {
+        signal: AbortSignal.timeout(2e3)
+      });
+      if (res.ok) break;
+    } catch {
+      await new Promise((r2) => setTimeout(r2, 500));
+    }
+  }
+  return { skill, childEnv };
+};
+var claudeCommand = (appContext) => new Command("claude").description(
+  "Open Claude Code with Zero capabilities pre-loaded \u2014 authenticate if needed, then hand off"
+).argument(
+  "[task...]",
+  "Initial task for Claude Code (starts an interactive session with this as the first message)"
+).option("--no-open", "Do not open the browser if sign-in is required").action(async (taskParts, opts) => {
+  const { skill, childEnv } = await prepareHandoff(appContext, opts);
+  const claudeArgs = ["--append-system-prompt", skill];
+  const task = taskParts.join(" ").trim();
+  if (task) claudeArgs.push(task);
+  const result = spawnSync("claude", claudeArgs, {
+    stdio: "inherit",
+    env: childEnv
+  });
+  if (result.error) {
+    process.stderr.write(
+      `
+Failed to launch Claude Code: ${result.error.message}
+Make sure it is installed: https://claude.ai/download
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (result.status !== null) process.exitCode = result.status;
+});
+var codexCommand = (appContext) => new Command("codex").description(
+  "Open Codex CLI with Zero capabilities pre-loaded \u2014 authenticate if needed, then hand off"
+).argument(
+  "[task...]",
+  "Initial task for Codex (starts an interactive session with this as the first message)"
+).option("--no-open", "Do not open the browser if sign-in is required").action(async (taskParts, opts) => {
+  const { skill, childEnv } = await prepareHandoff(appContext, opts);
+  installCodexSkill(skill);
+  const codexArgs = [];
+  const task = taskParts.join(" ").trim();
+  if (task) codexArgs.push(task);
+  const result = spawnSync("codex", codexArgs, {
+    stdio: "inherit",
+    env: childEnv
+  });
+  if (result.error) {
+    process.stderr.write(
+      `
+Failed to launch Codex: ${result.error.message}
+Make sure it is installed: https://openai.com/codex
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (result.status !== null) process.exitCode = result.status;
+});
+
 // src/commands/runs-command.ts
 init_esm_shims();
 var USD_ASSETS = /* @__PURE__ */ new Set(["USD", "USDC"]);
@@ -147850,6 +148138,48 @@ var formatPayment = (payment) => {
   const mode = payment.mode ? ` (${payment.mode})` : "";
   return `${payment.protocol}${chain2}${mode}`;
 };
+var formatDetail = (r2) => {
+  const lines = [];
+  const when = r2.createdAt.toISOString().replace("T", " ").slice(0, 19);
+  lines.push(`Run:        ${r2.runId}`);
+  lines.push(`When:       ${when}`);
+  lines.push(`Status:     ${r2.status ?? "\u2014"}`);
+  lines.push(`Latency:    ${r2.latencyMs != null ? `${r2.latencyMs}ms` : "\u2014"}`);
+  lines.push(`Result:     ${r2.errorClass ?? "\u2014"}`);
+  lines.push(`Reviewed:   ${r2.reviewed ? "yes" : "no"}`);
+  lines.push("");
+  lines.push(`Capability: ${r2.capability.name} (${r2.capability.slug})`);
+  lines.push(`URL:        ${r2.capability.method} ${r2.capability.url}`);
+  if (r2.capability.whatItDoes)
+    lines.push(`What:       ${r2.capability.whatItDoes}`);
+  if (r2.capability.tags.length > 0)
+    lines.push(`Tags:       ${r2.capability.tags.join(", ")}`);
+  if (r2.cost) {
+    const { amount: amount2, asset } = r2.cost;
+    lines.push(`Cost:       ${asset ? `${amount2} ${asset}` : amount2}`);
+  }
+  if (r2.payment) {
+    const chain2 = r2.payment.chain ? `:${r2.payment.chain}` : "";
+    const mode = r2.payment.mode ? ` (${r2.payment.mode})` : "";
+    const tx = r2.payment.txHash ? `  tx=${r2.payment.txHash}` : "";
+    lines.push(`Payment:    ${r2.payment.protocol}${chain2}${mode}${tx}`);
+  }
+  return lines.join("\n");
+};
+var runsDetailCommand = (appContext) => new Command("detail").description("Show full metadata for a single run").argument("<runId>", "Run ID (run_\u2026)").option("--json", "Output raw JSON to stdout").action(async (runId, options) => {
+  try {
+    const { client } = appContext.services;
+    const run = await client.runs.get(runId);
+    if (options.json) {
+      console.log(JSON.stringify(run, null, 2));
+      return;
+    }
+    console.log(formatDetail(run));
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : "Failed");
+    process.exitCode = 1;
+  }
+});
 var runsCommand = (appContext) => new Command("runs").description("List your recent capability runs").addHelpText(
   "after",
   `
@@ -147860,8 +148190,9 @@ Examples:
   zero runs                            # most recent runs
   zero runs --unreviewed               # filter to runs without a review
   zero runs --capability translate-en  # filter to one capability (uid or slug)
-  zero runs --json                     # full structured output for scripts`
-).option("--capability <id>", "Filter by capability uid or slug").option("--unreviewed", "Only show runs without a review").option(
+  zero runs --json                     # full structured output for scripts
+  zero runs detail <runId>             # full metadata for a single run`
+).addCommand(runsDetailCommand(appContext)).option("--capability <id>", "Filter by capability uid or slug").option("--unreviewed", "Only show runs without a review").option(
   "--limit <n>",
   "Max rows (1-100, default 25)",
   (v) => Number.parseInt(v, 10)
@@ -149234,6 +149565,8 @@ var createApp = (appContext) => {
   program2.addCommand(configCommand());
   program2.addCommand(termsCommand());
   program2.addCommand(authCommand(appContext));
+  program2.addCommand(claudeCommand(appContext));
+  program2.addCommand(codexCommand(appContext));
   return program2;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeroxyz/cli",
-	"version": "1.5.0",
+	"version": "1.7.0",
 	"type": "module",
 	"bin": {
 		"zero": "dist/index.js",