Commands

Connect and configure

Set up providers and control which models participate in routing.

• veto loginConnect a provider interactively — browser-based OAuth where supported, masked key entry otherwise. Local OpenAI-compatible models register here too, with their real text-only boundaries.
• veto logoutRemove a configured provider or a local model from ~/.veto/.
• veto disable <model…>Exclude one or more models from all routing without deleting their configuration.
• veto enable <model…>Re-include a previously disabled model.
• veto setupDiscover and approve skill files from your skill directories. Only approved sources ever contribute execution skills — this is the approval boundary.

Route and execute

The core loop: route selects, run executes one task, exec executes a plan.

• veto route "…" Route only. Filters candidates, asks survivors for admission, and prints the selected model — never executes. Use --json for one machine-readable result line, --max-cost for a preflight cost ceiling, --runtime to restrict to one executable runtime. $ veto route --json "summarize this PR"
• veto run "…" Route a task and execute it with the winning model; the response prints to stdout. Key flags: --kind, --risk, --max-cost, --timeout, --max-output-tokens, --output (the only way run writes a file), and --criteria for a fail-closed post-execution review. $ veto run --quiet "extract all TODO comments" > todos.txt
• veto exec <plan.md> Execute a multi-step plan file, routing each step independently. Steps declare kind, risk, dependencies, and success criteria in frontmatter; --dry-run previews, --on-failure controls abort behavior. Malformed plans are offered an automatic conversion through the best available model. $ veto exec my-plan.md --dry-run

Integrations

Native plugins route turns inside OpenCode and Hermes without copying credentials or changing provider settings.

• veto opencode <connect|status|disconnect>Manage an OpenCode runtime connection. Veto talks to the local server; no credentials are copied.
• veto opencode plugin <install|status|uninstall>Manage automatic routing, commands, and tools inside OpenCode.
• veto hermes plugin <install|status|uninstall>Manage the explicit native Hermes plugin without changing Hermes provider settings.
• veto install-git-hookAdd veto to your git workflow so routine commit tasks route automatically.

Inspect and maintain

Know exactly what is configured, what it costs, and whether your installation is healthy.

• veto providersShow which providers are configured and how they authenticate.
• veto models [--json] [--offline]List effective models, their runtimes, tool knowledge, and known/unknown prices — the three states stay distinct.
• veto verify-modelsVerify catalog IDs against one provider account with a redacted raw capture workflow.
• veto benchmarkReplay the offline routing corpus and emit JSON metrics — no network, no provider spend.
• veto doctorDiagnose installation and local-state integrity; --fix repairs only safe problems.
• veto feedbackSave a redacted diagnostic report and prepare a prefilled GitHub issue.
• veto analytics status · enable · disableShow the local seven-day diagnostic ledger and set the explicit preference for any future remote analytics export. Nothing is sent today — no remote transport exists.
• veto versionPrint the veto version.

Task kinds

Kinds guide filtering and skill matching. Auto-detected when you omit --kind.

• extract pull structured data
• summarize condense content
• code-change write or modify code
• debug diagnose and fix
• plan break down work
• review code review, analysis
• refactor restructure safely

Full flag tables

Every flag, default, and safety boundary for run, exec, and route lives in the README — kept alongside the code it documents.