@odla-ai/cli 0.10.0 → 0.10.1

package/README.md

@@ -29,13 +29,17 @@ For a project you keep working in, install it as a dev dependency so the
 shorter `npx odla-ai` form works and the version is pinned by your lockfile:
 
 ```bash
-npm view @odla-ai/cli@0.10.0 version
-npm i -D --save-exact @odla-ai/cli@0.10.0
+npm view @odla-ai/cli@0.10.1 version
+npm i -D --save-exact @odla-ai/cli@0.10.1
 ```
 
 ## Prerequisites
 
 - Node.js 20 or newer (`node --version`).
+- An existing odla account that has signed in at least once. For any command
+  that may need a fresh device grant, pass `--email <account>` or set
+  `ODLA_USER_EMAIL`. This value identifies who may review the request; it is not
+  a password or session credential, and an agent must never ask for either.
 - odla apps usually deploy as Cloudflare Workers. If you have never used
   Cloudflare:
   1. Create a free account at <https://dash.cloudflare.com/sign-up>.
@@ -61,7 +65,7 @@ npx odla-ai calendar disconnect --env dev --yes
 npx odla-ai capabilities --json
 # install SDKs, write the Worker, and create wrangler.jsonc before secret push
 npx odla-ai provision --dry-run
-npx odla-ai provision --write-dev-vars --push-secrets
+npx odla-ai provision --email owner@example.com --write-dev-vars --push-secrets
 npx odla-ai smoke --env dev
 npx odla-ai secrets push --env dev
 npx odla-ai secrets set clerk_webhook_secret --env dev --stdin
@@ -73,7 +77,7 @@ npx odla-ai security sources --env dev
 npx odla-ai security run --source <source-id> --ref main --env dev --plan-digest <digest-from-security-plan> --ack-redacted-source
 npx odla-ai security status <job-id>
 npx odla-ai security report <job-id>
-npx odla-ai admin ai show
+npx odla-ai admin ai show --email owner@example.com
 npx odla-ai admin ai models
 npx odla-ai admin ai set security --discovery-provider anthropic --discovery-model claude-opus-4-8 --validation-provider openai --validation-model gpt-5.5 --enabled
 npx odla-ai admin ai credentials
@@ -101,8 +105,11 @@ When using `--push-secrets`, create the Worker and its Wrangler config first.
 The CLI checks that config and `wrangler whoami` before it issues or rotates a
 shown-once credential.
 
-1. Gets an `odla_dev_...` token by device handshake, or reuses
-   `ODLA_DEV_TOKEN` / `.odla/dev-token.json`.
+1. Gets an `odla_dev_...` token by email-bound device handshake, or reuses
+   `ODLA_DEV_TOKEN` / `.odla/dev-token.json`. A fresh handshake requires
+   `--email <account>` or `ODLA_USER_EMAIL`; the matching existing account must
+   sign in, review the exact code, and approve it. Opening the URL alone does
+   not claim the request.
    In an interactive terminal it opens the approval page in your browser when
    the code is displayed. Pass `--open` to force browser launch from a
    non-interactive shell, or `--no-open` to suppress it. Browser launch is
@@ -138,6 +145,26 @@ The CLI preflights Wrangler first and persists the replacement before pushing;
 if that final push still fails, follow the printed `secrets push --env ...`
 retry. Do not run the rotation flag again.
 
+### Device-grant security and recovery
+
+The account email sent during a fresh handshake is a non-secret identity hint,
+not proof of identity. Unknown or never-signed-in accounts never produce a
+claimable Studio request, and the public start/poll shape intentionally does not
+reveal whether an account exists. The signed-in matching user must explicitly
+review the exact code before it becomes pending, and only one claimed pending
+or approved-but-uncollected request can be active for that user.
+
+Developer grants are tracked by id, owner, label, scopes, creation/expiry,
+last use, and revocation state. The plaintext token is delivered once to the
+polling client and is never available from the inventory. Every signed-in user
+can inspect and revoke their own grants under **Your agent credentials** in
+Studio; platform admins additionally see the global token inventory and
+metadata-only attempt evidence. Future requests with a revoked token fail.
+Deleting
+`.odla/dev-token.json` or `.odla/admin-token.local.json` removes the local copy
+but does not revoke a token already copied elsewhere, so use Studio revocation
+when compromise or accidental approval is possible.
+
 `smoke` verifies a provisioned environment from local credentials. It fetches
 the platform public config, checks the configured AI provider, fetches the live
 odla-db schema with the tenant key, compares expected schema entities, and runs

package/REQUIREMENTS.md

@@ -25,11 +25,27 @@ Agnacl, but none should mention or special-case Agnacl.
 
 - Provisioning must default to device-handshake auth, never a platform admin
   secret in chat or config.
-- The approval code must be printed in a copyable URL.
+- A fresh handshake must require the existing account email via `--email` or
+  `ODLA_USER_EMAIL`. Email is an identity hint, never a password or bearer
+  credential; agents must not request either from the human.
+- Unknown and never-signed-in accounts must not yield a claimable request, but
+  the public response must not disclose account existence.
+- The approval code must be printed in a copyable, server-supplied verification
+  URL. Opening it must not claim the request; the matching signed-in user must
+  explicitly review that exact code before approval controls appear.
+- Only one claimed pending or approved-but-uncollected request may be active per
+  user. Unclaimed issued codes must not occupy that slot.
 - Interactive provisioning should launch the browser to the approval page when
   possible. `--open` should force launch; `--no-open` should suppress it.
 - Cached developer tokens must be mode `0600`, gitignored, and reused until
   expiry.
+- Minted developer tokens must have a metadata-only inventory (owner, label,
+  scopes, created/expires/last-used/revoked state), immediate owner revocation,
+  and global admin incident response. Plaintext is shown only once and never
+  returned by inventory.
+- Handshake attempts must retain bounded metadata-only attribution using a
+  keyed requester fingerprint rather than a raw IP, with independent issue and
+  poll rate limits. Agents and developer tokens must not read this admin trail.
 
 ## Safe Provisioning
 

package/dist/bin.cjs

@@ -203,14 +203,16 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
     return cached.token;
   }
   const browser = approvalBrowser(options);
+  const email = handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0);
   const { token, expiresAt } = await (0, import_db.requestToken)({
     endpoint: cfg.platformUrl,
+    email,
     label: `${cfg.app.id} provisioner`,
     fetch: doFetch,
-    onCode: async ({ userCode, expiresIn }) => {
-      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
+    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
+      const approvalUrl = verificationUriComplete ?? handshakeUrl(cfg.platformUrl, userCode);
       out.log("");
-      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      out.log(`Review, then approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
       if (browser.open) {
         try {
           await (options.openApprovalUrl ?? openUrl)(approvalUrl);
@@ -224,10 +226,17 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
       out.log("");
     }
   });
-  writePrivateJson(cfg.local.tokenFile, { platform: audience, token, expiresAt });
+  writePrivateJson(cfg.local.tokenFile, { platform: audience, email, token, expiresAt });
   out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
+function handshakeEmail(value, cached) {
+  const email = (value ?? import_node_process2.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
+  }
+  return email;
+}
 function approvalBrowser(options) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
@@ -320,14 +329,16 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     out.log(`auth: using cached ${scope} grant (${tokenFile})`);
     return cached.token;
   }
+  const email = handshakeEmail(options.email, cache?.platform === audience ? cache.email : void 0);
   const { token, expiresAt } = await (0, import_db2.requestToken)({
     endpoint: audience,
+    email,
     label: `odla CLI admin AI (${scope})`,
     scopes: [scope],
     fetch: doFetch,
-    onCode: async ({ userCode, expiresIn }) => {
-      const approvalUrl = handshakeUrl(audience, userCode);
-      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
+      const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);
+      out.log(`Review, then approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
       const shouldOpen = options.open === true || options.open !== false && !import_node_process4.default.env.CI && Boolean(import_node_process4.default.stdin.isTTY && import_node_process4.default.stdout.isTTY);
       if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
     }
@@ -335,7 +346,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
   tokens[scope] = { token, expiresAt };
   if ((0, import_node_fs2.existsSync)(`${import_node_process4.default.cwd()}/.git`)) ensureGitignore(import_node_process4.default.cwd(), [tokenFile]);
-  writePrivateJson(tokenFile, { platform: audience, tokens });
+  writePrivateJson(tokenFile, { platform: audience, email, tokens });
   out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   return token;
 }
@@ -505,6 +516,7 @@ async function adminAi(options) {
     platform,
     scope,
     token: options.token,
+    email: options.email,
     open: options.open,
     fetch: doFetch,
     stdout: out,
@@ -764,6 +776,7 @@ async function adminCommand(parsed) {
     "platform",
     "json",
     "open",
+    "email",
     "provider",
     "model",
     "enabled",
@@ -791,6 +804,7 @@ async function adminCommand(parsed) {
     maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
     maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
     platform: stringOpt(parsed.options.platform),
+    email: stringOpt(parsed.options.email),
     json: parsed.options.json === true,
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
@@ -810,6 +824,7 @@ async function adminCommand(parsed) {
 // src/capabilities.ts
 var CAPABILITIES = {
   cli: [
+    "start an email-bound device request without accepting a password or user session token",
     "register the app and enable configured services per environment",
     "issue, persist, and explicitly rotate configured service credentials",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
@@ -828,7 +843,7 @@ var CAPABILITIES = {
     "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
   ],
   human: [
-    "approve the odla device code and one-off third-party logins",
+    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
     "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
     "consent to production changes with --yes",
     "request destructive credential rotation explicitly",
@@ -838,6 +853,7 @@ var CAPABILITIES = {
   ],
   studio: [
     "view telemetry and environment state",
+    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
     "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
     "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
     "configure system AI purposes and view app/environment/run-attributed usage",
@@ -1371,6 +1387,7 @@ async function lifecycleContext(options) {
     {
       configPath: cfg.configPath,
       token: options.token,
+      email: options.email,
       open: options.open,
       interactive: options.interactive,
       openApprovalUrl: options.openConsentUrl
@@ -1787,13 +1804,13 @@ Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
   odla-ai doctor [--config odla.config.mjs]
-  odla-ai calendar status [--env dev] [--json]
-  odla-ai calendar calendars [--env dev] [--json]
-  odla-ai calendar connect [--env dev] [--no-open] [--yes]
-  odla-ai calendar resync [--env dev] [--yes]
-  odla-ai calendar disconnect [--env dev] --yes
+  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
+  odla-ai calendar resync [--env dev] [--email <odla-account>] [--yes]
+  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
   odla-ai capabilities [--json]
-  odla-ai admin ai show [--platform https://odla.ai] [--json]
+  odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
   odla-ai admin ai models [--provider <id>] [--json]
   odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
   odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
@@ -1802,7 +1819,7 @@ Usage:
   odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
   odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
   odla-ai admin ai audit [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--no-open]
+  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai security github disconnect --source <id> [--env dev] [--yes]
   odla-ai security plan [--env dev] [--json]
   odla-ai security sources [--env dev] [--json]
@@ -1811,12 +1828,12 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--no-open]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
-  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
   odla-ai version
 
 Commands:
@@ -1844,6 +1861,10 @@ Safety:
   preflights Wrangler before any shown-once issuance or destructive rotation.
   Provision opens the approval page automatically in interactive terminals;
   use --open to force browser launch or --no-open to suppress it.
+  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
+  The email is a non-secret identity hint: never provide a password or session
+  token. The matching account must already exist, be signed in, explicitly
+  review the exact code, and finish any current request before claiming another.
   Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
   OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
   GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
@@ -2474,7 +2495,7 @@ async function hostedSecurityContext(parsed, dependencies) {
   const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
   const token = await getDeveloperToken(
     cfg,
-    { configPath, open, openApprovalUrl: dependencies.openUrl },
+    { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
     doFetch,
     stdout
   );
@@ -3092,6 +3113,7 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     "source",
     "ref",
     "follow",
+    "email",
     "open",
     "json",
     "ack-redacted-source",
@@ -3180,6 +3202,7 @@ async function runLocalSecurityCommand(parsed, dependencies) {
     "platform",
     "self",
     "ack-redacted-source",
+    "email",
     "open",
     "fail-on",
     "fail-on-candidates",
@@ -3209,6 +3232,7 @@ async function runLocalSecurityCommand(parsed, dependencies) {
         return getScopedPlatformToken({
           platform: request.platform,
           scope: request.scope,
+          email: stringOpt(parsed.options.email),
           open,
           fetch: doFetch,
           stdout: out,
@@ -3221,7 +3245,7 @@ async function runLocalSecurityCommand(parsed, dependencies) {
       }
       return getDeveloperToken(
         cfg,
-        { configPath, open, openApprovalUrl: dependencies.openUrl },
+        { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
         doFetch,
         out
       );
@@ -3255,7 +3279,7 @@ async function securityCommand(parsed, dependencies) {
     return;
   }
   if (sub === "plan") {
-    assertArgs(parsed, ["config", "env", "platform", "open", "json"], 2);
+    assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 2);
     const context = await hostedSecurityContext(parsed, dependencies);
     const plan = await getHostedSecurityPlan(context);
     if (parsed.options.json === true) context.stdout.log(JSON.stringify(plan, null, 2));
@@ -3271,7 +3295,7 @@ async function securityCommand(parsed, dependencies) {
     return;
   }
   if (sub === "report") {
-    assertArgs(parsed, ["config", "env", "platform", "open", "json"], 3);
+    assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
     const report = await getHostedSecurityReport({ ...context, jobId });
@@ -3289,7 +3313,7 @@ async function securityCommand(parsed, dependencies) {
 async function githubSecurityCommand(parsed, dependencies) {
   const action = parsed.positionals[2];
   if (action === "disconnect") {
-    assertArgs(parsed, ["config", "env", "platform", "source", "open", "yes"], 3);
+    assertArgs(parsed, ["config", "env", "platform", "source", "email", "open", "yes"], 3);
     const context2 = await hostedSecurityContext(parsed, dependencies);
     const sourceId = requiredString(parsed.options.source, "--source");
     const confirmed = parsed.options.yes === true || await interactiveConfirmation(
@@ -3306,7 +3330,7 @@ async function githubSecurityCommand(parsed, dependencies) {
   if (action !== "connect") {
     throw new Error('unknown security github command. Try "odla-ai security github connect".');
   }
-  assertArgs(parsed, ["config", "env", "platform", "repo", "open"], 3);
+  assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
   const context = await hostedSecurityContext(parsed, dependencies);
   const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin);
   const connection = await connectGitHubSecuritySource({
@@ -3321,7 +3345,7 @@ async function githubSecurityCommand(parsed, dependencies) {
   context.stdout.log("github: odla.ai stores the installation; no PAT or GitHub token is written locally");
 }
 async function listSecuritySources(parsed, dependencies) {
-  assertArgs(parsed, ["config", "env", "platform", "open", "json"], 2);
+  assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 2);
   const context = await hostedSecurityContext(parsed, dependencies);
   const [plan, sources] = await Promise.all([
     getHostedSecurityPlan(context),
@@ -3343,7 +3367,7 @@ source	repository	default ref	status`);
   }
 }
 async function securityStatus(parsed, dependencies) {
-  assertArgs(parsed, ["config", "env", "platform", "open", "json", "follow"], 3);
+  assertArgs(parsed, ["config", "env", "platform", "email", "open", "json", "follow"], 3);
   const jobId = requiredSecurityPositional(parsed, 2, "job id");
   const context = await hostedSecurityContext(parsed, dependencies);
   const job = parsed.options.follow === true ? await followHostedSecurityJob({
@@ -3646,6 +3670,7 @@ async function smoke(options) {
       {
         configPath: cfg.configPath,
         token: options.token,
+        email: options.email,
         open: options.open,
         interactive: options.interactive,
         openApprovalUrl: options.openApprovalUrl
@@ -3793,11 +3818,12 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     return;
   }
   if (command === "smoke") {
-    assertArgs(parsed, ["config", "env", "token", "open"], 1);
+    assertArgs(parsed, ["config", "env", "token", "email", "open"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       env: stringOpt(parsed.options.env),
       token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
       open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
       openApprovalUrl: dependencies.openUrl,
       fetch: dependencies.fetch,
@@ -3835,7 +3861,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   if (command === "secrets") {
     const sub = parsed.positionals[1];
     if (sub === "set" || sub === "set-clerk-key") {
-      assertArgs(parsed, ["config", "env", "from-env", "stdin", "token", "yes"], sub === "set" ? 3 : 2);
+      assertArgs(parsed, ["config", "env", "from-env", "stdin", "token", "email", "yes"], sub === "set" ? 3 : 2);
       const options = {
         configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
         name: parsed.positionals[2],
@@ -3843,6 +3869,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
         fromEnv: stringOpt(parsed.options["from-env"]),
         stdin: parsed.options.stdin === true,
         token: stringOpt(parsed.options.token),
+        email: stringOpt(parsed.options.email),
         yes: parsed.options.yes === true,
         fetch: dependencies.fetch,
         stdout: dependencies.stdout
@@ -3876,6 +3903,7 @@ async function provisionCommand(parsed, dependencies) {
     "write-credentials",
     "write-dev-vars",
     "token",
+    "email",
     "open",
     "yes"
   ], 1);
@@ -3889,6 +3917,7 @@ async function provisionCommand(parsed, dependencies) {
     writeCredentials: parsed.options["write-credentials"] !== false,
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     yes: parsed.options.yes === true,
     fetch: dependencies.fetch,
@@ -3902,13 +3931,14 @@ async function calendarCommand(parsed, dependencies) {
   if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "resync" && sub !== "disconnect") {
     throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
   }
-  assertArgs(parsed, ["config", "env", "json", "token", "open", "yes"], 2);
+  assertArgs(parsed, ["config", "env", "json", "token", "email", "open", "yes"], 2);
   if (sub !== "status" && sub !== "calendars" && parsed.options.json !== void 0) throw new Error(`--json is supported only by calendar status/calendars`);
   if ((sub === "status" || sub === "calendars") && parsed.options.yes !== void 0) throw new Error(`--yes is not used by "calendar ${sub}"`);
   const options = {
     configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
     env: stringOpt(parsed.options.env),
     token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     yes: parsed.options.yes === true,
     json: parsed.options.json === true,