@odla-ai/cli 0.13.1 → 0.14.1

package/dist/index.d.cts

@@ -2,6 +2,99 @@ import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
 import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityIntentResponse, HostedSecurityPlan, HostedSecurityReport, HostedSecurityJobStatus } from '@odla-ai/security/hosted';
 export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
+/** One exact platform scope obtainable through the admin device flow. */
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:code:host:connect" | "platform:security:self";
+/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
+interface ScopedPlatformTokenOptions {
+    platform: string;
+    scope: ScopedPlatformScope;
+    /** Existing odla account email used only when a fresh handshake is required. */
+    email?: string;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    tokenFile?: string;
+    /** Keep the shown-once grant only in memory. */
+    cache?: boolean;
+    /** Human-visible purpose recorded on the exact handshake. */
+    label?: string;
+}
+/** Obtain/cache one exact platform scope without granting ambient admin. */
+declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
+
+/** Immutable, release-owned Pi adapter. No registry credential enters it. */
+declare const CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:713db58428bc05cb486167c5747de8fd826669c9b283ff78e0139ac194c3d058";
+/** Supported local isolation engines for an odla Code host runtime. */
+type CodeContainerEngine = "container" | "podman" | "docker";
+/** Immutable CaMeL-registered build recipe available to an agent container. */
+interface CodeBuildRule {
+    id: string;
+    image: string;
+    command: readonly string[];
+    timeoutMs: number;
+    maxOutputBytes: number;
+    cpus?: number;
+    memory?: string;
+    pids?: number;
+    tmpfsBytes?: number;
+}
+/** Bounded host facts reported on each outbound Code control-plane heartbeat. */
+interface CodeHostCapabilities {
+    protocolVersion: 1;
+    platform: "macos" | "linux";
+    arch: string;
+    engines: CodeContainerEngine[];
+    cpuCount: number;
+    memoryBytes: number;
+}
+/** Initial CaMeL-registered clean-build rule. App-specific recipes can replace
+ * this only after their own owner-visible registration flow exists. */
+declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
+type Output$1 = Pick<typeof console, "log" | "error">;
+/** Inputs for enrolling the current checkout and running its foreground Pi host. */
+interface CodeConnectOptions {
+    configPath: string;
+    /** Repository root. Defaults to the current directory. */
+    cwd?: string;
+    env?: string;
+    email?: string;
+    open?: boolean;
+    name?: string;
+    slots?: number;
+    engine?: CodeContainerEngine | "auto";
+    heartbeatMs?: number;
+    /** Enroll and prove one heartbeat without waiting for sessions. */
+    once?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Output$1;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    signal?: AbortSignal;
+    /** Test/embedding boundaries. */
+    getToken?: typeof getScopedPlatformToken;
+    selectEngine?: (requested: CodeContainerEngine | "auto") => Promise<CodeContainerEngine>;
+    runRuntime?: (input: CodeRuntimeInput) => Promise<void>;
+    readGitOrigin?: (cwd: string) => Promise<string>;
+}
+/** Authority and runtime boundaries used after a Code host enrollment succeeds. */
+interface CodeRuntimeInput {
+    endpoint: string;
+    token: string;
+    engine: CodeContainerEngine;
+    capabilities: CodeHostCapabilities;
+    heartbeatMs: number;
+    once: boolean;
+    signal?: AbortSignal;
+    stdout: Output$1;
+    fetch?: typeof fetch;
+}
+/** Enroll this machine from an odla project and keep the embedded Pi runtime
+ * online. Both the approval grant and host credential hashes are stored in
+ * odla-ai/db; plaintext host authority exists only in this running process. */
+declare function codeConnect(options: CodeConnectOptions): Promise<void>;
+/** Run outbound presence and fenced Pi commands without opening a listener. */
+declare function runCodeRuntime(input: CodeRuntimeInput): Promise<void>;
+
 /** Map a CLI failure to its process exit code: 75 (EX_TEMPFAIL) marks a
  * handshake that is still awaiting human approval — the pending state is
  * persisted and rerunning the same command resumes it — everything else is 1. */
@@ -14,6 +107,7 @@ interface CliDependencies {
     readGitOrigin?: (cwd: string) => Promise<string>;
     confirm?: (message: string) => Promise<boolean>;
     stdout?: Pick<typeof console, "log" | "error">;
+    codeConnect?: (options: CodeConnectOptions) => Promise<void>;
 }
 /**
  * Parse CLI arguments and dispatch the matching odla command.
@@ -28,23 +122,6 @@ interface CliDependencies {
  */
 declare function runCli(argv?: string[], dependencies?: CliDependencies): Promise<void>;
 
-/** One exact platform scope obtainable through the admin device flow. */
-type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:security:self";
-/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
-interface ScopedPlatformTokenOptions {
-    platform: string;
-    scope: ScopedPlatformScope;
-    /** Existing odla account email used only when a fresh handshake is required. */
-    email?: string;
-    open?: boolean;
-    fetch?: typeof fetch;
-    stdout?: Pick<typeof console, "log">;
-    openApprovalUrl?: (url: string) => Promise<void>;
-    tokenFile?: string;
-}
-/** Obtain/cache one exact platform scope without granting ambient admin. */
-declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
-
 /** Hosted platform purposes whose provider, model, and budgets an admin may route. */
 declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
 /** One catalog-validated, platform-funded System AI purpose. */
@@ -99,10 +176,10 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["start an email-bound device request without accepting a password or user session token", "register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links", "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)", "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
+    readonly cli: readonly ["start an email-bound device request without accepting a password or user session token", "register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "add or remove app co-owners, each of whom self-provisions their own credentials for the shared db without any secret handoff", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links", "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)", "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "install capability packages, mount their runtime routes, and make application-specific schema, rules, auth, UI, and migration decisions", "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"];
     readonly human: readonly ["provide the existing odla account email, then sign in and explicitly review/approve the exact device code", "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning", "approve GitHub App repository access separately from redacted-snippet disclosure"];
-    readonly studio: readonly ["view telemetry and environment state", "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them", "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
+    readonly studio: readonly ["view telemetry and environment state", "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them", "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens", "perform manual credential recovery — for the primary owner or any co-owner — when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
 };
 type Output = Pick<typeof console, "log">;
 /** Print the stable responsibility boundary for humans or agent tooling. */
@@ -671,8 +748,9 @@ interface HostedSecurityRequestOptions {
 interface ConnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
     appId: string;
     env: string;
-    /** Exact owner/name repository requested before GitHub approval. */
-    repository: string;
+    /** Optional owner/name cross-check. The server always scans the app's one
+     * Studio-connected repository; a mismatch fails the connect. */
+    repository?: string;
     /** false prints but does not launch the install URL. Defaults to true. */
     open?: boolean;
     openInstallUrl?: (url: string) => Promise<void>;
@@ -855,4 +933,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };

package/dist/index.d.ts

@@ -2,6 +2,99 @@ import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
 import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityIntentResponse, HostedSecurityPlan, HostedSecurityReport, HostedSecurityJobStatus } from '@odla-ai/security/hosted';
 export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
+/** One exact platform scope obtainable through the admin device flow. */
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:code:host:connect" | "platform:security:self";
+/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
+interface ScopedPlatformTokenOptions {
+    platform: string;
+    scope: ScopedPlatformScope;
+    /** Existing odla account email used only when a fresh handshake is required. */
+    email?: string;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    tokenFile?: string;
+    /** Keep the shown-once grant only in memory. */
+    cache?: boolean;
+    /** Human-visible purpose recorded on the exact handshake. */
+    label?: string;
+}
+/** Obtain/cache one exact platform scope without granting ambient admin. */
+declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
+
+/** Immutable, release-owned Pi adapter. No registry credential enters it. */
+declare const CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:713db58428bc05cb486167c5747de8fd826669c9b283ff78e0139ac194c3d058";
+/** Supported local isolation engines for an odla Code host runtime. */
+type CodeContainerEngine = "container" | "podman" | "docker";
+/** Immutable CaMeL-registered build recipe available to an agent container. */
+interface CodeBuildRule {
+    id: string;
+    image: string;
+    command: readonly string[];
+    timeoutMs: number;
+    maxOutputBytes: number;
+    cpus?: number;
+    memory?: string;
+    pids?: number;
+    tmpfsBytes?: number;
+}
+/** Bounded host facts reported on each outbound Code control-plane heartbeat. */
+interface CodeHostCapabilities {
+    protocolVersion: 1;
+    platform: "macos" | "linux";
+    arch: string;
+    engines: CodeContainerEngine[];
+    cpuCount: number;
+    memoryBytes: number;
+}
+/** Initial CaMeL-registered clean-build rule. App-specific recipes can replace
+ * this only after their own owner-visible registration flow exists. */
+declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
+type Output$1 = Pick<typeof console, "log" | "error">;
+/** Inputs for enrolling the current checkout and running its foreground Pi host. */
+interface CodeConnectOptions {
+    configPath: string;
+    /** Repository root. Defaults to the current directory. */
+    cwd?: string;
+    env?: string;
+    email?: string;
+    open?: boolean;
+    name?: string;
+    slots?: number;
+    engine?: CodeContainerEngine | "auto";
+    heartbeatMs?: number;
+    /** Enroll and prove one heartbeat without waiting for sessions. */
+    once?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Output$1;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    signal?: AbortSignal;
+    /** Test/embedding boundaries. */
+    getToken?: typeof getScopedPlatformToken;
+    selectEngine?: (requested: CodeContainerEngine | "auto") => Promise<CodeContainerEngine>;
+    runRuntime?: (input: CodeRuntimeInput) => Promise<void>;
+    readGitOrigin?: (cwd: string) => Promise<string>;
+}
+/** Authority and runtime boundaries used after a Code host enrollment succeeds. */
+interface CodeRuntimeInput {
+    endpoint: string;
+    token: string;
+    engine: CodeContainerEngine;
+    capabilities: CodeHostCapabilities;
+    heartbeatMs: number;
+    once: boolean;
+    signal?: AbortSignal;
+    stdout: Output$1;
+    fetch?: typeof fetch;
+}
+/** Enroll this machine from an odla project and keep the embedded Pi runtime
+ * online. Both the approval grant and host credential hashes are stored in
+ * odla-ai/db; plaintext host authority exists only in this running process. */
+declare function codeConnect(options: CodeConnectOptions): Promise<void>;
+/** Run outbound presence and fenced Pi commands without opening a listener. */
+declare function runCodeRuntime(input: CodeRuntimeInput): Promise<void>;
+
 /** Map a CLI failure to its process exit code: 75 (EX_TEMPFAIL) marks a
  * handshake that is still awaiting human approval — the pending state is
  * persisted and rerunning the same command resumes it — everything else is 1. */
@@ -14,6 +107,7 @@ interface CliDependencies {
     readGitOrigin?: (cwd: string) => Promise<string>;
     confirm?: (message: string) => Promise<boolean>;
     stdout?: Pick<typeof console, "log" | "error">;
+    codeConnect?: (options: CodeConnectOptions) => Promise<void>;
 }
 /**
  * Parse CLI arguments and dispatch the matching odla command.
@@ -28,23 +122,6 @@ interface CliDependencies {
  */
 declare function runCli(argv?: string[], dependencies?: CliDependencies): Promise<void>;
 
-/** One exact platform scope obtainable through the admin device flow. */
-type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:security:self";
-/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
-interface ScopedPlatformTokenOptions {
-    platform: string;
-    scope: ScopedPlatformScope;
-    /** Existing odla account email used only when a fresh handshake is required. */
-    email?: string;
-    open?: boolean;
-    fetch?: typeof fetch;
-    stdout?: Pick<typeof console, "log">;
-    openApprovalUrl?: (url: string) => Promise<void>;
-    tokenFile?: string;
-}
-/** Obtain/cache one exact platform scope without granting ambient admin. */
-declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
-
 /** Hosted platform purposes whose provider, model, and budgets an admin may route. */
 declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
 /** One catalog-validated, platform-funded System AI purpose. */
@@ -99,10 +176,10 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["start an email-bound device request without accepting a password or user session token", "register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links", "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)", "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
+    readonly cli: readonly ["start an email-bound device request without accepting a password or user session token", "register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "add or remove app co-owners, each of whom self-provisions their own credentials for the shared db without any secret handoff", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links", "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)", "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "install capability packages, mount their runtime routes, and make application-specific schema, rules, auth, UI, and migration decisions", "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"];
     readonly human: readonly ["provide the existing odla account email, then sign in and explicitly review/approve the exact device code", "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning", "approve GitHub App repository access separately from redacted-snippet disclosure"];
-    readonly studio: readonly ["view telemetry and environment state", "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them", "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
+    readonly studio: readonly ["view telemetry and environment state", "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them", "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens", "perform manual credential recovery — for the primary owner or any co-owner — when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
 };
 type Output = Pick<typeof console, "log">;
 /** Print the stable responsibility boundary for humans or agent tooling. */
@@ -671,8 +748,9 @@ interface HostedSecurityRequestOptions {
 interface ConnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
     appId: string;
     env: string;
-    /** Exact owner/name repository requested before GitHub approval. */
-    repository: string;
+    /** Optional owner/name cross-check. The server always scans the app's one
+     * Studio-connected repository; a mismatch fails the connect. */
+    repository?: string;
     /** false prints but does not launch the install URL. Defaults to true. */
     open?: boolean;
     openInstallUrl?: (url: string) => Promise<void>;
@@ -855,4 +933,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };

package/dist/index.js

@@ -2,6 +2,8 @@
 import {
   AGENT_HARNESSES,
   CAPABILITIES,
+  CODE_BUILD_RECIPES,
+  CODE_PI_IMAGE,
   GOOGLE_CALENDAR_EVENTS_SCOPE,
   SYSTEM_AI_PURPOSES,
   adminAi,
@@ -11,6 +13,7 @@ import {
   calendarDisconnect,
   calendarServiceConfig,
   calendarStatus,
+  codeConnect,
   connectGitHubSecuritySource,
   disconnectGitHubSecuritySource,
   doctor,
@@ -32,16 +35,19 @@ import {
   redactSecrets,
   repositoryFromGitRemote,
   runCli,
+  runCodeRuntime,
   runHostedSecurity,
   secretsPush,
   secretsSet,
   secretsSetClerkKey,
   smoke,
   startHostedSecurityJob
-} from "./chunk-I7XDJZB6.js";
+} from "./chunk-AN6KZMR5.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,
+  CODE_BUILD_RECIPES,
+  CODE_PI_IMAGE,
   GOOGLE_CALENDAR_EVENTS_SCOPE,
   SYSTEM_AI_PURPOSES,
   adminAi,
@@ -51,6 +57,7 @@ export {
   calendarDisconnect,
   calendarServiceConfig,
   calendarStatus,
+  codeConnect,
   connectGitHubSecuritySource,
   disconnectGitHubSecuritySource,
   doctor,
@@ -72,6 +79,7 @@ export {
   redactSecrets,
   repositoryFromGitRemote,
   runCli,
+  runCodeRuntime,
   runHostedSecurity,
   secretsPush,
   secretsSet,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.13.1",
+  "version": "0.14.1",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and sync lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",
@@ -59,10 +59,11 @@
   "dependencies": {
     "@odla-ai/ai": "^0.5.0",
     "@odla-ai/apps": "^0.8.1",
-    "@odla-ai/db": "^0.6.4",
+    "@odla-ai/db": ">=0.6.4",
     "@odla-ai/security": "^0.3.1"
   },
   "devDependencies": {
+    "@odla-ai/harness": "*",
     "@types/node": "^22.10.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",

package/skills/odla/SKILL.md

@@ -9,6 +9,7 @@ description: >
 runbookOrder:
   - references/build.md
   - references/sdks.md
+  - references/co-owners.md
 ---
 
 # odla
@@ -160,3 +161,6 @@ code, paste a publishable key, run a command) — and wait for a nod.
   exported TypeScript declarations/JSDoc (resolve entry points through its
   `package.json` `exports`). Rendered references are also public at
   `https://odla.ai/docs/packages/<pkg>`.
+- `references/co-owners.md` — sharing one app's db and tooling across a team:
+  `app owners add/list/remove`, and how each co-owner self-provisions their own
+  credentials (dev and the shared prod database) without any secret handoff.

package/skills/odla/references/co-owners.md

@@ -0,0 +1,61 @@
+# Co-owners — sharing one app's db and tooling
+
+An odla app can have more than one owner. The creator is the **primary owner**;
+everyone else is a **co-owner** with the *same* full access. This is how a team
+shares one database — dev and prod — with each person holding their own
+revocable credentials. No secret is ever copied between people.
+
+## The rule that makes this safe
+
+Each owner mints their **own** `ODLA_API_KEY`. You never send someone a
+`.dev.vars`, a `.odla/credentials.local.json`, or a key over chat. The registry
+records who co-owns an app; the db honors any co-owner when they provision.
+
+## Onboarding a co-owner
+
+1. **The primary owner adds them** (they must already be a signed-up odla
+   member — an admin invites them first if not):
+
+   ```cmd
+   npx @odla-ai/cli app owners add teammate@example.com
+   npx @odla-ai/cli app owners list
+   ```
+
+   (`npx @odla-ai/cli app owners remove teammate@example.com` revokes it. The
+   primary owner can't be removed. Studio's app **Settings** does the same.)
+
+2. **The co-owner provisions as themselves.** They clone the repo (which carries
+   `odla.config.mjs` but not the gitignored credentials) and run provision with
+   their *own* account email — the device grant is approved by them, not the
+   primary owner:
+
+   ```cmd
+   npx @odla-ai/cli provision --email teammate@example.com --write-dev-vars --push-secrets
+   ```
+
+   provision verifies the existing app (it does not re-create it), mints the
+   co-owner's own db/o11y credentials for the shared tenant, writes their local
+   `.dev.vars`, and transfers secrets to their Worker. They can now
+   `npm run dev` and, at the production checkpoint, deploy.
+
+## Production is one shared database
+
+Every environment's tenant is the same across all owners (prod's tenant is the
+bare app id; `dev` is `<appId>--dev`). So multiple co-owners deploying to
+**production** all read and write the **same** prod database — each with their
+own key. Treat first-prod provision/deploy as the usual human checkpoint
+(`provision --dry-run` review, then `provision --yes --push-secrets`), and never
+rotate another owner's credentials on their behalf.
+
+## If provision says "you are not an owner"
+
+provision checks tenant admin access up front and aborts **before** anything is
+minted or written — no credential lands on disk, in the vault, or in a Worker.
+It means the registry doesn't list you as an owner yet: ask an existing owner
+to run `npx @odla-ai/cli app owners add <your-email>`, then re-run provision.
+
+## If a co-owner loses their local key
+
+Keys are shown once and stored hashed — there is no reveal. Re-mint instead:
+re-run `provision` (or Studio's **mint API key**). Both work for any owner now,
+not just the creator.