@odla-ai/cli 0.14.1 → 0.16.0

package/README.md

@@ -29,8 +29,8 @@ For a project you keep working in, install it as a dev dependency so the
 shorter `npx odla-ai` form works and the version is pinned by your lockfile:
 
 ```bash
-npm view @odla-ai/cli@0.13.0 version
-npm i -D --save-exact @odla-ai/cli@0.13.0
+npm view @odla-ai/cli@0.16.0 version
+npm i -D --save-exact @odla-ai/cli@0.16.0
 ```
 
 ## Prerequisites
@@ -63,7 +63,7 @@ npx odla-ai calendar connect --env dev
 npx odla-ai calendar resync --env dev
 npx odla-ai calendar disconnect --env dev --yes
 npx odla-ai capabilities --json
-npx odla-ai code connect --env dev --email owner@example.com
+npx odla-ai code connect --platform https://odla.ai --app-id my-app --env dev --email owner@example.com
 npx odla-ai code connect --env prod --once # bounded enrollment + heartbeat proof
 # install SDKs, write the Worker, and create wrangler.jsonc before secret push
 npx odla-ai provision --dry-run
@@ -90,20 +90,27 @@ npx odla-ai skill install
 npx odla-ai version
 ```
 
-`code connect` is the first-party Code host runtime. Run it from a GitHub
-checkout already connected to an app in Studio; it resolves the origin to that
-project without requiring local config. If `odla.config.mjs` exists, its app is
-used explicitly. The CLI chooses the safe installed container
-engine (Apple container or Podman by default), requests one exact
-`platform:code:host:connect` approval, atomically enrolls/offers/binds the host,
-then runs the credentialless Pi container adapter in the foreground. The Pi and
-clean-build images are digest-pinned, and build execution goes through a fixed
-CaMeL-registered recipe. Use `--engine docker` only after reviewing that daemon
-boundary. `--once` performs enrollment and one heartbeat without accepting a
-queued session.
+`code connect` is the first-party personal Code terminal runtime. Run the exact
+command copied from **Studio → Code → Terminal** while your shell is in the
+local Git checkout. `--platform`, `--app-id`, and `--env` make the requested
+scope unambiguous; without an explicit app, the CLI can infer it from
+`odla.config.mjs` or the Git remote. The terminal proves its isolation engine,
+prepares the pinned Pi and build images, and sends an outbound
+`app:code:host:connect` request to odla. The app owner approves that real
+request in Studio. The browser never mints or displays a host bearer.
+
+After approval, the foreground process secret-filters tracked and non-ignored
+source into a bounded staged snapshot. Harness operates on that frozen copy;
+the original checkout is never mounted into Pi. Pi receives no network,
+provider credential, or container-engine socket and accesses source only
+through the typed CaMeL broker. The session records the trusted Git base,
+developer-patch digest, snapshot digest, and the combined checkpoint patch.
+Later local edits do not silently alter an active session. Use `--engine
+docker` only after reviewing that daemon boundary. `--once` proves enrollment
+and one heartbeat without accepting queued work.
 
 The approval and host credential records live in odla-ai/db and store hashes,
-not plaintext. The shown-once host bearer is kept only in the running CLI
+not plaintext. The collected host bearer exists only in the running CLI
 process: no Code credential file is created under `.odla/`. A subsequent
 approved `code connect` rotates the database-backed credential and invalidates
 the previous bearer.