@odla-ai/cli 0.16.3 → 0.16.5

package/README.md

@@ -29,8 +29,8 @@ For a project you keep working in, install it as a dev dependency so the
 shorter `npx odla-ai` form works and the version is pinned by your lockfile:
 
 ```bash
-npm view @odla-ai/cli@0.16.3 version
-npm i -D --save-exact @odla-ai/cli@0.16.3
+npm view @odla-ai/cli@0.16.5 version
+npm i -D --save-exact @odla-ai/cli@0.16.5
 ```
 
 ## Prerequisites
@@ -95,7 +95,8 @@ command copied from **Studio → Code → Terminal** while your shell is in the
 local Git checkout. `--platform`, `--app-id`, and `--env` make the requested
 scope unambiguous; without an explicit app, the CLI can infer it from
 `odla.config.mjs` or the Git remote. The terminal proves its isolation engine,
-prepares the pinned Pi and build images, and sends an outbound
+builds the CLI-bundled Pi adapter into a content-addressed local image, prepares
+the digest-pinned build images, and sends an outbound
 `app:code:host:connect` request to odla. The app owner approves that real
 request in Studio. The browser never mints or displays a host bearer.
 
@@ -105,9 +106,11 @@ the original checkout is never mounted into Pi. Pi receives no network,
 provider credential, or container-engine socket and accesses source only
 through the typed CaMeL broker. The session records the trusted Git base,
 developer-patch digest, snapshot digest, and the combined checkpoint patch.
-Later local edits do not silently alter an active session. Use `--engine
-docker` only after reviewing that daemon boundary. `--once` proves enrollment
-and one heartbeat without accepting queued work.
+Later local edits do not silently alter an active session. The Pi adapter does
+not come from a private registry and `code connect` never logs the developer
+into one; the only first-run image download is its public, digest-pinned Node
+base. Use `--engine docker` only after reviewing that daemon boundary. `--once`
+proves enrollment and one heartbeat without accepting queued work.
 
 The approval and host credential records live in odla-ai/db and store hashes,
 not plaintext. The collected host bearer exists only in the running CLI

package/dist/bin.cjs

@@ -1939,8 +1939,8 @@ function printStatus(status, json, out) {
 
 // src/code-connect.ts
 var import_node_fs7 = require("fs");
-var import_node_os = require("os");
-var import_node_path4 = require("path");
+var import_node_os2 = require("os");
+var import_node_path5 = require("path");
 
 // ../harness/dist/chunk-QTUEF2HZ.js
 var HARNESS_PROTOCOL_VERSION = 1;
@@ -2023,7 +2023,7 @@ function encodeAgentInput(message2) {
 `;
 }
 
-// ../harness/dist/chunk-IRFCMVKU.js
+// ../harness/dist/chunk-IONC45N6.js
 var import_child_process = require("child_process");
 var import_fs = require("fs");
 var import_promises2 = require("fs/promises");
@@ -2076,7 +2076,7 @@ async function selectContainerEngine(requested = "auto", options = {}) {
     throw new TypeError("no rootless Podman found; install Podman or explicitly choose --engine docker after reviewing its daemon boundary");
   }
   if (platform === "darwin") {
-    throw new TypeError("no Apple container or Podman Machine found; install one or explicitly choose --engine docker");
+    throw new TypeError("Apple container is not installed; on Apple Silicon macOS 26 run `brew install container`, then retry (Podman Machine is the fallback)");
   }
   throw new TypeError("no supported container engine found");
 }
@@ -2481,7 +2481,7 @@ async function captureGitDiff(root, maxBytes) {
   if (code !== 0 && code !== 1) {
     throw new Error(`git diff failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
   }
-  return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
+  return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
 async function stageWorkspace(source, options = {}) {
   const sourceDir = await (0, import_promises4.realpath)((0, import_path4.resolve)(source));
@@ -2540,7 +2540,7 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
   }
 }
 
-// ../harness/dist/chunk-4MOSEKB6.js
+// ../harness/dist/chunk-QGDLTDYH.js
 var import_crypto = require("crypto");
 var import_promises5 = require("fs/promises");
 var import_path5 = require("path");
@@ -2877,7 +2877,7 @@ function validateSnapshot(snapshot, limits) {
   }
 }
 
-// ../harness/dist/chunk-4MOSEKB6.js
+// ../harness/dist/chunk-QGDLTDYH.js
 var import_child_process4 = require("child_process");
 var import_promises6 = require("fs/promises");
 var import_path6 = require("path");
@@ -3170,7 +3170,7 @@ function looksLikeDestination(value) {
   return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text);
 }
 
-// ../harness/dist/chunk-4MOSEKB6.js
+// ../harness/dist/chunk-QGDLTDYH.js
 var import_crypto4 = require("crypto");
 async function digestStagedWorkspace(root, limits) {
   const files = [];
@@ -4536,6 +4536,7 @@ function runtimeResultError(value) {
 var CodePiRuntimeEngine = class {
   constructor(options) {
     this.options = options;
+    if (options.imageAuthorization === "cli_embedded" && !/^odla-ai\/pi-agent:embedded-sha256-[0-9a-f]{64}$/.test(options.image)) throw new TypeError("CLI-embedded Pi image must use its content-addressed local tag");
     this.#run = options.runAttempt ?? runContainerAttempt;
     this.#buildPolicyDigest = digestRuntimeValue(JSON.stringify(options.recipes));
     this.#checkpoints = new CodeRuntimeCheckpointManager({
@@ -4701,6 +4702,7 @@ var CodePiRuntimeEngine = class {
     const result = await this.#run({
       engine: this.options.engine,
       image: this.options.image,
+      allowUnpinnedImage: this.options.imageAuthorization === "cli_embedded",
       workspaceDir: active.workspace.workspaceDir,
       workspaceAccess: "none",
       task: lease.task,
@@ -5210,23 +5212,18 @@ function digestText(value) {
 
 // src/code-images.ts
 var import_node_child_process4 = require("child_process");
-async function prepareCodeImages(engine, images) {
-  for (const image of images) {
-    await new Promise((accept, reject) => {
-      const args = engine === "container" ? ["image", "pull", image] : ["pull", image];
-      (0, import_node_child_process4.execFile)(engine, args, { encoding: "utf8", maxBuffer: 2 * 1024 * 1024, timeout: 10 * 6e4 }, (error) => {
-        if (error) reject(new Error(`could not prepare pinned Code image ${image}`));
-        else accept();
-      });
-    });
-  }
-}
+var import_node_crypto2 = require("crypto");
+var import_promises10 = require("fs/promises");
+var import_node_os = require("os");
+var import_node_path4 = require("path");
+var import_node_url2 = require("url");
 
 // src/code-runtime-config.ts
-var CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:2a52a1c8eed66ad167e7bccab4d603ed8fcd75c42dddfb320083436ed89b7c9c";
+var CODE_PI_IMAGE = "odla-ai/pi-agent:embedded";
+var CODE_NODE_IMAGE = "node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd";
 var CODE_BUILD_RECIPES = Object.freeze([{
   id: "odla-code-contracts",
-  image: "node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd",
+  image: CODE_NODE_IMAGE,
   command: [
     "node",
     // The clean source mount deliberately has no node_modules. Reuse the
@@ -5246,10 +5243,84 @@ var CODE_BUILD_RECIPES = Object.freeze([{
   pids: 128
 }]);
 
+// src/code-images.ts
+var runCodeImageCommand = (command, args, stdio) => new Promise((accept, reject) => {
+  const child = (0, import_node_child_process4.spawn)(command, [...args], { shell: false, stdio });
+  child.once("error", reject);
+  child.once("exit", (code, signal) => {
+    if (code === 0) accept();
+    else reject(new Error(`${command} ${args.join(" ")} exited ${code ?? signal ?? "without a status"}`));
+  });
+});
+async function prepareCodeImages(engine, images, run = runCodeImageCommand, buildEmbedded = buildEmbeddedPiImage, nameEmbedded = embeddedPiImageName) {
+  if (engine === "container") {
+    try {
+      await run(engine, ["system", "start"], "inherit");
+    } catch {
+      throw new Error("Apple container could not start; run `container system start` once to complete its lightweight VM setup, then retry");
+    }
+  }
+  const prepared = [];
+  for (const image of images) {
+    const runtimeImage = image === CODE_PI_IMAGE ? await nameEmbedded() : image;
+    const inspectArgs = ["image", "inspect", runtimeImage];
+    try {
+      await run(engine, inspectArgs, "ignore");
+      prepared.push(runtimeImage);
+      continue;
+    } catch {
+    }
+    if (image === CODE_PI_IMAGE) {
+      try {
+        await buildEmbedded(engine, runtimeImage, run);
+      } catch (error) {
+        const detail = error instanceof Error && error.message ? `: ${error.message}` : "";
+        throw new Error(`could not prepare CLI-embedded Code image${detail}`);
+      }
+      prepared.push(runtimeImage);
+      continue;
+    }
+    const args = engine === "container" ? ["image", "pull", image] : ["pull", image];
+    try {
+      await run(engine, args, "inherit");
+    } catch (error) {
+      const detail = error instanceof Error && error.message ? `: ${error.message}` : "";
+      throw new Error(`could not prepare pinned Code image ${image}${detail}`);
+    }
+    prepared.push(image);
+  }
+  return prepared;
+}
+function embeddedPiAssetPath() {
+  return (0, import_node_url2.fileURLToPath)(new URL("./runtime/pi-agent.js", importMetaUrl));
+}
+async function embeddedPiImageName() {
+  const bundle = await (0, import_promises10.readFile)(embeddedPiAssetPath()).catch(() => {
+    throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
+  });
+  return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto2.createHash)("sha256").update(bundle).digest("hex")}`;
+}
+async function buildEmbeddedPiImage(engine, image, run) {
+  const context = await (0, import_promises10.mkdtemp)((0, import_node_path4.join)((0, import_node_os.tmpdir)(), "odla-code-pi-"));
+  try {
+    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path4.join)(context, "pi-agent.js"));
+    await (0, import_promises10.writeFile)((0, import_node_path4.join)(context, "Dockerfile"), [
+      `FROM ${CODE_NODE_IMAGE}`,
+      "COPY pi-agent.js /opt/odla/pi-agent.js",
+      "WORKDIR /workspace",
+      'ENTRYPOINT ["node", "/opt/odla/pi-agent.js"]',
+      ""
+    ].join("\n"), { mode: 384 });
+    await run(engine, ["build", "--tag", image, context], "inherit");
+  } finally {
+    await (0, import_promises10.rm)(context, { recursive: true, force: true });
+  }
+}
+
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path4.resolve)(cwd, options.configPath);
+  const configPath = (0, import_node_path5.resolve)(cwd, options.configPath);
   const cfg = (0, import_node_fs7.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
@@ -5278,12 +5349,13 @@ async function codeConnect(options) {
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
   const engine = await (options.selectEngine ?? selectContainerEngine)(options.engine ?? "auto");
-  await (options.prepareImages ?? prepareCodeImages)(engine, [
-    CODE_PI_IMAGE,
-    ...new Set(CODE_BUILD_RECIPES.map((recipe2) => recipe2.image))
-  ]);
+  const [piImage] = await (options.prepareImages ?? prepareCodeImages)(
+    engine,
+    [CODE_PI_IMAGE, ...new Set(CODE_BUILD_RECIPES.map((recipe2) => recipe2.image))]
+  );
+  if (!piImage || !/^odla-ai\/pi-agent:embedded-sha256-[0-9a-f]{64}$/.test(piImage)) throw new Error("Code image preflight did not produce the content-addressed embedded Pi runtime");
   const hostPlatform = process.platform === "darwin" ? "macos" : "linux";
-  const hostName = (options.name ?? (0, import_node_os.hostname)()).trim();
+  const hostName = (options.name ?? (0, import_node_os2.hostname)()).trim();
   if (!hostName || hostName.length > 120) throw new Error("--name must contain 1 to 120 characters");
   const repository = await inferGitHubRepository(cwd, options.readGitOrigin);
   const localSource = await (options.prepareLocalSource ?? prepareCodeLocalSource)(
@@ -5320,12 +5392,13 @@ async function codeConnect(options) {
       platform: hostPlatform,
       arch: process.arch,
       engines: [engine],
-      cpuCount: (0, import_node_os.cpus)().length,
-      memoryBytes: (0, import_node_os.totalmem)(),
+      cpuCount: (0, import_node_os2.cpus)().length,
+      memoryBytes: (0, import_node_os2.totalmem)(),
       source: descriptor2,
       images: {
         ready: true,
-        pi: CODE_PI_IMAGE,
+        pi: piImage,
+        piSource: "cli_embedded",
         recipes: CODE_BUILD_RECIPES.map((recipe2) => ({ id: recipe2.id, image: recipe2.image }))
       }
     };
@@ -5340,6 +5413,7 @@ async function codeConnect(options) {
       engine,
       capabilities,
       localSource,
+      piImage,
       heartbeatMs,
       once: options.once === true,
       signal: options.signal,
@@ -5369,7 +5443,8 @@ async function runCodeRuntime(input) {
   const commandEngine = new CodePiRuntimeEngine({
     control,
     engine: input.engine,
-    image: CODE_PI_IMAGE,
+    image: input.piImage ?? input.capabilities.images.pi,
+    imageAuthorization: "cli_embedded",
     recipes: CODE_BUILD_RECIPES,
     recipeAuthorization: "registered_recipe",
     localSource: input.localSource,
@@ -5466,12 +5541,12 @@ async function codeCommand(parsed, dependencies) {
 // src/doctor-checks.ts
 var import_node_child_process6 = require("child_process");
 var import_node_fs9 = require("fs");
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process5 = require("child_process");
 var import_node_fs8 = require("fs");
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process5.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -5485,7 +5560,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path5.join)(rootDir, name);
+    const path = (0, import_node_path6.join)(rootDir, name);
     if ((0, import_node_fs8.existsSync)(path)) return path;
   }
   return null;
@@ -5591,10 +5666,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path6.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path6.resolve)(rootDir)) {
+      const dir = (0, import_node_path7.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path7.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs9.existsSync)((0, import_node_path6.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs9.existsSync)((0, import_node_path7.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -5629,7 +5704,7 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path6.resolve)(rootDir, config.main) : null;
+  const main = typeof config.main === "string" ? (0, import_node_path7.resolve)(rootDir, config.main) : null;
   if (!main || !(0, import_node_fs9.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
@@ -5659,7 +5734,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_path6.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_path7.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -5861,11 +5936,11 @@ function harnessOption(value, flag) {
 
 // src/init.ts
 var import_node_fs10 = require("fs");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path7.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path7.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  const rootDir = (0, import_node_path8.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path8.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
   if ((0, import_node_fs10.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
@@ -5876,12 +5951,12 @@ function initProject(options) {
   const services = options.services?.length ? options.services : ["db", "ai"];
   if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs10.mkdirSync)((0, import_node_path7.dirname)(configPath), { recursive: true });
-  (0, import_node_fs10.mkdirSync)((0, import_node_path7.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs10.mkdirSync)((0, import_node_path7.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs10.mkdirSync)((0, import_node_path8.dirname)(configPath), { recursive: true });
+  (0, import_node_fs10.mkdirSync)((0, import_node_path8.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs10.mkdirSync)((0, import_node_path8.resolve)(rootDir, ".odla"), { recursive: true });
   (0, import_node_fs10.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path7.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path7.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  writeIfMissing((0, import_node_path8.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path8.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
@@ -6531,7 +6606,7 @@ async function resolveVaultWrite(options) {
 }
 
 // src/security-command-context.ts
-var import_promises10 = require("readline/promises");
+var import_promises11 = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -6557,7 +6632,7 @@ async function hostedSecurityContext(parsed, dependencies) {
 async function interactiveConfirmation(message2, dependencies) {
   if (dependencies.confirm) return dependencies.confirm(message2);
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = (0, import_promises10.createInterface)({ input: process.stdin, output: process.stdout });
+  const prompt = (0, import_promises11.createInterface)({ input: process.stdin, output: process.stdout });
   try {
     const answer = await prompt.question(`${message2} [y/N] `);
     return /^y(?:es)?$/i.test(answer.trim());
@@ -6684,7 +6759,7 @@ function hostedSeverity(value, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -6696,9 +6771,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path8.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path8.resolve)(options.out ?? (0, import_node_path8.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path8.relative)(target, output).split(import_node_path8.sep).join("/");
+  const target = (0, import_node_path9.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path9.resolve)(options.out ?? (0, import_node_path9.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path9.relative)(target, output).split(import_node_path9.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -6710,7 +6785,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path8.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path9.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -6728,7 +6803,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path8.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path9.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -6752,7 +6827,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path8.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path9.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -6781,7 +6856,7 @@ function printSummary(out, appId, env, run, report2, output) {
   out.log(`  coverage: ${report2.coverageStatus} ${complete}/${report2.coverage.length} blocked=${report2.metrics.blockedCells} shallow=${report2.metrics.shallowCells} unscheduled=${report2.metrics.unscheduledCells} budget_exhausted=${report2.metrics.budgetExhaustedCells}`);
   if (report2.callBudget) out.log(`  calls: discovery=${formatBudget(report2.callBudget.discovery)} validation=${formatBudget(report2.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report2.metrics.confirmed} needs_reproduction=${report2.metrics.needsReproduction} candidates=${report2.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path8.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path9.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -7220,9 +7295,9 @@ async function securityStatus(parsed, dependencies) {
 
 // src/skill.ts
 var import_node_fs11 = require("fs");
-var import_node_os2 = require("os");
-var import_node_path9 = require("path");
-var import_node_url2 = require("url");
+var import_node_os3 = require("os");
+var import_node_path10 = require("path");
+var import_node_url3 = require("url");
 
 // src/skill-adapters.ts
 var PROJECT_INSTRUCTIONS = `<!-- odla-ai agent setup:start -->
@@ -7278,12 +7353,12 @@ runbook. Do not substitute a remote documentation page for the installed copy.
 var AGENT_HARNESSES = ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
 function installSkill(options = {}) {
   const out = options.stdout ?? console;
-  const sourceDir = options.sourceDir ?? (0, import_node_url2.fileURLToPath)(new URL("../skills", importMetaUrl));
+  const sourceDir = options.sourceDir ?? (0, import_node_url3.fileURLToPath)(new URL("../skills", importMetaUrl));
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path9.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path9.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
+  const root = (0, import_node_path10.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path10.resolve)(options.homeDir ?? (0, import_node_os3.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -7297,48 +7372,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path9.join)(targetDir2, rel), (0, import_node_fs11.readFileSync)((0, import_node_path9.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path10.join)(targetDir2, rel), (0, import_node_fs11.readFileSync)((0, import_node_path10.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path9.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path9.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path9.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path10.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path10.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path10.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path9.dirname)((0, import_node_path9.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path10.dirname)((0, import_node_path10.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path9.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path10.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path9.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path10.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs11.readFileSync)((0, import_node_path9.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path9.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs11.readFileSync)((0, import_node_path10.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path10.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path9.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path10.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path9.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path10.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path9.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path10.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path9.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path10.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -7374,7 +7449,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!(0, import_node_fs11.existsSync)(file.target) || (0, import_node_fs11.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs11.mkdirSync)((0, import_node_path9.dirname)(file.target), { recursive: true });
+      (0, import_node_fs11.mkdirSync)((0, import_node_path10.dirname)(file.target), { recursive: true });
       (0, import_node_fs11.writeFileSync)(file.target, file.content);
     }
   }
@@ -7394,7 +7469,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path9.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path9.sep}`) && !(0, import_node_path9.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path10.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path10.sep}`) && !(0, import_node_path10.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -7439,13 +7514,13 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path9.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path9.sep}`) || (0, import_node_path9.isAbsolute)(rel)) {
+  const rel = (0, import_node_path10.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path10.sep}`) || (0, import_node_path10.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path9.sep).filter(Boolean)) {
-    current = (0, import_node_path9.join)(current, part);
+  for (const part of rel.split(import_node_path10.sep).filter(Boolean)) {
+    current = (0, import_node_path10.join)(current, part);
     try {
       if ((0, import_node_fs11.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -7462,9 +7537,9 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of (0, import_node_fs11.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path9.join)(current, entry.name);
+      const path = (0, import_node_path10.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path9.relative)(dir, path));
+      else results.push((0, import_node_path10.relative)(dir, path));
     }
   };
   walk(dir);