@odla-ai/cli 0.17.1 → 0.18.0

package/dist/index.d.cts

@@ -3,7 +3,7 @@ import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, Hosted
 export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
 /** One exact platform scope obtainable through the admin device flow. */
-type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self";
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self" | "platform:runbook:write";
 /** Inputs for obtaining one short-lived, exact-scope platform device grant. */
 interface ScopedPlatformTokenOptions {
     platform: string;
@@ -15,6 +15,15 @@ interface ScopedPlatformTokenOptions {
     stdout?: Pick<typeof console, "log">;
     openApprovalUrl?: (url: string) => Promise<void>;
     tokenFile?: string;
+    /**
+     * Project root the grant cache hangs off, mirroring how the developer token
+     * resolves `.odla/dev-token.json` against the loaded config's `rootDir`.
+     * Callers with a project should pass `cfg.rootDir`: without it the cache
+     * follows the shell's working directory rather than the project, so the same
+     * command run from a subdirectory reads a different cache — and writes a
+     * credential file wherever it happened to be standing.
+     */
+    rootDir?: string;
     /** Keep the shown-once grant only in memory. */
     cache?: boolean;
     /** Human-visible purpose recorded on the exact handshake. */
@@ -165,6 +174,9 @@ interface CliDependencies {
     confirm?: (message: string) => Promise<boolean>;
     stdout?: Pick<typeof console, "log" | "error">;
     codeConnect?: (options: CodeConnectOptions) => Promise<void>;
+    /** Runs git in the working directory; injected so `runbook impact` can be
+     * driven over a fixed diff instead of whatever the checkout happens to be. */
+    runGit?: (args: string[]) => string;
 }
 /**
  * Parse CLI arguments and dispatch the matching odla command.
@@ -180,7 +192,7 @@ interface CliDependencies {
 declare function runCli(argv?: string[], dependencies?: CliDependencies): Promise<void>;
 
 /** Hosted platform purposes whose provider, model, and budgets an admin may route. */
-declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
+declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation", "runbook.answer"];
 /** One catalog-validated, platform-funded System AI purpose. */
 type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
 

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, Hosted
 export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
 /** One exact platform scope obtainable through the admin device flow. */
-type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self";
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self" | "platform:runbook:write";
 /** Inputs for obtaining one short-lived, exact-scope platform device grant. */
 interface ScopedPlatformTokenOptions {
     platform: string;
@@ -15,6 +15,15 @@ interface ScopedPlatformTokenOptions {
     stdout?: Pick<typeof console, "log">;
     openApprovalUrl?: (url: string) => Promise<void>;
     tokenFile?: string;
+    /**
+     * Project root the grant cache hangs off, mirroring how the developer token
+     * resolves `.odla/dev-token.json` against the loaded config's `rootDir`.
+     * Callers with a project should pass `cfg.rootDir`: without it the cache
+     * follows the shell's working directory rather than the project, so the same
+     * command run from a subdirectory reads a different cache — and writes a
+     * credential file wherever it happened to be standing.
+     */
+    rootDir?: string;
     /** Keep the shown-once grant only in memory. */
     cache?: boolean;
     /** Human-visible purpose recorded on the exact handshake. */
@@ -165,6 +174,9 @@ interface CliDependencies {
     confirm?: (message: string) => Promise<boolean>;
     stdout?: Pick<typeof console, "log" | "error">;
     codeConnect?: (options: CodeConnectOptions) => Promise<void>;
+    /** Runs git in the working directory; injected so `runbook impact` can be
+     * driven over a fixed diff instead of whatever the checkout happens to be. */
+    runGit?: (args: string[]) => string;
 }
 /**
  * Parse CLI arguments and dispatch the matching odla command.
@@ -180,7 +192,7 @@ interface CliDependencies {
 declare function runCli(argv?: string[], dependencies?: CliDependencies): Promise<void>;
 
 /** Hosted platform purposes whose provider, model, and budgets an admin may route. */
-declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
+declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation", "runbook.answer"];
 /** One catalog-validated, platform-funded System AI purpose. */
 type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
 

package/dist/index.js

@@ -43,7 +43,7 @@ import {
   secretsSetClerkKey,
   smoke,
   startHostedSecurityJob
-} from "./chunk-2UKO2NED.js";
+} from "./chunk-TOSMNGGQ.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,