@odla-ai/cli 0.24.0 → 0.25.0

package/dist/index.cjs

@@ -613,23 +613,23 @@ function adminAiAuditQuery(filters) {
   }
   return `?limit=${filters.limit}`;
 }
-async function readAdminAiAudit(request) {
-  const response2 = await request.fetch(`${request.platform}/registry/platform/ai-audit${request.query}`, {
-    headers: request.headers
+async function readAdminAiAudit(request2) {
+  const response2 = await request2.fetch(`${request2.platform}/registry/platform/ai-audit${request2.query}`, {
+    headers: request2.headers
   });
   const body = await responseBody(response2);
   if (!response2.ok) throw new Error(apiError(response2.status, body));
-  if (request.json) {
-    request.stdout.log(JSON.stringify(body, null, 2));
+  if (request2.json) {
+    request2.stdout.log(JSON.stringify(body, null, 2));
     return;
   }
   const events = isRecord(body) && Array.isArray(body.events) ? body.events.filter(isRecord) : [];
-  request.stdout.log("when	change	target	before -> after	actor");
+  request2.stdout.log("when	change	target	before -> after	actor");
   for (const event of events) {
     const before = isRecord(event.oldPolicy) ? event.oldPolicy : void 0;
     const after = isRecord(event.newPolicy) ? event.newPolicy : void 0;
     const route2 = before && after ? `${String(before.provider)}/${String(before.model)}@v${String(before.version)} -> ${String(after.provider)}/${String(after.model)}@v${String(after.version)}` : "value not retained";
-    request.stdout.log([
+    request2.stdout.log([
       timestamp(event.createdAt),
       String(event.changeKind ?? ""),
       String(event.purpose ?? event.provider ?? ""),
@@ -685,14 +685,14 @@ function adminAiUsageQuery(filters) {
   const query = params.toString();
   return query ? `?${query}` : "";
 }
-async function readAdminAiUsage(request) {
-  const res = await request.fetch(`${request.platform}/registry/platform/ai-usage${request.query}`, {
-    headers: request.headers
+async function readAdminAiUsage(request2) {
+  const res = await request2.fetch(`${request2.platform}/registry/platform/ai-usage${request2.query}`, {
+    headers: request2.headers
   });
   const body = await responseBody2(res);
   if (!res.ok) throw new Error(apiError2("read platform AI usage", res.status, body));
-  if (request.json) request.stdout.log(JSON.stringify(body, null, 2));
-  else printUsage(body, request.stdout);
+  if (request2.json) request2.stdout.log(JSON.stringify(body, null, 2));
+  else printUsage(body, request2.stdout);
 }
 function usageLimit(value) {
   if (!Number.isSafeInteger(value) || value < 1 || value > 500) {
@@ -3154,10 +3154,10 @@ function installSkill(options = {}) {
     current.add(target);
     targets.set(harness, current);
   };
-  const plan = (target, content, managedMerge = false, boundary = root) => {
+  const plan = (target, content2, managedMerge = false, boundary = root) => {
     const existing = plans.get(target);
-    if (existing && existing.content !== content) throw new Error(`internal agent setup conflict for ${target}`);
-    plans.set(target, { target, content, boundary, managedMerge });
+    if (existing && existing.content !== content2) throw new Error(`internal agent setup conflict for ${target}`);
+    plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
     for (const rel of files) plan((0, import_node_path8.join)(targetDir2, rel), (0, import_node_fs10.readFileSync)((0, import_node_path8.join)(sourceDir, rel), "utf8"), false, boundary);
@@ -3943,11 +3943,11 @@ async function gitBlobs(cwd, entries, maxBytes) {
     if (!Number.isSafeInteger(length) || length < 0 || newline + 1 + length >= output.length) {
       throw new Error("git object output has an invalid length");
     }
-    const content = output.subarray(newline + 1, newline + 1 + length);
+    const content2 = output.subarray(newline + 1, newline + 1 + length);
     if (output[newline + 1 + length] !== 10) throw new Error("git object output is malformed");
-    total += content.byteLength;
+    total += content2.byteLength;
     if (total > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
-    blobs.push(content);
+    blobs.push(content2);
     offset = newline + 1 + length + 1;
   }
   return blobs;
@@ -3970,13 +3970,13 @@ async function materializeGitTree(source, commitSha, options = {}) {
   try {
     const blobs = await gitBlobs(sourceDir, entries, maxBytes);
     for (const [index, entry] of entries.entries()) {
-      const content = blobs[index];
-      byteCount += content.byteLength;
+      const content2 = blobs[index];
+      byteCount += content2.byteLength;
       if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
       const target = (0, import_path2.resolve)(targetRoot, entry.path);
       if (!target.startsWith(`${(0, import_path2.resolve)(targetRoot)}${import_path2.sep}`)) throw new TypeError("Git tree path escapes workspace");
       await (0, import_promises3.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
-      await (0, import_promises3.writeFile)(target, content, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
+      await (0, import_promises3.writeFile)(target, content2, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
     }
     return {
       root,
@@ -4354,11 +4354,11 @@ var ID2 = /^[A-Za-z0-9._:-]{1,180}$/;
 var MAX_PATCH_BYTES = 256 * 1024;
 var MAX_STATE_BYTES = 64 * 1024;
 async function createCodePortableCheckpoint(input) {
-  const state = normalizeState(input.state);
+  const state2 = normalizeState(input.state);
   validateBaseAndPatch(input.baseCommitSha, input.patch);
   const patchDigest = `sha256:${await sha256Hex(input.patch)}`;
-  const stateDigest = `sha256:${await sha256Hex(canonicalJson(state))}`;
-  const fields = { schemaVersion: 1, baseCommitSha: input.baseCommitSha, patchDigest, state, stateDigest };
+  const stateDigest = `sha256:${await sha256Hex(canonicalJson(state2))}`;
+  const fields = { schemaVersion: 1, baseCommitSha: input.baseCommitSha, patchDigest, state: state2, stateDigest };
   const checkpointDigest = `sha256:${await sha256Hex(canonicalJson(fields))}`;
   return freeze({ ...fields, patch: input.patch, checkpointDigest });
 }
@@ -4379,8 +4379,8 @@ async function verifyCodePortableCheckpoint(value) {
   return created;
 }
 function normalizeState(value) {
-  const state = object(value, "state");
-  exact2(state, [
+  const state2 = object(value, "state");
+  exact2(state2, [
     "planCursor",
     "conversationRefs",
     "planningInputDigest",
@@ -4392,13 +4392,13 @@ function normalizeState(value) {
     "unresolvedApprovals",
     "trustStatus"
   ]);
-  const planCursor = state.planCursor;
-  const conversations = strings(state.conversationRefs, "conversationRefs", ID2, 256, false);
-  const approvals = strings(state.unresolvedApprovals, "unresolvedApprovals", DIGEST2, 256, true);
-  if (planCursor !== null && (typeof planCursor !== "string" || !ID2.test(planCursor)) || typeof state.planningInputDigest !== "string" || !DIGEST2.test(state.planningInputDigest) || typeof state.buildPolicyDigest !== "string" || !DIGEST2.test(state.buildPolicyDigest) || state.dependencyLayerDigest !== null && (typeof state.dependencyLayerDigest !== "string" || !DIGEST2.test(state.dependencyLayerDigest)) || state.verificationDigest !== null && (typeof state.verificationDigest !== "string" || !DIGEST2.test(state.verificationDigest)) || state.reviewDigest !== null && (typeof state.reviewDigest !== "string" || !DIGEST2.test(state.reviewDigest)) || !["candidate_untrusted", "verified", "reviewed"].includes(String(state.trustStatus)) || !Array.isArray(state.completedEffects) || state.completedEffects.length > 256) {
+  const planCursor = state2.planCursor;
+  const conversations = strings(state2.conversationRefs, "conversationRefs", ID2, 256, false);
+  const approvals = strings(state2.unresolvedApprovals, "unresolvedApprovals", DIGEST2, 256, true);
+  if (planCursor !== null && (typeof planCursor !== "string" || !ID2.test(planCursor)) || typeof state2.planningInputDigest !== "string" || !DIGEST2.test(state2.planningInputDigest) || typeof state2.buildPolicyDigest !== "string" || !DIGEST2.test(state2.buildPolicyDigest) || state2.dependencyLayerDigest !== null && (typeof state2.dependencyLayerDigest !== "string" || !DIGEST2.test(state2.dependencyLayerDigest)) || state2.verificationDigest !== null && (typeof state2.verificationDigest !== "string" || !DIGEST2.test(state2.verificationDigest)) || state2.reviewDigest !== null && (typeof state2.reviewDigest !== "string" || !DIGEST2.test(state2.reviewDigest)) || !["candidate_untrusted", "verified", "reviewed"].includes(String(state2.trustStatus)) || !Array.isArray(state2.completedEffects) || state2.completedEffects.length > 256) {
     throw invalid2("Portable checkpoint state is malformed or outside its bounds.");
   }
-  const effects = state.completedEffects.map((item) => {
+  const effects = state2.completedEffects.map((item) => {
     const effect = object(item, "completed effect");
     exact2(effect, ["effectId", "actionDigest", "receiptDigest"]);
     if (typeof effect.effectId !== "string" || !ID2.test(effect.effectId) || typeof effect.actionDigest !== "string" || !DIGEST2.test(effect.actionDigest) || typeof effect.receiptDigest !== "string" || !DIGEST2.test(effect.receiptDigest)) {
@@ -4413,18 +4413,18 @@ function normalizeState(value) {
   if (new Set(effects.map((item) => item.effectId)).size !== effects.length) {
     throw invalid2("Portable checkpoint repeats a completed effect.");
   }
-  const trustStatus = state.trustStatus;
-  if (trustStatus === "candidate_untrusted" && (state.verificationDigest !== null || state.reviewDigest !== null) || trustStatus === "verified" && (state.verificationDigest === null || state.reviewDigest !== null) || trustStatus === "reviewed" && (state.verificationDigest === null || state.reviewDigest === null)) {
+  const trustStatus = state2.trustStatus;
+  if (trustStatus === "candidate_untrusted" && (state2.verificationDigest !== null || state2.reviewDigest !== null) || trustStatus === "verified" && (state2.verificationDigest === null || state2.reviewDigest !== null) || trustStatus === "reviewed" && (state2.verificationDigest === null || state2.reviewDigest === null)) {
     throw invalid2("Portable checkpoint trust status does not match its evidence digests.");
   }
   const normalized = {
     planCursor,
     conversationRefs: conversations,
-    planningInputDigest: state.planningInputDigest,
-    buildPolicyDigest: state.buildPolicyDigest,
-    dependencyLayerDigest: state.dependencyLayerDigest,
-    verificationDigest: state.verificationDigest,
-    reviewDigest: state.reviewDigest,
+    planningInputDigest: state2.planningInputDigest,
+    buildPolicyDigest: state2.buildPolicyDigest,
+    dependencyLayerDigest: state2.dependencyLayerDigest,
+    verificationDigest: state2.verificationDigest,
+    reviewDigest: state2.reviewDigest,
     completedEffects: effects,
     unresolvedApprovals: approvals,
     trustStatus
@@ -4541,60 +4541,60 @@ async function createConversionRegistry(config) {
     policies.set(policy.conversionId, Object.freeze(policy));
   }
   const outputCounts = /* @__PURE__ */ new Map();
-  const get = (id, kind) => {
+  const get2 = (id, kind) => {
     const policy = policies.get(id);
     if (!policy || policy.output.kind !== kind) throw new CamelError("conversion_rejected", "Conversion policy is missing or has the wrong output kind.");
     return policy;
   };
   const checked = (source, id, kind) => {
-    const policy = get(id, kind);
+    const policy = get2(id, kind);
     if (utf8Length(source.value) > policy.maximumSourceBytes) throw new CamelError("limit_exceeded", "Unsafe conversion input exceeds its byte bound.");
     return policy;
   };
-  const emit2 = (source, policy, value) => convert(source, policy, value, outputCounts);
+  const emit3 = (source, policy, value) => convert(source, policy, value, outputCounts);
   const operations = Object.freeze({
     boolean: async (value, id) => {
       const policy = checked(value, id, "boolean");
-      return emit2(value, policy, requireBoolean(value.value));
+      return emit3(value, policy, requireBoolean(value.value));
     },
     integer: async (value, id) => {
       const policy = checked(value, id, "integer");
-      return emit2(value, policy, boundedInteger(value.value, policy.output));
+      return emit3(value, policy, boundedInteger(value.value, policy.output));
     },
     finiteNumber: async (value, id) => {
       const policy = checked(value, id, "finite_number");
-      return emit2(value, policy, boundedNumber(value.value, policy.output));
+      return emit3(value, policy, boundedNumber(value.value, policy.output));
     },
     enum: async (value, id) => {
       const policy = checked(value, id, "enum");
-      return emit2(value, policy, enumMember(value.value, policy.output));
+      return emit3(value, policy, enumMember(value.value, policy.output));
     },
     date: async (value, id) => {
       const policy = checked(value, id, "date");
-      return emit2(value, policy, canonicalDate(value.value, policy.output));
+      return emit3(value, policy, canonicalDate(value.value, policy.output));
     },
     registeredId: async (value, id) => {
       const policy = checked(value, id, "registered_id");
       const registry = config.registeredIds?.[policy.output.registryId];
       const output = typeof value.value === "string" ? registry?.values[value.value] : void 0;
       if (!output) throw new CamelError("conversion_rejected", "Registered-ID conversion rejected the candidate.");
-      return emit2(value, policy, output);
+      return emit3(value, policy, output);
     },
     digest: async (value, id) => {
       const policy = checked(value, id, "digest");
       if (!(value.value instanceof Uint8Array)) throw new CamelError("conversion_rejected", "Digest conversion requires bytes.");
-      return emit2(value, policy, await sha256Hex(value.value));
+      return emit3(value, policy, await sha256Hex(value.value));
     },
     measure: async (value, metric, id) => {
       const policy = checked(value, id, "integer");
       const measured = measure(value.value, metric);
-      return emit2(value, policy, boundedInteger(measured, policy.output));
+      return emit3(value, policy, boundedInteger(measured, policy.output));
     },
     test: async (value, predicateId, id) => {
       const policy = checked(value, id, "boolean");
       const predicate = config.predicates?.[predicateId];
       if (!predicate) throw new CamelError("conversion_rejected", "Predicate is not registered.");
-      return emit2(value, policy, evaluatePredicate(value.value, predicate, config.registeredIds));
+      return emit3(value, policy, evaluatePredicate(value.value, predicate, config.registeredIds));
     }
   });
   return Object.freeze({ operations, policy: (id) => policies.get(id) ?? missingPolicy() });
@@ -4813,11 +4813,11 @@ async function digestStagedWorkspace(root, limits) {
   const hash = (0, import_crypto.createHash)("sha256");
   let bytes = 0;
   for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
-    const content = await (0, import_promises5.readFile)(file.target);
-    bytes += Buffer.byteLength(file.path) + content.byteLength;
+    const content2 = await (0, import_promises5.readFile)(file.target);
+    bytes += Buffer.byteLength(file.path) + content2.byteLength;
     if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
-    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content.byteLength}:`);
-    hash.update(content);
+    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content2.byteLength}:`);
+    hash.update(content2);
   }
   return `sha256:${hash.digest("hex")}`;
 }
@@ -4912,13 +4912,13 @@ function createCodeRuntimeControlClient(options) {
   if (!Number.isSafeInteger(modelRequestTimeoutMs) || modelRequestTimeoutMs < 3e4 || modelRequestTimeoutMs > 30 * 6e4) {
     throw new TypeError("modelRequestTimeoutMs must be an integer from 30000 to 1800000");
   }
-  const request = options.fetch ?? fetch;
+  const request2 = options.fetch ?? fetch;
   const call2 = async (path, body, timeoutMs = requestTimeoutMs) => {
     const timeout = AbortSignal.timeout(timeoutMs);
     const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
     let response2;
     try {
-      response2 = await request(`${endpoint}${path}`, {
+      response2 = await request2(`${endpoint}${path}`, {
         method: "POST",
         headers: { authorization: `Bearer ${options.token}`, "content-type": "application/json" },
         body: JSON.stringify(body),
@@ -5825,34 +5825,34 @@ function createCodeToolBroker(options) {
   const policy = createCodePolicyGate(options);
   let tail = Promise.resolve();
   return {
-    execute(context, request) {
-      const result = tail.then(() => route(context, request, options, recipes, policy));
+    execute(context, request2) {
+      const result = tail.then(() => route(context, request2, options, recipes, policy));
       tail = result.then(() => void 0, () => void 0);
       return result;
     }
   };
 }
-async function route(context, request, options, recipes, policy) {
+async function route(context, request2, options, recipes, policy) {
   try {
     if (context.signal?.aborted) throw new TypeError("tool request was cancelled");
-    if (request.tool === "sandbox.read") return await read(context, request, options, policy);
-    if (request.tool === "sandbox.apply_patch") return await patch(context, request, options, policy);
-    return await recipe(context, request, options, recipes, policy);
+    if (request2.tool === "sandbox.read") return await read(context, request2, options, policy);
+    if (request2.tool === "sandbox.apply_patch") return await patch(context, request2, options, policy);
+    return await recipe(context, request2, options, recipes, policy);
   } catch (reason) {
-    return response(request, false, reason instanceof TypeError ? reason.message : "tool failed closed");
+    return response(request2, false, reason instanceof TypeError ? reason.message : "tool failed closed");
   }
 }
-async function read(context, request, options, policy) {
-  exactKeys(request.input, ["path", "startLine", "endLine"]);
-  const path = stringField(request.input, "path");
-  const startLine = optionalInteger(request.input.startLine) ?? 1;
-  const endLine = optionalInteger(request.input.endLine) ?? startLine + (options.maxReadLines ?? 2e3) - 1;
+async function read(context, request2, options, policy) {
+  exactKeys(request2.input, ["path", "startLine", "endLine"]);
+  const path = stringField(request2.input, "path");
+  const startLine = optionalInteger(request2.input.startLine) ?? 1;
+  const endLine = optionalInteger(request2.input.endLine) ?? startLine + (options.maxReadLines ?? 2e3) - 1;
   if (endLine < startLine || endLine - startLine + 1 > (options.maxReadLines ?? 2e3)) {
     throw new TypeError("requested line range exceeds its bound");
   }
   const paths = await registeredFiles(context.workspaceDir, 2e4);
-  const allowed = await policy.read(policyContext(context, request, options, { paths, path, startLine, endLine }));
-  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  const allowed = await policy.read(policyContext(context, request2, options, { paths, path, startLine, endLine }));
+  if (!allowed) return response(request2, false, "tool denied by CaMeL policy");
   const target = resolveCodePath(context.workspaceDir, path);
   const info = await (0, import_promises9.stat)(target);
   if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {
@@ -5861,40 +5861,40 @@ async function read(context, request, options, policy) {
   const source = await (0, import_promises9.readFile)(target);
   if (source.includes(0)) throw new TypeError("binary files are not readable through this tool");
   const lines = source.toString("utf8").split("\n");
-  const content = lines.slice(startLine - 1, endLine).join("\n");
-  if (Buffer.byteLength(content) > (options.maxReadBytes ?? 128 * 1024)) {
+  const content2 = lines.slice(startLine - 1, endLine).join("\n");
+  if (Buffer.byteLength(content2) > (options.maxReadBytes ?? 128 * 1024)) {
     throw new TypeError("read result exceeds its byte bound");
   }
-  return response(request, true, content, { path, startLine, endLine: Math.min(endLine, lines.length) });
+  return response(request2, true, content2, { path, startLine, endLine: Math.min(endLine, lines.length) });
 }
-async function patch(context, request, options, policy) {
-  exactKeys(request.input, ["patch"]);
-  const value = stringField(request.input, "patch");
+async function patch(context, request2, options, policy) {
+  exactKeys(request2.input, ["patch"]);
+  const value = stringField(request2.input, "patch");
   const paths = validateCodePatch(value, options.maxPatchBytes ?? 256 * 1024);
   if (paths.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
     throw new TypeError("patch targets a read-only reference source");
   }
-  const allowed = await policy.patch(policyContext(context, request, options, { patch: value }));
-  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  const allowed = await policy.patch(policyContext(context, request2, options, { patch: value }));
+  if (!allowed) return response(request2, false, "tool denied by CaMeL policy");
   await applyCodePatch(context.workspaceDir, value, paths);
-  return response(request, true, `Applied patch to ${paths.length} file(s).`, { paths });
+  return response(request2, true, `Applied patch to ${paths.length} file(s).`, { paths });
 }
-async function recipe(context, request, options, recipes, policy) {
-  exactKeys(request.input, ["recipeId"]);
-  const recipeId = stringField(request.input, "recipeId");
+async function recipe(context, request2, options, recipes, policy) {
+  exactKeys(request2.input, ["recipeId"]);
+  const recipeId = stringField(request2.input, "recipeId");
   const digestLimits = {
     maxFiles: options.maxRecipeWorkspaceFiles ?? 2e4,
     maxBytes: options.maxRecipeWorkspaceBytes ?? 512 * 1024 * 1024
   };
   const sourceDigest = await digestStagedWorkspace(context.workspaceDir, digestLimits);
-  const allowed = await policy.recipe(policyContext(context, request, options, {
+  const allowed = await policy.recipe(policyContext(context, request2, options, {
     recipeIds: [...recipes.keys()].sort(),
     recipeId,
     sourceDigest
   }));
-  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  if (!allowed) return response(request2, false, "tool denied by CaMeL policy");
   const selected = recipes.get(recipeId);
-  if (!selected) return response(request, false, "build recipe is not registered");
+  if (!selected) return response(request2, false, "build recipe is not registered");
   const staged = await stageWorkspace(context.workspaceDir, {
     maxFiles: digestLimits.maxFiles,
     maxBytes: digestLimits.maxBytes
@@ -5911,7 +5911,7 @@ async function recipe(context, request, options, recipes, policy) {
     const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
     const ok = result.exitCode === 0 && !result.outputLimitExceeded && !result.timedOut;
     const status = result.timedOut ? "timed out" : result.outputLimitExceeded ? "exceeded output limit" : ok ? "passed" : `failed with exit ${result.exitCode}`;
-    return response(request, ok, `Recipe ${recipeId} ${status}.${output ? `
+    return response(request2, ok, `Recipe ${recipeId} ${status}.${output ? `
 ${output}` : ""}`, {
       recipeId,
       exitCode: result.exitCode,
@@ -5923,10 +5923,10 @@ ${output}` : ""}`, {
     await staged.cleanup();
   }
 }
-function policyContext(context, request, options, extra) {
+function policyContext(context, request2, options, extra) {
   return {
     lease: context.lease,
-    request,
+    request: request2,
     workspaceId: `workspace:${context.lease.task.attemptId}`,
     readers: { kind: "principals", principalIds: [options.readerId] },
     ...extra
@@ -5976,8 +5976,8 @@ function optionalInteger(value) {
   if (!Number.isSafeInteger(value) || value < 1) throw new TypeError("line bounds must be positive integers");
   return value;
 }
-function response(request, ok, content, details) {
-  return { requestId: request.requestId, ok, content, ...details ? { details } : {} };
+function response(request2, ok, content2, details) {
+  return { requestId: request2.requestId, ok, content: content2, ...details ? { details } : {} };
 }
 function codeCommandMetadata(payload, resume) {
   const trusted = record22(payload.trustedBase);
@@ -6077,13 +6077,13 @@ function createCodeRuntimeToolBroker(input, lease, role) {
     readerId: `code-session:${lease.task.taskId}`,
     readOnlyPrefixes: [".odla-references"]
   });
-  return role === "coding" ? broker : { execute: (context, request) => request.tool === "sandbox.read" ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
+  return role === "coding" ? broker : { execute: (context, request2) => request2.tool === "sandbox.read" ? broker.execute(context, request2) : Promise.resolve({ requestId: request2.requestId, ok: false, content: "review sessions are read-only" }) };
 }
 async function handleCodeRuntimeInference(input) {
-  const { command, metadata: metadata2, request, state } = input;
-  if (state.tokens >= metadata2.maxTokensPerInteraction) {
-    if (!state.noticeEmitted) {
-      state.noticeEmitted = true;
+  const { command, metadata: metadata2, request: request2, state: state2 } = input;
+  if (state2.tokens >= metadata2.maxTokensPerInteraction) {
+    if (!state2.noticeEmitted) {
+      state2.noticeEmitted = true;
       await input.event({
         type: "message",
         actor: "system",
@@ -6093,7 +6093,7 @@ async function handleCodeRuntimeInference(input) {
     return {
       protocolVersion: HARNESS_PROTOCOL_VERSION,
       type: "inference.response",
-      requestId: request.requestId,
+      requestId: request2.requestId,
       response: {
         id: `budget:${command.commandId}`,
         provider: "openai",
@@ -6107,11 +6107,11 @@ async function handleCodeRuntimeInference(input) {
   }
   const startedAt = Date.now();
   const response2 = await input.control.infer(command.sessionId, {
-    requestId: request.requestId,
+    requestId: request2.requestId,
     interactionId: command.commandId,
-    call: request.call
+    call: request2.call
   });
-  state.tokens += response2.receipt.inputTokens + response2.receipt.outputTokens;
+  state2.tokens += response2.receipt.inputTokens + response2.receipt.outputTokens;
   await input.event({
     type: "usage",
     provider: response2.receipt.provider,
@@ -6120,13 +6120,13 @@ async function handleCodeRuntimeInference(input) {
     outputTokens: response2.receipt.outputTokens,
     durationMs: Date.now() - startedAt,
     interactionId: command.commandId,
-    interactionTokens: state.tokens,
+    interactionTokens: state2.tokens,
     interactionMaxTokens: metadata2.maxTokensPerInteraction
   }).catch(() => void 0);
   return {
     protocolVersion: HARNESS_PROTOCOL_VERSION,
     type: "inference.response",
-    requestId: request.requestId,
+    requestId: request2.requestId,
     response: response2.response
   };
 }
@@ -6494,6 +6494,14 @@ Usage:
   odla-ai pm <goal|task|decision|bug> comments <id> [--json]
   odla-ai pm <goal|task|decision|bug> rm <id>
   odla-ai pm handoff --app <id> [--json]
+  odla-ai discuss groups [--json]
+  odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
+  odla-ai discuss read <topic> [--json]
+  odla-ai discuss post --app <id> --subject "..." --body "..." [--markup "... @[Label](kind/id)"]
+  odla-ai discuss reply <topic> --body "..." [--markup "..."]
+  odla-ai discuss resolve <topic> [--reopen]
+  odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
+  odla-ai discuss watch [<topic>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json]
   odla-ai whoami [--json]
   odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
   odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
@@ -6598,6 +6606,13 @@ Commands:
                "app". Entities: goal (alias conformance), task (alias kanban),
                decision, bug. Status changes and comments post to each item's
                @odla-ai/chat discussion thread.
+  discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
+               one group per project, topics with replies, @-mentions of people,
+               agents, PM items, and projects. Built for unattended use \u2014 post a
+               question, then "watch" it until someone answers. "watch" exits 75
+               (not 1) when it times out with nothing new, so a script can tell
+               "no answer yet" from a failure and just rerun. Use "who" to look
+               up the exact @[Label](kind/id) markup for a mention.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
   smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
@@ -6785,15 +6800,15 @@ async function connectGitHubSecuritySource(options) {
   const deadline = Math.min(serverExpiry, now() + hostedPollTimeout(options.pollTimeoutMs));
   const wait2 = options.wait ?? waitForHostedPoll;
   while (true) {
-    const state = await requestHostedSecurityJson(
+    const state2 = await requestHostedSecurityJson(
       options,
       `/registry/github/connect/${encodeURIComponent(attempt.attemptId)}`,
       {},
       "check GitHub connection"
     );
-    if (state.status !== "pending") {
-      if (state.status === "connected") return state;
-      throw new Error(`GitHub connection ${state.status}${state.failureCode ? `: ${state.failureCode}` : ""}`);
+    if (state2.status !== "pending") {
+      if (state2.status === "connected") return state2;
+      throw new Error(`GitHub connection ${state2.status}${state2.failureCode ? `: ${state2.failureCode}` : ""}`);
     }
     if (now() >= deadline) throw new Error("GitHub connection approval timed out");
     await wait2(Math.min(interval, Math.max(0, deadline - now())), options.signal);
@@ -7244,6 +7259,289 @@ async function codeCommand(parsed, dependencies) {
   });
 }
 
+// src/discuss-actions.ts
+async function request(ctx, method, path, body) {
+  const res = await ctx.doFetch(`${ctx.platformUrl}/registry/discuss${path}`, {
+    method,
+    headers: { authorization: `Bearer ${ctx.token}`, "content-type": "application/json" },
+    body: body === void 0 ? void 0 : JSON.stringify(body)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok)
+    throw new Error(`discuss ${method} ${path} failed: ${data.error ?? `registry returned ${res.status}`}`);
+  return data;
+}
+function emit(ctx, value, human) {
+  if (ctx.json) ctx.out.log(JSON.stringify(value, null, 2));
+  else human();
+}
+var state = (topic) => topic.resolvedAt ? "resolved" : "open";
+function bodyWithRefs(post) {
+  if (!post.refs || post.refs.length === 0) return post.body;
+  let out = "";
+  let cursor = 0;
+  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {
+    if (ref.start < cursor || ref.end > post.body.length) continue;
+    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;
+    cursor = ref.end;
+  }
+  return out + post.body.slice(cursor);
+}
+function content(parsed) {
+  const markup = stringOpt(parsed.options.markup);
+  if (markup) return { markup };
+  const body = stringOpt(parsed.options.body);
+  if (!body) throw new Error('needs --body "\u2026" (or --markup with @[Label](kind/id) mentions)');
+  return { body };
+}
+async function discussGroups(ctx) {
+  const result = await request(
+    ctx,
+    "GET",
+    "/groups"
+  );
+  emit(ctx, result, () => {
+    ctx.out.log("app	name	started");
+    for (const group of result.groups) {
+      ctx.out.log(`${group.appId}	${group.name}	${group.channelId ? "yes" : "no"}`);
+    }
+  });
+}
+async function discussList(ctx, parsed) {
+  const query = new URLSearchParams();
+  for (const [flag, param] of [
+    ["app", "app"],
+    ["q", "q"],
+    ["state", "state"],
+    ["limit", "limit"],
+    ["offset", "offset"]
+  ]) {
+    const value = stringOpt(parsed.options[flag]);
+    if (value) query.set(param, value);
+  }
+  const qs = query.toString();
+  const page = await request(ctx, "GET", `/topics${qs ? `?${qs}` : ""}`);
+  emit(ctx, page, () => {
+    ctx.out.log(`topics \u2014 ${page.topics.length} of ${page.total}`);
+    ctx.out.log("id	state	app	replies	subject");
+    for (const topic of page.topics) {
+      ctx.out.log(
+        `${topic.id}	${state(topic)}	${topic.appId ?? ""}	${topic.replyCount}	${topic.subject}`
+      );
+    }
+  });
+}
+async function discussRead(ctx, id) {
+  const result = await request(
+    ctx,
+    "GET",
+    `/topics/${encodeURIComponent(id)}`
+  );
+  emit(ctx, result, () => {
+    ctx.out.log(`${result.topic.subject}  [${state(result.topic)}]  ${result.topic.appId ?? ""}`);
+    for (const post of result.posts) {
+      const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
+      ctx.out.log(`
+\u2014 ${who}`);
+      ctx.out.log(bodyWithRefs(post));
+      for (const file of post.attachments ?? []) ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);
+    }
+  });
+}
+async function discussPost(ctx, parsed) {
+  const appId = stringOpt(parsed.options.app);
+  if (!appId) throw new Error("discuss post needs --app <appId>");
+  const subject = stringOpt(parsed.options.subject);
+  if (!subject) throw new Error('discuss post needs --subject "\u2026"');
+  const created = await request(ctx, "POST", "/topics", {
+    appId,
+    subject,
+    ...content(parsed)
+  });
+  emit(ctx, created, () => ctx.out.log(`opened topic ${created.id}`));
+}
+async function discussReply(ctx, id, parsed) {
+  const created = await request(
+    ctx,
+    "POST",
+    `/topics/${encodeURIComponent(id)}/replies`,
+    content(parsed)
+  );
+  emit(ctx, created, () => ctx.out.log(`replied ${created.id}`));
+}
+async function discussResolve(ctx, id, resolved) {
+  const result = await request(
+    ctx,
+    "PATCH",
+    `/topics/${encodeURIComponent(id)}`,
+    { resolved }
+  );
+  emit(ctx, result, () => ctx.out.log(`${resolved ? "resolved" : "reopened"} ${result.id}`));
+}
+async function discussWho(ctx, parsed) {
+  const query = new URLSearchParams({ q: stringOpt(parsed.options.q) ?? "" });
+  const app = stringOpt(parsed.options.app);
+  if (app) query.set("app", app);
+  const kinds = stringOpt(parsed.options.kinds);
+  if (kinds) query.set("kinds", kinds);
+  const found = await request(ctx, "GET", `/mentionables?${query.toString()}`);
+  emit(ctx, found, () => {
+    ctx.out.log("mention	kind	hint");
+    for (const item of found.items) {
+      ctx.out.log(`@[${item.label}](${item.kind}/${item.id})	${item.kind}	${item.hint ?? ""}`);
+    }
+    if (found.failed.length > 0) ctx.out.error(`(no results from: ${found.failed.join(", ")})`);
+  });
+}
+
+// src/discuss-watch.ts
+var DEFAULT_INTERVAL_MS = 15e3;
+var DEFAULT_TIMEOUT_MS = 15 * 6e4;
+function numberOpt2(parsed, flag, fallback) {
+  const raw = stringOpt(parsed.options[flag]);
+  const value = raw == null ? NaN : Number(raw);
+  return Number.isFinite(value) && value > 0 ? value : fallback;
+}
+async function get(ctx, path) {
+  const res = await ctx.doFetch(`${ctx.platformUrl}/registry/discuss${path}`, {
+    headers: { authorization: `Bearer ${ctx.token}` }
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(`discuss watch failed: ${data.error ?? `registry returned ${res.status}`}`);
+  return data;
+}
+async function discussWatch(ctx, topicId, parsed) {
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve11) => setTimeout(resolve11, ms)));
+  const now = ctx.now ?? Date.now;
+  const intervalMs = numberOpt2(parsed, "interval", DEFAULT_INTERVAL_MS / 1e3) * 1e3;
+  const timeoutMs = numberOpt2(parsed, "timeout", DEFAULT_TIMEOUT_MS / 1e3) * 1e3;
+  const by = stringOpt(parsed.options.by);
+  const self = stringOpt(parsed.options.self);
+  const deadline = now() + timeoutMs;
+  const fresh = (post) => (!by || post.authorId === by) && (!self || post.authorId !== self);
+  let seen = /* @__PURE__ */ new Set();
+  let since = now();
+  if (topicId) {
+    const first = await get(ctx, `/topics/${encodeURIComponent(topicId)}`);
+    seen = new Set(first.posts.map((post) => post.id));
+  }
+  for (; ; ) {
+    if (topicId) {
+      const { posts } = await get(ctx, `/topics/${encodeURIComponent(topicId)}`);
+      const added = posts.filter((post) => !seen.has(post.id) && fresh(post));
+      if (added.length > 0) return report2(ctx, { found: true, posts: added });
+      for (const post of posts) seen.add(post.id);
+    } else {
+      const app = stringOpt(parsed.options.app);
+      const { topics } = await get(
+        ctx,
+        `/topics?state=all${app ? `&app=${encodeURIComponent(app)}` : ""}`
+      );
+      const active = topics.filter((topic) => topic.lastActivityAt > since);
+      if (active.length > 0) return report2(ctx, { found: true, topics: active });
+      since = now();
+    }
+    if (now() >= deadline) return report2(ctx, { found: false });
+    await sleep(Math.min(intervalMs, Math.max(0, deadline - now())));
+  }
+}
+function report2(ctx, result) {
+  if (ctx.json) {
+    ctx.out.log(JSON.stringify(result, null, 2));
+  } else if (result.found) {
+    for (const post of result.posts ?? []) {
+      const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
+      ctx.out.log(`\u2014 ${who}
+${post.body}`);
+    }
+    for (const topic of result.topics ?? []) {
+      ctx.out.log(`${topic.id}	${topic.appId ?? ""}	${topic.subject}`);
+    }
+  }
+  return result;
+}
+var WatchTimeoutError = class extends Error {
+  code = "watch_timeout";
+  constructor() {
+    super("nothing new before the timeout");
+    this.name = "WatchTimeoutError";
+  }
+};
+
+// src/discuss-command.ts
+var ALLOWED = [
+  "config",
+  "token",
+  "email",
+  "json",
+  "app",
+  "subject",
+  "body",
+  "markup",
+  "state",
+  "q",
+  "kinds",
+  "limit",
+  "offset",
+  "reopen",
+  "by",
+  "self",
+  "interval",
+  "timeout"
+];
+function requireId(id, action) {
+  if (!id) throw new Error(`"discuss ${action}" needs a topic id`);
+  return id;
+}
+async function buildContext(parsed, deps) {
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: false
+    },
+    doFetch,
+    out
+  );
+  return { platformUrl: cfg.platformUrl, token, doFetch, out, json: parsed.options.json === true };
+}
+async function discussCommand(parsed, deps = {}) {
+  assertArgs(parsed, ALLOWED, 3);
+  const action = parsed.positionals[1];
+  const id = parsed.positionals[2];
+  if (!action) throw new Error('"discuss" needs an action. Run "odla-ai help".');
+  const ctx = await buildContext(parsed, deps);
+  switch (action) {
+    case "groups":
+      return discussGroups(ctx);
+    case "list":
+    case "topics":
+      return discussList(ctx, parsed);
+    case "read":
+      return discussRead(ctx, requireId(id, "read"));
+    case "post":
+      return discussPost(ctx, parsed);
+    case "reply":
+      return discussReply(ctx, requireId(id, "reply"), parsed);
+    case "resolve":
+      return discussResolve(ctx, requireId(id, "resolve"), parsed.options.reopen !== true);
+    case "who":
+      return discussWho(ctx, parsed);
+    case "watch": {
+      const result = await discussWatch(ctx, id, parsed);
+      if (!result.found) throw new WatchTimeoutError();
+      return;
+    }
+    default:
+      throw new Error(`unknown discuss action "${action}". Run "odla-ai help".`);
+  }
+}
+
 // src/pm-actions.ts
 var FIELD_MAP = {
   title: { key: "title" },
@@ -7307,7 +7605,7 @@ function statusCol(entity, r) {
 function printRecord(ctx, entity, r) {
   ctx.out.log(`${r.id}	[${statusCol(entity, r)}]	${r.appId}	${r.title ?? ""}`);
 }
-function emit(ctx, value, human) {
+function emit2(ctx, value, human) {
   if (ctx.json) ctx.out.log(JSON.stringify(value, null, 2));
   else human();
 }
@@ -7333,7 +7631,7 @@ async function pmList(ctx, entity, parsed) {
   }
   const qs = q.toString();
   const page = await pmRequest(ctx, "GET", `/${entity}${qs ? `?${qs}` : ""}`);
-  emit(ctx, page, () => {
+  emit2(ctx, page, () => {
     ctx.out.log(`${entity} \u2014 ${page.records.length} of ${page.total}`);
     ctx.out.log("id	state	app	title");
     for (const r of page.records) printRecord(ctx, entity, r);
@@ -7347,25 +7645,25 @@ async function pmAdd(ctx, entity, parsed) {
   if (entity === "bug" && !input.description)
     throw new Error("pm bug add needs --description <context> (or --body <context>)");
   const res = await pmRequest(ctx, "POST", `/${entity}`, { appId, input });
-  emit(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
+  emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
   const { record: record5 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit(ctx, record5, () => printRecord(ctx, entity, record5));
+  emit2(ctx, record5, () => printRecord(ctx, entity, record5));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
   if (Object.keys(patch2).length === 0)
     throw new Error("pm set needs at least one field flag (e.g. --status doing, --assignee me, --no-assignee)");
   const res = await pmRequest(ctx, "PATCH", `/${entity}/${encodeURIComponent(id)}`, { patch: patch2 });
-  emit(ctx, res, () => ctx.out.log(res.record ? `${res.record.id}	[${statusCol(entity, res.record)}]	${res.record.appId}	${res.record.title ?? ""}` : `updated ${entity} ${id}`));
+  emit2(ctx, res, () => ctx.out.log(res.record ? `${res.record.id}	[${statusCol(entity, res.record)}]	${res.record.appId}	${res.record.title ?? ""}` : `updated ${entity} ${id}`));
 }
 async function pmDone(ctx, entity, id, parsed) {
   const decisionId = stringOpt(parsed.options.decision);
   if (decisionId && entity !== "bug") throw new Error("--decision is only valid when completing a bug");
   const patch2 = { ...DONE[entity], ...decisionId ? { decisionId } : {} };
   const res = await pmRequest(ctx, "PATCH", `/${entity}/${encodeURIComponent(id)}`, { patch: patch2 });
-  emit(ctx, res, () => ctx.out.log(`${entity} ${id} \u2192 done`));
+  emit2(ctx, res, () => ctx.out.log(`${entity} ${id} \u2192 done`));
 }
 async function allRecords(ctx, entity, appId) {
   const records = [];
@@ -7398,7 +7696,7 @@ async function pmHandoff(ctx, parsed) {
     ...handoff,
     clean: !handoff.unmetGoals.length && !handoff.activeTasks.length && !handoff.openBugs.length
   };
-  emit(ctx, result, () => {
+  emit2(ctx, result, () => {
     if (result.clean) {
       ctx.out.log(`${appId}: no unresolved PM work`);
       return;
@@ -7431,7 +7729,7 @@ async function pmComments(ctx, entity, id) {
     "GET",
     `/${entity}/${encodeURIComponent(id)}/comments`
   );
-  emit(ctx, messages, () => {
+  emit2(ctx, messages, () => {
     if (messages.length === 0) ctx.out.log("(no comments)");
     else for (const m of messages) ctx.out.log(`[${m.authorId ?? "?"}] ${m.body ?? ""}`);
   });
@@ -7450,7 +7748,7 @@ var ALIASES = {
   decision: "decision",
   bug: "bug"
 };
-var ALLOWED = [
+var ALLOWED2 = [
   "config",
   "token",
   "email",
@@ -7474,11 +7772,11 @@ var ALLOWED = [
   "offset",
   "q"
 ];
-function requireId(id, action) {
+function requireId2(id, action) {
   if (!id) throw new Error(`"pm ... ${action}" needs an item id`);
   return id;
 }
-async function buildContext(parsed, deps) {
+async function buildContext2(parsed, deps) {
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
   const doFetch = deps.fetch ?? fetch;
   const out = deps.stdout ?? console;
@@ -7493,14 +7791,14 @@ async function buildContext(parsed, deps) {
 async function pmCommand(parsed, deps = {}) {
   const word = parsed.positionals[1] ?? "";
   if (word === "handoff") {
-    assertArgs(parsed, ALLOWED, 2);
-    return pmHandoff(await buildContext(parsed, deps), parsed);
+    assertArgs(parsed, ALLOWED2, 2);
+    return pmHandoff(await buildContext2(parsed, deps), parsed);
   }
   const entity = ALIASES[word];
   if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm bug list" (goal|task|decision|bug).`);
   const action = parsed.positionals[2] ?? "list";
-  assertArgs(parsed, ALLOWED, 4);
-  const ctx = await buildContext(parsed, deps);
+  assertArgs(parsed, ALLOWED2, 4);
+  const ctx = await buildContext2(parsed, deps);
   const id = parsed.positionals[3];
   switch (action) {
     case "list":
@@ -7509,21 +7807,21 @@ async function pmCommand(parsed, deps = {}) {
     case "create":
       return pmAdd(ctx, entity, parsed);
     case "get":
-      return pmGet(ctx, entity, requireId(id, action));
+      return pmGet(ctx, entity, requireId2(id, action));
     case "set":
     case "update":
     case "status":
     case "move":
-      return pmSet(ctx, entity, requireId(id, action), parsed);
+      return pmSet(ctx, entity, requireId2(id, action), parsed);
     case "done":
-      return pmDone(ctx, entity, requireId(id, action), parsed);
+      return pmDone(ctx, entity, requireId2(id, action), parsed);
     case "comment":
-      return pmComment(ctx, entity, requireId(id, action), parsed);
+      return pmComment(ctx, entity, requireId2(id, action), parsed);
     case "comments":
-      return pmComments(ctx, entity, requireId(id, action));
+      return pmComments(ctx, entity, requireId2(id, action));
     case "rm":
     case "delete":
-      return pmRemove(ctx, entity, requireId(id, action));
+      return pmRemove(ctx, entity, requireId2(id, action));
     default:
       throw new Error(`unknown pm action "${action}". Try list|add|get|set|done|comment|comments|rm.`);
   }
@@ -7989,6 +8287,18 @@ var COMMAND_SURFACE = {
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
+  // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
+  discuss: {
+    groups: {},
+    list: {},
+    topics: {},
+    read: {},
+    post: {},
+    reply: {},
+    resolve: {},
+    who: {},
+    watch: {}
+  },
   doctor: {},
   help: {},
   init: {},
@@ -8585,7 +8895,7 @@ async function assessImpact(ctx, surfaces, all, limit) {
   return out;
 }
 var editHint = (slug, appId) => `odla-ai runbook edit ${slug}${appId === PLATFORM_SCOPE ? "" : ` --app ${appId}`} --note "<what changed>"`;
-function report2(ctx, impacts) {
+function report3(ctx, impacts) {
   const covered = impacts.filter((i) => i.runbooks.length);
   ctx.out.log(
     `${impacts.length} changed surface${impacts.length === 1 ? "" : "s"}; ${covered.length} covered by a runbook. Reread each one and fix any step this change made wrong.`
@@ -8623,7 +8933,7 @@ async function runbookImpact(ctx, options, deps = {}) {
   }
   const impacts = await assessImpact(ctx, surfaces, options.all, options.limit ?? 4);
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
-  report2(ctx, impacts);
+  report3(ctx, impacts);
 }
 
 // src/runbook-lint.ts
@@ -8856,7 +9166,7 @@ async function whoamiCommand(parsed, deps = {}) {
 }
 
 // src/runbook-command.ts
-var ALLOWED2 = [
+var ALLOWED3 = [
   "config",
   "token",
   "email",
@@ -8896,7 +9206,7 @@ async function loadOrDefaultConfig(configPath, action, appId) {
   }
   return loadProjectConfig(configPath);
 }
-async function buildContext2(parsed, deps, action) {
+async function buildContext3(parsed, deps, action) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadOrDefaultConfig(configPath, action, stringOpt(parsed.options.app));
   const doFetch = deps.fetch ?? fetch;
@@ -8952,8 +9262,8 @@ async function buildContext2(parsed, deps, action) {
 }
 async function runbookCommand(parsed, deps = {}) {
   const action = parsed.positionals[1] ?? "list";
-  assertArgs(parsed, ALLOWED2, action === "ask" || action === "search" ? 64 : 4);
-  const ctx = await buildContext2(parsed, deps, action);
+  assertArgs(parsed, ALLOWED3, action === "ask" || action === "search" ? 64 : 4);
+  const ctx = await buildContext3(parsed, deps, action);
   const slug = parsed.positionals[2];
   switch (action) {
     case "list":
@@ -9144,31 +9454,31 @@ function printHostedJob(out, job, platform, appId) {
   url.searchParams.set("job", job.jobId);
   out.log(`  Studio: ${url.toString()}`);
 }
-function printHostedReport(out, report3) {
-  out.log(`security report ${report3.jobId}: ${report3.repository}@${report3.revision}`);
-  out.log(`  coverage: ${report3.coverageStatus} cells=${report3.metrics.coverageCells} shallow=${report3.metrics.shallowCells} blocked=${report3.metrics.blockedCells} unscheduled=${report3.metrics.unscheduledCells} budget_exhausted=${report3.metrics.budgetExhaustedCells}`);
-  out.log(`  findings: confirmed=${report3.metrics.confirmed} needs_reproduction=${report3.metrics.needsReproduction} candidates=${report3.metrics.candidates} rejected=${report3.metrics.rejected}`);
-  out.log(`  discovery: ${report3.provenance.discovery?.provider ?? "unknown"}/${report3.provenance.discovery?.model ?? "unknown"}`);
-  out.log(`  validation: ${report3.provenance.validation?.provider ?? "unknown"}/${report3.provenance.validation?.model ?? "unknown"} independent=${String(report3.provenance.independentValidation)}`);
-  for (const finding of report3.findings) {
+function printHostedReport(out, report4) {
+  out.log(`security report ${report4.jobId}: ${report4.repository}@${report4.revision}`);
+  out.log(`  coverage: ${report4.coverageStatus} cells=${report4.metrics.coverageCells} shallow=${report4.metrics.shallowCells} blocked=${report4.metrics.blockedCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates} rejected=${report4.metrics.rejected}`);
+  out.log(`  discovery: ${report4.provenance.discovery?.provider ?? "unknown"}/${report4.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report4.provenance.validation?.provider ?? "unknown"}/${report4.provenance.validation?.model ?? "unknown"} independent=${String(report4.provenance.independentValidation)}`);
+  for (const finding of report4.findings) {
     const location = finding.locations[0];
     out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
   }
-  for (const limitation of report3.limitations) out.log(`  limitation: ${limitation}`);
+  for (const limitation of report4.limitations) out.log(`  limitation: ${limitation}`);
 }
-function enforceHostedReportGate(report3, parsed, out, emitSuccess) {
+function enforceHostedReportGate(report4, parsed, out, emitSuccess) {
   const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
   const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
-  const confirmed = report3.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
-  const leads = failOnCandidates ? report3.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
-  const incomplete = report3.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = report4.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report4.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report4.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
-    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report3.coverageStatus}` : ""}`);
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report4.coverageStatus}` : ""}`);
   }
   if (emitSuccess) {
-    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report3.coverageStatus}. This is not proof that the application is secure.`);
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report4.coverageStatus}. This is not proof that the application is secure.`);
   }
 }
 function printHostedSecurityPlanRoute(out, label, route2) {
@@ -9251,17 +9561,17 @@ async function runHostedSecurity(options) {
       allowNetwork: false
     }
   });
-  const report3 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await (0, import_node3.writeSecurityArtifacts)(output, report3);
-  const reportDigest = await (0, import_security.securityFingerprint)(report3);
+  const report4 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await (0, import_node3.writeSecurityArtifacts)(output, report4);
+  const reportDigest = await (0, import_security.securityFingerprint)(report4);
   await hosted.complete({
     reportDigest,
-    coverageStatus: report3.coverageStatus,
-    confirmed: report3.metrics.confirmed,
-    candidates: report3.metrics.candidates
+    coverageStatus: report4.coverageStatus,
+    confirmed: report4.metrics.confirmed,
+    candidates: report4.metrics.candidates
   }, { signal: options.signal });
-  printSummary(options.stdout ?? console, appId, env, hosted.run, report3, output);
-  return Object.freeze({ report: report3, run: hosted.run, output });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report4, output);
+  return Object.freeze({ report: report4, run: hosted.run, output });
 }
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
@@ -9271,11 +9581,11 @@ function selectEnv(requested, declared, configPath, rootDir) {
   }
   return env;
 }
-async function injectedToken(options, request) {
-  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request }));
+async function injectedToken(options, request2) {
+  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request2 }));
   if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
     throw new Error(
-      request.selfAudit ? "Self-audit requires an injected, scoped platform security token" : "Hosted security requires an injected app developer token or getToken callback"
+      request2.selfAudit ? "Self-audit requires an injected, scoped platform security token" : "Hosted security requires an injected app developer token or getToken callback"
     );
   }
   return value;
@@ -9287,14 +9597,14 @@ function profileFor(name, maxHuntTasks) {
   if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
   return { ...profile, maxHuntTasks };
 }
-function printSummary(out, appId, env, run, report3, output) {
-  const complete = report3.coverage.filter((cell) => cell.state === "complete").length;
+function printSummary(out, appId, env, run, report4, output) {
+  const complete = report4.coverage.filter((cell) => cell.state === "complete").length;
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report3.coverageStatus} ${complete}/${report3.coverage.length} blocked=${report3.metrics.blockedCells} shallow=${report3.metrics.shallowCells} unscheduled=${report3.metrics.unscheduledCells} budget_exhausted=${report3.metrics.budgetExhaustedCells}`);
-  if (report3.callBudget) out.log(`  calls: discovery=${formatBudget(report3.callBudget.discovery)} validation=${formatBudget(report3.callBudget.validation)}`);
-  out.log(`  findings: confirmed=${report3.metrics.confirmed} needs_reproduction=${report3.metrics.needsReproduction} candidates=${report3.metrics.candidates}`);
+  out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
   out.log(`  report: ${(0, import_node_path15.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
@@ -9541,13 +9851,13 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     }
     throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
   }
-  const report3 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  const report4 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
   if (parsed.options.json === true) {
-    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report3 }, null, 2));
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report4 }, null, 2));
   } else {
-    printHostedReport(context.stdout, report3);
+    printHostedReport(context.stdout, report4);
   }
-  enforceHostedReportGate(report3, parsed, context.stdout, parsed.options.json !== true);
+  enforceHostedReportGate(report4, parsed, context.stdout, parsed.options.json !== true);
 }
 async function runLocalSecurityCommand(parsed, dependencies) {
   if (parsed.options.source === true) {
@@ -9588,11 +9898,11 @@ async function runLocalSecurityCommand(parsed, dependencies) {
     sourceDisclosureAck: parsed.options["ack-redacted-source"] === true ? "redacted" : void 0,
     fetch: doFetch,
     stdout: out,
-    getToken: async (request) => {
-      if (request.scope === "platform:security:self") {
+    getToken: async (request2) => {
+      if (request2.scope === "platform:security:self") {
         return getScopedPlatformToken({
-          platform: request.platform,
-          scope: request.scope,
+          platform: request2.platform,
+          scope: request2.scope,
           email: stringOpt(parsed.options.email),
           open,
           fetch: doFetch,
@@ -9601,7 +9911,7 @@ async function runLocalSecurityCommand(parsed, dependencies) {
         });
       }
       const cfg = await loadProjectConfig(configPath);
-      if (platformAudience(cfg.platformUrl) !== platformAudience(request.platform)) {
+      if (platformAudience(cfg.platformUrl) !== platformAudience(request2.platform)) {
         throw new Error("--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there");
       }
       return getDeveloperToken(
@@ -9614,13 +9924,13 @@ async function runLocalSecurityCommand(parsed, dependencies) {
   });
   enforceLocalGate(result.report, parsed);
 }
-function enforceLocalGate(report3, parsed) {
+function enforceLocalGate(report4, parsed) {
   const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-  const confirmed = (0, import_security2.findingsAtOrAbove)(report3, failOn);
-  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report3, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-  const incomplete = report3.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = (0, import_security2.findingsAtOrAbove)(report4, failOn);
+  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report4, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report4.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
@@ -9659,9 +9969,9 @@ async function securityCommand(parsed, dependencies) {
     assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
-    const report3 = await getHostedSecurityReport({ ...context, jobId });
-    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report3, null, 2));
-    else printHostedReport(context.stdout, report3);
+    const report4 = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report4, null, 2));
+    else printHostedReport(context.stdout, report4);
     return;
   }
   if (sub !== "run") {
@@ -9745,7 +10055,8 @@ async function securityStatus(parsed, dependencies) {
 
 // src/cli.ts
 function exitCodeFor(err) {
-  return err?.code === "handshake_pending" ? 75 : 1;
+  const code = err?.code;
+  return code === "handshake_pending" || code === "watch_timeout" ? 75 : 1;
 }
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   const parsed = parseArgv(argv);
@@ -9793,6 +10104,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await pmCommand(parsed, dependencies);
     return;
   }
+  if (command === "discuss") {
+    await discussCommand(parsed, dependencies);
+    return;
+  }
   if (command === "provision") {
     await provisionCommand(parsed, dependencies);
     return;