@odla-ai/cli 0.25.11 → 0.25.17

package/README.md

@@ -13,8 +13,10 @@ deployed Worker secrets without printing them. It also gives platform admins a
 scoped System AI control surface and gives app owners a provider-key-free
 hosted security command.
 
-It does not know about any specific app. App identity, environments, services,
-schema, rules, integrations, auth, AI provider, and links all come from config.
+Provisioning does not know about any specific app. App identity, environments,
+services, schema, rules, integrations, auth, AI provider, and links all come
+from config. Operator commands can also receive explicit platform/app/env
+context so remote agents are not forced to manufacture a project checkout.
 
 ## Start with the runbooks, not this file
 
@@ -37,6 +39,50 @@ npx @odla-ai/cli runbook list                                      # what exists
 Reading works for any signed-in developer and needs no `odla.config.mjs` — the
 advice is most useful before there is a project.
 
+## Operator context from any directory
+
+Before an agent reads PM, Discussions, o11y, runbooks, or identity from a fresh
+workspace, it can explain the selected context without authenticating:
+
+```bash
+npx @odla-ai/cli context show --platform https://odla.ai --app <appId> --env prod --json
+npx @odla-ai/cli context save production --platform https://odla.ai --app <appId> --env prod
+npx @odla-ai/cli context show --context production --json
+```
+
+For each value, an explicit flag wins over the matching
+`ODLA_PLATFORM_URL`, `ODLA_APP_ID`, or `ODLA_ENV` variable. An explicitly
+selected `--context` (or `ODLA_CONTEXT`) comes next, followed by a present
+`odla.config.mjs`; the platform defaults to `https://odla.ai`, and environment
+defaults remain command-specific. There is deliberately no ambient “current”
+context: a saved profile cannot silently retarget commands. A missing named
+context or explicitly named missing `--config` is always an error.
+`context list` inventories profiles, and `context remove <name> --yes` removes
+metadata without deleting caches or revoking grants. Revoke a grant in Studio
+when its authority must end. Set `ODLA_CONTEXT_FILE` to relocate the default
+private `~/.odla/contexts.json` file.
+
+For unattended reads, supply the ordinary revocable owner grant through
+`ODLA_DEV_TOKEN`. Without a project config or explicit token, the normal device
+flow uses the private `~/.odla/dev-token.json` cache. Every named context instead
+uses isolated developer and scoped-token caches beneath
+`~/.odla/profiles/<name>/`; set `ODLA_DEV_TOKEN_FILE` or
+`ODLA_ADMIN_TOKEN_FILE` to override them. Profiles store scope metadata only
+and reject unknown fields, so credentials cannot be added to
+`contexts.json`. A checked-in project continues to use its configured cache
+when no profile is selected. Each cache records its platform audience, and a
+token for another origin is never reused. `context show` reports provenance and
+cache state only; it never returns a credential or starts a device handshake.
+
+```bash
+ODLA_DEV_TOKEN=... npx @odla-ai/cli pm handoff --app <appId>
+ODLA_DEV_TOKEN=... npx @odla-ai/cli discuss list --app <appId> --json
+ODLA_DEV_TOKEN=... npx @odla-ai/cli o11y status --app <appId> --env prod --json
+ODLA_DEV_TOKEN=... npx @odla-ai/cli whoami --json
+npx @odla-ai/cli pm handoff --context production --json
+npx @odla-ai/cli runbook new deploy --context production --title Deploy --file deploy.md
+```
+
 Runbooks tell an agent how to operate; PM tells every agent what this project is
 trying to prove, what is active, what was decided, and what is broken. Once the
 app is registered, start each session by reading its doing tasks, open bugs and
@@ -72,13 +118,22 @@ snapshot instead of scraping Studio or composing collector routes themselves:
 npx odla-ai o11y status --app <appId> --env prod --minutes 60 --json
 ```
 
-Schema v5 keeps application RED, reconciled live-sync load/freshness and
+Schema v9 keeps application RED, an `applicationVersions` breakdown of
+request/error/latency evidence by exact Cloudflare Worker version, reconciled
+live-sync load/freshness and
 subscription recompute/fanout/payload/commit-to-send performance, the exact
 latest protected commit-to-visible canary, collector ingest/scheduler trust,
-the live Cloudflare Worker read, and 30-day-retained provider snapshot history
-with a seven-day maximum per read separate. Scheduled collection failures,
-source age, expected cadence, collection lag, and history truncation remain
-machine-readable. It derives one
+the live Cloudflare Worker read with per-isolate memory headroom, same-window
+request-total reconciliation, and
+30-day-retained provider snapshot history with a seven-day maximum per read
+separate. For `odla-db`, `providerCapacity` adds redacted account-scoped
+Durable Object, D1, and R2 evidence: storage, query/operation/row volume,
+worst database-hour latency, socket/message load, objects/uploads, source
+ages, and per-dataset truncation. Other app scopes return an explicit
+not-applicable envelope without reading account data. The reconciliation ends five minutes behind real time and grades
+monitoring completeness without treating a coverage gap as application
+failure. Scheduled collection failures, source age, expected cadence,
+collection lag, and history truncation remain machine-readable. It derives one
 `healthy`, `degraded`, or `unhealthy` verdict with stable reason codes while
 retaining every source response for diagnosis. Provider unavailability,
 adaptive sampling, publication delay, collector loss, quota rejection, stale
@@ -181,6 +236,7 @@ npx odla-ai runbook impact --base origin/main
 npx odla-ai runbook lint
 npx odla-ai runbook edit db --note "what changed"
 npx odla-ai runbook comment release --body "step 4 no longer applies"
+npx odla-ai context show --app my-app --env prod --json
 npx odla-ai whoami
 npx odla-ai setup
 npx odla-ai init --app-id my-app --name "My App"