@odla-ai/cli 0.25.11 → 0.25.17

package/dist/index.cjs

@@ -304,7 +304,7 @@ var import_node_process2 = __toESM(require("process"), 1);
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? import_node_process2.default.platform);
   const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve11, reject) => {
+  await new Promise((resolve12, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -312,7 +312,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve11();
+      resolve12();
     });
   });
 }
@@ -2246,8 +2246,8 @@ function credential(value) {
 // src/calendar-poll.ts
 async function waitForCalendarPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
-  await new Promise((resolve11, reject) => {
-    const timer = setTimeout(resolve11, milliseconds);
+  await new Promise((resolve12, reject) => {
+    const timer = setTimeout(resolve12, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new Error("calendar connection aborted"));
@@ -2448,7 +2448,8 @@ var CAPABILITIES = {
     "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links",
     "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)",
     "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes",
-    "read one versioned o11y status envelope spanning application RED, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, and a bounded machine verdict",
+    "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout",
+    "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict",
     "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -2470,7 +2471,7 @@ var CAPABILITIES = {
     "approve GitHub App repository access separately from redacted-snippet disclosure"
   ],
   studio: [
-    "view application telemetry, reconciled live-sync load/freshness, commit-to-visible canary health, provider-owned Worker runtime metrics, and environment state",
+    "view application telemetry grouped by exact Worker version, reconciled live-sync load/freshness, commit-to-visible canary health, provider-owned Worker runtime metrics, and environment state",
     "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
     "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
     "perform manual credential recovery \u2014 for the primary owner or any co-owner \u2014 when the CLI's local shown-once copy is unavailable",
@@ -5476,21 +5477,21 @@ async function verifyCodeCandidate(input) {
     const recipes = [];
     const logs = [];
     for (const recipe2 of policy.recipes) {
-      const clean = await stageWorkspace(staged.workspaceDir, limits);
+      const clean4 = await stageWorkspace(staged.workspaceDir, limits);
       try {
-        if (await digestStagedWorkspace(clean.workspaceDir, limits) !== sourceDigest) {
+        if (await digestStagedWorkspace(clean4.workspaceDir, limits) !== sourceDigest) {
           throw new TypeError("clean verifier source changed before execution");
         }
         const result = checkedResult(await input.recipeExecutor.run({
-          workspaceDir: clean.workspaceDir,
+          workspaceDir: clean4.workspaceDir,
           recipe: recipe2,
           signal: input.signal
         }), recipe2.maxOutputBytes);
-        const artifacts = await inspectArtifacts(clean.workspaceDir, recipe2);
+        const artifacts = await inspectArtifacts(clean4.workspaceDir, recipe2);
         recipes.push(recipeReceipt(recipe2, result, artifacts));
         logs.push({ recipeId: recipe2.id, ...boundedLogs(result, recipe2.maxOutputBytes) });
       } finally {
-        await clean.cleanup();
+        await clean4.cleanup();
       }
     }
     const fields = {
@@ -6631,8 +6632,12 @@ Usage:
   odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
   odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
   odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
-  odla-ai o11y status [--app <id>] [--env prod] [--minutes 60] [--json]
-  odla-ai whoami [--json]
+  odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
+  odla-ai context list [--json]
+  odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
+  odla-ai context remove <name> --yes [--json]
+  odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
+  odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
   odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
   odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
   odla-ai runbook impact [--base origin/main] [--app <id>] [--all] [--limit <n>] [--json]
@@ -6697,6 +6702,11 @@ Commands:
   whoami       Report who this terminal is authenticated as, and whether it holds
                platform admin. A handshake-minted device token is never admin,
                however the human who approved it is configured.
+  context      Explain selected config, platform, app, environment, and
+               developer-token provenance without printing credentials or
+               starting a device handshake. Operator work can run outside a
+               project checkout with explicit flags or ODLA_* environment
+               variables.
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
@@ -6768,6 +6778,15 @@ Safety:
   Provision caches the approved developer token and service credentials under
   .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
   preflights Wrangler before any shown-once issuance or destructive rotation.
+  Projectless PM, Discussions, o11y, runbook, and identity commands use
+  --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
+  ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
+  select it explicitly with --context or ODLA_CONTEXT. Each named context gets
+  isolated developer and scoped-token caches. Override their locations with
+  ODLA_DEV_TOKEN_FILE and ODLA_ADMIN_TOKEN_FILE; ODLA_CONTEXT_FILE relocates
+  the metadata file. Flags and specific ODLA_* scope variables beat a selected
+  context, which beats project config. There is no ambient current context.
+  "context show" reports only provenance and cache state and never authenticates.
   Provision opens the approval page in your browser automatically whenever the
   machine can show one, including agent-driven runs; only CI, SSH, and
   display-less hosts skip it. Use --open to force or --no-open to suppress.
@@ -6885,8 +6904,8 @@ function hostedPollTimeout(value = 10 * 6e4) {
 }
 async function waitForHostedPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
-  await new Promise((resolve11, reject) => {
-    const timer = setTimeout(resolve11, milliseconds);
+  await new Promise((resolve12, reject) => {
+    const timer = setTimeout(resolve12, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new DOMException("aborted", "AbortError"));
@@ -7396,6 +7415,384 @@ async function codeCommand(parsed, dependencies) {
   });
 }
 
+// src/operator-credentials.ts
+var import_node_process7 = __toESM(require("process"), 1);
+function developerTokenStatus(context, parsed, now = Date.now()) {
+  const cached = readJsonFile(context.cfg.local.tokenFile);
+  const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
+  const source = clean(
+    stringOpt(parsed.options.token)
+  ) ? "flag" : clean(import_node_process7.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  return {
+    source,
+    cacheFile: context.cfg.local.tokenFile,
+    cacheStatus
+  };
+}
+function clean(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+
+// src/operator-context.ts
+var import_node_fs14 = require("fs");
+var import_node_path12 = require("path");
+var import_node_process9 = __toESM(require("process"), 1);
+
+// src/operator-profiles.ts
+var import_node_fs13 = require("fs");
+var import_node_os4 = require("os");
+var import_node_path11 = require("path");
+var import_node_process8 = __toESM(require("process"), 1);
+function operatorProfileFile() {
+  return (0, import_node_path11.resolve)(
+    clean2(import_node_process8.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".odla", "contexts.json")
+  );
+}
+function resolveOperatorProfile(parsed) {
+  const fromFlag = clean2(stringOpt(parsed.options.context));
+  const fromEnvironment = clean2(import_node_process8.default.env.ODLA_CONTEXT);
+  const name = fromFlag ?? fromEnvironment ?? null;
+  const file = operatorProfileFile();
+  if (!name) {
+    return { name: null, source: "unresolved", file, value: null };
+  }
+  assertOperatorName(name, "context");
+  const profiles = readOperatorProfiles(file);
+  const value = Object.hasOwn(profiles, name) ? profiles[name] : void 0;
+  if (!value) {
+    throw new Error(
+      `operator context "${name}" not found in ${file}; run "odla-ai context list" or save it first`
+    );
+  }
+  return {
+    name,
+    source: fromFlag ? "flag" : "environment",
+    file,
+    value
+  };
+}
+function listOperatorProfiles(file = operatorProfileFile()) {
+  return Object.entries(readOperatorProfiles(file)).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({ name, ...profile }));
+}
+function saveOperatorProfile(name, profile, file = operatorProfileFile()) {
+  assertOperatorName(name, "context");
+  const normalized = validateProfile(profile, `operator context "${name}"`);
+  const profiles = readOperatorProfiles(file);
+  profiles[name] = normalized;
+  writePrivateJson(file, { schemaVersion: 1, profiles });
+}
+function removeOperatorProfile(name, file = operatorProfileFile()) {
+  assertOperatorName(name, "context");
+  const profiles = readOperatorProfiles(file);
+  if (!Object.hasOwn(profiles, name)) return false;
+  delete profiles[name];
+  writePrivateJson(file, { schemaVersion: 1, profiles });
+  return true;
+}
+function operatorCredentialFiles(selection) {
+  const base = selection.name ? (0, import_node_path11.join)((0, import_node_path11.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".odla");
+  return {
+    developer: (0, import_node_path11.join)(base, "dev-token.json"),
+    scoped: (0, import_node_path11.join)(base, "admin-token.local.json")
+  };
+}
+function assertOperatorName(value, label) {
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(value)) {
+    throw new Error(
+      `${label} must contain lowercase letters, numbers, and hyphens`
+    );
+  }
+}
+function readOperatorProfiles(file) {
+  if (!(0, import_node_fs13.existsSync)(file)) return emptyProfiles();
+  let raw;
+  try {
+    raw = JSON.parse((0, import_node_fs13.readFileSync)(file, "utf8"));
+  } catch {
+    throw new Error(`operator context file ${file} is not valid JSON`);
+  }
+  if (!raw || typeof raw !== "object" || raw.schemaVersion !== 1 || !raw.profiles || typeof raw.profiles !== "object" || Array.isArray(raw.profiles)) {
+    throw new Error(`operator context file ${file} has an invalid shape`);
+  }
+  const unknown = Object.keys(raw).filter(
+    (key) => !["schemaVersion", "profiles"].includes(key)
+  );
+  if (unknown.length > 0) {
+    throw new Error(
+      `operator context file ${file} contains unsupported field(s): ${unknown.sort().join(", ")}`
+    );
+  }
+  const profiles = emptyProfiles();
+  for (const [name, value] of Object.entries(
+    raw.profiles
+  )) {
+    assertOperatorName(name, "context");
+    profiles[name] = validateProfile(value, `operator context "${name}"`);
+  }
+  return profiles;
+}
+function emptyProfiles() {
+  return /* @__PURE__ */ Object.create(null);
+}
+function validateProfile(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} has an invalid shape`);
+  }
+  const unknown = Object.keys(value).filter(
+    (key) => !["platform", "app", "environment"].includes(key)
+  );
+  if (unknown.length > 0) {
+    throw new Error(
+      `${label} contains unsupported field(s): ${unknown.sort().join(", ")}; contexts store scope metadata only, never credentials`
+    );
+  }
+  const candidate = value;
+  if (typeof candidate.platform !== "string") {
+    throw new Error(`${label} needs an absolute platform URL`);
+  }
+  const platform = platformAudience(candidate.platform);
+  const app = clean2(candidate.app);
+  const environment2 = clean2(candidate.environment);
+  if (app) assertOperatorName(app, "app");
+  if (environment2) assertOperatorName(environment2, "environment");
+  return {
+    platform,
+    ...app ? { app } : {},
+    ...environment2 ? { environment: environment2 } : {}
+  };
+}
+function clean2(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+
+// src/operator-context.ts
+var DEFAULT_PLATFORM2 = "https://odla.ai";
+async function resolveOperatorContext(parsed, options = {}) {
+  const profile = resolveOperatorProfile(parsed);
+  const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+  const configPath = (0, import_node_path12.resolve)(configArgument);
+  const explicitConfig = parsed.options.config !== void 0;
+  const hasConfig = (0, import_node_fs14.existsSync)(configPath);
+  if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
+    await loadProjectConfig(configArgument);
+  }
+  const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
+  const platformFlag = clean3(stringOpt(parsed.options.platform));
+  const platformEnvironment = clean3(import_node_process9.default.env.ODLA_PLATFORM_URL);
+  const platformValue = platformAudience(
+    platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
+  );
+  const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
+  const appFlag = clean3(stringOpt(parsed.options.app));
+  const appEnvironment = clean3(import_node_process9.default.env.ODLA_APP_ID);
+  const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
+  const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
+  if (appValue) assertOperatorName(appValue, "app");
+  if (options.requireApp && !appValue) {
+    throw new Error(
+      "app context is unresolved; pass --app <id>, set ODLA_APP_ID, select --context <name>, or run inside a project with odla.config.mjs"
+    );
+  }
+  const envFlag = clean3(stringOpt(parsed.options.env));
+  const envEnvironment = clean3(import_node_process9.default.env.ODLA_ENV);
+  const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
+  const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
+  if (environmentValue) {
+    assertOperatorName(environmentValue, "environment");
+  }
+  const rootDir = loaded?.rootDir ?? import_node_process9.default.cwd();
+  const profileCredentials = operatorCredentialFiles(profile);
+  const tokenFile = clean3(import_node_process9.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path12.resolve)(import_node_process9.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile = clean3(import_node_process9.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path12.resolve)(import_node_process9.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path12.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const cfg = loaded ? {
+    ...loaded,
+    platformUrl: platformValue,
+    app: appValue ? {
+      id: appValue,
+      name: appValue === loaded.app.id ? loaded.app.name : appValue
+    } : loaded.app,
+    local: { ...loaded.local, tokenFile }
+  } : {
+    configPath,
+    rootDir,
+    platformUrl: platformValue,
+    dbEndpoint: platformValue,
+    app: {
+      id: appValue ?? "operator",
+      name: appValue ?? "Operator"
+    },
+    envs: environmentValue ? [environmentValue] : [],
+    services: [],
+    local: {
+      tokenFile,
+      credentialsFile: (0, import_node_path12.join)(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: (0, import_node_path12.join)(rootDir, ".dev.vars"),
+      gitignore: true
+    }
+  };
+  return {
+    cfg,
+    profile: {
+      name: profile.name,
+      source: profile.source,
+      file: profile.file
+    },
+    config: {
+      path: configPath,
+      status: loaded ? "loaded" : "absent",
+      explicit: explicitConfig
+    },
+    platform: { value: platformValue, source: platformSource },
+    app: { value: appValue, source: appSource },
+    environment: {
+      value: environmentValue,
+      source: environmentSource
+    },
+    credentials: {
+      developerTokenFile: tokenFile,
+      scopedTokenFile
+    }
+  };
+}
+function clean3(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+
+// src/context-command.ts
+async function contextCommand(parsed, deps = {}) {
+  assertArgs(
+    parsed,
+    [
+      "config",
+      "context",
+      "platform",
+      "app",
+      "env",
+      "token",
+      "json",
+      "yes"
+    ],
+    3
+  );
+  const action = parsed.positionals[1];
+  const out = deps.stdout ?? console;
+  if (action === "list") {
+    const profiles = listOperatorProfiles();
+    if (parsed.options.json === true) {
+      out.log(JSON.stringify({ schemaVersion: 1, profiles }, null, 2));
+      return;
+    }
+    if (profiles.length === 0) {
+      out.log("No named operator contexts.");
+      return;
+    }
+    out.log("name	platform	app	environment");
+    for (const profile of profiles) {
+      out.log(
+        `${profile.name}	${profile.platform}	${profile.app ?? ""}	${profile.environment ?? ""}`
+      );
+    }
+    return;
+  }
+  if (action === "save") {
+    if (parsed.options.token !== void 0) {
+      throw new Error(
+        "context save does not accept --token; contexts store scope metadata only"
+      );
+    }
+    const name = requireName(parsed);
+    const context2 = await resolveOperatorContext(parsed, {
+      allowMissingConfig: true
+    });
+    const profile = {
+      platform: context2.platform.value,
+      ...context2.app.value ? { app: context2.app.value } : {},
+      ...context2.environment.value ? { environment: context2.environment.value } : {}
+    };
+    saveOperatorProfile(name, profile, context2.profile.file);
+    if (parsed.options.json === true) {
+      out.log(JSON.stringify({ schemaVersion: 1, name, ...profile }, null, 2));
+    } else {
+      out.log(`saved operator context "${name}" (${profile.platform})`);
+    }
+    return;
+  }
+  if (action === "remove") {
+    const name = requireName(parsed);
+    if (parsed.options.yes !== true) {
+      throw new Error(`context remove "${name}" requires --yes`);
+    }
+    const removed = removeOperatorProfile(name);
+    const result2 = {
+      schemaVersion: 1,
+      name,
+      removed,
+      credentialCachesRemoved: false,
+      grantsRevoked: false
+    };
+    if (parsed.options.json === true) out.log(JSON.stringify(result2, null, 2));
+    else {
+      const status = removed ? `removed operator context "${name}"` : `operator context "${name}" was already absent`;
+      out.log(`${status}; credential caches were not deleted or revoked`);
+    }
+    return;
+  }
+  if (action !== "show") {
+    throw new Error(
+      `unknown context action "${action ?? ""}". Try show|list|save|remove.`
+    );
+  }
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true,
+    defaultEnvironment: "prod"
+  });
+  const token = developerTokenStatus(context, parsed);
+  const result = {
+    schemaVersion: 1,
+    profile: context.profile,
+    config: context.config,
+    platform: context.platform,
+    app: context.app,
+    environment: context.environment,
+    authentication: {
+      developerToken: token,
+      scopedTokenCacheFile: context.credentials.scopedTokenFile,
+      handshakeStarted: false
+    }
+  };
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  out.log(`config:    ${context.config.status} (${context.config.path})`);
+  out.log(
+    `context:   ${context.profile.name ?? "(none)"} (${context.profile.source}; ${context.profile.file})`
+  );
+  out.log(
+    `platform:  ${context.platform.value} (${context.platform.source})`
+  );
+  out.log(
+    `app:       ${context.app.value ?? "(unresolved)"} (${context.app.source})`
+  );
+  out.log(
+    `env:       ${context.environment.value ?? "(unresolved)"} (${context.environment.source})`
+  );
+  out.log(
+    `auth:      ${token.source} (cache ${token.cacheStatus}: ${token.cacheFile})`
+  );
+  out.log("handshake: not started");
+}
+function requireName(parsed) {
+  const name = parsed.positionals[2]?.trim();
+  if (!name) {
+    throw new Error(`context ${parsed.positionals[1]} needs a profile name`);
+  }
+  return name;
+}
+
 // src/discuss-actions.ts
 var writeMutationId = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 async function request(ctx, method, path, body) {
@@ -7447,8 +7844,9 @@ async function discussGroups(ctx) {
 }
 async function discussList(ctx, parsed) {
   const query = new URLSearchParams();
+  const app = stringOpt(parsed.options.app) ?? ctx.appId;
+  if (app) query.set("app", app);
   for (const [flag, param] of [
-    ["app", "app"],
     ["q", "q"],
     ["state", "state"],
     ["limit", "limit"],
@@ -7524,7 +7922,7 @@ function renderRead(ctx, topic, posts) {
   }
 }
 async function discussPost(ctx, parsed) {
-  const appId = stringOpt(parsed.options.app);
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("discuss post needs --app <appId>");
   const subject = stringOpt(parsed.options.subject);
   if (!subject) throw new Error('discuss post needs --subject "\u2026"');
@@ -7556,7 +7954,7 @@ async function discussResolve(ctx, id, resolved, parsed) {
 }
 async function discussWho(ctx, parsed) {
   const query = new URLSearchParams({ q: stringOpt(parsed.options.q) ?? "" });
-  const app = stringOpt(parsed.options.app);
+  const app = stringOpt(parsed.options.app) ?? ctx.appId;
   if (app) query.set("app", app);
   const kinds = stringOpt(parsed.options.kinds);
   if (kinds) query.set("kinds", kinds);
@@ -7660,14 +8058,14 @@ function jsonl(ctx, parsed, value) {
 }
 async function discussWatch(ctx, topicId, parsed) {
   if (ctx.json && parsed.options.jsonl === true) throw new Error("--json and --jsonl cannot be combined");
-  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve11) => setTimeout(resolve11, ms)));
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
   const now = ctx.now ?? Date.now;
   const intervalMs = (numberOpt2(parsed, "interval", DEFAULT_INTERVAL_MS / 1e3) ?? DEFAULT_INTERVAL_MS / 1e3) * 1e3;
   const timeoutSeconds = numberOpt2(parsed, "timeout");
   const deadline = timeoutSeconds === void 0 ? void 0 : now() + timeoutSeconds * 1e3;
   const by = stringOpt(parsed.options.by);
   const self = stringOpt(parsed.options.self);
-  const app = stringOpt(parsed.options.app);
+  const app = stringOpt(parsed.options.app) ?? ctx.appId;
   let cursor = stringOpt(parsed.options.cursor);
   let firstSuccess = true;
   let consecutiveFailures = 0;
@@ -7812,14 +8210,19 @@ var ALLOWED = [
   "timeout",
   "cursor",
   "jsonl",
-  "mutation-id"
+  "mutation-id",
+  "platform",
+  "context"
 ];
 function requireId(id, action) {
   if (!id) throw new Error(`"discuss ${action}" needs a topic id`);
   return id;
 }
 async function buildContext(parsed, deps) {
-  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const { cfg } = context;
   const doFetch = deps.fetch ?? fetch;
   const out = deps.stdout ?? console;
   const token = await getDeveloperToken(
@@ -7833,7 +8236,16 @@ async function buildContext(parsed, deps) {
     doFetch,
     out
   );
-  return { platformUrl: cfg.platformUrl, token, doFetch, out, json: parsed.options.json === true };
+  return {
+    platformUrl: cfg.platformUrl,
+    token,
+    doFetch,
+    out,
+    json: parsed.options.json === true,
+    // Preserve Discussions' existing cross-project default for config-backed
+    // use while allowing remote agents to scope via ODLA_APP_ID or a profile.
+    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0
+  };
 }
 async function discussCommand(parsed, deps = {}) {
   assertArgs(parsed, ALLOWED, 3);
@@ -7945,7 +8357,7 @@ async function pmList(ctx, entity, parsed) {
     assignee: "assigneeId",
     decision: "decisionId"
   };
-  const app = stringOpt(parsed.options.app);
+  const app = stringOpt(parsed.options.app) ?? ctx.appId;
   if (app) q.set("app", app);
   for (const [flag, param] of Object.entries(filters)) {
     const v = stringOpt(parsed.options[flag]);
@@ -7964,7 +8376,7 @@ async function pmList(ctx, entity, parsed) {
   });
 }
 async function pmAdd(ctx, entity, parsed) {
-  const appId = stringOpt(parsed.options.app);
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("pm add needs --app <appId>");
   const input = collectEntityFields(entity, parsed, false);
   if (!input.title) throw new Error("pm add needs --title <title>");
@@ -8015,7 +8427,7 @@ async function allRecords(ctx, entity, appId) {
   }
 }
 async function pmHandoff(ctx, parsed) {
-  const appId = stringOpt(parsed.options.app);
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("pm handoff needs --app <appId>");
   const [goals, tasks, bugs] = await Promise.all([
     allRecords(ctx, "goal", appId),
@@ -8110,14 +8522,19 @@ var ALLOWED2 = [
   "limit",
   "offset",
   "q",
-  "mutation-id"
+  "mutation-id",
+  "platform",
+  "context"
 ];
 function requireId2(id, action) {
   if (!id) throw new Error(`"pm ... ${action}" needs an item id`);
   return id;
 }
 async function buildContext2(parsed, deps) {
-  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const { cfg } = context;
   const doFetch = deps.fetch ?? fetch;
   const out = deps.stdout ?? console;
   const token = await getDeveloperToken(
@@ -8126,7 +8543,16 @@ async function buildContext2(parsed, deps) {
     doFetch,
     out
   );
-  return { platformUrl: cfg.platformUrl, token, doFetch, out, json: parsed.options.json === true };
+  return {
+    platformUrl: cfg.platformUrl,
+    token,
+    doFetch,
+    out,
+    json: parsed.options.json === true,
+    // Preserve PM's existing cross-project default when a config is present;
+    // only an explicit remote-agent environment or profile selects an app.
+    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0
+  };
 }
 async function pmCommand(parsed, deps = {}) {
   const word = parsed.positionals[1] ?? "";
@@ -8175,6 +8601,20 @@ function statusVerdict(reads) {
   sourceHttp(reasons, "canary", reads.canary);
   sourceHttp(reasons, "collector", reads.collector);
   sourceHttp(reasons, "provider", reads.provider);
+  if (reads.providerCapacity) {
+    sourceHttp(
+      reasons,
+      "provider",
+      reads.providerCapacity,
+      "provider_capacity_"
+    );
+  }
+  sourceHttp(
+    reasons,
+    "provider",
+    reads.providerReconciliation,
+    "provider_reconciliation_"
+  );
   sourceHttp(reasons, "provider", reads.providerHistory, "provider_history_");
   const liveStatus = String(reads.liveSync.body.status ?? "");
   if (liveStatus === "partial") {
@@ -8247,6 +8687,17 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
+  const reconciliationStatus = String(
+    reads.providerReconciliation.body.status ?? ""
+  );
+  if (reads.providerReconciliation.httpStatus >= 200 && reads.providerReconciliation.httpStatus < 300 && reconciliationStatus && reconciliationStatus !== "within_budget") {
+    const reconciliationReason = reads.providerReconciliation.body.reason;
+    reasons.push({
+      source: "provider",
+      code: reconciliationStatus === "outside_budget" ? typeof reconciliationReason === "string" && reconciliationReason ? reconciliationReason : "request_coverage_outside_budget" : `request_reconciliation_${reconciliationStatus}`,
+      severity: "degraded"
+    });
+  }
   const providerHistoryStatus = String(reads.providerHistory.body.status ?? "");
   if (providerHistoryStatus && providerHistoryStatus !== "observed" && providerHistoryStatus !== "no_data") {
     reasons.push({
@@ -8283,11 +8734,138 @@ function sourceHttp(reasons, source, read3, prefix = "") {
   });
 }
 
+// src/o11y-output.ts
+function printO11yStatus(status, out) {
+  out.log(
+    `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
+  );
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record6) : [];
+  const requests = routes.reduce(
+    (total, row) => total + numeric3(row.requests),
+    0
+  );
+  const errors = routes.reduce(
+    (total, row) => total + numeric3(row.errors),
+    0
+  );
+  out.log(
+    `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
+  );
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record6) : [];
+  out.log(
+    `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
+      (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
+    ).join(", ") : "none observed"}`
+  );
+  out.log(liveSyncLine(status.liveSync));
+  const canaryDurations = record6(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  out.log(
+    `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
+  );
+  const collectorIngest = record6(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record6(collectorIngest.storage) ? collectorIngest.storage : {};
+  out.log(
+    `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
+  );
+  const providerMetrics = record6(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record6(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record6(providerCapacity.memory) ? providerCapacity.memory : {};
+  out.log(
+    `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
+  );
+  for (const line of providerCapacityLines(status.providerCapacity)) {
+    out.log(line);
+  }
+  const coverage = record6(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record6(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record6(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  out.log(
+    `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
+  );
+  const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
+  const providerFreshness = record6(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  out.log(
+    `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
+  );
+  out.log(
+    `verdict	${status.verdict.status}	${status.verdict.reasons.map((reason) => `${reason.source}:${reason.code}`).join(", ") || "all required signals healthy"}`
+  );
+}
+function providerCapacityLines(read3) {
+  const resources = record6(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record6(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record6(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record6(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record6(resources.d1) ? resources.d1 : {};
+  const d1Activity = record6(d1.activity) ? d1.activity : {};
+  const d1Storage = record6(d1.storage) ? d1.storage : {};
+  const d1Latency = record6(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record6(resources.r2) ? resources.r2 : {};
+  const r2Operations = record6(r2.operations) ? r2.operations : {};
+  const r2Storage = record6(r2.storage) ? r2.storage : {};
+  const status = String(
+    read3.body.status ?? read3.body.error ?? "unavailable"
+  );
+  return [
+    `cloudflare-capacity	${read3.httpStatus}	${status}	${optionalBytes(storage.storedBytes)} SQLite DO storage	${optionalCount(periodic.activeWebsocketConnectionsMax, "active socket max")}	${optionalAgeSeconds(storage.ageSeconds)} storage evidence age`,
+    `cloudflare-d1	${read3.httpStatus}	${status}	${optionalBytes(d1Storage.databaseSizeBytes)} storage	${numeric3(d1Activity.readQueries) + numeric3(d1Activity.writeQueries)} queries	${numeric3(d1Activity.rowsRead)}/${numeric3(d1Activity.rowsWritten)} rows read/written	${optionalNumeric(d1Latency.worstDatabaseHourP99Ms)} worst database-hour p99	${optionalAgeSeconds(d1Activity.ageSeconds)} activity evidence age`,
+    `cloudflare-r2	${read3.httpStatus}	${status}	${optionalBytes(r2Storage.storedBytes)} storage	${numeric3(r2Storage.objectCount)} objects	${numeric3(r2Operations.requests)} operations	${numeric3(r2Operations.userErrorRequests) + numeric3(r2Operations.internalErrorRequests)} provider errors	${optionalAgeSeconds(r2Operations.ageSeconds)} operation evidence age`
+  ];
+}
+function liveSyncLine(read3) {
+  const performance = record6(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record6(performance.commitToSend) ? performance.commitToSend : {};
+  return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
+}
+function record6(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function numeric3(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function optionalNumeric(value) {
+  return typeof value === "number" && Number.isFinite(value) ? `${value} ms` : "\u2014";
+}
+function optionalAge(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return "unknown";
+  return `${Math.max(0, Math.round(value / 1e3))}s`;
+}
+function optionalPercent(value) {
+  return typeof value === "number" && Number.isFinite(value) ? `${Math.round(value * 100)}%` : "\u2014";
+}
+function optionalBytes(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return "\u2014";
+  if (value >= 1024 * 1024 * 1024) {
+    return `${(value / (1024 * 1024 * 1024)).toFixed(2)} GiB`;
+  }
+  if (value >= 1024 * 1024) {
+    return `${(value / (1024 * 1024)).toFixed(1)} MiB`;
+  }
+  if (value >= 1024) return `${(value / 1024).toFixed(1)} KiB`;
+  return `${Math.round(value)} B`;
+}
+function optionalCount(value, unit) {
+  return typeof value === "number" && Number.isFinite(value) ? `${value} ${unit}` : `\u2014 ${unit}`;
+}
+function optionalAgeSeconds(value) {
+  return typeof value === "number" && Number.isFinite(value) ? `${Math.max(0, Math.round(value))}s` : "unknown";
+}
+
 // src/o11y-command.ts
 async function o11yCommand(parsed, deps = {}) {
   assertArgs(
     parsed,
-    ["config", "token", "email", "json", "app", "env", "minutes"],
+    [
+      "config",
+      "context",
+      "platform",
+      "token",
+      "email",
+      "json",
+      "app",
+      "env",
+      "minutes"
+    ],
     2
   );
   const action = parsed.positionals[1];
@@ -8299,9 +8877,12 @@ async function o11yCommand(parsed, deps = {}) {
   const minutes = statusMinutes(
     numberOpt(parsed.options.minutes, "--minutes") ?? 60
   );
-  const cfg = await loadProjectConfig(
-    stringOpt(parsed.options.config) ?? "odla.config.mjs"
-  );
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true,
+    defaultEnvironment: "prod",
+    requireApp: true
+  });
+  const cfg = context.cfg;
   const doFetch = deps.fetch ?? fetch;
   const out = deps.stdout ?? console;
   const token = await getDeveloperToken(
@@ -8315,13 +8896,30 @@ async function o11yCommand(parsed, deps = {}) {
     doFetch,
     out
   );
-  const appId = stringOpt(parsed.options.app)?.trim() || cfg.app.id;
-  const env = stringOpt(parsed.options.env)?.trim() || "prod";
+  const appId = context.app.value;
+  const env = context.environment.value;
   const base = `${cfg.platformUrl}/o11y/${encodeURIComponent(appId)}`;
   const query = new URLSearchParams({ env, minutes: String(minutes) });
   const headers = { authorization: `Bearer ${token}` };
-  const [application, liveSync, canary, collector, provider, providerHistory] = await Promise.all([
+  const versionsQuery = new URLSearchParams({
+    env,
+    minutes: String(minutes),
+    dimension: "version",
+    metric: "requests"
+  });
+  const [
+    application,
+    applicationVersions,
+    liveSync,
+    canary,
+    collector,
+    provider,
+    providerCapacity,
+    providerReconciliation,
+    providerHistory
+  ] = await Promise.all([
     read2(`${base}/metrics/red?${query}`, headers, doFetch),
+    read2(`${base}/explore?${versionsQuery}`, headers, doFetch),
     read2(
       `${base}/live-sync/health?${query}`,
       headers,
@@ -8334,6 +8932,19 @@ async function o11yCommand(parsed, deps = {}) {
     ),
     read2(`${base}/self-health?${query}`, headers, doFetch),
     read2(`${base}/provider/cloudflare?${query}`, headers, doFetch),
+    appId === "odla-db" ? read2(`${base}/provider/cloudflare/capacity`, headers, doFetch) : Promise.resolve({
+      httpStatus: 204,
+      body: {
+        status: "not_applicable",
+        scope: "cloudflare_account",
+        reason: "account-scoped Durable Object capacity is exposed only through odla-db"
+      }
+    }),
+    read2(
+      `${base}/provider/cloudflare/reconciliation?${query}`,
+      headers,
+      doFetch
+    ),
     read2(`${base}/provider/cloudflare/history?${query}`, headers, doFetch)
   ]);
   const verdict = statusVerdict({
@@ -8342,25 +8953,30 @@ async function o11yCommand(parsed, deps = {}) {
     canary,
     collector,
     provider,
+    providerCapacity,
+    providerReconciliation,
     providerHistory
   });
   const status = {
-    schemaVersion: 5,
+    schemaVersion: 9,
     scope: { appId, env, minutes },
     observedAt: (/* @__PURE__ */ new Date()).toISOString(),
     verdict,
     application,
+    applicationVersions,
     liveSync,
     canary,
     collector,
     provider,
+    providerCapacity,
+    providerReconciliation,
     providerHistory
   };
   if (parsed.options.json === true) {
     out.log(JSON.stringify(status, null, 2));
     return;
   }
-  printStatus2(status, out);
+  printO11yStatus(status, out);
 }
 function statusMinutes(value) {
   if (!Number.isSafeInteger(value) || value < 1 || value > 7 * 24 * 60) {
@@ -8382,70 +8998,11 @@ async function read2(url, headers, doFetch) {
   }
   return { httpStatus: response2.status, body };
 }
-function printStatus2(status, out) {
-  out.log(
-    `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
-  );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record6) : [];
-  const requests = routes.reduce(
-    (total, row) => total + numeric3(row.requests),
-    0
-  );
-  const errors = routes.reduce(
-    (total, row) => total + numeric3(row.errors),
-    0
-  );
-  out.log(
-    `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
-  );
-  out.log(
-    liveSyncLine(status.liveSync)
-  );
-  const canaryDurations = record6(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
-  out.log(
-    `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
-  );
-  const collectorIngest = record6(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record6(collectorIngest.storage) ? collectorIngest.storage : {};
-  out.log(
-    `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
-  );
-  const providerMetrics = record6(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  out.log(
-    `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors`
-  );
-  const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record6(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
-  out.log(
-    `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
-  );
-  out.log(
-    `verdict	${status.verdict.status}	${status.verdict.reasons.map((reason) => `${reason.source}:${reason.code}`).join(", ") || "all required signals healthy"}`
-  );
-}
-function liveSyncLine(read3) {
-  const performance = record6(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record6(performance.commitToSend) ? performance.commitToSend : {};
-  return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
-}
-function record6(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function numeric3(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : 0;
-}
-function optionalNumeric(value) {
-  return typeof value === "number" && Number.isFinite(value) ? `${value} ms` : "\u2014";
-}
-function optionalAge(value) {
-  if (typeof value !== "number" || !Number.isFinite(value)) return "unknown";
-  return `${Math.max(0, Math.round(value / 1e3))}s`;
-}
 
 // src/provision.ts
 var import_apps5 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
-var import_node_process7 = __toESM(require("process"), 1);
+var import_node_process10 = __toESM(require("process"), 1);
 
 // src/integration-provision.ts
 var import_db3 = require("@odla-ai/db");
@@ -8804,7 +9361,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process7.default.env[cfg.ai.keyEnv];
+      const key = import_node_process10.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -8845,8 +9402,8 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
 }
 
 // src/record.ts
-var import_node_fs13 = require("fs");
-var import_node_process8 = __toESM(require("process"), 1);
+var import_node_fs15 = require("fs");
+var import_node_process11 = __toESM(require("process"), 1);
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -8894,6 +9451,7 @@ var COMMAND_SURFACE = {
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
+  context: { show: {}, list: {}, save: {}, remove: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
     groups: {},
@@ -8997,7 +9555,7 @@ function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process8.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process11.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -9005,19 +9563,14 @@ function recordInvocation(parsed) {
       options: Object.keys(parsed.options).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs13.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs15.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
 }
 
-// src/runbook-command.ts
-var import_node_fs18 = require("fs");
-var import_node_path14 = require("path");
-var import_node_process10 = __toESM(require("process"), 1);
-
 // src/runbook-actions.ts
-var import_node_fs14 = require("fs");
+var import_node_fs16 = require("fs");
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
@@ -9102,7 +9655,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs14.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs16.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -9189,8 +9742,8 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-var import_node_fs15 = require("fs");
-var import_node_path11 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path13 = require("path");
 function parseRunbook(text, slug) {
   let rest = text;
   const meta = {};
@@ -9215,12 +9768,12 @@ function parseRunbook(text, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs15.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs15.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs17.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path11.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs15.readFileSync)((0, import_node_path11.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path13.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path13.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -9292,8 +9845,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs16 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs18 = require("fs");
+var import_node_path14 = require("path");
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -9462,10 +10015,10 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path12.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs16.existsSync)(manifest)) return void 0;
+    const manifest = (0, import_node_path14.join)(root, workspace, "package.json");
+    if (!(0, import_node_fs18.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs16.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs18.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -9532,7 +10085,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs16.readFileSync)((0, import_node_path12.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path14.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -9665,12 +10218,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 var import_node_child_process8 = require("child_process");
-var import_node_fs17 = require("fs");
-var import_node_os4 = require("os");
-var import_node_path13 = require("path");
-var import_node_process9 = __toESM(require("process"), 1);
+var import_node_fs19 = require("fs");
+var import_node_os5 = require("os");
+var import_node_path15 = require("path");
+var import_node_process12 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = import_node_process9.default.env) {
+function resolveEditor(env = import_node_process12.default.env) {
   for (const name of EDITOR_ENV) {
     const value = env[name];
     if (value && value.trim()) return value.trim();
@@ -9684,8 +10237,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process9.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process9.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process12.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process12.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -9693,16 +10246,16 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs17.mkdtempSync)((0, import_node_path13.join)((0, import_node_os4.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path13.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path15.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path15.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs17.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs19.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs17.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs19.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs17.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -9740,10 +10293,16 @@ function credentialKind(identity) {
   return identity.scopes.length ? "device token (scoped)" : "device token or session";
 }
 async function whoamiCommand(parsed, deps = {}) {
-  assertArgs(parsed, ["config", "token", "email", "json"], 1);
+  assertArgs(
+    parsed,
+    ["config", "context", "platform", "token", "email", "json"],
+    1
+  );
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const { cfg } = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
   const token = await getDeveloperToken(
     cfg,
     {
@@ -9792,34 +10351,24 @@ var ALLOWED3 = [
   "dry-run",
   "limit",
   "base",
-  "requires"
+  "requires",
+  "platform",
+  "context"
 ];
 function requireSlug(slug, action) {
   if (!slug) throw new Error(`"runbook ${action}" needs a slug, e.g. "odla-ai runbook ${action} release"`);
   return slug;
 }
 var WRITES = /* @__PURE__ */ new Set(["new", "edit", "publish", "archive", "visibility", "revert", "rm", "import"]);
-var CONFIG_FREE = /* @__PURE__ */ new Set(["list", "search", "ask", "get", "cat", "history", "impact", "lint"]);
-async function loadOrDefaultConfig(configPath, action, appId) {
-  const projectScoped = appId !== void 0;
-  if (!projectScoped && CONFIG_FREE.has(action) && !(0, import_node_fs18.existsSync)((0, import_node_path14.resolve)(configPath))) {
-    const rootDir = import_node_process10.default.cwd();
-    return {
-      configPath,
-      platformUrl: import_node_process10.default.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
-      rootDir,
-      app: { id: "", name: "" },
-      local: { tokenFile: (0, import_node_path14.join)(rootDir, ".odla/dev-token.json") }
-    };
-  }
-  return loadProjectConfig(configPath);
-}
 async function buildContext3(parsed, deps, action) {
-  const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
-  const cfg = await loadOrDefaultConfig(configPath, action, stringOpt(parsed.options.app));
+  const appIdOption = stringOpt(parsed.options.app);
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const { cfg } = context;
   const doFetch = deps.fetch ?? fetch;
   const out = deps.stdout ?? console;
-  const appId = stringOpt(parsed.options.app) ?? PLATFORM_SCOPE;
+  const appId = appIdOption ?? (context.app.source === "environment" || context.app.source === "profile" ? context.app.value : null) ?? PLATFORM_SCOPE;
   const dryRun = parsed.options["dry-run"] === true;
   if (action === "import" && dryRun) {
     return {
@@ -9840,8 +10389,10 @@ async function buildContext3(parsed, deps, action) {
     fetch: doFetch,
     stdout: out,
     openApprovalUrl: deps.openUrl,
-    // Anchor the grant cache to this project, not the shell's cwd.
-    rootDir: cfg.rootDir
+    // A project, named context, or the global operator context owns the
+    // exact-scope cache; it never follows an arbitrary shell directory.
+    rootDir: cfg.rootDir,
+    tokenFile: context.credentials.scopedTokenFile
   }) : await getDeveloperToken(
     cfg,
     {
@@ -10116,7 +10667,7 @@ function hostedSeverity(value, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path15 = require("path");
+var import_node_path16 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -10128,9 +10679,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path15.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path15.resolve)(options.out ?? (0, import_node_path15.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path15.relative)(target, output).split(import_node_path15.sep).join("/");
+  const target = (0, import_node_path16.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path16.resolve)(options.out ?? (0, import_node_path16.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path16.relative)(target, output).split(import_node_path16.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -10142,7 +10693,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path15.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path16.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -10160,7 +10711,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path15.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path16.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -10184,7 +10735,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path15.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path16.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -10213,7 +10764,7 @@ function printSummary(out, appId, env, run, report4, output) {
   out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
   if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path15.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path16.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -10693,6 +11244,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await whoamiCommand(parsed, runtime);
     return;
   }
+  if (command === "context") {
+    await contextCommand(parsed, runtime);
+    return;
+  }
   if (command === "runbook") {
     await runbookCommand(parsed, runtime);
     return;