@odla-ai/cli 0.27.0 → 0.27.2

package/dist/bin.js

@@ -3,7 +3,7 @@ import {
   exitCodeFor,
   redactSecrets,
   runCli
-} from "./chunk-DS64H4FY.js";
+} from "./chunk-JWEBGIBR.js";
 
 // src/bin.ts
 runCli().catch((err) => {

package/dist/{chunk-DS64H4FY.js → chunk-JWEBGIBR.js}

@@ -3,7 +3,7 @@
 // src/admin-ai-auth.ts
 import { existsSync as existsSync2 } from "fs";
 import { join as join2 } from "path";
-import process5 from "process";
+import process6 from "process";
 import { requestToken as requestToken2 } from "@odla-ai/db";
 
 // src/local.ts
@@ -132,36 +132,16 @@ function displayPath(path, rootDir = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
-// src/open.ts
-import { spawn } from "child_process";
-import process2 from "process";
-async function openUrl(url, options = {}) {
-  const command = openerFor(options.platform ?? process2.platform);
-  const doSpawn = options.spawnImpl ?? spawn;
-  await new Promise((resolve13, reject) => {
-    const child = doSpawn(command.cmd, [...command.args, url], {
-      stdio: "ignore",
-      detached: true
-    });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve13();
-    });
-  });
-}
-function openerFor(platform) {
-  if (platform === "darwin") return { cmd: "open", args: [] };
-  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
-  return { cmd: "xdg-open", args: [] };
-}
+// src/handshake-approval.ts
+import process3 from "process";
 
 // src/approval-prompt.ts
 function approvalLines(prompt) {
   const lines = [""];
   lines.push(
-    `\u23F8  Human approval required${prompt.purpose ? ` to ${prompt.purpose}` : ""} \u2014 code ${prompt.userCode}, ${prompt.minutesLeft}m left.`
+    `\u23F8  AUTHORIZATION REQUIRED${prompt.purpose ? ` to ${prompt.purpose}` : ""} \u2014 code ${prompt.userCode}, ${prompt.minutesLeft}m left.`
   );
+  lines.push("   OPEN THIS URL IN THE APPROVER'S SIGNED-IN BROWSER NOW:");
   lines.push("");
   lines.push(`   ${prompt.approvalUrl}`);
   lines.push("");
@@ -175,8 +155,9 @@ function approvalLines(prompt) {
     lines.push(`   No browser was opened (${prompt.browserSkipped}).`);
   }
   lines.push("");
-  lines.push("   AGENTS: relay the URL above to the human verbatim, now, before waiting.");
-  lines.push("   You cannot approve it yourself \u2014 the grant is issued to you, not by you.");
+  lines.push("   AGENTS: use browser control to open the URL above now; do not wait silently.");
+  lines.push("   If browser control is unavailable, give the exact URL to the human verbatim.");
+  lines.push("   You cannot approve it yourself, retry it away, or start a substitute handshake.");
   lines.push("");
   return lines;
 }
@@ -190,14 +171,73 @@ function reminderLines(prompt) {
   ];
 }
 
+// src/open.ts
+import { spawn } from "child_process";
+import process2 from "process";
+async function openUrl(url, options = {}) {
+  const command = openerFor(options.platform ?? process2.platform);
+  const doSpawn = options.spawnImpl ?? spawn;
+  await new Promise((resolve13, reject) => {
+    const child = doSpawn(command.cmd, [...command.args, url], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve13();
+    });
+  });
+}
+function openerFor(platform) {
+  if (platform === "darwin") return { cmd: "open", args: [] };
+  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
+  return { cmd: "xdg-open", args: [] };
+}
+
+// src/handshake-approval.ts
+function approvalBrowser(options, host = {}) {
+  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
+  if (options.open === true) return { open: true, mode: "forced" };
+  const env = host.env ?? process3.env;
+  if (env.VITEST || env.NODE_ENV === "test") {
+    return { open: false, reason: "test environment" };
+  }
+  return { open: true, mode: "auto" };
+}
+async function presentHandshakeApproval(out, prompt, options) {
+  const browser = approvalBrowser(options);
+  printApproval(out, {
+    ...prompt,
+    browserAttempted: browser.open,
+    browserSkipped: browser.reason
+  });
+  if (!browser.open) {
+    out.error(`auth: browser launch skipped (${browser.reason}) \u2014 open the URL above manually`);
+    return;
+  }
+  try {
+    await (options.openApprovalUrl ?? openUrl)(prompt.approvalUrl);
+    out.error("auth: browser open requested for the approval URL above");
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    out.error(`auth: browser did not open (${reason}) \u2014 OPEN THE URL ABOVE NOW`);
+  }
+}
+function handshakeUrl(platformUrl, userCode) {
+  const url = new URL("/studio", platformUrl);
+  url.searchParams.set("code", userCode);
+  return url.toString();
+}
+
 // src/token.ts
 import { collectToken, OdlaError, requestToken } from "@odla-ai/db";
-import process4 from "process";
+import process5 from "process";
 
 // src/handshake-state.ts
 import { rmSync } from "fs";
 import { dirname as dirname2, join } from "path";
-import process3 from "process";
+import process4 from "process";
 function handshakeFile(cfg) {
   return join(dirname2(cfg.local.tokenFile), "handshake.local.json");
 }
@@ -205,9 +245,13 @@ var RESUME_MARGIN_MS = 5e3;
 function readPendingHandshake(path, platform, email) {
   const pending = readJsonFile(path);
   if (!pending || pending.platform !== platform || pending.email !== email) return null;
-  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string" || typeof pending.approvalUrl !== "string") return null;
+  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string") return null;
   if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
-  return { interval: 3, ...pending };
+  return {
+    interval: typeof pending.interval === "number" ? pending.interval : 3,
+    ...pending,
+    approvalUrl: handshakeUrl(platform, pending.userCode)
+  };
 }
 function writePendingHandshake(path, pending) {
   writePrivateJson(path, pending);
@@ -233,7 +277,7 @@ function approvalReminder(out, pending, periodMs = 3e4) {
   timer.unref?.();
   return () => clearInterval(timer);
 }
-function handshakeWaitMs(waitSeconds, interactive = process3.stdout.isTTY === true) {
+function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === true) {
   if (waitSeconds !== void 0) return waitSeconds * 1e3;
   return interactive ? void 0 : 9e4;
 }
@@ -242,14 +286,14 @@ function handshakeWaitMs(waitSeconds, interactive = process3.stdout.isTTY === tr
 async function getDeveloperToken(cfg, options, doFetch, out) {
   if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (process4.env.ODLA_DEV_TOKEN) {
-    const declared = process4.env.ODLA_DEV_TOKEN_AUDIENCE;
+  if (process5.env.ODLA_DEV_TOKEN) {
+    const declared = process5.env.ODLA_DEV_TOKEN_AUDIENCE;
     if (declared) {
       if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
     } else if (audience !== "https://odla.ai") {
       throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
     }
-    return process4.env.ODLA_DEV_TOKEN;
+    return process5.env.ODLA_DEV_TOKEN;
   }
   const cached = readJsonFile(cfg.local.tokenFile);
   if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -262,7 +306,6 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
     doFetch,
     out,
     audience,
-    browser: approvalBrowser(options),
     email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
     pendingFile: handshakeFile(cfg)
   };
@@ -278,7 +321,12 @@ async function resumePendingHandshake(ctx, waitMs) {
   if (!pending) return null;
   ctx.out.error("");
   ctx.out.error(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
-  await launchApproval(ctx, pending.approvalUrl);
+  await presentHandshakeApproval(ctx.out, {
+    userCode: pending.userCode,
+    approvalUrl: pending.approvalUrl,
+    minutesLeft: Math.max(1, Math.floor((pending.expiresAt - Date.now()) / 6e4)),
+    purpose: `sign this terminal in as ${ctx.email}`
+  }, ctx.options);
   ctx.out.error("");
   const stopReminder = approvalReminder(ctx.out, pending);
   try {
@@ -312,10 +360,11 @@ async function freshHandshake(ctx, waitMs) {
       endpoint: ctx.cfg.platformUrl,
       email: ctx.email,
       label: `${ctx.cfg.app.id} provisioner`,
+      projectIds: [ctx.cfg.app.id],
       fetch: ctx.doFetch,
       waitMs,
-      onCode: async ({ userCode, deviceCode, expiresIn, interval, verificationUriComplete }) => {
-        const approvalUrl = verificationUriComplete ?? handshakeUrl(ctx.cfg.platformUrl, userCode);
+      onCode: async ({ userCode, deviceCode, expiresIn, interval }) => {
+        const approvalUrl = handshakeUrl(ctx.audience, userCode);
         started = {
           platform: ctx.audience,
           email: ctx.email,
@@ -326,15 +375,12 @@ async function freshHandshake(ctx, waitMs) {
           expiresAt: Date.now() + expiresIn * 1e3
         };
         writePendingHandshake(ctx.pendingFile, started);
-        printApproval(ctx.out, {
+        await presentHandshakeApproval(ctx.out, {
           userCode,
           approvalUrl,
           minutesLeft: Math.floor(expiresIn / 60),
-          purpose: `sign this terminal in as ${ctx.email}`,
-          browserAttempted: ctx.browser.open,
-          browserSkipped: ctx.browser.reason
-        });
-        await launchApproval(ctx, approvalUrl);
+          purpose: `sign this terminal in as ${ctx.email}`
+        }, ctx.options);
         stopReminder = approvalReminder(ctx.out, started);
       }
     });
@@ -349,18 +395,6 @@ async function freshHandshake(ctx, waitMs) {
     stopReminder?.();
   }
 }
-async function launchApproval(ctx, approvalUrl) {
-  if (ctx.browser.open) {
-    try {
-      await (ctx.options.openApprovalUrl ?? openUrl)(approvalUrl);
-      ctx.out.error(`auth: asked the OS to open a browser${ctx.browser.mode === "auto" ? " (auto)" : ""} \u2014 if no tab appeared, use the URL above`);
-    } catch (err) {
-      ctx.out.error(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
-    }
-  } else if (ctx.browser.reason) {
-    ctx.out.error(`auth: browser launch skipped (${ctx.browser.reason}) \u2014 show the human the URL above`);
-  }
-}
 function stillPending(pending, email) {
   return new OdlaError(
     "handshake_pending",
@@ -369,30 +403,12 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? process4.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? process5.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
     throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
   }
   return email;
 }
-function approvalBrowser(options, host = {}) {
-  if (options.open === true) return { open: true, mode: "forced" };
-  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  const env = host.env ?? process4.env;
-  if (env.VITEST || env.NODE_ENV === "test") return { open: false, reason: "test environment" };
-  if (env.CI) return { open: false, reason: "CI environment" };
-  if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: "SSH session; pass --open to force" };
-  const platform = host.platform ?? process4.platform;
-  if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
-    return { open: false, reason: "no graphical display; pass --open to force" };
-  }
-  return { open: true, mode: "auto" };
-}
-function handshakeUrl(platformUrl, userCode) {
-  const url = new URL("/studio", platformUrl);
-  url.searchParams.set("code", userCode);
-  return url.toString();
-}
 function platformAudience(value2) {
   let url;
   try {
@@ -417,7 +433,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = process5.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = process6.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -429,7 +445,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = process5.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = process6.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -454,7 +470,7 @@ var SCOPE_PURPOSE = {
 };
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? process5.cwd();
+  const rootDir = options.rootDir ?? process6.cwd();
   const tokenFile = options.tokenFile ?? join2(rootDir, ".odla/admin-token.local.json");
   const cache = options.cache === false ? null : readJsonFile(tokenFile);
   const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
@@ -469,21 +485,14 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     label: options.label ?? `odla CLI (${scope})`,
     scopes: [scope],
     fetch: doFetch,
-    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
-      const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);
-      const browser = approvalBrowser({ open: options.open });
-      printApproval(out, {
+    onCode: async ({ userCode, expiresIn }) => {
+      await presentHandshakeApproval(out, {
         userCode,
-        approvalUrl,
+        approvalUrl: handshakeUrl(audience, userCode),
         minutesLeft: Math.floor(expiresIn / 60),
         purpose: SCOPE_PURPOSE[scope] ?? `use ${scope}`,
-        approver: scope.startsWith("app:") ? "A signed-in app owner" : "A signed-in odla platform admin",
-        browserAttempted: browser.open,
-        browserSkipped: browser.reason
-      });
-      if (browser.open) {
-        await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
-      }
+        approver: scope.startsWith("app:") ? "A signed-in app owner" : "A signed-in odla platform admin"
+      }, options);
     }
   });
   if (options.cache !== false) {
@@ -513,15 +522,15 @@ function requireSystemAiPurpose(value2) {
 }
 
 // src/admin-ai.ts
-import process7 from "process";
+import process8 from "process";
 
 // src/secret-input.ts
-import process6 from "process";
+import process7 from "process";
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = process6.env[options.fromEnv];
+  if (options.fromEnv) value2 = process7.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -529,7 +538,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = process6.stdin) {
+async function readSecretStream(kind, stream = process7.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -692,7 +701,7 @@ function isRecord2(value2) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? process7.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? process8.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -7123,7 +7132,7 @@ function record6(value2) {
 // src/provision.ts
 import { createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
-import process8 from "process";
+import process9 from "process";
 
 // src/integration-provision.ts
 import { uuidv7 } from "@odla-ai/db";
@@ -7430,7 +7439,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process8.env[cfg.ai.keyEnv];
+      const key = process9.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret2({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -7976,21 +7985,21 @@ function addOption(options, name, value2) {
 // src/operator-context.ts
 import { existsSync as existsSync10 } from "fs";
 import { join as join12, resolve as resolve11 } from "path";
-import process10 from "process";
+import process11 from "process";
 
 // src/operator-profiles.ts
 import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname7, join as join11, resolve as resolve10 } from "path";
-import process9 from "process";
+import process10 from "process";
 function operatorProfileFile() {
   return resolve10(
-    clean(process9.env.ODLA_CONTEXT_FILE) ?? join11(homedir2(), ".odla", "contexts.json")
+    clean(process10.env.ODLA_CONTEXT_FILE) ?? join11(homedir2(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(process9.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(process10.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -8119,13 +8128,13 @@ async function resolveOperatorContext(parsed, options = {}) {
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(process10.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(process11.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(process10.env.ODLA_APP_ID);
+  const appEnvironment = clean2(process11.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) assertOperatorName(appValue, "app");
@@ -8135,16 +8144,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(process10.env.ODLA_ENV);
+  const envEnvironment = clean2(process11.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? process10.cwd();
+  const rootDir = loaded?.rootDir ?? process11.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(process10.env.ODLA_DEV_TOKEN_FILE) ? resolve11(process10.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(process10.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process10.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join12(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(process11.env.ODLA_DEV_TOKEN_FILE) ? resolve11(process11.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile = clean2(process11.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process11.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join12(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -9258,13 +9267,13 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-import process11 from "process";
+import process12 from "process";
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(process11.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(process12.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -9638,15 +9647,16 @@ Safety:
   the metadata file. Flags and specific ODLA_* scope variables beat a selected
   context, which beats project config. There is no ambient current context.
   "context show" reports only provenance and cache state and never authenticates.
-  Provision opens the approval page in your browser automatically whenever the
-  machine can show one, including agent-driven runs; only CI, SSH, and
-  display-less hosts skip it. Use --open to force or --no-open to suppress.
-  Browser launch is best-effort: the printed approval URL is authoritative and
-  agents must relay it to the human verbatim. A started handshake is persisted
+  Every real CLI handshake prints one canonical /studio?code= approval URL and
+  attempts to open it \u2014 including in CI, SSH, display-less, and agent-driven
+  shells. Only --no-open suppresses the attempt. Browser launch is best-effort:
+  agents with browser control must open that exact URL immediately; otherwise
+  they must give it to the human verbatim. A started handshake is persisted
   under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
   the same code. Outside an interactive terminal the wait is capped (90s by
   default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: relay the URL, wait for approval, and re-run to collect.
+  with code 75: open the same URL (or relay it if browser control is unavailable),
+  wait for approval, and re-run to collect.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
@@ -11054,9 +11064,9 @@ async function read2(url, headers, doFetch) {
 
 // src/record.ts
 import { appendFileSync } from "fs";
-import process12 from "process";
+import process13 from "process";
 function recordInvocation(parsed) {
-  const file = process12.env.ODLA_CLI_RECORD;
+  const file = process13.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -11728,9 +11738,9 @@ import { spawnSync } from "child_process";
 import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join15 } from "path";
-import process13 from "process";
+import process14 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = process13.env) {
+function resolveEditor(env = process14.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -11744,8 +11754,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? process13.env;
-  const interactive = deps.interactive ?? (() => Boolean(process13.stdin.isTTY));
+  const env = deps.env ?? process14.env;
+  const interactive = deps.interactive ?? (() => Boolean(process14.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -12736,4 +12746,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-DS64H4FY.js.map
+//# sourceMappingURL=chunk-JWEBGIBR.js.map