@odla-ai/cli 0.27.11 → 0.27.13

package/README.md

@@ -359,6 +359,8 @@ npx odla-ai code connect --env prod --once # bounded enrollment + heartbeat proo
 # install SDKs, write the Worker, and create wrangler.jsonc before secret push
 npx odla-ai provision --dry-run
 npx odla-ai provision --email owner@example.com --write-dev-vars --push-secrets
+# recovery when the selected agent credential has no live app.manage grant
+npx odla-ai provision --request-grant --email owner@example.com --write-dev-vars --push-secrets
 npx odla-ai smoke --env dev
 npx odla-ai agent jobs --env dev --state dead_letter --json
 npx odla-ai agent retry <job-id> --env dev --json
@@ -472,7 +474,11 @@ shown-once credential.
    needed by the run; it does not permit ownership, rename/category, archive,
    restore, or purge. A cached or pending baseline handshake without
    `app.manage` is not reused for provision: the CLI starts a fresh request for
-   owner review. If
+   owner review. An explicit `--token` or `ODLA_DEV_TOKEN` has no trustworthy
+   local grant metadata, so a server refusal cannot be repaired by retrying it.
+   Run `provision --request-grant --email <account>` to ignore the ambient and
+   cached credentials, open a new exact-project review, collect the approved
+   replacement, and continue the same provisioning run. If
    the exact project id does not exist yet, approval reserves that id for this
    credential instead of failing: the credential may create only that app once,
    and Registry binds its reviewed grant to the new app incarnation.