@odla-ai/cli 0.27.11 → 0.27.13

package/dist/index.cjs

@@ -386,23 +386,30 @@ function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default
 
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
-  if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
-    const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
-    if (declared) {
-      if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
-    } else if (audience !== "https://odla.ai") {
-      throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
-    }
-    return import_node_process4.default.env.ODLA_DEV_TOKEN;
-  }
   const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
   const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
-    out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
+  if (!grantRequest.forceReview) {
+    if (options.token) return options.token;
+    if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
+      const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+      if (declared) {
+        if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
+      } else if (audience !== "https://odla.ai") {
+        throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
+      }
+      return import_node_process4.default.env.ODLA_DEV_TOKEN;
+    }
+    if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
+      out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      return cached.token;
+    }
+  } else {
+    if (options.token) {
+      throw new Error("--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
+    }
+    out.error(`auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"`);
   }
   const ctx = {
     cfg,
@@ -1736,7 +1743,7 @@ async function agentCommand(parsed, deps = {}) {
   if (action2 !== "jobs" && action2 !== "retry") {
     throw new Error(`unknown agent action "${action2 ?? ""}". Try "odla-ai agent jobs --json".`);
   }
-  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action2 === "jobs" ? 2 : 3);
+  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token"], action2 === "jobs" ? 2 : 3);
   if (action2 === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
     throw new Error('--state and --limit are supported only by "agent jobs"');
   }
@@ -1744,17 +1751,17 @@ async function agentCommand(parsed, deps = {}) {
   const { env, tenant } = resolveTenant(cfg, stringOpt(parsed.options.env));
   const doFetch = deps.fetch ?? fetch;
   const out = deps.stdout ?? console;
-  const credential2 = await getDeveloperToken(
-    cfg,
-    {
-      configPath: cfg.configPath,
-      token: stringOpt(parsed.options.token),
-      email: stringOpt(parsed.options.email),
-      open: false
-    },
-    doFetch,
-    out
-  );
+  const credential2 = stringOpt(parsed.options.token) ?? readCredentials(cfg.local.credentialsFile)?.envs[env]?.dbKey;
+  if (!credential2) {
+    throw new Error(
+      `no ${env} app credential found; run \`odla-ai provision --write-dev-vars --yes\` or pass --token <ODLA_API_KEY>`
+    );
+  }
+  if (credential2.startsWith("odla_dev_")) {
+    throw new Error(
+      "agent job administration requires an app credential (ODLA_API_KEY / odla_sk_\u2026), not a developer device token"
+    );
+  }
   const base = `${cfg.dbEndpoint}/app/${encodeURIComponent(tenant)}/admin/agent-jobs`;
   const headers = { authorization: `Bearer ${credential2}` };
   if (action2 === "retry") {
@@ -1810,51 +1817,23 @@ function errorMessage(body) {
   return "request failed";
 }
 
+// src/human-session.ts
+async function requireStudioHuman(configPath, action2, destination = "app", env) {
+  const cfg = await loadProjectConfig(configPath);
+  const appEnv = env && cfg.envs.includes(env) ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
+  const path = destination === "app" ? `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/settings/app` : `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/${destination}`;
+  throw new Error(
+    `human_session_required: ${action2} requires the signed-in owner in Studio. A CLI device token is an agent credential, so another approval or retry cannot work. ${new URL(path, cfg.platformUrl).href}`
+  );
+}
+
 // src/app-export.ts
-var import_node_fs7 = require("fs");
-var import_node_stream = require("stream");
-var import_promises = require("stream/promises");
 async function appExport(options) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const doFetch = options.fetch ?? fetch;
-  const { tenant } = resolveTenant(cfg, options.env);
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const auth = { authorization: `Bearer ${token}` };
-  const base = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}`;
-  if (options.fresh) {
-    const res = await doFetch(`${base}/export`, { method: "POST", headers: auth });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) throw new Error(`export failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? res.status}`);
-  }
-  const list = await doFetch(`${base}/backups`, { headers: auth });
-  if (!list.ok) throw new Error(`couldn't list backups (${list.status})`);
-  const { backups } = await list.json();
-  const newest = backups[0];
-  if (!newest) {
-    throw new Error(
-      `${tenant} has no backups yet \u2014 run \`odla-ai app export --fresh\` to take one now (nightly snapshots appear after the first day with writes)`
-    );
-  }
-  const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });
-  if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);
-  const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;
-  await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(download.body), (0, import_node_fs7.createWriteStream)(file));
-  if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));
-  else {
-    out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);
-    out.log(`sha256 ${download.headers.get("x-odla-sha256") ?? newest.sha256}`);
-  }
-  return { file, backup: newest };
+  return requireStudioHuman(options.configPath, "database export", "database", options.env);
 }
 
 // src/app-import.ts
-var import_node_fs8 = require("fs");
+var import_node_fs7 = require("fs");
 var import_import = require("@odla-ai/db/import");
 function chooseIdMode(options, rows) {
   const chosen = [options.idField && "field", options.key && "key", options.generateIds && "generate"].filter(Boolean);
@@ -1871,9 +1850,8 @@ async function appImport(options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
-  const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
-  const text2 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
+  const text2 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs7.readFileSync)(0, "utf8")))() : (0, import_node_fs7.readFileSync)(options.file, "utf8");
   const { format, sources } = (0, import_import.parseImport)(text2, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -1899,100 +1877,18 @@ ${detail}${more}`);
     if (options.json) out.log(JSON.stringify(result, null, 2));
     return result;
   }
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const runId = crypto.randomUUID();
-  const url = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}/transact`;
-  for (const chunk of chunks) {
-    const res = await doFetch(url, {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-      body: JSON.stringify({ mutationId: (0, import_import.importMutationId)(runId, chunk.index), ops: chunk.ops })
-    });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) {
-      const code = body.error?.code ? ` (${body.error.code})` : "";
-      throw new Error(
-        `chunk ${chunk.index + 1} of ${chunks.length} failed${code}: ${body.error?.message ?? res.status}. ${result.committed} row(s) already committed; fix the input and re-run to import the rest.`
-      );
-    }
-    result.committed += chunk.ops.length;
-    if (typeof body.txId === "number") result.txIds.push(body.txId);
-    if (body.duplicate) result.duplicate++;
-  }
-  if (options.json) out.log(JSON.stringify(result, null, 2));
-  else {
-    const dup = result.duplicate > 0 ? ` (${result.duplicate} chunk(s) were already applied)` : "";
-    out.log(`${tenant}: upserted ${result.committed} row(s) in ${chunks.length} transaction(s)${dup}`);
-  }
-  return result;
+  return requireStudioHuman(options.configPath, "database import", "database", options.env);
 }
 
 // src/app-owners.ts
-var sink = (options) => options.stdout ?? console;
-async function ownersRequest(method, suffix, options, body) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    sink(options)
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/owners${suffix}`, {
-    method,
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: body === void 0 ? void 0 : JSON.stringify(body)
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    throw new Error(
-      `owners ${method} failed${data.error?.code ? ` (${data.error.code})` : ""}: ` + (data.error?.message ?? `registry returned ${res.status}`)
-    );
-  }
-  return data.owners ?? [];
-}
-function report(options, owners, headline) {
-  const out = sink(options);
-  if (options.json === true) {
-    out.log(JSON.stringify(owners, null, 2));
-    return;
-  }
-  if (headline) out.log(headline);
-  out.log(`owners (${owners.length}):`);
-  for (const o of owners) {
-    const name = o.email?.trim() || "Unnamed member";
-    out.log(
-      `  ${o.primary ? "\u2605" : "\xB7"} ${name} [${o.ownerId}]${o.primary ? " (primary)" : ""}`
-    );
-  }
-}
 async function ownersList(options) {
-  report(options, await ownersRequest("GET", "", options));
+  await requireStudioHuman(options.configPath, "listing app owners", "app");
 }
 async function ownersAdd(email, options) {
-  const owners = await ownersRequest("POST", "", options, { email });
-  report(
-    options,
-    owners,
-    `added ${email} as a co-owner \u2014 they share full access. They can now run \`odla-ai provision\` to mint their own credentials (no secret sharing).`
-  );
+  await requireStudioHuman(options.configPath, `adding ${email} as an app owner`, "app");
 }
 async function ownersRemove(target, options) {
-  let ownerId = target;
-  if (target.includes("@")) {
-    const owners2 = await ownersRequest("GET", "", options);
-    const match = owners2.find((o) => o.email?.toLowerCase() === target.toLowerCase());
-    if (!match) throw new Error(`no co-owner with email ${target}`);
-    if (match.primary) throw new Error("can't remove the primary owner");
-    ownerId = match.ownerId;
-  }
-  const owners = await ownersRequest("DELETE", `/${encodeURIComponent(ownerId)}`, options);
-  report(options, owners, `removed ${target}`);
+  await requireStudioHuman(options.configPath, `removing ${target} as an app owner`, "app");
 }
 async function appOwnersCommand(parsed, dependencies = {}) {
   const sub = parsed.positionals[2] ?? "list";
@@ -2024,35 +1920,9 @@ async function appOwnersCommand(parsed, dependencies = {}) {
 
 // src/app-rename.ts
 async function appRename(name, options) {
-  const out = options.stdout ?? console;
   const trimmed = name.trim();
   if (!trimmed) throw new Error('"app rename" needs a name \u2014 try `odla-ai app rename "Acme Storefront"`.');
-  const cfg = await loadProjectConfig(options.configPath);
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/name`, {
-    method: "PUT",
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: JSON.stringify({ name: trimmed })
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok || !data.app) {
-    throw new Error(
-      `rename failed${data.error?.code ? ` (${data.error.code})` : ""}: ` + (data.error?.message ?? `registry returned ${res.status}`)
-    );
-  }
-  if (options.json === true) {
-    out.log(JSON.stringify(data.app, null, 2));
-    return;
-  }
-  out.log(`renamed ${data.app.appId} \u2192 "${data.app.name}"`);
-  out.log("The app id is unchanged, so credentials, tenants, and URLs keep working.");
-  out.log(`Update the "name" in ${cfg.configPath} to match.`);
+  await requireStudioHuman(options.configPath, `renaming the app to "${trimmed}"`, "app");
 }
 async function appRenameCommand(parsed, dependencies = {}) {
   assertArgs(parsed, ["config", "token", "email", "json"], parsed.positionals.length);
@@ -2068,172 +1938,23 @@ async function appRenameCommand(parsed, dependencies = {}) {
 }
 
 // src/app-transfer.ts
-function endpointsFor(verb, tenants) {
-  const up = { source: tenants.sandbox, target: tenants.live, from: "dev" };
-  const down = { source: tenants.live, target: tenants.sandbox, from: "prod" };
-  if (verb === "refresh-sandbox") return { ...down, mode: "refresh" };
-  return { ...up, mode: "cutover" };
-}
-async function api(cfg, token, path, init, doFetch) {
-  const res = await doFetch(`${cfg.dbEndpoint}${path}`, {
-    ...init,
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init?.headers }
-  });
-  return { status: res.status, body: await res.json().catch(() => ({})) };
-}
-function describe(side) {
-  if (!side.exists) return "not provisioned";
-  if (side.maxTx === 0) return "empty \u2014 never written";
-  const ns = side.namespaces.length === 1 ? "1 namespace" : `${side.namespaces.length} namespaces`;
-  const identity = side.identityRows > 0 ? `, ${side.identityRows} identity row(s)` : "";
-  return `${ns} \xB7 ${side.triples} value(s) \xB7 tx ${side.maxTx}${identity}`;
-}
-function printPlan(out, verb, pre, opts) {
-  const arrow = verb === "refresh-sandbox" ? "live \u2192 sandbox" : "sandbox \u2192 live";
-  out.log(`${verb} (${arrow})`);
-  out.log(`  from  ${pre.source.tenant}  ${describe(pre.source)}`);
-  out.log(`  to    ${pre.target.tenant}  ${describe(pre.target)}`);
-  if (verb === "promote") {
-    out.log("  moves schema, rules and gates only \u2014 no rows are copied or removed");
-  } else {
-    out.log(`  ${pre.target.tenant} is REPLACED by ${pre.source.tenant}`);
-    out.log(`  stays put: ${pre.staysPut.join(", ")}`);
-    const identity = opts.includeIdentity ? "INCLUDED (--include-identity)" : `left behind: ${pre.excluded.join(", ")}`;
-    out.log(`  identity: ${identity}`);
-    out.log(`  files: ${opts.includeFiles ? "copied (--include-files)" : "not copied"}`);
-  }
-  for (const blocker of pre.blockers) out.log(`  \u2716 ${blocker.code}: ${blocker.message}`);
-}
 async function appTransfer(options) {
   const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
-  const doFetch = options.fetch ?? fetch;
-  const tenants = bothTenants(cfg);
-  const route2 = endpointsFor(options.verb, tenants);
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const pre = await api(
-    cfg,
-    token,
-    `/admin/apps/${encodeURIComponent(route2.target)}/copy-preflight?from=${route2.from}`,
-    void 0,
-    doFetch
-  );
-  if (pre.status !== 200) {
-    throw new Error(`pre-flight failed${pre.body.error?.code ? ` (${pre.body.error.code})` : ""}: ${pre.body.error?.message ?? pre.status}`);
-  }
-  const plan = pre.body;
-  printPlan({ log: say }, options.verb, plan, options);
-  if (options.verb === "go-live" && !plan.targetEmpty) {
-    throw new Error(
-      `${route2.target} already has data \u2014 go-live has already happened. Use \`odla-ai app promote --yes\` to push schema and rules, or \`odla-ai app refresh-sandbox --yes\` to pull live back down.`
-    );
-  }
-  if (plan.blockers.length > 0) throw new Error(`cannot ${options.verb}: ${plan.blockers.map((b) => b.message).join("; ")}`);
-  if (options.dryRun || options.yes !== true) {
-    say(`nothing written (${options.dryRun ? "--dry-run" : "no --yes"})`);
-    if (options.json) out.log(JSON.stringify(plan, null, 2));
-    return { ok: true, plan };
-  }
-  if (options.verb === "promote") {
-    const res2 = await api(
-      cfg,
-      token,
-      `/admin/apps/${encodeURIComponent(route2.target)}/promote-definitions`,
-      { method: "POST", body: JSON.stringify({ from: "dev" }) },
-      doFetch
-    );
-    if (res2.status !== 200) throw new Error(`promote failed${res2.body.error?.code ? ` (${res2.body.error.code})` : ""}: ${res2.body.error?.message ?? res2.status}`);
-    if (options.json) out.log(JSON.stringify(res2.body, null, 2));
-    else say(`${route2.target}: promoted ${(res2.body.applied ?? []).join(", ")}`);
-    return { ok: true, plan, result: res2.body };
-  }
-  const res = await api(
-    cfg,
-    token,
-    `/admin/apps/${encodeURIComponent(route2.target)}/copy-db`,
-    {
-      method: "POST",
-      body: JSON.stringify({
-        from: route2.from,
-        mode: route2.mode,
-        ...options.includeIdentity ? { includeUsers: true } : {},
-        ...options.includeFiles ? { includeFiles: true } : {}
-      })
-    },
-    doFetch
-  );
-  if (res.status !== 200) throw new Error(`${options.verb} failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
-  say(`${route2.target}: replaced from ${route2.source} (tx ${res.body.destination?.maxTx}, epoch ${res.body.destination?.epoch}) \u2014 connected clients resync automatically`);
-  if (options.includeFiles) await copyFiles(cfg, token, route2, doFetch, out);
-  if (options.json) out.log(JSON.stringify(res.body, null, 2));
-  return { ok: true, plan, result: res.body };
-}
-async function copyFiles(cfg, token, route2, doFetch, out) {
-  for (let attempt = 1; attempt <= 20; attempt++) {
-    const res = await api(
-      cfg,
-      token,
-      `/admin/apps/${encodeURIComponent(route2.target)}/copy-files`,
-      { method: "POST", body: JSON.stringify({ from: route2.from }) },
-      doFetch
-    );
-    if (res.status === 200) {
-      out.log(`${route2.target}: files copied`);
-      return;
-    }
-    if (!res.body.error?.retry) {
-      throw new Error(`file copy failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
-    }
-    out.log(`  files: bounded at attempt ${attempt}, resuming\u2026`);
-  }
-  throw new Error("file copy did not finish within 20 rounds \u2014 re-run to continue where it left off");
+  bothTenants(cfg);
+  return requireStudioHuman(options.configPath, `app ${options.verb}`, "database");
 }
 
 // src/app-lifecycle.ts
-async function lifecycleCall(action2, options) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action2}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || !body.ok) {
-    throw new Error(`${action2} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
-  }
-  return body;
-}
 async function appArchive(options) {
   if (options.yes !== true) {
     throw new Error(
       "app archive suspends EVERY environment: API keys stop working and all services refuse requests until restored. All data is retained. Pass --yes to proceed."
     );
   }
-  const out = options.stdout ?? console;
-  const body = await lifecycleCall("archive", options);
-  if (options.json) out.log(JSON.stringify(body, null, 2));
-  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already archived`);
-  else out.log(`${body.app?.appId}: archived \u2014 data retained; run \`odla-ai app restore\` (or use Studio) to bring it back`);
+  await requireStudioHuman(options.configPath, "app archive", "app");
 }
 async function appRestore(options) {
-  const out = options.stdout ?? console;
-  const body = await lifecycleCall("restore", options);
-  if (options.json) out.log(JSON.stringify(body, null, 2));
-  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already active`);
-  else out.log(`${body.app?.appId}: restored \u2014 every service's data plane is live again`);
+  await requireStudioHuman(options.configPath, "app restore", "app");
 }
 async function appCommand(parsed, dependencies = {}) {
   const sub = parsed.positionals[1];
@@ -2319,7 +2040,7 @@ async function appCommand(parsed, dependencies = {}) {
 }
 
 // src/brand-command.ts
-var import_promises2 = require("fs/promises");
+var import_promises = require("fs/promises");
 var import_node_path7 = require("path");
 
 // src/brand-design-unpack.ts
@@ -2422,7 +2143,7 @@ function describeUnpack(result, outDir) {
 // src/brand-command.ts
 var USAGE = "usage: odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]";
 async function readBundle(source, deps) {
-  if (source !== "-") return (0, import_promises2.readFile)((0, import_node_path7.resolve)(source), "utf8");
+  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path7.resolve)(source), "utf8");
   const readStdin = deps.readStdin;
   if (!readStdin) throw new Error("reading a bundle from stdin is not supported here");
   return readStdin();
@@ -2430,8 +2151,8 @@ async function readBundle(source, deps) {
 async function writeAll(result, outDir) {
   for (const file of result.files) {
     const target = (0, import_node_path7.resolve)(outDir, file.path);
-    await (0, import_promises2.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
-    await (0, import_promises2.writeFile)(target, file.bytes);
+    await (0, import_promises.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
+    await (0, import_promises.writeFile)(target, file.bytes);
   }
 }
 async function designUnpack(parsed, deps) {
@@ -2591,12 +2312,6 @@ async function pollCalendarConnection(ctx, attemptId) {
     ctx.env
   );
 }
-async function requestCalendarDisconnect(ctx) {
-  return parseCalendarStatus(
-    await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
-    ctx.env
-  );
-}
 function parseCalendarStatus(raw, env) {
   const outer = wrapped(raw, "calendar");
   const value2 = record(outer.attempt) ?? record(outer.status) ?? outer;
@@ -2780,10 +2495,7 @@ async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
 }
 async function calendarDisconnect(options) {
   if (!options.yes) throw new Error("calendar disconnect requires --yes");
-  const { ctx, out } = await lifecycleContext(options);
-  const status = await requestCalendarDisconnect(ctx);
-  out.log(`${ctx.env}: calendar disconnected; no calendar data was stored`);
-  return status;
+  return requireStudioHuman(options.configPath, "calendar disconnect", "calendar", options.env);
 }
 async function ensureCalendarConnected(ctx, options) {
   const out = options.stdout ?? console;
@@ -2997,9 +2709,9 @@ var import_apps6 = require("@odla-ai/apps");
 var import_node_path8 = require("path");
 
 // src/version.ts
-var import_node_fs9 = require("fs");
+var import_node_fs8 = require("fs");
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs9.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs8.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 
@@ -3015,7 +2727,7 @@ var ConfigOperationCommandError = class extends Error {
 
 // src/config-operation-validate.ts
 var import_apps3 = require("@odla-ai/apps");
-var import_node_fs10 = require("fs");
+var import_node_fs9 = require("fs");
 
 // src/config-reconcile-digest.ts
 var import_node_crypto2 = require("crypto");
@@ -3051,7 +2763,7 @@ var SERVICE = /^[a-z][a-z0-9-]{0,39}$/;
 function readPlan(path) {
   let value2;
   try {
-    const raw = (0, import_node_fs10.readFileSync)(path, "utf8");
+    const raw = (0, import_node_fs9.readFileSync)(path, "utf8");
     if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
     value2 = JSON.parse(raw);
   } catch (error) {
@@ -3194,11 +2906,11 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
     }
     if (code === "provision_approval_required") {
       throw new Error(
-        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Discard the cached or supplied token and run this command with the current CLI to approve one fresh exact-project provisioning handshake`
+        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Run "odla-ai provision --request-grant --email <odla-account>" to open one fresh exact-project owner review; do not change app ownership unless the human account itself is not an owner`
       );
     }
     throw new Error(
-      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
+      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; run "odla-ai provision --request-grant --email <odla-account>" to open a fresh owner review. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
@@ -3764,7 +3476,7 @@ async function configPlan(options) {
     apply,
     nextActions: planNextActions(reconciliation, options.configPath)
   };
-  printPlan2(document2, options);
+  printPlan(document2, options);
   return document2;
 }
 async function inspectConfig(options) {
@@ -3804,7 +3516,7 @@ function printDiff(document2, options) {
   printDifferences(out, document2);
   printNext(out, document2.nextActions);
 }
-function printPlan2(document2, options) {
+function printPlan(document2, options) {
   const out = options.stdout ?? console;
   if (options.json) {
     out.log(JSON.stringify(document2, null, 2));
@@ -3907,12 +3619,12 @@ function quoteArg2(value2) {
 
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
-var import_node_fs12 = require("fs");
+var import_node_fs11 = require("fs");
 var import_node_path11 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs11 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_path10 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
@@ -3928,14 +3640,14 @@ var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"]
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
     const path = (0, import_node_path10.join)(rootDir, name);
-    if ((0, import_node_fs11.existsSync)(path)) return path;
+    if ((0, import_node_fs10.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs11.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs10.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -4043,7 +3755,7 @@ function wranglerWarnings(rootDir) {
       const dir = (0, import_node_path11.resolve)(rootDir, assets.directory);
       if (dir === (0, import_node_path11.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs12.existsSync)((0, import_node_path11.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs11.existsSync)((0, import_node_path11.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4079,12 +3791,12 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? (0, import_node_path11.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs12.existsSync)(main)) {
+  if (!main || !(0, import_node_fs11.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs12.readFileSync)(main, "utf8");
+      source = (0, import_node_fs11.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -4108,7 +3820,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path11.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path11.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4337,14 +4049,14 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-var import_node_fs13 = require("fs");
+var import_node_fs12 = require("fs");
 var import_node_path12 = require("path");
 var import_apps9 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path12.resolve)(options.rootDir ?? process.cwd());
   const configPath = (0, import_node_path12.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs13.existsSync)(configPath) && !options.force) {
+  if ((0, import_node_fs12.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -4360,10 +4072,10 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
-  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs13.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  (0, import_node_fs12.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
+  (0, import_node_fs12.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs12.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs12.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
@@ -4372,8 +4084,8 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text2) {
-  if ((0, import_node_fs13.existsSync)(path)) return;
-  (0, import_node_fs13.writeFileSync)(path, text2);
+  if ((0, import_node_fs12.existsSync)(path)) return;
+  (0, import_node_fs12.writeFileSync)(path, text2);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -4580,7 +4292,9 @@ async function secretsSetClerkKey(options) {
   if (value2.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
     throw new Error(`refusing to store an sk_live_ Clerk key for "${options.env}" without --yes (live users would sync into a non-prod tenant)`);
   }
-  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const token = await getDeveloperToken(cfg, options, doFetch, out, {
+    optionalProjectCapabilities: ["app.manage"]
+  });
   const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -4610,7 +4324,7 @@ async function resolveVaultWrite(options) {
 }
 
 // src/skill.ts
-var import_node_fs14 = require("fs");
+var import_node_fs13 = require("fs");
 var import_node_os2 = require("os");
 var import_node_path13 = require("path");
 var import_node_url2 = require("url");
@@ -4707,7 +4421,7 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path13.join)(targetDir2, rel), (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path13.join)(targetDir2, rel), (0, import_node_fs13.readFileSync)((0, import_node_path13.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
@@ -4727,7 +4441,7 @@ function installSkill(options = {}) {
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        const canonical = (0, import_node_fs13.readFileSync)((0, import_node_path13.join)(sourceDir, skill, "SKILL.md"), "utf8");
         plan((0, import_node_path13.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
@@ -4762,11 +4476,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs14.existsSync)(file.target)) {
+    if (!(0, import_node_fs13.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs14.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs13.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -4783,9 +4497,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs14.existsSync)(file.target) || (0, import_node_fs14.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs14.mkdirSync)((0, import_node_path13.dirname)(file.target), { recursive: true });
-      (0, import_node_fs14.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs13.existsSync)(file.target) || (0, import_node_fs13.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file.target), { recursive: true });
+      (0, import_node_fs13.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -4826,9 +4540,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs14.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs13.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs14.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs13.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -4857,7 +4571,7 @@ function symlinkedComponent(boundary, target) {
   for (const part of rel.split(import_node_path13.sep).filter(Boolean)) {
     current = (0, import_node_path13.join)(current, part);
     try {
-      if ((0, import_node_fs14.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs13.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -4868,10 +4582,10 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs14.existsSync)(dir)) return [];
+  if (!(0, import_node_fs13.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs14.readdirSync)(current, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs13.readdirSync)(current, { withFileTypes: true })) {
       const path = (0, import_node_path13.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push((0, import_node_path13.relative)(dir, path));
@@ -5188,7 +4902,7 @@ async function projectCommand(command, parsed, deps) {
 }
 
 // src/code-connect.ts
-var import_node_fs15 = require("fs");
+var import_node_fs14 = require("fs");
 var import_node_os4 = require("os");
 var import_node_path15 = require("path");
 
@@ -5276,15 +4990,15 @@ function encodeAgentInput(message2) {
 // ../harness/dist/chunk-PHXQH4YM.js
 var import_child_process = require("child_process");
 var import_fs = require("fs");
-var import_promises3 = require("fs/promises");
+var import_promises2 = require("fs/promises");
 var import_path = require("path");
 var import_process = require("process");
-var import_promises4 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_os = require("os");
 var import_path2 = require("path");
 var import_child_process2 = require("child_process");
 var import_path3 = require("path");
-var import_promises5 = require("fs/promises");
+var import_promises4 = require("fs/promises");
 var import_os2 = require("os");
 var import_path4 = require("path");
 var import_child_process3 = require("child_process");
@@ -5295,7 +5009,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(import_path.delimiter).filter(Boolean)) {
     try {
-      await (0, import_promises3.access)((0, import_path.join)(directory, engine), import_fs.constants.X_OK);
+      await (0, import_promises2.access)((0, import_path.join)(directory, engine), import_fs.constants.X_OK);
       return true;
     } catch {
     }
@@ -5581,7 +5295,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
 }
 async function materializeGitTree(source, commitSha, options = {}) {
   if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new TypeError("Git tree requires an exact commit SHA");
-  const sourceDir = await (0, import_promises4.realpath)((0, import_path2.resolve)(source));
+  const sourceDir = await (0, import_promises3.realpath)((0, import_path2.resolve)(source));
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
@@ -5590,9 +5304,9 @@ async function materializeGitTree(source, commitSha, options = {}) {
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
-  const root = await (0, import_promises4.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-git-tree-"));
+  const root = await (0, import_promises3.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-git-tree-"));
   const targetRoot = (0, import_path2.join)(root, "source");
-  await (0, import_promises4.mkdir)(targetRoot);
+  await (0, import_promises3.mkdir)(targetRoot);
   let byteCount = 0;
   try {
     const blobs = await gitBlobs(sourceDir, entries, maxBytes);
@@ -5602,18 +5316,18 @@ async function materializeGitTree(source, commitSha, options = {}) {
       if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
       const target = (0, import_path2.resolve)(targetRoot, entry.path);
       if (!target.startsWith(`${(0, import_path2.resolve)(targetRoot)}${import_path2.sep}`)) throw new TypeError("Git tree path escapes workspace");
-      await (0, import_promises4.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
-      await (0, import_promises4.writeFile)(target, content2, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
+      await (0, import_promises3.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
+      await (0, import_promises3.writeFile)(target, content2, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
     }
     return {
       root,
       sourceDir: targetRoot,
       fileCount: entries.length,
       byteCount,
-      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises3.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises4.rm)(root, { recursive: true, force: true });
+    await (0, import_promises3.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
@@ -5621,7 +5335,7 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
   const files = [];
   let bytes = 0;
   const walk = async (dir) => {
-    for (const entry of await (0, import_promises5.readdir)(dir, { withFileTypes: true })) {
+    for (const entry of await (0, import_promises4.readdir)(dir, { withFileTypes: true })) {
       if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
       if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;
       const path = (0, import_path4.join)(dir, entry.name);
@@ -5631,7 +5345,7 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
         continue;
       }
       if (!entry.isFile()) continue;
-      const metadata2 = await (0, import_promises5.stat)(path);
+      const metadata2 = await (0, import_promises4.stat)(path);
       bytes += metadata2.size;
       if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
       if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
@@ -5680,7 +5394,7 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     if (!source.startsWith(`${root}${import_path4.sep}`)) throw new TypeError("git file path escapes workspace");
     let metadata2;
     try {
-      metadata2 = await (0, import_promises5.lstat)(source);
+      metadata2 = await (0, import_promises4.lstat)(source);
     } catch (error) {
       if (error.code === "ENOENT") continue;
       throw error;
@@ -5695,9 +5409,9 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
 async function copyTree(files, destination) {
   for (const file of files) {
     const target = (0, import_path4.join)(destination, file.relativePath);
-    await (0, import_promises5.mkdir)((0, import_path4.resolve)(target, ".."), { recursive: true });
-    await (0, import_promises5.copyFile)(file.source, target);
-    await (0, import_promises5.chmod)(target, file.mode);
+    await (0, import_promises4.mkdir)((0, import_path4.resolve)(target, ".."), { recursive: true });
+    await (0, import_promises4.copyFile)(file.source, target);
+    await (0, import_promises4.chmod)(target, file.mode);
   }
 }
 async function captureGitDiff(root, maxBytes) {
@@ -5734,13 +5448,13 @@ async function captureGitDiff(root, maxBytes) {
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
 async function stageWorkspace(source, options = {}) {
-  const sourceDir = await (0, import_promises5.realpath)((0, import_path4.resolve)(source));
-  const sourceStat = await (0, import_promises5.stat)(sourceDir);
+  const sourceDir = await (0, import_promises4.realpath)((0, import_path4.resolve)(source));
+  const sourceStat = await (0, import_promises4.stat)(sourceDir);
   if (!sourceStat.isDirectory()) throw new TypeError("workspace source must be a directory");
-  const root = await (0, import_promises5.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
   const baselineDir = (0, import_path4.join)(root, "baseline");
   const workspaceDir = (0, import_path4.join)(root, "workspace");
-  await Promise.all([(0, import_promises5.mkdir)(baselineDir), (0, import_promises5.mkdir)(workspaceDir)]);
+  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
   try {
     const maxFiles = options.maxFiles ?? 2e4;
     const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
@@ -5753,26 +5467,26 @@ async function stageWorkspace(source, options = {}) {
       fileCount: files.length,
       byteCount: files.reduce((sum, file) => sum + file.bytes, 0),
       patch: (maxBytes2) => captureGitDiff(root, maxBytes2),
-      cleanup: () => (0, import_promises5.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises5.rm)(root, { recursive: true, force: true });
+    await (0, import_promises4.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
 async function stageWorkspacePair(baselineSource, workspaceSource, options = {}) {
-  const baselineDirSource = await (0, import_promises5.realpath)((0, import_path4.resolve)(baselineSource));
-  const workspaceDirSource = await (0, import_promises5.realpath)((0, import_path4.resolve)(workspaceSource));
+  const baselineDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(baselineSource));
+  const workspaceDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(workspaceSource));
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const [baselineFiles, workspaceFiles] = await Promise.all([
     sourceFiles(baselineDirSource, maxFiles, maxBytes),
     sourceFiles(workspaceDirSource, maxFiles, maxBytes)
   ]);
-  const root = await (0, import_promises5.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
   const baselineDir = (0, import_path4.join)(root, "baseline");
   const workspaceDir = (0, import_path4.join)(root, "workspace");
-  await Promise.all([(0, import_promises5.mkdir)(baselineDir), (0, import_promises5.mkdir)(workspaceDir)]);
+  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
   try {
     await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);
     return {
@@ -5782,17 +5496,17 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
       fileCount: workspaceFiles.length,
       byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),
       patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),
-      cleanup: () => (0, import_promises5.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises5.rm)(root, { recursive: true, force: true });
+    await (0, import_promises4.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
 
 // ../harness/dist/chunk-GMVZ4LZH.js
 var import_crypto = require("crypto");
-var import_promises6 = require("fs/promises");
+var import_promises5 = require("fs/promises");
 var import_path5 = require("path");
 
 // ../camel/dist/chunk-7FHPOQVP.js
@@ -6129,19 +5843,19 @@ function validateSnapshot(snapshot, limits) {
 
 // ../harness/dist/chunk-GMVZ4LZH.js
 var import_child_process4 = require("child_process");
-var import_promises7 = require("fs/promises");
+var import_promises6 = require("fs/promises");
 var import_path6 = require("path");
 var import_child_process5 = require("child_process");
 var import_process2 = require("process");
 var import_crypto2 = require("crypto");
 var import_crypto3 = require("crypto");
 var import_fs2 = require("fs");
-var import_promises8 = require("fs/promises");
+var import_promises7 = require("fs/promises");
 var import_path7 = require("path");
-var import_promises9 = require("fs/promises");
+var import_promises8 = require("fs/promises");
 var import_os3 = require("os");
 var import_path8 = require("path");
-var import_promises10 = require("fs/promises");
+var import_promises9 = require("fs/promises");
 var import_path9 = require("path");
 
 // ../camel/dist/chunk-4EIRFS3A.js
@@ -6433,7 +6147,7 @@ var import_crypto4 = require("crypto");
 async function digestStagedWorkspace(root, limits) {
   const files = [];
   const walk = async (directory) => {
-    const entries = await (0, import_promises6.readdir)(directory, { withFileTypes: true });
+    const entries = await (0, import_promises5.readdir)(directory, { withFileTypes: true });
     for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
       if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
       const target = (0, import_path5.resolve)(directory, entry.name);
@@ -6448,7 +6162,7 @@ async function digestStagedWorkspace(root, limits) {
   const hash = (0, import_crypto.createHash)("sha256");
   let bytes = 0;
   for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
-    const content2 = await (0, import_promises6.readFile)(file.target);
+    const content2 = await (0, import_promises5.readFile)(file.target);
     bytes += Buffer.byteLength(file.path) + content2.byteLength;
     if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
     hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content2.byteLength}:`);
@@ -6774,7 +6488,7 @@ async function applyCodePatch(workspaceDir, patch2, paths) {
   await gitApply(workspaceDir, patch2, false);
   for (const path of paths) {
     try {
-      const info = await (0, import_promises7.lstat)(resolveCodePath(workspaceDir, path));
+      const info = await (0, import_promises6.lstat)(resolveCodePath(workspaceDir, path));
       if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
         throw new TypeError("patch created a non-regular workspace entry");
       }
@@ -7065,7 +6779,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
       const path = (0, import_path7.join)(workspaceDir, artifact.path);
-      const info = await (0, import_promises8.lstat)(path);
+      const info = await (0, import_promises7.lstat)(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
       } else if (info.size > artifact.maximumBytes) {
@@ -7246,9 +6960,9 @@ var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_mod
 var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
 async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.tmpdir)()) {
   if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
-  const root = await (0, import_promises9.mkdtemp)((0, import_path8.join)(tempRoot, "odla-code-source-"));
+  const root = await (0, import_promises8.mkdtemp)((0, import_path8.join)(tempRoot, "odla-code-source-"));
   const sourceDir = (0, import_path8.join)(root, "source");
-  await (0, import_promises9.mkdir)(sourceDir);
+  await (0, import_promises8.mkdir)(sourceDir);
   const seen = /* @__PURE__ */ new Set();
   let bytes = 0;
   try {
@@ -7260,8 +6974,8 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.
       if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
       const target = (0, import_path8.resolve)(sourceDir, file.path);
       if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code source path escapes its root");
-      await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-      await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 420 });
+      await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+      await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 420 });
     }
     for (const reference of snapshot.references ?? []) {
       validateAlias(reference.alias);
@@ -7275,13 +6989,13 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.
         if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
         const target = (0, import_path8.resolve)(sourceDir, path);
         if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
-        await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-        await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
       }
     }
-    return { sourceDir, cleanup: () => (0, import_promises9.rm)(root, { recursive: true, force: true }) };
+    return { sourceDir, cleanup: () => (0, import_promises8.rm)(root, { recursive: true, force: true }) };
   } catch (cause) {
-    await (0, import_promises9.rm)(root, { recursive: true, force: true });
+    await (0, import_promises8.rm)(root, { recursive: true, force: true });
     throw cause;
   }
 }
@@ -7302,8 +7016,8 @@ async function attachCodeRuntimeReferences(workspace, references) {
       for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
         const target = (0, import_path8.resolve)(root, path);
         if (!target.startsWith(`${(0, import_path8.resolve)(root)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
-        await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-        await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
       }
     }
   }
@@ -7489,11 +7203,11 @@ async function read(context, request2, options, policy) {
   const allowed = await policy.read(policyContext(context, request2, options, { paths, path, startLine, endLine }));
   if (!allowed) return response(request2, false, "tool denied by CaMeL policy");
   const target = resolveCodePath(context.workspaceDir, path);
-  const info = await (0, import_promises10.stat)(target);
+  const info = await (0, import_promises9.stat)(target);
   if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {
     throw new TypeError("file is not a bounded regular source file");
   }
-  const source = await (0, import_promises10.readFile)(target);
+  const source = await (0, import_promises9.readFile)(target);
   if (source.includes(0)) throw new TypeError("binary files are not readable through this tool");
   const lines = source.toString("utf8").split("\n");
   const content2 = lines.slice(startLine - 1, endLine).join("\n");
@@ -7570,7 +7284,7 @@ function policyContext(context, request2, options, extra) {
 async function registeredFiles(root, limit) {
   const paths = [];
   const walk = async (directory) => {
-    for (const entry of await (0, import_promises10.readdir)(directory, { withFileTypes: true })) {
+    for (const entry of await (0, import_promises9.readdir)(directory, { withFileTypes: true })) {
       if (entry.isSymbolicLink()) throw new TypeError("workspace contains a symbolic link");
       const target = (0, import_path9.resolve)(directory, entry.name);
       if (entry.isDirectory()) await walk(target);
@@ -8355,7 +8069,7 @@ function digestText(value2) {
 // src/code-images.ts
 var import_node_child_process6 = require("child_process");
 var import_node_crypto4 = require("crypto");
-var import_promises11 = require("fs/promises");
+var import_promises10 = require("fs/promises");
 var import_node_os3 = require("os");
 var import_node_path14 = require("path");
 var import_node_url3 = require("url");
@@ -8437,16 +8151,16 @@ function embeddedPiAssetPath() {
   return (0, import_node_url3.fileURLToPath)(new URL("./runtime/pi-agent.js", importMetaUrl));
 }
 async function embeddedPiImageName() {
-  const bundle = await (0, import_promises11.readFile)(embeddedPiAssetPath()).catch(() => {
+  const bundle = await (0, import_promises10.readFile)(embeddedPiAssetPath()).catch(() => {
     throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
   });
   return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto4.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await (0, import_promises11.mkdtemp)((0, import_node_path14.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
+  const context = await (0, import_promises10.mkdtemp)((0, import_node_path14.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
   try {
-    await (0, import_promises11.copyFile)(embeddedPiAssetPath(), (0, import_node_path14.join)(context, "pi-agent.js"));
-    await (0, import_promises11.writeFile)((0, import_node_path14.join)(context, "Dockerfile"), [
+    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path14.join)(context, "pi-agent.js"));
+    await (0, import_promises10.writeFile)((0, import_node_path14.join)(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -8455,7 +8169,7 @@ async function buildEmbeddedPiImage(engine, image, run) {
     ].join("\n"), { mode: 384 });
     await run(engine, ["build", "--tag", image, context], "inherit");
   } finally {
-    await (0, import_promises11.rm)(context, { recursive: true, force: true });
+    await (0, import_promises10.rm)(context, { recursive: true, force: true });
   }
 }
 
@@ -8463,7 +8177,7 @@ async function buildEmbeddedPiImage(engine, image, run) {
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = (0, import_node_path15.resolve)(cwd, options.configPath);
-  const cfg = (0, import_node_fs15.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const cfg = (0, import_node_fs14.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -8854,18 +8568,17 @@ Usage:
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
-  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
-  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai calendar disconnect [--env dev] --yes                         [continue in Studio; human session required]
+  odla-ai app archive [--config odla.config.mjs] --yes                  [continue in Studio; human session required]
+  odla-ai app restore [--config odla.config.mjs]                        [continue in Studio; human session required]
+  odla-ai app export [--env dev]                                        [continue in Studio; human session required]
   odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
-  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app promote         [--dry-run] [--json] --yes
-  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners add <email> [--email <odla-account>] [--json]
-  odla-ai app owners remove <email> [--email <odla-account>] [--json]
+                                                                         [dry-run is local; writes continue in Studio]
+  odla-ai app refresh-sandbox                                          [continue in Studio; human session required]
+  odla-ai app go-live                                                  [continue in Studio; human session required]
+  odla-ai app promote                                                  [continue in Studio; human session required]
+  odla-ai app rename <name>                                            [continue in Studio; human session required]
+  odla-ai app owners <list|add|remove> [...]                            [continue in Studio; human session required]
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -8900,8 +8613,8 @@ Usage:
   odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
   odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
   odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
-  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
-  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
+  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--token <ODLA_API_KEY>] [--json]
+  odla-ai agent retry <job-id> [--env dev] [--token <ODLA_API_KEY>] [--json]
   odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
   odla-ai context list [--json]
   odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
@@ -8937,8 +8650,8 @@ Usage:
   odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
   odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
   odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai security github disconnect --source <id> [--env dev] [--yes]
+  odla-ai security github connect [--repo owner/name] [--env dev]             [continue in Studio; human session required]
+  odla-ai security github disconnect --source <id> [--env dev]          [continue in Studio; human session required]
   odla-ai security plan [--env dev] [--json]
   odla-ai security sources [--env dev] [--json]
   odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
@@ -8946,7 +8659,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -9081,6 +8794,10 @@ Safety:
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
+  If provision reports that the current agent principal has no live app.manage
+  grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
+  the local cache, prints and opens a fresh exact-project owner-review URL, then
+  continues provisioning with the approved replacement credential.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. Code host
   approval and credential hashes live in odla-ai/db. The host
@@ -9449,7 +9166,7 @@ async function discussWatch(ctx, topicId, parsed) {
         throw new WatchRemoteError(cursor, error);
       }
       if (deadline !== void 0 && now() >= deadline) {
-        const result = report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        const result = report(ctx, parsed, { found: false, cursor: cursor ?? "" });
         throw new WatchTimeoutError(result.cursor);
       }
       const base = Math.min(intervalMs, 1e3);
@@ -9490,7 +9207,7 @@ async function discussWatch(ctx, topicId, parsed) {
       });
       const posts = topicId ? matching.filter((event) => event.type === "message").map((event) => event.payload) : void 0;
       const topics = topicId ? void 0 : matching.filter((event) => event.type === "activity").map((event) => event.payload);
-      return report2(ctx, parsed, {
+      return report(ctx, parsed, {
         found: true,
         cursor,
         events: matching,
@@ -9517,13 +9234,13 @@ async function discussWatch(ctx, topicId, parsed) {
     }
     if (page2.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report2(ctx, parsed, { found: false, cursor });
+      return report(ctx, parsed, { found: false, cursor });
     }
     const wait2 = deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()));
     await sleep(wait2);
   }
 }
-function report2(ctx, parsed, result) {
+function report(ctx, parsed, result) {
   if (ctx.json) {
     ctx.out.log(JSON.stringify(result, null, 2));
   } else if (parsed.options.jsonl !== true && result.found) {
@@ -10024,7 +9741,7 @@ function eventLabel(event) {
   const body = event.payload.message?.body?.replace(/\s+/g, " ").trim();
   return body || event.payload.entityId;
 }
-function report3(ctx, parsed, result) {
+function report2(ctx, parsed, result) {
   if (ctx.json) ctx.out.log(JSON.stringify(result, null, 2));
   else if (parsed.options.jsonl !== true && result.found) {
     for (const event of result.events ?? []) {
@@ -10084,7 +9801,7 @@ async function pmWatch(ctx, parsed) {
       });
       if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES2) throw error;
       if (deadline !== void 0 && now() >= deadline) {
-        return report3(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        return report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
       }
       const backoff = Math.min(
         MAX_BACKOFF_MS2,
@@ -10125,7 +9842,7 @@ async function pmWatch(ctx, parsed) {
         cursor,
         serverTime: current.serverTime
       });
-      return report3(ctx, parsed, { found: true, cursor, events: matching });
+      return report2(ctx, parsed, { found: true, cursor, events: matching });
     }
     if (current.events.length > 0) {
       jsonl2(ctx, parsed, {
@@ -10144,7 +9861,7 @@ async function pmWatch(ctx, parsed) {
     }
     if (current.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report3(ctx, parsed, { found: false, cursor });
+      return report2(ctx, parsed, { found: false, cursor });
     }
     await sleep(
       deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()))
@@ -11046,14 +10763,25 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out, {
-    optionalProjectCapabilities: ["app.manage"]
+    optionalProjectCapabilities: ["app.manage"],
+    forceReview: options.requestGrant
   });
   const apps = (0, import_apps12.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
   } else {
-    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    try {
+      await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    } catch (error) {
+      if (error instanceof import_apps12.AppsError && error.status === 403) {
+        throw new Error(
+          `app "${cfg.app.id}" does not exist, and this authenticated agent credential has no owner-reviewed app.manage bootstrap grant for that exact id. Run "odla-ai provision --request-grant --email <odla-account>" to open the review URL and continue; developer ownership alone is not agent authority`,
+          { cause: error }
+        );
+      }
+      throw error;
+    }
     out.log(`app: created ${cfg.app.id}`);
   }
   for (const env of cfg.envs) {
@@ -11177,7 +10905,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
 }
 
 // src/record.ts
-var import_node_fs16 = require("fs");
+var import_node_fs15 = require("fs");
 var import_node_process12 = __toESM(require("process"), 1);
 
 // src/surface.ts
@@ -11357,14 +11085,14 @@ function recordInvocation(parsed) {
       options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs16.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs15.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
 }
 
 // src/runbook-actions.ts
-var import_node_fs17 = require("fs");
+var import_node_fs16 = require("fs");
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
@@ -11449,7 +11177,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs17.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs16.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -11541,7 +11269,7 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-var import_node_fs18 = require("fs");
+var import_node_fs17 = require("fs");
 var import_node_path16 = require("path");
 function parseRunbook(text2, slug) {
   let rest = text2;
@@ -11567,12 +11295,12 @@ function parseRunbook(text2, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs18.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs18.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs17.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = (0, import_node_path16.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs18.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
+    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -11645,7 +11373,7 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs19 = require("fs");
+var import_node_fs18 = require("fs");
 var import_node_path17 = require("path");
 
 // src/runbook-impact-scan.ts
@@ -11816,9 +11544,9 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 function manifestLabeller(root) {
   return (workspace) => {
     const manifest = (0, import_node_path17.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs19.existsSync)(manifest)) return void 0;
+    if (!(0, import_node_fs18.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs19.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs18.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -11856,7 +11584,7 @@ async function assessImpact(ctx, surfaces, all, limit) {
   return out;
 }
 var editHint = (slug, appId) => `odla-ai runbook edit ${slug}${appId === PLATFORM_SCOPE ? "" : ` --app ${appId}`} --note "<what changed>"`;
-function report4(ctx, impacts) {
+function report3(ctx, impacts) {
   const covered = impacts.filter((i) => i.runbooks.length);
   ctx.out.log(
     `${impacts.length} changed surface${impacts.length === 1 ? "" : "s"}; ${covered.length} covered by a runbook. Reread each one and fix any step this change made wrong.`
@@ -11885,7 +11613,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -11894,7 +11622,7 @@ async function runbookImpact(ctx, options, deps = {}) {
   }
   const impacts = await assessImpact(ctx, surfaces, options.all, options.limit ?? 4);
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
-  report4(ctx, impacts);
+  report3(ctx, impacts);
 }
 
 // src/runbook-lint.ts
@@ -12018,7 +11746,7 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 var import_node_child_process8 = require("child_process");
-var import_node_fs20 = require("fs");
+var import_node_fs19 = require("fs");
 var import_node_os5 = require("os");
 var import_node_path18 = require("path");
 var import_node_process13 = __toESM(require("process"), 1);
@@ -12046,16 +11774,16 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path18.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path18.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
   const file = (0, import_node_path18.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs20.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs19.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs20.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs19.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs20.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -12394,7 +12122,6 @@ async function runbookCommand(parsed, deps = {}) {
 }
 
 // src/security-command-context.ts
-var import_promises12 = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -12413,21 +12140,11 @@ async function hostedSecurityContext(parsed, dependencies) {
     cfg,
     { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
     doFetch,
-    stdout
+    stdout,
+    { optionalProjectCapabilities: ["app.manage"] }
   );
   return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
 }
-async function interactiveConfirmation(message2, dependencies) {
-  if (dependencies.confirm) return dependencies.confirm(message2);
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = (0, import_promises12.createInterface)({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = await prompt.question(`${message2} [y/N] `);
-    return /^y(?:es)?$/i.test(answer.trim());
-  } finally {
-    prompt.close();
-  }
-}
 function requiredSecurityPositional(parsed, index, label) {
   const value2 = parsed.positionals[index];
   if (!value2) throw new Error(`${label} is required`);
@@ -12493,31 +12210,31 @@ function printHostedJob(out, job, platform, appId) {
   url.searchParams.set("job", job.jobId);
   out.log(`  Studio: ${url.toString()}`);
 }
-function printHostedReport(out, report5) {
-  out.log(`security report ${report5.jobId}: ${report5.repository}@${report5.revision}`);
-  out.log(`  coverage: ${report5.coverageStatus} cells=${report5.metrics.coverageCells} shallow=${report5.metrics.shallowCells} blocked=${report5.metrics.blockedCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
-  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates} rejected=${report5.metrics.rejected}`);
-  out.log(`  discovery: ${report5.provenance.discovery?.provider ?? "unknown"}/${report5.provenance.discovery?.model ?? "unknown"}`);
-  out.log(`  validation: ${report5.provenance.validation?.provider ?? "unknown"}/${report5.provenance.validation?.model ?? "unknown"} independent=${String(report5.provenance.independentValidation)}`);
-  for (const finding of report5.findings) {
+function printHostedReport(out, report4) {
+  out.log(`security report ${report4.jobId}: ${report4.repository}@${report4.revision}`);
+  out.log(`  coverage: ${report4.coverageStatus} cells=${report4.metrics.coverageCells} shallow=${report4.metrics.shallowCells} blocked=${report4.metrics.blockedCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates} rejected=${report4.metrics.rejected}`);
+  out.log(`  discovery: ${report4.provenance.discovery?.provider ?? "unknown"}/${report4.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report4.provenance.validation?.provider ?? "unknown"}/${report4.provenance.validation?.model ?? "unknown"} independent=${String(report4.provenance.independentValidation)}`);
+  for (const finding of report4.findings) {
     const location = finding.locations[0];
     out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
   }
-  for (const limitation of report5.limitations) out.log(`  limitation: ${limitation}`);
+  for (const limitation of report4.limitations) out.log(`  limitation: ${limitation}`);
 }
-function enforceHostedReportGate(report5, parsed, out, emitSuccess) {
+function enforceHostedReportGate(report4, parsed, out, emitSuccess) {
   const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
   const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
-  const confirmed = report5.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
-  const leads = failOnCandidates ? report5.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
-  const incomplete = report5.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = report4.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report4.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report4.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
-    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report5.coverageStatus}` : ""}`);
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report4.coverageStatus}` : ""}`);
   }
   if (emitSuccess) {
-    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report5.coverageStatus}. This is not proof that the application is secure.`);
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report4.coverageStatus}. This is not proof that the application is secure.`);
   }
 }
 function printHostedSecurityPlanRoute(out, label, route2) {
@@ -12600,17 +12317,17 @@ async function runHostedSecurity(options) {
       allowNetwork: false
     }
   });
-  const report5 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await (0, import_node3.writeSecurityArtifacts)(output, report5);
-  const reportDigest = await (0, import_security.securityFingerprint)(report5);
+  const report4 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await (0, import_node3.writeSecurityArtifacts)(output, report4);
+  const reportDigest = await (0, import_security.securityFingerprint)(report4);
   await hosted.complete({
     reportDigest,
-    coverageStatus: report5.coverageStatus,
-    confirmed: report5.metrics.confirmed,
-    candidates: report5.metrics.candidates
+    coverageStatus: report4.coverageStatus,
+    confirmed: report4.metrics.confirmed,
+    candidates: report4.metrics.candidates
   }, { signal: options.signal });
-  printSummary(options.stdout ?? console, appId, env, hosted.run, report5, output);
-  return Object.freeze({ report: report5, run: hosted.run, output });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report4, output);
+  return Object.freeze({ report: report4, run: hosted.run, output });
 }
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
@@ -12636,14 +12353,14 @@ function profileFor(name, maxHuntTasks) {
   if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
   return { ...profile, maxHuntTasks };
 }
-function printSummary(out, appId, env, run, report5, output) {
-  const complete = report5.coverage.filter((cell) => cell.state === "complete").length;
+function printSummary(out, appId, env, run, report4, output) {
+  const complete = report4.coverage.filter((cell) => cell.state === "complete").length;
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
-  if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
-  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
+  out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
   out.log(`  report: ${(0, import_node_path19.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
@@ -12890,13 +12607,13 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     }
     throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
   }
-  const report5 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  const report4 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
   if (parsed.options.json === true) {
-    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report5 }, null, 2));
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report4 }, null, 2));
   } else {
-    printHostedReport(context.stdout, report5);
+    printHostedReport(context.stdout, report4);
   }
-  enforceHostedReportGate(report5, parsed, context.stdout, parsed.options.json !== true);
+  enforceHostedReportGate(report4, parsed, context.stdout, parsed.options.json !== true);
 }
 async function runLocalSecurityCommand(parsed, dependencies) {
   if (parsed.options.source === true) {
@@ -12957,19 +12674,20 @@ async function runLocalSecurityCommand(parsed, dependencies) {
         cfg,
         { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
         doFetch,
-        out
+        out,
+        { optionalProjectCapabilities: ["app.manage"] }
       );
     }
   });
   enforceLocalGate(result.report, parsed);
 }
-function enforceLocalGate(report5, parsed) {
+function enforceLocalGate(report4, parsed) {
   const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-  const confirmed = (0, import_security2.findingsAtOrAbove)(report5, failOn);
-  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report5, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-  const incomplete = report5.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = (0, import_security2.findingsAtOrAbove)(report4, failOn);
+  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report4, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report4.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
@@ -13008,9 +12726,9 @@ async function securityCommand(parsed, dependencies) {
     assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
-    const report5 = await getHostedSecurityReport({ ...context, jobId });
-    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report5, null, 2));
-    else printHostedReport(context.stdout, report5);
+    const report4 = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report4, null, 2));
+    else printHostedReport(context.stdout, report4);
     return;
   }
   if (sub !== "run") {
@@ -13024,35 +12742,24 @@ async function githubSecurityCommand(parsed, dependencies) {
   const action2 = parsed.positionals[2];
   if (action2 === "disconnect") {
     assertArgs(parsed, ["config", "env", "platform", "source", "email", "open", "yes"], 3);
-    const context2 = await hostedSecurityContext(parsed, dependencies);
     const sourceId = requiredString(parsed.options.source, "--source");
-    const confirmed = parsed.options.yes === true || await interactiveConfirmation(
-      `Disconnect GitHub security source ${sourceId} from ${context2.appId}/${context2.env}?`,
-      dependencies
+    return requireStudioHuman(
+      stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      `disconnecting GitHub security source ${sourceId}`,
+      "security",
+      stringOpt(parsed.options.env)
     );
-    if (!confirmed) {
-      throw new Error("GitHub source disconnect cancelled; pass --yes in a non-interactive shell");
-    }
-    await disconnectGitHubSecuritySource({ ...context2, sourceId });
-    context2.stdout.log(`github: disconnected ${sourceId} from ${context2.appId}/${context2.env}`);
-    return;
   }
   if (action2 !== "connect") {
     throw new Error('unknown security github command. Try "odla-ai security github connect".');
   }
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
-  const context = await hostedSecurityContext(parsed, dependencies);
-  const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin).catch(() => void 0);
-  const connection = await connectGitHubSecuritySource({
-    ...context,
-    ...repository === void 0 ? {} : { repository },
-    open: parsed.options.open !== false,
-    openInstallUrl: dependencies.openUrl ?? openUrl,
-    wait: dependencies.pollWait,
-    stdout: context.stdout
-  });
-  context.stdout.log(`github: connected ${connection.repository ?? repository ?? "app repository"} (${connection.sourceId ?? "source pending"})`);
-  context.stdout.log("github: odla.ai stores the installation; no PAT or GitHub token is written locally");
+  await requireStudioHuman(
+    stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    "connecting the GitHub security repository",
+    "security",
+    stringOpt(parsed.options.env)
+  );
 }
 async function listSecuritySources(parsed, dependencies) {
   assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 2);
@@ -13193,6 +12900,7 @@ async function provisionCommand(parsed, dependencies) {
     "write-credentials",
     "write-dev-vars",
     "token",
+    "request-grant",
     "email",
     "open",
     "wait",
@@ -13208,6 +12916,7 @@ async function provisionCommand(parsed, dependencies) {
     writeCredentials: parsed.options["write-credentials"] !== false,
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
+    requestGrant: parsed.options["request-grant"] === true,
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     wait: numberOpt(parsed.options.wait, "--wait"),