@odla-ai/cli 0.27.12 → 0.27.13

package/README.md

@@ -359,6 +359,8 @@ npx odla-ai code connect --env prod --once # bounded enrollment + heartbeat proo
 # install SDKs, write the Worker, and create wrangler.jsonc before secret push
 npx odla-ai provision --dry-run
 npx odla-ai provision --email owner@example.com --write-dev-vars --push-secrets
+# recovery when the selected agent credential has no live app.manage grant
+npx odla-ai provision --request-grant --email owner@example.com --write-dev-vars --push-secrets
 npx odla-ai smoke --env dev
 npx odla-ai agent jobs --env dev --state dead_letter --json
 npx odla-ai agent retry <job-id> --env dev --json
@@ -472,7 +474,11 @@ shown-once credential.
    needed by the run; it does not permit ownership, rename/category, archive,
    restore, or purge. A cached or pending baseline handshake without
    `app.manage` is not reused for provision: the CLI starts a fresh request for
-   owner review. If
+   owner review. An explicit `--token` or `ODLA_DEV_TOKEN` has no trustworthy
+   local grant metadata, so a server refusal cannot be repaired by retrying it.
+   Run `provision --request-grant --email <account>` to ignore the ambient and
+   cached credentials, open a new exact-project review, collect the approved
+   replacement, and continue the same provisioning run. If
    the exact project id does not exist yet, approval reserves that id for this
    credential instead of failing: the credential may create only that app once,
    and Registry binds its reviewed grant to the new app incarnation.

package/dist/bin.cjs

@@ -318,23 +318,30 @@ function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default
 
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
-  if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
-    const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
-    if (declared) {
-      if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
-    } else if (audience !== "https://odla.ai") {
-      throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
-    }
-    return import_node_process4.default.env.ODLA_DEV_TOKEN;
-  }
   const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
   const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
-    out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
+  if (!grantRequest.forceReview) {
+    if (options.token) return options.token;
+    if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
+      const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+      if (declared) {
+        if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
+      } else if (audience !== "https://odla.ai") {
+        throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
+      }
+      return import_node_process4.default.env.ODLA_DEV_TOKEN;
+    }
+    if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
+      out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      return cached.token;
+    }
+  } else {
+    if (options.token) {
+      throw new Error("--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
+    }
+    out.error(`auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"`);
   }
   const ctx = {
     cfg,
@@ -2831,11 +2838,11 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
     }
     if (code === "provision_approval_required") {
       throw new Error(
-        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Discard the cached or supplied token and run this command with the current CLI to approve one fresh exact-project provisioning handshake`
+        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Run "odla-ai provision --request-grant --email <odla-account>" to open one fresh exact-project owner review; do not change app ownership unless the human account itself is not an owner`
       );
     }
     throw new Error(
-      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
+      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; run "odla-ai provision --request-grant --email <odla-account>" to open a fresh owner review. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
@@ -8517,7 +8524,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -8652,6 +8659,10 @@ Safety:
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
+  If provision reports that the current agent principal has no live app.manage
+  grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
+  the local cache, prints and opens a fresh exact-project owner-review URL, then
+  continues provisioning with the approved replacement credential.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. Code host
   approval and credential hashes live in odla-ai/db. The host
@@ -10617,14 +10628,25 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out, {
-    optionalProjectCapabilities: ["app.manage"]
+    optionalProjectCapabilities: ["app.manage"],
+    forceReview: options.requestGrant
   });
   const apps = (0, import_apps12.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
   } else {
-    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    try {
+      await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    } catch (error) {
+      if (error instanceof import_apps12.AppsError && error.status === 403) {
+        throw new Error(
+          `app "${cfg.app.id}" does not exist, and this authenticated agent credential has no owner-reviewed app.manage bootstrap grant for that exact id. Run "odla-ai provision --request-grant --email <odla-account>" to open the review URL and continue; developer ownership alone is not agent authority`,
+          { cause: error }
+        );
+      }
+      throw error;
+    }
     out.log(`app: created ${cfg.app.id}`);
   }
   for (const env of cfg.envs) {
@@ -12723,6 +12745,7 @@ async function provisionCommand(parsed, dependencies) {
     "write-credentials",
     "write-dev-vars",
     "token",
+    "request-grant",
     "email",
     "open",
     "wait",
@@ -12738,6 +12761,7 @@ async function provisionCommand(parsed, dependencies) {
     writeCredentials: parsed.options["write-credentials"] !== false,
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
+    requestGrant: parsed.options["request-grant"] === true,
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     wait: numberOpt(parsed.options.wait, "--wait"),