@odla-ai/cli 0.27.12 → 0.27.14

package/README.md

@@ -359,6 +359,8 @@ npx odla-ai code connect --env prod --once # bounded enrollment + heartbeat proo
 # install SDKs, write the Worker, and create wrangler.jsonc before secret push
 npx odla-ai provision --dry-run
 npx odla-ai provision --email owner@example.com --write-dev-vars --push-secrets
+# recovery when the selected agent credential has no live app.manage grant
+npx odla-ai provision --request-grant --email owner@example.com --write-dev-vars --push-secrets
 npx odla-ai smoke --env dev
 npx odla-ai agent jobs --env dev --state dead_letter --json
 npx odla-ai agent retry <job-id> --env dev --json
@@ -472,7 +474,11 @@ shown-once credential.
    needed by the run; it does not permit ownership, rename/category, archive,
    restore, or purge. A cached or pending baseline handshake without
    `app.manage` is not reused for provision: the CLI starts a fresh request for
-   owner review. If
+   owner review. An explicit `--token` or `ODLA_DEV_TOKEN` has no trustworthy
+   local grant metadata, so a server refusal cannot be repaired by retrying it.
+   Run `provision --request-grant --email <account>` to ignore the ambient and
+   cached credentials, open a new exact-project review, collect the approved
+   replacement, and continue the same provisioning run. If
    the exact project id does not exist yet, approval reserves that id for this
    credential instead of failing: the credential may create only that app once,
    and Registry binds its reviewed grant to the new app incarnation.

package/dist/bin.cjs

@@ -318,23 +318,30 @@ function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default
 
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
-  if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
-    const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
-    if (declared) {
-      if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
-    } else if (audience !== "https://odla.ai") {
-      throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
-    }
-    return import_node_process4.default.env.ODLA_DEV_TOKEN;
-  }
   const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
   const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
-    out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
+  if (!grantRequest.forceReview) {
+    if (options.token) return options.token;
+    if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
+      const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+      if (declared) {
+        if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
+      } else if (audience !== "https://odla.ai") {
+        throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
+      }
+      return import_node_process4.default.env.ODLA_DEV_TOKEN;
+    }
+    if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
+      out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      return cached.token;
+    }
+  } else {
+    if (options.token) {
+      throw new Error("--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
+    }
+    out.error(`auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"`);
   }
   const ctx = {
     cfg,
@@ -2831,11 +2838,11 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
     }
     if (code === "provision_approval_required") {
       throw new Error(
-        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Discard the cached or supplied token and run this command with the current CLI to approve one fresh exact-project provisioning handshake`
+        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Run "odla-ai provision --request-grant --email <odla-account>" to open one fresh exact-project owner review; do not change app ownership unless the human account itself is not an owner`
       );
     }
     throw new Error(
-      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
+      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; run "odla-ai provision --request-grant --email <odla-account>" to open a fresh owner review. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
@@ -8517,7 +8524,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -8652,6 +8659,13 @@ Safety:
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
+  If provision reports that the current agent principal has no live app.manage
+  grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
+  the local cache, prints and opens a fresh exact-project owner-review URL, then
+  continues provisioning with the approved replacement credential.
+  Before a non-dry-run provision, the executable checks npm's current CLI
+  release. A confirmed stale client stops with a safe npx rerun command; a
+  workspace-linked client also identifies the worktree that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. Code host
   approval and credential hashes live in odla-ai/db. The host
@@ -10617,14 +10631,25 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out, {
-    optionalProjectCapabilities: ["app.manage"]
+    optionalProjectCapabilities: ["app.manage"],
+    forceReview: options.requestGrant
   });
   const apps = (0, import_apps12.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
   } else {
-    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    try {
+      await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    } catch (error) {
+      if (error instanceof import_apps12.AppsError && error.status === 403) {
+        throw new Error(
+          `app "${cfg.app.id}" does not exist, and this authenticated agent credential has no owner-reviewed app.manage bootstrap grant for that exact id. Run "odla-ai provision --request-grant --email <odla-account>" to open the review URL and continue; developer ownership alone is not agent authority`,
+          { cause: error }
+        );
+      }
+      throw error;
+    }
     out.log(`app: created ${cfg.app.id}`);
   }
   for (const env of cfg.envs) {
@@ -12723,6 +12748,7 @@ async function provisionCommand(parsed, dependencies) {
     "write-credentials",
     "write-dev-vars",
     "token",
+    "request-grant",
     "email",
     "open",
     "wait",
@@ -12738,6 +12764,7 @@ async function provisionCommand(parsed, dependencies) {
     writeCredentials: parsed.options["write-credentials"] !== false,
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
+    requestGrant: parsed.options["request-grant"] === true,
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     wait: numberOpt(parsed.options.wait, "--wait"),
@@ -12774,8 +12801,80 @@ async function calendarCommand(parsed, dependencies) {
   else await calendarDisconnect(options);
 }
 
+// src/cli-update.ts
+var import_node_fs20 = require("fs");
+var DEFAULT_REGISTRY_URL = "https://registry.npmjs.org/@odla-ai%2fcli/latest";
+var VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+async function requireCurrentCliForProvision(argv, options = {}) {
+  if (argv[0] !== "provision" || argv.includes("--dry-run")) return;
+  const current = options.currentVersion ?? cliVersion();
+  if (!VERSION.test(current)) return;
+  const latest = await fetchLatestCliVersion(options);
+  if (!latest || compareVersions(current, latest) >= 0) return;
+  const entryPath = resolvedEntryPath(options.entryPath ?? process.argv[1]);
+  const workspace = isWorkspaceCli(entryPath);
+  const rerun = renderReleasedProvisionCommand(latest, argv);
+  const source = workspace ? ` This executable resolves to the workspace build at ${entryPath}; update/rebase that worktree and rebuild it before using the linked CLI again.` : " Update the installed dependency before using its CLI again.";
+  throw new Error(
+    `provision blocked: @odla-ai/cli ${current} is older than the released ${latest}. Provisioning grant requests are security-sensitive, and a stale client can omit required authority.${source}
+Run the current release now:
+  ${rerun}`
+  );
+}
+async function fetchLatestCliVersion(options) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 2500);
+  timeout.unref?.();
+  try {
+    const response2 = await (options.fetch ?? fetch)(
+      options.registryUrl ?? process.env.ODLA_CLI_REGISTRY_URL ?? DEFAULT_REGISTRY_URL,
+      {
+        headers: {
+          accept: "application/json",
+          "user-agent": `odla-ai-cli/${options.currentVersion ?? cliVersion()}`
+        },
+        signal: controller.signal
+      }
+    );
+    if (!response2.ok) return null;
+    const body = await response2.json();
+    return typeof body.version === "string" && VERSION.test(body.version) ? body.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function resolvedEntryPath(entryPath) {
+  if (!entryPath) return "unknown executable";
+  try {
+    return (0, import_node_fs20.realpathSync)(entryPath);
+  } catch {
+    return entryPath;
+  }
+}
+function isWorkspaceCli(entryPath) {
+  const normalized = entryPath.replaceAll("\\", "/");
+  return normalized.includes("/packages/cli/dist/bin.") && !normalized.includes("/node_modules/");
+}
+function renderReleasedProvisionCommand(latest, argv) {
+  const safeArgs = [];
+  for (let index = 0; index < argv.length; index++) {
+    const value2 = argv[index];
+    safeArgs.push(value2);
+    if (value2 === "--token" && index + 1 < argv.length) {
+      safeArgs.push("<redacted-token>");
+      index++;
+    }
+  }
+  return ["npx", "--yes", `@odla-ai/cli@${latest}`, ...safeArgs].map(shellQuote).join(" ");
+}
+function shellQuote(value2) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value2) ? value2 : `'${value2.replaceAll("'", `'"'"'`)}'`;
+}
+
 // src/bin.ts
-runCli().catch((err) => {
+requireCurrentCliForProvision(process.argv.slice(2)).then(() => runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });