@odla-ai/cli 0.27.12 → 0.27.14

package/dist/bin.js

@@ -1,12 +1,86 @@
 #!/usr/bin/env node
 import {
+  cliVersion,
+  compareVersions,
   exitCodeFor,
   redactSecrets,
   runCli
-} from "./chunk-ECRBOR66.js";
+} from "./chunk-3SQ2XUBB.js";
+
+// src/cli-update.ts
+import { realpathSync } from "fs";
+var DEFAULT_REGISTRY_URL = "https://registry.npmjs.org/@odla-ai%2fcli/latest";
+var VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+async function requireCurrentCliForProvision(argv, options = {}) {
+  if (argv[0] !== "provision" || argv.includes("--dry-run")) return;
+  const current = options.currentVersion ?? cliVersion();
+  if (!VERSION.test(current)) return;
+  const latest = await fetchLatestCliVersion(options);
+  if (!latest || compareVersions(current, latest) >= 0) return;
+  const entryPath = resolvedEntryPath(options.entryPath ?? process.argv[1]);
+  const workspace = isWorkspaceCli(entryPath);
+  const rerun = renderReleasedProvisionCommand(latest, argv);
+  const source = workspace ? ` This executable resolves to the workspace build at ${entryPath}; update/rebase that worktree and rebuild it before using the linked CLI again.` : " Update the installed dependency before using its CLI again.";
+  throw new Error(
+    `provision blocked: @odla-ai/cli ${current} is older than the released ${latest}. Provisioning grant requests are security-sensitive, and a stale client can omit required authority.${source}
+Run the current release now:
+  ${rerun}`
+  );
+}
+async function fetchLatestCliVersion(options) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 2500);
+  timeout.unref?.();
+  try {
+    const response = await (options.fetch ?? fetch)(
+      options.registryUrl ?? process.env.ODLA_CLI_REGISTRY_URL ?? DEFAULT_REGISTRY_URL,
+      {
+        headers: {
+          accept: "application/json",
+          "user-agent": `odla-ai-cli/${options.currentVersion ?? cliVersion()}`
+        },
+        signal: controller.signal
+      }
+    );
+    if (!response.ok) return null;
+    const body = await response.json();
+    return typeof body.version === "string" && VERSION.test(body.version) ? body.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function resolvedEntryPath(entryPath) {
+  if (!entryPath) return "unknown executable";
+  try {
+    return realpathSync(entryPath);
+  } catch {
+    return entryPath;
+  }
+}
+function isWorkspaceCli(entryPath) {
+  const normalized = entryPath.replaceAll("\\", "/");
+  return normalized.includes("/packages/cli/dist/bin.") && !normalized.includes("/node_modules/");
+}
+function renderReleasedProvisionCommand(latest, argv) {
+  const safeArgs = [];
+  for (let index = 0; index < argv.length; index++) {
+    const value = argv[index];
+    safeArgs.push(value);
+    if (value === "--token" && index + 1 < argv.length) {
+      safeArgs.push("<redacted-token>");
+      index++;
+    }
+  }
+  return ["npx", "--yes", `@odla-ai/cli@${latest}`, ...safeArgs].map(shellQuote).join(" ");
+}
+function shellQuote(value) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 
 // src/bin.ts
-runCli().catch((err) => {
+requireCurrentCliForProvision(process.argv.slice(2)).then(() => runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/bin.ts"],"sourcesContent":["import { exitCodeFor, runCli } from \"./cli\";\nimport { redactSecrets } from \"./redact\";\n\nrunCli().catch((err) => {\n  console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));\n  process.exitCode = exitCodeFor(err);\n});\n"],"mappings":";;;;;;;;AAGA,OAAO,EAAE,MAAM,CAAC,QAAQ;AACtB,UAAQ,MAAM,cAAc,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE,CAAC;AAC3F,UAAQ,WAAW,YAAY,GAAG;AACpC,CAAC;","names":[]}
+{"version":3,"sources":["../src/cli-update.ts","../src/bin.ts"],"sourcesContent":["import { realpathSync } from \"node:fs\";\nimport { compareVersions } from \"./runbook-requires\";\nimport { cliVersion } from \"./version\";\n\nconst DEFAULT_REGISTRY_URL = \"https://registry.npmjs.org/@odla-ai%2fcli/latest\";\nconst VERSION = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/;\n\nexport interface CliUpdateCheckOptions {\n  currentVersion?: string;\n  entryPath?: string;\n  fetch?: typeof fetch;\n  registryUrl?: string;\n  timeoutMs?: number;\n}\n\n/**\n * Provisioning handshakes are security-sensitive protocol requests. Before a\n * real provision run, stop a CLI which is confirmed older than npm's current\n * release so an agent cannot unknowingly submit an obsolete grant shape.\n * Registry unavailability remains fail-open: npm must not become a production\n * availability dependency for an otherwise current CLI.\n */\nexport async function requireCurrentCliForProvision(\n  argv: readonly string[],\n  options: CliUpdateCheckOptions = {},\n): Promise<void> {\n  if (argv[0] !== \"provision\" || argv.includes(\"--dry-run\")) return;\n\n  const current = options.currentVersion ?? cliVersion();\n  if (!VERSION.test(current)) return;\n  const latest = await fetchLatestCliVersion(options);\n  if (!latest || compareVersions(current, latest) >= 0) return;\n\n  const entryPath = resolvedEntryPath(options.entryPath ?? process.argv[1]);\n  const workspace = isWorkspaceCli(entryPath);\n  const rerun = renderReleasedProvisionCommand(latest, argv);\n  const source = workspace\n    ? ` This executable resolves to the workspace build at ${entryPath}; update/rebase that worktree and rebuild it before using the linked CLI again.`\n    : \" Update the installed dependency before using its CLI again.\";\n  throw new Error(\n    `provision blocked: @odla-ai/cli ${current} is older than the released ${latest}. ` +\n    `Provisioning grant requests are security-sensitive, and a stale client can omit required authority.${source}\\n` +\n    `Run the current release now:\\n  ${rerun}`,\n  );\n}\n\nasync function fetchLatestCliVersion(\n  options: CliUpdateCheckOptions,\n): Promise<string | null> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 2_500);\n  timeout.unref?.();\n  try {\n    const response = await (options.fetch ?? fetch)(\n      options.registryUrl ?? process.env.ODLA_CLI_REGISTRY_URL ?? DEFAULT_REGISTRY_URL,\n      {\n        headers: {\n          accept: \"application/json\",\n          \"user-agent\": `odla-ai-cli/${options.currentVersion ?? cliVersion()}`,\n        },\n        signal: controller.signal,\n      },\n    );\n    if (!response.ok) return null;\n    const body = await response.json() as { version?: unknown };\n    return typeof body.version === \"string\" && VERSION.test(body.version)\n      ? body.version\n      : null;\n  } catch {\n    return null;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nfunction resolvedEntryPath(entryPath: string | undefined): string {\n  if (!entryPath) return \"unknown executable\";\n  try {\n    return realpathSync(entryPath);\n  } catch {\n    return entryPath;\n  }\n}\n\nfunction isWorkspaceCli(entryPath: string): boolean {\n  const normalized = entryPath.replaceAll(\"\\\\\", \"/\");\n  return normalized.includes(\"/packages/cli/dist/bin.\") &&\n    !normalized.includes(\"/node_modules/\");\n}\n\nfunction renderReleasedProvisionCommand(\n  latest: string,\n  argv: readonly string[],\n): string {\n  const safeArgs: string[] = [];\n  for (let index = 0; index < argv.length; index++) {\n    const value = argv[index]!;\n    safeArgs.push(value);\n    if (value === \"--token\" && index + 1 < argv.length) {\n      safeArgs.push(\"<redacted-token>\");\n      index++;\n    }\n  }\n  return [\"npx\", \"--yes\", `@odla-ai/cli@${latest}`, ...safeArgs]\n    .map(shellQuote)\n    .join(\" \");\n}\n\nfunction shellQuote(value: string): string {\n  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value)\n    ? value\n    : `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n","import { exitCodeFor, runCli } from \"./cli\";\nimport { requireCurrentCliForProvision } from \"./cli-update\";\nimport { redactSecrets } from \"./redact\";\n\nrequireCurrentCliForProvision(process.argv.slice(2))\n  .then(() => runCli())\n  .catch((err) => {\n    console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));\n    process.exitCode = exitCodeFor(err);\n  });\n"],"mappings":";;;;;;;;;;AAAA,SAAS,oBAAoB;AAI7B,IAAM,uBAAuB;AAC7B,IAAM,UAAU;AAiBhB,eAAsB,8BACpB,MACA,UAAiC,CAAC,GACnB;AACf,MAAI,KAAK,CAAC,MAAM,eAAe,KAAK,SAAS,WAAW,EAAG;AAE3D,QAAM,UAAU,QAAQ,kBAAkB,WAAW;AACrD,MAAI,CAAC,QAAQ,KAAK,OAAO,EAAG;AAC5B,QAAM,SAAS,MAAM,sBAAsB,OAAO;AAClD,MAAI,CAAC,UAAU,gBAAgB,SAAS,MAAM,KAAK,EAAG;AAEtD,QAAM,YAAY,kBAAkB,QAAQ,aAAa,QAAQ,KAAK,CAAC,CAAC;AACxE,QAAM,YAAY,eAAe,SAAS;AAC1C,QAAM,QAAQ,+BAA+B,QAAQ,IAAI;AACzD,QAAM,SAAS,YACX,uDAAuD,SAAS,oFAChE;AACJ,QAAM,IAAI;AAAA,IACR,mCAAmC,OAAO,+BAA+B,MAAM,wGACuB,MAAM;AAAA;AAAA,IACzE,KAAK;AAAA,EAC1C;AACF;AAEA,eAAe,sBACb,SACwB;AACxB,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,QAAQ,aAAa,IAAK;AAC/E,UAAQ,QAAQ;AAChB,MAAI;AACF,UAAM,WAAW,OAAO,QAAQ,SAAS;AAAA,MACvC,QAAQ,eAAe,QAAQ,IAAI,yBAAyB;AAAA,MAC5D;AAAA,QACE,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc,eAAe,QAAQ,kBAAkB,WAAW,CAAC;AAAA,QACrE;AAAA,QACA,QAAQ,WAAW;AAAA,MACrB;AAAA,IACF;AACA,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,OAAO,KAAK,YAAY,YAAY,QAAQ,KAAK,KAAK,OAAO,IAChE,KAAK,UACL;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,iBAAa,OAAO;AAAA,EACtB;AACF;AAEA,SAAS,kBAAkB,WAAuC;AAChE,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI;AACF,WAAO,aAAa,SAAS;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,WAA4B;AAClD,QAAM,aAAa,UAAU,WAAW,MAAM,GAAG;AACjD,SAAO,WAAW,SAAS,yBAAyB,KAClD,CAAC,WAAW,SAAS,gBAAgB;AACzC;AAEA,SAAS,+BACP,QACA,MACQ;AACR,QAAM,WAAqB,CAAC;AAC5B,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;AAChD,UAAM,QAAQ,KAAK,KAAK;AACxB,aAAS,KAAK,KAAK;AACnB,QAAI,UAAU,aAAa,QAAQ,IAAI,KAAK,QAAQ;AAClD,eAAS,KAAK,kBAAkB;AAChC;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,OAAO,SAAS,gBAAgB,MAAM,IAAI,GAAG,QAAQ,EAC1D,IAAI,UAAU,EACd,KAAK,GAAG;AACb;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,2BAA2B,KAAK,KAAK,IACxC,QACA,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AACxC;;;AC5GA,8BAA8B,QAAQ,KAAK,MAAM,CAAC,CAAC,EAChD,KAAK,MAAM,OAAO,CAAC,EACnB,MAAM,CAAC,QAAQ;AACd,UAAQ,MAAM,cAAc,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE,CAAC;AAC3F,UAAQ,WAAW,YAAY,GAAG;AACpC,CAAC;","names":[]}

package/dist/{chunk-ECRBOR66.js → chunk-3SQ2XUBB.js}

@@ -292,23 +292,30 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
 
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
-  if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (process5.env.ODLA_DEV_TOKEN) {
-    const declared = process5.env.ODLA_DEV_TOKEN_AUDIENCE;
-    if (declared) {
-      if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
-    } else if (audience !== "https://odla.ai") {
-      throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
-    }
-    return process5.env.ODLA_DEV_TOKEN;
-  }
   const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
   const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
-    out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
+  if (!grantRequest.forceReview) {
+    if (options.token) return options.token;
+    if (process5.env.ODLA_DEV_TOKEN) {
+      const declared = process5.env.ODLA_DEV_TOKEN_AUDIENCE;
+      if (declared) {
+        if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
+      } else if (audience !== "https://odla.ai") {
+        throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
+      }
+      return process5.env.ODLA_DEV_TOKEN;
+    }
+    if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
+      out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      return cached.token;
+    }
+  } else {
+    if (options.token) {
+      throw new Error("--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
+    }
+    out.error(`auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"`);
   }
   const ctx = {
     cfg,
@@ -1810,11 +1817,11 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
     }
     if (code === "provision_approval_required") {
       throw new Error(
-        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Discard the cached or supplied token and run this command with the current CLI to approve one fresh exact-project provisioning handshake`
+        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Run "odla-ai provision --request-grant --email <odla-account>" to open one fresh exact-project owner review; do not change app ownership unless the human account itself is not an owner`
       );
     }
     throw new Error(
-      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
+      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; run "odla-ai provision --request-grant --email <odla-account>" to open a fresh owner review. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
@@ -7241,7 +7248,7 @@ function record6(value2) {
 }
 
 // src/provision.ts
-import { createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
+import { AppsError as AppsError2, createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
 import process9 from "process";
 
@@ -7462,14 +7469,25 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out, {
-    optionalProjectCapabilities: ["app.manage"]
+    optionalProjectCapabilities: ["app.manage"],
+    forceReview: options.requestGrant
   });
   const apps = createAppsClient3({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
   } else {
-    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    try {
+      await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    } catch (error) {
+      if (error instanceof AppsError2 && error.status === 403) {
+        throw new Error(
+          `app "${cfg.app.id}" does not exist, and this authenticated agent credential has no owner-reviewed app.manage bootstrap grant for that exact id. Run "odla-ai provision --request-grant --email <odla-account>" to open the review URL and continue; developer ownership alone is not agent authority`,
+          { cause: error }
+        );
+      }
+      throw error;
+    }
     out.log(`app: created ${cfg.app.id}`);
   }
   for (const env of cfg.envs) {
@@ -9360,7 +9378,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -9495,6 +9513,13 @@ Safety:
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
+  If provision reports that the current agent principal has no live app.manage
+  grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
+  the local cache, prints and opens a fresh exact-project owner-review URL, then
+  continues provisioning with the approved replacement credential.
+  Before a non-dry-run provision, the executable checks npm's current CLI
+  release. A confirmed stale client stops with a safe npx rerun command; a
+  workspace-linked client also identifies the worktree that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. Code host
   approval and credential hashes live in odla-ai/db. The host
@@ -12796,6 +12821,7 @@ async function provisionCommand(parsed, dependencies) {
     "write-credentials",
     "write-dev-vars",
     "token",
+    "request-grant",
     "email",
     "open",
     "wait",
@@ -12811,6 +12837,7 @@ async function provisionCommand(parsed, dependencies) {
     writeCredentials: parsed.options["write-credentials"] !== false,
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
+    requestGrant: parsed.options["request-grant"] === true,
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     wait: numberOpt(parsed.options.wait, "--wait"),
@@ -12861,6 +12888,7 @@ export {
   calendarDisconnect,
   CAPABILITIES,
   printCapabilities,
+  cliVersion,
   ConfigOperationCommandError,
   desiredRegistryState,
   configApply,
@@ -12894,6 +12922,7 @@ export {
   describeProblem,
   invocationPath,
   surfacePaths,
+  compareVersions,
   runHostedSecurity,
   getHostedSecurityIntent,
   getHostedSecurityPlan,
@@ -12906,4 +12935,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-ECRBOR66.js.map
+//# sourceMappingURL=chunk-3SQ2XUBB.js.map