@odla-ai/cli 0.27.15 → 0.28.0

package/dist/bin.cjs

@@ -509,7 +509,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
   const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (!grantRequest.forceReview) {
+  if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
     if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
       const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
@@ -526,9 +526,9 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     }
   } else {
     if (options.token) {
-      throw new Error("--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
+      throw new Error(grantRequest.forceReview ? "--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached" : "a fresh authorization cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
     }
-    out.error(`auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"`);
+    out.error(grantRequest.forceReview ? `auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"` : `auth: requesting a fresh agent sign-in for exact project "${cfg.app.id}"`);
   }
   const ctx = {
     cfg,
@@ -541,6 +541,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
+  if (grantRequest.freshLogin) clearPendingHandshake(ctx.pendingFile);
   const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
   writePrivateJson(cfg.local.tokenFile, {
@@ -663,8 +664,15 @@ function stillPending(pending, email) {
 }
 function handshakeEmail(value2, cached) {
   const email = (value2 ?? import_node_process4.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  if (/@users\.noreply\.github\.com$/i.test(email)) {
+    throw new Error(
+      `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
+    );
+  }
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
-    throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
+    throw new Error(
+      "a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL; use the signed-in email shown in odla Studio, not git or GitHub identity"
+    );
   }
   return email;
 }
@@ -1958,6 +1966,223 @@ var init_admin_command = __esm({
   }
 });
 
+// src/whoami-command.ts
+function principalKind(value2, machine) {
+  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
+}
+function credentialKind(value2, machine, scopes) {
+  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
+  if (machine) return "machine";
+  if (scopes.length) return "device";
+  return "unknown";
+}
+function managerOf(value2) {
+  if (!value2 || typeof value2 !== "object") return null;
+  const row = value2;
+  const principalId = text(row.principalId);
+  if (!principalId) return null;
+  return {
+    principalId,
+    displayName: text(row.displayName) ?? "Unnamed member",
+    handle: text(row.handle) ?? ""
+  };
+}
+function unnamedPrincipal(kind) {
+  if (kind === "agent") return "Unnamed agent";
+  if (kind === "service") return "Unnamed service";
+  return "Unnamed member";
+}
+async function fetchIdentity(platformUrl, token, doFetch) {
+  const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
+  const body = await res.json();
+  const developerId = text(body.developerId) ?? "";
+  const machine = body.machine === true;
+  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
+  const principalId = text(body.principalId) ?? developerId;
+  const email = text(body.email);
+  const kind = principalKind(body.principalKind, machine);
+  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
+  const handle = text(body.handle) ?? "";
+  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
+  return {
+    developerId,
+    principalId,
+    principalKind: kind,
+    displayName,
+    handle,
+    manager: managerOf(body.manager),
+    credential: {
+      id: text(credential2.id),
+      kind: credentialKind(credential2.kind, machine, scopes)
+    },
+    email,
+    admin: body.admin === true,
+    machine,
+    scopes
+  };
+}
+function credentialLabel(identity) {
+  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
+  if (identity.credential.kind === "device")
+    return identity.scopes.length ? "device (scoped)" : "device";
+  if (identity.credential.kind === "clerk") return "clerk";
+  return "unknown (legacy server)";
+}
+function namedPrincipal(identity) {
+  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
+}
+function namedManager(manager) {
+  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
+}
+function accountableOwner(identity) {
+  if (identity.principalKind === "agent" && identity.manager) {
+    return namedManager(identity.manager);
+  }
+  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
+    return namedPrincipal(identity);
+  }
+  return identity.email ?? "Unnamed member";
+}
+async function whoamiCommand(parsed, deps = {}) {
+  assertArgs(
+    parsed,
+    ["config", "context", "platform", "token", "email", "json", "open"],
+    1
+  );
+  const out = deps.stdout ?? console;
+  const doFetch = deps.fetch ?? fetch;
+  const { cfg } = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      // As above: never suppress the browser for an ordinary sign-in.
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
+    },
+    doFetch,
+    out
+  );
+  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(identity, null, 2));
+    return;
+  }
+  out.log(`platform:   ${cfg.platformUrl}`);
+  out.log(`principal:  ${namedPrincipal(identity)}`);
+  out.log(`principal id: ${identity.principalId}`);
+  out.log(`kind:       ${identity.principalKind}`);
+  if (identity.principalKind === "agent")
+    out.log(
+      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
+    );
+  out.log(`owner:      ${accountableOwner(identity)}`);
+  out.log(`owner id:   ${identity.developerId}`);
+  out.log(`email:      ${identity.email ?? "(none)"}`);
+  out.log(`credential: ${credentialLabel(identity)}`);
+  if (identity.credential.id)
+    out.log(`credential id: ${identity.credential.id}`);
+  out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
+  if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
+  if (!identity.admin) {
+    if (identity.scopes.includes("platform:runbook:write")) {
+      out.log("\nThis exact scope can read and edit all platform runbook content.");
+      out.log("The device token is not ambient admin and cannot change visibility.");
+    } else {
+      out.log("\nYou can read operator-visible platform runbooks but not edit them.");
+      out.log("Use a platform-admin-approved runbook write request to edit.");
+    }
+  }
+}
+var text;
+var init_whoami_command = __esm({
+  "src/whoami-command.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_argv();
+    init_operator_context();
+    init_token();
+    text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
+  }
+});
+
+// src/auth-command.ts
+async function authCommand(parsed, deps = {}) {
+  assertArgs(parsed, [
+    "config",
+    "context",
+    "platform",
+    "app",
+    "email",
+    "open",
+    "wait",
+    "json"
+  ], 2);
+  const action2 = parsed.positionals[1] ?? "login";
+  if (action2 !== "login") {
+    throw new Error(`unknown auth action "${action2}". Try "odla-ai auth login --app <id> --email <odla-account>".`);
+  }
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true,
+    requireApp: true
+  });
+  const { cfg } = context;
+  const out = deps.stdout ?? console;
+  const doFetch = deps.fetch ?? fetch;
+  const email = stringOpt(parsed.options.email) ?? import_node_process10.default.env.ODLA_USER_EMAIL?.trim();
+  if (!email) {
+    throw new Error(
+      "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
+    );
+  }
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      email,
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      wait: numberOpt(parsed.options.wait, "--wait"),
+      openApprovalUrl: deps.openUrl
+    },
+    doFetch,
+    out,
+    { freshLogin: true }
+  );
+  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify({
+      principalId: identity.principalId,
+      displayName: identity.displayName,
+      handle: identity.handle,
+      email: identity.email,
+      appId: cfg.app.id
+    }, null, 2));
+    return;
+  }
+  const handle = identity.handle ? ` (@${identity.handle})` : "";
+  out.log(`Authorized ${identity.displayName}${handle} for ${cfg.app.id}.`);
+  out.log(`odla account: ${identity.email ?? "not returned"}`);
+}
+var import_node_process10;
+var init_auth_command = __esm({
+  "src/auth-command.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_process10 = __toESM(require("process"), 1);
+    init_argv();
+    init_operator_context();
+    init_token();
+    init_whoami_command();
+  }
+});
+
 // src/tenant.ts
 function resolveEnv(cfg, requested) {
   const env = requested ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
@@ -3035,6 +3260,71 @@ var init_capabilities = __esm({
   }
 });
 
+// src/ai-models.ts
+async function aiModels(options = {}) {
+  const cfg = await loadProjectConfig(options.configPath ?? "odla.config.mjs");
+  const env = options.env ?? cfg.envs[0] ?? "dev";
+  if (!cfg.envs.includes(env)) throw new Error(`ai models env "${env}" is not declared in config envs`);
+  const url = new URL(`/registry/apps/${encodeURIComponent(cfg.app.id)}/public-config`, cfg.platformUrl);
+  url.searchParams.set("env", env);
+  const response2 = await (options.fetch ?? fetch)(url);
+  if (!response2.ok) throw new Error(`read app AI models failed (${response2.status}): ${await safeText4(response2)}`);
+  const body = await response2.json();
+  if (!body.ai) throw new Error(`ai is not configured for ${cfg.app.id}/${env}`);
+  const mode = body.ai.mode === "hosted" ? "hosted" : "byok";
+  const defaultModel = typeof body.ai.model === "string" ? body.ai.model : void 0;
+  let models;
+  if (mode === "hosted") {
+    if (body.ai.enabled !== true) throw new Error(`hosted ai is disabled for ${cfg.app.id}/${env}`);
+    if (!Array.isArray(body.ai.models) || !body.ai.models.every(isModelSpec)) {
+      throw new Error("platform returned an invalid hosted AI model catalog");
+    }
+    models = body.ai.models;
+  } else {
+    const provider = typeof body.ai.provider === "string" ? body.ai.provider : cfg.ai?.provider;
+    if (!provider) throw new Error(`BYOK ai has no provider for ${cfg.app.id}/${env}`);
+    models = Object.values(import_ai.DEFAULT_CATALOG).filter((model) => model.provider === provider);
+  }
+  if (options.provider) models = models.filter((model) => model.provider === options.provider);
+  models.sort((a, b) => a.provider.localeCompare(b.provider) || a.id.localeCompare(b.id));
+  const out = options.stdout ?? console;
+  if (options.json) {
+    out.log(JSON.stringify({ appId: cfg.app.id, env, mode, defaultModel: defaultModel ?? null, models }, null, 2));
+    return;
+  }
+  out.log("provider	model	default	capabilities");
+  for (const model of models) {
+    out.log([model.provider, model.id, model.id === defaultModel ? "yes" : "", capabilityList(model)].join("	"));
+  }
+}
+function capabilityList(model) {
+  return [
+    model.capabilities.imageIn ? "image" : "",
+    model.capabilities.audioIn ? "audio" : "",
+    model.capabilities.documentIn ? "document" : "",
+    model.capabilities.toolUse ? "tools" : "",
+    model.capabilities.thinking || model.capabilities.effort ? "reasoning" : "",
+    model.capabilities.webSearch || model.superpowers?.webSearch ? "web-search" : ""
+  ].filter(Boolean).join(",");
+}
+function isModelSpec(value2) {
+  if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return false;
+  const model = value2;
+  return typeof model.id === "string" && typeof model.nativeId === "string" && (model.provider === "anthropic" || model.provider === "openai" || model.provider === "google") && Boolean(model.capabilities) && typeof model.capabilities === "object";
+}
+async function safeText4(response2) {
+  return (await response2.text().catch(() => "request failed")).slice(0, 300);
+}
+var import_ai;
+var init_ai_models = __esm({
+  "src/ai-models.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_ai = require("@odla-ai/ai");
+    init_config();
+  }
+});
+
 // src/config-operation-error.ts
 var ConfigOperationCommandError;
 var init_config_operation_error = __esm({
@@ -3223,7 +3513,7 @@ var init_config_operation_validate = __esm({
 
 // src/provision-helpers.ts
 function defaultSecretName(provider) {
-  const names = import_ai.DEFAULT_SECRET_NAMES;
+  const names = import_ai2.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
 async function assertTenantAdminAccess(doFetch, cfg, env, token) {
@@ -3233,7 +3523,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   });
   if (res.ok || res.status === 404) return;
   if (res.status === 403) {
-    const detail = await safeText4(res);
+    const detail = await safeText5(res);
     const code = errorCode(detail);
     if (code === "human_session_required") {
       throw new Error(
@@ -3249,7 +3539,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
       `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; run "odla-ai provision --request-grant --email <odla-account>" to open a fresh owner review. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
-  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
 }
 function errorCode(text2) {
   try {
@@ -3265,7 +3555,7 @@ async function postJson(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText5(res)}`);
 }
 function normalizeClerkConfig(value2) {
   if (!value2) return null;
@@ -3278,19 +3568,19 @@ function normalizeClerkConfig(value2) {
   const publishableKey = envValue(cfg.publishableKey);
   return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
 }
-async function safeText4(res) {
+async function safeText5(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
     return "";
   }
 }
-var import_ai, import_apps4;
+var import_ai2, import_apps4;
 var init_provision_helpers = __esm({
   "src/provision-helpers.ts"() {
     "use strict";
     init_cjs_shims();
-    import_ai = require("@odla-ai/ai");
+    import_ai2 = require("@odla-ai/ai");
     import_apps4 = require("@odla-ai/apps");
     init_config();
     init_redact();
@@ -4745,7 +5035,7 @@ async function secretsSet(options) {
     optionalProjectCapabilities: ["app.manage"]
   });
   try {
-    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
+    await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
   } catch (err) {
     throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value2));
   }
@@ -4790,12 +5080,12 @@ async function resolveVaultWrite(options) {
   const value2 = await secretInputValue(options, "secret");
   return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
 }
-var import_ai2, import_apps10, PROD_ENV_NAMES2;
+var import_ai3, import_apps10, PROD_ENV_NAMES2;
 var init_secrets_set = __esm({
   "src/secrets-set.ts"() {
     "use strict";
     init_cjs_shims();
-    import_ai2 = require("@odla-ai/ai");
+    import_ai3 = require("@odla-ai/ai");
     import_apps10 = require("@odla-ai/apps");
     init_config();
     init_redact();
@@ -4852,6 +5142,14 @@ and atomically claim a refined Ready task. Record decisions when you make them
 and file bugs when you notice them. The conventions and the full command set are
 in \`.agents/skills/odla/references/pm.md\`.
 
+Use the human's signed-in odla account email for device authorization; never
+infer it from git config, commit metadata, or GitHub. If authorization is not
+already active, run
+\`npx @odla-ai/cli auth login --app <appId> --email <odla-account>\` and open
+the exact Studio URL it prints. Never file an odla project or product defect in
+GitHub Issues: run \`npx @odla-ai/cli bug report --app <appId> ...\` so the bug
+lands in odla PM with the rest of the project's goals, tasks, and decisions.
+
 The setup runbooks and their references are installed in this repository, pinned
 to this CLI version. Use them as your setup context.
 
@@ -5207,7 +5505,7 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText6(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -5216,7 +5514,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText6(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -5224,7 +5522,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText5(res) {
+async function safeText6(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -5291,6 +5589,20 @@ async function secretsCommand(parsed, deps) {
   });
 }
 async function projectCommand(command, parsed, deps) {
+  if (command === "ai") {
+    const sub = parsed.positionals[1];
+    if (sub !== "models") throw new Error(`unknown ai subcommand "${sub ?? ""}". Try "odla-ai ai models --env dev".`);
+    assertArgs(parsed, ["config", "env", "provider", "json"], 2);
+    await aiModels({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: stringOpt(parsed.options.env),
+      provider: stringOpt(parsed.options.provider),
+      json: parsed.options.json === true,
+      fetch: deps.fetch,
+      stdout: deps.stdout
+    });
+    return true;
+  }
   if (command === "config") {
     const sub = parsed.positionals[1];
     if (sub !== "diff" && sub !== "plan" && sub !== "apply") {
@@ -5413,6 +5725,7 @@ var init_cli_project = __esm({
     init_cjs_shims();
     init_argv();
     init_capabilities();
+    init_ai_models();
     init_config_operation_command();
     init_config_reconcile_command();
     init_doctor();
@@ -9023,7 +9336,7 @@ function developerTokenStatus(context, parsed, now = Date.now()) {
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(import_node_process10.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(import_node_process11.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -9034,12 +9347,12 @@ function clean3(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_process10;
+var import_node_process11;
 var init_operator_credentials = __esm({
   "src/operator-credentials.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process10 = __toESM(require("process"), 1);
+    import_node_process11 = __toESM(require("process"), 1);
     init_argv();
     init_local();
   }
@@ -9205,9 +9518,11 @@ Start here:
                                      step it made wrong.
 
 Usage:
+  odla-ai auth login --app <id> --email <odla-account> [--platform https://odla.ai] [--no-open] [--wait <seconds>] [--json]
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod] [--ai-provider <byok-provider>]
   odla-ai doctor [--config odla.config.mjs]
+  odla-ai ai models [--config odla.config.mjs] [--env dev] [--provider <id>] [--json]
   odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
   odla-ai operations get <operation-id> [--json]
@@ -9240,6 +9555,7 @@ Usage:
   odla-ai pm task release <id> --expected-revision <n> [--mutation-id <id>] [--json]
   odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
   odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
+  odla-ai bug report --app <id> --title <t> (--description <text>|--body <text>) [--severity <s>] [--json]
   odla-ai pm <goal|task|decision|bug> get <id> [--json]
   odla-ai pm <goal|task|decision|bug> ref <id> [--json]
   odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
@@ -9321,6 +9637,9 @@ function printHelp(output = console) {
   output.log(`odla-ai
 ${USAGE_SECTION}
 Commands:
+  auth         Start a fresh, exact-project agent authorization in the browser.
+               The email is the signed-in odla account, never git or GitHub
+               identity. The approval screen confirms the agent name first.
   agent        Inspect durable agent wakeups and explicitly requeue a
                dead-lettered job; JSON output is stable for remote operators.
   runbook      odla's operational procedures, stored in the database and read at
@@ -9388,6 +9707,8 @@ Commands:
                "app". Entities: goal (alias conformance), task (alias kanban),
                decision, bug. Status changes and comments post to each item's
                @odla-ai/chat discussion thread.
+  bug          Intent-first alias for PM bugs. "bug report" writes to
+               odla PM; odla product defects do not belong in GitHub Issues.
   discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
                one group per project, topics with replies, @-mentions of people,
                agents, PM items, and projects. Built for unattended use \u2014 post a
@@ -9445,8 +9766,12 @@ Safety:
   wait for approval, and re-run to collect.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
-  token. The matching account must already exist, be signed in, explicitly
+  token. It is the email shown by the signed-in odla account \u2014 never infer it
+  from git config, a commit author, or GitHub. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
+  Use "auth login --app <id> --email <odla-account>" when an outside agent needs
+  a deliberate fresh request; it ignores cached credentials and opens the same
+  focused authorization sequence used by every first-time command.
   If provision reports that the current agent principal has no live app.manage
   grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
   the local cache, prints and opens a fresh exact-project owner-review URL, then
@@ -9983,7 +10308,8 @@ async function buildContext(parsed, deps) {
       configPath: cfg.configPath,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
-      open: false
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
     },
     doFetch,
     out
@@ -10063,7 +10389,8 @@ var init_discuss_command = __esm({
       "jsonl",
       "mutation-id",
       "platform",
-      "context"
+      "context",
+      "open"
     ];
   }
 });
@@ -10650,7 +10977,13 @@ async function buildContext2(parsed, deps) {
   const out = deps.stdout ?? console;
   const token = await getDeveloperToken(
     cfg,
-    { configPath: cfg.configPath, token: stringOpt(parsed.options.token), email: stringOpt(parsed.options.email), open: false },
+    {
+      configPath: cfg.configPath,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
+    },
     doFetch,
     out
   );
@@ -10748,7 +11081,7 @@ var init_pm_command = __esm({
       decision: "decision",
       bug: "bug"
     };
-    COMMON_OPTIONS = ["config", "token", "email", "json", "platform", "context"];
+    COMMON_OPTIONS = ["config", "token", "email", "json", "platform", "context", "open"];
     ACTION_OPTIONS = {
       list: ["app", "q", "limit", "offset"],
       add: ["app", "title", "mutation-id"],
@@ -11204,7 +11537,8 @@ async function o11yCommand(parsed, deps = {}) {
       "json",
       "app",
       "env",
-      "minutes"
+      "minutes",
+      "open"
     ],
     2
   );
@@ -11231,7 +11565,8 @@ async function o11yCommand(parsed, deps = {}) {
       configPath: cfg.configPath,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
-      open: false
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
     },
     doFetch,
     out
@@ -11468,14 +11803,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText6(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText7(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText6(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText7(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -11491,12 +11826,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText6(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText7(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText6(res) {
+async function safeText7(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -11685,10 +12020,10 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process11.default.env[cfg.ai.keyEnv];
+      const key = import_node_process12.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
-        await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
+        await (0, import_ai4.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
         out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);
       } else {
         out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);
@@ -11724,14 +12059,14 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     }
   }
 }
-var import_apps12, import_ai3, import_node_process11;
+var import_apps12, import_ai4, import_node_process12;
 var init_provision = __esm({
   "src/provision.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps12 = require("@odla-ai/apps");
-    import_ai3 = require("@odla-ai/ai");
-    import_node_process11 = __toESM(require("process"), 1);
+    import_ai4 = require("@odla-ai/ai");
+    import_node_process12 = __toESM(require("process"), 1);
     init_config();
     init_calendar();
     init_calendar_errors();
@@ -11819,6 +12154,7 @@ var init_surface = __esm({
     };
     COMMAND_SURFACE = {
       agent: { jobs: {}, retry: {} },
+      ai: { models: {} },
       admin: {
         ai: {
           show: {},
@@ -11841,7 +12177,9 @@ var init_surface = __esm({
         promote: {},
         owners: { list: {}, add: {}, remove: {} }
       },
+      auth: { login: {} },
       brand: { design: { unpack: {} } },
+      bug: { create: {}, list: {}, report: {} },
       calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
       capabilities: {},
       code: { connect: {} },
@@ -11913,7 +12251,7 @@ var init_surface = __esm({
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process12.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process13.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -11926,13 +12264,13 @@ function recordInvocation(parsed) {
   } catch {
   }
 }
-var import_node_fs17, import_node_process12;
+var import_node_fs17, import_node_process13;
 var init_record = __esm({
   "src/record.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs17 = require("fs");
-    import_node_process12 = __toESM(require("process"), 1);
+    import_node_process13 = __toESM(require("process"), 1);
     init_surface();
   }
 });
@@ -12591,7 +12929,7 @@ var init_runbook_search_command = __esm({
 });
 
 // src/runbook-editor.ts
-function resolveEditor(env = import_node_process13.default.env) {
+function resolveEditor(env = import_node_process14.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -12605,8 +12943,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process13.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process13.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process14.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process14.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -12626,7 +12964,7 @@ function editText(initial, slug, deps = {}) {
     (0, import_node_fs21.rmSync)(dir, { recursive: true, force: true });
   }
 }
-var import_node_child_process8, import_node_fs21, import_node_os5, import_node_path19, import_node_process13, EDITOR_ENV, defaultRunOrInjected;
+var import_node_child_process8, import_node_fs21, import_node_os5, import_node_path19, import_node_process14, EDITOR_ENV, defaultRunOrInjected;
 var init_runbook_editor = __esm({
   "src/runbook-editor.ts"() {
     "use strict";
@@ -12635,7 +12973,7 @@ var init_runbook_editor = __esm({
     import_node_fs21 = require("fs");
     import_node_os5 = require("os");
     import_node_path19 = require("path");
-    import_node_process13 = __toESM(require("process"), 1);
+    import_node_process14 = __toESM(require("process"), 1);
     EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
     defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
   }
@@ -12663,152 +13001,6 @@ var init_runbook_edit_flow = __esm({
   }
 });
 
-// src/whoami-command.ts
-function principalKind(value2, machine) {
-  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
-}
-function credentialKind(value2, machine, scopes) {
-  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
-  if (machine) return "machine";
-  if (scopes.length) return "device";
-  return "unknown";
-}
-function managerOf(value2) {
-  if (!value2 || typeof value2 !== "object") return null;
-  const row = value2;
-  const principalId = text(row.principalId);
-  if (!principalId) return null;
-  return {
-    principalId,
-    displayName: text(row.displayName) ?? "Unnamed member",
-    handle: text(row.handle) ?? ""
-  };
-}
-function unnamedPrincipal(kind) {
-  if (kind === "agent") return "Unnamed agent";
-  if (kind === "service") return "Unnamed service";
-  return "Unnamed member";
-}
-async function fetchIdentity(platformUrl, token, doFetch) {
-  const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
-  const body = await res.json();
-  const developerId = text(body.developerId) ?? "";
-  const machine = body.machine === true;
-  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
-  const principalId = text(body.principalId) ?? developerId;
-  const email = text(body.email);
-  const kind = principalKind(body.principalKind, machine);
-  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
-  const handle = text(body.handle) ?? "";
-  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
-  return {
-    developerId,
-    principalId,
-    principalKind: kind,
-    displayName,
-    handle,
-    manager: managerOf(body.manager),
-    credential: {
-      id: text(credential2.id),
-      kind: credentialKind(credential2.kind, machine, scopes)
-    },
-    email,
-    admin: body.admin === true,
-    machine,
-    scopes
-  };
-}
-function credentialLabel(identity) {
-  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
-  if (identity.credential.kind === "device")
-    return identity.scopes.length ? "device (scoped)" : "device";
-  if (identity.credential.kind === "clerk") return "clerk";
-  return "unknown (legacy server)";
-}
-function namedPrincipal(identity) {
-  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
-}
-function namedManager(manager) {
-  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
-}
-function accountableOwner(identity) {
-  if (identity.principalKind === "agent" && identity.manager) {
-    return namedManager(identity.manager);
-  }
-  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
-    return namedPrincipal(identity);
-  }
-  return identity.email ?? "Unnamed member";
-}
-async function whoamiCommand(parsed, deps = {}) {
-  assertArgs(
-    parsed,
-    ["config", "context", "platform", "token", "email", "json"],
-    1
-  );
-  const out = deps.stdout ?? console;
-  const doFetch = deps.fetch ?? fetch;
-  const { cfg } = await resolveOperatorContext(parsed, {
-    allowMissingConfig: true
-  });
-  const token = await getDeveloperToken(
-    cfg,
-    {
-      configPath: cfg.configPath,
-      token: stringOpt(parsed.options.token),
-      email: stringOpt(parsed.options.email),
-      // As above: never suppress the browser for an ordinary sign-in.
-      open: void 0
-    },
-    doFetch,
-    out
-  );
-  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);
-  if (parsed.options.json === true) {
-    out.log(JSON.stringify(identity, null, 2));
-    return;
-  }
-  out.log(`platform:   ${cfg.platformUrl}`);
-  out.log(`principal:  ${namedPrincipal(identity)}`);
-  out.log(`principal id: ${identity.principalId}`);
-  out.log(`kind:       ${identity.principalKind}`);
-  if (identity.principalKind === "agent")
-    out.log(
-      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
-    );
-  out.log(`owner:      ${accountableOwner(identity)}`);
-  out.log(`owner id:   ${identity.developerId}`);
-  out.log(`email:      ${identity.email ?? "(none)"}`);
-  out.log(`credential: ${credentialLabel(identity)}`);
-  if (identity.credential.id)
-    out.log(`credential id: ${identity.credential.id}`);
-  out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
-  if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
-  if (!identity.admin) {
-    if (identity.scopes.includes("platform:runbook:write")) {
-      out.log("\nThis exact scope can read and edit all platform runbook content.");
-      out.log("The device token is not ambient admin and cannot change visibility.");
-    } else {
-      out.log("\nYou can read operator-visible platform runbooks but not edit them.");
-      out.log("Use a platform-admin-approved runbook write request to edit.");
-    }
-  }
-}
-var text;
-var init_whoami_command = __esm({
-  "src/whoami-command.ts"() {
-    "use strict";
-    init_cjs_shims();
-    init_argv();
-    init_operator_context();
-    init_token();
-    text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
-  }
-});
-
 // src/runbook-command.ts
 function requireSlug(slug, action2) {
   if (!slug) throw new Error(`"runbook ${action2}" needs a slug, e.g. "odla-ai runbook ${action2} release"`);
@@ -13781,6 +13973,10 @@ async function runCli(argv2 = process.argv.slice(2), dependencies = {}) {
     await whoamiCommand(parsed, runtime);
     return;
   }
+  if (command === "auth") {
+    await authCommand(parsed, runtime);
+    return;
+  }
   if (command === "context") {
     await contextCommand(parsed, runtime);
     return;
@@ -13821,6 +14017,15 @@ async function runCli(argv2 = process.argv.slice(2), dependencies = {}) {
     await pmCommand(parsed, runtime);
     return;
   }
+  if (command === "bug") {
+    const action2 = parsed.positionals[1] ?? "list";
+    const canonical = action2 === "report" || action2 === "create" ? "add" : action2;
+    await pmCommand({
+      ...parsed,
+      positionals: ["pm", "bug", canonical, ...parsed.positionals.slice(2)]
+    }, runtime);
+    return;
+  }
   if (command === "discuss") {
     await discussCommand(parsed, runtime);
     return;
@@ -13907,6 +14112,7 @@ var init_cli = __esm({
     "use strict";
     init_cjs_shims();
     init_admin_command();
+    init_auth_command();
     init_agent_command();
     init_app_lifecycle();
     init_brand_command();