@odla-ai/cli 0.27.17 → 0.28.1

package/dist/bin.cjs

@@ -509,7 +509,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
   const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (!grantRequest.forceReview) {
+  if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
     if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
       const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
@@ -526,9 +526,9 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     }
   } else {
     if (options.token) {
-      throw new Error("--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
+      throw new Error(grantRequest.forceReview ? "--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached" : "a fresh authorization cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
     }
-    out.error(`auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"`);
+    out.error(grantRequest.forceReview ? `auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"` : `auth: requesting a fresh agent sign-in for exact project "${cfg.app.id}"`);
   }
   const ctx = {
     cfg,
@@ -541,6 +541,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
+  if (grantRequest.freshLogin) clearPendingHandshake(ctx.pendingFile);
   const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
   writePrivateJson(cfg.local.tokenFile, {
@@ -598,11 +599,12 @@ async function resumePendingHandshake(ctx, waitMs) {
 async function freshHandshake(ctx, waitMs) {
   let started;
   let stopReminder;
+  const provisioning = ctx.grantIntent.optionalProjectCapabilities.includes("app.manage");
   try {
     return await (0, import_db.requestToken)({
       endpoint: ctx.cfg.platformUrl,
       email: ctx.email,
-      label: `${ctx.cfg.app.id} provisioner`,
+      label: `${ctx.cfg.app.id} ${provisioning ? "provisioner" : "agent"}`,
       agentHandle: projectAgentHandle(ctx.cfg.app.id),
       projectIds: [ctx.cfg.app.id],
       optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities,
@@ -663,8 +665,15 @@ function stillPending(pending, email) {
 }
 function handshakeEmail(value2, cached) {
   const email = (value2 ?? import_node_process4.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  if (/@users\.noreply\.github\.com$/i.test(email)) {
+    throw new Error(
+      `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
+    );
+  }
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
-    throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
+    throw new Error(
+      "a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL; use the signed-in email shown in odla Studio, not git or GitHub identity"
+    );
   }
   return email;
 }
@@ -1958,6 +1967,223 @@ var init_admin_command = __esm({
   }
 });
 
+// src/whoami-command.ts
+function principalKind(value2, machine) {
+  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
+}
+function credentialKind(value2, machine, scopes) {
+  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
+  if (machine) return "machine";
+  if (scopes.length) return "device";
+  return "unknown";
+}
+function managerOf(value2) {
+  if (!value2 || typeof value2 !== "object") return null;
+  const row = value2;
+  const principalId = text(row.principalId);
+  if (!principalId) return null;
+  return {
+    principalId,
+    displayName: text(row.displayName) ?? "Unnamed member",
+    handle: text(row.handle) ?? ""
+  };
+}
+function unnamedPrincipal(kind) {
+  if (kind === "agent") return "Unnamed agent";
+  if (kind === "service") return "Unnamed service";
+  return "Unnamed member";
+}
+async function fetchIdentity(platformUrl, token, doFetch) {
+  const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
+  const body = await res.json();
+  const developerId = text(body.developerId) ?? "";
+  const machine = body.machine === true;
+  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
+  const principalId = text(body.principalId) ?? developerId;
+  const email = text(body.email);
+  const kind = principalKind(body.principalKind, machine);
+  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
+  const handle = text(body.handle) ?? "";
+  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
+  return {
+    developerId,
+    principalId,
+    principalKind: kind,
+    displayName,
+    handle,
+    manager: managerOf(body.manager),
+    credential: {
+      id: text(credential2.id),
+      kind: credentialKind(credential2.kind, machine, scopes)
+    },
+    email,
+    admin: body.admin === true,
+    machine,
+    scopes
+  };
+}
+function credentialLabel(identity) {
+  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
+  if (identity.credential.kind === "device")
+    return identity.scopes.length ? "device (scoped)" : "device";
+  if (identity.credential.kind === "clerk") return "clerk";
+  return "unknown (legacy server)";
+}
+function namedPrincipal(identity) {
+  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
+}
+function namedManager(manager) {
+  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
+}
+function accountableOwner(identity) {
+  if (identity.principalKind === "agent" && identity.manager) {
+    return namedManager(identity.manager);
+  }
+  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
+    return namedPrincipal(identity);
+  }
+  return identity.email ?? "Unnamed member";
+}
+async function whoamiCommand(parsed, deps = {}) {
+  assertArgs(
+    parsed,
+    ["config", "context", "platform", "token", "email", "json", "open"],
+    1
+  );
+  const out = deps.stdout ?? console;
+  const doFetch = deps.fetch ?? fetch;
+  const { cfg } = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      // As above: never suppress the browser for an ordinary sign-in.
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
+    },
+    doFetch,
+    out
+  );
+  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(identity, null, 2));
+    return;
+  }
+  out.log(`platform:   ${cfg.platformUrl}`);
+  out.log(`principal:  ${namedPrincipal(identity)}`);
+  out.log(`principal id: ${identity.principalId}`);
+  out.log(`kind:       ${identity.principalKind}`);
+  if (identity.principalKind === "agent")
+    out.log(
+      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
+    );
+  out.log(`owner:      ${accountableOwner(identity)}`);
+  out.log(`owner id:   ${identity.developerId}`);
+  out.log(`email:      ${identity.email ?? "(none)"}`);
+  out.log(`credential: ${credentialLabel(identity)}`);
+  if (identity.credential.id)
+    out.log(`credential id: ${identity.credential.id}`);
+  out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
+  if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
+  if (!identity.admin) {
+    if (identity.scopes.includes("platform:runbook:write")) {
+      out.log("\nThis exact scope can read and edit all platform runbook content.");
+      out.log("The device token is not ambient admin and cannot change visibility.");
+    } else {
+      out.log("\nYou can read operator-visible platform runbooks but not edit them.");
+      out.log("Use a platform-admin-approved runbook write request to edit.");
+    }
+  }
+}
+var text;
+var init_whoami_command = __esm({
+  "src/whoami-command.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_argv();
+    init_operator_context();
+    init_token();
+    text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
+  }
+});
+
+// src/auth-command.ts
+async function authCommand(parsed, deps = {}) {
+  assertArgs(parsed, [
+    "config",
+    "context",
+    "platform",
+    "app",
+    "email",
+    "open",
+    "wait",
+    "json"
+  ], 2);
+  const action2 = parsed.positionals[1] ?? "login";
+  if (action2 !== "login") {
+    throw new Error(`unknown auth action "${action2}". Try "odla-ai auth login --app <id> --email <odla-account>".`);
+  }
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true,
+    requireApp: true
+  });
+  const { cfg } = context;
+  const out = deps.stdout ?? console;
+  const doFetch = deps.fetch ?? fetch;
+  const email = stringOpt(parsed.options.email) ?? import_node_process10.default.env.ODLA_USER_EMAIL?.trim();
+  if (!email) {
+    throw new Error(
+      "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
+    );
+  }
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      email,
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      wait: numberOpt(parsed.options.wait, "--wait"),
+      openApprovalUrl: deps.openUrl
+    },
+    doFetch,
+    out,
+    { freshLogin: true }
+  );
+  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify({
+      principalId: identity.principalId,
+      displayName: identity.displayName,
+      handle: identity.handle,
+      email: identity.email,
+      appId: cfg.app.id
+    }, null, 2));
+    return;
+  }
+  const handle = identity.handle ? ` (@${identity.handle})` : "";
+  out.log(`Authorized ${identity.displayName}${handle} for ${cfg.app.id}.`);
+  out.log(`odla account: ${identity.email ?? "not returned"}`);
+}
+var import_node_process10;
+var init_auth_command = __esm({
+  "src/auth-command.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_process10 = __toESM(require("process"), 1);
+    init_argv();
+    init_operator_context();
+    init_token();
+    init_whoami_command();
+  }
+});
+
 // src/tenant.ts
 function resolveEnv(cfg, requested) {
   const env = requested ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
@@ -4917,6 +5143,14 @@ and atomically claim a refined Ready task. Record decisions when you make them
 and file bugs when you notice them. The conventions and the full command set are
 in \`.agents/skills/odla/references/pm.md\`.
 
+Use the human's signed-in odla account email for device authorization; never
+infer it from git config, commit metadata, or GitHub. If authorization is not
+already active, run
+\`npx @odla-ai/cli auth login --app <appId> --email <odla-account>\` and open
+the exact Studio URL it prints. Never file an odla project or product defect in
+GitHub Issues: run \`npx @odla-ai/cli bug report --app <appId> ...\` so the bug
+lands in odla PM with the rest of the project's goals, tasks, and decisions.
+
 The setup runbooks and their references are installed in this repository, pinned
 to this CLI version. Use them as your setup context.
 
@@ -9103,7 +9337,7 @@ function developerTokenStatus(context, parsed, now = Date.now()) {
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(import_node_process10.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(import_node_process11.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -9114,12 +9348,12 @@ function clean3(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_process10;
+var import_node_process11;
 var init_operator_credentials = __esm({
   "src/operator-credentials.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process10 = __toESM(require("process"), 1);
+    import_node_process11 = __toESM(require("process"), 1);
     init_argv();
     init_local();
   }
@@ -9285,6 +9519,7 @@ Start here:
                                      step it made wrong.
 
 Usage:
+  odla-ai auth login --app <id> --email <odla-account> [--platform https://odla.ai] [--no-open] [--wait <seconds>] [--json]
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod] [--ai-provider <byok-provider>]
   odla-ai doctor [--config odla.config.mjs]
@@ -9321,6 +9556,7 @@ Usage:
   odla-ai pm task release <id> --expected-revision <n> [--mutation-id <id>] [--json]
   odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
   odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
+  odla-ai bug report --app <id> --title <t> (--description <text>|--body <text>) [--severity <s>] [--json]
   odla-ai pm <goal|task|decision|bug> get <id> [--json]
   odla-ai pm <goal|task|decision|bug> ref <id> [--json]
   odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
@@ -9402,6 +9638,9 @@ function printHelp(output = console) {
   output.log(`odla-ai
 ${USAGE_SECTION}
 Commands:
+  auth         Start a fresh, exact-project agent authorization in the browser.
+               The email is the signed-in odla account, never git or GitHub
+               identity. The approval screen confirms the agent name first.
   agent        Inspect durable agent wakeups and explicitly requeue a
                dead-lettered job; JSON output is stable for remote operators.
   runbook      odla's operational procedures, stored in the database and read at
@@ -9469,6 +9708,8 @@ Commands:
                "app". Entities: goal (alias conformance), task (alias kanban),
                decision, bug. Status changes and comments post to each item's
                @odla-ai/chat discussion thread.
+  bug          Intent-first alias for PM bugs. "bug report" writes to
+               odla PM; odla product defects do not belong in GitHub Issues.
   discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
                one group per project, topics with replies, @-mentions of people,
                agents, PM items, and projects. Built for unattended use \u2014 post a
@@ -9526,8 +9767,12 @@ Safety:
   wait for approval, and re-run to collect.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
-  token. The matching account must already exist, be signed in, explicitly
+  token. It is the email shown by the signed-in odla account \u2014 never infer it
+  from git config, a commit author, or GitHub. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
+  Use "auth login --app <id> --email <odla-account>" when an outside agent needs
+  a deliberate fresh request; it ignores cached credentials and opens the same
+  focused authorization sequence used by every first-time command.
   If provision reports that the current agent principal has no live app.manage
   grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
   the local cache, prints and opens a fresh exact-project owner-review URL, then
@@ -10064,7 +10309,8 @@ async function buildContext(parsed, deps) {
       configPath: cfg.configPath,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
-      open: false
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
     },
     doFetch,
     out
@@ -10144,7 +10390,8 @@ var init_discuss_command = __esm({
       "jsonl",
       "mutation-id",
       "platform",
-      "context"
+      "context",
+      "open"
     ];
   }
 });
@@ -10731,7 +10978,13 @@ async function buildContext2(parsed, deps) {
   const out = deps.stdout ?? console;
   const token = await getDeveloperToken(
     cfg,
-    { configPath: cfg.configPath, token: stringOpt(parsed.options.token), email: stringOpt(parsed.options.email), open: false },
+    {
+      configPath: cfg.configPath,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
+    },
     doFetch,
     out
   );
@@ -10829,7 +11082,7 @@ var init_pm_command = __esm({
       decision: "decision",
       bug: "bug"
     };
-    COMMON_OPTIONS = ["config", "token", "email", "json", "platform", "context"];
+    COMMON_OPTIONS = ["config", "token", "email", "json", "platform", "context", "open"];
     ACTION_OPTIONS = {
       list: ["app", "q", "limit", "offset"],
       add: ["app", "title", "mutation-id"],
@@ -11285,7 +11538,8 @@ async function o11yCommand(parsed, deps = {}) {
       "json",
       "app",
       "env",
-      "minutes"
+      "minutes",
+      "open"
     ],
     2
   );
@@ -11312,7 +11566,8 @@ async function o11yCommand(parsed, deps = {}) {
       configPath: cfg.configPath,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
-      open: false
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
     },
     doFetch,
     out
@@ -11766,7 +12021,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process11.default.env[cfg.ai.keyEnv];
+      const key = import_node_process12.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai4.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -11805,14 +12060,14 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     }
   }
 }
-var import_apps12, import_ai4, import_node_process11;
+var import_apps12, import_ai4, import_node_process12;
 var init_provision = __esm({
   "src/provision.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps12 = require("@odla-ai/apps");
     import_ai4 = require("@odla-ai/ai");
-    import_node_process11 = __toESM(require("process"), 1);
+    import_node_process12 = __toESM(require("process"), 1);
     init_config();
     init_calendar();
     init_calendar_errors();
@@ -11923,7 +12178,9 @@ var init_surface = __esm({
         promote: {},
         owners: { list: {}, add: {}, remove: {} }
       },
+      auth: { login: {} },
       brand: { design: { unpack: {} } },
+      bug: { create: {}, list: {}, report: {} },
       calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
       capabilities: {},
       code: { connect: {} },
@@ -11995,7 +12252,7 @@ var init_surface = __esm({
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process12.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process13.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -12008,13 +12265,13 @@ function recordInvocation(parsed) {
   } catch {
   }
 }
-var import_node_fs17, import_node_process12;
+var import_node_fs17, import_node_process13;
 var init_record = __esm({
   "src/record.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs17 = require("fs");
-    import_node_process12 = __toESM(require("process"), 1);
+    import_node_process13 = __toESM(require("process"), 1);
     init_surface();
   }
 });
@@ -12673,7 +12930,7 @@ var init_runbook_search_command = __esm({
 });
 
 // src/runbook-editor.ts
-function resolveEditor(env = import_node_process13.default.env) {
+function resolveEditor(env = import_node_process14.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -12687,8 +12944,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process13.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process13.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process14.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process14.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -12708,7 +12965,7 @@ function editText(initial, slug, deps = {}) {
     (0, import_node_fs21.rmSync)(dir, { recursive: true, force: true });
   }
 }
-var import_node_child_process8, import_node_fs21, import_node_os5, import_node_path19, import_node_process13, EDITOR_ENV, defaultRunOrInjected;
+var import_node_child_process8, import_node_fs21, import_node_os5, import_node_path19, import_node_process14, EDITOR_ENV, defaultRunOrInjected;
 var init_runbook_editor = __esm({
   "src/runbook-editor.ts"() {
     "use strict";
@@ -12717,7 +12974,7 @@ var init_runbook_editor = __esm({
     import_node_fs21 = require("fs");
     import_node_os5 = require("os");
     import_node_path19 = require("path");
-    import_node_process13 = __toESM(require("process"), 1);
+    import_node_process14 = __toESM(require("process"), 1);
     EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
     defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
   }
@@ -12745,152 +13002,6 @@ var init_runbook_edit_flow = __esm({
   }
 });
 
-// src/whoami-command.ts
-function principalKind(value2, machine) {
-  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
-}
-function credentialKind(value2, machine, scopes) {
-  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
-  if (machine) return "machine";
-  if (scopes.length) return "device";
-  return "unknown";
-}
-function managerOf(value2) {
-  if (!value2 || typeof value2 !== "object") return null;
-  const row = value2;
-  const principalId = text(row.principalId);
-  if (!principalId) return null;
-  return {
-    principalId,
-    displayName: text(row.displayName) ?? "Unnamed member",
-    handle: text(row.handle) ?? ""
-  };
-}
-function unnamedPrincipal(kind) {
-  if (kind === "agent") return "Unnamed agent";
-  if (kind === "service") return "Unnamed service";
-  return "Unnamed member";
-}
-async function fetchIdentity(platformUrl, token, doFetch) {
-  const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
-  const body = await res.json();
-  const developerId = text(body.developerId) ?? "";
-  const machine = body.machine === true;
-  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
-  const principalId = text(body.principalId) ?? developerId;
-  const email = text(body.email);
-  const kind = principalKind(body.principalKind, machine);
-  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
-  const handle = text(body.handle) ?? "";
-  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
-  return {
-    developerId,
-    principalId,
-    principalKind: kind,
-    displayName,
-    handle,
-    manager: managerOf(body.manager),
-    credential: {
-      id: text(credential2.id),
-      kind: credentialKind(credential2.kind, machine, scopes)
-    },
-    email,
-    admin: body.admin === true,
-    machine,
-    scopes
-  };
-}
-function credentialLabel(identity) {
-  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
-  if (identity.credential.kind === "device")
-    return identity.scopes.length ? "device (scoped)" : "device";
-  if (identity.credential.kind === "clerk") return "clerk";
-  return "unknown (legacy server)";
-}
-function namedPrincipal(identity) {
-  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
-}
-function namedManager(manager) {
-  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
-}
-function accountableOwner(identity) {
-  if (identity.principalKind === "agent" && identity.manager) {
-    return namedManager(identity.manager);
-  }
-  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
-    return namedPrincipal(identity);
-  }
-  return identity.email ?? "Unnamed member";
-}
-async function whoamiCommand(parsed, deps = {}) {
-  assertArgs(
-    parsed,
-    ["config", "context", "platform", "token", "email", "json"],
-    1
-  );
-  const out = deps.stdout ?? console;
-  const doFetch = deps.fetch ?? fetch;
-  const { cfg } = await resolveOperatorContext(parsed, {
-    allowMissingConfig: true
-  });
-  const token = await getDeveloperToken(
-    cfg,
-    {
-      configPath: cfg.configPath,
-      token: stringOpt(parsed.options.token),
-      email: stringOpt(parsed.options.email),
-      // As above: never suppress the browser for an ordinary sign-in.
-      open: void 0
-    },
-    doFetch,
-    out
-  );
-  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);
-  if (parsed.options.json === true) {
-    out.log(JSON.stringify(identity, null, 2));
-    return;
-  }
-  out.log(`platform:   ${cfg.platformUrl}`);
-  out.log(`principal:  ${namedPrincipal(identity)}`);
-  out.log(`principal id: ${identity.principalId}`);
-  out.log(`kind:       ${identity.principalKind}`);
-  if (identity.principalKind === "agent")
-    out.log(
-      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
-    );
-  out.log(`owner:      ${accountableOwner(identity)}`);
-  out.log(`owner id:   ${identity.developerId}`);
-  out.log(`email:      ${identity.email ?? "(none)"}`);
-  out.log(`credential: ${credentialLabel(identity)}`);
-  if (identity.credential.id)
-    out.log(`credential id: ${identity.credential.id}`);
-  out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
-  if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
-  if (!identity.admin) {
-    if (identity.scopes.includes("platform:runbook:write")) {
-      out.log("\nThis exact scope can read and edit all platform runbook content.");
-      out.log("The device token is not ambient admin and cannot change visibility.");
-    } else {
-      out.log("\nYou can read operator-visible platform runbooks but not edit them.");
-      out.log("Use a platform-admin-approved runbook write request to edit.");
-    }
-  }
-}
-var text;
-var init_whoami_command = __esm({
-  "src/whoami-command.ts"() {
-    "use strict";
-    init_cjs_shims();
-    init_argv();
-    init_operator_context();
-    init_token();
-    text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
-  }
-});
-
 // src/runbook-command.ts
 function requireSlug(slug, action2) {
   if (!slug) throw new Error(`"runbook ${action2}" needs a slug, e.g. "odla-ai runbook ${action2} release"`);
@@ -13863,6 +13974,10 @@ async function runCli(argv2 = process.argv.slice(2), dependencies = {}) {
     await whoamiCommand(parsed, runtime);
     return;
   }
+  if (command === "auth") {
+    await authCommand(parsed, runtime);
+    return;
+  }
   if (command === "context") {
     await contextCommand(parsed, runtime);
     return;
@@ -13903,6 +14018,15 @@ async function runCli(argv2 = process.argv.slice(2), dependencies = {}) {
     await pmCommand(parsed, runtime);
     return;
   }
+  if (command === "bug") {
+    const action2 = parsed.positionals[1] ?? "list";
+    const canonical = action2 === "report" || action2 === "create" ? "add" : action2;
+    await pmCommand({
+      ...parsed,
+      positionals: ["pm", "bug", canonical, ...parsed.positionals.slice(2)]
+    }, runtime);
+    return;
+  }
   if (command === "discuss") {
     await discussCommand(parsed, runtime);
     return;
@@ -13989,6 +14113,7 @@ var init_cli = __esm({
     "use strict";
     init_cjs_shims();
     init_admin_command();
+    init_auth_command();
     init_agent_command();
     init_app_lifecycle();
     init_brand_command();