@odla-ai/cli 0.27.17 → 0.28.1

package/dist/{cli-DCSVQAZ6.js → cli-2WZIFXA6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-3WVVHH3Y.js";
+} from "./chunk-STJCWZJU.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-DCSVQAZ6.js.map
+//# sourceMappingURL=cli-2WZIFXA6.js.map

package/dist/index.cjs

@@ -391,7 +391,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
   const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (!grantRequest.forceReview) {
+  if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
     if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
       const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
@@ -408,9 +408,9 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     }
   } else {
     if (options.token) {
-      throw new Error("--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
+      throw new Error(grantRequest.forceReview ? "--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached" : "a fresh authorization cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
     }
-    out.error(`auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"`);
+    out.error(grantRequest.forceReview ? `auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"` : `auth: requesting a fresh agent sign-in for exact project "${cfg.app.id}"`);
   }
   const ctx = {
     cfg,
@@ -423,6 +423,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
+  if (grantRequest.freshLogin) clearPendingHandshake(ctx.pendingFile);
   const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
   writePrivateJson(cfg.local.tokenFile, {
@@ -480,11 +481,12 @@ async function resumePendingHandshake(ctx, waitMs) {
 async function freshHandshake(ctx, waitMs) {
   let started;
   let stopReminder;
+  const provisioning = ctx.grantIntent.optionalProjectCapabilities.includes("app.manage");
   try {
     return await (0, import_db.requestToken)({
       endpoint: ctx.cfg.platformUrl,
       email: ctx.email,
-      label: `${ctx.cfg.app.id} provisioner`,
+      label: `${ctx.cfg.app.id} ${provisioning ? "provisioner" : "agent"}`,
       agentHandle: projectAgentHandle(ctx.cfg.app.id),
       projectIds: [ctx.cfg.app.id],
       optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities,
@@ -545,8 +547,15 @@ function stillPending(pending, email) {
 }
 function handshakeEmail(value2, cached) {
   const email = (value2 ?? import_node_process4.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  if (/@users\.noreply\.github\.com$/i.test(email)) {
+    throw new Error(
+      `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
+    );
+  }
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
-    throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
+    throw new Error(
+      "a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL; use the signed-in email shown in odla Studio, not git or GitHub identity"
+    );
   }
   return email;
 }
@@ -1714,6 +1723,204 @@ async function adminCommand(parsed, deps = {}) {
   });
 }
 
+// src/auth-command.ts
+var import_node_process10 = __toESM(require("process"), 1);
+
+// src/whoami-command.ts
+var text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
+function principalKind(value2, machine) {
+  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
+}
+function credentialKind(value2, machine, scopes) {
+  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
+  if (machine) return "machine";
+  if (scopes.length) return "device";
+  return "unknown";
+}
+function managerOf(value2) {
+  if (!value2 || typeof value2 !== "object") return null;
+  const row = value2;
+  const principalId = text(row.principalId);
+  if (!principalId) return null;
+  return {
+    principalId,
+    displayName: text(row.displayName) ?? "Unnamed member",
+    handle: text(row.handle) ?? ""
+  };
+}
+function unnamedPrincipal(kind) {
+  if (kind === "agent") return "Unnamed agent";
+  if (kind === "service") return "Unnamed service";
+  return "Unnamed member";
+}
+async function fetchIdentity(platformUrl, token, doFetch) {
+  const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
+  const body = await res.json();
+  const developerId = text(body.developerId) ?? "";
+  const machine = body.machine === true;
+  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
+  const principalId = text(body.principalId) ?? developerId;
+  const email = text(body.email);
+  const kind = principalKind(body.principalKind, machine);
+  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
+  const handle = text(body.handle) ?? "";
+  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
+  return {
+    developerId,
+    principalId,
+    principalKind: kind,
+    displayName,
+    handle,
+    manager: managerOf(body.manager),
+    credential: {
+      id: text(credential2.id),
+      kind: credentialKind(credential2.kind, machine, scopes)
+    },
+    email,
+    admin: body.admin === true,
+    machine,
+    scopes
+  };
+}
+function credentialLabel(identity) {
+  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
+  if (identity.credential.kind === "device")
+    return identity.scopes.length ? "device (scoped)" : "device";
+  if (identity.credential.kind === "clerk") return "clerk";
+  return "unknown (legacy server)";
+}
+function namedPrincipal(identity) {
+  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
+}
+function namedManager(manager) {
+  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
+}
+function accountableOwner(identity) {
+  if (identity.principalKind === "agent" && identity.manager) {
+    return namedManager(identity.manager);
+  }
+  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
+    return namedPrincipal(identity);
+  }
+  return identity.email ?? "Unnamed member";
+}
+async function whoamiCommand(parsed, deps = {}) {
+  assertArgs(
+    parsed,
+    ["config", "context", "platform", "token", "email", "json", "open"],
+    1
+  );
+  const out = deps.stdout ?? console;
+  const doFetch = deps.fetch ?? fetch;
+  const { cfg } = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      // As above: never suppress the browser for an ordinary sign-in.
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
+    },
+    doFetch,
+    out
+  );
+  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(identity, null, 2));
+    return;
+  }
+  out.log(`platform:   ${cfg.platformUrl}`);
+  out.log(`principal:  ${namedPrincipal(identity)}`);
+  out.log(`principal id: ${identity.principalId}`);
+  out.log(`kind:       ${identity.principalKind}`);
+  if (identity.principalKind === "agent")
+    out.log(
+      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
+    );
+  out.log(`owner:      ${accountableOwner(identity)}`);
+  out.log(`owner id:   ${identity.developerId}`);
+  out.log(`email:      ${identity.email ?? "(none)"}`);
+  out.log(`credential: ${credentialLabel(identity)}`);
+  if (identity.credential.id)
+    out.log(`credential id: ${identity.credential.id}`);
+  out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
+  if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
+  if (!identity.admin) {
+    if (identity.scopes.includes("platform:runbook:write")) {
+      out.log("\nThis exact scope can read and edit all platform runbook content.");
+      out.log("The device token is not ambient admin and cannot change visibility.");
+    } else {
+      out.log("\nYou can read operator-visible platform runbooks but not edit them.");
+      out.log("Use a platform-admin-approved runbook write request to edit.");
+    }
+  }
+}
+
+// src/auth-command.ts
+async function authCommand(parsed, deps = {}) {
+  assertArgs(parsed, [
+    "config",
+    "context",
+    "platform",
+    "app",
+    "email",
+    "open",
+    "wait",
+    "json"
+  ], 2);
+  const action2 = parsed.positionals[1] ?? "login";
+  if (action2 !== "login") {
+    throw new Error(`unknown auth action "${action2}". Try "odla-ai auth login --app <id> --email <odla-account>".`);
+  }
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true,
+    requireApp: true
+  });
+  const { cfg } = context;
+  const out = deps.stdout ?? console;
+  const doFetch = deps.fetch ?? fetch;
+  const email = stringOpt(parsed.options.email) ?? import_node_process10.default.env.ODLA_USER_EMAIL?.trim();
+  if (!email) {
+    throw new Error(
+      "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
+    );
+  }
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      email,
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      wait: numberOpt(parsed.options.wait, "--wait"),
+      openApprovalUrl: deps.openUrl
+    },
+    doFetch,
+    out,
+    { freshLogin: true }
+  );
+  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify({
+      principalId: identity.principalId,
+      displayName: identity.displayName,
+      handle: identity.handle,
+      email: identity.email,
+      appId: cfg.app.id
+    }, null, 2));
+    return;
+  }
+  const handle = identity.handle ? ` (@${identity.handle})` : "";
+  out.log(`Authorized ${identity.displayName}${handle} for ${cfg.app.id}.`);
+  out.log(`odla account: ${identity.email ?? "not returned"}`);
+}
+
 // src/tenant.ts
 var import_apps2 = require("@odla-ai/apps");
 function resolveEnv(cfg, requested) {
@@ -4402,6 +4609,14 @@ and atomically claim a refined Ready task. Record decisions when you make them
 and file bugs when you notice them. The conventions and the full command set are
 in \`.agents/skills/odla/references/pm.md\`.
 
+Use the human's signed-in odla account email for device authorization; never
+infer it from git config, commit metadata, or GitHub. If authorization is not
+already active, run
+\`npx @odla-ai/cli auth login --app <appId> --email <odla-account>\` and open
+the exact Studio URL it prints. Never file an odla project or product defect in
+GitHub Issues: run \`npx @odla-ai/cli bug report --app <appId> ...\` so the bug
+lands in odla PM with the rest of the project's goals, tasks, and decisions.
+
 The setup runbooks and their references are installed in this repository, pinned
 to this CLI version. Use them as your setup context.
 
@@ -8467,13 +8682,13 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-var import_node_process10 = __toESM(require("process"), 1);
+var import_node_process11 = __toESM(require("process"), 1);
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(import_node_process10.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(import_node_process11.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -8630,6 +8845,7 @@ Start here:
                                      step it made wrong.
 
 Usage:
+  odla-ai auth login --app <id> --email <odla-account> [--platform https://odla.ai] [--no-open] [--wait <seconds>] [--json]
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod] [--ai-provider <byok-provider>]
   odla-ai doctor [--config odla.config.mjs]
@@ -8666,6 +8882,7 @@ Usage:
   odla-ai pm task release <id> --expected-revision <n> [--mutation-id <id>] [--json]
   odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
   odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
+  odla-ai bug report --app <id> --title <t> (--description <text>|--body <text>) [--severity <s>] [--json]
   odla-ai pm <goal|task|decision|bug> get <id> [--json]
   odla-ai pm <goal|task|decision|bug> ref <id> [--json]
   odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
@@ -8745,6 +8962,9 @@ function printHelp(output = console) {
   output.log(`odla-ai
 ${USAGE_SECTION}
 Commands:
+  auth         Start a fresh, exact-project agent authorization in the browser.
+               The email is the signed-in odla account, never git or GitHub
+               identity. The approval screen confirms the agent name first.
   agent        Inspect durable agent wakeups and explicitly requeue a
                dead-lettered job; JSON output is stable for remote operators.
   runbook      odla's operational procedures, stored in the database and read at
@@ -8812,6 +9032,8 @@ Commands:
                "app". Entities: goal (alias conformance), task (alias kanban),
                decision, bug. Status changes and comments post to each item's
                @odla-ai/chat discussion thread.
+  bug          Intent-first alias for PM bugs. "bug report" writes to
+               odla PM; odla product defects do not belong in GitHub Issues.
   discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
                one group per project, topics with replies, @-mentions of people,
                agents, PM items, and projects. Built for unattended use \u2014 post a
@@ -8869,8 +9091,12 @@ Safety:
   wait for approval, and re-run to collect.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
-  token. The matching account must already exist, be signed in, explicitly
+  token. It is the email shown by the signed-in odla account \u2014 never infer it
+  from git config, a commit author, or GitHub. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
+  Use "auth login --app <id> --email <odla-account>" when an outside agent needs
+  a deliberate fresh request; it ignores cached credentials and opens the same
+  focused authorization sequence used by every first-time command.
   If provision reports that the current agent principal has no live app.manage
   grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
   the local cache, prints and opens a fresh exact-project owner-review URL, then
@@ -9364,7 +9590,8 @@ var ALLOWED = [
   "jsonl",
   "mutation-id",
   "platform",
-  "context"
+  "context",
+  "open"
 ];
 function requireId(id, action2) {
   if (!id) throw new Error(`"discuss ${action2}" needs a topic id`);
@@ -9383,7 +9610,8 @@ async function buildContext(parsed, deps) {
       configPath: cfg.configPath,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
-      open: false
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
     },
     doFetch,
     out
@@ -9958,7 +10186,7 @@ var ALIASES = {
   decision: "decision",
   bug: "bug"
 };
-var COMMON_OPTIONS = ["config", "token", "email", "json", "platform", "context"];
+var COMMON_OPTIONS = ["config", "token", "email", "json", "platform", "context", "open"];
 var ACTION_OPTIONS = {
   list: ["app", "q", "limit", "offset"],
   add: ["app", "title", "mutation-id"],
@@ -10022,7 +10250,13 @@ async function buildContext2(parsed, deps) {
   const out = deps.stdout ?? console;
   const token = await getDeveloperToken(
     cfg,
-    { configPath: cfg.configPath, token: stringOpt(parsed.options.token), email: stringOpt(parsed.options.email), open: false },
+    {
+      configPath: cfg.configPath,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
+    },
     doFetch,
     out
   );
@@ -10486,7 +10720,8 @@ async function o11yCommand(parsed, deps = {}) {
       "json",
       "app",
       "env",
-      "minutes"
+      "minutes",
+      "open"
     ],
     2
   );
@@ -10513,7 +10748,8 @@ async function o11yCommand(parsed, deps = {}) {
       configPath: cfg.configPath,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
-      open: false
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: deps.openUrl
     },
     doFetch,
     out
@@ -10624,7 +10860,7 @@ async function read2(url, headers, doFetch) {
 // src/provision.ts
 var import_apps12 = require("@odla-ai/apps");
 var import_ai4 = require("@odla-ai/ai");
-var import_node_process11 = __toESM(require("process"), 1);
+var import_node_process12 = __toESM(require("process"), 1);
 
 // src/integration-provision.ts
 var import_db3 = require("@odla-ai/db");
@@ -10944,7 +11180,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process11.default.env[cfg.ai.keyEnv];
+      const key = import_node_process12.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai4.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -10986,7 +11222,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
 
 // src/record.ts
 var import_node_fs15 = require("fs");
-var import_node_process12 = __toESM(require("process"), 1);
+var import_node_process13 = __toESM(require("process"), 1);
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -11043,7 +11279,9 @@ var COMMAND_SURFACE = {
     promote: {},
     owners: { list: {}, add: {}, remove: {} }
   },
+  auth: { login: {} },
   brand: { design: { unpack: {} } },
+  bug: { create: {}, list: {}, report: {} },
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
@@ -11158,7 +11396,7 @@ function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process12.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process13.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -11830,9 +12068,9 @@ var import_node_child_process8 = require("child_process");
 var import_node_fs19 = require("fs");
 var import_node_os5 = require("os");
 var import_node_path18 = require("path");
-var import_node_process13 = __toESM(require("process"), 1);
+var import_node_process14 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = import_node_process13.default.env) {
+function resolveEditor(env = import_node_process14.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -11846,8 +12084,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process13.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process13.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process14.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process14.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -11883,142 +12121,6 @@ async function editRunbook(ctx, slug, deps = {}) {
   return body === null ? null : { body, expectedVersion: found.version };
 }
 
-// src/whoami-command.ts
-var text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
-function principalKind(value2, machine) {
-  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
-}
-function credentialKind(value2, machine, scopes) {
-  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
-  if (machine) return "machine";
-  if (scopes.length) return "device";
-  return "unknown";
-}
-function managerOf(value2) {
-  if (!value2 || typeof value2 !== "object") return null;
-  const row = value2;
-  const principalId = text(row.principalId);
-  if (!principalId) return null;
-  return {
-    principalId,
-    displayName: text(row.displayName) ?? "Unnamed member",
-    handle: text(row.handle) ?? ""
-  };
-}
-function unnamedPrincipal(kind) {
-  if (kind === "agent") return "Unnamed agent";
-  if (kind === "service") return "Unnamed service";
-  return "Unnamed member";
-}
-async function fetchIdentity(platformUrl, token, doFetch) {
-  const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
-  const body = await res.json();
-  const developerId = text(body.developerId) ?? "";
-  const machine = body.machine === true;
-  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
-  const principalId = text(body.principalId) ?? developerId;
-  const email = text(body.email);
-  const kind = principalKind(body.principalKind, machine);
-  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
-  const handle = text(body.handle) ?? "";
-  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
-  return {
-    developerId,
-    principalId,
-    principalKind: kind,
-    displayName,
-    handle,
-    manager: managerOf(body.manager),
-    credential: {
-      id: text(credential2.id),
-      kind: credentialKind(credential2.kind, machine, scopes)
-    },
-    email,
-    admin: body.admin === true,
-    machine,
-    scopes
-  };
-}
-function credentialLabel(identity) {
-  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
-  if (identity.credential.kind === "device")
-    return identity.scopes.length ? "device (scoped)" : "device";
-  if (identity.credential.kind === "clerk") return "clerk";
-  return "unknown (legacy server)";
-}
-function namedPrincipal(identity) {
-  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
-}
-function namedManager(manager) {
-  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
-}
-function accountableOwner(identity) {
-  if (identity.principalKind === "agent" && identity.manager) {
-    return namedManager(identity.manager);
-  }
-  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
-    return namedPrincipal(identity);
-  }
-  return identity.email ?? "Unnamed member";
-}
-async function whoamiCommand(parsed, deps = {}) {
-  assertArgs(
-    parsed,
-    ["config", "context", "platform", "token", "email", "json"],
-    1
-  );
-  const out = deps.stdout ?? console;
-  const doFetch = deps.fetch ?? fetch;
-  const { cfg } = await resolveOperatorContext(parsed, {
-    allowMissingConfig: true
-  });
-  const token = await getDeveloperToken(
-    cfg,
-    {
-      configPath: cfg.configPath,
-      token: stringOpt(parsed.options.token),
-      email: stringOpt(parsed.options.email),
-      // As above: never suppress the browser for an ordinary sign-in.
-      open: void 0
-    },
-    doFetch,
-    out
-  );
-  const identity = await fetchIdentity(cfg.platformUrl, token, doFetch);
-  if (parsed.options.json === true) {
-    out.log(JSON.stringify(identity, null, 2));
-    return;
-  }
-  out.log(`platform:   ${cfg.platformUrl}`);
-  out.log(`principal:  ${namedPrincipal(identity)}`);
-  out.log(`principal id: ${identity.principalId}`);
-  out.log(`kind:       ${identity.principalKind}`);
-  if (identity.principalKind === "agent")
-    out.log(
-      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
-    );
-  out.log(`owner:      ${accountableOwner(identity)}`);
-  out.log(`owner id:   ${identity.developerId}`);
-  out.log(`email:      ${identity.email ?? "(none)"}`);
-  out.log(`credential: ${credentialLabel(identity)}`);
-  if (identity.credential.id)
-    out.log(`credential id: ${identity.credential.id}`);
-  out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
-  if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
-  if (!identity.admin) {
-    if (identity.scopes.includes("platform:runbook:write")) {
-      out.log("\nThis exact scope can read and edit all platform runbook content.");
-      out.log("The device token is not ambient admin and cannot change visibility.");
-    } else {
-      out.log("\nYou can read operator-visible platform runbooks but not edit them.");
-      out.log("Use a platform-admin-approved runbook write request to edit.");
-    }
-  }
-}
-
 // src/runbook-command.ts
 var ALLOWED2 = [
   "config",
@@ -12914,6 +13016,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await whoamiCommand(parsed, runtime);
     return;
   }
+  if (command === "auth") {
+    await authCommand(parsed, runtime);
+    return;
+  }
   if (command === "context") {
     await contextCommand(parsed, runtime);
     return;
@@ -12954,6 +13060,15 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await pmCommand(parsed, runtime);
     return;
   }
+  if (command === "bug") {
+    const action2 = parsed.positionals[1] ?? "list";
+    const canonical = action2 === "report" || action2 === "create" ? "add" : action2;
+    await pmCommand({
+      ...parsed,
+      positionals: ["pm", "bug", canonical, ...parsed.positionals.slice(2)]
+    }, runtime);
+    return;
+  }
   if (command === "discuss") {
     await discussCommand(parsed, runtime);
     return;