@odla-ai/cli 0.27.6 → 0.27.8

package/dist/bin.js

@@ -3,7 +3,7 @@ import {
   exitCodeFor,
   redactSecrets,
   runCli
-} from "./chunk-DQOJ4S6H.js";
+} from "./chunk-MZSU4YQL.js";
 
 // src/bin.ts
 runCli().catch((err) => {

package/dist/{chunk-DQOJ4S6H.js → chunk-MZSU4YQL.js}

@@ -465,7 +465,7 @@ var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
-  "platform:runbook:write": "add or edit odla's operational runbooks",
+  "platform:runbook:write": "read and edit all of odla's operational runbooks, including admin-visible content",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
   "platform:ai:credential:write": "replace a stored AI provider key",
@@ -12332,8 +12332,13 @@ async function whoamiCommand(parsed, deps = {}) {
   out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
   if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
   if (!identity.admin) {
-    out.log("\nYou can read platform runbooks but not edit them. A handshake-minted");
-    out.log("device token never carries admin \u2014 sign in to Studio as an admin to edit.");
+    if (identity.scopes.includes("platform:runbook:write")) {
+      out.log("\nThis exact scope can read and edit all platform runbook content.");
+      out.log("The device token is not ambient admin and cannot change visibility.");
+    } else {
+      out.log("\nYou can read operator-visible platform runbooks but not edit them.");
+      out.log("Use a platform-admin-approved runbook write request to edit.");
+    }
   }
 }
 
@@ -13161,4 +13166,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-DQOJ4S6H.js.map
+//# sourceMappingURL=chunk-MZSU4YQL.js.map