@odla-ai/cli 0.30.0 → 0.30.1

package/README.md

@@ -511,12 +511,12 @@ credential set.
    and attempts to open it — including from CI, SSH, display-less, scripted,
    and agent-driven shells. Only `--no-open` suppresses the attempt. Browser
    launch is best-effort: an agent with browser control must open that exact URL
-   immediately; otherwise it gives the URL to the human verbatim. The started
-   handshake is persisted privately under `.odla/`, so a
-   run killed before approval loses nothing: rerunning resumes the same code.
-   Outside an interactive terminal the approval wait is capped (90 seconds by
-   default; `--wait <seconds>` overrides), and a still-pending handshake exits
-   with code 75 — approve at the URL, then re-run to collect the token.
+   immediately; otherwise it gives the URL to the human verbatim. The device
+   code stays only in the running process. Outside an interactive terminal the
+   approval wait is capped (90 seconds by default; `--wait <seconds>`
+   overrides), and a still-pending handshake exits with code 75. Rerunning
+   always requests and opens a new code; it never resumes an older request from
+   `.odla/`.
 2. Creates the platform app if needed. For a new id, this consumes the exact-id
    reservation approved in step 1; it is not ambient project-creation authority.
 3. Enables configured services in every configured environment. Calendar
@@ -569,6 +569,19 @@ The inventory contains only receipt, target, state, and timestamp metadata.
 Revocation uses the receipt's exact DB and o11y credential ids; no value is
 retrieved or rotated.
 
+Verify a deployment that intentionally keeps db/o11y credentials only on the
+Worker:
+
+```sh
+npx @odla-ai/cli smoke --env dev --runtime
+```
+
+Runtime smoke never reads `.odla/credentials.local.json`. It checks Registry
+public config, the configured Worker link, anonymous integration probes, and
+owner-visible calendar health. Direct schema and aggregate reads remain part
+of ordinary local-credential smoke because a runtime credential is deliberately
+not retrievable from the Worker.
+
 ### Application capability integrations
 
 An integration is an npm capability composed into an app, not a hosted

package/dist/bin.cjs

@@ -305,10 +305,51 @@ var init_handshake_approval = __esm({
   }
 });
 
+// src/handshake-state.ts
+function handshakeFile(cfg) {
+  return (0, import_node_path2.join)((0, import_node_path2.dirname)(cfg.local.tokenFile), "handshake.local.json");
+}
+function clearPendingHandshake(path) {
+  (0, import_node_fs4.rmSync)(path, { force: true });
+}
+function minutesLeft(expiresAt) {
+  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+}
+function approvalHint(pending) {
+  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
+}
+function approvalReminder(out, pending, periodMs = 3e4) {
+  const timer = setInterval(() => {
+    for (const line of reminderLines({
+      userCode: pending.userCode,
+      approvalUrl: pending.approvalUrl,
+      minutesLeft: minutesLeft(pending.expiresAt)
+    }))
+      out.log(line);
+  }, periodMs);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default.stdout.isTTY === true) {
+  if (waitSeconds !== void 0) return waitSeconds * 1e3;
+  return interactive ? void 0 : 9e4;
+}
+var import_node_fs4, import_node_path2, import_node_process3;
+var init_handshake_state = __esm({
+  "src/handshake-state.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_fs4 = require("fs");
+    import_node_path2 = require("path");
+    import_node_process3 = __toESM(require("process"), 1);
+    init_approval_prompt();
+  }
+});
+
 // src/local.ts
 function readJsonFile(path) {
   try {
-    return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs5.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
@@ -318,10 +359,10 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!(0, import_node_fs4.existsSync)(path)) return null;
+  if (!(0, import_node_fs5.existsSync)(path)) return null;
   let value2;
   try {
-    value2 = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
+    value2 = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf8"));
   } catch {
     throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
   }
@@ -351,14 +392,14 @@ function mergeCredential(current, update) {
   return next;
 }
 function ensureGitignore(rootDir, localPaths = []) {
-  const path = (0, import_node_path2.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs4.existsSync)(path) ? (0, import_node_fs4.readFileSync)(path, "utf8") : "";
+  const path = (0, import_node_path3.resolve)(rootDir, ".gitignore");
+  const existing = (0, import_node_fs5.existsSync)(path) ? (0, import_node_fs5.readFileSync)(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line) => !!line);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line) => !existing.split(/\r?\n/).includes(line));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs4.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+  (0, import_node_fs5.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
 `);
 }
 function o11yDevVars(cfg) {
@@ -372,7 +413,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path2.resolve)((0, import_node_path2.dirname)(cfg.configPath), requested);
+  return (0, import_node_path3.resolve)((0, import_node_path3.dirname)(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -386,7 +427,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = (0, import_node_fs4.existsSync)(path) ? (0, import_node_fs4.readFileSync)(path, "utf8") : "";
+  const existing = (0, import_node_fs5.existsSync)(path) ? (0, import_node_fs5.readFileSync)(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line) => !isManagedDevVar(line));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -400,28 +441,28 @@ function isManagedDevVar(line) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text2) {
-  (0, import_node_fs4.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
+  (0, import_node_fs5.mkdirSync)((0, import_node_path3.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs4.writeFileSync)(temporary, text2, { mode: 384 });
-  (0, import_node_fs4.chmodSync)(temporary, 384);
-  (0, import_node_fs4.renameSync)(temporary, path);
+  (0, import_node_fs5.writeFileSync)(temporary, text2, { mode: 384 });
+  (0, import_node_fs5.chmodSync)(temporary, 384);
+  (0, import_node_fs5.renameSync)(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
-  const rel = (0, import_node_path2.relative)((0, import_node_path2.resolve)(rootDir), (0, import_node_path2.resolve)(path));
-  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path2.isAbsolute)(rel)) return null;
+  const rel = (0, import_node_path3.relative)((0, import_node_path3.resolve)(rootDir), (0, import_node_path3.resolve)(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path3.isAbsolute)(rel)) return null;
   return rel.replaceAll("\\", "/");
 }
 function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path2.relative)(rootDir, path);
+  const rel = (0, import_node_path3.relative)(rootDir, path);
   return rel && !rel.startsWith("..") ? rel : path;
 }
-var import_node_fs4, import_node_path2, GITIGNORE_LINES, MANAGED_DEV_VARS;
+var import_node_fs5, import_node_path3, GITIGNORE_LINES, MANAGED_DEV_VARS;
 var init_local = __esm({
   "src/local.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs4 = require("fs");
-    import_node_path2 = require("path");
+    import_node_fs5 = require("fs");
+    import_node_path3 = require("path");
     GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
     MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
       "ODLA_PLATFORM",
@@ -438,71 +479,6 @@ var init_local = __esm({
   }
 });
 
-// src/handshake-state.ts
-function handshakeFile(cfg) {
-  return (0, import_node_path3.join)((0, import_node_path3.dirname)(cfg.local.tokenFile), "handshake.local.json");
-}
-function readPendingHandshake(path, platform, email, requiredGrant) {
-  const pending = readJsonFile(path);
-  if (!pending || pending.platform !== platform || pending.email !== email) return null;
-  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string") return null;
-  if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
-  if (requiredGrant && !grantCovers(pending, requiredGrant)) return null;
-  return {
-    interval: typeof pending.interval === "number" ? pending.interval : 3,
-    ...pending,
-    approvalUrl: handshakeUrl(platform, pending.userCode)
-  };
-}
-function grantCovers(stored, required) {
-  if (required.optionalProjectCapabilities.length === 0) return true;
-  return required.projectIds.every((id) => stored.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
-    (capability) => stored.optionalProjectCapabilities?.includes(capability)
-  );
-}
-function writePendingHandshake(path, pending) {
-  writePrivateJson(path, pending);
-}
-function clearPendingHandshake(path) {
-  (0, import_node_fs5.rmSync)(path, { force: true });
-}
-function minutesLeft(expiresAt) {
-  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
-}
-function approvalHint(pending) {
-  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
-}
-function approvalReminder(out, pending, periodMs = 3e4) {
-  const timer = setInterval(() => {
-    for (const line of reminderLines({
-      userCode: pending.userCode,
-      approvalUrl: pending.approvalUrl,
-      minutesLeft: minutesLeft(pending.expiresAt)
-    }))
-      out.log(line);
-  }, periodMs);
-  timer.unref?.();
-  return () => clearInterval(timer);
-}
-function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default.stdout.isTTY === true) {
-  if (waitSeconds !== void 0) return waitSeconds * 1e3;
-  return interactive ? void 0 : 9e4;
-}
-var import_node_fs5, import_node_path3, import_node_process3, RESUME_MARGIN_MS;
-var init_handshake_state = __esm({
-  "src/handshake-state.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_node_fs5 = require("fs");
-    import_node_path3 = require("path");
-    import_node_process3 = __toESM(require("process"), 1);
-    init_local();
-    init_approval_prompt();
-    init_handshake_approval();
-    RESUME_MARGIN_MS = 5e3;
-  }
-});
-
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   const audience = platformAudience(cfg.platformUrl);
@@ -541,8 +517,8 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
-  if (grantRequest.freshLogin) clearPendingHandshake(ctx.pendingFile);
-  const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
+  clearPendingHandshake(ctx.pendingFile);
+  const { token, expiresAt } = await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
   writePrivateJson(cfg.local.tokenFile, {
     platform: audience,
@@ -555,47 +531,6 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
-async function resumePendingHandshake(ctx, waitMs) {
-  const pending = readPendingHandshake(
-    ctx.pendingFile,
-    ctx.audience,
-    ctx.email,
-    ctx.grantIntent
-  );
-  if (!pending) return null;
-  ctx.out.error("");
-  ctx.out.error(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
-  await presentHandshakeApproval(ctx.out, {
-    userCode: pending.userCode,
-    approvalUrl: pending.approvalUrl,
-    minutesLeft: Math.max(1, Math.floor((pending.expiresAt - Date.now()) / 6e4)),
-    purpose: `sign this terminal in as ${ctx.email}`
-  }, ctx.options);
-  ctx.out.error("");
-  const stopReminder = approvalReminder(ctx.out, pending);
-  try {
-    return await (0, import_db.collectToken)({
-      endpoint: ctx.cfg.platformUrl,
-      deviceCode: pending.deviceCode,
-      expiresAt: pending.expiresAt,
-      interval: pending.interval,
-      waitMs,
-      fetch: ctx.doFetch
-    });
-  } catch (err) {
-    const code = err instanceof import_db.OdlaError ? err.code : void 0;
-    if (code === "handshake_pending") throw stillPending(pending, ctx.email);
-    if (code === "handshake_expired" || code === "handshake_timeout") {
-      clearPendingHandshake(ctx.pendingFile);
-      ctx.out.error("auth: pending handshake lapsed unapproved; starting a fresh one");
-      return null;
-    }
-    if (code === "handshake_denied") clearPendingHandshake(ctx.pendingFile);
-    throw err;
-  } finally {
-    stopReminder();
-  }
-}
 async function freshHandshake(ctx, waitMs) {
   let started;
   let stopReminder;
@@ -623,7 +558,6 @@ async function freshHandshake(ctx, waitMs) {
           projectIds: ctx.grantIntent.projectIds,
           optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities
         };
-        writePendingHandshake(ctx.pendingFile, started);
         await presentHandshakeApproval(ctx.out, {
           userCode,
           approvalUrl,
@@ -659,7 +593,7 @@ function projectAgentHandle(appId) {
 function stillPending(pending, email) {
   return new import_db.OdlaError(
     "handshake_pending",
-    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,
+    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}; if this command exits, re-run it to request a new code`,
     { retryable: true }
   );
 }
@@ -5436,28 +5370,31 @@ async function smoke(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const env = resolveEnv(cfg, options.env);
-  const credentials = readCredentials(cfg.local.credentialsFile);
-  if (!credentials) {
+  const runtime = options.runtime === true;
+  const credentials = runtime ? null : readCredentials(cfg.local.credentialsFile);
+  if (!runtime && !credentials) {
     throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
   }
-  if (credentials.appId !== cfg.app.id) {
+  if (credentials && credentials.appId !== cfg.app.id) {
     throw new Error(`local credentials are for app "${credentials.appId}", but config app is "${cfg.app.id}"`);
   }
-  const entry = credentials.envs[env];
-  if (!entry?.tenantId) {
+  const entry = credentials?.envs[env];
+  if (!runtime && !entry?.tenantId) {
     throw new Error(`local credentials have no tenant for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const hasDb = cfg.services.includes("db");
   const hasO11y = cfg.services.includes("o11y");
-  if (hasDb && !entry.dbKey) {
+  if (!runtime && hasDb && !entry?.dbKey) {
     throw new Error(`local credentials have no db key for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
-  if (hasO11y && !entry.o11yToken) {
+  if (!runtime && hasO11y && !entry?.o11yToken) {
     throw new Error(`local credentials have no o11y token for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const doFetch = options.fetch ?? fetch;
+  const tenantId = entry?.tenantId ?? resolveTenant(cfg, env).tenant;
   out.log(`smoke: ${cfg.app.id}/${env}`);
-  out.log(`  tenant: ${entry.tenantId}`);
+  out.log(`  mode: ${runtime ? "runtime (Worker-held credentials)" : "local credentials"}`);
+  out.log(`  tenant: ${tenantId}`);
   const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
   out.log(`  public-config: ok`);
   if (cfg.services.includes("ai") && cfg.ai?.provider) {
@@ -5471,7 +5408,7 @@ async function smoke(options) {
     if (mode !== "hosted") throw new Error(`ai mode mismatch: expected "hosted", public-config has "${String(mode ?? "none")}"`);
     out.log("  ai: hosted");
   }
-  if (hasO11y) out.log(`  o11y: credentials present`);
+  if (hasO11y) out.log(runtime ? `  o11y: Worker-held credential` : `  o11y: credentials present`);
   if (cfg.services.includes("calendar")) {
     const token = await getDeveloperToken(
       cfg,
@@ -5490,10 +5427,10 @@ async function smoke(options) {
     out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
   const database = await resolveDatabaseConfig(cfg);
-  if (hasDb) {
+  if (hasDb && !runtime) {
     const expectedSchema = database.schema;
     const expectedEntities = serializedEntities(expectedSchema);
-    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
+    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, entry.dbKey);
     const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
     const liveEntities = serializedEntities(liveSchema);
     if (expectedEntities.length) {
@@ -5503,7 +5440,7 @@ async function smoke(options) {
     out.log(`  schema: ${liveEntities.length} entities`);
     const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
     if (aggregateEntity) {
-      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/aggregate`, entry.dbKey, {
         ns: aggregateEntity,
         aggregate: { count: true }
       });
@@ -5512,9 +5449,20 @@ async function smoke(options) {
     } else {
       out.log(`  aggregate: skipped (schema has no entities)`);
     }
+  } else if (hasDb) {
+    out.log(`  db: Worker-held credential (direct schema/aggregate skipped)`);
   } else {
     out.log(`  db: skipped (not enabled)`);
   }
+  if (runtime) {
+    const link = cfg.links?.[env];
+    if (!link) throw new Error(`runtime smoke requires links.${env} in odla.config.mjs`);
+    const res = await doFetch(link, { redirect: "manual" });
+    if (res.status < 200 || res.status >= 500) {
+      throw new Error(`runtime target ${new URL(link).origin} returned ${res.status}`);
+    }
+    out.log(`  runtime target: ${res.status}`);
+  }
   const probes = database.integrations.flatMap(
     (integration) => (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe }))
   );
@@ -5729,10 +5677,11 @@ async function projectCommand(command, parsed, deps) {
     return true;
   }
   if (command === "smoke") {
-    assertArgs(parsed, ["config", "env", "token", "email", "open"], 1);
+    assertArgs(parsed, ["config", "env", "runtime", "token", "email", "open"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       env: stringOpt(parsed.options.env),
+      runtime: parsed.options.runtime === true,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
       open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
@@ -9727,7 +9676,7 @@ Usage:
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
   odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--runtime] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
@@ -9831,7 +9780,7 @@ Commands:
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
                no edit to the dev-first envs list is required.
-  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
+  smoke        Verify local service access, or use --runtime for a Worker-held credential deployment.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
@@ -9871,12 +9820,11 @@ Safety:
   attempts to open it \u2014 including in CI, SSH, display-less, and agent-driven
   shells. Only --no-open suppresses the attempt. Browser launch is best-effort:
   agents with browser control must open that exact URL immediately; otherwise
-  they must give it to the human verbatim. A started handshake is persisted
-  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
-  the same code. Outside an interactive terminal the wait is capped (90s by
+  they must give it to the human verbatim. A device code remains only in the
+  running process. Outside an interactive terminal the wait is capped (90s by
   default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: open the same URL (or relay it if browser control is unavailable),
-  wait for approval, and re-run to collect.
+  with code 75. Rerunning always requests and opens a new code; older clients'
+  persisted pending state is discarded.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. It is the email shown by the signed-in odla account \u2014 never infer it