@odla-ai/cli 0.30.0 → 0.30.2

package/dist/bin.js

@@ -174,7 +174,7 @@ function absoluteEntryPath(entryPath) {
 
 // src/bin.ts
 var argv = process.argv.slice(2);
-requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-CKBUVTJM.js")).runCli()).catch((err) => {
+requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-BGSX5Z4C.js")).runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });

package/dist/{chunk-PPSXHZJI.js → chunk-3HFNKDZV.js}

@@ -13,7 +13,7 @@ import {
 import process8 from "process";
 
 // src/token.ts
-import { collectToken, OdlaError, requestToken } from "@odla-ai/db";
+import { OdlaError, requestToken } from "@odla-ai/db";
 import { createHash } from "crypto";
 import process5 from "process";
 
@@ -117,12 +117,40 @@ function handshakeUrl(platformUrl, userCode) {
 
 // src/handshake-state.ts
 import { rmSync } from "fs";
-import { dirname as dirname2, join } from "path";
+import { dirname, join } from "path";
 import process4 from "process";
+function handshakeFile(cfg) {
+  return join(dirname(cfg.local.tokenFile), "handshake.local.json");
+}
+function clearPendingHandshake(path) {
+  rmSync(path, { force: true });
+}
+function minutesLeft(expiresAt) {
+  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+}
+function approvalHint(pending) {
+  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
+}
+function approvalReminder(out, pending, periodMs = 3e4) {
+  const timer = setInterval(() => {
+    for (const line of reminderLines({
+      userCode: pending.userCode,
+      approvalUrl: pending.approvalUrl,
+      minutesLeft: minutesLeft(pending.expiresAt)
+    }))
+      out.log(line);
+  }, periodMs);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === true) {
+  if (waitSeconds !== void 0) return waitSeconds * 1e3;
+  return interactive ? void 0 : 9e4;
+}
 
 // src/local.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
-import { dirname, isAbsolute, relative, resolve } from "path";
+import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
@@ -190,7 +218,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return resolve(dirname(cfg.configPath), requested);
+  return resolve(dirname2(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -230,7 +258,7 @@ function isManagedDevVar(line) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text2) {
-  mkdirSync(dirname(path), { recursive: true });
+  mkdirSync(dirname2(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync(temporary, text2, { mode: 384 });
   chmodSync(temporary, 384);
@@ -246,58 +274,6 @@ function displayPath(path, rootDir = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
-// src/handshake-state.ts
-function handshakeFile(cfg) {
-  return join(dirname2(cfg.local.tokenFile), "handshake.local.json");
-}
-var RESUME_MARGIN_MS = 5e3;
-function readPendingHandshake(path, platform, email, requiredGrant) {
-  const pending = readJsonFile(path);
-  if (!pending || pending.platform !== platform || pending.email !== email) return null;
-  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string") return null;
-  if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
-  if (requiredGrant && !grantCovers(pending, requiredGrant)) return null;
-  return {
-    interval: typeof pending.interval === "number" ? pending.interval : 3,
-    ...pending,
-    approvalUrl: handshakeUrl(platform, pending.userCode)
-  };
-}
-function grantCovers(stored, required) {
-  if (required.optionalProjectCapabilities.length === 0) return true;
-  return required.projectIds.every((id) => stored.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
-    (capability) => stored.optionalProjectCapabilities?.includes(capability)
-  );
-}
-function writePendingHandshake(path, pending) {
-  writePrivateJson(path, pending);
-}
-function clearPendingHandshake(path) {
-  rmSync(path, { force: true });
-}
-function minutesLeft(expiresAt) {
-  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
-}
-function approvalHint(pending) {
-  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
-}
-function approvalReminder(out, pending, periodMs = 3e4) {
-  const timer = setInterval(() => {
-    for (const line of reminderLines({
-      userCode: pending.userCode,
-      approvalUrl: pending.approvalUrl,
-      minutesLeft: minutesLeft(pending.expiresAt)
-    }))
-      out.log(line);
-  }, periodMs);
-  timer.unref?.();
-  return () => clearInterval(timer);
-}
-function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === true) {
-  if (waitSeconds !== void 0) return waitSeconds * 1e3;
-  return interactive ? void 0 : 9e4;
-}
-
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   const audience = platformAudience(cfg.platformUrl);
@@ -336,8 +312,8 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
-  if (grantRequest.freshLogin) clearPendingHandshake(ctx.pendingFile);
-  const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
+  clearPendingHandshake(ctx.pendingFile);
+  const { token, expiresAt } = await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
   writePrivateJson(cfg.local.tokenFile, {
     platform: audience,
@@ -350,47 +326,6 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
-async function resumePendingHandshake(ctx, waitMs) {
-  const pending = readPendingHandshake(
-    ctx.pendingFile,
-    ctx.audience,
-    ctx.email,
-    ctx.grantIntent
-  );
-  if (!pending) return null;
-  ctx.out.error("");
-  ctx.out.error(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
-  await presentHandshakeApproval(ctx.out, {
-    userCode: pending.userCode,
-    approvalUrl: pending.approvalUrl,
-    minutesLeft: Math.max(1, Math.floor((pending.expiresAt - Date.now()) / 6e4)),
-    purpose: `sign this terminal in as ${ctx.email}`
-  }, ctx.options);
-  ctx.out.error("");
-  const stopReminder = approvalReminder(ctx.out, pending);
-  try {
-    return await collectToken({
-      endpoint: ctx.cfg.platformUrl,
-      deviceCode: pending.deviceCode,
-      expiresAt: pending.expiresAt,
-      interval: pending.interval,
-      waitMs,
-      fetch: ctx.doFetch
-    });
-  } catch (err) {
-    const code = err instanceof OdlaError ? err.code : void 0;
-    if (code === "handshake_pending") throw stillPending(pending, ctx.email);
-    if (code === "handshake_expired" || code === "handshake_timeout") {
-      clearPendingHandshake(ctx.pendingFile);
-      ctx.out.error("auth: pending handshake lapsed unapproved; starting a fresh one");
-      return null;
-    }
-    if (code === "handshake_denied") clearPendingHandshake(ctx.pendingFile);
-    throw err;
-  } finally {
-    stopReminder();
-  }
-}
 async function freshHandshake(ctx, waitMs) {
   let started;
   let stopReminder;
@@ -418,7 +353,6 @@ async function freshHandshake(ctx, waitMs) {
           projectIds: ctx.grantIntent.projectIds,
           optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities
         };
-        writePendingHandshake(ctx.pendingFile, started);
         await presentHandshakeApproval(ctx.out, {
           userCode,
           approvalUrl,
@@ -454,7 +388,7 @@ function projectAgentHandle(appId) {
 function stillPending(pending, email) {
   return new OdlaError(
     "handshake_pending",
-    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,
+    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}; if this command exits, re-run it to request a new code`,
     { retryable: true }
   );
 }
@@ -4781,28 +4715,31 @@ async function smoke(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const env = resolveEnv(cfg, options.env);
-  const credentials = readCredentials(cfg.local.credentialsFile);
-  if (!credentials) {
+  const runtime = options.runtime === true;
+  const credentials = runtime ? null : readCredentials(cfg.local.credentialsFile);
+  if (!runtime && !credentials) {
     throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
   }
-  if (credentials.appId !== cfg.app.id) {
+  if (credentials && credentials.appId !== cfg.app.id) {
     throw new Error(`local credentials are for app "${credentials.appId}", but config app is "${cfg.app.id}"`);
   }
-  const entry = credentials.envs[env];
-  if (!entry?.tenantId) {
+  const entry = credentials?.envs[env];
+  if (!runtime && !entry?.tenantId) {
     throw new Error(`local credentials have no tenant for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const hasDb = cfg.services.includes("db");
   const hasO11y = cfg.services.includes("o11y");
-  if (hasDb && !entry.dbKey) {
+  if (!runtime && hasDb && !entry?.dbKey) {
     throw new Error(`local credentials have no db key for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
-  if (hasO11y && !entry.o11yToken) {
+  if (!runtime && hasO11y && !entry?.o11yToken) {
     throw new Error(`local credentials have no o11y token for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const doFetch = options.fetch ?? fetch;
+  const tenantId = entry?.tenantId ?? resolveTenant(cfg, env).tenant;
   out.log(`smoke: ${cfg.app.id}/${env}`);
-  out.log(`  tenant: ${entry.tenantId}`);
+  out.log(`  mode: ${runtime ? "runtime (Worker-held credentials)" : "local credentials"}`);
+  out.log(`  tenant: ${tenantId}`);
   const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
   out.log(`  public-config: ok`);
   if (cfg.services.includes("ai") && cfg.ai?.provider) {
@@ -4816,7 +4753,7 @@ async function smoke(options) {
     if (mode !== "hosted") throw new Error(`ai mode mismatch: expected "hosted", public-config has "${String(mode ?? "none")}"`);
     out.log("  ai: hosted");
   }
-  if (hasO11y) out.log(`  o11y: credentials present`);
+  if (hasO11y) out.log(runtime ? `  o11y: Worker-held credential` : `  o11y: credentials present`);
   if (cfg.services.includes("calendar")) {
     const token = await getDeveloperToken(
       cfg,
@@ -4835,10 +4772,10 @@ async function smoke(options) {
     out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
   const database = await resolveDatabaseConfig(cfg);
-  if (hasDb) {
+  if (hasDb && !runtime) {
     const expectedSchema = database.schema;
     const expectedEntities = serializedEntities(expectedSchema);
-    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
+    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, entry.dbKey);
     const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
     const liveEntities = serializedEntities(liveSchema);
     if (expectedEntities.length) {
@@ -4848,7 +4785,7 @@ async function smoke(options) {
     out.log(`  schema: ${liveEntities.length} entities`);
     const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
     if (aggregateEntity) {
-      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/aggregate`, entry.dbKey, {
         ns: aggregateEntity,
         aggregate: { count: true }
       });
@@ -4857,9 +4794,20 @@ async function smoke(options) {
     } else {
       out.log(`  aggregate: skipped (schema has no entities)`);
     }
+  } else if (hasDb) {
+    out.log(`  db: Worker-held credential (direct schema/aggregate skipped)`);
   } else {
     out.log(`  db: skipped (not enabled)`);
   }
+  if (runtime) {
+    const link = cfg.links?.[env];
+    if (!link) throw new Error(`runtime smoke requires links.${env} in odla.config.mjs`);
+    const res = await doFetch(link, { redirect: "manual" });
+    if (res.status < 200 || res.status >= 500) {
+      throw new Error(`runtime target ${new URL(link).origin} returned ${res.status}`);
+    }
+    out.log(`  runtime target: ${res.status}`);
+  }
   const probes = database.integrations.flatMap(
     (integration) => (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe }))
   );
@@ -5062,10 +5010,11 @@ async function projectCommand(command, parsed, deps) {
     return true;
   }
   if (command === "smoke") {
-    assertArgs(parsed, ["config", "env", "token", "email", "open"], 1);
+    assertArgs(parsed, ["config", "env", "runtime", "token", "email", "open"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       env: stringOpt(parsed.options.env),
+      runtime: parsed.options.runtime === true,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
       open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
@@ -8840,6 +8789,7 @@ Usage:
   odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
   odla-ai bug report --app <id> --title <t> (--description <text>|--body <text>) [--severity <s>] [--json]
   odla-ai pm <goal|task|decision|bug> get <id> [--json]
+  odla-ai pm <goal|task|decision|bug> link <id> [--json]
   odla-ai pm <goal|task|decision|bug> ref <id> [--json]
   odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
   odla-ai pm task set <id> [--title <t>|--column <backlog|ready|doing|review|done>|--rank <n>|--goal <id>|--no-goal|--alignment-decision <id>|--no-alignment-decision|--execution <human|agent|either>|--assignee <id>|--no-assignee|--description <text>|--body <text>|--acceptance <text>|--no-acceptance|--due <epoch-ms>|--no-due|--expected-revision <n>] [--mutation-id <id>] [--json]
@@ -8908,7 +8858,7 @@ Usage:
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
   odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--runtime] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
@@ -9010,7 +8960,7 @@ Commands:
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
                no edit to the dev-first envs list is required.
-  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
+  smoke        Verify local service access, or use --runtime for a Worker-held credential deployment.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
@@ -9050,12 +9000,11 @@ Safety:
   attempts to open it \u2014 including in CI, SSH, display-less, and agent-driven
   shells. Only --no-open suppresses the attempt. Browser launch is best-effort:
   agents with browser control must open that exact URL immediately; otherwise
-  they must give it to the human verbatim. A started handshake is persisted
-  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
-  the same code. Outside an interactive terminal the wait is capped (90s by
+  they must give it to the human verbatim. A device code remains only in the
+  running process. Outside an interactive terminal the wait is capped (90s by
   default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: open the same URL (or relay it if browser control is unavailable),
-  wait for approval, and re-run to collect.
+  with code 75. Rerunning always requests and opens a new code; older clients'
+  persisted pending state is discarded.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. It is the email shown by the signed-in odla account \u2014 never infer it
@@ -9706,9 +9655,25 @@ function referenceMarkup(entity, record10) {
   const label = (record10.title?.trim() || `${entity} ${record10.id}`).replaceAll("]", ")");
   return `@[${label}](pm:${entity}/${record10.id})`;
 }
+var STUDIO_SECTION = {
+  goal: "goals",
+  task: "board",
+  decision: "decisions",
+  bug: "bugs"
+};
+function studioRecordUrl(ctx, entity, id) {
+  return new URL(
+    `/studio/pm/${STUDIO_SECTION[entity]}/${encodeURIComponent(id)}`,
+    ctx.platformUrl
+  ).href;
+}
+function studioRecordLink(ctx, entity, record10) {
+  const label = (record10.title?.trim() || `${entity} ${record10.id}`).replaceAll("]", ")");
+  return `[${label}](${studioRecordUrl(ctx, entity, record10.id)})`;
+}
 function printRecord(ctx, entity, record10) {
   ctx.out.log(
-    `${record10.id}	[${statusCol(entity, record10)}]	${record10.appId}	${record10.title ?? ""}`
+    `${record10.id}	[${statusCol(entity, record10)}]	${record10.appId}	${studioRecordLink(ctx, entity, record10)}`
   );
 }
 function emit2(ctx, value2, human) {
@@ -9758,7 +9723,8 @@ async function pmAdd(ctx, entity, parsed) {
     input,
     mutationId: writeMutationId2(parsed)
   });
-  emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
+  const record10 = { id: res.id, appId, title: String(input.title) };
+  emit2(ctx, res, () => ctx.out.log(`created ${entity}: ${studioRecordLink(ctx, entity, record10)}`));
 }
 async function pmGet(ctx, entity, id) {
   const { record: record10 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
@@ -9783,7 +9749,10 @@ async function pmSet(ctx, entity, id, parsed) {
     patch: patch2,
     mutationId: writeMutationId2(parsed)
   });
-  emit2(ctx, res, () => ctx.out.log(res.record ? `${res.record.id}	[${statusCol(entity, res.record)}]	${res.record.appId}	${res.record.title ?? ""}` : `updated ${entity} ${id}`));
+  emit2(ctx, res, () => {
+    if (!res.record) return ctx.out.log(`updated ${entity} ${id}`);
+    ctx.out.log(`${entity}: ${studioRecordLink(ctx, entity, res.record)} \u2192 ${statusCol(entity, res.record)}`);
+  });
 }
 async function pmDone(ctx, entity, id, parsed) {
   const decisionId = stringOpt(parsed.options.decision);
@@ -9793,7 +9762,11 @@ async function pmDone(ctx, entity, id, parsed) {
     patch: patch2,
     mutationId: writeMutationId2(parsed)
   });
-  emit2(ctx, res, () => ctx.out.log(`${entity} ${id} \u2192 done`));
+  emit2(ctx, res, () => {
+    const label = res.record ? studioRecordLink(ctx, entity, res.record) : id;
+    const state2 = res.record ? statusCol(entity, res.record) : "done";
+    ctx.out.log(`${entity}: ${label} \u2192 ${state2}`);
+  });
 }
 async function pmTaskLifecycle(ctx, id, action2, parsed) {
   const rawRevision = stringOpt(parsed.options["expected-revision"]);
@@ -9822,7 +9795,8 @@ async function pmTaskLifecycle(ctx, id, action2, parsed) {
   );
   emit2(ctx, res, () => {
     const state2 = res.record ? statusCol("task", res.record) : action2;
-    ctx.out.log(`task ${id} \u2192 ${state2}`);
+    const label = res.record ? studioRecordLink(ctx, "task", res.record) : id;
+    ctx.out.log(`task: ${label} \u2192 ${state2}`);
   });
 }
 async function allRecords(ctx, entity, appId) {
@@ -9919,6 +9893,20 @@ async function pmRemove(ctx, entity, id) {
   ctx.out.log(`deleted ${entity} ${id}`);
 }
 
+// src/pm-links.ts
+async function pmLink(ctx, entity, id) {
+  const { record: record10 } = await pmRequest(
+    ctx,
+    "GET",
+    `/${entity}/${encodeURIComponent(id)}`
+  );
+  const url = studioRecordUrl(ctx, entity, record10.id);
+  const markdown = studioRecordLink(ctx, entity, record10);
+  emit2(ctx, { kind: entity, id: record10.id, label: record10.title ?? "", url, markdown }, () => {
+    ctx.out.log(markdown);
+  });
+}
+
 // src/pm-comments.ts
 async function pmComment(ctx, entity, id, parsed) {
   const body = stringOpt(parsed.options.body);
@@ -10166,6 +10154,7 @@ var ACTION_OPTIONS = {
   ready: ["goal", "alignment-decision", "execution", "description", "desc", "body", "acceptance", "expected-revision", "mutation-id"],
   claim: ["expected-revision", "mutation-id"],
   release: ["expected-revision", "mutation-id"],
+  link: [],
   ref: []
 };
 var ENTITY_OPTIONS = {
@@ -10270,7 +10259,7 @@ async function pmCommand(parsed, deps = {}) {
   if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm bug list" (goal|task|decision|bug).`);
   const requestedAction = parsed.positionals[2] ?? "list";
   const action2 = canonicalAction(requestedAction);
-  if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
+  if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|link|ref|comment|comments|rm.`);
   assertArgs(parsed, allowedOptions(entity, action2), 4);
   if ((action2 === "ready" || action2 === "claim" || action2 === "release") && entity !== "task") {
     throw new Error(`pm ${action2} is only valid for tasks`);
@@ -10294,6 +10283,8 @@ async function pmCommand(parsed, deps = {}) {
       return pmComments(ctx, entity, requireId2(id, action2));
     case "rm":
       return pmRemove(ctx, entity, requireId2(id, action2));
+    case "link":
+      return pmLink(ctx, entity, requireId2(id, action2));
     case "ref":
       return pmReference(ctx, entity, requireId2(id, action2));
     case "ready":
@@ -13246,4 +13237,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-PPSXHZJI.js.map
+//# sourceMappingURL=chunk-3HFNKDZV.js.map