@odla-ai/cli 0.30.0 → 0.30.2

package/dist/{cli-CKBUVTJM.js → cli-BGSX5Z4C.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-PPSXHZJI.js";
+} from "./chunk-3HFNKDZV.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-CKBUVTJM.js.map
+//# sourceMappingURL=cli-BGSX5Z4C.js.map

package/dist/index.cjs

@@ -203,17 +203,45 @@ function handshakeUrl(platformUrl, userCode) {
 }
 
 // src/handshake-state.ts
-var import_node_fs2 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs = require("fs");
+var import_node_path = require("path");
 var import_node_process3 = __toESM(require("process"), 1);
+function handshakeFile(cfg) {
+  return (0, import_node_path.join)((0, import_node_path.dirname)(cfg.local.tokenFile), "handshake.local.json");
+}
+function clearPendingHandshake(path) {
+  (0, import_node_fs.rmSync)(path, { force: true });
+}
+function minutesLeft(expiresAt) {
+  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+}
+function approvalHint(pending) {
+  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
+}
+function approvalReminder(out, pending, periodMs = 3e4) {
+  const timer = setInterval(() => {
+    for (const line of reminderLines({
+      userCode: pending.userCode,
+      approvalUrl: pending.approvalUrl,
+      minutesLeft: minutesLeft(pending.expiresAt)
+    }))
+      out.log(line);
+  }, periodMs);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default.stdout.isTTY === true) {
+  if (waitSeconds !== void 0) return waitSeconds * 1e3;
+  return interactive ? void 0 : 9e4;
+}
 
 // src/local.ts
-var import_node_fs = require("fs");
-var import_node_path = require("path");
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
-    return JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
@@ -223,10 +251,10 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!(0, import_node_fs.existsSync)(path)) return null;
+  if (!(0, import_node_fs2.existsSync)(path)) return null;
   let value2;
   try {
-    value2 = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+    value2 = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
   } catch {
     throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
   }
@@ -256,14 +284,14 @@ function mergeCredential(current, update) {
   return next;
 }
 function ensureGitignore(rootDir, localPaths = []) {
-  const path = (0, import_node_path.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs.existsSync)(path) ? (0, import_node_fs.readFileSync)(path, "utf8") : "";
+  const path = (0, import_node_path2.resolve)(rootDir, ".gitignore");
+  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line) => !!line);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line) => !existing.split(/\r?\n/).includes(line));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+  (0, import_node_fs2.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
 `);
 }
 function o11yDevVars(cfg) {
@@ -277,7 +305,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path.resolve)((0, import_node_path.dirname)(cfg.configPath), requested);
+  return (0, import_node_path2.resolve)((0, import_node_path2.dirname)(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -291,7 +319,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = (0, import_node_fs.existsSync)(path) ? (0, import_node_fs.readFileSync)(path, "utf8") : "";
+  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line) => !isManagedDevVar(line));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -317,74 +345,22 @@ function isManagedDevVar(line) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text2) {
-  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true });
+  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs.writeFileSync)(temporary, text2, { mode: 384 });
-  (0, import_node_fs.chmodSync)(temporary, 384);
-  (0, import_node_fs.renameSync)(temporary, path);
+  (0, import_node_fs2.writeFileSync)(temporary, text2, { mode: 384 });
+  (0, import_node_fs2.chmodSync)(temporary, 384);
+  (0, import_node_fs2.renameSync)(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
-  const rel = (0, import_node_path.relative)((0, import_node_path.resolve)(rootDir), (0, import_node_path.resolve)(path));
-  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path.isAbsolute)(rel)) return null;
+  const rel = (0, import_node_path2.relative)((0, import_node_path2.resolve)(rootDir), (0, import_node_path2.resolve)(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path2.isAbsolute)(rel)) return null;
   return rel.replaceAll("\\", "/");
 }
 function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path.relative)(rootDir, path);
+  const rel = (0, import_node_path2.relative)(rootDir, path);
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
-// src/handshake-state.ts
-function handshakeFile(cfg) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(cfg.local.tokenFile), "handshake.local.json");
-}
-var RESUME_MARGIN_MS = 5e3;
-function readPendingHandshake(path, platform, email, requiredGrant) {
-  const pending = readJsonFile(path);
-  if (!pending || pending.platform !== platform || pending.email !== email) return null;
-  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string") return null;
-  if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
-  if (requiredGrant && !grantCovers(pending, requiredGrant)) return null;
-  return {
-    interval: typeof pending.interval === "number" ? pending.interval : 3,
-    ...pending,
-    approvalUrl: handshakeUrl(platform, pending.userCode)
-  };
-}
-function grantCovers(stored, required) {
-  if (required.optionalProjectCapabilities.length === 0) return true;
-  return required.projectIds.every((id) => stored.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
-    (capability) => stored.optionalProjectCapabilities?.includes(capability)
-  );
-}
-function writePendingHandshake(path, pending) {
-  writePrivateJson(path, pending);
-}
-function clearPendingHandshake(path) {
-  (0, import_node_fs2.rmSync)(path, { force: true });
-}
-function minutesLeft(expiresAt) {
-  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
-}
-function approvalHint(pending) {
-  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
-}
-function approvalReminder(out, pending, periodMs = 3e4) {
-  const timer = setInterval(() => {
-    for (const line of reminderLines({
-      userCode: pending.userCode,
-      approvalUrl: pending.approvalUrl,
-      minutesLeft: minutesLeft(pending.expiresAt)
-    }))
-      out.log(line);
-  }, periodMs);
-  timer.unref?.();
-  return () => clearInterval(timer);
-}
-function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default.stdout.isTTY === true) {
-  if (waitSeconds !== void 0) return waitSeconds * 1e3;
-  return interactive ? void 0 : 9e4;
-}
-
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   const audience = platformAudience(cfg.platformUrl);
@@ -423,8 +399,8 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
-  if (grantRequest.freshLogin) clearPendingHandshake(ctx.pendingFile);
-  const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
+  clearPendingHandshake(ctx.pendingFile);
+  const { token, expiresAt } = await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
   writePrivateJson(cfg.local.tokenFile, {
     platform: audience,
@@ -437,47 +413,6 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
-async function resumePendingHandshake(ctx, waitMs) {
-  const pending = readPendingHandshake(
-    ctx.pendingFile,
-    ctx.audience,
-    ctx.email,
-    ctx.grantIntent
-  );
-  if (!pending) return null;
-  ctx.out.error("");
-  ctx.out.error(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
-  await presentHandshakeApproval(ctx.out, {
-    userCode: pending.userCode,
-    approvalUrl: pending.approvalUrl,
-    minutesLeft: Math.max(1, Math.floor((pending.expiresAt - Date.now()) / 6e4)),
-    purpose: `sign this terminal in as ${ctx.email}`
-  }, ctx.options);
-  ctx.out.error("");
-  const stopReminder = approvalReminder(ctx.out, pending);
-  try {
-    return await (0, import_db.collectToken)({
-      endpoint: ctx.cfg.platformUrl,
-      deviceCode: pending.deviceCode,
-      expiresAt: pending.expiresAt,
-      interval: pending.interval,
-      waitMs,
-      fetch: ctx.doFetch
-    });
-  } catch (err) {
-    const code = err instanceof import_db.OdlaError ? err.code : void 0;
-    if (code === "handshake_pending") throw stillPending(pending, ctx.email);
-    if (code === "handshake_expired" || code === "handshake_timeout") {
-      clearPendingHandshake(ctx.pendingFile);
-      ctx.out.error("auth: pending handshake lapsed unapproved; starting a fresh one");
-      return null;
-    }
-    if (code === "handshake_denied") clearPendingHandshake(ctx.pendingFile);
-    throw err;
-  } finally {
-    stopReminder();
-  }
-}
 async function freshHandshake(ctx, waitMs) {
   let started;
   let stopReminder;
@@ -505,7 +440,6 @@ async function freshHandshake(ctx, waitMs) {
           projectIds: ctx.grantIntent.projectIds,
           optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities
         };
-        writePendingHandshake(ctx.pendingFile, started);
         await presentHandshakeApproval(ctx.out, {
           userCode,
           approvalUrl,
@@ -541,7 +475,7 @@ function projectAgentHandle(appId) {
 function stillPending(pending, email) {
   return new import_db.OdlaError(
     "handshake_pending",
-    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,
+    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}; if this command exits, re-run it to request a new code`,
     { retryable: true }
   );
 }
@@ -4911,28 +4845,31 @@ async function smoke(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const env = resolveEnv(cfg, options.env);
-  const credentials = readCredentials(cfg.local.credentialsFile);
-  if (!credentials) {
+  const runtime = options.runtime === true;
+  const credentials = runtime ? null : readCredentials(cfg.local.credentialsFile);
+  if (!runtime && !credentials) {
     throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
   }
-  if (credentials.appId !== cfg.app.id) {
+  if (credentials && credentials.appId !== cfg.app.id) {
     throw new Error(`local credentials are for app "${credentials.appId}", but config app is "${cfg.app.id}"`);
   }
-  const entry = credentials.envs[env];
-  if (!entry?.tenantId) {
+  const entry = credentials?.envs[env];
+  if (!runtime && !entry?.tenantId) {
     throw new Error(`local credentials have no tenant for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const hasDb = cfg.services.includes("db");
   const hasO11y = cfg.services.includes("o11y");
-  if (hasDb && !entry.dbKey) {
+  if (!runtime && hasDb && !entry?.dbKey) {
     throw new Error(`local credentials have no db key for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
-  if (hasO11y && !entry.o11yToken) {
+  if (!runtime && hasO11y && !entry?.o11yToken) {
     throw new Error(`local credentials have no o11y token for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const doFetch = options.fetch ?? fetch;
+  const tenantId = entry?.tenantId ?? resolveTenant(cfg, env).tenant;
   out.log(`smoke: ${cfg.app.id}/${env}`);
-  out.log(`  tenant: ${entry.tenantId}`);
+  out.log(`  mode: ${runtime ? "runtime (Worker-held credentials)" : "local credentials"}`);
+  out.log(`  tenant: ${tenantId}`);
   const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
   out.log(`  public-config: ok`);
   if (cfg.services.includes("ai") && cfg.ai?.provider) {
@@ -4946,7 +4883,7 @@ async function smoke(options) {
     if (mode !== "hosted") throw new Error(`ai mode mismatch: expected "hosted", public-config has "${String(mode ?? "none")}"`);
     out.log("  ai: hosted");
   }
-  if (hasO11y) out.log(`  o11y: credentials present`);
+  if (hasO11y) out.log(runtime ? `  o11y: Worker-held credential` : `  o11y: credentials present`);
   if (cfg.services.includes("calendar")) {
     const token = await getDeveloperToken(
       cfg,
@@ -4965,10 +4902,10 @@ async function smoke(options) {
     out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
   const database = await resolveDatabaseConfig(cfg);
-  if (hasDb) {
+  if (hasDb && !runtime) {
     const expectedSchema = database.schema;
     const expectedEntities = serializedEntities(expectedSchema);
-    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
+    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, entry.dbKey);
     const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
     const liveEntities = serializedEntities(liveSchema);
     if (expectedEntities.length) {
@@ -4978,7 +4915,7 @@ async function smoke(options) {
     out.log(`  schema: ${liveEntities.length} entities`);
     const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
     if (aggregateEntity) {
-      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/aggregate`, entry.dbKey, {
         ns: aggregateEntity,
         aggregate: { count: true }
       });
@@ -4987,9 +4924,20 @@ async function smoke(options) {
     } else {
       out.log(`  aggregate: skipped (schema has no entities)`);
     }
+  } else if (hasDb) {
+    out.log(`  db: Worker-held credential (direct schema/aggregate skipped)`);
   } else {
     out.log(`  db: skipped (not enabled)`);
   }
+  if (runtime) {
+    const link = cfg.links?.[env];
+    if (!link) throw new Error(`runtime smoke requires links.${env} in odla.config.mjs`);
+    const res = await doFetch(link, { redirect: "manual" });
+    if (res.status < 200 || res.status >= 500) {
+      throw new Error(`runtime target ${new URL(link).origin} returned ${res.status}`);
+    }
+    out.log(`  runtime target: ${res.status}`);
+  }
   const probes = database.integrations.flatMap(
     (integration) => (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe }))
   );
@@ -5192,10 +5140,11 @@ async function projectCommand(command, parsed, deps) {
     return true;
   }
   if (command === "smoke") {
-    assertArgs(parsed, ["config", "env", "token", "email", "open"], 1);
+    assertArgs(parsed, ["config", "env", "runtime", "token", "email", "open"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       env: stringOpt(parsed.options.env),
+      runtime: parsed.options.runtime === true,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
       open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
@@ -8970,6 +8919,7 @@ Usage:
   odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
   odla-ai bug report --app <id> --title <t> (--description <text>|--body <text>) [--severity <s>] [--json]
   odla-ai pm <goal|task|decision|bug> get <id> [--json]
+  odla-ai pm <goal|task|decision|bug> link <id> [--json]
   odla-ai pm <goal|task|decision|bug> ref <id> [--json]
   odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
   odla-ai pm task set <id> [--title <t>|--column <backlog|ready|doing|review|done>|--rank <n>|--goal <id>|--no-goal|--alignment-decision <id>|--no-alignment-decision|--execution <human|agent|either>|--assignee <id>|--no-assignee|--description <text>|--body <text>|--acceptance <text>|--no-acceptance|--due <epoch-ms>|--no-due|--expected-revision <n>] [--mutation-id <id>] [--json]
@@ -9038,7 +8988,7 @@ Usage:
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
   odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--runtime] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
@@ -9140,7 +9090,7 @@ Commands:
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
                no edit to the dev-first envs list is required.
-  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
+  smoke        Verify local service access, or use --runtime for a Worker-held credential deployment.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
@@ -9180,12 +9130,11 @@ Safety:
   attempts to open it \u2014 including in CI, SSH, display-less, and agent-driven
   shells. Only --no-open suppresses the attempt. Browser launch is best-effort:
   agents with browser control must open that exact URL immediately; otherwise
-  they must give it to the human verbatim. A started handshake is persisted
-  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
-  the same code. Outside an interactive terminal the wait is capped (90s by
+  they must give it to the human verbatim. A device code remains only in the
+  running process. Outside an interactive terminal the wait is capped (90s by
   default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: open the same URL (or relay it if browser control is unavailable),
-  wait for approval, and re-run to collect.
+  with code 75. Rerunning always requests and opens a new code; older clients'
+  persisted pending state is discarded.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. It is the email shown by the signed-in odla account \u2014 never infer it
@@ -9836,9 +9785,25 @@ function referenceMarkup(entity, record10) {
   const label = (record10.title?.trim() || `${entity} ${record10.id}`).replaceAll("]", ")");
   return `@[${label}](pm:${entity}/${record10.id})`;
 }
+var STUDIO_SECTION = {
+  goal: "goals",
+  task: "board",
+  decision: "decisions",
+  bug: "bugs"
+};
+function studioRecordUrl(ctx, entity, id) {
+  return new URL(
+    `/studio/pm/${STUDIO_SECTION[entity]}/${encodeURIComponent(id)}`,
+    ctx.platformUrl
+  ).href;
+}
+function studioRecordLink(ctx, entity, record10) {
+  const label = (record10.title?.trim() || `${entity} ${record10.id}`).replaceAll("]", ")");
+  return `[${label}](${studioRecordUrl(ctx, entity, record10.id)})`;
+}
 function printRecord(ctx, entity, record10) {
   ctx.out.log(
-    `${record10.id}	[${statusCol(entity, record10)}]	${record10.appId}	${record10.title ?? ""}`
+    `${record10.id}	[${statusCol(entity, record10)}]	${record10.appId}	${studioRecordLink(ctx, entity, record10)}`
   );
 }
 function emit2(ctx, value2, human) {
@@ -9888,7 +9853,8 @@ async function pmAdd(ctx, entity, parsed) {
     input,
     mutationId: writeMutationId2(parsed)
   });
-  emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
+  const record10 = { id: res.id, appId, title: String(input.title) };
+  emit2(ctx, res, () => ctx.out.log(`created ${entity}: ${studioRecordLink(ctx, entity, record10)}`));
 }
 async function pmGet(ctx, entity, id) {
   const { record: record10 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
@@ -9913,7 +9879,10 @@ async function pmSet(ctx, entity, id, parsed) {
     patch: patch2,
     mutationId: writeMutationId2(parsed)
   });
-  emit2(ctx, res, () => ctx.out.log(res.record ? `${res.record.id}	[${statusCol(entity, res.record)}]	${res.record.appId}	${res.record.title ?? ""}` : `updated ${entity} ${id}`));
+  emit2(ctx, res, () => {
+    if (!res.record) return ctx.out.log(`updated ${entity} ${id}`);
+    ctx.out.log(`${entity}: ${studioRecordLink(ctx, entity, res.record)} \u2192 ${statusCol(entity, res.record)}`);
+  });
 }
 async function pmDone(ctx, entity, id, parsed) {
   const decisionId = stringOpt(parsed.options.decision);
@@ -9923,7 +9892,11 @@ async function pmDone(ctx, entity, id, parsed) {
     patch: patch2,
     mutationId: writeMutationId2(parsed)
   });
-  emit2(ctx, res, () => ctx.out.log(`${entity} ${id} \u2192 done`));
+  emit2(ctx, res, () => {
+    const label = res.record ? studioRecordLink(ctx, entity, res.record) : id;
+    const state2 = res.record ? statusCol(entity, res.record) : "done";
+    ctx.out.log(`${entity}: ${label} \u2192 ${state2}`);
+  });
 }
 async function pmTaskLifecycle(ctx, id, action2, parsed) {
   const rawRevision = stringOpt(parsed.options["expected-revision"]);
@@ -9952,7 +9925,8 @@ async function pmTaskLifecycle(ctx, id, action2, parsed) {
   );
   emit2(ctx, res, () => {
     const state2 = res.record ? statusCol("task", res.record) : action2;
-    ctx.out.log(`task ${id} \u2192 ${state2}`);
+    const label = res.record ? studioRecordLink(ctx, "task", res.record) : id;
+    ctx.out.log(`task: ${label} \u2192 ${state2}`);
   });
 }
 async function allRecords(ctx, entity, appId) {
@@ -10049,6 +10023,20 @@ async function pmRemove(ctx, entity, id) {
   ctx.out.log(`deleted ${entity} ${id}`);
 }
 
+// src/pm-links.ts
+async function pmLink(ctx, entity, id) {
+  const { record: record10 } = await pmRequest(
+    ctx,
+    "GET",
+    `/${entity}/${encodeURIComponent(id)}`
+  );
+  const url = studioRecordUrl(ctx, entity, record10.id);
+  const markdown = studioRecordLink(ctx, entity, record10);
+  emit2(ctx, { kind: entity, id: record10.id, label: record10.title ?? "", url, markdown }, () => {
+    ctx.out.log(markdown);
+  });
+}
+
 // src/pm-comments.ts
 async function pmComment(ctx, entity, id, parsed) {
   const body = stringOpt(parsed.options.body);
@@ -10296,6 +10284,7 @@ var ACTION_OPTIONS = {
   ready: ["goal", "alignment-decision", "execution", "description", "desc", "body", "acceptance", "expected-revision", "mutation-id"],
   claim: ["expected-revision", "mutation-id"],
   release: ["expected-revision", "mutation-id"],
+  link: [],
   ref: []
 };
 var ENTITY_OPTIONS = {
@@ -10400,7 +10389,7 @@ async function pmCommand(parsed, deps = {}) {
   if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm bug list" (goal|task|decision|bug).`);
   const requestedAction = parsed.positionals[2] ?? "list";
   const action2 = canonicalAction(requestedAction);
-  if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
+  if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|link|ref|comment|comments|rm.`);
   assertArgs(parsed, allowedOptions(entity, action2), 4);
   if ((action2 === "ready" || action2 === "claim" || action2 === "release") && entity !== "task") {
     throw new Error(`pm ${action2} is only valid for tasks`);
@@ -10424,6 +10413,8 @@ async function pmCommand(parsed, deps = {}) {
       return pmComments(ctx, entity, requireId2(id, action2));
     case "rm":
       return pmRemove(ctx, entity, requireId2(id, action2));
+    case "link":
+      return pmLink(ctx, entity, requireId2(id, action2));
     case "ref":
       return pmReference(ctx, entity, requireId2(id, action2));
     case "ready":