@odla-ai/cli 0.30.0 → 0.30.2

package/dist/index.d.cts

@@ -594,9 +594,8 @@ interface ProvisionOptions {
      * true records an explicit request; false is the only production suppression. */
     open?: boolean;
     /** Cap the handshake-approval wait, in seconds. When it elapses the command
-     * exits with the pending handshake persisted; rerunning resumes it. Defaults
-     * to the handshake's own expiry on an interactive terminal and 90 seconds
-     * everywhere else (agent tool shells kill long-running commands). */
+     * exits pending; rerunning requests a new code. Defaults to the handshake's
+     * own expiry on an interactive terminal and 90 seconds everywhere else. */
     wait?: number;
     /** Test/embedding override for opening the approval URL. Defaults to the OS browser opener. */
     openApprovalUrl?: (url: string) => Promise<void>;
@@ -629,6 +628,8 @@ interface ProvisionPlan {
 interface SmokeOptions {
     configPath: string;
     env?: string;
+    /** Verify the deployed Worker without reading local db/o11y credentials. */
+    runtime?: boolean;
     /** Developer-token override used only for owner-visible calendar health. */
     token?: string;
     /** Existing odla account email used only when a fresh device handshake is required. */
@@ -1255,10 +1256,10 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  * Verify a live, already-provisioned environment end-to-end. Resolves the target
  * env (`options.env`, else `dev`, else the first declared env). Explicit `prod`
  * remains addressable after one-shot `provision --live` even when ordinary
- * provision defaults stay dev-only. Reads the local credentials file and checks
- * that it belongs to this app and holds the credentials required by the enabled
- * services — otherwise it throws pointing the user at
- * `odla-ai provision --write-dev-vars`.
+ * provision defaults stay dev-only. Local mode reads the private service
+ * credentials and performs direct db checks. `runtime` mode never reads those
+ * values: it verifies Registry state, the deployed Worker link, anonymous
+ * integration probes, and owner-visible calendar health instead.
  *
  * It then makes service-aware network calls: fetches the registry public-config
  * (and, when `ai.provider` is configured, asserts the live provider matches);

package/dist/index.d.ts

@@ -594,9 +594,8 @@ interface ProvisionOptions {
      * true records an explicit request; false is the only production suppression. */
     open?: boolean;
     /** Cap the handshake-approval wait, in seconds. When it elapses the command
-     * exits with the pending handshake persisted; rerunning resumes it. Defaults
-     * to the handshake's own expiry on an interactive terminal and 90 seconds
-     * everywhere else (agent tool shells kill long-running commands). */
+     * exits pending; rerunning requests a new code. Defaults to the handshake's
+     * own expiry on an interactive terminal and 90 seconds everywhere else. */
     wait?: number;
     /** Test/embedding override for opening the approval URL. Defaults to the OS browser opener. */
     openApprovalUrl?: (url: string) => Promise<void>;
@@ -629,6 +628,8 @@ interface ProvisionPlan {
 interface SmokeOptions {
     configPath: string;
     env?: string;
+    /** Verify the deployed Worker without reading local db/o11y credentials. */
+    runtime?: boolean;
     /** Developer-token override used only for owner-visible calendar health. */
     token?: string;
     /** Existing odla account email used only when a fresh device handshake is required. */
@@ -1255,10 +1256,10 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  * Verify a live, already-provisioned environment end-to-end. Resolves the target
  * env (`options.env`, else `dev`, else the first declared env). Explicit `prod`
  * remains addressable after one-shot `provision --live` even when ordinary
- * provision defaults stay dev-only. Reads the local credentials file and checks
- * that it belongs to this app and holds the credentials required by the enabled
- * services — otherwise it throws pointing the user at
- * `odla-ai provision --write-dev-vars`.
+ * provision defaults stay dev-only. Local mode reads the private service
+ * credentials and performs direct db checks. `runtime` mode never reads those
+ * values: it verifies Registry state, the deployed Worker link, anonymous
+ * integration probes, and owner-visible calendar health instead.
  *
  * It then makes service-aware network calls: fetches the registry public-config
  * (and, when `ai.provider` is configured, asserts the live provider matches);

package/dist/index.js

@@ -56,7 +56,7 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-PPSXHZJI.js";
+} from "./chunk-3HFNKDZV.js";
 import {
   exitCodeFor,
   redactSecrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.30.0",
+  "version": "0.30.2",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and connection lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",

package/skills/odla/SKILL.md

@@ -113,9 +113,8 @@ guessing which platform/credential steps need manual work. Then:
    control, open that exact URL now.** If you do not, give it to the human
    verbatim; never wait silently or start a substitute handshake. Outside an
    interactive terminal the wait is capped (90s default,
-   `--wait <seconds>`); exit code 75 means still pending: the handshake is
-   persisted, so once the human approves, re-run the same command and it
-   resumes the same code and collects the token. It creates the app,
+   `--wait <seconds>`); exit code 75 means still pending. The device code is
+   not cached: rerunning always opens a fresh code for human review. It creates the app,
    consuming a one-time exact-id reservation when the approved app is new,
    enables services, issues or reuses configured credentials (db key + o11y
    ingest token when enabled), composes declared integration schema/rules and
@@ -280,7 +279,10 @@ If approval is not available, comment on the runbook instead so an admin can fix
 it later.
 
 `npx @odla-ai/cli doctor` is an offline config check anytime;
-`npx @odla-ai/cli smoke --env dev` verifies a live deployment.
+`npx @odla-ai/cli smoke --env dev` verifies a live deployment from local
+service credentials. After `provision --push-secrets`, use
+`npx @odla-ai/cli smoke --env dev --runtime`; it verifies the Worker and
+anonymous integration routes without retrieving its db/o11y secrets.
 Use `calendar status --json` for safe connection state (`bookable`, booking
 and availability calendars) and `calendar calendars --json` to discover ids
 after consent; update checked-in config and re-provision. Disconnect always

package/skills/odla/references/pm-work-intake.md

@@ -81,10 +81,19 @@ do not retry with a guessed revision. Once claimed, use the repository's
 worktree procedure and mention the PM references in the execution chat:
 
 ```text
-@[Task title](pm:task/<task-id>)
-@[Goal title](pm:goal/<goal-id>)
+[Task title](https://odla.ai/studio/pm/board/<task-id>)
+[Goal title](https://odla.ai/studio/pm/goals/<goal-id>)
 ```
 
+In user-facing chat, a UUID is never the record's label. Name the type and title
+as a Markdown link to Studio, then add the state, consequence, or next action. A
+useful handoff says, for example, `Ready task: [Replace UUID-only PM
+handoffs](https://odla.ai/studio/pm/board/<task-id>) — ready to claim`, not
+`Ready task: <task-id>`. When several records are related, explain that
+relationship instead of returning an id inventory. Create and lifecycle
+commands print the title-first link directly; `pm ... link <id>` reproduces it
+later. Reserve `pm ... ref <id>` for structured odla Discussion markup.
+
 ## 5. Execute, review, and complete
 
 - Keep the task description/acceptance criteria current under its revision.

package/skills/odla/references/pm.md

@@ -188,6 +188,41 @@ npx @odla-ai/cli pm task comments <task-id>
 Use `pm:task`, `pm:goal`, `pm:decision`, `pm:bug`, and `pm:runbook`. The message
 is communication; the referenced PM row remains the lifecycle authority.
 
+### Human-readable handoffs
+
+A PM id is an implementation handle, not a useful description of work. In every
+chat update, final response, review request, or handoff, lead with the record's
+type and title as an ordinary Markdown link to its Studio record, then say what
+happened or what the recipient should do. The UUID belongs in the link target,
+not in the prose. Typed `pm:*` references are for odla Discussion, where they
+render as PM chips; do not expose that internal markup in ordinary chat.
+
+Do not write:
+
+```text
+Accepted decision: 019fd392-1217-754c-a61d-3b0470bcd269
+Ready task: 019fd392-dd02-7312-86d6-d255c5a983e7
+Backup bug: 20f38d3d-7c02-54b5-8e33-f8b82e4ab125
+```
+
+Write a compact semantic handoff instead:
+
+```text
+Accepted decision: [Keep the legacy fallback through migration](https://odla.ai/studio/pm/decisions/<decision-id>) — rules out deleting it before production evidence is clean.
+Ready task: [Replace UUID-only PM handoffs](https://odla.ai/studio/pm/board/<task-id>) — implementation is bounded and ready to claim.
+Tracked bug: [PM create output hides the record title](https://odla.ai/studio/pm/bugs/<bug-id>) — retained if the task does not cover every output path.
+```
+
+The CLI reinforces this convention: successful creates and lifecycle changes
+print title-first, copy-ready links, such as
+`created bug: [Checkout 500s on retry](https://odla.ai/studio/pm/bugs/<bug-id>)`
+and `decision: [Keep the fallback](https://odla.ai/studio/pm/decisions/<decision-id>)
+→ accepted`. Use `pm ... link <id>` to regenerate an ordinary Markdown link
+later; use `pm ... ref <id>` only for structured odla Discussion markup.
+Summarize the relationship between records instead of merely listing them; PM
+contains the detail, while chat should make the state and next action
+understandable before the recipient follows a link.
+
 In Studio, open any PM item and choose **Discuss** to open the owning project's
 Discussion composer with the same stable reference already inserted. The draft
 is retained in the URL across reload/back navigation but is not a write: review,