@odla-ai/cli 0.30.3 → 0.31.1

package/README.md

@@ -96,7 +96,10 @@ app is registered, start each session with the read-only aligned-work intake,
 then read open bugs and recent decisions:
 
 ```bash
-npx odla-ai pm next --app <appId>
+npx odla-ai pm project list --app <productId>
+npx odla-ai pm project add --app <productId> --name "My project"
+npx odla-ai pm project use <projectId>
+npx odla-ai pm next --app <appId> --project <projectId>
 npx odla-ai pm handoff --app <appId>
 npx odla-ai pm watch --app <appId> --entity task --jsonl
 npx odla-ai pm bug list --app <appId> --status open

package/dist/bin.cjs

@@ -233,7 +233,7 @@ var init_approval_prompt = __esm({
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? import_node_process.default.platform);
   const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve14, reject) => {
+  await new Promise((resolve15, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -241,7 +241,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve14();
+      resolve15();
     });
   });
 }
@@ -570,7 +570,7 @@ async function freshHandshake(ctx, waitMs) {
   } catch (err) {
     const code = err instanceof import_db.OdlaError ? err.code : void 0;
     if (code === "handshake_pending" && started) throw stillPending(started, ctx.email);
-    if (code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
+    if (code === "handshake_duplicate" || code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
       clearPendingHandshake(ctx.pendingFile);
     }
     throw err;
@@ -2921,8 +2921,8 @@ var init_calendar_http = __esm({
 // src/calendar-poll.ts
 async function waitForCalendarPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
-  await new Promise((resolve14, reject) => {
-    const timer = setTimeout(resolve14, milliseconds);
+  await new Promise((resolve15, reject) => {
+    const timer = setTimeout(resolve15, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new Error("calendar connection aborted"));
@@ -3694,7 +3694,7 @@ async function configOperationWait(options) {
   assertOperationId(options.operationId);
   const cfg = await loadProjectConfig(options.configPath);
   const client = await operationClient(cfg, options, "wait");
-  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
+  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve15) => setTimeout(resolve15, ms)));
   const now = () => (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
   const deadline = now() + (options.timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3;
   const interval = (options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS) * 1e3;
@@ -8802,8 +8802,8 @@ function hostedPollTimeout(value2 = 10 * 6e4) {
 }
 async function waitForHostedPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
-  await new Promise((resolve14, reject) => {
-    const timer = setTimeout(resolve14, milliseconds);
+  await new Promise((resolve15, reject) => {
+    const timer = setTimeout(resolve15, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new DOMException("aborted", "AbortError"));
@@ -9593,13 +9593,16 @@ Usage:
   odla-ai app rename <name>                                            [continue in Studio; human session required]
   odla-ai app owners <list|add|remove> [...]                            [continue in Studio; human session required]
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
-  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm project list [--app <product-id>] [--status <s>] [--json]
+  odla-ai pm project add --app <product-id> --name <name> [--description <text>] [--json]
+  odla-ai pm project use <project-id> [--json]                         [saved locally in this worktree]
+  odla-ai pm goal list [--app <id>] [--project <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
   odla-ai pm task add --app <id> --title <t> [--column <backlog|ready|doing|review|done>] [--goal <id>|--alignment-decision <id>] [--assignee <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
-  odla-ai pm next --app <id> [--json]
+  odla-ai pm next --app <id> [--project <id>] [--json]
   odla-ai pm watch --app <id> [--cursor <cursor>] [--entity goal|task|decision|bug] [--action created|updated|deleted|comment.created|comment.updated] [--state <state>] [--by <principalId>] [--self <principalId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
   odla-ai pm task ready <id> --expected-revision <n> [--goal <id>|--alignment-decision <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--mutation-id <id>] [--json]
   odla-ai pm task claim <id> --expected-revision <n> [--mutation-id <id>] [--json]
@@ -9619,7 +9622,7 @@ Usage:
   odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
   odla-ai pm <goal|task|decision|bug> comments <id> [--json]
   odla-ai pm <goal|task|decision|bug> rm <id>
-  odla-ai pm handoff --app <id> [--json]
+  odla-ai pm handoff --app <id> [--project <id>] [--json]
   odla-ai discuss groups [--json]
   odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
   odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
@@ -9754,13 +9757,12 @@ Commands:
   code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  pm           Project management (via @odla-ai/pm) shared across the apps you
-               co-own: conformance goals, kanban tasks, decisions, and bugs. With
-               no --app, "list" spans every co-owned project (the cross-project
-               view); with --app it scopes to one. Same device-grant auth as
-               "app". Entities: goal (alias conformance), task (alias kanban),
-               decision, bug. Status changes and comments post to each item's
-               @odla-ai/chat discussion thread.
+  pm           Project management (via @odla-ai/pm): Products contain Projects;
+               projects contain goals, kanban tasks, decisions, and bugs. Use
+               "pm project list|add|use" to select worktree-local context, or
+               pass --app/--project explicitly. Same device-grant auth as "app".
+               Status changes and comments post to each item's @odla-ai/chat
+               discussion thread.
   bug          Intent-first alias for PM bugs. "bug report" writes to
                odla PM; odla product defects do not belong in GitHub Issues.
   discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
@@ -10202,7 +10204,7 @@ function jsonl(ctx, parsed, value2) {
 }
 async function discussWatch(ctx, topicId, parsed) {
   if (ctx.json && parsed.options.jsonl === true) throw new Error("--json and --jsonl cannot be combined");
-  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve15) => setTimeout(resolve15, ms)));
   const now = ctx.now ?? Date.now;
   const intervalMs = (numberOpt2(parsed, "interval", DEFAULT_INTERVAL_MS / 1e3) ?? DEFAULT_INTERVAL_MS / 1e3) * 1e3;
   const timeoutSeconds = numberOpt2(parsed, "timeout");
@@ -10584,6 +10586,8 @@ async function pmList(ctx, entity, parsed) {
   };
   const app = stringOpt(parsed.options.app) ?? ctx.appId;
   if (app) q.set("app", app);
+  const project = stringOpt(parsed.options.project) ?? ctx.projectId;
+  if (project) q.set("project", project);
   for (const [flag, param] of Object.entries(filters)) {
     const raw = stringOpt(parsed.options[flag]);
     const v = entity === "task" && flag === "column" && raw === "ready" ? "todo" : raw;
@@ -10603,6 +10607,7 @@ async function pmList(ctx, entity, parsed) {
 }
 async function pmAdd(ctx, entity, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
   if (!appId) throw new Error("pm add needs --app <appId>");
   const input = collectEntityFields(entity, parsed, false);
   if (!input.title) throw new Error("pm add needs --title <title>");
@@ -10610,6 +10615,7 @@ async function pmAdd(ctx, entity, parsed) {
     throw new Error("pm bug add needs --description <context> (or --body <context>)");
   const res = await pmRequest(ctx, "POST", `/${entity}`, {
     appId,
+    ...projectId ? { projectId } : {},
     input,
     mutationId: writeMutationId2(parsed)
   });
@@ -10689,7 +10695,7 @@ async function pmTaskLifecycle(ctx, id, action2, parsed) {
     ctx.out.log(`task: ${label} \u2192 ${state2}`);
   });
 }
-async function allRecords(ctx, entity, appId) {
+async function allRecords(ctx, entity, appId, projectId) {
   const records = [];
   for (; ; ) {
     const q = new URLSearchParams({
@@ -10697,6 +10703,7 @@ async function allRecords(ctx, entity, appId) {
       limit: "100",
       offset: String(records.length)
     });
+    if (projectId) q.set("project", projectId);
     const page2 = await pmRequest(ctx, "GET", `/${entity}?${q}`);
     records.push(...page2.records);
     if (records.length >= page2.total || page2.records.length === 0) return records;
@@ -10704,13 +10711,15 @@ async function allRecords(ctx, entity, appId) {
 }
 async function pmNext(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
   if (!appId) throw new Error("pm next needs --app <appId>");
   const [goals, tasks] = await Promise.all([
-    allRecords(ctx, "goal", appId),
-    allRecords(ctx, "task", appId)
+    allRecords(ctx, "goal", appId, projectId),
+    allRecords(ctx, "task", appId, projectId)
   ]);
   const result = {
     appId,
+    projectId,
     openGoals: goals.filter((record10) => record10.status === "open"),
     doing: tasks.filter((record10) => record10.column === "doing"),
     ready: tasks.filter((record10) => record10.column === "todo")
@@ -10741,14 +10750,16 @@ async function pmNext(ctx, parsed) {
 }
 async function pmHandoff(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
   if (!appId) throw new Error("pm handoff needs --app <appId>");
   const [goals, tasks, bugs] = await Promise.all([
-    allRecords(ctx, "goal", appId),
-    allRecords(ctx, "task", appId),
-    allRecords(ctx, "bug", appId)
+    allRecords(ctx, "goal", appId, projectId),
+    allRecords(ctx, "task", appId, projectId),
+    allRecords(ctx, "bug", appId, projectId)
   ]);
   const handoff = {
     appId,
+    projectId,
     unmetGoals: goals.filter((record10) => record10.status !== "met"),
     activeTasks: tasks.filter((record10) => record10.column !== "done"),
     openBugs: bugs.filter((record10) => record10.status !== "fixed" && record10.status !== "wontfix")
@@ -10940,7 +10951,7 @@ async function pmWatch(ctx, parsed) {
   }
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("pm watch needs --app <appId>");
-  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve15) => setTimeout(resolve15, ms)));
   const now = ctx.now ?? Date.now;
   const intervalMs = (positiveNumber(parsed, "interval", DEFAULT_INTERVAL_MS2 / 1e3) ?? DEFAULT_INTERVAL_MS2 / 1e3) * 1e3;
   const timeoutSeconds = positiveNumber(parsed, "timeout");
@@ -11061,6 +11072,73 @@ var init_pm_watch = __esm({
   }
 });
 
+// src/pm-project-context.ts
+function readPmProjectContext(rootDir) {
+  const value2 = readJsonFile(pmProjectContextFile(rootDir));
+  return value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" ? value2 : null;
+}
+function writePmProjectContext(rootDir, value2) {
+  writePrivateJson(pmProjectContextFile(rootDir), { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() });
+}
+var import_node_path17, pmProjectContextFile;
+var init_pm_project_context = __esm({
+  "src/pm-project-context.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_path17 = require("path");
+    init_local();
+    pmProjectContextFile = (rootDir) => (0, import_node_path17.resolve)(rootDir, ".odla", "pm-project.local.json");
+  }
+});
+
+// src/pm-project-actions.ts
+async function pmProjectList(ctx, parsed) {
+  const q = new URLSearchParams();
+  const app = stringOpt(parsed.options.app) ?? ctx.appId;
+  if (app) q.set("app", app);
+  for (const key of ["status", "limit", "offset"]) {
+    const value2 = stringOpt(parsed.options[key]);
+    if (value2) q.set(key, value2);
+  }
+  const page2 = await pmRequest(ctx, "GET", `/project?${q}`);
+  emit2(ctx, page2, () => {
+    ctx.out.log(`projects \u2014 ${page2.records.length} of ${page2.total}`);
+    ctx.out.log("id	status	product	name");
+    for (const project of page2.records) {
+      ctx.out.log(`${project.id}	${project.status}	${project.appId}	${project.name}${project.isDefault ? " (default)" : ""}`);
+    }
+  });
+}
+async function pmProjectAdd(ctx, parsed) {
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const name = stringOpt(parsed.options.name);
+  if (!appId) throw new Error("pm project add needs --app <productId>");
+  if (!name) throw new Error("pm project add needs --name <name>");
+  const result = await pmRequest(ctx, "POST", "/project", {
+    appId,
+    name,
+    description: stringOpt(parsed.options.description),
+    mutationId: writeMutationId2(parsed)
+  });
+  emit2(ctx, result, () => ctx.out.log(`created project: ${result.project.name} (${result.project.id})`));
+}
+async function pmProjectUse(ctx, id) {
+  if (!ctx.rootDir) throw new Error("pm project use needs a local project directory");
+  const { project } = await pmRequest(ctx, "GET", `/project/${encodeURIComponent(id)}`);
+  if (project.status !== "active") throw new Error(`project ${project.name} is ${project.status}, not active`);
+  writePmProjectContext(ctx.rootDir, { appId: project.appId, projectId: project.id });
+  emit2(ctx, project, () => ctx.out.log(`using ${project.appId} / ${project.name} (${project.id}) in this worktree`));
+}
+var init_pm_project_actions = __esm({
+  "src/pm-project-actions.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_argv();
+    init_pm_action_core();
+    init_pm_project_context();
+  }
+});
+
 // src/pm-command.ts
 function canonicalAction(action2) {
   if (action2 === "create") return "add";
@@ -11095,6 +11173,9 @@ async function buildContext2(parsed, deps) {
     doFetch,
     out
   );
+  const selectedProject = readPmProjectContext(cfg.rootDir);
+  const requestedApp = stringOpt(parsed.options.app) ?? (context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0);
+  const compatibleProject = selectedProject && (!requestedApp || selectedProject.appId === requestedApp) ? selectedProject : null;
   return {
     platformUrl: cfg.platformUrl,
     token,
@@ -11103,15 +11184,33 @@ async function buildContext2(parsed, deps) {
     json: parsed.options.json === true,
     // Preserve PM's existing cross-project default when a config is present;
     // only an explicit remote-agent environment or profile selects an app.
-    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0,
+    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : compatibleProject?.appId,
+    projectId: compatibleProject?.projectId,
+    rootDir: cfg.rootDir,
     ...deps.sleep ? { sleep: deps.sleep } : {},
     ...deps.now ? { now: deps.now } : {}
   };
 }
 async function pmCommand(parsed, deps = {}) {
   const word = parsed.positionals[1] ?? "";
+  if (word === "project") {
+    const action3 = parsed.positionals[2] ?? "list";
+    if (action3 === "list") {
+      assertArgs(parsed, [...COMMON_OPTIONS, "app", "status", "limit", "offset"], 3);
+      return pmProjectList(await buildContext2(parsed, deps), parsed);
+    }
+    if (action3 === "add" || action3 === "create") {
+      assertArgs(parsed, [...COMMON_OPTIONS, "app", "name", "description", "mutation-id"], 3);
+      return pmProjectAdd(await buildContext2(parsed, deps), parsed);
+    }
+    if (action3 === "use") {
+      assertArgs(parsed, COMMON_OPTIONS, 4);
+      return pmProjectUse(await buildContext2(parsed, deps), requireId2(parsed.positionals[3], action3));
+    }
+    throw new Error(`unknown pm project action "${action3}". Try list|add|use.`);
+  }
   if (word === "next") {
-    assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
+    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project"], 2);
     return pmNext(await buildContext2(parsed, deps), parsed);
   }
   if (word === "watch") {
@@ -11131,7 +11230,7 @@ async function pmCommand(parsed, deps = {}) {
     return pmWatch(await buildContext2(parsed, deps), parsed).then(() => void 0);
   }
   if (word === "handoff") {
-    assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
+    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project"], 2);
     return pmHandoff(await buildContext2(parsed, deps), parsed);
   }
   const entity = ALIASES[word];
@@ -11184,6 +11283,8 @@ var init_pm_command = __esm({
     init_pm_comments();
     init_token();
     init_pm_watch();
+    init_pm_project_actions();
+    init_pm_project_context();
     ALIASES = {
       goal: "goal",
       conformance: "goal",
@@ -11194,8 +11295,8 @@ var init_pm_command = __esm({
     };
     COMMON_OPTIONS = ["config", "token", "email", "json", "platform", "context", "open"];
     ACTION_OPTIONS = {
-      list: ["app", "q", "limit", "offset"],
-      add: ["app", "title", "mutation-id"],
+      list: ["app", "project", "q", "limit", "offset"],
+      add: ["app", "project", "title", "mutation-id"],
       get: [],
       set: ["mutation-id"],
       done: ["mutation-id"],
@@ -12453,6 +12554,7 @@ var init_surface = __esm({
       },
       pm: {
         ...PM_ENTITIES,
+        project: { list: {}, add: {}, create: {}, use: {} },
         handoff: {},
         next: {},
         watch: {}
@@ -12687,8 +12789,8 @@ function readRunbookDir(dir) {
   const files = (0, import_node_fs19.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path17.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs19.readFileSync)((0, import_node_path17.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path18.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs19.readFileSync)((0, import_node_path18.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -12758,13 +12860,13 @@ async function upsert(ctx, r, visibility) {
   );
   return "updated";
 }
-var import_node_fs19, import_node_path17;
+var import_node_fs19, import_node_path18;
 var init_runbook_import = __esm({
   "src/runbook-import.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs19 = require("fs");
-    import_node_path17 = require("path");
+    import_node_path18 = require("path");
     init_runbook_actions();
   }
 });
@@ -12942,7 +13044,7 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path18.join)(root, workspace, "package.json");
+    const manifest = (0, import_node_path19.join)(root, workspace, "package.json");
     if (!(0, import_node_fs20.existsSync)(manifest)) return void 0;
     try {
       const name = JSON.parse((0, import_node_fs20.readFileSync)(manifest, "utf8")).name;
@@ -13011,7 +13113,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs20.readFileSync)((0, import_node_path18.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs20.readFileSync)((0, import_node_path19.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -13022,14 +13124,14 @@ async function runbookImpact(ctx, options, deps = {}) {
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
   report3(ctx, impacts);
 }
-var import_node_child_process7, import_node_fs20, import_node_path18, SOURCE2, editHint;
+var import_node_child_process7, import_node_fs20, import_node_path19, SOURCE2, editHint;
 var init_runbook_impact = __esm({
   "src/runbook-impact.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process7 = require("child_process");
     import_node_fs20 = require("fs");
-    import_node_path18 = require("path");
+    import_node_path19 = require("path");
     init_runbook_impact_scan();
     init_runbook_actions();
     SOURCE2 = /\.(ts|tsx|js|jsx|mts|cts)$/;
@@ -13198,8 +13300,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs21.mkdtempSync)((0, import_node_path19.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path19.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs21.mkdtempSync)((0, import_node_path20.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path20.join)(dir, `${slug}.md`);
   try {
     (0, import_node_fs21.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -13210,7 +13312,7 @@ function editText(initial, slug, deps = {}) {
     (0, import_node_fs21.rmSync)(dir, { recursive: true, force: true });
   }
 }
-var import_node_child_process8, import_node_fs21, import_node_os5, import_node_path19, import_node_process14, EDITOR_ENV, defaultRunOrInjected;
+var import_node_child_process8, import_node_fs21, import_node_os5, import_node_path20, import_node_process14, EDITOR_ENV, defaultRunOrInjected;
 var init_runbook_editor = __esm({
   "src/runbook-editor.ts"() {
     "use strict";
@@ -13218,7 +13320,7 @@ var init_runbook_editor = __esm({
     import_node_child_process8 = require("child_process");
     import_node_fs21 = require("fs");
     import_node_os5 = require("os");
-    import_node_path19 = require("path");
+    import_node_path20 = require("path");
     import_node_process14 = __toESM(require("process"), 1);
     EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
     defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -13615,9 +13717,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path20.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path20.resolve)(options.out ?? (0, import_node_path20.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path20.relative)(target, output).split(import_node_path20.sep).join("/");
+  const target = (0, import_node_path21.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path21.resolve)(options.out ?? (0, import_node_path21.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path21.relative)(target, output).split(import_node_path21.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -13629,7 +13731,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path20.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path21.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -13647,7 +13749,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path20.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path21.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -13671,7 +13773,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path20.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path21.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -13700,17 +13802,17 @@ function printSummary(out, appId, env, run, report4, output) {
   out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
   if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path20.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path21.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
 }
-var import_node_path20, import_security, import_node3;
+var import_node_path21, import_security, import_node3;
 var init_security = __esm({
   "src/security.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path20 = require("path");
+    import_node_path21 = require("path");
     import_security = require("@odla-ai/security");
     import_node3 = require("@odla-ai/security/node");
     init_config();