@odla-ai/cli 0.30.3 → 0.31.1

package/dist/bin.js

@@ -174,7 +174,7 @@ function absoluteEntryPath(entryPath) {
 
 // src/bin.ts
 var argv = process.argv.slice(2);
-requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-BGSX5Z4C.js")).runCli()).catch((err) => {
+requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-Q2U7TCMV.js")).runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });

package/dist/{chunk-3HFNKDZV.js → chunk-Y3W7YKWI.js}

@@ -62,7 +62,7 @@ import process2 from "process";
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? process2.platform);
   const doSpawn = options.spawnImpl ?? spawn;
-  await new Promise((resolve13, reject) => {
+  await new Promise((resolve14, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -70,7 +70,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve13();
+      resolve14();
     });
   });
 }
@@ -365,7 +365,7 @@ async function freshHandshake(ctx, waitMs) {
   } catch (err) {
     const code = err instanceof OdlaError ? err.code : void 0;
     if (code === "handshake_pending" && started) throw stillPending(started, ctx.email);
-    if (code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
+    if (code === "handshake_duplicate" || code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
       clearPendingHandshake(ctx.pendingFile);
     }
     throw err;
@@ -2470,8 +2470,8 @@ function credential(value2) {
 // src/calendar-poll.ts
 async function waitForCalendarPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
-  await new Promise((resolve13, reject) => {
-    const timer = setTimeout(resolve13, milliseconds);
+  await new Promise((resolve14, reject) => {
+    const timer = setTimeout(resolve14, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new Error("calendar connection aborted"));
@@ -3175,7 +3175,7 @@ async function configOperationWait(options) {
   assertOperationId(options.operationId);
   const cfg = await loadProjectConfig(options.configPath);
   const client = await operationClient(cfg, options, "wait");
-  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
+  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
   const now = () => (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
   const deadline = now() + (options.timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3;
   const interval = (options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS) * 1e3;
@@ -8026,8 +8026,8 @@ function hostedPollTimeout(value2 = 10 * 6e4) {
 }
 async function waitForHostedPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
-  await new Promise((resolve13, reject) => {
-    const timer = setTimeout(resolve13, milliseconds);
+  await new Promise((resolve14, reject) => {
+    const timer = setTimeout(resolve14, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new DOMException("aborted", "AbortError"));
@@ -8774,13 +8774,16 @@ Usage:
   odla-ai app rename <name>                                            [continue in Studio; human session required]
   odla-ai app owners <list|add|remove> [...]                            [continue in Studio; human session required]
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
-  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm project list [--app <product-id>] [--status <s>] [--json]
+  odla-ai pm project add --app <product-id> --name <name> [--description <text>] [--json]
+  odla-ai pm project use <project-id> [--json]                         [saved locally in this worktree]
+  odla-ai pm goal list [--app <id>] [--project <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
   odla-ai pm task add --app <id> --title <t> [--column <backlog|ready|doing|review|done>] [--goal <id>|--alignment-decision <id>] [--assignee <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
-  odla-ai pm next --app <id> [--json]
+  odla-ai pm next --app <id> [--project <id>] [--json]
   odla-ai pm watch --app <id> [--cursor <cursor>] [--entity goal|task|decision|bug] [--action created|updated|deleted|comment.created|comment.updated] [--state <state>] [--by <principalId>] [--self <principalId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
   odla-ai pm task ready <id> --expected-revision <n> [--goal <id>|--alignment-decision <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--mutation-id <id>] [--json]
   odla-ai pm task claim <id> --expected-revision <n> [--mutation-id <id>] [--json]
@@ -8800,7 +8803,7 @@ Usage:
   odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
   odla-ai pm <goal|task|decision|bug> comments <id> [--json]
   odla-ai pm <goal|task|decision|bug> rm <id>
-  odla-ai pm handoff --app <id> [--json]
+  odla-ai pm handoff --app <id> [--project <id>] [--json]
   odla-ai discuss groups [--json]
   odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
   odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
@@ -8933,13 +8936,12 @@ Commands:
   code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  pm           Project management (via @odla-ai/pm) shared across the apps you
-               co-own: conformance goals, kanban tasks, decisions, and bugs. With
-               no --app, "list" spans every co-owned project (the cross-project
-               view); with --app it scopes to one. Same device-grant auth as
-               "app". Entities: goal (alias conformance), task (alias kanban),
-               decision, bug. Status changes and comments post to each item's
-               @odla-ai/chat discussion thread.
+  pm           Project management (via @odla-ai/pm): Products contain Projects;
+               projects contain goals, kanban tasks, decisions, and bugs. Use
+               "pm project list|add|use" to select worktree-local context, or
+               pass --app/--project explicitly. Same device-grant auth as "app".
+               Status changes and comments post to each item's @odla-ai/chat
+               discussion thread.
   bug          Intent-first alias for PM bugs. "bug report" writes to
                odla PM; odla product defects do not belong in GitHub Issues.
   discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
@@ -9346,7 +9348,7 @@ function jsonl(ctx, parsed, value2) {
 }
 async function discussWatch(ctx, topicId, parsed) {
   if (ctx.json && parsed.options.jsonl === true) throw new Error("--json and --jsonl cannot be combined");
-  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
   const now = ctx.now ?? Date.now;
   const intervalMs = (numberOpt2(parsed, "interval", DEFAULT_INTERVAL_MS / 1e3) ?? DEFAULT_INTERVAL_MS / 1e3) * 1e3;
   const timeoutSeconds = numberOpt2(parsed, "timeout");
@@ -9694,6 +9696,8 @@ async function pmList(ctx, entity, parsed) {
   };
   const app = stringOpt(parsed.options.app) ?? ctx.appId;
   if (app) q.set("app", app);
+  const project = stringOpt(parsed.options.project) ?? ctx.projectId;
+  if (project) q.set("project", project);
   for (const [flag, param] of Object.entries(filters)) {
     const raw = stringOpt(parsed.options[flag]);
     const v = entity === "task" && flag === "column" && raw === "ready" ? "todo" : raw;
@@ -9713,6 +9717,7 @@ async function pmList(ctx, entity, parsed) {
 }
 async function pmAdd(ctx, entity, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
   if (!appId) throw new Error("pm add needs --app <appId>");
   const input = collectEntityFields(entity, parsed, false);
   if (!input.title) throw new Error("pm add needs --title <title>");
@@ -9720,6 +9725,7 @@ async function pmAdd(ctx, entity, parsed) {
     throw new Error("pm bug add needs --description <context> (or --body <context>)");
   const res = await pmRequest(ctx, "POST", `/${entity}`, {
     appId,
+    ...projectId ? { projectId } : {},
     input,
     mutationId: writeMutationId2(parsed)
   });
@@ -9799,7 +9805,7 @@ async function pmTaskLifecycle(ctx, id, action2, parsed) {
     ctx.out.log(`task: ${label} \u2192 ${state2}`);
   });
 }
-async function allRecords(ctx, entity, appId) {
+async function allRecords(ctx, entity, appId, projectId) {
   const records = [];
   for (; ; ) {
     const q = new URLSearchParams({
@@ -9807,6 +9813,7 @@ async function allRecords(ctx, entity, appId) {
       limit: "100",
       offset: String(records.length)
     });
+    if (projectId) q.set("project", projectId);
     const page2 = await pmRequest(ctx, "GET", `/${entity}?${q}`);
     records.push(...page2.records);
     if (records.length >= page2.total || page2.records.length === 0) return records;
@@ -9814,13 +9821,15 @@ async function allRecords(ctx, entity, appId) {
 }
 async function pmNext(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
   if (!appId) throw new Error("pm next needs --app <appId>");
   const [goals, tasks] = await Promise.all([
-    allRecords(ctx, "goal", appId),
-    allRecords(ctx, "task", appId)
+    allRecords(ctx, "goal", appId, projectId),
+    allRecords(ctx, "task", appId, projectId)
   ]);
   const result = {
     appId,
+    projectId,
     openGoals: goals.filter((record10) => record10.status === "open"),
     doing: tasks.filter((record10) => record10.column === "doing"),
     ready: tasks.filter((record10) => record10.column === "todo")
@@ -9851,14 +9860,16 @@ async function pmNext(ctx, parsed) {
 }
 async function pmHandoff(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
   if (!appId) throw new Error("pm handoff needs --app <appId>");
   const [goals, tasks, bugs] = await Promise.all([
-    allRecords(ctx, "goal", appId),
-    allRecords(ctx, "task", appId),
-    allRecords(ctx, "bug", appId)
+    allRecords(ctx, "goal", appId, projectId),
+    allRecords(ctx, "task", appId, projectId),
+    allRecords(ctx, "bug", appId, projectId)
   ]);
   const handoff = {
     appId,
+    projectId,
     unmetGoals: goals.filter((record10) => record10.status !== "met"),
     activeTasks: tasks.filter((record10) => record10.column !== "done"),
     openBugs: bugs.filter((record10) => record10.status !== "fixed" && record10.status !== "wontfix")
@@ -10023,7 +10034,7 @@ async function pmWatch(ctx, parsed) {
   }
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("pm watch needs --app <appId>");
-  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
   const now = ctx.now ?? Date.now;
   const intervalMs = (positiveNumber(parsed, "interval", DEFAULT_INTERVAL_MS2 / 1e3) ?? DEFAULT_INTERVAL_MS2 / 1e3) * 1e3;
   const timeoutSeconds = positiveNumber(parsed, "timeout");
@@ -10132,6 +10143,56 @@ async function pmWatch(ctx, parsed) {
   }
 }
 
+// src/pm-project-context.ts
+import { resolve as resolve12 } from "path";
+var pmProjectContextFile = (rootDir) => resolve12(rootDir, ".odla", "pm-project.local.json");
+function readPmProjectContext(rootDir) {
+  const value2 = readJsonFile(pmProjectContextFile(rootDir));
+  return value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" ? value2 : null;
+}
+function writePmProjectContext(rootDir, value2) {
+  writePrivateJson(pmProjectContextFile(rootDir), { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() });
+}
+
+// src/pm-project-actions.ts
+async function pmProjectList(ctx, parsed) {
+  const q = new URLSearchParams();
+  const app = stringOpt(parsed.options.app) ?? ctx.appId;
+  if (app) q.set("app", app);
+  for (const key of ["status", "limit", "offset"]) {
+    const value2 = stringOpt(parsed.options[key]);
+    if (value2) q.set(key, value2);
+  }
+  const page2 = await pmRequest(ctx, "GET", `/project?${q}`);
+  emit2(ctx, page2, () => {
+    ctx.out.log(`projects \u2014 ${page2.records.length} of ${page2.total}`);
+    ctx.out.log("id	status	product	name");
+    for (const project of page2.records) {
+      ctx.out.log(`${project.id}	${project.status}	${project.appId}	${project.name}${project.isDefault ? " (default)" : ""}`);
+    }
+  });
+}
+async function pmProjectAdd(ctx, parsed) {
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const name = stringOpt(parsed.options.name);
+  if (!appId) throw new Error("pm project add needs --app <productId>");
+  if (!name) throw new Error("pm project add needs --name <name>");
+  const result = await pmRequest(ctx, "POST", "/project", {
+    appId,
+    name,
+    description: stringOpt(parsed.options.description),
+    mutationId: writeMutationId2(parsed)
+  });
+  emit2(ctx, result, () => ctx.out.log(`created project: ${result.project.name} (${result.project.id})`));
+}
+async function pmProjectUse(ctx, id) {
+  if (!ctx.rootDir) throw new Error("pm project use needs a local project directory");
+  const { project } = await pmRequest(ctx, "GET", `/project/${encodeURIComponent(id)}`);
+  if (project.status !== "active") throw new Error(`project ${project.name} is ${project.status}, not active`);
+  writePmProjectContext(ctx.rootDir, { appId: project.appId, projectId: project.id });
+  emit2(ctx, project, () => ctx.out.log(`using ${project.appId} / ${project.name} (${project.id}) in this worktree`));
+}
+
 // src/pm-command.ts
 var ALIASES = {
   goal: "goal",
@@ -10143,8 +10204,8 @@ var ALIASES = {
 };
 var COMMON_OPTIONS = ["config", "token", "email", "json", "platform", "context", "open"];
 var ACTION_OPTIONS = {
-  list: ["app", "q", "limit", "offset"],
-  add: ["app", "title", "mutation-id"],
+  list: ["app", "project", "q", "limit", "offset"],
+  add: ["app", "project", "title", "mutation-id"],
   get: [],
   set: ["mutation-id"],
   done: ["mutation-id"],
@@ -10216,6 +10277,9 @@ async function buildContext2(parsed, deps) {
     doFetch,
     out
   );
+  const selectedProject = readPmProjectContext(cfg.rootDir);
+  const requestedApp = stringOpt(parsed.options.app) ?? (context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0);
+  const compatibleProject = selectedProject && (!requestedApp || selectedProject.appId === requestedApp) ? selectedProject : null;
   return {
     platformUrl: cfg.platformUrl,
     token,
@@ -10224,15 +10288,33 @@ async function buildContext2(parsed, deps) {
     json: parsed.options.json === true,
     // Preserve PM's existing cross-project default when a config is present;
     // only an explicit remote-agent environment or profile selects an app.
-    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0,
+    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : compatibleProject?.appId,
+    projectId: compatibleProject?.projectId,
+    rootDir: cfg.rootDir,
     ...deps.sleep ? { sleep: deps.sleep } : {},
     ...deps.now ? { now: deps.now } : {}
   };
 }
 async function pmCommand(parsed, deps = {}) {
   const word = parsed.positionals[1] ?? "";
+  if (word === "project") {
+    const action3 = parsed.positionals[2] ?? "list";
+    if (action3 === "list") {
+      assertArgs(parsed, [...COMMON_OPTIONS, "app", "status", "limit", "offset"], 3);
+      return pmProjectList(await buildContext2(parsed, deps), parsed);
+    }
+    if (action3 === "add" || action3 === "create") {
+      assertArgs(parsed, [...COMMON_OPTIONS, "app", "name", "description", "mutation-id"], 3);
+      return pmProjectAdd(await buildContext2(parsed, deps), parsed);
+    }
+    if (action3 === "use") {
+      assertArgs(parsed, COMMON_OPTIONS, 4);
+      return pmProjectUse(await buildContext2(parsed, deps), requireId2(parsed.positionals[3], action3));
+    }
+    throw new Error(`unknown pm project action "${action3}". Try list|add|use.`);
+  }
   if (word === "next") {
-    assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
+    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project"], 2);
     return pmNext(await buildContext2(parsed, deps), parsed);
   }
   if (word === "watch") {
@@ -10252,7 +10334,7 @@ async function pmCommand(parsed, deps = {}) {
     return pmWatch(await buildContext2(parsed, deps), parsed).then(() => void 0);
   }
   if (word === "handoff") {
-    assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
+    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project"], 2);
     return pmHandoff(await buildContext2(parsed, deps), parsed);
   }
   const entity = ALIASES[word];
@@ -11384,6 +11466,7 @@ var COMMAND_SURFACE = {
   },
   pm: {
     ...PM_ENTITIES,
+    project: { list: {}, add: {}, create: {}, use: {} },
     handoff: {},
     next: {},
     watch: {}
@@ -12473,7 +12556,7 @@ function hostedSeverity(value2, flag) {
 import { findingsAtOrAbove } from "@odla-ai/security";
 
 // src/security.ts
-import { isAbsolute as isAbsolute5, relative as relative5, resolve as resolve12, sep as sep4 } from "path";
+import { isAbsolute as isAbsolute5, relative as relative5, resolve as resolve13, sep as sep4 } from "path";
 import {
   cloudflareAppProfile,
   createPlatformSecurityReasoners,
@@ -12492,8 +12575,8 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = resolve12(options.target ?? cfg?.rootDir ?? ".");
-  const output = resolve12(options.out ?? resolve12(target, ".odla/security/hosted"));
+  const target = resolve13(options.target ?? cfg?.rootDir ?? ".");
+  const output = resolve13(options.out ?? resolve13(target, ".odla/security/hosted"));
   const outputRelative = relative5(target, output).split(sep4).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
@@ -12524,7 +12607,7 @@ async function runHostedSecurity(options) {
   });
   const harness = createSecurityHarness({
     profile,
-    store: new FileRunStore(resolve12(output, "state")),
+    store: new FileRunStore(resolve13(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -12577,7 +12660,7 @@ function printSummary(out, appId, env, run, report4, output) {
   out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
   if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
-  out.log(`  report: ${resolve12(output, "REPORT.md")}`);
+  out.log(`  report: ${resolve13(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -13237,4 +13320,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-3HFNKDZV.js.map
+//# sourceMappingURL=chunk-Y3W7YKWI.js.map