@odla-ai/cli 0.30.3 → 0.31.1

package/dist/{cli-BGSX5Z4C.js → cli-Q2U7TCMV.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-3HFNKDZV.js";
+} from "./chunk-Y3W7YKWI.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-BGSX5Z4C.js.map
+//# sourceMappingURL=cli-Q2U7TCMV.js.map

package/dist/index.cjs

@@ -149,7 +149,7 @@ var import_node_process = __toESM(require("process"), 1);
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? import_node_process.default.platform);
   const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve13, reject) => {
+  await new Promise((resolve14, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -157,7 +157,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve13();
+      resolve14();
     });
   });
 }
@@ -452,7 +452,7 @@ async function freshHandshake(ctx, waitMs) {
   } catch (err) {
     const code = err instanceof import_db.OdlaError ? err.code : void 0;
     if (code === "handshake_pending" && started) throw stillPending(started, ctx.email);
-    if (code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
+    if (code === "handshake_duplicate" || code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
       clearPendingHandshake(ctx.pendingFile);
     }
     throw err;
@@ -2598,8 +2598,8 @@ function credential(value2) {
 // src/calendar-poll.ts
 async function waitForCalendarPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
-  await new Promise((resolve13, reject) => {
-    const timer = setTimeout(resolve13, milliseconds);
+  await new Promise((resolve14, reject) => {
+    const timer = setTimeout(resolve14, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new Error("calendar connection aborted"));
@@ -3305,7 +3305,7 @@ async function configOperationWait(options) {
   assertOperationId(options.operationId);
   const cfg = await loadProjectConfig(options.configPath);
   const client = await operationClient(cfg, options, "wait");
-  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
+  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
   const now = () => (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
   const deadline = now() + (options.timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3;
   const interval = (options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS) * 1e3;
@@ -8156,8 +8156,8 @@ function hostedPollTimeout(value2 = 10 * 6e4) {
 }
 async function waitForHostedPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
-  await new Promise((resolve13, reject) => {
-    const timer = setTimeout(resolve13, milliseconds);
+  await new Promise((resolve14, reject) => {
+    const timer = setTimeout(resolve14, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new DOMException("aborted", "AbortError"));
@@ -8904,13 +8904,16 @@ Usage:
   odla-ai app rename <name>                                            [continue in Studio; human session required]
   odla-ai app owners <list|add|remove> [...]                            [continue in Studio; human session required]
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
-  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm project list [--app <product-id>] [--status <s>] [--json]
+  odla-ai pm project add --app <product-id> --name <name> [--description <text>] [--json]
+  odla-ai pm project use <project-id> [--json]                         [saved locally in this worktree]
+  odla-ai pm goal list [--app <id>] [--project <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
   odla-ai pm task add --app <id> --title <t> [--column <backlog|ready|doing|review|done>] [--goal <id>|--alignment-decision <id>] [--assignee <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
-  odla-ai pm next --app <id> [--json]
+  odla-ai pm next --app <id> [--project <id>] [--json]
   odla-ai pm watch --app <id> [--cursor <cursor>] [--entity goal|task|decision|bug] [--action created|updated|deleted|comment.created|comment.updated] [--state <state>] [--by <principalId>] [--self <principalId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
   odla-ai pm task ready <id> --expected-revision <n> [--goal <id>|--alignment-decision <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--mutation-id <id>] [--json]
   odla-ai pm task claim <id> --expected-revision <n> [--mutation-id <id>] [--json]
@@ -8930,7 +8933,7 @@ Usage:
   odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
   odla-ai pm <goal|task|decision|bug> comments <id> [--json]
   odla-ai pm <goal|task|decision|bug> rm <id>
-  odla-ai pm handoff --app <id> [--json]
+  odla-ai pm handoff --app <id> [--project <id>] [--json]
   odla-ai discuss groups [--json]
   odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
   odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
@@ -9063,13 +9066,12 @@ Commands:
   code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  pm           Project management (via @odla-ai/pm) shared across the apps you
-               co-own: conformance goals, kanban tasks, decisions, and bugs. With
-               no --app, "list" spans every co-owned project (the cross-project
-               view); with --app it scopes to one. Same device-grant auth as
-               "app". Entities: goal (alias conformance), task (alias kanban),
-               decision, bug. Status changes and comments post to each item's
-               @odla-ai/chat discussion thread.
+  pm           Project management (via @odla-ai/pm): Products contain Projects;
+               projects contain goals, kanban tasks, decisions, and bugs. Use
+               "pm project list|add|use" to select worktree-local context, or
+               pass --app/--project explicitly. Same device-grant auth as "app".
+               Status changes and comments post to each item's @odla-ai/chat
+               discussion thread.
   bug          Intent-first alias for PM bugs. "bug report" writes to
                odla PM; odla product defects do not belong in GitHub Issues.
   discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
@@ -9476,7 +9478,7 @@ function jsonl(ctx, parsed, value2) {
 }
 async function discussWatch(ctx, topicId, parsed) {
   if (ctx.json && parsed.options.jsonl === true) throw new Error("--json and --jsonl cannot be combined");
-  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
   const now = ctx.now ?? Date.now;
   const intervalMs = (numberOpt2(parsed, "interval", DEFAULT_INTERVAL_MS / 1e3) ?? DEFAULT_INTERVAL_MS / 1e3) * 1e3;
   const timeoutSeconds = numberOpt2(parsed, "timeout");
@@ -9824,6 +9826,8 @@ async function pmList(ctx, entity, parsed) {
   };
   const app = stringOpt(parsed.options.app) ?? ctx.appId;
   if (app) q.set("app", app);
+  const project = stringOpt(parsed.options.project) ?? ctx.projectId;
+  if (project) q.set("project", project);
   for (const [flag, param] of Object.entries(filters)) {
     const raw = stringOpt(parsed.options[flag]);
     const v = entity === "task" && flag === "column" && raw === "ready" ? "todo" : raw;
@@ -9843,6 +9847,7 @@ async function pmList(ctx, entity, parsed) {
 }
 async function pmAdd(ctx, entity, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
   if (!appId) throw new Error("pm add needs --app <appId>");
   const input = collectEntityFields(entity, parsed, false);
   if (!input.title) throw new Error("pm add needs --title <title>");
@@ -9850,6 +9855,7 @@ async function pmAdd(ctx, entity, parsed) {
     throw new Error("pm bug add needs --description <context> (or --body <context>)");
   const res = await pmRequest(ctx, "POST", `/${entity}`, {
     appId,
+    ...projectId ? { projectId } : {},
     input,
     mutationId: writeMutationId2(parsed)
   });
@@ -9929,7 +9935,7 @@ async function pmTaskLifecycle(ctx, id, action2, parsed) {
     ctx.out.log(`task: ${label} \u2192 ${state2}`);
   });
 }
-async function allRecords(ctx, entity, appId) {
+async function allRecords(ctx, entity, appId, projectId) {
   const records = [];
   for (; ; ) {
     const q = new URLSearchParams({
@@ -9937,6 +9943,7 @@ async function allRecords(ctx, entity, appId) {
       limit: "100",
       offset: String(records.length)
     });
+    if (projectId) q.set("project", projectId);
     const page2 = await pmRequest(ctx, "GET", `/${entity}?${q}`);
     records.push(...page2.records);
     if (records.length >= page2.total || page2.records.length === 0) return records;
@@ -9944,13 +9951,15 @@ async function allRecords(ctx, entity, appId) {
 }
 async function pmNext(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
   if (!appId) throw new Error("pm next needs --app <appId>");
   const [goals, tasks] = await Promise.all([
-    allRecords(ctx, "goal", appId),
-    allRecords(ctx, "task", appId)
+    allRecords(ctx, "goal", appId, projectId),
+    allRecords(ctx, "task", appId, projectId)
   ]);
   const result = {
     appId,
+    projectId,
     openGoals: goals.filter((record10) => record10.status === "open"),
     doing: tasks.filter((record10) => record10.column === "doing"),
     ready: tasks.filter((record10) => record10.column === "todo")
@@ -9981,14 +9990,16 @@ async function pmNext(ctx, parsed) {
 }
 async function pmHandoff(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
   if (!appId) throw new Error("pm handoff needs --app <appId>");
   const [goals, tasks, bugs] = await Promise.all([
-    allRecords(ctx, "goal", appId),
-    allRecords(ctx, "task", appId),
-    allRecords(ctx, "bug", appId)
+    allRecords(ctx, "goal", appId, projectId),
+    allRecords(ctx, "task", appId, projectId),
+    allRecords(ctx, "bug", appId, projectId)
   ]);
   const handoff = {
     appId,
+    projectId,
     unmetGoals: goals.filter((record10) => record10.status !== "met"),
     activeTasks: tasks.filter((record10) => record10.column !== "done"),
     openBugs: bugs.filter((record10) => record10.status !== "fixed" && record10.status !== "wontfix")
@@ -10153,7 +10164,7 @@ async function pmWatch(ctx, parsed) {
   }
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("pm watch needs --app <appId>");
-  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve14) => setTimeout(resolve14, ms)));
   const now = ctx.now ?? Date.now;
   const intervalMs = (positiveNumber(parsed, "interval", DEFAULT_INTERVAL_MS2 / 1e3) ?? DEFAULT_INTERVAL_MS2 / 1e3) * 1e3;
   const timeoutSeconds = positiveNumber(parsed, "timeout");
@@ -10262,6 +10273,56 @@ async function pmWatch(ctx, parsed) {
   }
 }
 
+// src/pm-project-context.ts
+var import_node_path16 = require("path");
+var pmProjectContextFile = (rootDir) => (0, import_node_path16.resolve)(rootDir, ".odla", "pm-project.local.json");
+function readPmProjectContext(rootDir) {
+  const value2 = readJsonFile(pmProjectContextFile(rootDir));
+  return value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" ? value2 : null;
+}
+function writePmProjectContext(rootDir, value2) {
+  writePrivateJson(pmProjectContextFile(rootDir), { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() });
+}
+
+// src/pm-project-actions.ts
+async function pmProjectList(ctx, parsed) {
+  const q = new URLSearchParams();
+  const app = stringOpt(parsed.options.app) ?? ctx.appId;
+  if (app) q.set("app", app);
+  for (const key of ["status", "limit", "offset"]) {
+    const value2 = stringOpt(parsed.options[key]);
+    if (value2) q.set(key, value2);
+  }
+  const page2 = await pmRequest(ctx, "GET", `/project?${q}`);
+  emit2(ctx, page2, () => {
+    ctx.out.log(`projects \u2014 ${page2.records.length} of ${page2.total}`);
+    ctx.out.log("id	status	product	name");
+    for (const project of page2.records) {
+      ctx.out.log(`${project.id}	${project.status}	${project.appId}	${project.name}${project.isDefault ? " (default)" : ""}`);
+    }
+  });
+}
+async function pmProjectAdd(ctx, parsed) {
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  const name = stringOpt(parsed.options.name);
+  if (!appId) throw new Error("pm project add needs --app <productId>");
+  if (!name) throw new Error("pm project add needs --name <name>");
+  const result = await pmRequest(ctx, "POST", "/project", {
+    appId,
+    name,
+    description: stringOpt(parsed.options.description),
+    mutationId: writeMutationId2(parsed)
+  });
+  emit2(ctx, result, () => ctx.out.log(`created project: ${result.project.name} (${result.project.id})`));
+}
+async function pmProjectUse(ctx, id) {
+  if (!ctx.rootDir) throw new Error("pm project use needs a local project directory");
+  const { project } = await pmRequest(ctx, "GET", `/project/${encodeURIComponent(id)}`);
+  if (project.status !== "active") throw new Error(`project ${project.name} is ${project.status}, not active`);
+  writePmProjectContext(ctx.rootDir, { appId: project.appId, projectId: project.id });
+  emit2(ctx, project, () => ctx.out.log(`using ${project.appId} / ${project.name} (${project.id}) in this worktree`));
+}
+
 // src/pm-command.ts
 var ALIASES = {
   goal: "goal",
@@ -10273,8 +10334,8 @@ var ALIASES = {
 };
 var COMMON_OPTIONS = ["config", "token", "email", "json", "platform", "context", "open"];
 var ACTION_OPTIONS = {
-  list: ["app", "q", "limit", "offset"],
-  add: ["app", "title", "mutation-id"],
+  list: ["app", "project", "q", "limit", "offset"],
+  add: ["app", "project", "title", "mutation-id"],
   get: [],
   set: ["mutation-id"],
   done: ["mutation-id"],
@@ -10346,6 +10407,9 @@ async function buildContext2(parsed, deps) {
     doFetch,
     out
   );
+  const selectedProject = readPmProjectContext(cfg.rootDir);
+  const requestedApp = stringOpt(parsed.options.app) ?? (context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0);
+  const compatibleProject = selectedProject && (!requestedApp || selectedProject.appId === requestedApp) ? selectedProject : null;
   return {
     platformUrl: cfg.platformUrl,
     token,
@@ -10354,15 +10418,33 @@ async function buildContext2(parsed, deps) {
     json: parsed.options.json === true,
     // Preserve PM's existing cross-project default when a config is present;
     // only an explicit remote-agent environment or profile selects an app.
-    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0,
+    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : compatibleProject?.appId,
+    projectId: compatibleProject?.projectId,
+    rootDir: cfg.rootDir,
     ...deps.sleep ? { sleep: deps.sleep } : {},
     ...deps.now ? { now: deps.now } : {}
   };
 }
 async function pmCommand(parsed, deps = {}) {
   const word = parsed.positionals[1] ?? "";
+  if (word === "project") {
+    const action3 = parsed.positionals[2] ?? "list";
+    if (action3 === "list") {
+      assertArgs(parsed, [...COMMON_OPTIONS, "app", "status", "limit", "offset"], 3);
+      return pmProjectList(await buildContext2(parsed, deps), parsed);
+    }
+    if (action3 === "add" || action3 === "create") {
+      assertArgs(parsed, [...COMMON_OPTIONS, "app", "name", "description", "mutation-id"], 3);
+      return pmProjectAdd(await buildContext2(parsed, deps), parsed);
+    }
+    if (action3 === "use") {
+      assertArgs(parsed, COMMON_OPTIONS, 4);
+      return pmProjectUse(await buildContext2(parsed, deps), requireId2(parsed.positionals[3], action3));
+    }
+    throw new Error(`unknown pm project action "${action3}". Try list|add|use.`);
+  }
   if (word === "next") {
-    assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
+    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project"], 2);
     return pmNext(await buildContext2(parsed, deps), parsed);
   }
   if (word === "watch") {
@@ -10382,7 +10464,7 @@ async function pmCommand(parsed, deps = {}) {
     return pmWatch(await buildContext2(parsed, deps), parsed).then(() => void 0);
   }
   if (word === "handoff") {
-    assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
+    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project"], 2);
     return pmHandoff(await buildContext2(parsed, deps), parsed);
   }
   const entity = ALIASES[word];
@@ -11514,6 +11596,7 @@ var COMMAND_SURFACE = {
   },
   pm: {
     ...PM_ENTITIES,
+    project: { list: {}, add: {}, create: {}, use: {} },
     handoff: {},
     next: {},
     watch: {}
@@ -11794,7 +11877,7 @@ async function runbookRemove(ctx, slug) {
 
 // src/runbook-import.ts
 var import_node_fs17 = require("fs");
-var import_node_path16 = require("path");
+var import_node_path17 = require("path");
 function parseRunbook(text2, slug) {
   let rest = text2;
   const meta = {};
@@ -11823,8 +11906,8 @@ function readRunbookDir(dir) {
   const files = (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path16.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path17.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path17.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -11898,7 +11981,7 @@ async function upsert(ctx, r, visibility) {
 // src/runbook-impact.ts
 var import_node_child_process7 = require("child_process");
 var import_node_fs18 = require("fs");
-var import_node_path17 = require("path");
+var import_node_path18 = require("path");
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -12067,7 +12150,7 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path17.join)(root, workspace, "package.json");
+    const manifest = (0, import_node_path18.join)(root, workspace, "package.json");
     if (!(0, import_node_fs18.existsSync)(manifest)) return void 0;
     try {
       const name = JSON.parse((0, import_node_fs18.readFileSync)(manifest, "utf8")).name;
@@ -12137,7 +12220,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path18.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -12272,7 +12355,7 @@ async function runbookComment(ctx, slug, body) {
 var import_node_child_process8 = require("child_process");
 var import_node_fs19 = require("fs");
 var import_node_os5 = require("os");
-var import_node_path18 = require("path");
+var import_node_path19 = require("path");
 var import_node_process14 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
 function resolveEditor(env = import_node_process14.default.env) {
@@ -12298,8 +12381,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path18.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path18.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path19.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path19.join)(dir, `${slug}.md`);
   try {
     (0, import_node_fs19.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -12652,7 +12735,7 @@ function hostedSeverity(value2, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path19 = require("path");
+var import_node_path20 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -12664,9 +12747,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path19.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path19.resolve)(options.out ?? (0, import_node_path19.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path19.relative)(target, output).split(import_node_path19.sep).join("/");
+  const target = (0, import_node_path20.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path20.resolve)(options.out ?? (0, import_node_path20.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path20.relative)(target, output).split(import_node_path20.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -12678,7 +12761,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path19.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path20.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -12696,7 +12779,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path19.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path20.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -12720,7 +12803,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path19.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path20.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -12749,7 +12832,7 @@ function printSummary(out, appId, env, run, report4, output) {
   out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
   if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path19.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path20.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";