@odla-ai/cli 0.34.0 → 0.35.0

package/dist/index.cjs

@@ -127,14 +127,15 @@ function approvalLines(prompt) {
     lines.push(`   No browser was opened (${prompt.browserSkipped}).`);
   }
   lines.push("");
-  lines.push("   AGENTS: use browser control to open the URL above now; do not wait silently.");
-  lines.push("   If browser control is unavailable, give the exact URL to the human verbatim.");
-  lines.push("   You cannot approve it yourself, retry it away, or start a substitute handshake.");
+  lines.push("   AGENTS: immediately give the human this URL as a clickable approval action and repeat the code.");
+  lines.push("   Keep this CLI process running and wait on this same process; the CLI owns protocol polling.");
+  lines.push("   Do not use OS open, browser control, curl, a shell wait loop, detached execution, or a substitute handshake.");
+  lines.push("   You cannot approve it yourself. If this process exits, a later invocation creates a new code.");
   lines.push("");
   return lines;
 }
 function printApproval(out, prompt) {
-  for (const line of approvalLines(prompt)) out.error(line);
+  for (const line2 of approvalLines(prompt)) out.error(line2);
 }
 function reminderLines(prompt) {
   return [
@@ -220,12 +221,12 @@ function approvalHint(pending) {
 }
 function approvalReminder(out, pending, periodMs = 3e4) {
   const timer = setInterval(() => {
-    for (const line of reminderLines({
+    for (const line2 of reminderLines({
       userCode: pending.userCode,
       approvalUrl: pending.approvalUrl,
       minutesLeft: minutesLeft(pending.expiresAt)
     }))
-      out.log(line);
+      out.log(line2);
   }, periodMs);
   timer.unref?.();
   return () => clearInterval(timer);
@@ -286,9 +287,9 @@ function mergeCredential(current, update) {
 function ensureGitignore(rootDir, localPaths = []) {
   const path = (0, import_node_path2.resolve)(rootDir, ".gitignore");
   const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
-  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line) => !!line);
+  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
-  const missing = wanted.filter((line) => !existing.split(/\r?\n/).includes(line));
+  const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
   (0, import_node_fs2.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
@@ -320,7 +321,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
   const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
-  const retained = existing.split(/\r?\n/).filter((line) => !isManagedDevVar(line));
+  const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
 
@@ -340,8 +341,8 @@ var MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
   "ODLA_O11Y_VERSION",
   "ODLA_O11Y_TOKEN"
 ]);
-function isManagedDevVar(line) {
-  const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
+function isManagedDevVar(line2) {
+  const match = line2.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text3) {
@@ -2195,7 +2196,7 @@ function chooseIdMode(options, rows) {
 async function appImport(options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
-  const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
+  const say = options.json ? (line2) => out.error(line2) : (line2) => out.log(line2);
   const { tenant } = resolveTenant(cfg, options.env);
   const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs7.readFileSync)(0, "utf8")))() : (0, import_node_fs7.readFileSync)(options.file, "utf8");
   const { format, sources } = (0, import_import.parseImport)(text3, options.ns);
@@ -2520,7 +2521,7 @@ async function designUnpack(parsed, deps) {
     );
     return;
   }
-  for (const line of describeUnpack(result, outDir)) out.log(line);
+  for (const line2 of describeUnpack(result, outDir)) out.log(line2);
 }
 async function brandCommand(parsed, deps) {
   const subject = parsed.positionals[1];
@@ -4481,7 +4482,7 @@ async function doctor(options) {
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ? `byok/${cfg.ai.provider}` : "hosted" : "not enabled"}`);
   const contract = resolveSecretContract(cfg);
   out.log(`secrets: ${contract.length ? `${contract.length} declared` : "none declared"}`);
-  for (const line of formatSecretContract(contract)) out.log(line);
+  for (const line2 of formatSecretContract(contract)) out.log(line2);
   if (cfg.services.includes("calendar")) {
     const calendar = cfg.envs.map((env) => {
       const resolved = calendarServiceConfig(cfg, env);
@@ -4850,10 +4851,10 @@ async function secretsStatus(options) {
   }
   const body = await res.json();
   const stored = new Set((body.secrets ?? []).map((entry) => String(entry.name)));
-  const report4 = buildReport(cfg.app.id, options.env, tenantId, contract, stored);
-  if (options.json) out.log(JSON.stringify(report4, null, 2));
-  else printReport(report4, out);
-  return report4;
+  const report5 = buildReport(cfg.app.id, options.env, tenantId, contract, stored);
+  if (options.json) out.log(JSON.stringify(report5, null, 2));
+  else printReport(report5, out);
+  return report5;
 }
 function buildReport(appId, env, tenant, contract, stored) {
   const declared = new Set(contract.map((secret) => secret.name));
@@ -4870,25 +4871,25 @@ function buildReport(appId, env, tenant, contract, stored) {
   const ok = rows.every((row) => row.state !== "missing" || !row.required);
   return { app: appId, env, tenant, secrets: rows, ok };
 }
-function printReport(report4, out) {
-  out.log(`${report4.app} (${report4.tenant})`);
-  if (report4.secrets.length === 0) {
+function printReport(report5, out) {
+  out.log(`${report5.app} (${report5.tenant})`);
+  if (report5.secrets.length === 0) {
     out.log("  no secrets declared and none stored");
     return;
   }
-  for (const row of report4.secrets) {
+  for (const row of report5.secrets) {
     const label = row.state === "missing" && !row.required ? "missing (optional)" : row.state;
     const suffix = row.sources.length ? ` \u2014 ${row.sources.join(", ")}` : "";
     out.log(`  ${label.padEnd(18)} ${row.name}${suffix}`);
   }
-  const missing = report4.secrets.filter((row) => row.state === "missing" && row.required);
+  const missing = report5.secrets.filter((row) => row.state === "missing" && row.required);
   if (missing.length) {
     out.log("");
     for (const row of missing) {
-      out.log(`${row.name} is required but not set \u2014 "odla-ai secrets set ${row.name} --env ${report4.env} --stdin"`);
+      out.log(`${row.name} is required but not set \u2014 "odla-ai secrets set ${row.name} --env ${report5.env} --stdin"`);
     }
   }
-  if (report4.secrets.some((row) => row.state === "reserved")) {
+  if (report5.secrets.some((row) => row.state === "reserved")) {
     out.log("");
     out.log('"reserved" slots are never enumerated by the vault; presence cannot be confirmed here.');
   }
@@ -4910,18 +4911,29 @@ For work that creates an odla app or adds odla services, read and follow
 \`.agents/skills/odla-o11y-debug/SKILL.md\`.
 
 Track the work in odla's PM as you go. Before project-mutating work, run
-\`npx @odla-ai/cli pm next --app <appId>\`, confirm alignment to an open goal,
+\`npx --yes @odla-ai/cli@latest pm next --app <appId>\`, confirm alignment to an open goal,
 and atomically claim a refined Ready task. Record decisions when you make them
 and file bugs when you notice them. The conventions and the full command set are
 in \`.agents/skills/odla/references/pm.md\`.
 
-Use the human's signed-in odla account email for device authorization; never
-infer it from git config, commit metadata, or GitHub. If authorization is not
-already active, run
-\`npx @odla-ai/cli auth login --app <appId> --email <odla-account>\` and open
-the exact Studio URL it prints. Never file an odla project or product defect in
-GitHub Issues: run \`npx @odla-ai/cli bug report --app <appId> ...\` so the bug
-lands in odla PM with the rest of the project's goals, tasks, and decisions.
+Use the human's known signed-in odla account email for device authorization;
+never infer it from git config, commit metadata, or GitHub. If authorization is
+not already active, run this exact command as one foreground process:
+
+\`npx --yes @odla-ai/cli@latest auth login --app <appId> --email <odla-account> --no-open --wait 600\`
+
+When it prints the approval URL and code, immediately give the human a clickable
+link, name the code they must verify, and tell them to click **Approve**. Keep
+that CLI process running and wait on the same tool process for its result. The
+CLI owns protocol polling: never call the OS \`open\` command, use browser
+control, curl a handshake endpoint, build a shell wait/poll loop, detach the
+process, or start another handshake while it is alive. The device code exists
+only in that process. If it exits 75 before approval, the old code cannot be
+collected; start one fresh foreground command and surface its new URL.
+
+Never file an odla project or product defect in GitHub Issues: run
+\`npx --yes @odla-ai/cli@latest bug report --app <appId> ...\` so the bug lands
+in odla PM with the rest of the project's goals, tasks, and decisions.
 
 The setup runbooks and their references are installed in this repository, pinned
 to this CLI version. Use them as your setup context.
@@ -4933,9 +4945,9 @@ When this repository has an \`appId\`, pass it: app-scoped discovery includes
 that project's instructions plus the shared platform procedures.
 
 \`\`\`
-npx odla-ai runbook ask "<what you are about to do>" --app <appId>
-npx odla-ai runbook list
-npx odla-ai runbook get <slug>
+npx --yes @odla-ai/cli@latest runbook ask "<what you are about to do>" --app <appId>
+npx --yes @odla-ai/cli@latest runbook list
+npx --yes @odla-ai/cli@latest runbook get <slug>
 \`\`\`
 
 Never scrape odla.ai HTML for any of this. The CLI reads the same content
@@ -4955,12 +4967,12 @@ function claudeAdapter(skill, canonical2) {
   const lines = match[1].split(/\r?\n/);
   const frontmatter = [];
   let keepIndented = false;
-  for (const line of lines) {
-    if (line.startsWith("name:") || line.startsWith("description:")) {
-      frontmatter.push(line);
-      keepIndented = line.startsWith("description:");
-    } else if (keepIndented && /^\s+/.test(line)) {
-      frontmatter.push(line);
+  for (const line2 of lines) {
+    if (line2.startsWith("name:") || line2.startsWith("description:")) {
+      frontmatter.push(line2);
+      keepIndented = line2.startsWith("description:");
+    } else if (keepIndented && /^\s+/.test(line2)) {
+      frontmatter.push(line2);
     } else {
       keepIndented = false;
     }
@@ -6281,13 +6293,13 @@ async function createConversionRegistry(config) {
     policies.set(policy.conversionId, Object.freeze(policy));
   }
   const outputCounts = /* @__PURE__ */ new Map();
-  const get = (id2, kind) => {
+  const get2 = (id2, kind) => {
     const policy = policies.get(id2);
     if (!policy || policy.output.kind !== kind) throw new CamelError("conversion_rejected", "Conversion policy is missing or has the wrong output kind.");
     return policy;
   };
   const checked = (source, id2, kind) => {
-    const policy = get(id2, kind);
+    const policy = get2(id2, kind);
     if (utf8Length(source.value) > policy.maximumSourceBytes) throw new CamelError("limit_exceeded", "Unsafe conversion input exceeds its byte bound.");
     return policy;
   };
@@ -7118,7 +7130,7 @@ var PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
 var FORBIDDEN = /^(?:GIT binary patch|Binary files |rename (?:from|to) |copy (?:from|to) |similarity index |old mode |new mode |deleted file mode 160000|new file mode 160000)/m;
 function stripPatchEnvelope(patch2) {
   if (!/^\*\*\* (?:Begin|End) Patch\s*$/m.test(patch2)) return patch2;
-  const kept = patch2.split("\n").filter((line) => !/^\*\*\* (?:Begin|End) Patch\s*$/.test(line));
+  const kept = patch2.split("\n").filter((line2) => !/^\*\*\* (?:Begin|End) Patch\s*$/.test(line2));
   const stripped = kept.join("\n");
   return /^diff --git /m.test(stripped) ? stripped : patch2;
 }
@@ -7139,9 +7151,9 @@ function validateCodePatch(rawPatch, maxBytes) {
   const paths = [];
   const lines = patch2.split("\n");
   for (let index = 0; index < lines.length; index += 1) {
-    const line = lines[index];
-    if (!line.startsWith("diff --git ")) continue;
-    const match = /^diff --git a\/(\S+) b\/(\S+)$/.exec(line);
+    const line2 = lines[index];
+    if (!line2.startsWith("diff --git ")) continue;
+    const match = /^diff --git a\/(\S+) b\/(\S+)$/.exec(line2);
     const path = match?.[1];
     if (!path || !match?.[2] || path !== match[2]) throw new TypeError("patch must use one unquoted relative path per diff");
     validateRelativePath(path);
@@ -7174,9 +7186,9 @@ function resolveCodePath(workspaceDir, path) {
   return target;
 }
 function describePatchFailure(patch2, detail) {
-  const hunks = patch2.split("\n").filter((line) => line.startsWith("@@"));
+  const hunks = patch2.split("\n").filter((line2) => line2.startsWith("@@"));
   const bodies = patch2.split(/^@@.*$/m).slice(1);
-  const contextless = bodies.some((body) => !body.split("\n").some((line) => line.startsWith(" ") && line.trim().length > 0));
+  const contextless = bodies.some((body) => !body.split("\n").some((line2) => line2.startsWith(" ") && line2.trim().length > 0));
   const hint = hunks.length > 0 && contextless ? " A hunk has no context lines; include at least one unchanged line above or below each change." : "";
   return `patch did not apply: ${detail}${hint}`;
 }
@@ -9737,11 +9749,237 @@ function record6(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 
+// src/code-grant-command.ts
+var ACTIONS = ["request", "list", "approve", "revoke"];
+var isAction = (value2) => ACTIONS.includes(value2 ?? "");
+async function fail2(response2, what) {
+  const body = redactSecrets((await response2.text()).slice(0, 1e3));
+  throw new Error(`${what} failed (${response2.status}): ${body}`);
+}
+function line(grant) {
+  const who = grant.status === "granted" ? `granted by ${grant.approvedBy ?? "?"}` : `requested by ${grant.requestedBy}`;
+  return `${grant.grantId}	${grant.appEnv}	${grant.owner}/${grant.name}	${grant.status}	${who}`;
+}
+function report(grants, out, json) {
+  if (json) return out.log(JSON.stringify({ grants }, null, 2));
+  if (!grants.length) return out.log("no repository grants for this app");
+  out.log("GRANT	ENV	REPOSITORY	STATUS	DECIDED");
+  for (const grant of grants) out.log(line(grant));
+  const pending = grants.filter((grant) => grant.status === "requested");
+  if (pending.length) {
+    out.log(`
+${pending.length} awaiting approval. A human owner runs:`);
+    for (const grant of pending) out.log(`  odla-ai code grant approve ${grant.grantId} --env ${grant.appEnv}`);
+  }
+}
+function grantsUrl(cfg, suffix = "") {
+  return `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/code/repository-grants${suffix}`;
+}
+async function codeGrantCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[2];
+  if (!isAction(action2)) {
+    throw new Error(
+      `unknown code grant action "${action2 ?? ""}". Try "odla-ai code grant list --env dev".`
+    );
+  }
+  const decides = action2 === "approve" || action2 === "revoke";
+  assertArgs(parsed, ["config", "env", "json", "token", "email", "open"], decides ? 4 : 3);
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const env = stringOpt(parsed.options.env) ?? "dev";
+  const json = parsed.options.json === true;
+  const token = await getDeveloperToken(cfg, {
+    configPath: cfg.configPath,
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    openApprovalUrl: deps.openUrl
+    // Every verb here administers grants, which the registry gates on
+    // app.manage — a token without it is refused as "not your app", which reads
+    // like the wrong app rather than the wrong authority.
+    //
+    // Only `request` additionally asks for code.session. Approving is a human
+    // act, and a token minted to approve has no business also carrying the
+    // authority the approval is about.
+  }, doFetch, out, {
+    optionalProjectCapabilities: action2 === "request" ? ["app.manage", "code.session"] : ["app.manage"]
+  });
+  const auth = { authorization: `Bearer ${token}` };
+  if (action2 === "list") {
+    const response3 = await doFetch(`${grantsUrl(cfg)}?env=${encodeURIComponent(env)}`, { headers: auth });
+    if (!response3.ok) await fail2(response3, "repository grant list");
+    const body2 = await response3.json();
+    return report(body2.grants, out, json);
+  }
+  if (action2 === "request") {
+    const response3 = await doFetch(grantsUrl(cfg), {
+      method: "POST",
+      headers: { ...auth, "content-type": "application/json" },
+      body: JSON.stringify({ env })
+    });
+    if (!response3.ok) await fail2(response3, "repository grant request");
+    const { grant } = await response3.json();
+    if (json) return out.log(JSON.stringify({ grant }, null, 2));
+    out.log(`requested ${grant.owner}/${grant.name} (${grant.appEnv}) \u2014 ${grant.grantId}`);
+    return out.log(grant.status === "granted" ? "already granted; nothing to approve" : `a human owner of ${cfg.app.id} approves it with:
+  odla-ai code grant approve ${grant.grantId} --env ${env}`);
+  }
+  const grantId = parsed.positionals[3];
+  if (!grantId) throw new Error(`code grant ${action2} requires the grant id from "odla-ai code grant list"`);
+  const url = `${grantsUrl(cfg, `/${encodeURIComponent(grantId)}`)}`;
+  const response2 = action2 === "approve" ? await doFetch(url, {
+    method: "POST",
+    headers: { ...auth, "content-type": "application/json" },
+    body: JSON.stringify({ env })
+  }) : await doFetch(`${url}?env=${encodeURIComponent(env)}`, { method: "DELETE", headers: auth });
+  if (!response2.ok) await fail2(response2, `repository grant ${action2}`);
+  const body = await response2.json();
+  if (json) return out.log(JSON.stringify(body, null, 2));
+  out.log(action2 === "approve" && body.grant ? `granted ${body.grant.owner}/${body.grant.name} (${body.grant.appEnv}) to ${cfg.app.id}` : `revoked ${grantId}`);
+}
+
+// src/code-repository-command.ts
+var ACTIONS2 = ["show", "list", "bind"];
+var isAction2 = (value2) => ACTIONS2.includes(value2 ?? "");
+async function get(doFetch, url, token, what) {
+  const response2 = await doFetch(url, { headers: { authorization: `Bearer ${token}` } });
+  if (!response2.ok) {
+    const body = redactSecrets((await response2.text()).slice(0, 1e3));
+    if (response2.status === 403 && body.includes("human_session_required")) {
+      throw new Error(
+        `selecting a repository needs a signed-in human session, and every CLI handshake token is a delegated agent credential by design \u2014 so this cannot be done with one, however it was approved. Connect the repository in Studio (Apps \u2192 this app \u2192 Code), then run "odla-ai code grant request".`
+      );
+    }
+    throw new Error(`${what} failed (${response2.status}): ${body}`);
+  }
+  return await response2.json();
+}
+async function catalogue(doFetch, platformUrl, token) {
+  const account = await get(
+    doFetch,
+    `${platformUrl}/registry/code/github/account`,
+    token,
+    "GitHub account read"
+  );
+  const active = account.installations.filter((install2) => install2.status === "active");
+  const found = [];
+  for (const install2 of active) {
+    const { repositories } = await get(
+      doFetch,
+      `${platformUrl}/registry/code/github/installations/${install2.installationId}/repositories`,
+      token,
+      `repository catalog for ${install2.accountLogin}`
+    );
+    for (const repository of repositories) {
+      found.push({ ...repository, installationId: install2.installationId });
+    }
+  }
+  if (!active.length) {
+    throw new Error(
+      "no active GitHub App installation. Install odla's GitHub App on the account that owns the repository first, from Studio \u2192 Code."
+    );
+  }
+  return found;
+}
+function selectRepository(found, full) {
+  const wanted = full.toLowerCase();
+  const matches = found.filter((repository) => repository.fullName.toLowerCase() === wanted);
+  if (matches.length === 1) return matches[0];
+  if (!matches.length) {
+    const near = found.filter((repository) => repository.name.toLowerCase() === wanted.split("/").pop());
+    throw new Error(near.length ? `no installation exposes ${full}. Did you mean ${near.map((repository) => repository.fullName).join(", ")}?` : `no installation exposes ${full}. Run "odla-ai code repository list" to see what is reachable.`);
+  }
+  throw new Error(
+    `${full} is reachable through ${matches.length} installations (${matches.map((match) => match.installationId).join(", ")}); revoke the one you do not mean.`
+  );
+}
+function repositoryUrl(cfg, suffix = "") {
+  return `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/code/repository${suffix}`;
+}
+async function codeRepositoryCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[2];
+  if (!isAction2(action2)) {
+    throw new Error(
+      `unknown code repository action "${action2 ?? ""}". Try "odla-ai code repository show --env dev".`
+    );
+  }
+  assertArgs(parsed, ["config", "env", "repo", "json", "token", "email", "open"], 3);
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const env = stringOpt(parsed.options.env) ?? "dev";
+  const json = parsed.options.json === true;
+  const token = await getDeveloperToken(cfg, {
+    configPath: cfg.configPath,
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    openApprovalUrl: deps.openUrl
+  }, doFetch, out, { optionalProjectCapabilities: ["app.manage"] });
+  if (action2 === "show") {
+    const body2 = await get(
+      doFetch,
+      `${repositoryUrl(cfg)}?env=${encodeURIComponent(env)}`,
+      token,
+      "repository read"
+    );
+    if (json) return out.log(JSON.stringify(body2, null, 2));
+    const bound = body2.environmentRepository;
+    return out.log(bound ? `${cfg.app.id} (${env}) \u2192 ${bound.owner}/${bound.name}` : `${cfg.app.id} (${env}) has no connected repository. Connect one with "odla-ai code repository bind --repo owner/name --env ${env}".`);
+  }
+  const found = await catalogue(doFetch, cfg.platformUrl, token);
+  if (action2 === "list") {
+    if (json) return out.log(JSON.stringify({ repositories: found }, null, 2));
+    if (!found.length) return out.log("no repositories reachable through your installations");
+    out.log("REPOSITORY	INSTALL	DEFAULT	READY");
+    for (const repository of found) {
+      out.log(`${repository.fullName}	${repository.installationId}	${repository.defaultBranch ?? "\u2014"}	${repository.ready ? "yes" : "empty"}`);
+    }
+    return;
+  }
+  const repo = stringOpt(parsed.options.repo);
+  if (!repo?.includes("/")) throw new Error("code repository bind requires --repo owner/name");
+  const selected = selectRepository(found, repo);
+  if (!selected.ready) {
+    throw new Error(`${selected.fullName} has no commits yet; GitHub cannot serve a default branch for an empty repository.`);
+  }
+  const response2 = await doFetch(repositoryUrl(cfg, "/bind"), {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({ env, installationId: selected.installationId, repositoryId: selected.repositoryId })
+  });
+  if (!response2.ok) {
+    throw new Error(`repository bind failed (${response2.status}): ${redactSecrets((await response2.text()).slice(0, 1e3))}`);
+  }
+  const body = await response2.json();
+  if (json) return out.log(JSON.stringify(body, null, 2));
+  out.log(`connected ${cfg.app.id} (${env}) to ${selected.fullName} @ ${selected.defaultBranch}`);
+  out.log(`Next, so it may be worked on unattended:
+  odla-ai code grant request --env ${env}`);
+}
+
 // src/code-command.ts
 async function codeCommand(parsed, dependencies) {
   const sub = parsed.positionals[1];
+  if (sub === "grant") {
+    return await codeGrantCommand(parsed, {
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout,
+      openUrl: dependencies.openUrl
+    });
+  }
+  if (sub === "repository") {
+    return await codeRepositoryCommand(parsed, {
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout,
+      openUrl: dependencies.openUrl
+    });
+  }
   if (sub !== "connect") {
-    throw new Error(`unknown code subcommand "${sub ?? ""}". Try "odla-ai code connect --env dev".`);
+    throw new Error(
+      `unknown code subcommand "${sub ?? ""}". Try "odla-ai code connect --env dev" or "odla-ai code grant list --env dev".`
+    );
   }
   assertArgs(parsed, [
     "config",
@@ -10087,8 +10325,8 @@ Usage:
   odla-ai runbook revert <slug> --version <n> [--app <id>]
   odla-ai runbook rm <slug> [--app <id>]
   odla-ai capabilities [--json]
-  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
-  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--no-open] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
+  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--no-open] [--json]
   odla-ai admin ai models [--context <name>] [--provider <id>] [--json]
   odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]
     [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]
@@ -10107,7 +10345,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
   odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--runtime] [--email <odla-account>] [--no-open]
@@ -10122,7 +10360,7 @@ function printHelp(output = console) {
   output.log(`odla-ai
 ${USAGE_SECTION}
 Commands:
-  auth         Start a fresh, exact-project agent authorization in the browser.
+  auth         Start a fresh, exact-project agent authorization for human review.
                The email is the signed-in odla account, never git or GitHub
                identity. The approval screen confirms the agent name first.
   agent        Inspect durable agent wakeups and explicitly requeue a
@@ -10183,6 +10421,9 @@ Commands:
                \u2014 no secret is ever copied between people.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
+               "code repository show" reports the repository an app works on (Studio or a
+               human session connects one); "code grant request|list|approve|revoke" then
+               governs unattended access: an agent may request, only a human may approve.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
   pm           Project management (via @odla-ai/pm): Products contain Projects;
@@ -10252,23 +10493,25 @@ Safety:
   the metadata file. Flags and specific ODLA_* scope variables beat a selected
   context, which beats project config. There is no ambient current context.
   "context show" reports only provenance and cache state and never authenticates.
-  Every real CLI handshake prints one canonical /studio?code= approval URL and
-  attempts to open it \u2014 including in CI, SSH, display-less, and agent-driven
-  shells. Only --no-open suppresses the attempt. Browser launch is best-effort:
-  agents with browser control must open that exact URL immediately; otherwise
-  they must give it to the human verbatim. A device code remains only in the
-  running process. Outside an interactive terminal the wait is capped (90s by
-  default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75. Rerunning always requests and opens a new code; older clients'
-  persisted pending state is discarded.
+  Every real CLI handshake prints one canonical /studio?code= approval URL.
+  Interactive humans may let the CLI attempt its best-effort browser launch.
+  Agent-driven commands must pass --no-open --wait 600, immediately surface the
+  exact URL and code as a clickable human approval action, and keep that CLI
+  process alive. Wait only on that same process: the CLI owns protocol polling.
+  Do not call OS open, use browser control, curl handshake endpoints, build a
+  shell wait loop, detach the command, or start a substitute handshake. The
+  device code remains only in the running process. If the process exits 75, its
+  old code cannot be collected; a later invocation requests a new code. Older
+  clients' persisted pending state is discarded.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. It is the email shown by the signed-in odla account \u2014 never infer it
   from git config, a commit author, or GitHub. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
-  Use "auth login --app <id> --email <odla-account>" when an outside agent needs
-  a deliberate fresh request; it ignores cached credentials and opens the same
-  focused authorization sequence used by every first-time command.
+  Use "auth login --app <id> --email <odla-account> --no-open --wait 600" when
+  an outside agent needs a deliberate fresh request; it ignores cached
+  credentials and uses the same focused authorization sequence as every
+  first-time command.
   If provision reports that the current agent principal has no live app.manage
   grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
   the local cache, prints and opens a fresh exact-project owner-review URL, then
@@ -10281,6 +10524,17 @@ Safety:
   approval and credential hashes live in odla-ai/db. The host
   credential is never written under .odla/; it exists only in the foreground
   "code connect" process and is rotated by the next approved connection.
+  "code repository bind" takes owner/name and resolves the two GitHub integers the
+  bind route wants across every installation you have, refusing an ambiguous match
+  rather than choosing one \u2014 the same repository name under two organizations is
+  ordinary, and picking the first would connect an app to source nobody chose. It
+  needs a signed-in human session; a CLI handshake token is a delegated agent
+  credential by design, so an agent cannot choose the source it will be given.
+  Unattended access is per repository and revocable on its own, but the connection
+  IS the authorization: a repository is recorded for one exact app and environment
+  only by a signed-in human choosing it. "code grant list" shows what is authorized;
+  "revoke" stops unattended access without disconnecting the repository, and
+  re-binding never resurrects it. Connecting sandbox never authorizes live.
   Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
   OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
   GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
@@ -10647,7 +10901,7 @@ async function discussWatch(ctx, topicId, parsed) {
         throw new WatchRemoteError(cursor, error);
       }
       if (deadline !== void 0 && now() >= deadline) {
-        const result = report(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        const result = report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
         throw new WatchTimeoutError(result.cursor);
       }
       const base = Math.min(intervalMs, 1e3);
@@ -10688,7 +10942,7 @@ async function discussWatch(ctx, topicId, parsed) {
       });
       const posts = topicId ? matching.filter((event) => event.type === "message").map((event) => event.payload) : void 0;
       const topics = topicId ? void 0 : matching.filter((event) => event.type === "activity").map((event) => event.payload);
-      return report(ctx, parsed, {
+      return report2(ctx, parsed, {
         found: true,
         cursor,
         events: matching,
@@ -10715,13 +10969,13 @@ async function discussWatch(ctx, topicId, parsed) {
     }
     if (page2.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report(ctx, parsed, { found: false, cursor });
+      return report2(ctx, parsed, { found: false, cursor });
     }
     const wait2 = deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()));
     await sleep(wait2);
   }
 }
-function report(ctx, parsed, result) {
+function report2(ctx, parsed, result) {
   if (ctx.json) {
     ctx.out.log(JSON.stringify(result, null, 2));
   } else if (parsed.options.jsonl !== true && result.found) {
@@ -11318,7 +11572,7 @@ function eventLabel(event) {
   const body = event.payload.message?.body?.replace(/\s+/g, " ").trim();
   return body || event.payload.entityId;
 }
-function report2(ctx, parsed, result) {
+function report3(ctx, parsed, result) {
   if (ctx.json) ctx.out.log(JSON.stringify(result, null, 2));
   else if (parsed.options.jsonl !== true && result.found) {
     for (const event of result.events ?? []) {
@@ -11378,7 +11632,7 @@ async function pmWatch(ctx, parsed) {
       });
       if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES2) throw error;
       if (deadline !== void 0 && now() >= deadline) {
-        return report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        return report3(ctx, parsed, { found: false, cursor: cursor ?? "" });
       }
       const backoff = Math.min(
         MAX_BACKOFF_MS2,
@@ -11419,7 +11673,7 @@ async function pmWatch(ctx, parsed) {
         cursor,
         serverTime: current.serverTime
       });
-      return report2(ctx, parsed, { found: true, cursor, events: matching });
+      return report3(ctx, parsed, { found: true, cursor, events: matching });
     }
     if (current.events.length > 0) {
       jsonl2(ctx, parsed, {
@@ -11438,7 +11692,7 @@ async function pmWatch(ctx, parsed) {
     }
     if (current.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report2(ctx, parsed, { found: false, cursor });
+      return report3(ctx, parsed, { found: false, cursor });
     }
     await sleep(
       deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()))
@@ -11975,8 +12229,8 @@ function printO11yStatus(status, out) {
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
-  for (const line of providerCapacityLines(status.providerCapacity)) {
-    out.log(line);
+  for (const line2 of providerCapacityLines(status.providerCapacity)) {
+    out.log(line2);
   }
   const coverage = record9(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
   const coverageCounts = record9(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
@@ -13019,7 +13273,11 @@ var COMMAND_SURFACE = {
   bug: { create: {}, list: {}, report: {} },
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
-  code: { connect: {} },
+  code: {
+    connect: {},
+    grant: { request: {}, list: {}, approve: {}, revoke: {} },
+    repository: { show: {}, list: {}, bind: {} }
+  },
   config: { diff: {}, plan: {}, apply: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
   credentials: { list: {}, revoke: {} },
@@ -13334,8 +13592,8 @@ function parseRunbook(text3, slug) {
   const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text3);
   if (fm) {
     rest = text3.slice(fm[0].length);
-    for (const line of fm[1].split(/\r?\n/)) {
-      const pair = /^(\w+)\s*:\s*(.+)$/.exec(line.trim());
+    for (const line2 of fm[1].split(/\r?\n/)) {
+      const pair = /^(\w+)\s*:\s*(.+)$/.exec(line2.trim());
       if (!pair) continue;
       const value2 = pair[2].trim().replace(/^["']|["']$/g, "");
       if (pair[1] === "summary") meta.summary = value2;
@@ -13475,18 +13733,18 @@ function areaOf(path) {
   return parts[src + 2] !== void 0 ? parts[src + 1] ?? null : null;
 }
 function scanHunk(lines, into) {
-  for (const [i, line] of lines.entries()) {
-    const decl = DECL.exec(line);
+  for (const [i, line2] of lines.entries()) {
+    const decl = DECL.exec(line2);
     if (decl?.[1]) {
       into.add(decl[1]);
       continue;
     }
-    const named = NAMED.exec(line);
+    const named = NAMED.exec(line2);
     if (named?.[1]) {
       for (const name of namedExports(named[1])) into.add(name);
       continue;
     }
-    if (!JSDOC.test(line)) continue;
+    if (!JSDOC.test(line2)) continue;
     for (let j = i + 1; j < lines.length && j < i + 40; j++) {
       const found = ANY_DECL.exec(lines[j]);
       if (found?.[1]) {
@@ -13504,8 +13762,8 @@ function parseDiff(diff) {
     if (current && hunk.length) scanHunk(hunk, current.exports);
     hunk = [];
   };
-  for (const line of diff.split("\n")) {
-    const header = /^diff --git a\/(\S+) b\/(\S+)/.exec(line);
+  for (const line2 of diff.split("\n")) {
+    const header = /^diff --git a\/(\S+) b\/(\S+)/.exec(line2);
     if (header) {
       flush();
       const path = header[2] ?? header[1];
@@ -13513,11 +13771,11 @@ function parseDiff(diff) {
       files.set(path, current);
       continue;
     }
-    if (line.startsWith("@@")) {
+    if (line2.startsWith("@@")) {
       flush();
       continue;
     }
-    if (current && SOURCE2.test(current.path) && !TEST_PATH.test(current.path)) hunk.push(line);
+    if (current && SOURCE2.test(current.path) && !TEST_PATH.test(current.path)) hunk.push(line2);
   }
   flush();
   return [...files.values()];
@@ -13580,7 +13838,7 @@ function untrackedDiff(runGit, read3) {
     return "";
   }
   let out = "";
-  for (const path of listed.split("\n").map((line) => line.trim()).filter(Boolean)) {
+  for (const path of listed.split("\n").map((line2) => line2.trim()).filter(Boolean)) {
     out += `diff --git a/${path} b/${path}
 --- /dev/null
 +++ b/${path}
@@ -13593,7 +13851,7 @@ function untrackedDiff(runGit, read3) {
       continue;
     }
     out += `@@ -0,0 +1,${body.split("\n").length} @@
-${body.split("\n").map((line) => `+${line}`).join("\n")}
+${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 `;
   }
   return out;
@@ -13641,7 +13899,7 @@ async function assessImpact(ctx, surfaces, all, limit) {
   return out;
 }
 var editHint = (slug, appId) => `odla-ai runbook edit ${slug}${appId === PLATFORM_SCOPE ? "" : ` --app ${appId}`} --note "<what changed>"`;
-function report3(ctx, impacts) {
+function report4(ctx, impacts) {
   const covered = impacts.filter((i) => i.runbooks.length);
   ctx.out.log(
     `${impacts.length} changed surface${impacts.length === 1 ? "" : "s"}; ${covered.length} covered by a runbook. Reread each one and fix any step this change made wrong.`
@@ -13679,12 +13937,12 @@ async function runbookImpact(ctx, options, deps = {}) {
   }
   const impacts = await assessImpact(ctx, surfaces, options.all, options.limit ?? 4);
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
-  report3(ctx, impacts);
+  report4(ctx, impacts);
 }
 
 // src/runbook-lint.ts
 function invocationsIn(body) {
-  const re = /(`|npx[^\S\n]+)?(?:@odla-ai\/cli(?:@[\w.-]+)?|odla-ai)((?:[^\S\n]+[a-z][\w-]*)+)/g;
+  const re = /(`|npx[^\S\n]+(?:--yes[^\S\n]+)?)?(?:@odla-ai\/cli(?:@[\w.-]+)?|odla-ai)((?:[^\S\n]+[a-z][\w-]*)+)/g;
   const found = [];
   for (const match of body.matchAll(re)) {
     if (!match[1]) continue;
@@ -13755,7 +14013,7 @@ async function runbookSearch(ctx, query, all, limit) {
   for (const [i, hit] of result.hits.entries()) {
     if (i) ctx.out.log("");
     ctx.out.log(`${hit.slug}${hit.heading ? ` \xA7 ${hit.heading}` : ""}  (v${hit.version})`);
-    for (const line of hit.excerpt.split("\n")) ctx.out.log(`  ${line}`);
+    for (const line2 of hit.excerpt.split("\n")) ctx.out.log(`  ${line2}`);
     ctx.out.log(`  source: ${hit.slug}${hit.anchor ? `#${hit.anchor}` : ""} \xB7 ${hit.command}`);
   }
 }
@@ -13880,7 +14138,8 @@ var ALLOWED2 = [
   "base",
   "requires",
   "platform",
-  "context"
+  "context",
+  "open"
 ];
 function requireSlug(slug, action2) {
   if (!slug) throw new Error(`"runbook ${action2}" needs a slug, e.g. "odla-ai runbook ${action2} release"`);
@@ -13908,6 +14167,7 @@ async function buildContext3(parsed, deps, action2) {
     };
   }
   const needsCapability = WRITES2.has(action2) && !dryRun && appId === PLATFORM_SCOPE && !stringOpt(parsed.options.token);
+  const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
   const token = needsCapability ? await getScopedPlatformToken({
     platform: cfg.platformUrl,
     scope: "platform:runbook:write",
@@ -13915,6 +14175,7 @@ async function buildContext3(parsed, deps, action2) {
     label: `odla CLI (runbook ${action2})`,
     fetch: doFetch,
     stdout: out,
+    open,
     openApprovalUrl: deps.openUrl,
     // A project, named context, or the global operator context owns the
     // exact-scope cache; it never follows an arbitrary shell directory.
@@ -13926,11 +14187,7 @@ async function buildContext3(parsed, deps, action2) {
       configPath: cfg.configPath,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
-      // Let the normal browser policy decide (it already suppresses tests,
-      // CI and SSH). Hardcoding `false` meant a first-time handshake printed
-      // a link and opened nothing — the one moment a browser is the whole
-      // point.
-      open: void 0
+      open
     },
     doFetch,
     out
@@ -14131,31 +14388,31 @@ function printHostedJob(out, job, platform, appId) {
   url.searchParams.set("job", job.jobId);
   out.log(`  Studio: ${url.toString()}`);
 }
-function printHostedReport(out, report4) {
-  out.log(`security report ${report4.jobId}: ${report4.repository}@${report4.revision}`);
-  out.log(`  coverage: ${report4.coverageStatus} cells=${report4.metrics.coverageCells} shallow=${report4.metrics.shallowCells} blocked=${report4.metrics.blockedCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
-  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates} rejected=${report4.metrics.rejected}`);
-  out.log(`  discovery: ${report4.provenance.discovery?.provider ?? "unknown"}/${report4.provenance.discovery?.model ?? "unknown"}`);
-  out.log(`  validation: ${report4.provenance.validation?.provider ?? "unknown"}/${report4.provenance.validation?.model ?? "unknown"} independent=${String(report4.provenance.independentValidation)}`);
-  for (const finding of report4.findings) {
+function printHostedReport(out, report5) {
+  out.log(`security report ${report5.jobId}: ${report5.repository}@${report5.revision}`);
+  out.log(`  coverage: ${report5.coverageStatus} cells=${report5.metrics.coverageCells} shallow=${report5.metrics.shallowCells} blocked=${report5.metrics.blockedCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates} rejected=${report5.metrics.rejected}`);
+  out.log(`  discovery: ${report5.provenance.discovery?.provider ?? "unknown"}/${report5.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report5.provenance.validation?.provider ?? "unknown"}/${report5.provenance.validation?.model ?? "unknown"} independent=${String(report5.provenance.independentValidation)}`);
+  for (const finding of report5.findings) {
     const location = finding.locations[0];
     out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
   }
-  for (const limitation of report4.limitations) out.log(`  limitation: ${limitation}`);
+  for (const limitation of report5.limitations) out.log(`  limitation: ${limitation}`);
 }
-function enforceHostedReportGate(report4, parsed, out, emitSuccess) {
+function enforceHostedReportGate(report5, parsed, out, emitSuccess) {
   const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
   const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
-  const confirmed = report4.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
-  const leads = failOnCandidates ? report4.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
-  const incomplete = report4.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = report5.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report5.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report5.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
-    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report4.coverageStatus}` : ""}`);
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report5.coverageStatus}` : ""}`);
   }
   if (emitSuccess) {
-    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report4.coverageStatus}. This is not proof that the application is secure.`);
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report5.coverageStatus}. This is not proof that the application is secure.`);
   }
 }
 function printHostedSecurityPlanRoute(out, label, route3) {
@@ -14238,17 +14495,17 @@ async function runHostedSecurity(options) {
       allowNetwork: false
     }
   });
-  const report4 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await (0, import_node3.writeSecurityArtifacts)(output, report4);
-  const reportDigest = await (0, import_security.securityFingerprint)(report4);
+  const report5 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await (0, import_node3.writeSecurityArtifacts)(output, report5);
+  const reportDigest = await (0, import_security.securityFingerprint)(report5);
   await hosted.complete({
     reportDigest,
-    coverageStatus: report4.coverageStatus,
-    confirmed: report4.metrics.confirmed,
-    candidates: report4.metrics.candidates
+    coverageStatus: report5.coverageStatus,
+    confirmed: report5.metrics.confirmed,
+    candidates: report5.metrics.candidates
   }, { signal: options.signal });
-  printSummary(options.stdout ?? console, appId, env, hosted.run, report4, output);
-  return Object.freeze({ report: report4, run: hosted.run, output });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report5, output);
+  return Object.freeze({ report: report5, run: hosted.run, output });
 }
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
@@ -14274,14 +14531,14 @@ function profileFor(name, maxHuntTasks) {
   if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
   return { ...profile, maxHuntTasks };
 }
-function printSummary(out, appId, env, run, report4, output) {
-  const complete = report4.coverage.filter((cell) => cell.state === "complete").length;
+function printSummary(out, appId, env, run, report5, output) {
+  const complete = report5.coverage.filter((cell) => cell.state === "complete").length;
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
-  if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
-  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
+  out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
+  if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
   out.log(`  report: ${(0, import_node_path19.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
@@ -14528,13 +14785,13 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     }
     throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
   }
-  const report4 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  const report5 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
   if (parsed.options.json === true) {
-    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report4 }, null, 2));
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report5 }, null, 2));
   } else {
-    printHostedReport(context.stdout, report4);
+    printHostedReport(context.stdout, report5);
   }
-  enforceHostedReportGate(report4, parsed, context.stdout, parsed.options.json !== true);
+  enforceHostedReportGate(report5, parsed, context.stdout, parsed.options.json !== true);
 }
 async function runLocalSecurityCommand(parsed, dependencies) {
   if (parsed.options.source === true) {
@@ -14602,13 +14859,13 @@ async function runLocalSecurityCommand(parsed, dependencies) {
   });
   enforceLocalGate(result.report, parsed);
 }
-function enforceLocalGate(report4, parsed) {
+function enforceLocalGate(report5, parsed) {
   const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-  const confirmed = (0, import_security2.findingsAtOrAbove)(report4, failOn);
-  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report4, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-  const incomplete = report4.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = (0, import_security2.findingsAtOrAbove)(report5, failOn);
+  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report5, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report5.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
@@ -14647,9 +14904,9 @@ async function securityCommand(parsed, dependencies) {
     assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
-    const report4 = await getHostedSecurityReport({ ...context, jobId });
-    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report4, null, 2));
-    else printHostedReport(context.stdout, report4);
+    const report5 = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report5, null, 2));
+    else printHostedReport(context.stdout, report5);
     return;
   }
   if (sub !== "run") {