@odla-ai/cli 0.35.0 → 0.35.3

package/dist/bin.cjs

@@ -347,10 +347,40 @@ var init_handshake_state = __esm({
   }
 });
 
+// src/cached-credential.ts
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  (0, import_node_fs5.rmSync)(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
+    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
+  ].join("\n");
+}
+var import_node_fs5, noted;
+var init_cached_credential = __esm({
+  "src/cached-credential.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_fs5 = require("fs");
+    noted = null;
+  }
+});
+
 // src/local.ts
 function readJsonFile(path) {
   try {
-    return JSON.parse((0, import_node_fs5.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
@@ -360,10 +390,10 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!(0, import_node_fs5.existsSync)(path)) return null;
+  if (!(0, import_node_fs6.existsSync)(path)) return null;
   let value2;
   try {
-    value2 = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf8"));
+    value2 = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
   } catch {
     throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
   }
@@ -394,13 +424,13 @@ function mergeCredential(current, update) {
 }
 function ensureGitignore(rootDir, localPaths = []) {
   const path = (0, import_node_path3.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs5.existsSync)(path) ? (0, import_node_fs5.readFileSync)(path, "utf8") : "";
+  const existing = (0, import_node_fs6.existsSync)(path) ? (0, import_node_fs6.readFileSync)(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs5.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+  (0, import_node_fs6.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
 `);
 }
 function o11yDevVars(cfg) {
@@ -428,7 +458,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = (0, import_node_fs5.existsSync)(path) ? (0, import_node_fs5.readFileSync)(path, "utf8") : "";
+  const existing = (0, import_node_fs6.existsSync)(path) ? (0, import_node_fs6.readFileSync)(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -442,11 +472,11 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text3) {
-  (0, import_node_fs5.mkdirSync)((0, import_node_path3.dirname)(path), { recursive: true });
+  (0, import_node_fs6.mkdirSync)((0, import_node_path3.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs5.writeFileSync)(temporary, text3, { mode: 384 });
-  (0, import_node_fs5.chmodSync)(temporary, 384);
-  (0, import_node_fs5.renameSync)(temporary, path);
+  (0, import_node_fs6.writeFileSync)(temporary, text3, { mode: 384 });
+  (0, import_node_fs6.chmodSync)(temporary, 384);
+  (0, import_node_fs6.renameSync)(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
   const rel = (0, import_node_path3.relative)((0, import_node_path3.resolve)(rootDir), (0, import_node_path3.resolve)(path));
@@ -457,12 +487,12 @@ function displayPath(path, rootDir = process.cwd()) {
   const rel = (0, import_node_path3.relative)(rootDir, path);
   return rel && !rel.startsWith("..") ? rel : path;
 }
-var import_node_fs5, import_node_path3, GITIGNORE_LINES, MANAGED_DEV_VARS;
+var import_node_fs6, import_node_path3, GITIGNORE_LINES, MANAGED_DEV_VARS;
 var init_local = __esm({
   "src/local.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs5 = require("fs");
+    import_node_fs6 = require("fs");
     import_node_path3 = require("path");
     GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
     MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
@@ -499,6 +529,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
       out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      noteCachedCredential(cfg.local.tokenFile);
       return cached.token;
     }
   } else {
@@ -638,6 +669,7 @@ var init_token = __esm({
     import_node_process4 = __toESM(require("process"), 1);
     init_handshake_approval();
     init_handshake_state();
+    init_cached_credential();
     init_local();
   }
 });
@@ -729,7 +761,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   if (options.cache !== false) {
     const tokens = cache2?.platform === audience ? { ...cache2.tokens ?? {} } : {};
     tokens[scope] = { token, expiresAt };
-    if ((0, import_node_fs6.existsSync)((0, import_node_path4.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
+    if ((0, import_node_fs7.existsSync)((0, import_node_path4.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
     writePrivateJson(tokenFile, { platform: audience, email, tokens });
     out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   } else {
@@ -737,12 +769,12 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   }
   return token;
 }
-var import_node_fs6, import_node_path4, import_node_process6, import_db2, SCOPE_PURPOSE;
+var import_node_fs7, import_node_path4, import_node_process6, import_db2, SCOPE_PURPOSE;
 var init_admin_ai_auth = __esm({
   "src/admin-ai-auth.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs6 = require("fs");
+    import_node_fs7 = require("fs");
     import_node_path4 = require("path");
     import_node_process6 = __toESM(require("process"), 1);
     import_db2 = require("@odla-ai/db");
@@ -1660,7 +1692,7 @@ var init_monitoring_validation = __esm({
 // src/config.ts
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = (0, import_node_path5.resolve)(configPath);
-  if (!(0, import_node_fs7.existsSync)(resolved)) {
+  if (!(0, import_node_fs8.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
@@ -1695,7 +1727,7 @@ async function resolveDataExport(cfg, value2, names) {
   if (typeof value2 !== "string") return value2;
   const target = (0, import_node_path5.isAbsolute)(value2) ? value2 : (0, import_node_path5.resolve)(cfg.rootDir, value2);
   if (target.endsWith(".json")) {
-    return JSON.parse((0, import_node_fs7.readFileSync)(target, "utf8"));
+    return JSON.parse((0, import_node_fs8.readFileSync)(target, "utf8"));
   }
   const mod = await import((0, import_node_url.pathToFileURL)(target).href);
   for (const name of names) {
@@ -1771,7 +1803,7 @@ function validId2(value2) {
   return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs8.readFileSync)(path, "utf8"));
   const nonce = `${Date.now()}-${configImportSerial++}`;
   const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?reload=${nonce}`);
   const value2 = mod.default ?? mod.config;
@@ -1784,12 +1816,12 @@ function trimSlash(value2) {
 function unique3(values) {
   return [...new Set(values.filter(Boolean))];
 }
-var import_node_fs7, import_node_path5, import_node_url, import_apps, DEFAULT_PLATFORM, DEFAULT_ENVS, DEFAULT_SERVICES, configImportSerial, GOOGLE_CALENDAR_EVENTS_SCOPE;
+var import_node_fs8, import_node_path5, import_node_url, import_apps, DEFAULT_PLATFORM, DEFAULT_ENVS, DEFAULT_SERVICES, configImportSerial, GOOGLE_CALENDAR_EVENTS_SCOPE;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs7 = require("fs");
+    import_node_fs8 = require("fs");
     import_node_path5 = require("path");
     import_node_url = require("url");
     import_apps = require("@odla-ai/apps");
@@ -1868,10 +1900,10 @@ function assertOperatorName(value2, label) {
   }
 }
 function readOperatorProfiles(file) {
-  if (!(0, import_node_fs8.existsSync)(file)) return emptyProfiles();
+  if (!(0, import_node_fs9.existsSync)(file)) return emptyProfiles();
   let raw;
   try {
-    raw = JSON.parse((0, import_node_fs8.readFileSync)(file, "utf8"));
+    raw = JSON.parse((0, import_node_fs9.readFileSync)(file, "utf8"));
   } catch {
     throw new Error(`operator context file ${file} is not valid JSON`);
   }
@@ -1929,12 +1961,12 @@ function clean(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_fs8, import_node_os, import_node_path6, import_node_process8;
+var import_node_fs9, import_node_os, import_node_path6, import_node_process8;
 var init_operator_profiles = __esm({
   "src/operator-profiles.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs8 = require("fs");
+    import_node_fs9 = require("fs");
     import_node_os = require("os");
     import_node_path6 = require("path");
     import_node_process8 = __toESM(require("process"), 1);
@@ -1950,7 +1982,7 @@ async function resolveOperatorContext(parsed, options = {}) {
   const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const configPath = (0, import_node_path7.resolve)(configArgument);
   const explicitConfig = parsed.options.config !== void 0;
-  const hasConfig = (0, import_node_fs9.existsSync)(configPath);
+  const hasConfig = (0, import_node_fs10.existsSync)(configPath);
   if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
     await loadProjectConfig(configArgument);
   }
@@ -2036,12 +2068,12 @@ function clean2(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_fs9, import_node_path7, import_node_process9, DEFAULT_PLATFORM2;
+var import_node_fs10, import_node_path7, import_node_process9, DEFAULT_PLATFORM2;
 var init_operator_context = __esm({
   "src/operator-context.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs9 = require("fs");
+    import_node_fs10 = require("fs");
     import_node_path7 = require("path");
     import_node_process9 = __toESM(require("process"), 1);
     init_argv();
@@ -2507,7 +2539,7 @@ async function appImport(options) {
   const out = options.stdout ?? console;
   const say = options.json ? (line2) => out.error(line2) : (line2) => out.log(line2);
   const { tenant } = resolveTenant(cfg, options.env);
-  const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs10.readFileSync)(0, "utf8")))() : (0, import_node_fs10.readFileSync)(options.file, "utf8");
+  const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs11.readFileSync)(0, "utf8")))() : (0, import_node_fs11.readFileSync)(options.file, "utf8");
   const { format, sources } = (0, import_import.parseImport)(text3, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -2535,12 +2567,12 @@ ${detail}${more}`);
   }
   return requireStudioHuman(options.configPath, "database import", "database", options.env);
 }
-var import_node_fs10, import_import;
+var import_node_fs11, import_import;
 var init_app_import = __esm({
   "src/app-import.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs10 = require("fs");
+    import_node_fs11 = require("fs");
     import_import = require("@odla-ai/db/import");
     init_config();
     init_human_session();
@@ -3537,7 +3569,7 @@ var init_config_reconcile_digest = __esm({
 function readPlan(path) {
   let value2;
   try {
-    const raw = (0, import_node_fs11.readFileSync)(path, "utf8");
+    const raw = (0, import_node_fs12.readFileSync)(path, "utf8");
     if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
     value2 = JSON.parse(raw);
   } catch (error) {
@@ -3653,13 +3685,13 @@ function invalidPlan(message2) {
 function record3(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
-var import_apps3, import_node_fs11, DIGEST, REVISION, OPERATION_ID, ACTION_ID, ENV, SERVICE;
+var import_apps3, import_node_fs12, DIGEST, REVISION, OPERATION_ID, ACTION_ID, ENV, SERVICE;
 var init_config_operation_validate = __esm({
   "src/config-operation-validate.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps3 = require("@odla-ai/apps");
-    import_node_fs11 = require("fs");
+    import_node_fs12 = require("fs");
     init_config_operation_error();
     init_config_reconcile_digest();
     DIGEST = /^sha256:[0-9a-f]{64}$/;
@@ -4477,14 +4509,14 @@ var init_config_reconcile_command = __esm({
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
     const path = (0, import_node_path11.join)(rootDir, name);
-    if ((0, import_node_fs12.existsSync)(path)) return path;
+    if ((0, import_node_fs13.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs12.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs13.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -4588,13 +4620,13 @@ function wranglerBulkSecrets(run, opts) {
   ];
   return run("npx", args, { input: JSON.stringify(opts.secrets), cwd: opts.cwd });
 }
-var import_node_child_process2, import_node_fs12, import_node_path11, defaultRunner, WRANGLER_CONFIG_FILES;
+var import_node_child_process2, import_node_fs13, import_node_path11, defaultRunner, WRANGLER_CONFIG_FILES;
 var init_wrangler = __esm({
   "src/wrangler.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process2 = require("child_process");
-    import_node_fs12 = require("fs");
+    import_node_fs13 = require("fs");
     import_node_path11 = require("path");
     defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
       const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
@@ -4657,7 +4689,7 @@ function wranglerWarnings(rootDir) {
       const dir = (0, import_node_path12.resolve)(rootDir, assets.directory);
       if (dir === (0, import_node_path12.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs13.existsSync)((0, import_node_path12.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs14.existsSync)((0, import_node_path12.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4693,12 +4725,12 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? (0, import_node_path12.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs13.existsSync)(main)) {
+  if (!main || !(0, import_node_fs14.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs13.readFileSync)(main, "utf8");
+      source = (0, import_node_fs14.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -4722,18 +4754,18 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path12.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs14.readFileSync)((0, import_node_path12.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }
-var import_node_child_process3, import_node_fs13, import_node_path12, defaultExec;
+var import_node_child_process3, import_node_fs14, import_node_path12, defaultExec;
 var init_doctor_checks = __esm({
   "src/doctor-checks.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process3 = require("child_process");
-    import_node_fs13 = require("fs");
+    import_node_fs14 = require("fs");
     import_node_path12 = require("path");
     init_redact();
     init_local();
@@ -5073,7 +5105,7 @@ function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path13.resolve)(options.rootDir ?? process.cwd());
   const configPath = (0, import_node_path13.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs14.existsSync)(configPath) && !options.force) {
+  if ((0, import_node_fs15.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -5089,10 +5121,10 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  (0, import_node_fs14.mkdirSync)((0, import_node_path13.dirname)(configPath), { recursive: true });
-  (0, import_node_fs14.mkdirSync)((0, import_node_path13.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs14.mkdirSync)((0, import_node_path13.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs14.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  (0, import_node_fs15.mkdirSync)((0, import_node_path13.dirname)(configPath), { recursive: true });
+  (0, import_node_fs15.mkdirSync)((0, import_node_path13.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs15.mkdirSync)((0, import_node_path13.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs15.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing((0, import_node_path13.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing((0, import_node_path13.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
@@ -5101,8 +5133,8 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text3) {
-  if ((0, import_node_fs14.existsSync)(path)) return;
-  (0, import_node_fs14.writeFileSync)(path, text3);
+  if ((0, import_node_fs15.existsSync)(path)) return;
+  (0, import_node_fs15.writeFileSync)(path, text3);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -5205,12 +5237,12 @@ function defaultKeyEnv(provider) {
 function relativeDisplay(path, rootDir) {
   return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;
 }
-var import_node_fs14, import_node_path13, import_apps9;
+var import_node_fs15, import_node_path13, import_apps9;
 var init_init = __esm({
   "src/init.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs14 = require("fs");
+    import_node_fs15 = require("fs");
     import_node_path13 = require("path");
     import_apps9 = require("@odla-ai/apps");
     init_local();
@@ -5559,7 +5591,7 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path14.join)(targetDir2, rel), (0, import_node_fs15.readFileSync)((0, import_node_path14.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path14.join)(targetDir2, rel), (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
@@ -5579,7 +5611,7 @@ function installSkill(options = {}) {
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = (0, import_node_fs15.readFileSync)((0, import_node_path14.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        const canonical2 = (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(sourceDir, skill, "SKILL.md"), "utf8");
         plan((0, import_node_path14.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
@@ -5614,11 +5646,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs15.existsSync)(file.target)) {
+    if (!(0, import_node_fs16.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs15.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs16.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -5635,9 +5667,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs15.existsSync)(file.target) || (0, import_node_fs15.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs15.mkdirSync)((0, import_node_path14.dirname)(file.target), { recursive: true });
-      (0, import_node_fs15.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs16.existsSync)(file.target) || (0, import_node_fs16.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs16.mkdirSync)((0, import_node_path14.dirname)(file.target), { recursive: true });
+      (0, import_node_fs16.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -5678,9 +5710,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs15.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs16.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs15.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs16.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -5709,7 +5741,7 @@ function symlinkedComponent(boundary, target) {
   for (const part of rel.split(import_node_path14.sep).filter(Boolean)) {
     current = (0, import_node_path14.join)(current, part);
     try {
-      if ((0, import_node_fs15.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs16.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -5720,10 +5752,10 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs15.existsSync)(dir)) return [];
+  if (!(0, import_node_fs16.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs15.readdirSync)(current, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs16.readdirSync)(current, { withFileTypes: true })) {
       const path = (0, import_node_path14.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push((0, import_node_path14.relative)(dir, path));
@@ -5732,12 +5764,12 @@ function listFiles(dir) {
   walk(dir);
   return results.sort();
 }
-var import_node_fs15, import_node_os2, import_node_path14, import_node_url2, AGENT_HARNESSES;
+var import_node_fs16, import_node_os2, import_node_path14, import_node_url2, AGENT_HARNESSES;
 var init_skill = __esm({
   "src/skill.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs15 = require("fs");
+    import_node_fs16 = require("fs");
     import_node_os2 = require("os");
     import_node_path14 = require("path");
     import_node_url2 = require("url");
@@ -10255,7 +10287,7 @@ var init_code_runtime_config = __esm({
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = (0, import_node_path15.resolve)(cwd, options.configPath);
-  const cfg = (0, import_node_fs16.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const cfg = (0, import_node_fs17.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -10419,12 +10451,12 @@ function apiFailure(action2, status, value2) {
 function record6(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
-var import_node_fs16, import_node_os3, import_node_path15;
+var import_node_fs17, import_node_os3, import_node_path15;
 var init_code_connect = __esm({
   "src/code-connect.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs16 = require("fs");
+    import_node_fs17 = require("fs");
     import_node_os3 = require("os");
     import_node_path15 = require("path");
     init_node();
@@ -14408,22 +14440,52 @@ function recordInvocation(parsed) {
       options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs17.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs18.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
 }
-var import_node_fs17, import_node_process13;
+var import_node_fs18, import_node_process13;
 var init_record = __esm({
   "src/record.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs17 = require("fs");
+    import_node_fs18 = require("fs");
     import_node_process13 = __toESM(require("process"), 1);
     init_surface();
   }
 });
 
+// src/advisory-output.ts
+function advisoryCollectingFetch(inner, sink) {
+  return (async (input, init) => {
+    const response2 = await inner(input, init);
+    try {
+      sink.push(...(0, import_apps14.parseAdvisories)(response2));
+    } catch {
+    }
+    return response2;
+  });
+}
+function renderAdvisories(out, advisories, env = process.env) {
+  if (env.ODLA_NO_ADVISORIES) return;
+  const seen = /* @__PURE__ */ new Set();
+  for (const advisory of advisories) {
+    const key = `${advisory.code}:${advisory.message}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.error((0, import_apps14.formatAdvisory)(advisory));
+  }
+}
+var import_apps14;
+var init_advisory_output = __esm({
+  "src/advisory-output.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_apps14 = require("@odla-ai/apps");
+  }
+});
+
 // src/runbook-actions.ts
 async function call(ctx, method, path, body) {
   const res = await ctx.doFetch(`${ctx.platformUrl.replace(/\/$/, "")}/registry/pm${path}`, {
@@ -14452,14 +14514,25 @@ async function bySlug(ctx, slug) {
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const found = page2.records[0];
-  if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
-  return found;
+  const filtered = page2.records.find((record11) => record11.slug === slug);
+  if (filtered) return filtered;
+  const limit = 100;
+  for (let offset = 0; ; offset += limit) {
+    const fallback = await call(
+      ctx,
+      "GET",
+      `/runbook?app=${encodeURIComponent(ctx.appId)}&limit=${limit}&offset=${offset}`
+    );
+    const found = fallback.records.find((record11) => record11.slug === slug);
+    if (found) return found;
+    if (!fallback.records.length || offset + fallback.records.length >= fallback.total) break;
+  }
+  throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
 }
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs18.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs19.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 async function runbookList(ctx, all, query) {
   const params = new URLSearchParams();
@@ -14538,7 +14611,7 @@ async function runbookRevert(ctx, slug, version) {
     ctx,
     "POST",
     `/runbook/${encodeURIComponent(runbook.id)}/revert`,
-    { version }
+    { version, expectedVersion: runbook.version }
   );
   if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
   ctx.out.log(`${slug} reverted to v${version}, now v${result.record?.version ?? runbook.version + 1}`);
@@ -14548,12 +14621,12 @@ async function runbookRemove(ctx, slug) {
   await call(ctx, "DELETE", `/runbook/${encodeURIComponent(runbook.id)}`);
   ctx.out.log(`removed ${slug}`);
 }
-var import_node_fs18, PLATFORM_SCOPE, stamp;
+var import_node_fs19, PLATFORM_SCOPE, stamp;
 var init_runbook_actions = __esm({
   "src/runbook-actions.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs18 = require("fs");
+    import_node_fs19 = require("fs");
     init_version();
     init_runbook_requires();
     PLATFORM_SCOPE = "$platform";
@@ -14586,12 +14659,12 @@ function parseRunbook(text3, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs19.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs19.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs20.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs20.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = (0, import_node_path17.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs19.readFileSync)((0, import_node_path17.join)(dir, file), "utf8"), slug);
+    const parsed = parseRunbook((0, import_node_fs20.readFileSync)((0, import_node_path17.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -14661,12 +14734,12 @@ async function upsert(ctx, r, visibility) {
   );
   return "updated";
 }
-var import_node_fs19, import_node_path17;
+var import_node_fs20, import_node_path17;
 var init_runbook_import = __esm({
   "src/runbook-import.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs19 = require("fs");
+    import_node_fs20 = require("fs");
     import_node_path17 = require("path");
     init_runbook_actions();
   }
@@ -14846,9 +14919,9 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 function manifestLabeller(root) {
   return (workspace) => {
     const manifest = (0, import_node_path18.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs20.existsSync)(manifest)) return void 0;
+    if (!(0, import_node_fs21.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs20.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs21.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -14914,7 +14987,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs20.readFileSync)((0, import_node_path18.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs21.readFileSync)((0, import_node_path18.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -14925,13 +14998,13 @@ async function runbookImpact(ctx, options, deps = {}) {
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
   report4(ctx, impacts);
 }
-var import_node_child_process6, import_node_fs20, import_node_path18, SOURCE3, editHint;
+var import_node_child_process6, import_node_fs21, import_node_path18, SOURCE3, editHint;
 var init_runbook_impact = __esm({
   "src/runbook-impact.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process6 = require("child_process");
-    import_node_fs20 = require("fs");
+    import_node_fs21 = require("fs");
     import_node_path18 = require("path");
     init_runbook_impact_scan();
     init_runbook_actions();
@@ -15101,25 +15174,25 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs21.mkdtempSync)((0, import_node_path19.join)((0, import_node_os4.tmpdir)(), "odla-runbook-"));
+  const dir = (0, import_node_fs22.mkdtempSync)((0, import_node_path19.join)((0, import_node_os4.tmpdir)(), "odla-runbook-"));
   const file = (0, import_node_path19.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs21.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs22.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs21.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs22.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs21.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
   }
 }
-var import_node_child_process7, import_node_fs21, import_node_os4, import_node_path19, import_node_process14, EDITOR_ENV, defaultRunOrInjected;
+var import_node_child_process7, import_node_fs22, import_node_os4, import_node_path19, import_node_process14, EDITOR_ENV, defaultRunOrInjected;
 var init_runbook_editor = __esm({
   "src/runbook-editor.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process7 = require("child_process");
-    import_node_fs21 = require("fs");
+    import_node_fs22 = require("fs");
     import_node_os4 = require("os");
     import_node_path19 = require("path");
     import_node_process14 = __toESM(require("process"), 1);
@@ -16100,6 +16173,23 @@ __export(cli_exports, {
   runCli: () => runCli
 });
 async function runCli(argv2 = process.argv.slice(2), dependencies = {}) {
+  const out = redactingOutput(dependencies.stdout ?? console);
+  const advisories = [];
+  const withAdvisoryReader = {
+    ...dependencies,
+    fetch: advisoryCollectingFetch(dependencies.fetch ?? fetch, advisories)
+  };
+  try {
+    return await dispatchCli(argv2, withAdvisoryReader);
+  } catch (error) {
+    const explanation = explainRejectedCredential(error);
+    if (explanation) out.error(explanation);
+    throw error;
+  } finally {
+    renderAdvisories(out, advisories);
+  }
+}
+async function dispatchCli(argv2, dependencies) {
   const runtime = {
     ...dependencies,
     stdout: redactingOutput(dependencies.stdout ?? console)
@@ -16289,6 +16379,8 @@ var init_cli = __esm({
     init_monitor_command();
     init_provision();
     init_record();
+    init_advisory_output();
+    init_cached_credential();
     init_redact();
     init_runbook_command();
     init_security_command();