@odla-ai/cli 0.38.2 → 0.39.0

package/dist/bin.cjs

@@ -347,45 +347,15 @@ var init_handshake_state = __esm({
   }
 });
 
-// src/cached-credential.ts
-function noteCachedCredential(tokenFile) {
-  noted = tokenFile;
-}
-function isCredentialRejection(error) {
-  const message2 = error instanceof Error ? error.message : String(error ?? "");
-  return /\((401|403)\)\s*$/.test(message2.trim());
-}
-function explainRejectedCredential(error) {
-  const tokenFile = noted;
-  if (!tokenFile || !isCredentialRejection(error)) return null;
-  noted = null;
-  (0, import_node_fs5.rmSync)(tokenFile, { force: true });
-  return [
-    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
-    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
-    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
-    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
-  ].join("\n");
-}
-var import_node_fs5, noted;
-var init_cached_credential = __esm({
-  "src/cached-credential.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_node_fs5 = require("fs");
-    noted = null;
-  }
-});
-
 // src/device-session.ts
 function deviceCredentialPath(env = import_node_process4.default.env) {
   return env.ODLA_DEVICE_CREDENTIAL ?? (0, import_node_path3.join)(env.HOME ?? (0, import_node_os.homedir)(), ".odla", "device.json");
 }
 function readDeviceCredential(platform, env = import_node_process4.default.env) {
   const path = deviceCredentialPath(env);
-  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  if (!(0, import_node_fs5.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf8"));
     if (typeof parsed.token !== "string" || !parsed.token.startsWith("odla_device_")) return null;
     if (parsed.platform !== platform) return null;
     return { ...parsed, token: parsed.token, platform: parsed.platform };
@@ -407,20 +377,86 @@ async function mintDeviceSession(platformUrl, credential2, doFetch) {
       `device session failed: ${detail} (${response2.status})` + (revocable ? " \u2014 if this machine's enrollment was revoked or has expired, enroll it again in Studio" : "")
     );
   }
-  return { token: body.token, expiresAt: body.expiresAt ?? Date.now() };
+  return {
+    token: body.token,
+    expiresAt: body.expiresAt ?? Date.now(),
+    // Absent from a registry that predates rolling expiry and scoped devices.
+    // Left undefined rather than defaulted, so a caller can tell "the platform
+    // did not say" from "the platform said none".
+    ...typeof body.deviceExpiresAt === "number" ? { deviceExpiresAt: body.deviceExpiresAt } : {},
+    ...Array.isArray(body.appIds) ? { appIds: body.appIds } : {},
+    ...Array.isArray(body.capabilities) ? { capabilities: body.capabilities } : {},
+    ...Array.isArray(body.scopes) ? { scopes: body.scopes } : {}
+  };
 }
-var import_node_fs6, import_node_os, import_node_path3, import_node_process4;
+var import_node_fs5, import_node_os, import_node_path3, import_node_process4;
 var init_device_session = __esm({
   "src/device-session.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs6 = require("fs");
+    import_node_fs5 = require("fs");
     import_node_os = require("os");
     import_node_path3 = require("path");
     import_node_process4 = __toESM(require("process"), 1);
   }
 });
 
+// src/odla-home.ts
+function odlaHome(env = import_node_process5.default.env) {
+  return env.ODLA_HOME ?? (0, import_node_path4.join)(env.HOME ?? (0, import_node_os2.homedir)(), ".odla");
+}
+function odlaHomePath(segments, env = import_node_process5.default.env) {
+  return (0, import_node_path4.join)(odlaHome(env), ...segments);
+}
+function identityFile(env) {
+  return odlaHomePath(["identity.json"], env);
+}
+function deviceSessionFile(env) {
+  return odlaHomePath(["session.json"], env);
+}
+function appTokenFile(appId, env) {
+  return odlaHomePath(["apps", safeSegment(appId), "dev-token.json"], env);
+}
+function appCredentialsFile(appId, env) {
+  return odlaHomePath(["apps", safeSegment(appId), "credentials.json"], env);
+}
+function scopedTokenFile(env) {
+  return odlaHomePath(["admin-token.local.json"], env);
+}
+function pmContextFile(env) {
+  return odlaHomePath(["pm-context.json"], env);
+}
+function adoptRepoLocalCache(legacyPath, machinePath, out) {
+  if (!(0, import_node_fs6.existsSync)(legacyPath) || legacyPath === machinePath) return false;
+  const superseded = (0, import_node_fs6.existsSync)(machinePath);
+  if (!superseded) {
+    (0, import_node_fs6.mkdirSync)((0, import_node_path4.dirname)(machinePath), { recursive: true });
+    (0, import_node_fs6.copyFileSync)(legacyPath, machinePath);
+    (0, import_node_fs6.chmodSync)(machinePath, 384);
+  }
+  (0, import_node_fs6.rmSync)(legacyPath, { force: true });
+  out?.error(
+    superseded ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
+  );
+  return true;
+}
+function safeSegment(value2) {
+  const clean4 = value2.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "");
+  if (!clean4) throw new Error(`"${value2}" is not a usable app id`);
+  return clean4;
+}
+var import_node_fs6, import_node_os2, import_node_path4, import_node_process5;
+var init_odla_home = __esm({
+  "src/odla-home.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_fs6 = require("fs");
+    import_node_os2 = require("os");
+    import_node_path4 = require("path");
+    import_node_process5 = __toESM(require("process"), 1);
+  }
+});
+
 // src/local.ts
 function readJsonFile(path) {
   try {
@@ -467,7 +503,7 @@ function mergeCredential(current, update) {
   return next;
 }
 function ensureGitignore(rootDir, localPaths = []) {
-  const path = (0, import_node_path4.resolve)(rootDir, ".gitignore");
+  const path = (0, import_node_path5.resolve)(rootDir, ".gitignore");
   const existing = (0, import_node_fs7.existsSync)(path) ? (0, import_node_fs7.readFileSync)(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
@@ -488,7 +524,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path4.resolve)((0, import_node_path4.dirname)(cfg.configPath), requested);
+  return (0, import_node_path5.resolve)((0, import_node_path5.dirname)(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -516,28 +552,28 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text3) {
-  (0, import_node_fs7.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
+  (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
   (0, import_node_fs7.writeFileSync)(temporary, text3, { mode: 384 });
   (0, import_node_fs7.chmodSync)(temporary, 384);
   (0, import_node_fs7.renameSync)(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
-  const rel = (0, import_node_path4.relative)((0, import_node_path4.resolve)(rootDir), (0, import_node_path4.resolve)(path));
-  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path4.isAbsolute)(rel)) return null;
+  const rel = (0, import_node_path5.relative)((0, import_node_path5.resolve)(rootDir), (0, import_node_path5.resolve)(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path5.isAbsolute)(rel)) return null;
   return rel.replaceAll("\\", "/");
 }
 function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path4.relative)(rootDir, path);
+  const rel = (0, import_node_path5.relative)(rootDir, path);
   return rel && !rel.startsWith("..") ? rel : path;
 }
-var import_node_fs7, import_node_path4, GITIGNORE_LINES, MANAGED_DEV_VARS;
+var import_node_fs7, import_node_path5, GITIGNORE_LINES, MANAGED_DEV_VARS;
 var init_local = __esm({
   "src/local.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs7 = require("fs");
-    import_node_path4 = require("path");
+    import_node_path5 = require("path");
     GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
     MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
       "ODLA_PLATFORM",
@@ -554,6 +590,133 @@ var init_local = __esm({
   }
 });
 
+// src/auth-guidance.ts
+function machineAuthState(audience, env = import_node_process6.default.env) {
+  const device = readDeviceCredential(audience, env);
+  if (!device) return { enrolled: false };
+  const session = readJsonFile(deviceSessionFile(env));
+  const current = session?.platform === audience && session.deviceId === device.deviceId ? session : void 0;
+  return {
+    enrolled: true,
+    ...device.name ? { deviceName: device.name } : {},
+    ...current?.appIds ? { appIds: current.appIds } : {},
+    ...current?.capabilities ? { capabilities: current.capabilities } : {},
+    ...current?.scopes ? { scopes: current.scopes } : {},
+    ...current?.deviceExpiresAt ? { lapsesAt: current.deviceExpiresAt } : {}
+  };
+}
+function scopeInterruptionNotice(scope, state2) {
+  const platformScope = scope.startsWith("platform:");
+  const reason = !state2.enrolled ? "this machine is not enrolled, so every privileged command needs its own browser approval" : `this machine is enrolled but its approval did not include "${scope}"`;
+  return [
+    `odla: ${reason}.`,
+    `   Approve this one now, then end the interruptions with:`,
+    `     ${platformScope ? ENROL_PLATFORM_WIDE : ENROL_EVERYTHING}`,
+    platformScope ? "   A platform scope needs an administrator's approval; an app owner's cannot carry it." : "   One approval, every app you own, and it rolls forward while you keep working."
+  ].join("\n");
+}
+function lapseNotice(state2, now = Date.now()) {
+  if (!state2.enrolled || !state2.lapsesAt) return null;
+  const days = Math.floor((state2.lapsesAt - now) / (24 * 60 * 60 * 1e3));
+  if (days < 0) return "this machine's enrollment has lapsed; the next command will ask for approval";
+  return `idle for ${days} more day${days === 1 ? "" : "s"} before this machine needs approving again (using it resets the clock)`;
+}
+var import_node_process6, ENROL_EVERYTHING, ENROL_PLATFORM_WIDE;
+var init_auth_guidance = __esm({
+  "src/auth-guidance.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_process6 = __toESM(require("process"), 1);
+    init_device_session();
+    init_odla_home();
+    init_local();
+    ENROL_EVERYTHING = "npx odla-ai device enroll --all-apps --capability all --no-open --wait 600";
+    ENROL_PLATFORM_WIDE = "npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600";
+  }
+});
+
+// src/cached-credential.ts
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  (0, import_node_fs8.rmSync)(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this account: collecting a handshake retires the",
+    "   principal's other collected credentials, so a second machine supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`,
+    `   To stop needing one: ${ENROL_EVERYTHING}`
+  ].join("\n");
+}
+var import_node_fs8, noted;
+var init_cached_credential = __esm({
+  "src/cached-credential.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_fs8 = require("fs");
+    init_auth_guidance();
+    noted = null;
+  }
+});
+
+// src/device-session-cache.ts
+async function deviceSessionToken(platformUrl, audience, credential2, doFetch, env = import_node_process7.default.env) {
+  const path = deviceSessionFile(env);
+  const cached = readJsonFile(path);
+  if (cached?.token && cached.platform === audience && cached.deviceId === credential2.deviceId && (cached.expiresAt ?? 0) > Date.now() + SKEW_MS) return cached;
+  const minted = await mintDeviceSession(platformUrl, credential2, doFetch);
+  const session = {
+    ...minted,
+    platform: audience,
+    ...credential2.deviceId ? { deviceId: credential2.deviceId } : {}
+  };
+  writePrivateJson(path, session);
+  return session;
+}
+var import_node_process7, SKEW_MS;
+var init_device_session_cache = __esm({
+  "src/device-session-cache.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_process7 = __toESM(require("process"), 1);
+    init_odla_home();
+    init_local();
+    init_device_session();
+    SKEW_MS = 6e4;
+  }
+});
+
+// src/machine-identity.ts
+function readMachineIdentity(audience, env = import_node_process8.default.env) {
+  const stored = readJsonFile(identityFile(env));
+  if (!stored || typeof stored.email !== "string" || !stored.email) return null;
+  return stored.platform === audience ? { platform: audience, email: stored.email } : null;
+}
+function rememberMachineIdentity(audience, email, env = import_node_process8.default.env) {
+  if (!email) return;
+  const existing = readMachineIdentity(audience, env);
+  if (existing?.email === email) return;
+  writePrivateJson(identityFile(env), { platform: audience, email });
+}
+var import_node_process8;
+var init_machine_identity = __esm({
+  "src/machine-identity.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_process8 = __toESM(require("process"), 1);
+    init_odla_home();
+    init_local();
+  }
+});
+
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   const audience = platformAudience(cfg.platformUrl);
@@ -562,19 +725,19 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const cached = readJsonFile(cfg.local.tokenFile);
   if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
-    if (import_node_process5.default.env.ODLA_DEV_TOKEN) {
-      const declared = import_node_process5.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (import_node_process9.default.env.ODLA_DEV_TOKEN) {
+      const declared = import_node_process9.default.env.ODLA_DEV_TOKEN_AUDIENCE;
       if (declared) {
         if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
       } else if (audience !== "https://odla.ai") {
         throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
       }
-      return import_node_process5.default.env.ODLA_DEV_TOKEN;
+      return import_node_process9.default.env.ODLA_DEV_TOKEN;
     }
     const device = readDeviceCredential(audience);
     if (device) {
-      const session = await mintDeviceSession(cfg.platformUrl, device, doFetch);
-      out.error(`auth: session minted by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
+      const session = await deviceSessionToken(cfg.platformUrl, audience, device, doFetch);
+      out.error(`auth: session held by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
       return session.token;
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
@@ -594,7 +757,10 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     doFetch,
     out,
     audience,
-    email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
+    email: handshakeEmail(
+      options.email,
+      (cached?.platform === audience ? cached.email : void 0) ?? readMachineIdentity(audience)?.email
+    ),
     pendingFile: handshakeFile(cfg),
     grantIntent
   };
@@ -611,6 +777,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     expiresAt
   });
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+  rememberMachineIdentity(audience, ctx.email);
   return token;
 }
 async function freshHandshake(ctx, waitMs) {
@@ -680,7 +847,7 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? import_node_process5.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? import_node_process9.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (/@users\.noreply\.github\.com$/i.test(email)) {
     throw new Error(
       `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
@@ -709,18 +876,20 @@ function platformAudience(value2) {
   }
   return url.origin;
 }
-var import_db, import_node_crypto, import_node_process5;
+var import_db, import_node_crypto, import_node_process9;
 var init_token = __esm({
   "src/token.ts"() {
     "use strict";
     init_cjs_shims();
     import_db = require("@odla-ai/db");
     import_node_crypto = require("crypto");
-    import_node_process5 = __toESM(require("process"), 1);
+    import_node_process9 = __toESM(require("process"), 1);
     init_handshake_approval();
     init_handshake_state();
     init_cached_credential();
     init_device_session();
+    init_device_session_cache();
+    init_machine_identity();
     init_local();
   }
 });
@@ -729,7 +898,7 @@ var init_token = __esm({
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = import_node_process6.default.env[options.fromEnv];
+  if (options.fromEnv) value2 = import_node_process10.default.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -737,7 +906,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = import_node_process6.default.stdin) {
+async function readSecretStream(kind, stream = import_node_process10.default.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -745,12 +914,12 @@ async function readSecretStream(kind, stream = import_node_process6.default.stdi
   }
   return value2;
 }
-var import_node_process6, MAX_BYTES;
+var import_node_process10, MAX_BYTES;
 var init_secret_input = __esm({
   "src/secret-input.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process6 = __toESM(require("process"), 1);
+    import_node_process10 = __toESM(require("process"), 1);
     MAX_BYTES = 64 * 1024;
   }
 });
@@ -762,7 +931,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = import_node_process7.default.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = import_node_process11.default.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -774,7 +943,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = import_node_process7.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = import_node_process11.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -784,15 +953,28 @@ function audienceBoundEnvToken(token, platform) {
 }
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? import_node_process7.default.cwd();
-  const tokenFile = options.tokenFile ?? (0, import_node_path5.join)(rootDir, ".odla/admin-token.local.json");
+  const rootDir = options.rootDir ?? import_node_process11.default.cwd();
+  const tokenFile = options.tokenFile ?? scopedTokenFile();
+  adoptRepoLocalCache((0, import_node_path6.join)(rootDir, ".odla/admin-token.local.json"), tokenFile, out);
+  const device = readDeviceCredential(audience);
+  if (device && options.cache !== false) {
+    const session = await deviceSessionToken(platform, audience, device, doFetch);
+    if (session.scopes?.includes(scope)) {
+      out.error(`auth: ${scope} held by this enrolled device`);
+      return session.token;
+    }
+  }
   const cache2 = options.cache === false ? null : readJsonFile(tokenFile);
   const cached = cache2?.platform === audience ? cache2.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.error(`auth: using cached ${scope} grant (${tokenFile})`);
     return cached.token;
   }
-  const email = handshakeEmail(options.email, cache2?.platform === audience ? cache2.email : void 0);
+  out.error(scopeInterruptionNotice(scope, machineAuthState(audience)));
+  const email = handshakeEmail(
+    options.email,
+    (cache2?.platform === audience ? cache2.email : void 0) ?? readMachineIdentity(audience)?.email
+  );
   const { token, expiresAt } = await (0, import_db2.requestToken)({
     endpoint: audience,
     email,
@@ -812,26 +994,30 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   if (options.cache !== false) {
     const tokens = cache2?.platform === audience ? { ...cache2.tokens ?? {} } : {};
     tokens[scope] = { token, expiresAt };
-    if ((0, import_node_fs8.existsSync)((0, import_node_path5.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
     writePrivateJson(tokenFile, { platform: audience, email, tokens });
+    rememberMachineIdentity(audience, email);
     out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   } else {
     out.error(`auth: ${scope} grant is in memory only; its credential record remains in odla-ai/db`);
   }
   return token;
 }
-var import_node_fs8, import_node_path5, import_node_process7, import_db2, SCOPE_PURPOSE;
+var import_node_path6, import_node_process11, import_db2, SCOPE_PURPOSE;
 var init_admin_ai_auth = __esm({
   "src/admin-ai-auth.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs8 = require("fs");
-    import_node_path5 = require("path");
-    import_node_process7 = __toESM(require("process"), 1);
+    import_node_path6 = require("path");
+    import_node_process11 = __toESM(require("process"), 1);
     import_db2 = require("@odla-ai/db");
     init_local();
     init_handshake_approval();
     init_token();
+    init_auth_guidance();
+    init_device_session_cache();
+    init_device_session();
+    init_machine_identity();
+    init_odla_home();
     SCOPE_PURPOSE = {
       "platform:status:read": "read the platform fleet health and deployment snapshot",
       "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
@@ -1047,7 +1233,7 @@ var init_admin_ai_usage = __esm({
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? import_node_process8.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? import_node_process12.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -1225,12 +1411,12 @@ function apiError3(action2, status, body) {
 function isRecord3(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
-var import_node_process8;
+var import_node_process12;
 var init_admin_ai = __esm({
   "src/admin-ai.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process8 = __toESM(require("process"), 1);
+    import_node_process12 = __toESM(require("process"), 1);
     init_token();
     init_secret_input();
     init_admin_ai_auth();
@@ -1812,12 +1998,12 @@ var init_monitoring_validation = __esm({
 
 // src/config.ts
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
-  const resolved = (0, import_node_path6.resolve)(configPath);
+  const resolved = (0, import_node_path7.resolve)(configPath);
   if (!(0, import_node_fs9.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = (0, import_node_path6.dirname)(resolved);
+  const rootDir = (0, import_node_path7.dirname)(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -1827,11 +2013,14 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   validateCalendarConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   validateMonitoringConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
-    tokenFile: (0, import_node_path6.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: (0, import_node_path6.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: (0, import_node_path6.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    tokenFile: raw.local?.tokenFile ? (0, import_node_path7.resolve)(rootDir, raw.local.tokenFile) : appTokenFile(raw.app.id),
+    credentialsFile: raw.local?.credentialsFile ? (0, import_node_path7.resolve)(rootDir, raw.local.credentialsFile) : appCredentialsFile(raw.app.id),
+    devVarsFile: (0, import_node_path7.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
+  adoptRepoLocalCache((0, import_node_path7.resolve)(rootDir, ".odla/dev-token.json"), local.tokenFile, stderr);
+  adoptRepoLocalCache((0, import_node_path7.resolve)(rootDir, ".odla/credentials.local.json"), local.credentialsFile, stderr);
+  (0, import_node_fs9.rmSync)((0, import_node_path7.resolve)(rootDir, ".odla/handshake.local.json"), { force: true });
   return {
     ...raw,
     configPath: resolved,
@@ -1846,7 +2035,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
 async function resolveDataExport(cfg, value2, names) {
   if (value2 === void 0 || value2 === null || value2 === false) return void 0;
   if (typeof value2 !== "string") return value2;
-  const target = (0, import_node_path6.isAbsolute)(value2) ? value2 : (0, import_node_path6.resolve)(cfg.rootDir, value2);
+  const target = (0, import_node_path7.isAbsolute)(value2) ? value2 : (0, import_node_path7.resolve)(cfg.rootDir, value2);
   if (target.endsWith(".json")) {
     return JSON.parse((0, import_node_fs9.readFileSync)(target, "utf8"));
   }
@@ -1937,37 +2126,42 @@ function trimSlash(value2) {
 function unique3(values) {
   return [...new Set(values.filter(Boolean))];
 }
-var import_node_fs9, import_node_path6, import_node_url, import_apps, DEFAULT_PLATFORM, DEFAULT_ENVS, DEFAULT_SERVICES, configImportSerial, GOOGLE_CALENDAR_EVENTS_SCOPE;
+var import_node_fs9, import_node_path7, import_node_url, import_apps, DEFAULT_PLATFORM, DEFAULT_ENVS, DEFAULT_SERVICES, configImportSerial, GOOGLE_CALENDAR_EVENTS_SCOPE, stderr;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs9 = require("fs");
-    import_node_path6 = require("path");
+    import_node_path7 = require("path");
     import_node_url = require("url");
     import_apps = require("@odla-ai/apps");
     init_ai_config_validation();
     init_calendar_config();
     init_integration_validation();
     init_monitoring_validation();
+    init_odla_home();
     init_calendar_config();
     DEFAULT_PLATFORM = "https://odla.ai";
     DEFAULT_ENVS = ["dev"];
     DEFAULT_SERVICES = ["db", "ai"];
     configImportSerial = 0;
     GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+    stderr = { error: (message2) => {
+      process.stderr.write(`${message2}
+`);
+    } };
   }
 });
 
 // src/operator-profiles.ts
 function operatorProfileFile() {
-  return (0, import_node_path7.resolve)(
-    clean(import_node_process9.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".odla", "contexts.json")
+  return (0, import_node_path8.resolve)(
+    clean(import_node_process13.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path8.join)((0, import_node_os3.homedir)(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(import_node_process9.default.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(import_node_process13.default.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -2007,10 +2201,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? (0, import_node_path7.join)((0, import_node_path7.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".odla");
+  const base = selection.name ? (0, import_node_path8.join)((0, import_node_path8.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path8.join)((0, import_node_os3.homedir)(), ".odla");
   return {
-    developer: (0, import_node_path7.join)(base, "dev-token.json"),
-    scoped: (0, import_node_path7.join)(base, "admin-token.local.json")
+    developer: (0, import_node_path8.join)(base, "dev-token.json"),
+    scoped: (0, import_node_path8.join)(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -2082,15 +2276,15 @@ function clean(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_fs10, import_node_os2, import_node_path7, import_node_process9;
+var import_node_fs10, import_node_os3, import_node_path8, import_node_process13;
 var init_operator_profiles = __esm({
   "src/operator-profiles.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs10 = require("fs");
-    import_node_os2 = require("os");
-    import_node_path7 = require("path");
-    import_node_process9 = __toESM(require("process"), 1);
+    import_node_os3 = require("os");
+    import_node_path8 = require("path");
+    import_node_process13 = __toESM(require("process"), 1);
     init_argv();
     init_local();
     init_token();
@@ -2101,7 +2295,7 @@ var init_operator_profiles = __esm({
 async function resolveOperatorContext(parsed, options = {}) {
   const profile = resolveOperatorProfile(parsed);
   const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
-  const configPath = (0, import_node_path8.resolve)(configArgument);
+  const configPath = (0, import_node_path9.resolve)(configArgument);
   const explicitConfig = parsed.options.config !== void 0;
   const hasConfig = (0, import_node_fs11.existsSync)(configPath);
   if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
@@ -2109,13 +2303,13 @@ async function resolveOperatorContext(parsed, options = {}) {
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(import_node_process10.default.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(import_node_process14.default.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(import_node_process10.default.env.ODLA_APP_ID);
+  const appEnvironment = clean2(import_node_process14.default.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) {
@@ -2129,16 +2323,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(import_node_process10.default.env.ODLA_ENV);
+  const envEnvironment = clean2(import_node_process14.default.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? import_node_process10.default.cwd();
+  const rootDir = loaded?.rootDir ?? import_node_process14.default.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(import_node_process10.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path8.resolve)(import_node_process10.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(import_node_process10.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path8.resolve)(import_node_process10.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path8.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(import_node_process14.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path9.resolve)(import_node_process14.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile2 = clean2(import_node_process14.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path9.resolve)(import_node_process14.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path9.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -2160,8 +2354,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: (0, import_node_path8.join)(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: (0, import_node_path8.join)(rootDir, ".dev.vars"),
+      credentialsFile: (0, import_node_path9.join)(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: (0, import_node_path9.join)(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -2185,7 +2379,7 @@ async function resolveOperatorContext(parsed, options = {}) {
     },
     credentials: {
       developerTokenFile: tokenFile,
-      scopedTokenFile
+      scopedTokenFile: scopedTokenFile2
     }
   };
 }
@@ -2193,14 +2387,14 @@ function clean2(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_fs11, import_node_path8, import_node_process10, DEFAULT_PLATFORM2;
+var import_node_fs11, import_node_path9, import_node_process14, DEFAULT_PLATFORM2;
 var init_operator_context = __esm({
   "src/operator-context.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs11 = require("fs");
-    import_node_path8 = require("path");
-    import_node_process10 = __toESM(require("process"), 1);
+    import_node_path9 = require("path");
+    import_node_process14 = __toESM(require("process"), 1);
     init_argv();
     init_config();
     init_operator_profiles();
@@ -2442,6 +2636,7 @@ async function whoamiCommand(parsed, deps = {}) {
   } else {
     out.log("projects:   (none \u2014 every pm and discuss call will be refused)");
   }
+  printMachineBlock(cfg.platformUrl, out);
   if (!identity.admin) {
     if (identity.scopes.includes("platform:runbook:write")) {
       out.log("\nThis exact scope can read and edit all platform runbook content.");
@@ -2452,6 +2647,21 @@ async function whoamiCommand(parsed, deps = {}) {
     }
   }
 }
+function printMachineBlock(platformUrl, out) {
+  const state2 = machineAuthState(platformAudience(platformUrl));
+  if (!state2.enrolled) {
+    out.log("\nmachine:    not enrolled \u2014 every privileged command needs its own browser approval.");
+    out.log(`            End that with:
+              ${ENROL_EVERYTHING}`);
+    return;
+  }
+  const reach = state2.appIds?.includes("*") ? "every app you own" : state2.appIds?.join(", ");
+  out.log(`
+machine:    enrolled${state2.deviceName ? ` as "${state2.deviceName}"` : ""}${reach ? ` for ${reach}` : ""}`);
+  if (state2.scopes?.length) out.log(`            carrying ${state2.scopes.join(", ")}`);
+  const lapse = lapseNotice(state2);
+  if (lapse) out.log(`            ${lapse}`);
+}
 var text2;
 var init_whoami_command = __esm({
   "src/whoami-command.ts"() {
@@ -2460,6 +2670,8 @@ var init_whoami_command = __esm({
     init_argv();
     init_operator_context();
     init_token();
+    init_auth_guidance();
+    init_token();
     text2 = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
   }
 });
@@ -2487,7 +2699,7 @@ async function authCommand(parsed, deps = {}) {
   const { cfg } = context;
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const email = stringOpt(parsed.options.email) ?? import_node_process11.default.env.ODLA_USER_EMAIL?.trim();
+  const email = stringOpt(parsed.options.email) ?? import_node_process15.default.env.ODLA_USER_EMAIL?.trim();
   if (!email) {
     throw new Error(
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
@@ -2521,12 +2733,12 @@ async function authCommand(parsed, deps = {}) {
   out.log(`Authorized ${identity.displayName}${handle} for ${cfg.app.id}.`);
   out.log(`odla account: ${identity.email ?? "not returned"}`);
 }
-var import_node_process11;
+var import_node_process15;
 var init_auth_command = __esm({
   "src/auth-command.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process11 = __toESM(require("process"), 1);
+    import_node_process15 = __toESM(require("process"), 1);
     init_argv();
     init_operator_context();
     init_token();
@@ -3043,15 +3255,15 @@ var init_brand_design_unpack = __esm({
 
 // src/brand-command.ts
 async function readBundle(source, deps) {
-  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path9.resolve)(source), "utf8");
+  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path10.resolve)(source), "utf8");
   const readStdin = deps.readStdin;
   if (!readStdin) throw new Error("reading a bundle from stdin is not supported here");
   return readStdin();
 }
 async function writeAll(result, outDir) {
   for (const file of result.files) {
-    const target = (0, import_node_path9.resolve)(outDir, file.path);
-    await (0, import_promises.mkdir)((0, import_node_path9.dirname)(target), { recursive: true });
+    const target = (0, import_node_path10.resolve)(outDir, file.path);
+    await (0, import_promises.mkdir)((0, import_node_path10.dirname)(target), { recursive: true });
     await (0, import_promises.writeFile)(target, file.bytes);
   }
 }
@@ -3059,7 +3271,7 @@ async function designUnpack(parsed, deps) {
   assertArgs(parsed, ["out", "json"], 4);
   const source = parsed.positionals[3];
   if (!source) throw new Error(USAGE);
-  const outDir = (0, import_node_path9.resolve)(stringOpt(parsed.options.out) ?? "design");
+  const outDir = (0, import_node_path10.resolve)(stringOpt(parsed.options.out) ?? "design");
   const result = unpackDesign(await readBundle(source, deps));
   await writeAll(result, outDir);
   const out = deps.stdout ?? console;
@@ -3085,13 +3297,13 @@ async function brandCommand(parsed, deps) {
   }
   throw new Error(USAGE);
 }
-var import_promises, import_node_path9, USAGE;
+var import_promises, import_node_path10, USAGE;
 var init_brand_command = __esm({
   "src/brand-command.ts"() {
     "use strict";
     init_cjs_shims();
     import_promises = require("fs/promises");
-    import_node_path9 = require("path");
+    import_node_path10 = require("path");
     init_argv();
     init_brand_design_unpack();
     USAGE = "usage: odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]";
@@ -4139,7 +4351,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: (0, import_node_path10.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path11.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4191,13 +4403,13 @@ function normalizeRequestError(error) {
 function record4(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
-var import_apps6, import_node_path10, IDEMPOTENCY_KEY, DEFAULT_WAIT_SECONDS, DEFAULT_INTERVAL_SECONDS;
+var import_apps6, import_node_path11, IDEMPOTENCY_KEY, DEFAULT_WAIT_SECONDS, DEFAULT_INTERVAL_SECONDS;
 var init_config_operation_command = __esm({
   "src/config-operation-command.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps6 = require("@odla-ai/apps");
-    import_node_path10 = require("path");
+    import_node_path11 = require("path");
     init_admin_ai_auth();
     init_version();
     init_config();
@@ -4520,7 +4732,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: (0, import_node_path11.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path12.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4649,13 +4861,13 @@ function studioSettingsUrl(reconciliation) {
 function quoteArg2(value2) {
   return `'${value2.replace(/'/g, `'\\''`)}'`;
 }
-var import_apps8, import_node_path11;
+var import_apps8, import_node_path12;
 var init_config_reconcile_command = __esm({
   "src/config-reconcile-command.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps8 = require("@odla-ai/apps");
-    import_node_path11 = require("path");
+    import_node_path12 = require("path");
     init_admin_ai_auth();
     init_config();
     init_config_reconcile_digest();
@@ -4668,7 +4880,7 @@ var init_config_reconcile_command = __esm({
 // src/wrangler.ts
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path12.join)(rootDir, name);
+    const path = (0, import_node_path13.join)(rootDir, name);
     if ((0, import_node_fs14.existsSync)(path)) return path;
   }
   return null;
@@ -4780,22 +4992,22 @@ function wranglerBulkSecrets(run, opts) {
   ];
   return run("npx", args, { input: JSON.stringify(opts.secrets), cwd: opts.cwd });
 }
-var import_node_child_process2, import_node_fs14, import_node_path12, defaultRunner, WRANGLER_CONFIG_FILES;
+var import_node_child_process2, import_node_fs14, import_node_path13, defaultRunner, WRANGLER_CONFIG_FILES;
 var init_wrangler = __esm({
   "src/wrangler.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process2 = require("child_process");
     import_node_fs14 = require("fs");
-    import_node_path12 = require("path");
+    import_node_path13 = require("path");
     defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
       const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
       let stdout = "";
-      let stderr = "";
+      let stderr2 = "";
       child.stdout.on("data", (chunk) => stdout += chunk.toString());
-      child.stderr.on("data", (chunk) => stderr += chunk.toString());
+      child.stderr.on("data", (chunk) => stderr2 += chunk.toString());
       child.on("error", reject);
-      child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+      child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr: stderr2 }));
       child.stdin.end(opts?.input ?? "");
     });
     WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
@@ -4839,21 +5051,21 @@ function wranglerWarnings(rootDir) {
   const blocks = [{ label: "", block: config }];
   const envs = config.env;
   if (envs && typeof envs === "object") {
-    for (const [name, block] of Object.entries(envs)) {
-      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+    for (const [name, block2] of Object.entries(envs)) {
+      if (block2 && typeof block2 === "object") blocks.push({ label: `env.${name}.`, block: block2 });
     }
   }
-  for (const { label, block } of blocks) {
-    const assets = block.assets;
+  for (const { label, block: block2 } of blocks) {
+    const assets = block2.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path13.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path13.resolve)(rootDir)) {
+      const dir = (0, import_node_path14.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path14.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs15.existsSync)((0, import_node_path13.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs15.existsSync)((0, import_node_path14.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
-    const vars = block.vars;
+    const vars = block2.vars;
     if (vars && typeof vars === "object") {
       for (const [name, value2] of Object.entries(vars)) {
         if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value2 === "string" && looksSecret(value2)) {
@@ -4884,7 +5096,7 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path13.resolve)(rootDir, config.main) : null;
+  const main = typeof config.main === "string" ? (0, import_node_path14.resolve)(rootDir, config.main) : null;
   if (!main || !(0, import_node_fs15.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
@@ -4914,19 +5126,19 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs15.readFileSync)((0, import_node_path13.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs15.readFileSync)((0, import_node_path14.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }
-var import_node_child_process3, import_node_fs15, import_node_path13, defaultExec;
+var import_node_child_process3, import_node_fs15, import_node_path14, defaultExec;
 var init_doctor_checks = __esm({
   "src/doctor-checks.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process3 = require("child_process");
     import_node_fs15 = require("fs");
-    import_node_path13 = require("path");
+    import_node_path14 = require("path");
     init_redact();
     init_local();
     init_wrangler();
@@ -5263,8 +5475,8 @@ var init_harness_options = __esm({
 // src/init.ts
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path14.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path14.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  const rootDir = (0, import_node_path15.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path15.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
   if ((0, import_node_fs16.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
@@ -5281,12 +5493,12 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  (0, import_node_fs16.mkdirSync)((0, import_node_path14.dirname)(configPath), { recursive: true });
-  (0, import_node_fs16.mkdirSync)((0, import_node_path14.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs16.mkdirSync)((0, import_node_path14.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs16.mkdirSync)((0, import_node_path15.dirname)(configPath), { recursive: true });
+  (0, import_node_fs16.mkdirSync)((0, import_node_path15.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs16.mkdirSync)((0, import_node_path15.resolve)(rootDir, ".odla"), { recursive: true });
   (0, import_node_fs16.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path14.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path14.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  writeIfMissing((0, import_node_path15.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path15.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
@@ -5353,8 +5565,10 @@ ${calendar}
     // prod: "https://example.com",
   },
   local: {
-    tokenFile: ".odla/dev-token.json",
-    credentialsFile: ".odla/credentials.local.json",
+    // Credentials live in ~/.odla, per machine, so every worktree of this app
+    // shares one approval instead of asking for its own. Pinning tokenFile or
+    // credentialsFile here still works and still overrides that \u2014 it just puts
+    // this checkout back on its own island.
     devVarsFile: ".dev.vars",
   },
 };
@@ -5397,13 +5611,13 @@ function defaultKeyEnv(provider) {
 function relativeDisplay(path, rootDir) {
   return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;
 }
-var import_node_fs16, import_node_path14, import_apps9;
+var import_node_fs16, import_node_path15, import_apps9;
 var init_init = __esm({
   "src/init.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs16 = require("fs");
-    import_node_path14 = require("path");
+    import_node_path15 = require("path");
     import_apps9 = require("@odla-ai/apps");
     init_local();
   }
@@ -5736,8 +5950,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path15.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path15.resolve)(options.homeDir ?? (0, import_node_os3.homedir)());
+  const root = (0, import_node_path16.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path16.resolve)(options.homeDir ?? (0, import_node_os4.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -5751,48 +5965,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path15.join)(targetDir2, rel), (0, import_node_fs17.readFileSync)((0, import_node_path15.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path16.join)(targetDir2, rel), (0, import_node_fs17.readFileSync)((0, import_node_path16.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path15.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path15.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path15.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path16.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path16.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path16.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path15.dirname)((0, import_node_path15.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path16.dirname)((0, import_node_path16.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path15.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path16.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path15.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path16.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = (0, import_node_fs17.readFileSync)((0, import_node_path15.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path15.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
+        const canonical2 = (0, import_node_fs17.readFileSync)((0, import_node_path16.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path16.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path15.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path16.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path15.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path16.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path15.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path16.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path15.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path16.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -5828,7 +6042,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!(0, import_node_fs17.existsSync)(file.target) || (0, import_node_fs17.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs17.mkdirSync)((0, import_node_path15.dirname)(file.target), { recursive: true });
+      (0, import_node_fs17.mkdirSync)((0, import_node_path16.dirname)(file.target), { recursive: true });
       (0, import_node_fs17.writeFileSync)(file.target, file.content);
     }
   }
@@ -5848,7 +6062,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path15.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path15.sep}`) && !(0, import_node_path15.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path16.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path16.sep}`) && !(0, import_node_path16.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -5867,10 +6081,10 @@ function normalizeHarnesses(values, global) {
   }
   return expanded;
 }
-function managedFileContent(path, block, force, boundary) {
+function managedFileContent(path, block2, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs17.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs17.existsSync)(path)) return `${block2}
 `;
   const current = (0, import_node_fs17.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
@@ -5882,24 +6096,24 @@ function managedFileContent(path, block, force, boundary) {
   }
   if (startAt === -1) {
     const separator = current.length === 0 || current.endsWith("\n\n") ? "" : current.endsWith("\n") ? "\n" : "\n\n";
-    return `${current}${separator}${block}
+    return `${current}${separator}${block2}
 `;
   }
   const afterEnd = endAt + end.length;
   const existing = current.slice(startAt, afterEnd);
-  if (existing !== block && !force) {
+  if (existing !== block2 && !force) {
     throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);
   }
-  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
+  return `${current.slice(0, startAt)}${block2}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path15.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path15.sep}`) || (0, import_node_path15.isAbsolute)(rel)) {
+  const rel = (0, import_node_path16.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path16.sep}`) || (0, import_node_path16.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path15.sep).filter(Boolean)) {
-    current = (0, import_node_path15.join)(current, part);
+  for (const part of rel.split(import_node_path16.sep).filter(Boolean)) {
+    current = (0, import_node_path16.join)(current, part);
     try {
       if ((0, import_node_fs17.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -5916,22 +6130,22 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of (0, import_node_fs17.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path15.join)(current, entry.name);
+      const path = (0, import_node_path16.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path15.relative)(dir, path));
+      else results.push((0, import_node_path16.relative)(dir, path));
     }
   };
   walk(dir);
   return results.sort();
 }
-var import_node_fs17, import_node_os3, import_node_path15, import_node_url2, AGENT_HARNESSES;
+var import_node_fs17, import_node_os4, import_node_path16, import_node_url2, AGENT_HARNESSES;
 var init_skill = __esm({
   "src/skill.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs17 = require("fs");
-    import_node_os3 = require("os");
-    import_node_path15 = require("path");
+    import_node_os4 = require("os");
+    import_node_path16 = require("path");
     import_node_url2 = require("url");
     init_skill_adapters();
     AGENT_HARNESSES = ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
@@ -6405,7 +6619,7 @@ function allowedWorkspacePath(relativePath) {
 async function gitOutput(cwd, args, maxBytes) {
   const child = (0, import_child_process2.spawn)("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -6413,20 +6627,20 @@ async function gitOutput(cwd, args, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
     child.once("exit", accept);
   });
   if (bytes > maxBytes) throw new Error(`git output exceeds ${maxBytes} bytes`);
-  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   return Buffer.concat(stdout);
 }
 async function gitBlobs(cwd, entries, maxBytes) {
   const child = (0, import_child_process2.spawn)("git", ["cat-file", "--batch"], { cwd, stdio: ["pipe", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -6434,7 +6648,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   child.stdin.end(`${entries.map((entry) => entry.hash).join("\n")}
 `);
@@ -6443,7 +6657,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
     child.once("exit", accept);
   });
   if (bytes > maxBytes + entries.length * 100) throw new Error(`Git tree exceeds ${maxBytes} bytes`);
-  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   const output = Buffer.concat(stdout);
   const blobs = [];
   let offset = 0;
@@ -6540,7 +6754,7 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     shell: false
   });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let outputBytes = 0;
   child.stdout.on("data", (chunk) => {
     outputBytes += chunk.byteLength;
@@ -6548,14 +6762,14 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
     child.once("exit", accept);
   });
   if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
-  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
   if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
   const root = (0, import_path4.resolve)(sourceDir);
@@ -6600,7 +6814,7 @@ async function captureGitDiff(root, maxBytes) {
     "workspace"
   ], { cwd: root, stdio: ["ignore", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -6608,7 +6822,7 @@ async function captureGitDiff(root, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
@@ -6616,7 +6830,7 @@ async function captureGitDiff(root, maxBytes) {
   });
   if (bytes > maxBytes) throw new Error(`patch exceeds ${maxBytes} bytes`);
   if (code !== 0 && code !== 1) {
-    throw new Error(`git diff failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+    throw new Error(`git diff failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   }
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
@@ -7504,11 +7718,11 @@ var init_dist2 = __esm({
 });
 
 // ../graph/dist/code/index.js
-function dirname9(path) {
+function dirname10(path) {
   const at = path.lastIndexOf("/");
   return at <= 0 ? "." : path.slice(0, at);
 }
-function join13(base, specifier) {
+function join14(base, specifier) {
   const parts = [];
   const segments = `${base === "." ? "" : `${base}/`}${specifier}`.split("/");
   for (const segment of segments) {
@@ -7520,7 +7734,7 @@ function join13(base, specifier) {
 }
 function resolveImport(fromPath, specifier, known) {
   if (!specifier.startsWith(".")) return null;
-  const base = join13(dirname9(fromPath), specifier);
+  const base = join14(dirname10(fromPath), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -8023,13 +8237,13 @@ function gitApply(cwd, patch2, check) {
       stdio: ["pipe", "ignore", "pipe"],
       env: { PATH: process.env.PATH ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" }
     });
-    let stderr = "";
+    let stderr2 = "";
     child.stderr.setEncoding("utf8");
     child.stderr.on("data", (text3) => {
-      if (stderr.length < 4e3) stderr += text3.slice(0, 4e3);
+      if (stderr2.length < 4e3) stderr2 += text3.slice(0, 4e3);
     });
     child.once("error", reject);
-    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr.trim().slice(0, 500)))));
+    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr2.trim().slice(0, 500)))));
     child.stdin.end(patch2);
   });
 }
@@ -8140,7 +8354,7 @@ function execute(engine, args, name, recipe2, signal) {
     const started = Date.now();
     const child = (0, import_child_process5.spawn)(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
     const stdout = [];
-    const stderr = [];
+    const stderr2 = [];
     let bytes = 0;
     let outputLimitExceeded = false;
     let timedOut = false;
@@ -8161,7 +8375,7 @@ function execute(engine, args, name, recipe2, signal) {
       else target.push(chunk);
     };
     child.stdout.on("data", collect(stdout));
-    child.stderr.on("data", collect(stderr));
+    child.stderr.on("data", collect(stderr2));
     const abort = () => stop("abort");
     signal?.addEventListener("abort", abort, { once: true });
     if (signal?.aborted) abort();
@@ -8177,7 +8391,7 @@ function execute(engine, args, name, recipe2, signal) {
       accept({
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdout).toString("utf8"),
-        stderr: Buffer.concat(stderr).toString("utf8"),
+        stderr: Buffer.concat(stderr2).toString("utf8"),
         durationMs: Date.now() - started,
         outputLimitExceeded,
         timedOut
@@ -8323,11 +8537,11 @@ function checkedResult(result, maximumOutputBytes) {
 }
 function boundedLogs(result, maximum) {
   const stdout = Buffer.from(result.stdout);
-  const stderr = Buffer.from(result.stderr);
+  const stderr2 = Buffer.from(result.stderr);
   const first = stdout.subarray(0, maximum);
   return {
     stdout: first.toString("utf8"),
-    stderr: stderr.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
+    stderr: stderr2.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
   };
 }
 function digestPolicy(policy) {
@@ -10461,7 +10675,7 @@ var init_code_runtime_config = __esm({
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path16.resolve)(cwd, options.configPath);
+  const configPath = (0, import_node_path17.resolve)(cwd, options.configPath);
   const cfg = (0, import_node_fs18.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
@@ -10491,7 +10705,7 @@ async function codeConnect(options) {
   const doFetch = options.fetch ?? fetch;
   const engine = await (options.selectEngine ?? selectContainerEngine)(options.engine ?? "auto");
   const hostPlatform = process.platform === "darwin" ? "macos" : "linux";
-  const hostName = (options.name ?? (0, import_node_os4.hostname)()).trim();
+  const hostName = (options.name ?? (0, import_node_os5.hostname)()).trim();
   if (!hostName || hostName.length > 120) throw new Error("--name must contain 1 to 120 characters");
   const repository = await inferGitHubRepository(cwd, options.readGitOrigin);
   const localSource = await (options.prepareLocalSource ?? prepareCodeLocalSource)(
@@ -10501,7 +10715,8 @@ async function codeConnect(options) {
   );
   try {
     const descriptor2 = localSource.descriptor;
-    const approval = await (options.getToken ?? getScopedPlatformToken)({
+    const device = options.getToken ? null : readDeviceCredential(platform);
+    const authorization = device ? (await mintDeviceSession(platform, device, doFetch)).token : await (options.getToken ?? getScopedPlatformToken)({
       platform,
       scope: "app:code:host:connect",
       email: options.email,
@@ -10515,7 +10730,7 @@ async function codeConnect(options) {
     const target = appId ? { appId } : { repository };
     const response2 = await doFetch(`${platform}/registry/code/hosts/connect`, {
       method: "POST",
-      headers: { authorization: `Bearer ${approval}`, "content-type": "application/json" },
+      headers: { authorization: `Bearer ${authorization}`, "content-type": "application/json" },
       body: JSON.stringify({ ...target, env: appEnv, name: hostName, platform: hostPlatform, slots }),
       redirect: "error",
       signal: options.signal
@@ -10528,8 +10743,8 @@ async function codeConnect(options) {
       platform: hostPlatform,
       arch: process.arch,
       engines: [engine],
-      cpuCount: (0, import_node_os4.cpus)().length,
-      memoryBytes: (0, import_node_os4.totalmem)(),
+      cpuCount: (0, import_node_os5.cpus)().length,
+      memoryBytes: (0, import_node_os5.totalmem)(),
       source: descriptor2,
       images: {
         ready: true,
@@ -10626,17 +10841,18 @@ function apiFailure(action2, status, value2) {
 function record6(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
-var import_node_fs18, import_node_os4, import_node_path16;
+var import_node_fs18, import_node_os5, import_node_path17;
 var init_code_connect = __esm({
   "src/code-connect.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_fs18 = require("fs");
-    import_node_os4 = require("os");
-    import_node_path16 = require("path");
+    import_node_os5 = require("os");
+    import_node_path17 = require("path");
     init_node();
     init_admin_ai_auth();
     init_config();
+    init_device_session();
     init_version();
     init_security_hosted_github();
     init_code_local_source();
@@ -10950,7 +11166,7 @@ function developerTokenStatus(context, parsed, now = Date.now()) {
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(import_node_process12.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(import_node_process16.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -10961,12 +11177,12 @@ function clean3(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_process12;
+var import_node_process16;
 var init_operator_credentials = __esm({
   "src/operator-credentials.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process12 = __toESM(require("process"), 1);
+    import_node_process16 = __toESM(require("process"), 1);
     init_argv();
     init_local();
   }
@@ -11174,11 +11390,32 @@ var init_credential_command = __esm({
 });
 
 // src/help-usage.ts
-var USAGE_SECTION;
+var AUTH_SECTION, USAGE_SECTION;
 var init_help_usage = __esm({
   "src/help-usage.ts"() {
     "use strict";
     init_cjs_shims();
+    AUTH_SECTION = `
+Enrol this machine once, then stop asking:
+  npx odla-ai device enroll --all-apps --capability all --no-open --wait 600
+      One browser approval. Afterwards every worktree on this machine mints its
+      own short-lived credentials with nobody's attention, for every app you
+      own \u2014 including apps you create later. The window rolls forward each time
+      you use it, so continuous work never interrupts anyone; only a real gap
+      does. Give the human the printed /studio?code= URL, keep the process
+      alive, and wait on it.
+
+  npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600
+      The same thing across all of odla, for weeks. Needs a platform
+      administrator's approval \u2014 an app owner's cannot carry platform scopes.
+
+  npx odla-ai whoami        what this machine holds and when it lapses
+  npx odla-ai device list   every machine you have enrolled
+
+Enrollment is the only human decision here. Revoking a machine, purging an app,
+transferring ownership, and rotating credentials still need a signed-in human in
+Studio, and no machine credential can do them however wide its approval was.
+`;
     USAGE_SECTION = `
 Start here:
   odla-ai runbook ask "<question>"   The current procedure, from odla's own
@@ -11217,7 +11454,7 @@ Usage:
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm project list [--app <product-id>] [--status <s>] [--json]
   odla-ai pm project add --app <product-id> --name <name> [--description <text>] [--json]
-  odla-ai pm project use <project-id> [--json]                         [saved locally in this worktree]
+  odla-ai pm project use <project-id> [--json]                         [saved for this app, on this machine]
   odla-ai pm goal list [--app <id>] [--project <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -11309,7 +11546,8 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device enroll [--all-apps|--app <id>[,<id>...]] [--capability all|<c>[,<c>...]] [--platform-wide]
+    [--name <label>] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--wait <seconds>] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
@@ -11325,8 +11563,11 @@ Usage:
 
 // src/help.ts
 function printHelp(output = console) {
-  output.log(`odla-ai
-${USAGE_SECTION}
+  output.log(helpText());
+}
+function helpText() {
+  return `odla-ai
+${AUTH_SECTION}${USAGE_SECTION}
 Commands:
   auth         Start a fresh, exact-project agent authorization for human review.
                The email is the signed-in odla account, never git or GitHub
@@ -11399,8 +11640,9 @@ Commands:
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
   pm           Project management (via @odla-ai/pm): Products contain Projects;
                projects contain goals, kanban tasks, decisions, and bugs. Use
-               "pm project list|add|use" to select worktree-local context, or
-               pass --app/--project explicitly. Same device-grant auth as "app".
+               "pm project list|add|use" selects a project for this app on this
+               machine \u2014 every worktree shares it \u2014 or pass --app/--project
+               explicitly. Same device-grant auth as "app".
                Status changes and comments post to each item's @odla-ai/chat
                discussion thread.
                NOTE: "--column ready" is OWNER-ONLY. Creating a task in Ready
@@ -11429,9 +11671,20 @@ Commands:
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
   device       Enrol THIS machine once, then stop asking. A human approves the
-               enrollment in the browser; from then on this terminal mints its
-               own short-lived credentials for the named projects with nobody's
-               attention, until the device expires or is revoked.
+               enrollment in the browser; from then on EVERY worktree on this
+               machine mints its own short-lived credentials with nobody's
+               attention, until the device is revoked or goes unused.
+               "--all-apps" covers every app you own, now and later, so creating
+               an app costs no new approval. "--capability all" takes everything
+               that approval is allowed to carry, so a capability you did not
+               think to name is not a 403 next week. "--platform-wide" is the
+               administrator's version, across all of odla.
+               The expiry is a GAP, not a clock: each use rolls it forward, so
+               only going quiet brings a human back into the loop \u2014 which is
+               where anything that changed can be explained.
+               "device list" shows what each machine holds and when it lapses;
+               revoking one takes down every credential it ever minted, and is
+               deliberately a signed-in human's decision in Studio.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
@@ -11501,10 +11754,12 @@ Safety:
   release. A confirmed stale client stops with a safe npx rerun command; a
   workspace-linked client also identifies the worktree that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
-  odla.config.mjs may select the app explicitly but is not required. Code host
-  approval and credential hashes live in odla-ai/db. The host
-  credential is never written under .odla/; it exists only in the foreground
-  "code connect" process and is rotated by the next approved connection.
+  odla.config.mjs may select the app explicitly but is not required. With an
+  enrolled code.session device, the Studio repository selection authorizes the
+  host's first connection and reconnects without another human approval. Without
+  an enrolled device, "code connect" falls back to the reviewed handshake. Host
+  credential hashes live in odla-ai/db; the credential itself is never written
+  under .odla/, exists only in the foreground process, and rotates on reconnect.
   "code repository bind" takes owner/name and resolves the two GitHub integers the
   bind route wants across every installation you have, refusing an ambiguous match
   rather than choosing one \u2014 the same repository name under two organizations is
@@ -11525,7 +11780,7 @@ Safety:
   Run security plan first to inspect the admin-selected providers, models,
   per-route bounds, credential readiness, retention, no-execution boundary,
   and digest that binds consent to that exact plan.
-`);
+`;
 }
 var init_help = __esm({
   "src/help.ts"() {
@@ -11535,6 +11790,53 @@ var init_help = __esm({
   }
 });
 
+// src/help-command.ts
+function printCommandHelp(command, output = console) {
+  const lines = helpText().split("\n");
+  const usage = allBlocks(lines, new RegExp(`^  odla-ai ${escapeRe(command)}(\\s|$)`));
+  const prose = block(lines, (line2) => new RegExp(`^  ${escapeRe(command)}\\s\\s+\\S`).test(line2));
+  if (usage.length === 0 && prose.length === 0) {
+    output.log(`odla-ai: no command "${command}". Run "odla-ai help" for all of them.`);
+    return;
+  }
+  output.log([
+    ...prose.length ? [prose.join("\n"), ""] : [],
+    ...usage.length ? ["Usage:", ...usage, ""] : [],
+    AUTH_SECTION.trimEnd()
+  ].join("\n"));
+}
+function allBlocks(lines, pattern) {
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!pattern.test(lines[i])) continue;
+    out.push(...block(lines.slice(i), (line2) => line2 === lines[i]));
+  }
+  return out;
+}
+function block(lines, starts) {
+  const first = lines.findIndex(starts);
+  if (first === -1) return [];
+  const indent = lines[first].length - lines[first].trimStart().length;
+  const out = [lines[first]];
+  for (const line2 of lines.slice(first + 1)) {
+    if (!line2.trim()) break;
+    if (line2.length - line2.trimStart().length <= indent) break;
+    out.push(line2);
+  }
+  return out;
+}
+function escapeRe(value2) {
+  return value2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var init_help_command = __esm({
+  "src/help-command.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_help_usage();
+    init_help();
+  }
+});
+
 // src/discuss-principals.ts
 function mergeDiscussPrincipals(target, source) {
   Object.assign(target.authors, source.authors ?? {});
@@ -12800,20 +13102,43 @@ var init_pm_watch = __esm({
 
 // src/pm-project-context.ts
 function readPmProjectContext(rootDir) {
-  const value2 = readJsonFile(pmProjectContextFile(rootDir));
-  return value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" ? value2 : null;
+  adoptLegacySelection(rootDir);
+  const entries = Object.values(readSelections()).filter(isSelection);
+  return entries.sort((a, b) => b.selectedAt.localeCompare(a.selectedAt))[0] ?? null;
 }
 function writePmProjectContext(rootDir, value2) {
-  writePrivateJson(pmProjectContextFile(rootDir), { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  adoptLegacySelection(rootDir);
+  writePrivateJson(pmProjectContextFile(), {
+    ...readSelections(),
+    [value2.appId]: { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() }
+  });
+}
+function adoptLegacySelection(rootDir) {
+  const legacy = (0, import_node_path18.resolve)(rootDir, ".odla", "pm-project.local.json");
+  if (!(0, import_node_fs19.existsSync)(legacy)) return;
+  const previous = readJsonFile(legacy);
+  (0, import_node_fs19.rmSync)(legacy, { force: true });
+  if (!isSelection(previous)) return;
+  const selections = readSelections();
+  if (selections[previous.appId]) return;
+  writePrivateJson(pmProjectContextFile(), { ...selections, [previous.appId]: previous });
 }
-var import_node_path17, pmProjectContextFile;
+function readSelections() {
+  return readJsonFile(pmProjectContextFile()) ?? {};
+}
+function isSelection(value2) {
+  return !!value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" && typeof value2.selectedAt === "string";
+}
+var import_node_fs19, import_node_path18, pmProjectContextFile;
 var init_pm_project_context = __esm({
   "src/pm-project-context.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path17 = require("path");
+    import_node_fs19 = require("fs");
+    import_node_path18 = require("path");
     init_local();
-    pmProjectContextFile = (rootDir) => (0, import_node_path17.resolve)(rootDir, ".odla", "pm-project.local.json");
+    init_odla_home();
+    pmProjectContextFile = () => pmContextFile();
   }
 });
 
@@ -14387,7 +14712,7 @@ async function provision(options) {
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process13.default.env[cfg.ai.keyEnv];
+      const key = import_node_process17.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai5.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -14426,14 +14751,14 @@ async function provision(options) {
     }
   }
 }
-var import_apps13, import_ai5, import_node_process13;
+var import_apps13, import_ai5, import_node_process17;
 var init_provision = __esm({
   "src/provision.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps13 = require("@odla-ai/apps");
     import_ai5 = require("@odla-ai/ai");
-    import_node_process13 = __toESM(require("process"), 1);
+    import_node_process17 = __toESM(require("process"), 1);
     init_config();
     init_calendar();
     init_calendar_errors();
@@ -14628,7 +14953,7 @@ var init_surface = __esm({
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process14.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process18.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -14636,18 +14961,18 @@ function recordInvocation(parsed) {
       options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs19.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs20.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
 }
-var import_node_fs19, import_node_process14;
+var import_node_fs20, import_node_process18;
 var init_record = __esm({
   "src/record.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs19 = require("fs");
-    import_node_process14 = __toESM(require("process"), 1);
+    import_node_fs20 = require("fs");
+    import_node_process18 = __toESM(require("process"), 1);
     init_surface();
   }
 });
@@ -14709,6 +15034,22 @@ var init_device_ttl = __esm({
 
 // src/device-command.ts
 async function deviceCommand(parsed, deps) {
+  assertArgs(parsed, [
+    "app",
+    "all-apps",
+    "platform-wide",
+    "name",
+    "capability",
+    "device-ttl",
+    "email",
+    "open",
+    "json",
+    "config",
+    "token",
+    "context",
+    "platform",
+    "wait"
+  ], 3);
   const action2 = parsed.positionals[1] ?? "";
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
@@ -14721,10 +15062,12 @@ async function deviceCommand(parsed, deps) {
 }
 async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
-  const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
-  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
+  const platformWide = parsed.options["platform-wide"] === true;
+  const apps = platformWide || parsed.options["all-apps"] === true ? [import_db4.ALL_OWNED_APPS] : (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
+  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026], or --all-apps");
   const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
-  const extended = deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const extended = platformWide || deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const { capabilities, scopes } = requestedEnvelope(parsed, platformWide);
   const token = await scopedToken2(
     parsed,
     deps,
@@ -14739,9 +15082,10 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
     body: JSON.stringify({
       name,
-      platform: import_node_process15.default.platform,
+      platform: import_node_process19.default.platform,
       appIds: apps,
-      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {},
+      ...capabilities ? { capabilities } : {},
+      ...scopes ? { scopes } : {},
       ...deviceTtlMs === void 0 ? {} : { deviceTtlMs }
     })
   });
@@ -14750,19 +15094,52 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     throw new Error(`device enroll failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
   }
   const path = deviceCredentialPath();
-  (0, import_node_fs20.mkdirSync)((0, import_node_path18.dirname)(path), { recursive: true });
-  (0, import_node_fs20.writeFileSync)(path, JSON.stringify({
+  (0, import_node_fs21.mkdirSync)((0, import_node_path19.dirname)(path), { recursive: true });
+  (0, import_node_fs21.writeFileSync)(path, JSON.stringify({
     token: body.token,
     platform: cfg.platformUrl.replace(/\/$/, ""),
     deviceId: body.device.deviceId,
     name
   }, null, 2));
-  (0, import_node_fs20.chmodSync)(path, 384);
-  out.error(`device: enrolled "${name}" for ${body.device.appIds.join(", ")}; credential written to ${path}`);
-  out.error("device: this terminal will mint its own credentials from now on \u2014 no further approvals.");
+  (0, import_node_fs21.chmodSync)(path, 384);
+  rememberMachineIdentity(cfg.platformUrl.replace(/\/$/, ""), stringOpt(parsed.options.email));
+  const reach = body.device.appIds.includes(import_db4.ALL_OWNED_APPS) ? "every app you own, now and later" : body.device.appIds.join(", ");
+  out.error(`device: enrolled "${name}" for ${reach}; credential written to ${path}`);
+  out.error(
+    "device: every worktree on this machine mints its own credentials from now on \u2014 no further approvals,"
+  );
+  out.error(
+    `device: and the clock resets each time you use it. Going quiet for ${describeWindow(body.device.expiresAt)} is what ends it.`
+  );
   if (json) {
-    out.log(JSON.stringify({ deviceId: body.device.deviceId, name, appIds: body.device.appIds, expiresAt: body.device.expiresAt }, null, 2));
+    out.log(JSON.stringify({
+      deviceId: body.device.deviceId,
+      name,
+      appIds: body.device.appIds,
+      capabilities: body.device.capabilities ?? [],
+      scopes: body.device.scopes ?? [],
+      expiresAt: body.device.expiresAt,
+      hardExpiresAt: body.device.hardExpiresAt ?? null
+    }, null, 2));
+  }
+}
+function requestedEnvelope(parsed, platformWide) {
+  const raw = stringOpt(parsed.options.capability);
+  const everything = platformWide || raw?.trim().toLowerCase() === "all";
+  if (everything) {
+    return {
+      capabilities: [...import_db4.OPTIONAL_AGENT_PROJECT_CAPABILITIES],
+      scopes: platformWide ? [...import_db4.ADMIN_DEVICE_SCOPES] : [...import_db4.OWNER_DEVICE_SCOPES]
+    };
   }
+  const named = raw?.split(",").map((c) => c.trim()).filter(Boolean);
+  return named?.length ? { capabilities: named } : {};
+}
+function describeWindow(expiresAt, now = Date.now()) {
+  const days = Math.max(1, Math.round((expiresAt - now) / (24 * 60 * 60 * 1e3)));
+  if (days >= 365) return `${Math.round(days / 365)} year${days >= 730 ? "s" : ""}`;
+  if (days % 7 === 0) return `${days / 7} week${days > 7 ? "s" : ""}`;
+  return `${days} day${days === 1 ? "" : "s"}`;
 }
 async function list2(parsed, deps, cfg, doFetch, out, json) {
   const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device list)");
@@ -14777,12 +15154,17 @@ async function list2(parsed, deps, cfg, doFetch, out, json) {
   if (body.devices.length === 0) return out.log("no enrolled devices");
   for (const device of body.devices) {
     const state2 = device.revokedAt ? "revoked" : device.expiresAt <= Date.now() ? "expired" : "active";
-    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${device.appIds.join(", ")}]`);
+    const reach = device.appIds.includes("*") ? "every app you own" : device.appIds.join(", ");
+    const gap = state2 === "active" ? `  idle ${describeWindow(device.expiresAt)} left` : "";
+    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${reach}]${gap}`);
   }
 }
 async function revoke(parsed, deps, cfg, doFetch, out, json) {
   const deviceId = parsed.positionals[2];
   if (!deviceId) throw new Error("device revoke needs the device id from `odla-ai device list`");
+  out.error(
+    `device: revoking is a signed-in human's decision; if this is refused, open ${cfg.platformUrl}/studio and revoke it there.`
+  );
   const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device revoke)");
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices/${encodeURIComponent(deviceId)}/revoke`, {
     method: "POST",
@@ -14801,7 +15183,7 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
     // A device is granted the apps named in ONE approval, so --app is a list here.
     allowAppList: true
   });
-  const scopedTokenFile = credentials.scopedTokenFile;
+  const scopedTokenFile2 = credentials.scopedTokenFile;
   return getScopedPlatformToken({
     platform: cfg.platformUrl,
     scope,
@@ -14812,22 +15194,24 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     openApprovalUrl: deps.openUrl,
     rootDir: cfg.rootDir,
-    tokenFile: scopedTokenFile,
+    tokenFile: scopedTokenFile2,
     ...stringOpt(parsed.options.token) ? { token: stringOpt(parsed.options.token) } : {}
   });
 }
 function defaultDeviceName() {
-  return `${import_node_process15.default.env.HOSTNAME ?? import_node_process15.default.env.HOST ?? "machine"}-${import_node_process15.default.platform}`;
+  return `${import_node_process19.default.env.HOSTNAME ?? import_node_process19.default.env.HOST ?? "machine"}-${import_node_process19.default.platform}`;
 }
-var import_node_fs20, import_node_path18, import_node_process15;
+var import_db4, import_node_fs21, import_node_path19, import_node_process19;
 var init_device_command = __esm({
   "src/device-command.ts"() {
     "use strict";
     init_cjs_shims();
+    import_db4 = require("@odla-ai/db");
     init_device_ttl();
-    import_node_fs20 = require("fs");
-    import_node_path18 = require("path");
-    import_node_process15 = __toESM(require("process"), 1);
+    init_machine_identity();
+    import_node_fs21 = require("fs");
+    import_node_path19 = require("path");
+    import_node_process19 = __toESM(require("process"), 1);
     init_argv();
     init_admin_ai_auth();
     init_device_session();
@@ -14882,7 +15266,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs21.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs22.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 async function runbookList(ctx, all, query) {
   const params = new URLSearchParams();
@@ -14971,12 +15355,12 @@ async function runbookRemove(ctx, slug) {
   await call2(ctx, "DELETE", `/runbook/${encodeURIComponent(runbook.id)}`);
   ctx.out.log(`removed ${slug}`);
 }
-var import_node_fs21, PLATFORM_SCOPE, stamp;
+var import_node_fs22, PLATFORM_SCOPE, stamp;
 var init_runbook_actions = __esm({
   "src/runbook-actions.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs21 = require("fs");
+    import_node_fs22 = require("fs");
     init_version();
     init_runbook_requires();
     PLATFORM_SCOPE = "$platform";
@@ -15009,12 +15393,12 @@ function parseRunbook(text3, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs22.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs22.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs23.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs23.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path19.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs22.readFileSync)((0, import_node_path19.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path20.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs23.readFileSync)((0, import_node_path20.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -15079,13 +15463,13 @@ async function upsert(ctx, r, visibility) {
   );
   return "updated";
 }
-var import_node_fs22, import_node_path19;
+var import_node_fs23, import_node_path20;
 var init_runbook_import = __esm({
   "src/runbook-import.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs22 = require("fs");
-    import_node_path19 = require("path");
+    import_node_fs23 = require("fs");
+    import_node_path20 = require("path");
     init_runbook_actions();
   }
 });
@@ -15263,10 +15647,10 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path20.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs23.existsSync)(manifest)) return void 0;
+    const manifest = (0, import_node_path21.join)(root, workspace, "package.json");
+    if (!(0, import_node_fs24.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs23.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs24.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -15332,7 +15716,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs23.readFileSync)((0, import_node_path20.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs24.readFileSync)((0, import_node_path21.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -15343,14 +15727,14 @@ async function runbookImpact(ctx, options, deps = {}) {
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
   report4(ctx, impacts);
 }
-var import_node_child_process6, import_node_fs23, import_node_path20, SOURCE3, editHint;
+var import_node_child_process6, import_node_fs24, import_node_path21, SOURCE3, editHint;
 var init_runbook_impact = __esm({
   "src/runbook-impact.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process6 = require("child_process");
-    import_node_fs23 = require("fs");
-    import_node_path20 = require("path");
+    import_node_fs24 = require("fs");
+    import_node_path21 = require("path");
     init_runbook_impact_scan();
     init_runbook_actions();
     SOURCE3 = /\.(ts|tsx|js|jsx|mts|cts)$/;
@@ -15490,7 +15874,7 @@ var init_runbook_search_command = __esm({
 });
 
 // src/runbook-editor.ts
-function resolveEditor(env = import_node_process16.default.env) {
+function resolveEditor(env = import_node_process20.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -15504,8 +15888,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process16.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process16.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process20.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process20.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -15513,28 +15897,28 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs24.mkdtempSync)((0, import_node_path21.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path21.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs25.mkdtempSync)((0, import_node_path22.join)((0, import_node_os6.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path22.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs24.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs25.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs24.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs25.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs25.rmSync)(dir, { recursive: true, force: true });
   }
 }
-var import_node_child_process7, import_node_fs24, import_node_os5, import_node_path21, import_node_process16, EDITOR_ENV, defaultRunOrInjected;
+var import_node_child_process7, import_node_fs25, import_node_os6, import_node_path22, import_node_process20, EDITOR_ENV, defaultRunOrInjected;
 var init_runbook_editor = __esm({
   "src/runbook-editor.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process7 = require("child_process");
-    import_node_fs24 = require("fs");
-    import_node_os5 = require("os");
-    import_node_path21 = require("path");
-    import_node_process16 = __toESM(require("process"), 1);
+    import_node_fs25 = require("fs");
+    import_node_os6 = require("os");
+    import_node_path22 = require("path");
+    import_node_process20 = __toESM(require("process"), 1);
     EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
     defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
   }
@@ -15923,9 +16307,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path22.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path22.resolve)(options.out ?? (0, import_node_path22.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path22.relative)(target, output).split(import_node_path22.sep).join("/");
+  const target = (0, import_node_path23.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path23.resolve)(options.out ?? (0, import_node_path23.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path23.relative)(target, output).split(import_node_path23.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -15937,7 +16321,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path22.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path23.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -15955,7 +16339,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path22.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path23.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -15979,7 +16363,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path22.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path23.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -16008,17 +16392,17 @@ function printSummary(out, appId, env, run, report5, output) {
   out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
   if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path22.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path23.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
 }
-var import_node_path22, import_security, import_node3;
+var import_node_path23, import_security, import_node3;
 var init_security = __esm({
   "src/security.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path22 = require("path");
+    import_node_path23 = require("path");
     import_security = require("@odla-ai/security");
     import_node3 = require("@odla-ai/security/node");
     init_config();
@@ -16536,8 +16920,10 @@ async function dispatchCli(argv2, dependencies) {
     return;
   }
   if (command === "help" || command === "--help" || command === "-h") {
-    assertArgs(parsed, ["help"], 1);
-    printHelp(runtime.stdout);
+    assertArgs(parsed, ["help"], 2);
+    const topic = parsed.positionals[1];
+    if (topic) printCommandHelp(topic, runtime.stdout);
+    else printHelp(runtime.stdout);
     return;
   }
   if (command === "whoami") {
@@ -16708,6 +17094,7 @@ var init_cli = __esm({
     init_context_command();
     init_credential_command();
     init_help();
+    init_help_command();
     init_version();
     init_discuss_command();
     init_pm_command();