@odla-ai/cli 0.38.2 → 0.39.0

package/dist/{chunk-HETCZVFB.js → chunk-PJ3RATDD.js}

@@ -10,12 +10,12 @@ import {
 } from "./chunk-UKLSRQ5J.js";
 
 // src/admin-ai.ts
-import process9 from "process";
+import process13 from "process";
 
 // src/token.ts
 import { OdlaError, requestToken } from "@odla-ai/db";
 import { createHash } from "crypto";
-import process6 from "process";
+import process10 from "process";
 
 // src/handshake-approval.ts
 import process3 from "process";
@@ -150,27 +150,10 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
 }
 
 // src/cached-credential.ts
-import { rmSync as rmSync2 } from "fs";
-var noted = null;
-function noteCachedCredential(tokenFile) {
-  noted = tokenFile;
-}
-function isCredentialRejection(error) {
-  const message2 = error instanceof Error ? error.message : String(error ?? "");
-  return /\((401|403)\)\s*$/.test(message2.trim());
-}
-function explainRejectedCredential(error) {
-  const tokenFile = noted;
-  if (!tokenFile || !isCredentialRejection(error)) return null;
-  noted = null;
-  rmSync2(tokenFile, { force: true });
-  return [
-    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
-    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
-    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
-    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
-  ].join("\n");
-}
+import { rmSync as rmSync3 } from "fs";
+
+// src/auth-guidance.ts
+import process7 from "process";
 
 // src/device-session.ts
 import { existsSync, readFileSync } from "fs";
@@ -206,12 +189,71 @@ async function mintDeviceSession(platformUrl, credential2, doFetch) {
       `device session failed: ${detail} (${response2.status})` + (revocable ? " \u2014 if this machine's enrollment was revoked or has expired, enroll it again in Studio" : "")
     );
   }
-  return { token: body.token, expiresAt: body.expiresAt ?? Date.now() };
+  return {
+    token: body.token,
+    expiresAt: body.expiresAt ?? Date.now(),
+    // Absent from a registry that predates rolling expiry and scoped devices.
+    // Left undefined rather than defaulted, so a caller can tell "the platform
+    // did not say" from "the platform said none".
+    ...typeof body.deviceExpiresAt === "number" ? { deviceExpiresAt: body.deviceExpiresAt } : {},
+    ...Array.isArray(body.appIds) ? { appIds: body.appIds } : {},
+    ...Array.isArray(body.capabilities) ? { capabilities: body.capabilities } : {},
+    ...Array.isArray(body.scopes) ? { scopes: body.scopes } : {}
+  };
+}
+
+// src/odla-home.ts
+import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, rmSync as rmSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join3 } from "path";
+import process6 from "process";
+function odlaHome(env = process6.env) {
+  return env.ODLA_HOME ?? join3(env.HOME ?? homedir2(), ".odla");
+}
+function odlaHomePath(segments, env = process6.env) {
+  return join3(odlaHome(env), ...segments);
+}
+function identityFile(env) {
+  return odlaHomePath(["identity.json"], env);
+}
+function deviceSessionFile(env) {
+  return odlaHomePath(["session.json"], env);
+}
+function appTokenFile(appId, env) {
+  return odlaHomePath(["apps", safeSegment(appId), "dev-token.json"], env);
+}
+function appCredentialsFile(appId, env) {
+  return odlaHomePath(["apps", safeSegment(appId), "credentials.json"], env);
+}
+function scopedTokenFile(env) {
+  return odlaHomePath(["admin-token.local.json"], env);
+}
+function pmContextFile(env) {
+  return odlaHomePath(["pm-context.json"], env);
+}
+function adoptRepoLocalCache(legacyPath, machinePath, out) {
+  if (!existsSync2(legacyPath) || legacyPath === machinePath) return false;
+  const superseded = existsSync2(machinePath);
+  if (!superseded) {
+    mkdirSync(dirname2(machinePath), { recursive: true });
+    copyFileSync(legacyPath, machinePath);
+    chmodSync(machinePath, 384);
+  }
+  rmSync2(legacyPath, { force: true });
+  out?.error(
+    superseded ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
+  );
+  return true;
+}
+function safeSegment(value2) {
+  const clean4 = value2.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "");
+  if (!clean4) throw new Error(`"${value2}" is not a usable app id`);
+  return clean4;
 }
 
 // src/local.ts
-import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
-import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
+import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
+import { dirname as dirname3, isAbsolute, relative, resolve } from "path";
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
@@ -225,7 +267,7 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!existsSync2(path)) return null;
+  if (!existsSync3(path)) return null;
   let value2;
   try {
     value2 = JSON.parse(readFileSync2(path, "utf8"));
@@ -259,7 +301,7 @@ function mergeCredential(current, update) {
 }
 function ensureGitignore(rootDir, localPaths = []) {
   const path = resolve(rootDir, ".gitignore");
-  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
+  const existing = existsSync3(path) ? readFileSync2(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
@@ -279,7 +321,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return resolve(dirname2(cfg.configPath), requested);
+  return resolve(dirname3(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -293,7 +335,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
+  const existing = existsSync3(path) ? readFileSync2(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -319,10 +361,10 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text3) {
-  mkdirSync(dirname2(path), { recursive: true });
+  mkdirSync2(dirname3(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync(temporary, text3, { mode: 384 });
-  chmodSync(temporary, 384);
+  chmodSync2(temporary, 384);
   renameSync(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
@@ -335,6 +377,94 @@ function displayPath(path, rootDir = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
+// src/auth-guidance.ts
+var ENROL_EVERYTHING = "npx odla-ai device enroll --all-apps --capability all --no-open --wait 600";
+var ENROL_PLATFORM_WIDE = "npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600";
+function machineAuthState(audience, env = process7.env) {
+  const device = readDeviceCredential(audience, env);
+  if (!device) return { enrolled: false };
+  const session = readJsonFile(deviceSessionFile(env));
+  const current = session?.platform === audience && session.deviceId === device.deviceId ? session : void 0;
+  return {
+    enrolled: true,
+    ...device.name ? { deviceName: device.name } : {},
+    ...current?.appIds ? { appIds: current.appIds } : {},
+    ...current?.capabilities ? { capabilities: current.capabilities } : {},
+    ...current?.scopes ? { scopes: current.scopes } : {},
+    ...current?.deviceExpiresAt ? { lapsesAt: current.deviceExpiresAt } : {}
+  };
+}
+function scopeInterruptionNotice(scope, state2) {
+  const platformScope = scope.startsWith("platform:");
+  const reason = !state2.enrolled ? "this machine is not enrolled, so every privileged command needs its own browser approval" : `this machine is enrolled but its approval did not include "${scope}"`;
+  return [
+    `odla: ${reason}.`,
+    `   Approve this one now, then end the interruptions with:`,
+    `     ${platformScope ? ENROL_PLATFORM_WIDE : ENROL_EVERYTHING}`,
+    platformScope ? "   A platform scope needs an administrator's approval; an app owner's cannot carry it." : "   One approval, every app you own, and it rolls forward while you keep working."
+  ].join("\n");
+}
+function lapseNotice(state2, now = Date.now()) {
+  if (!state2.enrolled || !state2.lapsesAt) return null;
+  const days = Math.floor((state2.lapsesAt - now) / (24 * 60 * 60 * 1e3));
+  if (days < 0) return "this machine's enrollment has lapsed; the next command will ask for approval";
+  return `idle for ${days} more day${days === 1 ? "" : "s"} before this machine needs approving again (using it resets the clock)`;
+}
+
+// src/cached-credential.ts
+var noted = null;
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  rmSync3(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this account: collecting a handshake retires the",
+    "   principal's other collected credentials, so a second machine supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`,
+    `   To stop needing one: ${ENROL_EVERYTHING}`
+  ].join("\n");
+}
+
+// src/device-session-cache.ts
+import process8 from "process";
+var SKEW_MS = 6e4;
+async function deviceSessionToken(platformUrl, audience, credential2, doFetch, env = process8.env) {
+  const path = deviceSessionFile(env);
+  const cached = readJsonFile(path);
+  if (cached?.token && cached.platform === audience && cached.deviceId === credential2.deviceId && (cached.expiresAt ?? 0) > Date.now() + SKEW_MS) return cached;
+  const minted = await mintDeviceSession(platformUrl, credential2, doFetch);
+  const session = {
+    ...minted,
+    platform: audience,
+    ...credential2.deviceId ? { deviceId: credential2.deviceId } : {}
+  };
+  writePrivateJson(path, session);
+  return session;
+}
+
+// src/machine-identity.ts
+import process9 from "process";
+function readMachineIdentity(audience, env = process9.env) {
+  const stored = readJsonFile(identityFile(env));
+  if (!stored || typeof stored.email !== "string" || !stored.email) return null;
+  return stored.platform === audience ? { platform: audience, email: stored.email } : null;
+}
+function rememberMachineIdentity(audience, email, env = process9.env) {
+  if (!email) return;
+  const existing = readMachineIdentity(audience, env);
+  if (existing?.email === email) return;
+  writePrivateJson(identityFile(env), { platform: audience, email });
+}
+
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   const audience = platformAudience(cfg.platformUrl);
@@ -343,19 +473,19 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const cached = readJsonFile(cfg.local.tokenFile);
   if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
-    if (process6.env.ODLA_DEV_TOKEN) {
-      const declared = process6.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (process10.env.ODLA_DEV_TOKEN) {
+      const declared = process10.env.ODLA_DEV_TOKEN_AUDIENCE;
       if (declared) {
         if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
       } else if (audience !== "https://odla.ai") {
         throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
       }
-      return process6.env.ODLA_DEV_TOKEN;
+      return process10.env.ODLA_DEV_TOKEN;
     }
     const device = readDeviceCredential(audience);
     if (device) {
-      const session = await mintDeviceSession(cfg.platformUrl, device, doFetch);
-      out.error(`auth: session minted by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
+      const session = await deviceSessionToken(cfg.platformUrl, audience, device, doFetch);
+      out.error(`auth: session held by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
       return session.token;
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
@@ -375,7 +505,10 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     doFetch,
     out,
     audience,
-    email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
+    email: handshakeEmail(
+      options.email,
+      (cached?.platform === audience ? cached.email : void 0) ?? readMachineIdentity(audience)?.email
+    ),
     pendingFile: handshakeFile(cfg),
     grantIntent
   };
@@ -392,6 +525,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     expiresAt
   });
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+  rememberMachineIdentity(audience, ctx.email);
   return token;
 }
 async function freshHandshake(ctx, waitMs) {
@@ -461,7 +595,7 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? process6.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? process10.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (/@users\.noreply\.github\.com$/i.test(email)) {
     throw new Error(
       `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
@@ -492,12 +626,12 @@ function platformAudience(value2) {
 }
 
 // src/secret-input.ts
-import process7 from "process";
+import process11 from "process";
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = process7.env[options.fromEnv];
+  if (options.fromEnv) value2 = process11.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -505,7 +639,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = process7.stdin) {
+async function readSecretStream(kind, stream = process11.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -515,9 +649,8 @@ async function readSecretStream(kind, stream = process7.stdin) {
 }
 
 // src/admin-ai-auth.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
-import process8 from "process";
+import { join as join4 } from "path";
+import process12 from "process";
 import { requestToken as requestToken2 } from "@odla-ai/db";
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -525,7 +658,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = process8.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = process12.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -537,7 +670,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = process8.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = process12.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -564,15 +697,28 @@ var SCOPE_PURPOSE = {
 };
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? process8.cwd();
-  const tokenFile = options.tokenFile ?? join3(rootDir, ".odla/admin-token.local.json");
+  const rootDir = options.rootDir ?? process12.cwd();
+  const tokenFile = options.tokenFile ?? scopedTokenFile();
+  adoptRepoLocalCache(join4(rootDir, ".odla/admin-token.local.json"), tokenFile, out);
+  const device = readDeviceCredential(audience);
+  if (device && options.cache !== false) {
+    const session = await deviceSessionToken(platform, audience, device, doFetch);
+    if (session.scopes?.includes(scope)) {
+      out.error(`auth: ${scope} held by this enrolled device`);
+      return session.token;
+    }
+  }
   const cache2 = options.cache === false ? null : readJsonFile(tokenFile);
   const cached = cache2?.platform === audience ? cache2.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.error(`auth: using cached ${scope} grant (${tokenFile})`);
     return cached.token;
   }
-  const email = handshakeEmail(options.email, cache2?.platform === audience ? cache2.email : void 0);
+  out.error(scopeInterruptionNotice(scope, machineAuthState(audience)));
+  const email = handshakeEmail(
+    options.email,
+    (cache2?.platform === audience ? cache2.email : void 0) ?? readMachineIdentity(audience)?.email
+  );
   const { token, expiresAt } = await requestToken2({
     endpoint: audience,
     email,
@@ -592,8 +738,8 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   if (options.cache !== false) {
     const tokens = cache2?.platform === audience ? { ...cache2.tokens ?? {} } : {};
     tokens[scope] = { token, expiresAt };
-    if (existsSync3(join3(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
     writePrivateJson(tokenFile, { platform: audience, email, tokens });
+    rememberMachineIdentity(audience, email);
     out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   } else {
     out.error(`auth: ${scope} grant is in memory only; its credential record remains in odla-ai/db`);
@@ -769,7 +915,7 @@ function isRecord2(value2) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? process9.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? process13.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -1085,12 +1231,12 @@ async function adminSpend(parsed, ctx) {
 
 // src/operator-context.ts
 import { existsSync as existsSync6 } from "fs";
-import { join as join5, resolve as resolve4 } from "path";
-import process11 from "process";
+import { join as join6, resolve as resolve4 } from "path";
+import process15 from "process";
 
 // src/config.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { existsSync as existsSync4, rmSync as rmSync4, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 import { appServiceDefinition, appServiceIds } from "@odla-ai/apps";
 
@@ -1494,13 +1640,17 @@ var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
 var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+var stderr = { error: (message2) => {
+  process.stderr.write(`${message2}
+`);
+} };
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = resolve2(configPath);
   if (!existsSync4(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = dirname3(resolved);
+  const rootDir = dirname4(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -1510,11 +1660,14 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   validateCalendarConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   validateMonitoringConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
-    tokenFile: resolve2(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: resolve2(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    tokenFile: raw.local?.tokenFile ? resolve2(rootDir, raw.local.tokenFile) : appTokenFile(raw.app.id),
+    credentialsFile: raw.local?.credentialsFile ? resolve2(rootDir, raw.local.credentialsFile) : appCredentialsFile(raw.app.id),
     devVarsFile: resolve2(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
+  adoptRepoLocalCache(resolve2(rootDir, ".odla/dev-token.json"), local.tokenFile, stderr);
+  adoptRepoLocalCache(resolve2(rootDir, ".odla/credentials.local.json"), local.credentialsFile, stderr);
+  rmSync4(resolve2(rootDir, ".odla/handshake.local.json"), { force: true });
   return {
     ...raw,
     configPath: resolved,
@@ -1623,17 +1776,17 @@ function unique3(values) {
 
 // src/operator-profiles.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join4, resolve as resolve3 } from "path";
-import process10 from "process";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname5, join as join5, resolve as resolve3 } from "path";
+import process14 from "process";
 function operatorProfileFile() {
   return resolve3(
-    clean(process10.env.ODLA_CONTEXT_FILE) ?? join4(homedir2(), ".odla", "contexts.json")
+    clean(process14.env.ODLA_CONTEXT_FILE) ?? join5(homedir3(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(process10.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(process14.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -1673,10 +1826,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? join4(dirname4(selection.file), "profiles", selection.name) : join4(homedir2(), ".odla");
+  const base = selection.name ? join5(dirname5(selection.file), "profiles", selection.name) : join5(homedir3(), ".odla");
   return {
-    developer: join4(base, "dev-token.json"),
-    scoped: join4(base, "admin-token.local.json")
+    developer: join5(base, "dev-token.json"),
+    scoped: join5(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -1762,13 +1915,13 @@ async function resolveOperatorContext(parsed, options = {}) {
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(process11.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(process15.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(process11.env.ODLA_APP_ID);
+  const appEnvironment = clean2(process15.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) {
@@ -1782,16 +1935,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(process11.env.ODLA_ENV);
+  const envEnvironment = clean2(process15.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? process11.cwd();
+  const rootDir = loaded?.rootDir ?? process15.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(process11.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process11.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(process11.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process11.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join5(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(process15.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process15.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile2 = clean2(process15.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process15.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join6(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -1813,8 +1966,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: join5(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: join5(rootDir, ".dev.vars"),
+      credentialsFile: join6(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: join6(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -1838,7 +1991,7 @@ async function resolveOperatorContext(parsed, options = {}) {
     },
     credentials: {
       developerTokenFile: tokenFile,
-      scopedTokenFile
+      scopedTokenFile: scopedTokenFile2
     }
   };
 }
@@ -1936,7 +2089,7 @@ async function adminCommand(parsed, deps = {}) {
 }
 
 // src/auth-command.ts
-import process12 from "process";
+import process16 from "process";
 
 // src/whoami-command.ts
 var text2 = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
@@ -2072,6 +2225,7 @@ async function whoamiCommand(parsed, deps = {}) {
   } else {
     out.log("projects:   (none \u2014 every pm and discuss call will be refused)");
   }
+  printMachineBlock(cfg.platformUrl, out);
   if (!identity.admin) {
     if (identity.scopes.includes("platform:runbook:write")) {
       out.log("\nThis exact scope can read and edit all platform runbook content.");
@@ -2082,6 +2236,21 @@ async function whoamiCommand(parsed, deps = {}) {
     }
   }
 }
+function printMachineBlock(platformUrl, out) {
+  const state2 = machineAuthState(platformAudience(platformUrl));
+  if (!state2.enrolled) {
+    out.log("\nmachine:    not enrolled \u2014 every privileged command needs its own browser approval.");
+    out.log(`            End that with:
+              ${ENROL_EVERYTHING}`);
+    return;
+  }
+  const reach = state2.appIds?.includes("*") ? "every app you own" : state2.appIds?.join(", ");
+  out.log(`
+machine:    enrolled${state2.deviceName ? ` as "${state2.deviceName}"` : ""}${reach ? ` for ${reach}` : ""}`);
+  if (state2.scopes?.length) out.log(`            carrying ${state2.scopes.join(", ")}`);
+  const lapse = lapseNotice(state2);
+  if (lapse) out.log(`            ${lapse}`);
+}
 
 // src/auth-command.ts
 async function authCommand(parsed, deps = {}) {
@@ -2106,7 +2275,7 @@ async function authCommand(parsed, deps = {}) {
   const { cfg } = context;
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const email = stringOpt(parsed.options.email) ?? process12.env.ODLA_USER_EMAIL?.trim();
+  const email = stringOpt(parsed.options.email) ?? process16.env.ODLA_USER_EMAIL?.trim();
   if (!email) {
     throw new Error(
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
@@ -2471,7 +2640,7 @@ async function appCommand(parsed, dependencies = {}) {
 
 // src/brand-command.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname5, resolve as resolve5 } from "path";
+import { dirname as dirname6, resolve as resolve5 } from "path";
 
 // src/brand-design-unpack.ts
 import { gunzipSync } from "zlib";
@@ -2586,7 +2755,7 @@ async function readBundle(source, deps) {
 async function writeAll(result, outDir) {
   for (const file of result.files) {
     const target = resolve5(outDir, file.path);
-    await mkdir(dirname5(target), { recursive: true });
+    await mkdir(dirname6(target), { recursive: true });
     await writeFile(target, file.bytes);
   }
 }
@@ -3152,7 +3321,7 @@ import {
   AppsError,
   createAppsClient
 } from "@odla-ai/apps";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/config-operation-error.ts
 var ConfigOperationCommandError = class extends Error {
@@ -3577,7 +3746,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: join6(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join7(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3632,7 +3801,7 @@ function record4(value2) {
 
 // src/config-reconcile-command.ts
 import { createAppsClient as createAppsClient2, studioAppSettingsPath } from "@odla-ai/apps";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 // src/config-reconcile.ts
 import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
@@ -3928,7 +4097,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: join7(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join8(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4061,26 +4230,26 @@ function quoteArg2(value2) {
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { join as join9, resolve as resolve6 } from "path";
+import { join as join10, resolve as resolve6 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
-  let stderr = "";
+  let stderr2 = "";
   child.stdout.on("data", (chunk) => stdout += chunk.toString());
-  child.stderr.on("data", (chunk) => stderr += chunk.toString());
+  child.stderr.on("data", (chunk) => stderr2 += chunk.toString());
   child.on("error", reject);
-  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr: stderr2 }));
   child.stdin.end(opts?.input ?? "");
 });
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join8(rootDir, name);
+    const path = join9(rootDir, name);
     if (existsSync7(path)) return path;
   }
   return null;
@@ -4231,21 +4400,21 @@ function wranglerWarnings(rootDir) {
   const blocks = [{ label: "", block: config }];
   const envs = config.env;
   if (envs && typeof envs === "object") {
-    for (const [name, block] of Object.entries(envs)) {
-      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+    for (const [name, block2] of Object.entries(envs)) {
+      if (block2 && typeof block2 === "object") blocks.push({ label: `env.${name}.`, block: block2 });
     }
   }
-  for (const { label, block } of blocks) {
-    const assets = block.assets;
+  for (const { label, block: block2 } of blocks) {
+    const assets = block2.assets;
     if (assets?.directory) {
       const dir = resolve6(rootDir, assets.directory);
       if (dir === resolve6(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync8(join9(dir, "node_modules"))) {
+      } else if (existsSync8(join10(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
-    const vars = block.vars;
+    const vars = block2.vars;
     if (vars && typeof vars === "object") {
       for (const [name, value2] of Object.entries(vars)) {
         if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value2 === "string" && looksSecret(value2)) {
@@ -4306,7 +4475,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync8(join9(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync8(join10(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4600,8 +4769,8 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname6, resolve as resolve7 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname7, resolve as resolve7 } from "path";
 import { appServiceDefinition as appServiceDefinition3, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
 function initProject(options) {
   const out = options.stdout ?? console;
@@ -4623,9 +4792,9 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  mkdirSync2(dirname6(configPath), { recursive: true });
-  mkdirSync2(resolve7(rootDir, "src/odla"), { recursive: true });
-  mkdirSync2(resolve7(rootDir, ".odla"), { recursive: true });
+  mkdirSync3(dirname7(configPath), { recursive: true });
+  mkdirSync3(resolve7(rootDir, "src/odla"), { recursive: true });
+  mkdirSync3(resolve7(rootDir, ".odla"), { recursive: true });
   writeFileSync2(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing(resolve7(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing(resolve7(rootDir, "src/odla/rules.mjs"), rulesTemplate());
@@ -4695,8 +4864,10 @@ ${calendar}
     // prod: "https://example.com",
   },
   local: {
-    tokenFile: ".odla/dev-token.json",
-    credentialsFile: ".odla/credentials.local.json",
+    // Credentials live in ~/.odla, per machine, so every worktree of this app
+    // shares one approval instead of asking for its own. Pinning tokenFile or
+    // credentialsFile here still works and still overrides that \u2014 it just puts
+    // this checkout back on its own island.
     devVarsFile: ".dev.vars",
   },
 };
@@ -4932,9 +5103,9 @@ function printReport(report5, out) {
 }
 
 // src/skill.ts
-import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname7, isAbsolute as isAbsolute3, join as join10, relative as relative2, resolve as resolve8, sep } from "path";
+import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync9, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname8, isAbsolute as isAbsolute3, join as join11, relative as relative2, resolve as resolve8, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -5034,7 +5205,7 @@ function installSkill(options = {}) {
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
   const root = resolve8(options.dir ?? process.cwd());
-  const home = resolve8(options.homeDir ?? homedir3());
+  const home = resolve8(options.homeDir ?? homedir4());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -5048,48 +5219,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join10(targetDir2, rel), readFileSync9(join10(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join11(targetDir2, rel), readFileSync9(join11(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join10(home, ".claude", "skills");
-    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join10(home, ".codex"), "skills");
+    const claudeRoot = join11(home, ".claude", "skills");
+    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join11(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : dirname7(dirname7(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : dirname8(dirname8(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join10(root, ".agents", "skills");
+    const sharedRoot = join11(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join10(root, ".claude", "skills");
+    const claudeRoot = join11(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = readFileSync9(join10(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join10(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
+        const canonical2 = readFileSync9(join11(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join11(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join10(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join11(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join10(root, "AGENTS.md");
+      const agentsFile = join11(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join10(root, ".github", "copilot-instructions.md");
+      const copilotFile = join11(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join10(root, "GEMINI.md");
+      const geminiFile = join11(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -5125,7 +5296,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!existsSync10(file.target) || readFileSync9(file.target, "utf8") !== file.content) {
-      mkdirSync3(dirname7(file.target), { recursive: true });
+      mkdirSync4(dirname8(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
   }
@@ -5164,10 +5335,10 @@ function normalizeHarnesses(values, global) {
   }
   return expanded;
 }
-function managedFileContent(path, block, force, boundary) {
+function managedFileContent(path, block2, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!existsSync10(path)) return `${block}
+  if (!existsSync10(path)) return `${block2}
 `;
   const current = readFileSync9(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
@@ -5179,15 +5350,15 @@ function managedFileContent(path, block, force, boundary) {
   }
   if (startAt === -1) {
     const separator = current.length === 0 || current.endsWith("\n\n") ? "" : current.endsWith("\n") ? "\n" : "\n\n";
-    return `${current}${separator}${block}
+    return `${current}${separator}${block2}
 `;
   }
   const afterEnd = endAt + end.length;
   const existing = current.slice(startAt, afterEnd);
-  if (existing !== block && !force) {
+  if (existing !== block2 && !force) {
     throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);
   }
-  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
+  return `${current.slice(0, startAt)}${block2}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
   const rel = relative2(boundary, target);
@@ -5196,7 +5367,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep).filter(Boolean)) {
-    current = join10(current, part);
+    current = join11(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -5213,7 +5384,7 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join10(current, entry.name);
+      const path = join11(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative2(dir, path));
     }
@@ -5581,7 +5752,7 @@ var HARNESS_PROTOCOL_VERSION = 1;
 import { execFile, spawn as spawn3 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
-import { delimiter, join as join11 } from "path";
+import { delimiter, join as join12 } from "path";
 import { getgid, getuid } from "process";
 import { mkdir as mkdir2, mkdtemp, realpath, rm, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir } from "os";
@@ -5599,7 +5770,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
     try {
-      await access(join11(directory, engine), constants.X_OK);
+      await access(join12(directory, engine), constants.X_OK);
       return true;
     } catch {
     }
@@ -5678,7 +5849,7 @@ function allowedWorkspacePath(relativePath) {
 async function gitOutput(cwd, args, maxBytes) {
   const child = spawn22("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -5686,20 +5857,20 @@ async function gitOutput(cwd, args, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
     child.once("exit", accept);
   });
   if (bytes > maxBytes) throw new Error(`git output exceeds ${maxBytes} bytes`);
-  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   return Buffer.concat(stdout);
 }
 async function gitBlobs(cwd, entries, maxBytes) {
   const child = spawn22("git", ["cat-file", "--batch"], { cwd, stdio: ["pipe", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -5707,7 +5878,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   child.stdin.end(`${entries.map((entry) => entry.hash).join("\n")}
 `);
@@ -5716,7 +5887,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
     child.once("exit", accept);
   });
   if (bytes > maxBytes + entries.length * 100) throw new Error(`Git tree exceeds ${maxBytes} bytes`);
-  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   const output = Buffer.concat(stdout);
   const blobs = [];
   let offset = 0;
@@ -5813,7 +5984,7 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     shell: false
   });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let outputBytes = 0;
   child.stdout.on("data", (chunk) => {
     outputBytes += chunk.byteLength;
@@ -5821,14 +5992,14 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
     child.once("exit", accept);
   });
   if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
-  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
   if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
   const root = resolve22(sourceDir);
@@ -5873,7 +6044,7 @@ async function captureGitDiff(root, maxBytes) {
     "workspace"
   ], { cwd: root, stdio: ["ignore", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -5881,7 +6052,7 @@ async function captureGitDiff(root, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
@@ -5889,7 +6060,7 @@ async function captureGitDiff(root, maxBytes) {
   });
   if (bytes > maxBytes) throw new Error(`patch exceeds ${maxBytes} bytes`);
   if (code !== 0 && code !== 1) {
-    throw new Error(`git diff failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+    throw new Error(`git diff failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   }
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
@@ -6297,10 +6468,10 @@ import { randomUUID } from "crypto";
 import { createHash as createHash22, randomUUID as randomUUID2 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat22 } from "fs/promises";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname9, join as join23, resolve as resolve32, sep as sep23 } from "path";
+import { dirname as dirname10, join as join23, resolve as resolve32, sep as sep23 } from "path";
 import {
   keepRecentExchanges,
   runAgent
@@ -6696,11 +6867,11 @@ function rollup(graph, kind, options = {}) {
 }
 
 // ../graph/dist/code/index.js
-function dirname8(path) {
+function dirname9(path) {
   const at = path.lastIndexOf("/");
   return at <= 0 ? "." : path.slice(0, at);
 }
-function join12(base, specifier) {
+function join13(base, specifier) {
   const parts = [];
   const segments = `${base === "." ? "" : `${base}/`}${specifier}`.split("/");
   for (const segment of segments) {
@@ -6724,7 +6895,7 @@ var BARE_IMPORT = /^\s*import\s*["']([^"']+)["']/gm;
 var isSourcePath = (path) => SOURCE.test(path);
 function resolveImport(fromPath, specifier, known) {
   if (!specifier.startsWith(".")) return null;
-  const base = join12(dirname8(fromPath), specifier);
+  const base = join13(dirname9(fromPath), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -7255,13 +7426,13 @@ function gitApply(cwd, patch2, check) {
       stdio: ["pipe", "ignore", "pipe"],
       env: { PATH: process.env.PATH ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" }
     });
-    let stderr = "";
+    let stderr2 = "";
     child.stderr.setEncoding("utf8");
     child.stderr.on("data", (text3) => {
-      if (stderr.length < 4e3) stderr += text3.slice(0, 4e3);
+      if (stderr2.length < 4e3) stderr2 += text3.slice(0, 4e3);
     });
     child.once("error", reject);
-    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr.trim().slice(0, 500)))));
+    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr2.trim().slice(0, 500)))));
     child.stdin.end(patch2);
   });
 }
@@ -7374,7 +7545,7 @@ function execute(engine, args, name, recipe2, signal) {
     const started = Date.now();
     const child = spawn23(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
     const stdout = [];
-    const stderr = [];
+    const stderr2 = [];
     let bytes = 0;
     let outputLimitExceeded = false;
     let timedOut = false;
@@ -7395,7 +7566,7 @@ function execute(engine, args, name, recipe2, signal) {
       else target.push(chunk);
     };
     child.stdout.on("data", collect(stdout));
-    child.stderr.on("data", collect(stderr));
+    child.stderr.on("data", collect(stderr2));
     const abort = () => stop("abort");
     signal?.addEventListener("abort", abort, { once: true });
     if (signal?.aborted) abort();
@@ -7411,7 +7582,7 @@ function execute(engine, args, name, recipe2, signal) {
       accept({
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdout).toString("utf8"),
-        stderr: Buffer.concat(stderr).toString("utf8"),
+        stderr: Buffer.concat(stderr2).toString("utf8"),
         durationMs: Date.now() - started,
         outputLimitExceeded,
         timedOut
@@ -7527,7 +7698,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = join13(workspaceDir, artifact.path);
+      const path = join14(workspaceDir, artifact.path);
       const info = await lstat22(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
@@ -7563,11 +7734,11 @@ function checkedResult(result, maximumOutputBytes) {
 }
 function boundedLogs(result, maximum) {
   const stdout = Buffer.from(result.stdout);
-  const stderr = Buffer.from(result.stderr);
+  const stderr2 = Buffer.from(result.stderr);
   const first = stdout.subarray(0, maximum);
   return {
     stdout: first.toString("utf8"),
-    stderr: stderr.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
+    stderr: stderr2.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
   };
 }
 function digestPolicy(policy) {
@@ -7813,7 +7984,7 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
       if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
       const target = resolve32(sourceDir, file.path);
       if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code source path escapes its root");
-      await mkdir3(dirname9(target), { recursive: true });
+      await mkdir3(dirname10(target), { recursive: true });
       await writeFile3(target, file.content, { flag: "wx", mode: 420 });
     }
     for (const reference of snapshot.references ?? []) {
@@ -7828,7 +7999,7 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
         if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
         const target = resolve32(sourceDir, path);
         if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
-        await mkdir3(dirname9(target), { recursive: true });
+        await mkdir3(dirname10(target), { recursive: true });
         await writeFile3(target, file.content, { flag: "wx", mode: 292 });
       }
     }
@@ -7855,7 +8026,7 @@ async function attachCodeRuntimeReferences(workspace, references) {
       for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
         const target = resolve32(root, path);
         if (!target.startsWith(`${resolve32(root)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
-        await mkdir3(dirname9(target), { recursive: true });
+        await mkdir3(dirname10(target), { recursive: true });
         await writeFile3(target, file.content, { flag: "wx", mode: 292 });
       }
     }
@@ -9677,7 +9848,8 @@ async function codeConnect(options) {
   );
   try {
     const descriptor2 = localSource.descriptor;
-    const approval = await (options.getToken ?? getScopedPlatformToken)({
+    const device = options.getToken ? null : readDeviceCredential(platform);
+    const authorization = device ? (await mintDeviceSession(platform, device, doFetch)).token : await (options.getToken ?? getScopedPlatformToken)({
       platform,
       scope: "app:code:host:connect",
       email: options.email,
@@ -9691,7 +9863,7 @@ async function codeConnect(options) {
     const target = appId ? { appId } : { repository };
     const response2 = await doFetch(`${platform}/registry/code/hosts/connect`, {
       method: "POST",
-      headers: { authorization: `Bearer ${approval}`, "content-type": "application/json" },
+      headers: { authorization: `Bearer ${authorization}`, "content-type": "application/json" },
       body: JSON.stringify({ ...target, env: appEnv, name: hostName, platform: hostPlatform, slots }),
       redirect: "error",
       signal: options.signal
@@ -10072,13 +10244,13 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-import process13 from "process";
+import process17 from "process";
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(process13.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(process17.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -10272,6 +10444,27 @@ async function credentialCommand(parsed, deps = {}) {
 }
 
 // src/help-usage.ts
+var AUTH_SECTION = `
+Enrol this machine once, then stop asking:
+  npx odla-ai device enroll --all-apps --capability all --no-open --wait 600
+      One browser approval. Afterwards every worktree on this machine mints its
+      own short-lived credentials with nobody's attention, for every app you
+      own \u2014 including apps you create later. The window rolls forward each time
+      you use it, so continuous work never interrupts anyone; only a real gap
+      does. Give the human the printed /studio?code= URL, keep the process
+      alive, and wait on it.
+
+  npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600
+      The same thing across all of odla, for weeks. Needs a platform
+      administrator's approval \u2014 an app owner's cannot carry platform scopes.
+
+  npx odla-ai whoami        what this machine holds and when it lapses
+  npx odla-ai device list   every machine you have enrolled
+
+Enrollment is the only human decision here. Revoking a machine, purging an app,
+transferring ownership, and rotating credentials still need a signed-in human in
+Studio, and no machine credential can do them however wide its approval was.
+`;
 var USAGE_SECTION = `
 Start here:
   odla-ai runbook ask "<question>"   The current procedure, from odla's own
@@ -10310,7 +10503,7 @@ Usage:
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm project list [--app <product-id>] [--status <s>] [--json]
   odla-ai pm project add --app <product-id> --name <name> [--description <text>] [--json]
-  odla-ai pm project use <project-id> [--json]                         [saved locally in this worktree]
+  odla-ai pm project use <project-id> [--json]                         [saved for this app, on this machine]
   odla-ai pm goal list [--app <id>] [--project <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -10402,7 +10595,8 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device enroll [--all-apps|--app <id>[,<id>...]] [--capability all|<c>[,<c>...]] [--platform-wide]
+    [--name <label>] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--wait <seconds>] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
@@ -10416,8 +10610,11 @@ Usage:
 
 // src/help.ts
 function printHelp(output = console) {
-  output.log(`odla-ai
-${USAGE_SECTION}
+  output.log(helpText());
+}
+function helpText() {
+  return `odla-ai
+${AUTH_SECTION}${USAGE_SECTION}
 Commands:
   auth         Start a fresh, exact-project agent authorization for human review.
                The email is the signed-in odla account, never git or GitHub
@@ -10490,8 +10687,9 @@ Commands:
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
   pm           Project management (via @odla-ai/pm): Products contain Projects;
                projects contain goals, kanban tasks, decisions, and bugs. Use
-               "pm project list|add|use" to select worktree-local context, or
-               pass --app/--project explicitly. Same device-grant auth as "app".
+               "pm project list|add|use" selects a project for this app on this
+               machine \u2014 every worktree shares it \u2014 or pass --app/--project
+               explicitly. Same device-grant auth as "app".
                Status changes and comments post to each item's @odla-ai/chat
                discussion thread.
                NOTE: "--column ready" is OWNER-ONLY. Creating a task in Ready
@@ -10520,9 +10718,20 @@ Commands:
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
   device       Enrol THIS machine once, then stop asking. A human approves the
-               enrollment in the browser; from then on this terminal mints its
-               own short-lived credentials for the named projects with nobody's
-               attention, until the device expires or is revoked.
+               enrollment in the browser; from then on EVERY worktree on this
+               machine mints its own short-lived credentials with nobody's
+               attention, until the device is revoked or goes unused.
+               "--all-apps" covers every app you own, now and later, so creating
+               an app costs no new approval. "--capability all" takes everything
+               that approval is allowed to carry, so a capability you did not
+               think to name is not a 403 next week. "--platform-wide" is the
+               administrator's version, across all of odla.
+               The expiry is a GAP, not a clock: each use rolls it forward, so
+               only going quiet brings a human back into the loop \u2014 which is
+               where anything that changed can be explained.
+               "device list" shows what each machine holds and when it lapses;
+               revoking one takes down every credential it ever minted, and is
+               deliberately a signed-in human's decision in Studio.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
@@ -10592,10 +10801,12 @@ Safety:
   release. A confirmed stale client stops with a safe npx rerun command; a
   workspace-linked client also identifies the worktree that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
-  odla.config.mjs may select the app explicitly but is not required. Code host
-  approval and credential hashes live in odla-ai/db. The host
-  credential is never written under .odla/; it exists only in the foreground
-  "code connect" process and is rotated by the next approved connection.
+  odla.config.mjs may select the app explicitly but is not required. With an
+  enrolled code.session device, the Studio repository selection authorizes the
+  host's first connection and reconnects without another human approval. Without
+  an enrolled device, "code connect" falls back to the reviewed handshake. Host
+  credential hashes live in odla-ai/db; the credential itself is never written
+  under .odla/, exists only in the foreground process, and rotates on reconnect.
   "code repository bind" takes owner/name and resolves the two GitHub integers the
   bind route wants across every installation you have, refusing an ambiguous match
   rather than choosing one \u2014 the same repository name under two organizations is
@@ -10616,7 +10827,46 @@ Safety:
   Run security plan first to inspect the admin-selected providers, models,
   per-route bounds, credential readiness, retention, no-execution boundary,
   and digest that binds consent to that exact plan.
-`);
+`;
+}
+
+// src/help-command.ts
+function printCommandHelp(command, output = console) {
+  const lines = helpText().split("\n");
+  const usage = allBlocks(lines, new RegExp(`^  odla-ai ${escapeRe(command)}(\\s|$)`));
+  const prose = block(lines, (line2) => new RegExp(`^  ${escapeRe(command)}\\s\\s+\\S`).test(line2));
+  if (usage.length === 0 && prose.length === 0) {
+    output.log(`odla-ai: no command "${command}". Run "odla-ai help" for all of them.`);
+    return;
+  }
+  output.log([
+    ...prose.length ? [prose.join("\n"), ""] : [],
+    ...usage.length ? ["Usage:", ...usage, ""] : [],
+    AUTH_SECTION.trimEnd()
+  ].join("\n"));
+}
+function allBlocks(lines, pattern) {
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!pattern.test(lines[i])) continue;
+    out.push(...block(lines.slice(i), (line2) => line2 === lines[i]));
+  }
+  return out;
+}
+function block(lines, starts) {
+  const first = lines.findIndex(starts);
+  if (first === -1) return [];
+  const indent = lines[first].length - lines[first].trimStart().length;
+  const out = [lines[first]];
+  for (const line2 of lines.slice(first + 1)) {
+    if (!line2.trim()) break;
+    if (line2.length - line2.trimStart().length <= indent) break;
+    out.push(line2);
+  }
+  return out;
+}
+function escapeRe(value2) {
+  return value2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 // src/discuss-principals.ts
@@ -11773,14 +12023,36 @@ async function pmWatch(ctx, parsed) {
 }
 
 // src/pm-project-context.ts
+import { existsSync as existsSync12, rmSync as rmSync5 } from "fs";
 import { resolve as resolve12 } from "path";
-var pmProjectContextFile = (rootDir) => resolve12(rootDir, ".odla", "pm-project.local.json");
+var pmProjectContextFile = () => pmContextFile();
 function readPmProjectContext(rootDir) {
-  const value2 = readJsonFile(pmProjectContextFile(rootDir));
-  return value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" ? value2 : null;
+  adoptLegacySelection(rootDir);
+  const entries = Object.values(readSelections()).filter(isSelection);
+  return entries.sort((a, b) => b.selectedAt.localeCompare(a.selectedAt))[0] ?? null;
 }
 function writePmProjectContext(rootDir, value2) {
-  writePrivateJson(pmProjectContextFile(rootDir), { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  adoptLegacySelection(rootDir);
+  writePrivateJson(pmProjectContextFile(), {
+    ...readSelections(),
+    [value2.appId]: { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() }
+  });
+}
+function adoptLegacySelection(rootDir) {
+  const legacy = resolve12(rootDir, ".odla", "pm-project.local.json");
+  if (!existsSync12(legacy)) return;
+  const previous = readJsonFile(legacy);
+  rmSync5(legacy, { force: true });
+  if (!isSelection(previous)) return;
+  const selections = readSelections();
+  if (selections[previous.appId]) return;
+  writePrivateJson(pmProjectContextFile(), { ...selections, [previous.appId]: previous });
+}
+function readSelections() {
+  return readJsonFile(pmProjectContextFile()) ?? {};
+}
+function isSelection(value2) {
+  return !!value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" && typeof value2.selectedAt === "string";
 }
 
 // src/pm-project-actions.ts
@@ -12805,7 +13077,7 @@ function percent(value2) {
 // src/provision.ts
 import { AppsError as AppsError2, createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor6 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
-import process14 from "process";
+import process18 from "process";
 
 // src/integration-provision.ts
 import { uuidv7 } from "@odla-ai/db";
@@ -13243,7 +13515,7 @@ async function provision(options) {
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process14.env[cfg.ai.keyEnv];
+      const key = process18.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret2({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -13285,7 +13557,7 @@ async function provision(options) {
 
 // src/record.ts
 import { appendFileSync } from "fs";
-import process15 from "process";
+import process19 from "process";
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -13467,7 +13739,7 @@ function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = process15.env.ODLA_CLI_RECORD;
+  const file = process19.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -13504,6 +13776,14 @@ function renderAdvisories(out, advisories, env = process.env) {
   }
 }
 
+// src/device-command.ts
+import {
+  ADMIN_DEVICE_SCOPES,
+  ALL_OWNED_APPS,
+  OPTIONAL_AGENT_PROJECT_CAPABILITIES,
+  OWNER_DEVICE_SCOPES
+} from "@odla-ai/db";
+
 // src/device-ttl.ts
 var OWNER_DEVICE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var DAY_MS = 24 * 60 * 60 * 1e3;
@@ -13523,10 +13803,26 @@ function parseDeviceTtl(raw) {
 }
 
 // src/device-command.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname10 } from "path";
-import process16 from "process";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname11 } from "path";
+import process20 from "process";
 async function deviceCommand(parsed, deps) {
+  assertArgs(parsed, [
+    "app",
+    "all-apps",
+    "platform-wide",
+    "name",
+    "capability",
+    "device-ttl",
+    "email",
+    "open",
+    "json",
+    "config",
+    "token",
+    "context",
+    "platform",
+    "wait"
+  ], 3);
   const action2 = parsed.positionals[1] ?? "";
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
@@ -13539,10 +13835,12 @@ async function deviceCommand(parsed, deps) {
 }
 async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
-  const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
-  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
+  const platformWide = parsed.options["platform-wide"] === true;
+  const apps = platformWide || parsed.options["all-apps"] === true ? [ALL_OWNED_APPS] : (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
+  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026], or --all-apps");
   const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
-  const extended = deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const extended = platformWide || deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const { capabilities, scopes } = requestedEnvelope(parsed, platformWide);
   const token = await scopedToken2(
     parsed,
     deps,
@@ -13557,9 +13855,10 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
     body: JSON.stringify({
       name,
-      platform: process16.platform,
+      platform: process20.platform,
       appIds: apps,
-      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {},
+      ...capabilities ? { capabilities } : {},
+      ...scopes ? { scopes } : {},
       ...deviceTtlMs === void 0 ? {} : { deviceTtlMs }
     })
   });
@@ -13568,20 +13867,53 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     throw new Error(`device enroll failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
   }
   const path = deviceCredentialPath();
-  mkdirSync4(dirname10(path), { recursive: true });
+  mkdirSync5(dirname11(path), { recursive: true });
   writeFileSync4(path, JSON.stringify({
     token: body.token,
     platform: cfg.platformUrl.replace(/\/$/, ""),
     deviceId: body.device.deviceId,
     name
   }, null, 2));
-  chmodSync2(path, 384);
-  out.error(`device: enrolled "${name}" for ${body.device.appIds.join(", ")}; credential written to ${path}`);
-  out.error("device: this terminal will mint its own credentials from now on \u2014 no further approvals.");
+  chmodSync3(path, 384);
+  rememberMachineIdentity(cfg.platformUrl.replace(/\/$/, ""), stringOpt(parsed.options.email));
+  const reach = body.device.appIds.includes(ALL_OWNED_APPS) ? "every app you own, now and later" : body.device.appIds.join(", ");
+  out.error(`device: enrolled "${name}" for ${reach}; credential written to ${path}`);
+  out.error(
+    "device: every worktree on this machine mints its own credentials from now on \u2014 no further approvals,"
+  );
+  out.error(
+    `device: and the clock resets each time you use it. Going quiet for ${describeWindow(body.device.expiresAt)} is what ends it.`
+  );
   if (json) {
-    out.log(JSON.stringify({ deviceId: body.device.deviceId, name, appIds: body.device.appIds, expiresAt: body.device.expiresAt }, null, 2));
+    out.log(JSON.stringify({
+      deviceId: body.device.deviceId,
+      name,
+      appIds: body.device.appIds,
+      capabilities: body.device.capabilities ?? [],
+      scopes: body.device.scopes ?? [],
+      expiresAt: body.device.expiresAt,
+      hardExpiresAt: body.device.hardExpiresAt ?? null
+    }, null, 2));
   }
 }
+function requestedEnvelope(parsed, platformWide) {
+  const raw = stringOpt(parsed.options.capability);
+  const everything = platformWide || raw?.trim().toLowerCase() === "all";
+  if (everything) {
+    return {
+      capabilities: [...OPTIONAL_AGENT_PROJECT_CAPABILITIES],
+      scopes: platformWide ? [...ADMIN_DEVICE_SCOPES] : [...OWNER_DEVICE_SCOPES]
+    };
+  }
+  const named = raw?.split(",").map((c) => c.trim()).filter(Boolean);
+  return named?.length ? { capabilities: named } : {};
+}
+function describeWindow(expiresAt, now = Date.now()) {
+  const days = Math.max(1, Math.round((expiresAt - now) / (24 * 60 * 60 * 1e3)));
+  if (days >= 365) return `${Math.round(days / 365)} year${days >= 730 ? "s" : ""}`;
+  if (days % 7 === 0) return `${days / 7} week${days > 7 ? "s" : ""}`;
+  return `${days} day${days === 1 ? "" : "s"}`;
+}
 async function list2(parsed, deps, cfg, doFetch, out, json) {
   const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device list)");
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
@@ -13595,12 +13927,17 @@ async function list2(parsed, deps, cfg, doFetch, out, json) {
   if (body.devices.length === 0) return out.log("no enrolled devices");
   for (const device of body.devices) {
     const state2 = device.revokedAt ? "revoked" : device.expiresAt <= Date.now() ? "expired" : "active";
-    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${device.appIds.join(", ")}]`);
+    const reach = device.appIds.includes("*") ? "every app you own" : device.appIds.join(", ");
+    const gap = state2 === "active" ? `  idle ${describeWindow(device.expiresAt)} left` : "";
+    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${reach}]${gap}`);
   }
 }
 async function revoke(parsed, deps, cfg, doFetch, out, json) {
   const deviceId = parsed.positionals[2];
   if (!deviceId) throw new Error("device revoke needs the device id from `odla-ai device list`");
+  out.error(
+    `device: revoking is a signed-in human's decision; if this is refused, open ${cfg.platformUrl}/studio and revoke it there.`
+  );
   const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device revoke)");
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices/${encodeURIComponent(deviceId)}/revoke`, {
     method: "POST",
@@ -13619,7 +13956,7 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
     // A device is granted the apps named in ONE approval, so --app is a list here.
     allowAppList: true
   });
-  const scopedTokenFile = credentials.scopedTokenFile;
+  const scopedTokenFile2 = credentials.scopedTokenFile;
   return getScopedPlatformToken({
     platform: cfg.platformUrl,
     scope,
@@ -13630,12 +13967,12 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     openApprovalUrl: deps.openUrl,
     rootDir: cfg.rootDir,
-    tokenFile: scopedTokenFile,
+    tokenFile: scopedTokenFile2,
     ...stringOpt(parsed.options.token) ? { token: stringOpt(parsed.options.token) } : {}
   });
 }
 function defaultDeviceName() {
-  return `${process16.env.HOSTNAME ?? process16.env.HOST ?? "machine"}-${process16.platform}`;
+  return `${process20.env.HOSTNAME ?? process20.env.HOST ?? "machine"}-${process20.platform}`;
 }
 
 // src/runbook-actions.ts
@@ -13779,7 +14116,7 @@ async function runbookRemove(ctx, slug) {
 
 // src/runbook-import.ts
 import { readFileSync as readFileSync11, readdirSync as readdirSync2, statSync } from "fs";
-import { basename as basename2, join as join14 } from "path";
+import { basename as basename2, join as join15 } from "path";
 function parseRunbook(text3, slug) {
   let rest = text3;
   const meta = {};
@@ -13809,7 +14146,7 @@ function readRunbookDir(dir) {
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = basename2(file, ".md");
-    const parsed = parseRunbook(readFileSync11(join14(dir, file), "utf8"), slug);
+    const parsed = parseRunbook(readFileSync11(join15(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -13877,8 +14214,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join16 } from "path";
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -14047,8 +14384,8 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = join15(root, workspace, "package.json");
-    if (!existsSync12(manifest)) return void 0;
+    const manifest = join16(root, workspace, "package.json");
+    if (!existsSync13(manifest)) return void 0;
     try {
       const name = JSON.parse(readFileSync12(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
@@ -14117,7 +14454,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join15(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join16(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -14244,12 +14581,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join16 } from "path";
-import process17 from "process";
+import { join as join17 } from "path";
+import process21 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = process17.env) {
+function resolveEditor(env = process21.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -14263,8 +14600,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? process17.env;
-  const interactive = deps.interactive ?? (() => Boolean(process17.stdin.isTTY));
+  const env = deps.env ?? process21.env;
+  const interactive = deps.interactive ?? (() => Boolean(process21.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -14272,8 +14609,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = mkdtempSync(join16(tmpdir4(), "odla-runbook-"));
-  const file = join16(dir, `${slug}.md`);
+  const dir = mkdtempSync(join17(tmpdir4(), "odla-runbook-"));
+  const file = join17(dir, `${slug}.md`);
   try {
     writeFileSync5(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -14281,7 +14618,7 @@ function editText(initial, slug, deps = {}) {
     const edited = readFileSync13(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    rmSync3(dir, { recursive: true, force: true });
+    rmSync6(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -15193,8 +15530,10 @@ async function dispatchCli(argv, dependencies) {
     return;
   }
   if (command === "help" || command === "--help" || command === "-h") {
-    assertArgs(parsed, ["help"], 1);
-    printHelp(runtime.stdout);
+    assertArgs(parsed, ["help"], 2);
+    const topic = parsed.positionals[1];
+    if (topic) printCommandHelp(topic, runtime.stdout);
+    else printHelp(runtime.stdout);
     return;
   }
   if (command === "whoami") {
@@ -15408,4 +15747,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-HETCZVFB.js.map
+//# sourceMappingURL=chunk-PJ3RATDD.js.map