@odla-ai/cli 0.38.2 → 0.39.0

package/dist/index.cjs

@@ -97,12 +97,12 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/admin-ai.ts
-var import_node_process8 = __toESM(require("process"), 1);
+var import_node_process12 = __toESM(require("process"), 1);
 
 // src/token.ts
 var import_db = require("@odla-ai/db");
 var import_node_crypto = require("crypto");
-var import_node_process5 = __toESM(require("process"), 1);
+var import_node_process9 = __toESM(require("process"), 1);
 
 // src/handshake-approval.ts
 var import_node_process2 = __toESM(require("process"), 1);
@@ -237,30 +237,13 @@ function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default
 }
 
 // src/cached-credential.ts
-var import_node_fs2 = require("fs");
-var noted = null;
-function noteCachedCredential(tokenFile) {
-  noted = tokenFile;
-}
-function isCredentialRejection(error) {
-  const message2 = error instanceof Error ? error.message : String(error ?? "");
-  return /\((401|403)\)\s*$/.test(message2.trim());
-}
-function explainRejectedCredential(error) {
-  const tokenFile = noted;
-  if (!tokenFile || !isCredentialRejection(error)) return null;
-  noted = null;
-  (0, import_node_fs2.rmSync)(tokenFile, { force: true });
-  return [
-    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
-    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
-    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
-    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
-  ].join("\n");
-}
+var import_node_fs5 = require("fs");
+
+// src/auth-guidance.ts
+var import_node_process6 = __toESM(require("process"), 1);
 
 // src/device-session.ts
-var import_node_fs3 = require("fs");
+var import_node_fs2 = require("fs");
 var import_node_os = require("os");
 var import_node_path2 = require("path");
 var import_node_process4 = __toESM(require("process"), 1);
@@ -269,9 +252,9 @@ function deviceCredentialPath(env = import_node_process4.default.env) {
 }
 function readDeviceCredential(platform, env = import_node_process4.default.env) {
   const path = deviceCredentialPath(env);
-  if (!(0, import_node_fs3.existsSync)(path)) return null;
+  if (!(0, import_node_fs2.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
     if (typeof parsed.token !== "string" || !parsed.token.startsWith("odla_device_")) return null;
     if (parsed.platform !== platform) return null;
     return { ...parsed, token: parsed.token, platform: parsed.platform };
@@ -293,12 +276,71 @@ async function mintDeviceSession(platformUrl, credential2, doFetch) {
       `device session failed: ${detail} (${response2.status})` + (revocable ? " \u2014 if this machine's enrollment was revoked or has expired, enroll it again in Studio" : "")
     );
   }
-  return { token: body.token, expiresAt: body.expiresAt ?? Date.now() };
+  return {
+    token: body.token,
+    expiresAt: body.expiresAt ?? Date.now(),
+    // Absent from a registry that predates rolling expiry and scoped devices.
+    // Left undefined rather than defaulted, so a caller can tell "the platform
+    // did not say" from "the platform said none".
+    ...typeof body.deviceExpiresAt === "number" ? { deviceExpiresAt: body.deviceExpiresAt } : {},
+    ...Array.isArray(body.appIds) ? { appIds: body.appIds } : {},
+    ...Array.isArray(body.capabilities) ? { capabilities: body.capabilities } : {},
+    ...Array.isArray(body.scopes) ? { scopes: body.scopes } : {}
+  };
+}
+
+// src/odla-home.ts
+var import_node_fs3 = require("fs");
+var import_node_os2 = require("os");
+var import_node_path3 = require("path");
+var import_node_process5 = __toESM(require("process"), 1);
+function odlaHome(env = import_node_process5.default.env) {
+  return env.ODLA_HOME ?? (0, import_node_path3.join)(env.HOME ?? (0, import_node_os2.homedir)(), ".odla");
+}
+function odlaHomePath(segments, env = import_node_process5.default.env) {
+  return (0, import_node_path3.join)(odlaHome(env), ...segments);
+}
+function identityFile(env) {
+  return odlaHomePath(["identity.json"], env);
+}
+function deviceSessionFile(env) {
+  return odlaHomePath(["session.json"], env);
+}
+function appTokenFile(appId, env) {
+  return odlaHomePath(["apps", safeSegment(appId), "dev-token.json"], env);
+}
+function appCredentialsFile(appId, env) {
+  return odlaHomePath(["apps", safeSegment(appId), "credentials.json"], env);
+}
+function scopedTokenFile(env) {
+  return odlaHomePath(["admin-token.local.json"], env);
+}
+function pmContextFile(env) {
+  return odlaHomePath(["pm-context.json"], env);
+}
+function adoptRepoLocalCache(legacyPath, machinePath, out) {
+  if (!(0, import_node_fs3.existsSync)(legacyPath) || legacyPath === machinePath) return false;
+  const superseded = (0, import_node_fs3.existsSync)(machinePath);
+  if (!superseded) {
+    (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(machinePath), { recursive: true });
+    (0, import_node_fs3.copyFileSync)(legacyPath, machinePath);
+    (0, import_node_fs3.chmodSync)(machinePath, 384);
+  }
+  (0, import_node_fs3.rmSync)(legacyPath, { force: true });
+  out?.error(
+    superseded ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
+  );
+  return true;
+}
+function safeSegment(value2) {
+  const clean4 = value2.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "");
+  if (!clean4) throw new Error(`"${value2}" is not a usable app id`);
+  return clean4;
 }
 
 // src/local.ts
 var import_node_fs4 = require("fs");
-var import_node_path3 = require("path");
+var import_node_path4 = require("path");
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
@@ -345,7 +387,7 @@ function mergeCredential(current, update) {
   return next;
 }
 function ensureGitignore(rootDir, localPaths = []) {
-  const path = (0, import_node_path3.resolve)(rootDir, ".gitignore");
+  const path = (0, import_node_path4.resolve)(rootDir, ".gitignore");
   const existing = (0, import_node_fs4.existsSync)(path) ? (0, import_node_fs4.readFileSync)(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
@@ -366,7 +408,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path3.resolve)((0, import_node_path3.dirname)(cfg.configPath), requested);
+  return (0, import_node_path4.resolve)((0, import_node_path4.dirname)(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -406,22 +448,110 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text3) {
-  (0, import_node_fs4.mkdirSync)((0, import_node_path3.dirname)(path), { recursive: true });
+  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
   (0, import_node_fs4.writeFileSync)(temporary, text3, { mode: 384 });
   (0, import_node_fs4.chmodSync)(temporary, 384);
   (0, import_node_fs4.renameSync)(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
-  const rel = (0, import_node_path3.relative)((0, import_node_path3.resolve)(rootDir), (0, import_node_path3.resolve)(path));
-  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path3.isAbsolute)(rel)) return null;
+  const rel = (0, import_node_path4.relative)((0, import_node_path4.resolve)(rootDir), (0, import_node_path4.resolve)(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path4.isAbsolute)(rel)) return null;
   return rel.replaceAll("\\", "/");
 }
 function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path3.relative)(rootDir, path);
+  const rel = (0, import_node_path4.relative)(rootDir, path);
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
+// src/auth-guidance.ts
+var ENROL_EVERYTHING = "npx odla-ai device enroll --all-apps --capability all --no-open --wait 600";
+var ENROL_PLATFORM_WIDE = "npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600";
+function machineAuthState(audience, env = import_node_process6.default.env) {
+  const device = readDeviceCredential(audience, env);
+  if (!device) return { enrolled: false };
+  const session = readJsonFile(deviceSessionFile(env));
+  const current = session?.platform === audience && session.deviceId === device.deviceId ? session : void 0;
+  return {
+    enrolled: true,
+    ...device.name ? { deviceName: device.name } : {},
+    ...current?.appIds ? { appIds: current.appIds } : {},
+    ...current?.capabilities ? { capabilities: current.capabilities } : {},
+    ...current?.scopes ? { scopes: current.scopes } : {},
+    ...current?.deviceExpiresAt ? { lapsesAt: current.deviceExpiresAt } : {}
+  };
+}
+function scopeInterruptionNotice(scope, state2) {
+  const platformScope = scope.startsWith("platform:");
+  const reason = !state2.enrolled ? "this machine is not enrolled, so every privileged command needs its own browser approval" : `this machine is enrolled but its approval did not include "${scope}"`;
+  return [
+    `odla: ${reason}.`,
+    `   Approve this one now, then end the interruptions with:`,
+    `     ${platformScope ? ENROL_PLATFORM_WIDE : ENROL_EVERYTHING}`,
+    platformScope ? "   A platform scope needs an administrator's approval; an app owner's cannot carry it." : "   One approval, every app you own, and it rolls forward while you keep working."
+  ].join("\n");
+}
+function lapseNotice(state2, now = Date.now()) {
+  if (!state2.enrolled || !state2.lapsesAt) return null;
+  const days = Math.floor((state2.lapsesAt - now) / (24 * 60 * 60 * 1e3));
+  if (days < 0) return "this machine's enrollment has lapsed; the next command will ask for approval";
+  return `idle for ${days} more day${days === 1 ? "" : "s"} before this machine needs approving again (using it resets the clock)`;
+}
+
+// src/cached-credential.ts
+var noted = null;
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  (0, import_node_fs5.rmSync)(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this account: collecting a handshake retires the",
+    "   principal's other collected credentials, so a second machine supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`,
+    `   To stop needing one: ${ENROL_EVERYTHING}`
+  ].join("\n");
+}
+
+// src/device-session-cache.ts
+var import_node_process7 = __toESM(require("process"), 1);
+var SKEW_MS = 6e4;
+async function deviceSessionToken(platformUrl, audience, credential2, doFetch, env = import_node_process7.default.env) {
+  const path = deviceSessionFile(env);
+  const cached = readJsonFile(path);
+  if (cached?.token && cached.platform === audience && cached.deviceId === credential2.deviceId && (cached.expiresAt ?? 0) > Date.now() + SKEW_MS) return cached;
+  const minted = await mintDeviceSession(platformUrl, credential2, doFetch);
+  const session = {
+    ...minted,
+    platform: audience,
+    ...credential2.deviceId ? { deviceId: credential2.deviceId } : {}
+  };
+  writePrivateJson(path, session);
+  return session;
+}
+
+// src/machine-identity.ts
+var import_node_process8 = __toESM(require("process"), 1);
+function readMachineIdentity(audience, env = import_node_process8.default.env) {
+  const stored = readJsonFile(identityFile(env));
+  if (!stored || typeof stored.email !== "string" || !stored.email) return null;
+  return stored.platform === audience ? { platform: audience, email: stored.email } : null;
+}
+function rememberMachineIdentity(audience, email, env = import_node_process8.default.env) {
+  if (!email) return;
+  const existing = readMachineIdentity(audience, env);
+  if (existing?.email === email) return;
+  writePrivateJson(identityFile(env), { platform: audience, email });
+}
+
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   const audience = platformAudience(cfg.platformUrl);
@@ -430,19 +560,19 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const cached = readJsonFile(cfg.local.tokenFile);
   if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
-    if (import_node_process5.default.env.ODLA_DEV_TOKEN) {
-      const declared = import_node_process5.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (import_node_process9.default.env.ODLA_DEV_TOKEN) {
+      const declared = import_node_process9.default.env.ODLA_DEV_TOKEN_AUDIENCE;
       if (declared) {
         if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
       } else if (audience !== "https://odla.ai") {
         throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
       }
-      return import_node_process5.default.env.ODLA_DEV_TOKEN;
+      return import_node_process9.default.env.ODLA_DEV_TOKEN;
     }
     const device = readDeviceCredential(audience);
     if (device) {
-      const session = await mintDeviceSession(cfg.platformUrl, device, doFetch);
-      out.error(`auth: session minted by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
+      const session = await deviceSessionToken(cfg.platformUrl, audience, device, doFetch);
+      out.error(`auth: session held by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
       return session.token;
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
@@ -462,7 +592,10 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     doFetch,
     out,
     audience,
-    email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
+    email: handshakeEmail(
+      options.email,
+      (cached?.platform === audience ? cached.email : void 0) ?? readMachineIdentity(audience)?.email
+    ),
     pendingFile: handshakeFile(cfg),
     grantIntent
   };
@@ -479,6 +612,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     expiresAt
   });
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+  rememberMachineIdentity(audience, ctx.email);
   return token;
 }
 async function freshHandshake(ctx, waitMs) {
@@ -548,7 +682,7 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? import_node_process5.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? import_node_process9.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (/@users\.noreply\.github\.com$/i.test(email)) {
     throw new Error(
       `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
@@ -579,12 +713,12 @@ function platformAudience(value2) {
 }
 
 // src/secret-input.ts
-var import_node_process6 = __toESM(require("process"), 1);
+var import_node_process10 = __toESM(require("process"), 1);
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = import_node_process6.default.env[options.fromEnv];
+  if (options.fromEnv) value2 = import_node_process10.default.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -592,7 +726,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = import_node_process6.default.stdin) {
+async function readSecretStream(kind, stream = import_node_process10.default.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -602,9 +736,8 @@ async function readSecretStream(kind, stream = import_node_process6.default.stdi
 }
 
 // src/admin-ai-auth.ts
-var import_node_fs5 = require("fs");
-var import_node_path4 = require("path");
-var import_node_process7 = __toESM(require("process"), 1);
+var import_node_path5 = require("path");
+var import_node_process11 = __toESM(require("process"), 1);
 var import_db2 = require("@odla-ai/db");
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -612,7 +745,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = import_node_process7.default.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = import_node_process11.default.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -624,7 +757,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = import_node_process7.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = import_node_process11.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -651,15 +784,28 @@ var SCOPE_PURPOSE = {
 };
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? import_node_process7.default.cwd();
-  const tokenFile = options.tokenFile ?? (0, import_node_path4.join)(rootDir, ".odla/admin-token.local.json");
+  const rootDir = options.rootDir ?? import_node_process11.default.cwd();
+  const tokenFile = options.tokenFile ?? scopedTokenFile();
+  adoptRepoLocalCache((0, import_node_path5.join)(rootDir, ".odla/admin-token.local.json"), tokenFile, out);
+  const device = readDeviceCredential(audience);
+  if (device && options.cache !== false) {
+    const session = await deviceSessionToken(platform, audience, device, doFetch);
+    if (session.scopes?.includes(scope)) {
+      out.error(`auth: ${scope} held by this enrolled device`);
+      return session.token;
+    }
+  }
   const cache2 = options.cache === false ? null : readJsonFile(tokenFile);
   const cached = cache2?.platform === audience ? cache2.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.error(`auth: using cached ${scope} grant (${tokenFile})`);
     return cached.token;
   }
-  const email = handshakeEmail(options.email, cache2?.platform === audience ? cache2.email : void 0);
+  out.error(scopeInterruptionNotice(scope, machineAuthState(audience)));
+  const email = handshakeEmail(
+    options.email,
+    (cache2?.platform === audience ? cache2.email : void 0) ?? readMachineIdentity(audience)?.email
+  );
   const { token, expiresAt } = await (0, import_db2.requestToken)({
     endpoint: audience,
     email,
@@ -679,8 +825,8 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   if (options.cache !== false) {
     const tokens = cache2?.platform === audience ? { ...cache2.tokens ?? {} } : {};
     tokens[scope] = { token, expiresAt };
-    if ((0, import_node_fs5.existsSync)((0, import_node_path4.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
     writePrivateJson(tokenFile, { platform: audience, email, tokens });
+    rememberMachineIdentity(audience, email);
     out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   } else {
     out.error(`auth: ${scope} grant is in memory only; its credential record remains in odla-ai/db`);
@@ -856,7 +1002,7 @@ function isRecord2(value2) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? import_node_process8.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? import_node_process12.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -1172,12 +1318,12 @@ async function adminSpend(parsed, ctx) {
 
 // src/operator-context.ts
 var import_node_fs8 = require("fs");
-var import_node_path7 = require("path");
-var import_node_process10 = __toESM(require("process"), 1);
+var import_node_path8 = require("path");
+var import_node_process14 = __toESM(require("process"), 1);
 
 // src/config.ts
 var import_node_fs6 = require("fs");
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 var import_node_url = require("url");
 var import_apps = require("@odla-ai/apps");
 
@@ -1581,13 +1727,17 @@ var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
 var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+var stderr = { error: (message2) => {
+  process.stderr.write(`${message2}
+`);
+} };
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
-  const resolved = (0, import_node_path5.resolve)(configPath);
+  const resolved = (0, import_node_path6.resolve)(configPath);
   if (!(0, import_node_fs6.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = (0, import_node_path5.dirname)(resolved);
+  const rootDir = (0, import_node_path6.dirname)(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -1597,11 +1747,14 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   validateCalendarConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   validateMonitoringConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
-    tokenFile: (0, import_node_path5.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: (0, import_node_path5.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: (0, import_node_path5.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    tokenFile: raw.local?.tokenFile ? (0, import_node_path6.resolve)(rootDir, raw.local.tokenFile) : appTokenFile(raw.app.id),
+    credentialsFile: raw.local?.credentialsFile ? (0, import_node_path6.resolve)(rootDir, raw.local.credentialsFile) : appCredentialsFile(raw.app.id),
+    devVarsFile: (0, import_node_path6.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
+  adoptRepoLocalCache((0, import_node_path6.resolve)(rootDir, ".odla/dev-token.json"), local.tokenFile, stderr);
+  adoptRepoLocalCache((0, import_node_path6.resolve)(rootDir, ".odla/credentials.local.json"), local.credentialsFile, stderr);
+  (0, import_node_fs6.rmSync)((0, import_node_path6.resolve)(rootDir, ".odla/handshake.local.json"), { force: true });
   return {
     ...raw,
     configPath: resolved,
@@ -1616,7 +1769,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
 async function resolveDataExport(cfg, value2, names) {
   if (value2 === void 0 || value2 === null || value2 === false) return void 0;
   if (typeof value2 !== "string") return value2;
-  const target = (0, import_node_path5.isAbsolute)(value2) ? value2 : (0, import_node_path5.resolve)(cfg.rootDir, value2);
+  const target = (0, import_node_path6.isAbsolute)(value2) ? value2 : (0, import_node_path6.resolve)(cfg.rootDir, value2);
   if (target.endsWith(".json")) {
     return JSON.parse((0, import_node_fs6.readFileSync)(target, "utf8"));
   }
@@ -1710,17 +1863,17 @@ function unique3(values) {
 
 // src/operator-profiles.ts
 var import_node_fs7 = require("fs");
-var import_node_os2 = require("os");
-var import_node_path6 = require("path");
-var import_node_process9 = __toESM(require("process"), 1);
+var import_node_os3 = require("os");
+var import_node_path7 = require("path");
+var import_node_process13 = __toESM(require("process"), 1);
 function operatorProfileFile() {
-  return (0, import_node_path6.resolve)(
-    clean(import_node_process9.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".odla", "contexts.json")
+  return (0, import_node_path7.resolve)(
+    clean(import_node_process13.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path7.join)((0, import_node_os3.homedir)(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(import_node_process9.default.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(import_node_process13.default.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -1760,10 +1913,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? (0, import_node_path6.join)((0, import_node_path6.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".odla");
+  const base = selection.name ? (0, import_node_path7.join)((0, import_node_path7.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path7.join)((0, import_node_os3.homedir)(), ".odla");
   return {
-    developer: (0, import_node_path6.join)(base, "dev-token.json"),
-    scoped: (0, import_node_path6.join)(base, "admin-token.local.json")
+    developer: (0, import_node_path7.join)(base, "dev-token.json"),
+    scoped: (0, import_node_path7.join)(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -1841,7 +1994,7 @@ var DEFAULT_PLATFORM2 = "https://odla.ai";
 async function resolveOperatorContext(parsed, options = {}) {
   const profile = resolveOperatorProfile(parsed);
   const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
-  const configPath = (0, import_node_path7.resolve)(configArgument);
+  const configPath = (0, import_node_path8.resolve)(configArgument);
   const explicitConfig = parsed.options.config !== void 0;
   const hasConfig = (0, import_node_fs8.existsSync)(configPath);
   if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
@@ -1849,13 +2002,13 @@ async function resolveOperatorContext(parsed, options = {}) {
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(import_node_process10.default.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(import_node_process14.default.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(import_node_process10.default.env.ODLA_APP_ID);
+  const appEnvironment = clean2(import_node_process14.default.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) {
@@ -1869,16 +2022,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(import_node_process10.default.env.ODLA_ENV);
+  const envEnvironment = clean2(import_node_process14.default.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? import_node_process10.default.cwd();
+  const rootDir = loaded?.rootDir ?? import_node_process14.default.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(import_node_process10.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path7.resolve)(import_node_process10.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(import_node_process10.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path7.resolve)(import_node_process10.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path7.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(import_node_process14.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path8.resolve)(import_node_process14.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile2 = clean2(import_node_process14.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path8.resolve)(import_node_process14.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path8.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -1900,8 +2053,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: (0, import_node_path7.join)(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: (0, import_node_path7.join)(rootDir, ".dev.vars"),
+      credentialsFile: (0, import_node_path8.join)(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: (0, import_node_path8.join)(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -1925,7 +2078,7 @@ async function resolveOperatorContext(parsed, options = {}) {
     },
     credentials: {
       developerTokenFile: tokenFile,
-      scopedTokenFile
+      scopedTokenFile: scopedTokenFile2
     }
   };
 }
@@ -2023,7 +2176,7 @@ async function adminCommand(parsed, deps = {}) {
 }
 
 // src/auth-command.ts
-var import_node_process11 = __toESM(require("process"), 1);
+var import_node_process15 = __toESM(require("process"), 1);
 
 // src/whoami-command.ts
 var text2 = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
@@ -2159,6 +2312,7 @@ async function whoamiCommand(parsed, deps = {}) {
   } else {
     out.log("projects:   (none \u2014 every pm and discuss call will be refused)");
   }
+  printMachineBlock(cfg.platformUrl, out);
   if (!identity.admin) {
     if (identity.scopes.includes("platform:runbook:write")) {
       out.log("\nThis exact scope can read and edit all platform runbook content.");
@@ -2169,6 +2323,21 @@ async function whoamiCommand(parsed, deps = {}) {
     }
   }
 }
+function printMachineBlock(platformUrl, out) {
+  const state2 = machineAuthState(platformAudience(platformUrl));
+  if (!state2.enrolled) {
+    out.log("\nmachine:    not enrolled \u2014 every privileged command needs its own browser approval.");
+    out.log(`            End that with:
+              ${ENROL_EVERYTHING}`);
+    return;
+  }
+  const reach = state2.appIds?.includes("*") ? "every app you own" : state2.appIds?.join(", ");
+  out.log(`
+machine:    enrolled${state2.deviceName ? ` as "${state2.deviceName}"` : ""}${reach ? ` for ${reach}` : ""}`);
+  if (state2.scopes?.length) out.log(`            carrying ${state2.scopes.join(", ")}`);
+  const lapse = lapseNotice(state2);
+  if (lapse) out.log(`            ${lapse}`);
+}
 
 // src/auth-command.ts
 async function authCommand(parsed, deps = {}) {
@@ -2193,7 +2362,7 @@ async function authCommand(parsed, deps = {}) {
   const { cfg } = context;
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const email = stringOpt(parsed.options.email) ?? import_node_process11.default.env.ODLA_USER_EMAIL?.trim();
+  const email = stringOpt(parsed.options.email) ?? import_node_process15.default.env.ODLA_USER_EMAIL?.trim();
   if (!email) {
     throw new Error(
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
@@ -2554,7 +2723,7 @@ async function appCommand(parsed, dependencies = {}) {
 
 // src/brand-command.ts
 var import_promises = require("fs/promises");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 
 // src/brand-design-unpack.ts
 var import_node_zlib = require("zlib");
@@ -2656,15 +2825,15 @@ function describeUnpack(result, outDir) {
 // src/brand-command.ts
 var USAGE = "usage: odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]";
 async function readBundle(source, deps) {
-  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path8.resolve)(source), "utf8");
+  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path9.resolve)(source), "utf8");
   const readStdin = deps.readStdin;
   if (!readStdin) throw new Error("reading a bundle from stdin is not supported here");
   return readStdin();
 }
 async function writeAll(result, outDir) {
   for (const file of result.files) {
-    const target = (0, import_node_path8.resolve)(outDir, file.path);
-    await (0, import_promises.mkdir)((0, import_node_path8.dirname)(target), { recursive: true });
+    const target = (0, import_node_path9.resolve)(outDir, file.path);
+    await (0, import_promises.mkdir)((0, import_node_path9.dirname)(target), { recursive: true });
     await (0, import_promises.writeFile)(target, file.bytes);
   }
 }
@@ -2672,7 +2841,7 @@ async function designUnpack(parsed, deps) {
   assertArgs(parsed, ["out", "json"], 4);
   const source = parsed.positionals[3];
   if (!source) throw new Error(USAGE);
-  const outDir = (0, import_node_path8.resolve)(stringOpt(parsed.options.out) ?? "design");
+  const outDir = (0, import_node_path9.resolve)(stringOpt(parsed.options.out) ?? "design");
   const result = unpackDesign(await readBundle(source, deps));
   await writeAll(result, outDir);
   const out = deps.stdout ?? console;
@@ -3277,7 +3446,7 @@ async function safeText4(response2) {
 
 // src/config-operation-command.ts
 var import_apps6 = require("@odla-ai/apps");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 
 // src/version.ts
 var import_node_fs10 = require("fs");
@@ -3707,7 +3876,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: (0, import_node_path9.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path10.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3762,7 +3931,7 @@ function record4(value2) {
 
 // src/config-reconcile-command.ts
 var import_apps8 = require("@odla-ai/apps");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 
 // src/config-reconcile.ts
 var import_apps7 = require("@odla-ai/apps");
@@ -4058,7 +4227,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: (0, import_node_path10.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path11.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4191,26 +4360,26 @@ function quoteArg2(value2) {
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
 var import_node_fs13 = require("fs");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
 var import_node_fs12 = require("fs");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
-  let stderr = "";
+  let stderr2 = "";
   child.stdout.on("data", (chunk) => stdout += chunk.toString());
-  child.stderr.on("data", (chunk) => stderr += chunk.toString());
+  child.stderr.on("data", (chunk) => stderr2 += chunk.toString());
   child.on("error", reject);
-  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr: stderr2 }));
   child.stdin.end(opts?.input ?? "");
 });
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path11.join)(rootDir, name);
+    const path = (0, import_node_path12.join)(rootDir, name);
     if ((0, import_node_fs12.existsSync)(path)) return path;
   }
   return null;
@@ -4361,21 +4530,21 @@ function wranglerWarnings(rootDir) {
   const blocks = [{ label: "", block: config }];
   const envs = config.env;
   if (envs && typeof envs === "object") {
-    for (const [name, block] of Object.entries(envs)) {
-      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+    for (const [name, block2] of Object.entries(envs)) {
+      if (block2 && typeof block2 === "object") blocks.push({ label: `env.${name}.`, block: block2 });
     }
   }
-  for (const { label, block } of blocks) {
-    const assets = block.assets;
+  for (const { label, block: block2 } of blocks) {
+    const assets = block2.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path12.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path12.resolve)(rootDir)) {
+      const dir = (0, import_node_path13.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path13.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs13.existsSync)((0, import_node_path12.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs13.existsSync)((0, import_node_path13.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
-    const vars = block.vars;
+    const vars = block2.vars;
     if (vars && typeof vars === "object") {
       for (const [name, value2] of Object.entries(vars)) {
         if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value2 === "string" && looksSecret(value2)) {
@@ -4406,7 +4575,7 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path12.resolve)(rootDir, config.main) : null;
+  const main = typeof config.main === "string" ? (0, import_node_path13.resolve)(rootDir, config.main) : null;
   if (!main || !(0, import_node_fs13.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
@@ -4436,7 +4605,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path12.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path13.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4731,12 +4900,12 @@ function harnessOption(value2, flag) {
 
 // src/init.ts
 var import_node_fs14 = require("fs");
-var import_node_path13 = require("path");
+var import_node_path14 = require("path");
 var import_apps9 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path13.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path13.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  const rootDir = (0, import_node_path14.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path14.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
   if ((0, import_node_fs14.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
@@ -4753,12 +4922,12 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  (0, import_node_fs14.mkdirSync)((0, import_node_path13.dirname)(configPath), { recursive: true });
-  (0, import_node_fs14.mkdirSync)((0, import_node_path13.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs14.mkdirSync)((0, import_node_path13.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs14.mkdirSync)((0, import_node_path14.dirname)(configPath), { recursive: true });
+  (0, import_node_fs14.mkdirSync)((0, import_node_path14.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs14.mkdirSync)((0, import_node_path14.resolve)(rootDir, ".odla"), { recursive: true });
   (0, import_node_fs14.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path13.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path13.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  writeIfMissing((0, import_node_path14.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path14.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
@@ -4825,8 +4994,10 @@ ${calendar}
     // prod: "https://example.com",
   },
   local: {
-    tokenFile: ".odla/dev-token.json",
-    credentialsFile: ".odla/credentials.local.json",
+    // Credentials live in ~/.odla, per machine, so every worktree of this app
+    // shares one approval instead of asking for its own. Pinning tokenFile or
+    // credentialsFile here still works and still overrides that \u2014 it just puts
+    // this checkout back on its own island.
     devVarsFile: ".dev.vars",
   },
 };
@@ -5063,8 +5234,8 @@ function printReport(report5, out) {
 
 // src/skill.ts
 var import_node_fs15 = require("fs");
-var import_node_os3 = require("os");
-var import_node_path14 = require("path");
+var import_node_os4 = require("os");
+var import_node_path15 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -5163,8 +5334,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path14.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path14.resolve)(options.homeDir ?? (0, import_node_os3.homedir)());
+  const root = (0, import_node_path15.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path15.resolve)(options.homeDir ?? (0, import_node_os4.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -5178,48 +5349,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path14.join)(targetDir2, rel), (0, import_node_fs15.readFileSync)((0, import_node_path14.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path15.join)(targetDir2, rel), (0, import_node_fs15.readFileSync)((0, import_node_path15.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path14.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path14.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path14.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path15.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path15.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path15.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path14.dirname)((0, import_node_path14.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path15.dirname)((0, import_node_path15.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path14.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path15.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path14.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path15.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = (0, import_node_fs15.readFileSync)((0, import_node_path14.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path14.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
+        const canonical2 = (0, import_node_fs15.readFileSync)((0, import_node_path15.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path15.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path14.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path15.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path14.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path15.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path14.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path15.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path14.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path15.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -5255,7 +5426,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!(0, import_node_fs15.existsSync)(file.target) || (0, import_node_fs15.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs15.mkdirSync)((0, import_node_path14.dirname)(file.target), { recursive: true });
+      (0, import_node_fs15.mkdirSync)((0, import_node_path15.dirname)(file.target), { recursive: true });
       (0, import_node_fs15.writeFileSync)(file.target, file.content);
     }
   }
@@ -5275,7 +5446,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path14.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path14.sep}`) && !(0, import_node_path14.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path15.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path15.sep}`) && !(0, import_node_path15.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -5294,10 +5465,10 @@ function normalizeHarnesses(values, global) {
   }
   return expanded;
 }
-function managedFileContent(path, block, force, boundary) {
+function managedFileContent(path, block2, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs15.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs15.existsSync)(path)) return `${block2}
 `;
   const current = (0, import_node_fs15.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
@@ -5309,24 +5480,24 @@ function managedFileContent(path, block, force, boundary) {
   }
   if (startAt === -1) {
     const separator = current.length === 0 || current.endsWith("\n\n") ? "" : current.endsWith("\n") ? "\n" : "\n\n";
-    return `${current}${separator}${block}
+    return `${current}${separator}${block2}
 `;
   }
   const afterEnd = endAt + end.length;
   const existing = current.slice(startAt, afterEnd);
-  if (existing !== block && !force) {
+  if (existing !== block2 && !force) {
     throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);
   }
-  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
+  return `${current.slice(0, startAt)}${block2}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path14.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path14.sep}`) || (0, import_node_path14.isAbsolute)(rel)) {
+  const rel = (0, import_node_path15.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path15.sep}`) || (0, import_node_path15.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path14.sep).filter(Boolean)) {
-    current = (0, import_node_path14.join)(current, part);
+  for (const part of rel.split(import_node_path15.sep).filter(Boolean)) {
+    current = (0, import_node_path15.join)(current, part);
     try {
       if ((0, import_node_fs15.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -5343,9 +5514,9 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of (0, import_node_fs15.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path14.join)(current, entry.name);
+      const path = (0, import_node_path15.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path14.relative)(dir, path));
+      else results.push((0, import_node_path15.relative)(dir, path));
     }
   };
   walk(dir);
@@ -5701,8 +5872,8 @@ async function projectCommand(command, parsed, deps) {
 
 // src/code-connect.ts
 var import_node_fs16 = require("fs");
-var import_node_os4 = require("os");
-var import_node_path15 = require("path");
+var import_node_os5 = require("os");
+var import_node_path16 = require("path");
 
 // ../harness/dist/chunk-LNQNFGQC.js
 var HARNESS_PROTOCOL_VERSION = 1;
@@ -5808,7 +5979,7 @@ function allowedWorkspacePath(relativePath) {
 async function gitOutput(cwd, args, maxBytes) {
   const child = (0, import_child_process2.spawn)("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -5816,20 +5987,20 @@ async function gitOutput(cwd, args, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
     child.once("exit", accept);
   });
   if (bytes > maxBytes) throw new Error(`git output exceeds ${maxBytes} bytes`);
-  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   return Buffer.concat(stdout);
 }
 async function gitBlobs(cwd, entries, maxBytes) {
   const child = (0, import_child_process2.spawn)("git", ["cat-file", "--batch"], { cwd, stdio: ["pipe", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -5837,7 +6008,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   child.stdin.end(`${entries.map((entry) => entry.hash).join("\n")}
 `);
@@ -5846,7 +6017,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
     child.once("exit", accept);
   });
   if (bytes > maxBytes + entries.length * 100) throw new Error(`Git tree exceeds ${maxBytes} bytes`);
-  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   const output = Buffer.concat(stdout);
   const blobs = [];
   let offset = 0;
@@ -5943,7 +6114,7 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     shell: false
   });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let outputBytes = 0;
   child.stdout.on("data", (chunk) => {
     outputBytes += chunk.byteLength;
@@ -5951,14 +6122,14 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
     child.once("exit", accept);
   });
   if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
-  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
   if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
   const root = (0, import_path4.resolve)(sourceDir);
@@ -6003,7 +6174,7 @@ async function captureGitDiff(root, maxBytes) {
     "workspace"
   ], { cwd: root, stdio: ["ignore", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -6011,7 +6182,7 @@ async function captureGitDiff(root, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
@@ -6019,7 +6190,7 @@ async function captureGitDiff(root, maxBytes) {
   });
   if (bytes > maxBytes) throw new Error(`patch exceeds ${maxBytes} bytes`);
   if (code !== 0 && code !== 1) {
-    throw new Error(`git diff failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+    throw new Error(`git diff failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   }
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
@@ -6823,11 +6994,11 @@ function rollup(graph, kind, options = {}) {
 }
 
 // ../graph/dist/code/index.js
-function dirname8(path) {
+function dirname9(path) {
   const at = path.lastIndexOf("/");
   return at <= 0 ? "." : path.slice(0, at);
 }
-function join12(base, specifier) {
+function join13(base, specifier) {
   const parts = [];
   const segments = `${base === "." ? "" : `${base}/`}${specifier}`.split("/");
   for (const segment of segments) {
@@ -6851,7 +7022,7 @@ var BARE_IMPORT = /^\s*import\s*["']([^"']+)["']/gm;
 var isSourcePath = (path) => SOURCE.test(path);
 function resolveImport(fromPath, specifier, known) {
   if (!specifier.startsWith(".")) return null;
-  const base = join12(dirname8(fromPath), specifier);
+  const base = join13(dirname9(fromPath), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -7382,13 +7553,13 @@ function gitApply(cwd, patch2, check) {
       stdio: ["pipe", "ignore", "pipe"],
       env: { PATH: process.env.PATH ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" }
     });
-    let stderr = "";
+    let stderr2 = "";
     child.stderr.setEncoding("utf8");
     child.stderr.on("data", (text3) => {
-      if (stderr.length < 4e3) stderr += text3.slice(0, 4e3);
+      if (stderr2.length < 4e3) stderr2 += text3.slice(0, 4e3);
     });
     child.once("error", reject);
-    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr.trim().slice(0, 500)))));
+    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr2.trim().slice(0, 500)))));
     child.stdin.end(patch2);
   });
 }
@@ -7501,7 +7672,7 @@ function execute(engine, args, name, recipe2, signal) {
     const started = Date.now();
     const child = (0, import_child_process5.spawn)(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
     const stdout = [];
-    const stderr = [];
+    const stderr2 = [];
     let bytes = 0;
     let outputLimitExceeded = false;
     let timedOut = false;
@@ -7522,7 +7693,7 @@ function execute(engine, args, name, recipe2, signal) {
       else target.push(chunk);
     };
     child.stdout.on("data", collect(stdout));
-    child.stderr.on("data", collect(stderr));
+    child.stderr.on("data", collect(stderr2));
     const abort = () => stop("abort");
     signal?.addEventListener("abort", abort, { once: true });
     if (signal?.aborted) abort();
@@ -7538,7 +7709,7 @@ function execute(engine, args, name, recipe2, signal) {
       accept({
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdout).toString("utf8"),
-        stderr: Buffer.concat(stderr).toString("utf8"),
+        stderr: Buffer.concat(stderr2).toString("utf8"),
         durationMs: Date.now() - started,
         outputLimitExceeded,
         timedOut
@@ -7690,11 +7861,11 @@ function checkedResult(result, maximumOutputBytes) {
 }
 function boundedLogs(result, maximum) {
   const stdout = Buffer.from(result.stdout);
-  const stderr = Buffer.from(result.stderr);
+  const stderr2 = Buffer.from(result.stderr);
   const first = stdout.subarray(0, maximum);
   return {
     stdout: first.toString("utf8"),
-    stderr: stderr.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
+    stderr: stderr2.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
   };
 }
 function digestPolicy(policy) {
@@ -9764,7 +9935,7 @@ var CODE_BUILD_RECIPES = Object.freeze([{
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path15.resolve)(cwd, options.configPath);
+  const configPath = (0, import_node_path16.resolve)(cwd, options.configPath);
   const cfg = (0, import_node_fs16.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
@@ -9794,7 +9965,7 @@ async function codeConnect(options) {
   const doFetch = options.fetch ?? fetch;
   const engine = await (options.selectEngine ?? selectContainerEngine)(options.engine ?? "auto");
   const hostPlatform = process.platform === "darwin" ? "macos" : "linux";
-  const hostName = (options.name ?? (0, import_node_os4.hostname)()).trim();
+  const hostName = (options.name ?? (0, import_node_os5.hostname)()).trim();
   if (!hostName || hostName.length > 120) throw new Error("--name must contain 1 to 120 characters");
   const repository = await inferGitHubRepository(cwd, options.readGitOrigin);
   const localSource = await (options.prepareLocalSource ?? prepareCodeLocalSource)(
@@ -9804,7 +9975,8 @@ async function codeConnect(options) {
   );
   try {
     const descriptor2 = localSource.descriptor;
-    const approval = await (options.getToken ?? getScopedPlatformToken)({
+    const device = options.getToken ? null : readDeviceCredential(platform);
+    const authorization = device ? (await mintDeviceSession(platform, device, doFetch)).token : await (options.getToken ?? getScopedPlatformToken)({
       platform,
       scope: "app:code:host:connect",
       email: options.email,
@@ -9818,7 +9990,7 @@ async function codeConnect(options) {
     const target = appId ? { appId } : { repository };
     const response2 = await doFetch(`${platform}/registry/code/hosts/connect`, {
       method: "POST",
-      headers: { authorization: `Bearer ${approval}`, "content-type": "application/json" },
+      headers: { authorization: `Bearer ${authorization}`, "content-type": "application/json" },
       body: JSON.stringify({ ...target, env: appEnv, name: hostName, platform: hostPlatform, slots }),
       redirect: "error",
       signal: options.signal
@@ -9831,8 +10003,8 @@ async function codeConnect(options) {
       platform: hostPlatform,
       arch: process.arch,
       engines: [engine],
-      cpuCount: (0, import_node_os4.cpus)().length,
-      memoryBytes: (0, import_node_os4.totalmem)(),
+      cpuCount: (0, import_node_os5.cpus)().length,
+      memoryBytes: (0, import_node_os5.totalmem)(),
       source: descriptor2,
       images: {
         ready: true,
@@ -10199,13 +10371,13 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-var import_node_process12 = __toESM(require("process"), 1);
+var import_node_process16 = __toESM(require("process"), 1);
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(import_node_process12.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(import_node_process16.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -10399,6 +10571,27 @@ async function credentialCommand(parsed, deps = {}) {
 }
 
 // src/help-usage.ts
+var AUTH_SECTION = `
+Enrol this machine once, then stop asking:
+  npx odla-ai device enroll --all-apps --capability all --no-open --wait 600
+      One browser approval. Afterwards every worktree on this machine mints its
+      own short-lived credentials with nobody's attention, for every app you
+      own \u2014 including apps you create later. The window rolls forward each time
+      you use it, so continuous work never interrupts anyone; only a real gap
+      does. Give the human the printed /studio?code= URL, keep the process
+      alive, and wait on it.
+
+  npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600
+      The same thing across all of odla, for weeks. Needs a platform
+      administrator's approval \u2014 an app owner's cannot carry platform scopes.
+
+  npx odla-ai whoami        what this machine holds and when it lapses
+  npx odla-ai device list   every machine you have enrolled
+
+Enrollment is the only human decision here. Revoking a machine, purging an app,
+transferring ownership, and rotating credentials still need a signed-in human in
+Studio, and no machine credential can do them however wide its approval was.
+`;
 var USAGE_SECTION = `
 Start here:
   odla-ai runbook ask "<question>"   The current procedure, from odla's own
@@ -10437,7 +10630,7 @@ Usage:
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm project list [--app <product-id>] [--status <s>] [--json]
   odla-ai pm project add --app <product-id> --name <name> [--description <text>] [--json]
-  odla-ai pm project use <project-id> [--json]                         [saved locally in this worktree]
+  odla-ai pm project use <project-id> [--json]                         [saved for this app, on this machine]
   odla-ai pm goal list [--app <id>] [--project <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -10529,7 +10722,8 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device enroll [--all-apps|--app <id>[,<id>...]] [--capability all|<c>[,<c>...]] [--platform-wide]
+    [--name <label>] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--wait <seconds>] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
@@ -10543,8 +10737,11 @@ Usage:
 
 // src/help.ts
 function printHelp(output = console) {
-  output.log(`odla-ai
-${USAGE_SECTION}
+  output.log(helpText());
+}
+function helpText() {
+  return `odla-ai
+${AUTH_SECTION}${USAGE_SECTION}
 Commands:
   auth         Start a fresh, exact-project agent authorization for human review.
                The email is the signed-in odla account, never git or GitHub
@@ -10617,8 +10814,9 @@ Commands:
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
   pm           Project management (via @odla-ai/pm): Products contain Projects;
                projects contain goals, kanban tasks, decisions, and bugs. Use
-               "pm project list|add|use" to select worktree-local context, or
-               pass --app/--project explicitly. Same device-grant auth as "app".
+               "pm project list|add|use" selects a project for this app on this
+               machine \u2014 every worktree shares it \u2014 or pass --app/--project
+               explicitly. Same device-grant auth as "app".
                Status changes and comments post to each item's @odla-ai/chat
                discussion thread.
                NOTE: "--column ready" is OWNER-ONLY. Creating a task in Ready
@@ -10647,9 +10845,20 @@ Commands:
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
   device       Enrol THIS machine once, then stop asking. A human approves the
-               enrollment in the browser; from then on this terminal mints its
-               own short-lived credentials for the named projects with nobody's
-               attention, until the device expires or is revoked.
+               enrollment in the browser; from then on EVERY worktree on this
+               machine mints its own short-lived credentials with nobody's
+               attention, until the device is revoked or goes unused.
+               "--all-apps" covers every app you own, now and later, so creating
+               an app costs no new approval. "--capability all" takes everything
+               that approval is allowed to carry, so a capability you did not
+               think to name is not a 403 next week. "--platform-wide" is the
+               administrator's version, across all of odla.
+               The expiry is a GAP, not a clock: each use rolls it forward, so
+               only going quiet brings a human back into the loop \u2014 which is
+               where anything that changed can be explained.
+               "device list" shows what each machine holds and when it lapses;
+               revoking one takes down every credential it ever minted, and is
+               deliberately a signed-in human's decision in Studio.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
@@ -10719,10 +10928,12 @@ Safety:
   release. A confirmed stale client stops with a safe npx rerun command; a
   workspace-linked client also identifies the worktree that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
-  odla.config.mjs may select the app explicitly but is not required. Code host
-  approval and credential hashes live in odla-ai/db. The host
-  credential is never written under .odla/; it exists only in the foreground
-  "code connect" process and is rotated by the next approved connection.
+  odla.config.mjs may select the app explicitly but is not required. With an
+  enrolled code.session device, the Studio repository selection authorizes the
+  host's first connection and reconnects without another human approval. Without
+  an enrolled device, "code connect" falls back to the reviewed handshake. Host
+  credential hashes live in odla-ai/db; the credential itself is never written
+  under .odla/, exists only in the foreground process, and rotates on reconnect.
   "code repository bind" takes owner/name and resolves the two GitHub integers the
   bind route wants across every installation you have, refusing an ambiguous match
   rather than choosing one \u2014 the same repository name under two organizations is
@@ -10743,7 +10954,46 @@ Safety:
   Run security plan first to inspect the admin-selected providers, models,
   per-route bounds, credential readiness, retention, no-execution boundary,
   and digest that binds consent to that exact plan.
-`);
+`;
+}
+
+// src/help-command.ts
+function printCommandHelp(command, output = console) {
+  const lines = helpText().split("\n");
+  const usage = allBlocks(lines, new RegExp(`^  odla-ai ${escapeRe(command)}(\\s|$)`));
+  const prose = block(lines, (line2) => new RegExp(`^  ${escapeRe(command)}\\s\\s+\\S`).test(line2));
+  if (usage.length === 0 && prose.length === 0) {
+    output.log(`odla-ai: no command "${command}". Run "odla-ai help" for all of them.`);
+    return;
+  }
+  output.log([
+    ...prose.length ? [prose.join("\n"), ""] : [],
+    ...usage.length ? ["Usage:", ...usage, ""] : [],
+    AUTH_SECTION.trimEnd()
+  ].join("\n"));
+}
+function allBlocks(lines, pattern) {
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!pattern.test(lines[i])) continue;
+    out.push(...block(lines.slice(i), (line2) => line2 === lines[i]));
+  }
+  return out;
+}
+function block(lines, starts) {
+  const first = lines.findIndex(starts);
+  if (first === -1) return [];
+  const indent = lines[first].length - lines[first].trimStart().length;
+  const out = [lines[first]];
+  for (const line2 of lines.slice(first + 1)) {
+    if (!line2.trim()) break;
+    if (line2.length - line2.trimStart().length <= indent) break;
+    out.push(line2);
+  }
+  return out;
+}
+function escapeRe(value2) {
+  return value2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 // src/discuss-principals.ts
@@ -11900,14 +12150,36 @@ async function pmWatch(ctx, parsed) {
 }
 
 // src/pm-project-context.ts
-var import_node_path16 = require("path");
-var pmProjectContextFile = (rootDir) => (0, import_node_path16.resolve)(rootDir, ".odla", "pm-project.local.json");
+var import_node_fs17 = require("fs");
+var import_node_path17 = require("path");
+var pmProjectContextFile = () => pmContextFile();
 function readPmProjectContext(rootDir) {
-  const value2 = readJsonFile(pmProjectContextFile(rootDir));
-  return value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" ? value2 : null;
+  adoptLegacySelection(rootDir);
+  const entries = Object.values(readSelections()).filter(isSelection);
+  return entries.sort((a, b) => b.selectedAt.localeCompare(a.selectedAt))[0] ?? null;
 }
 function writePmProjectContext(rootDir, value2) {
-  writePrivateJson(pmProjectContextFile(rootDir), { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  adoptLegacySelection(rootDir);
+  writePrivateJson(pmProjectContextFile(), {
+    ...readSelections(),
+    [value2.appId]: { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() }
+  });
+}
+function adoptLegacySelection(rootDir) {
+  const legacy = (0, import_node_path17.resolve)(rootDir, ".odla", "pm-project.local.json");
+  if (!(0, import_node_fs17.existsSync)(legacy)) return;
+  const previous = readJsonFile(legacy);
+  (0, import_node_fs17.rmSync)(legacy, { force: true });
+  if (!isSelection(previous)) return;
+  const selections = readSelections();
+  if (selections[previous.appId]) return;
+  writePrivateJson(pmProjectContextFile(), { ...selections, [previous.appId]: previous });
+}
+function readSelections() {
+  return readJsonFile(pmProjectContextFile()) ?? {};
+}
+function isSelection(value2) {
+  return !!value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" && typeof value2.selectedAt === "string";
 }
 
 // src/pm-project-actions.ts
@@ -12932,7 +13204,7 @@ function percent(value2) {
 // src/provision.ts
 var import_apps13 = require("@odla-ai/apps");
 var import_ai5 = require("@odla-ai/ai");
-var import_node_process13 = __toESM(require("process"), 1);
+var import_node_process17 = __toESM(require("process"), 1);
 
 // src/integration-provision.ts
 var import_db3 = require("@odla-ai/db");
@@ -13370,7 +13642,7 @@ async function provision(options) {
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process13.default.env[cfg.ai.keyEnv];
+      const key = import_node_process17.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai5.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -13411,8 +13683,8 @@ async function provision(options) {
 }
 
 // src/record.ts
-var import_node_fs17 = require("fs");
-var import_node_process14 = __toESM(require("process"), 1);
+var import_node_fs18 = require("fs");
+var import_node_process18 = __toESM(require("process"), 1);
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -13594,7 +13866,7 @@ function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process14.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process18.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -13602,7 +13874,7 @@ function recordInvocation(parsed) {
       options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs17.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs18.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
@@ -13631,6 +13903,9 @@ function renderAdvisories(out, advisories, env = process.env) {
   }
 }
 
+// src/device-command.ts
+var import_db4 = require("@odla-ai/db");
+
 // src/device-ttl.ts
 var OWNER_DEVICE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var DAY_MS = 24 * 60 * 60 * 1e3;
@@ -13650,10 +13925,26 @@ function parseDeviceTtl(raw) {
 }
 
 // src/device-command.ts
-var import_node_fs18 = require("fs");
-var import_node_path17 = require("path");
-var import_node_process15 = __toESM(require("process"), 1);
+var import_node_fs19 = require("fs");
+var import_node_path18 = require("path");
+var import_node_process19 = __toESM(require("process"), 1);
 async function deviceCommand(parsed, deps) {
+  assertArgs(parsed, [
+    "app",
+    "all-apps",
+    "platform-wide",
+    "name",
+    "capability",
+    "device-ttl",
+    "email",
+    "open",
+    "json",
+    "config",
+    "token",
+    "context",
+    "platform",
+    "wait"
+  ], 3);
   const action2 = parsed.positionals[1] ?? "";
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
@@ -13666,10 +13957,12 @@ async function deviceCommand(parsed, deps) {
 }
 async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
-  const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
-  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
+  const platformWide = parsed.options["platform-wide"] === true;
+  const apps = platformWide || parsed.options["all-apps"] === true ? [import_db4.ALL_OWNED_APPS] : (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
+  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026], or --all-apps");
   const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
-  const extended = deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const extended = platformWide || deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const { capabilities, scopes } = requestedEnvelope(parsed, platformWide);
   const token = await scopedToken2(
     parsed,
     deps,
@@ -13684,9 +13977,10 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
     body: JSON.stringify({
       name,
-      platform: import_node_process15.default.platform,
+      platform: import_node_process19.default.platform,
       appIds: apps,
-      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {},
+      ...capabilities ? { capabilities } : {},
+      ...scopes ? { scopes } : {},
       ...deviceTtlMs === void 0 ? {} : { deviceTtlMs }
     })
   });
@@ -13695,20 +13989,53 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     throw new Error(`device enroll failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
   }
   const path = deviceCredentialPath();
-  (0, import_node_fs18.mkdirSync)((0, import_node_path17.dirname)(path), { recursive: true });
-  (0, import_node_fs18.writeFileSync)(path, JSON.stringify({
+  (0, import_node_fs19.mkdirSync)((0, import_node_path18.dirname)(path), { recursive: true });
+  (0, import_node_fs19.writeFileSync)(path, JSON.stringify({
     token: body.token,
     platform: cfg.platformUrl.replace(/\/$/, ""),
     deviceId: body.device.deviceId,
     name
   }, null, 2));
-  (0, import_node_fs18.chmodSync)(path, 384);
-  out.error(`device: enrolled "${name}" for ${body.device.appIds.join(", ")}; credential written to ${path}`);
-  out.error("device: this terminal will mint its own credentials from now on \u2014 no further approvals.");
+  (0, import_node_fs19.chmodSync)(path, 384);
+  rememberMachineIdentity(cfg.platformUrl.replace(/\/$/, ""), stringOpt(parsed.options.email));
+  const reach = body.device.appIds.includes(import_db4.ALL_OWNED_APPS) ? "every app you own, now and later" : body.device.appIds.join(", ");
+  out.error(`device: enrolled "${name}" for ${reach}; credential written to ${path}`);
+  out.error(
+    "device: every worktree on this machine mints its own credentials from now on \u2014 no further approvals,"
+  );
+  out.error(
+    `device: and the clock resets each time you use it. Going quiet for ${describeWindow(body.device.expiresAt)} is what ends it.`
+  );
   if (json) {
-    out.log(JSON.stringify({ deviceId: body.device.deviceId, name, appIds: body.device.appIds, expiresAt: body.device.expiresAt }, null, 2));
+    out.log(JSON.stringify({
+      deviceId: body.device.deviceId,
+      name,
+      appIds: body.device.appIds,
+      capabilities: body.device.capabilities ?? [],
+      scopes: body.device.scopes ?? [],
+      expiresAt: body.device.expiresAt,
+      hardExpiresAt: body.device.hardExpiresAt ?? null
+    }, null, 2));
   }
 }
+function requestedEnvelope(parsed, platformWide) {
+  const raw = stringOpt(parsed.options.capability);
+  const everything = platformWide || raw?.trim().toLowerCase() === "all";
+  if (everything) {
+    return {
+      capabilities: [...import_db4.OPTIONAL_AGENT_PROJECT_CAPABILITIES],
+      scopes: platformWide ? [...import_db4.ADMIN_DEVICE_SCOPES] : [...import_db4.OWNER_DEVICE_SCOPES]
+    };
+  }
+  const named = raw?.split(",").map((c) => c.trim()).filter(Boolean);
+  return named?.length ? { capabilities: named } : {};
+}
+function describeWindow(expiresAt, now = Date.now()) {
+  const days = Math.max(1, Math.round((expiresAt - now) / (24 * 60 * 60 * 1e3)));
+  if (days >= 365) return `${Math.round(days / 365)} year${days >= 730 ? "s" : ""}`;
+  if (days % 7 === 0) return `${days / 7} week${days > 7 ? "s" : ""}`;
+  return `${days} day${days === 1 ? "" : "s"}`;
+}
 async function list2(parsed, deps, cfg, doFetch, out, json) {
   const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device list)");
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
@@ -13722,12 +14049,17 @@ async function list2(parsed, deps, cfg, doFetch, out, json) {
   if (body.devices.length === 0) return out.log("no enrolled devices");
   for (const device of body.devices) {
     const state2 = device.revokedAt ? "revoked" : device.expiresAt <= Date.now() ? "expired" : "active";
-    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${device.appIds.join(", ")}]`);
+    const reach = device.appIds.includes("*") ? "every app you own" : device.appIds.join(", ");
+    const gap = state2 === "active" ? `  idle ${describeWindow(device.expiresAt)} left` : "";
+    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${reach}]${gap}`);
   }
 }
 async function revoke(parsed, deps, cfg, doFetch, out, json) {
   const deviceId = parsed.positionals[2];
   if (!deviceId) throw new Error("device revoke needs the device id from `odla-ai device list`");
+  out.error(
+    `device: revoking is a signed-in human's decision; if this is refused, open ${cfg.platformUrl}/studio and revoke it there.`
+  );
   const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device revoke)");
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices/${encodeURIComponent(deviceId)}/revoke`, {
     method: "POST",
@@ -13746,7 +14078,7 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
     // A device is granted the apps named in ONE approval, so --app is a list here.
     allowAppList: true
   });
-  const scopedTokenFile = credentials.scopedTokenFile;
+  const scopedTokenFile2 = credentials.scopedTokenFile;
   return getScopedPlatformToken({
     platform: cfg.platformUrl,
     scope,
@@ -13757,16 +14089,16 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     openApprovalUrl: deps.openUrl,
     rootDir: cfg.rootDir,
-    tokenFile: scopedTokenFile,
+    tokenFile: scopedTokenFile2,
     ...stringOpt(parsed.options.token) ? { token: stringOpt(parsed.options.token) } : {}
   });
 }
 function defaultDeviceName() {
-  return `${import_node_process15.default.env.HOSTNAME ?? import_node_process15.default.env.HOST ?? "machine"}-${import_node_process15.default.platform}`;
+  return `${import_node_process19.default.env.HOSTNAME ?? import_node_process19.default.env.HOST ?? "machine"}-${import_node_process19.default.platform}`;
 }
 
 // src/runbook-actions.ts
-var import_node_fs19 = require("fs");
+var import_node_fs20 = require("fs");
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
@@ -13862,7 +14194,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs19.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs20.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -13954,8 +14286,8 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-var import_node_fs20 = require("fs");
-var import_node_path18 = require("path");
+var import_node_fs21 = require("fs");
+var import_node_path19 = require("path");
 function parseRunbook(text3, slug) {
   let rest = text3;
   const meta = {};
@@ -13980,12 +14312,12 @@ function parseRunbook(text3, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs20.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs20.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs21.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs21.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path18.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs20.readFileSync)((0, import_node_path18.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path19.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -14053,8 +14385,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 var import_node_child_process6 = require("child_process");
-var import_node_fs21 = require("fs");
-var import_node_path19 = require("path");
+var import_node_fs22 = require("fs");
+var import_node_path20 = require("path");
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -14223,10 +14555,10 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path19.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs21.existsSync)(manifest)) return void 0;
+    const manifest = (0, import_node_path20.join)(root, workspace, "package.json");
+    if (!(0, import_node_fs22.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs21.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs22.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -14293,7 +14625,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs21.readFileSync)((0, import_node_path19.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs22.readFileSync)((0, import_node_path20.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -14420,12 +14752,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs22 = require("fs");
-var import_node_os5 = require("os");
-var import_node_path20 = require("path");
-var import_node_process16 = __toESM(require("process"), 1);
+var import_node_fs23 = require("fs");
+var import_node_os6 = require("os");
+var import_node_path21 = require("path");
+var import_node_process20 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = import_node_process16.default.env) {
+function resolveEditor(env = import_node_process20.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -14439,8 +14771,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process16.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process16.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process20.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process20.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -14448,16 +14780,16 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs22.mkdtempSync)((0, import_node_path20.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path20.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs23.mkdtempSync)((0, import_node_path21.join)((0, import_node_os6.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path21.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs22.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs23.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs22.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs23.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -14795,7 +15127,7 @@ function hostedSeverity(value2, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path21 = require("path");
+var import_node_path22 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -14807,9 +15139,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path21.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path21.resolve)(options.out ?? (0, import_node_path21.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path21.relative)(target, output).split(import_node_path21.sep).join("/");
+  const target = (0, import_node_path22.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path22.resolve)(options.out ?? (0, import_node_path22.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path22.relative)(target, output).split(import_node_path22.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -14821,7 +15153,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path21.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path22.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -14839,7 +15171,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path21.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path22.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -14863,7 +15195,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path21.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path22.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -14892,7 +15224,7 @@ function printSummary(out, appId, env, run, report5, output) {
   out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
   if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path21.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path22.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -15373,8 +15705,10 @@ async function dispatchCli(argv, dependencies) {
     return;
   }
   if (command === "help" || command === "--help" || command === "-h") {
-    assertArgs(parsed, ["help"], 1);
-    printHelp(runtime.stdout);
+    assertArgs(parsed, ["help"], 2);
+    const topic = parsed.positionals[1];
+    if (topic) printCommandHelp(topic, runtime.stdout);
+    else printHelp(runtime.stdout);
     return;
   }
   if (command === "whoami") {