@odla-ai/cli 0.38.3 → 0.40.0

package/dist/{chunk-WJAN5CZ2.js → chunk-2IHE5U3M.js}

@@ -10,12 +10,12 @@ import {
 } from "./chunk-UKLSRQ5J.js";
 
 // src/admin-ai.ts
-import process9 from "process";
+import process13 from "process";
 
 // src/token.ts
 import { OdlaError, requestToken } from "@odla-ai/db";
 import { createHash } from "crypto";
-import process6 from "process";
+import process10 from "process";
 
 // src/handshake-approval.ts
 import process3 from "process";
@@ -150,27 +150,10 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
 }
 
 // src/cached-credential.ts
-import { rmSync as rmSync2 } from "fs";
-var noted = null;
-function noteCachedCredential(tokenFile) {
-  noted = tokenFile;
-}
-function isCredentialRejection(error) {
-  const message2 = error instanceof Error ? error.message : String(error ?? "");
-  return /\((401|403)\)\s*$/.test(message2.trim());
-}
-function explainRejectedCredential(error) {
-  const tokenFile = noted;
-  if (!tokenFile || !isCredentialRejection(error)) return null;
-  noted = null;
-  rmSync2(tokenFile, { force: true });
-  return [
-    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
-    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
-    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
-    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
-  ].join("\n");
-}
+import { rmSync as rmSync3 } from "fs";
+
+// src/auth-guidance.ts
+import process7 from "process";
 
 // src/device-session.ts
 import { existsSync, readFileSync } from "fs";
@@ -206,12 +189,76 @@ async function mintDeviceSession(platformUrl, credential2, doFetch) {
       `device session failed: ${detail} (${response2.status})` + (revocable ? " \u2014 if this machine's enrollment was revoked or has expired, enroll it again in Studio" : "")
     );
   }
-  return { token: body.token, expiresAt: body.expiresAt ?? Date.now() };
+  return {
+    token: body.token,
+    expiresAt: body.expiresAt ?? Date.now(),
+    // Absent from a registry that predates rolling expiry and scoped devices.
+    // Left undefined rather than defaulted, so a caller can tell "the platform
+    // did not say" from "the platform said none".
+    ...typeof body.deviceExpiresAt === "number" ? { deviceExpiresAt: body.deviceExpiresAt } : {},
+    ...Array.isArray(body.appIds) ? { appIds: body.appIds } : {},
+    ...Array.isArray(body.capabilities) ? { capabilities: body.capabilities } : {},
+    ...Array.isArray(body.scopes) ? { scopes: body.scopes } : {}
+  };
+}
+
+// src/odla-home.ts
+import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, rmSync as rmSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join3 } from "path";
+import process6 from "process";
+function odlaHome(env = process6.env) {
+  if (env.VITEST && !env.ODLA_HOME) {
+    throw new Error(
+      "ODLA_HOME must be set under test \u2014 resolving the real ~/.odla would write to the developer's machine"
+    );
+  }
+  return env.ODLA_HOME ?? join3(env.HOME ?? homedir2(), ".odla");
+}
+function odlaHomePath(segments, env = process6.env) {
+  return join3(odlaHome(env), ...segments);
+}
+function identityFile(env) {
+  return odlaHomePath(["identity.json"], env);
+}
+function deviceSessionFile(env) {
+  return odlaHomePath(["session.json"], env);
+}
+function appTokenFile(appId, env) {
+  return odlaHomePath(["apps", safeSegment(appId), "dev-token.json"], env);
+}
+function appCredentialsFile(appId, env) {
+  return odlaHomePath(["apps", safeSegment(appId), "credentials.json"], env);
+}
+function scopedTokenFile(env) {
+  return odlaHomePath(["admin-token.local.json"], env);
+}
+function pmContextFile(env) {
+  return odlaHomePath(["pm-context.json"], env);
+}
+function adoptRepoLocalCache(legacyPath, machinePath, out) {
+  if (!existsSync2(legacyPath) || legacyPath === machinePath) return false;
+  const superseded2 = existsSync2(machinePath);
+  if (!superseded2) {
+    mkdirSync(dirname2(machinePath), { recursive: true });
+    copyFileSync(legacyPath, machinePath);
+    chmodSync(machinePath, 384);
+  }
+  rmSync2(legacyPath, { force: true });
+  out?.error(
+    superseded2 ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
+  );
+  return true;
+}
+function safeSegment(value2) {
+  const clean4 = value2.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "");
+  if (!clean4) throw new Error(`"${value2}" is not a usable app id`);
+  return clean4;
 }
 
 // src/local.ts
-import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
-import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
+import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
+import { dirname as dirname3, isAbsolute, relative, resolve } from "path";
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
@@ -225,7 +272,7 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!existsSync2(path)) return null;
+  if (!existsSync3(path)) return null;
   let value2;
   try {
     value2 = JSON.parse(readFileSync2(path, "utf8"));
@@ -259,7 +306,7 @@ function mergeCredential(current, update) {
 }
 function ensureGitignore(rootDir, localPaths = []) {
   const path = resolve(rootDir, ".gitignore");
-  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
+  const existing = existsSync3(path) ? readFileSync2(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
@@ -279,7 +326,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return resolve(dirname2(cfg.configPath), requested);
+  return resolve(dirname3(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -293,7 +340,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
+  const existing = existsSync3(path) ? readFileSync2(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -319,10 +366,10 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text3) {
-  mkdirSync(dirname2(path), { recursive: true });
+  mkdirSync2(dirname3(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync(temporary, text3, { mode: 384 });
-  chmodSync(temporary, 384);
+  chmodSync2(temporary, 384);
   renameSync(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
@@ -335,6 +382,108 @@ function displayPath(path, rootDir = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
+// src/auth-guidance.ts
+var ENROL_EVERYTHING = "npx odla-ai device enroll --no-open --wait 600";
+var ENROL_PLATFORM_WIDE = "npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600";
+function machineAuthState(audience, env = process7.env) {
+  const device = readDeviceCredential(audience, env);
+  if (!device) return { enrolled: false };
+  const session = readJsonFile(deviceSessionFile(env));
+  const current = session?.platform === audience && session.deviceId === device.deviceId ? session : void 0;
+  return {
+    enrolled: true,
+    ...device.name ? { deviceName: device.name } : {},
+    ...current?.appIds ? { appIds: current.appIds } : {},
+    ...current?.capabilities ? { capabilities: current.capabilities } : {},
+    ...current?.scopes ? { scopes: current.scopes } : {},
+    ...current?.deviceExpiresAt ? { lapsesAt: current.deviceExpiresAt } : {}
+  };
+}
+function scopeInterruptionNotice(scope, state2) {
+  const platformScope = scope.startsWith("platform:");
+  const reason = !state2.enrolled ? "this machine is not enrolled, so every privileged command needs its own browser approval" : `this machine is enrolled but its approval did not include "${scope}"`;
+  return [
+    `odla: ${reason}.`,
+    `   Approve this one now, then end the interruptions with:`,
+    `     ${platformScope ? ENROL_PLATFORM_WIDE : ENROL_EVERYTHING}`,
+    platformScope ? "   A platform scope needs an administrator's approval; an app owner's cannot carry it." : "   One approval, every app you own, and it rolls forward while you keep working."
+  ].join("\n");
+}
+function narrowEnrollmentNotice(envelope) {
+  const everyApp = envelope.appIds.includes("*");
+  if (everyApp && envelope.capabilities.length > 0 && envelope.scopes.length > 0) return null;
+  const missing = [
+    everyApp ? null : `only ${envelope.appIds.length} app${envelope.appIds.length === 1 ? "" : "s"} \u2014 a new one will need a new approval`,
+    envelope.capabilities.length ? null : "no optional capabilities \u2014 app.manage, crm.read and code.session are not included",
+    envelope.scopes.length ? null : "no platform scopes \u2014 runbook edits, config plans and host connect will each ask again"
+  ].filter(Boolean);
+  return [
+    `odla: this is a NARROW enrollment: ${missing.join("; ")}.`,
+    "   That is a fine choice if you meant it. If you did not, drop the flags:",
+    `     ${ENROL_EVERYTHING}`
+  ].join("\n");
+}
+function lapseNotice(state2, now = Date.now()) {
+  if (!state2.enrolled || !state2.lapsesAt) return null;
+  const days = Math.floor((state2.lapsesAt - now) / (24 * 60 * 60 * 1e3));
+  if (days < 0) return "this machine's enrollment has lapsed; the next command will ask for approval";
+  return `idle for ${days} more day${days === 1 ? "" : "s"} before this machine needs approving again (using it resets the clock)`;
+}
+
+// src/cached-credential.ts
+var noted = null;
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  rmSync3(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this account: collecting a handshake retires the",
+    "   principal's other collected credentials, so a second machine supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`,
+    `   To stop needing one: ${ENROL_EVERYTHING}`
+  ].join("\n");
+}
+
+// src/device-session-cache.ts
+import process8 from "process";
+var SKEW_MS = 6e4;
+async function deviceSessionToken(platformUrl, audience, credential2, doFetch, env = process8.env) {
+  const path = deviceSessionFile(env);
+  const cached = readJsonFile(path);
+  if (cached?.token && cached.platform === audience && cached.deviceId === credential2.deviceId && (cached.expiresAt ?? 0) > Date.now() + SKEW_MS) return cached;
+  const minted = await mintDeviceSession(platformUrl, credential2, doFetch);
+  const session = {
+    ...minted,
+    platform: audience,
+    ...credential2.deviceId ? { deviceId: credential2.deviceId } : {}
+  };
+  writePrivateJson(path, session);
+  return session;
+}
+
+// src/machine-identity.ts
+import process9 from "process";
+function readMachineIdentity(audience, env = process9.env) {
+  const stored = readJsonFile(identityFile(env));
+  if (!stored || typeof stored.email !== "string" || !stored.email) return null;
+  return stored.platform === audience ? { platform: audience, email: stored.email } : null;
+}
+function rememberMachineIdentity(audience, email, env = process9.env) {
+  if (!email) return;
+  const existing = readMachineIdentity(audience, env);
+  if (existing?.email === email) return;
+  writePrivateJson(identityFile(env), { platform: audience, email });
+}
+
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   const audience = platformAudience(cfg.platformUrl);
@@ -343,19 +492,19 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const cached = readJsonFile(cfg.local.tokenFile);
   if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
-    if (process6.env.ODLA_DEV_TOKEN) {
-      const declared = process6.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (process10.env.ODLA_DEV_TOKEN) {
+      const declared = process10.env.ODLA_DEV_TOKEN_AUDIENCE;
       if (declared) {
         if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
       } else if (audience !== "https://odla.ai") {
         throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
       }
-      return process6.env.ODLA_DEV_TOKEN;
+      return process10.env.ODLA_DEV_TOKEN;
     }
     const device = readDeviceCredential(audience);
     if (device) {
-      const session = await mintDeviceSession(cfg.platformUrl, device, doFetch);
-      out.error(`auth: session minted by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
+      const session = await deviceSessionToken(cfg.platformUrl, audience, device, doFetch);
+      out.error(`auth: session held by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
       return session.token;
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
@@ -375,7 +524,10 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     doFetch,
     out,
     audience,
-    email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
+    email: handshakeEmail(
+      options.email,
+      (cached?.platform === audience ? cached.email : void 0) ?? readMachineIdentity(audience)?.email
+    ),
     pendingFile: handshakeFile(cfg),
     grantIntent
   };
@@ -392,6 +544,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     expiresAt
   });
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+  rememberMachineIdentity(audience, ctx.email);
   return token;
 }
 async function freshHandshake(ctx, waitMs) {
@@ -461,7 +614,7 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? process6.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? process10.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (/@users\.noreply\.github\.com$/i.test(email)) {
     throw new Error(
       `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
@@ -492,12 +645,12 @@ function platformAudience(value2) {
 }
 
 // src/secret-input.ts
-import process7 from "process";
+import process11 from "process";
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = process7.env[options.fromEnv];
+  if (options.fromEnv) value2 = process11.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -505,7 +658,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = process7.stdin) {
+async function readSecretStream(kind, stream = process11.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -515,9 +668,8 @@ async function readSecretStream(kind, stream = process7.stdin) {
 }
 
 // src/admin-ai-auth.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
-import process8 from "process";
+import { join as join4 } from "path";
+import process12 from "process";
 import { requestToken as requestToken2 } from "@odla-ai/db";
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -525,7 +677,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = process8.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = process12.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -537,7 +689,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = process8.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = process12.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -564,15 +716,28 @@ var SCOPE_PURPOSE = {
 };
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? process8.cwd();
-  const tokenFile = options.tokenFile ?? join3(rootDir, ".odla/admin-token.local.json");
+  const rootDir = options.rootDir ?? process12.cwd();
+  const tokenFile = options.tokenFile ?? scopedTokenFile();
+  adoptRepoLocalCache(join4(rootDir, ".odla/admin-token.local.json"), tokenFile, out);
+  const device = readDeviceCredential(audience);
+  if (device && options.cache !== false) {
+    const session = await deviceSessionToken(platform, audience, device, doFetch);
+    if (session.scopes?.includes(scope)) {
+      out.error(`auth: ${scope} held by this enrolled device`);
+      return session.token;
+    }
+  }
   const cache2 = options.cache === false ? null : readJsonFile(tokenFile);
   const cached = cache2?.platform === audience ? cache2.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.error(`auth: using cached ${scope} grant (${tokenFile})`);
     return cached.token;
   }
-  const email = handshakeEmail(options.email, cache2?.platform === audience ? cache2.email : void 0);
+  out.error(scopeInterruptionNotice(scope, machineAuthState(audience)));
+  const email = handshakeEmail(
+    options.email,
+    (cache2?.platform === audience ? cache2.email : void 0) ?? readMachineIdentity(audience)?.email
+  );
   const { token, expiresAt } = await requestToken2({
     endpoint: audience,
     email,
@@ -592,8 +757,8 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   if (options.cache !== false) {
     const tokens = cache2?.platform === audience ? { ...cache2.tokens ?? {} } : {};
     tokens[scope] = { token, expiresAt };
-    if (existsSync3(join3(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
     writePrivateJson(tokenFile, { platform: audience, email, tokens });
+    rememberMachineIdentity(audience, email);
     out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   } else {
     out.error(`auth: ${scope} grant is in memory only; its credential record remains in odla-ai/db`);
@@ -769,7 +934,7 @@ function isRecord2(value2) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? process9.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? process13.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -1085,12 +1250,12 @@ async function adminSpend(parsed, ctx) {
 
 // src/operator-context.ts
 import { existsSync as existsSync6 } from "fs";
-import { join as join5, resolve as resolve4 } from "path";
-import process11 from "process";
+import { join as join6, resolve as resolve4 } from "path";
+import process15 from "process";
 
 // src/config.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { existsSync as existsSync4, rmSync as rmSync4, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 import { appServiceDefinition, appServiceIds } from "@odla-ai/apps";
 
@@ -1494,13 +1659,17 @@ var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
 var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+var stderr = { error: (message2) => {
+  process.stderr.write(`${message2}
+`);
+} };
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = resolve2(configPath);
   if (!existsSync4(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = dirname3(resolved);
+  const rootDir = dirname4(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -1510,11 +1679,14 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   validateCalendarConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   validateMonitoringConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
-    tokenFile: resolve2(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: resolve2(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    tokenFile: raw.local?.tokenFile ? resolve2(rootDir, raw.local.tokenFile) : appTokenFile(raw.app.id),
+    credentialsFile: raw.local?.credentialsFile ? resolve2(rootDir, raw.local.credentialsFile) : appCredentialsFile(raw.app.id),
     devVarsFile: resolve2(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
+  adoptRepoLocalCache(resolve2(rootDir, ".odla/dev-token.json"), local.tokenFile, stderr);
+  adoptRepoLocalCache(resolve2(rootDir, ".odla/credentials.local.json"), local.credentialsFile, stderr);
+  rmSync4(resolve2(rootDir, ".odla/handshake.local.json"), { force: true });
   return {
     ...raw,
     configPath: resolved,
@@ -1623,17 +1795,17 @@ function unique3(values) {
 
 // src/operator-profiles.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join4, resolve as resolve3 } from "path";
-import process10 from "process";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname5, join as join5, resolve as resolve3 } from "path";
+import process14 from "process";
 function operatorProfileFile() {
   return resolve3(
-    clean(process10.env.ODLA_CONTEXT_FILE) ?? join4(homedir2(), ".odla", "contexts.json")
+    clean(process14.env.ODLA_CONTEXT_FILE) ?? join5(homedir3(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(process10.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(process14.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -1673,10 +1845,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? join4(dirname4(selection.file), "profiles", selection.name) : join4(homedir2(), ".odla");
+  const base = selection.name ? join5(dirname5(selection.file), "profiles", selection.name) : join5(homedir3(), ".odla");
   return {
-    developer: join4(base, "dev-token.json"),
-    scoped: join4(base, "admin-token.local.json")
+    developer: join5(base, "dev-token.json"),
+    scoped: join5(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -1762,13 +1934,13 @@ async function resolveOperatorContext(parsed, options = {}) {
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(process11.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(process15.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(process11.env.ODLA_APP_ID);
+  const appEnvironment = clean2(process15.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) {
@@ -1782,16 +1954,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(process11.env.ODLA_ENV);
+  const envEnvironment = clean2(process15.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? process11.cwd();
+  const rootDir = loaded?.rootDir ?? process15.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(process11.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process11.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(process11.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process11.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join5(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(process15.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process15.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile2 = clean2(process15.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process15.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join6(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -1813,8 +1985,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: join5(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: join5(rootDir, ".dev.vars"),
+      credentialsFile: join6(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: join6(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -1838,7 +2010,7 @@ async function resolveOperatorContext(parsed, options = {}) {
     },
     credentials: {
       developerTokenFile: tokenFile,
-      scopedTokenFile
+      scopedTokenFile: scopedTokenFile2
     }
   };
 }
@@ -1936,7 +2108,7 @@ async function adminCommand(parsed, deps = {}) {
 }
 
 // src/auth-command.ts
-import process12 from "process";
+import process16 from "process";
 
 // src/whoami-command.ts
 var text2 = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
@@ -2072,6 +2244,7 @@ async function whoamiCommand(parsed, deps = {}) {
   } else {
     out.log("projects:   (none \u2014 every pm and discuss call will be refused)");
   }
+  printMachineBlock(cfg.platformUrl, out);
   if (!identity.admin) {
     if (identity.scopes.includes("platform:runbook:write")) {
       out.log("\nThis exact scope can read and edit all platform runbook content.");
@@ -2082,6 +2255,21 @@ async function whoamiCommand(parsed, deps = {}) {
     }
   }
 }
+function printMachineBlock(platformUrl, out) {
+  const state2 = machineAuthState(platformAudience(platformUrl));
+  if (!state2.enrolled) {
+    out.log("\nmachine:    not enrolled \u2014 every privileged command needs its own browser approval.");
+    out.log(`            End that with:
+              ${ENROL_EVERYTHING}`);
+    return;
+  }
+  const reach = state2.appIds?.includes("*") ? "every app you own" : state2.appIds?.join(", ");
+  out.log(`
+machine:    enrolled${state2.deviceName ? ` as "${state2.deviceName}"` : ""}${reach ? ` for ${reach}` : ""}`);
+  if (state2.scopes?.length) out.log(`            carrying ${state2.scopes.join(", ")}`);
+  const lapse = lapseNotice(state2);
+  if (lapse) out.log(`            ${lapse}`);
+}
 
 // src/auth-command.ts
 async function authCommand(parsed, deps = {}) {
@@ -2106,12 +2294,17 @@ async function authCommand(parsed, deps = {}) {
   const { cfg } = context;
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const email = stringOpt(parsed.options.email) ?? process12.env.ODLA_USER_EMAIL?.trim();
+  const email = stringOpt(parsed.options.email) ?? process16.env.ODLA_USER_EMAIL?.trim();
   if (!email) {
     throw new Error(
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
     );
   }
+  if (!machineAuthState(platformAudience(cfg.platformUrl)).enrolled) {
+    out.error("odla: this machine is not enrolled, so this approval buys one project until it lapses.");
+    out.error(`   For one approval that covers every app you own, with no repeats:
+     ${ENROL_EVERYTHING}`);
+  }
   const token = await getDeveloperToken(
     cfg,
     {
@@ -2471,7 +2664,7 @@ async function appCommand(parsed, dependencies = {}) {
 
 // src/brand-command.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname5, resolve as resolve5 } from "path";
+import { dirname as dirname6, resolve as resolve5 } from "path";
 
 // src/brand-design-unpack.ts
 import { gunzipSync } from "zlib";
@@ -2586,7 +2779,7 @@ async function readBundle(source, deps) {
 async function writeAll(result, outDir) {
   for (const file of result.files) {
     const target = resolve5(outDir, file.path);
-    await mkdir(dirname5(target), { recursive: true });
+    await mkdir(dirname6(target), { recursive: true });
     await writeFile(target, file.bytes);
   }
 }
@@ -3152,7 +3345,7 @@ import {
   AppsError,
   createAppsClient
 } from "@odla-ai/apps";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/config-operation-error.ts
 var ConfigOperationCommandError = class extends Error {
@@ -3577,7 +3770,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: join6(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join7(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3632,7 +3825,7 @@ function record4(value2) {
 
 // src/config-reconcile-command.ts
 import { createAppsClient as createAppsClient2, studioAppSettingsPath } from "@odla-ai/apps";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 // src/config-reconcile.ts
 import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
@@ -3928,7 +4121,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: join7(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join8(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4061,26 +4254,26 @@ function quoteArg2(value2) {
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { join as join9, resolve as resolve6 } from "path";
+import { join as join10, resolve as resolve6 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
-  let stderr = "";
+  let stderr2 = "";
   child.stdout.on("data", (chunk) => stdout += chunk.toString());
-  child.stderr.on("data", (chunk) => stderr += chunk.toString());
+  child.stderr.on("data", (chunk) => stderr2 += chunk.toString());
   child.on("error", reject);
-  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr: stderr2 }));
   child.stdin.end(opts?.input ?? "");
 });
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join8(rootDir, name);
+    const path = join9(rootDir, name);
     if (existsSync7(path)) return path;
   }
   return null;
@@ -4231,21 +4424,21 @@ function wranglerWarnings(rootDir) {
   const blocks = [{ label: "", block: config }];
   const envs = config.env;
   if (envs && typeof envs === "object") {
-    for (const [name, block] of Object.entries(envs)) {
-      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+    for (const [name, block2] of Object.entries(envs)) {
+      if (block2 && typeof block2 === "object") blocks.push({ label: `env.${name}.`, block: block2 });
     }
   }
-  for (const { label, block } of blocks) {
-    const assets = block.assets;
+  for (const { label, block: block2 } of blocks) {
+    const assets = block2.assets;
     if (assets?.directory) {
       const dir = resolve6(rootDir, assets.directory);
       if (dir === resolve6(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync8(join9(dir, "node_modules"))) {
+      } else if (existsSync8(join10(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
-    const vars = block.vars;
+    const vars = block2.vars;
     if (vars && typeof vars === "object") {
       for (const [name, value2] of Object.entries(vars)) {
         if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value2 === "string" && looksSecret(value2)) {
@@ -4306,7 +4499,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync8(join9(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync8(join10(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4600,8 +4793,8 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname6, resolve as resolve7 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname7, resolve as resolve7 } from "path";
 import { appServiceDefinition as appServiceDefinition3, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
 function initProject(options) {
   const out = options.stdout ?? console;
@@ -4623,9 +4816,9 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  mkdirSync2(dirname6(configPath), { recursive: true });
-  mkdirSync2(resolve7(rootDir, "src/odla"), { recursive: true });
-  mkdirSync2(resolve7(rootDir, ".odla"), { recursive: true });
+  mkdirSync3(dirname7(configPath), { recursive: true });
+  mkdirSync3(resolve7(rootDir, "src/odla"), { recursive: true });
+  mkdirSync3(resolve7(rootDir, ".odla"), { recursive: true });
   writeFileSync2(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing(resolve7(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing(resolve7(rootDir, "src/odla/rules.mjs"), rulesTemplate());
@@ -4695,8 +4888,10 @@ ${calendar}
     // prod: "https://example.com",
   },
   local: {
-    tokenFile: ".odla/dev-token.json",
-    credentialsFile: ".odla/credentials.local.json",
+    // Credentials live in ~/.odla, per machine, so every worktree of this app
+    // shares one approval instead of asking for its own. Pinning tokenFile or
+    // credentialsFile here still works and still overrides that \u2014 it just puts
+    // this checkout back on its own island.
     devVarsFile: ".dev.vars",
   },
 };
@@ -4932,9 +5127,9 @@ function printReport(report5, out) {
 }
 
 // src/skill.ts
-import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname7, isAbsolute as isAbsolute3, join as join10, relative as relative2, resolve as resolve8, sep } from "path";
+import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync9, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname8, isAbsolute as isAbsolute3, join as join11, relative as relative2, resolve as resolve8, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -5034,7 +5229,7 @@ function installSkill(options = {}) {
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
   const root = resolve8(options.dir ?? process.cwd());
-  const home = resolve8(options.homeDir ?? homedir3());
+  const home = resolve8(options.homeDir ?? homedir4());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -5048,48 +5243,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join10(targetDir2, rel), readFileSync9(join10(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join11(targetDir2, rel), readFileSync9(join11(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join10(home, ".claude", "skills");
-    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join10(home, ".codex"), "skills");
+    const claudeRoot = join11(home, ".claude", "skills");
+    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join11(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : dirname7(dirname7(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : dirname8(dirname8(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join10(root, ".agents", "skills");
+    const sharedRoot = join11(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join10(root, ".claude", "skills");
+    const claudeRoot = join11(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = readFileSync9(join10(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join10(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
+        const canonical2 = readFileSync9(join11(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join11(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join10(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join11(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join10(root, "AGENTS.md");
+      const agentsFile = join11(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join10(root, ".github", "copilot-instructions.md");
+      const copilotFile = join11(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join10(root, "GEMINI.md");
+      const geminiFile = join11(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -5125,7 +5320,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!existsSync10(file.target) || readFileSync9(file.target, "utf8") !== file.content) {
-      mkdirSync3(dirname7(file.target), { recursive: true });
+      mkdirSync4(dirname8(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
   }
@@ -5164,10 +5359,10 @@ function normalizeHarnesses(values, global) {
   }
   return expanded;
 }
-function managedFileContent(path, block, force, boundary) {
+function managedFileContent(path, block2, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!existsSync10(path)) return `${block}
+  if (!existsSync10(path)) return `${block2}
 `;
   const current = readFileSync9(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
@@ -5179,15 +5374,15 @@ function managedFileContent(path, block, force, boundary) {
   }
   if (startAt === -1) {
     const separator = current.length === 0 || current.endsWith("\n\n") ? "" : current.endsWith("\n") ? "\n" : "\n\n";
-    return `${current}${separator}${block}
+    return `${current}${separator}${block2}
 `;
   }
   const afterEnd = endAt + end.length;
   const existing = current.slice(startAt, afterEnd);
-  if (existing !== block && !force) {
+  if (existing !== block2 && !force) {
     throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);
   }
-  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
+  return `${current.slice(0, startAt)}${block2}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
   const rel = relative2(boundary, target);
@@ -5196,7 +5391,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep).filter(Boolean)) {
-    current = join10(current, part);
+    current = join11(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -5213,7 +5408,7 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join10(current, entry.name);
+      const path = join11(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative2(dir, path));
     }
@@ -5581,7 +5776,7 @@ var HARNESS_PROTOCOL_VERSION = 1;
 import { execFile, spawn as spawn3 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
-import { delimiter, join as join11 } from "path";
+import { delimiter, join as join12 } from "path";
 import { getgid, getuid } from "process";
 import { mkdir as mkdir2, mkdtemp, realpath, rm, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir } from "os";
@@ -5599,7 +5794,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
     try {
-      await access(join11(directory, engine), constants.X_OK);
+      await access(join12(directory, engine), constants.X_OK);
       return true;
     } catch {
     }
@@ -5678,7 +5873,7 @@ function allowedWorkspacePath(relativePath) {
 async function gitOutput(cwd, args, maxBytes) {
   const child = spawn22("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -5686,20 +5881,20 @@ async function gitOutput(cwd, args, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
     child.once("exit", accept);
   });
   if (bytes > maxBytes) throw new Error(`git output exceeds ${maxBytes} bytes`);
-  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git command failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   return Buffer.concat(stdout);
 }
 async function gitBlobs(cwd, entries, maxBytes) {
   const child = spawn22("git", ["cat-file", "--batch"], { cwd, stdio: ["pipe", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -5707,7 +5902,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   child.stdin.end(`${entries.map((entry) => entry.hash).join("\n")}
 `);
@@ -5716,7 +5911,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
     child.once("exit", accept);
   });
   if (bytes > maxBytes + entries.length * 100) throw new Error(`Git tree exceeds ${maxBytes} bytes`);
-  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git object read failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   const output = Buffer.concat(stdout);
   const blobs = [];
   let offset = 0;
@@ -5813,7 +6008,7 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     shell: false
   });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let outputBytes = 0;
   child.stdout.on("data", (chunk) => {
     outputBytes += chunk.byteLength;
@@ -5821,14 +6016,14 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
     child.once("exit", accept);
   });
   if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
-  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
   if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
   const root = resolve22(sourceDir);
@@ -5873,7 +6068,7 @@ async function captureGitDiff(root, maxBytes) {
     "workspace"
   ], { cwd: root, stdio: ["ignore", "pipe", "pipe"], shell: false });
   const stdout = [];
-  const stderr = [];
+  const stderr2 = [];
   let bytes = 0;
   child.stdout.on("data", (chunk) => {
     bytes += chunk.byteLength;
@@ -5881,7 +6076,7 @@ async function captureGitDiff(root, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr2.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr2.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
@@ -5889,7 +6084,7 @@ async function captureGitDiff(root, maxBytes) {
   });
   if (bytes > maxBytes) throw new Error(`patch exceeds ${maxBytes} bytes`);
   if (code !== 0 && code !== 1) {
-    throw new Error(`git diff failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+    throw new Error(`git diff failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
   }
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
@@ -6297,10 +6492,10 @@ import { randomUUID } from "crypto";
 import { createHash as createHash22, randomUUID as randomUUID2 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat22 } from "fs/promises";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname9, join as join23, resolve as resolve32, sep as sep23 } from "path";
+import { dirname as dirname10, join as join23, resolve as resolve32, sep as sep23 } from "path";
 import {
   keepRecentExchanges,
   runAgent
@@ -6696,11 +6891,11 @@ function rollup(graph, kind, options = {}) {
 }
 
 // ../graph/dist/code/index.js
-function dirname8(path) {
+function dirname9(path) {
   const at = path.lastIndexOf("/");
   return at <= 0 ? "." : path.slice(0, at);
 }
-function join12(base, specifier) {
+function join13(base, specifier) {
   const parts = [];
   const segments = `${base === "." ? "" : `${base}/`}${specifier}`.split("/");
   for (const segment of segments) {
@@ -6724,7 +6919,7 @@ var BARE_IMPORT = /^\s*import\s*["']([^"']+)["']/gm;
 var isSourcePath = (path) => SOURCE.test(path);
 function resolveImport(fromPath, specifier, known) {
   if (!specifier.startsWith(".")) return null;
-  const base = join12(dirname8(fromPath), specifier);
+  const base = join13(dirname9(fromPath), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -7255,13 +7450,13 @@ function gitApply(cwd, patch2, check) {
       stdio: ["pipe", "ignore", "pipe"],
       env: { PATH: process.env.PATH ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" }
     });
-    let stderr = "";
+    let stderr2 = "";
     child.stderr.setEncoding("utf8");
     child.stderr.on("data", (text3) => {
-      if (stderr.length < 4e3) stderr += text3.slice(0, 4e3);
+      if (stderr2.length < 4e3) stderr2 += text3.slice(0, 4e3);
     });
     child.once("error", reject);
-    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr.trim().slice(0, 500)))));
+    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr2.trim().slice(0, 500)))));
     child.stdin.end(patch2);
   });
 }
@@ -7374,7 +7569,7 @@ function execute(engine, args, name, recipe2, signal) {
     const started = Date.now();
     const child = spawn23(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
     const stdout = [];
-    const stderr = [];
+    const stderr2 = [];
     let bytes = 0;
     let outputLimitExceeded = false;
     let timedOut = false;
@@ -7395,7 +7590,7 @@ function execute(engine, args, name, recipe2, signal) {
       else target.push(chunk);
     };
     child.stdout.on("data", collect(stdout));
-    child.stderr.on("data", collect(stderr));
+    child.stderr.on("data", collect(stderr2));
     const abort = () => stop("abort");
     signal?.addEventListener("abort", abort, { once: true });
     if (signal?.aborted) abort();
@@ -7411,7 +7606,7 @@ function execute(engine, args, name, recipe2, signal) {
       accept({
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdout).toString("utf8"),
-        stderr: Buffer.concat(stderr).toString("utf8"),
+        stderr: Buffer.concat(stderr2).toString("utf8"),
         durationMs: Date.now() - started,
         outputLimitExceeded,
         timedOut
@@ -7527,7 +7722,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = join13(workspaceDir, artifact.path);
+      const path = join14(workspaceDir, artifact.path);
       const info = await lstat22(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
@@ -7563,11 +7758,11 @@ function checkedResult(result, maximumOutputBytes) {
 }
 function boundedLogs(result, maximum) {
   const stdout = Buffer.from(result.stdout);
-  const stderr = Buffer.from(result.stderr);
+  const stderr2 = Buffer.from(result.stderr);
   const first = stdout.subarray(0, maximum);
   return {
     stdout: first.toString("utf8"),
-    stderr: stderr.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
+    stderr: stderr2.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
   };
 }
 function digestPolicy(policy) {
@@ -7813,7 +8008,7 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
       if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
       const target = resolve32(sourceDir, file.path);
       if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code source path escapes its root");
-      await mkdir3(dirname9(target), { recursive: true });
+      await mkdir3(dirname10(target), { recursive: true });
       await writeFile3(target, file.content, { flag: "wx", mode: 420 });
     }
     for (const reference of snapshot.references ?? []) {
@@ -7828,7 +8023,7 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
         if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
         const target = resolve32(sourceDir, path);
         if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
-        await mkdir3(dirname9(target), { recursive: true });
+        await mkdir3(dirname10(target), { recursive: true });
         await writeFile3(target, file.content, { flag: "wx", mode: 292 });
       }
     }
@@ -7855,7 +8050,7 @@ async function attachCodeRuntimeReferences(workspace, references) {
       for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
         const target = resolve32(root, path);
         if (!target.startsWith(`${resolve32(root)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
-        await mkdir3(dirname9(target), { recursive: true });
+        await mkdir3(dirname10(target), { recursive: true });
         await writeFile3(target, file.content, { flag: "wx", mode: 292 });
       }
     }
@@ -10073,13 +10268,13 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-import process13 from "process";
+import process17 from "process";
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(process13.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(process17.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -10273,6 +10468,30 @@ async function credentialCommand(parsed, deps = {}) {
 }
 
 // src/help-usage.ts
+var AUTH_SECTION = `
+Enrol this machine once, then stop asking:
+  npx odla-ai device enroll --no-open --wait 600
+      One browser approval, and no flags to remember: this covers every app you
+      own \u2014 including apps you create later \u2014 with every capability that
+      approval can carry. Afterwards every worktree on this machine mints its
+      own short-lived credentials with nobody's attention. The window rolls
+      forward each time you use it, so continuous work never interrupts anyone;
+      only a real gap does. Give the human the printed /studio?code= URL, keep
+      the process alive, and wait on it.
+      Narrow it deliberately with --app <id> or --capability <c>; the CLI then
+      says what that gave up.
+
+  npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600
+      The same thing across all of odla, for weeks. Needs a platform
+      administrator's approval \u2014 an app owner's cannot carry platform scopes.
+
+  npx odla-ai whoami        what this machine holds and when it lapses
+  npx odla-ai device list   every machine you have enrolled
+
+Enrollment is the only human decision here. Revoking a machine, purging an app,
+transferring ownership, and rotating credentials still need a signed-in human in
+Studio, and no machine credential can do them however wide its approval was.
+`;
 var USAGE_SECTION = `
 Start here:
   odla-ai runbook ask "<question>"   The current procedure, from odla's own
@@ -10311,7 +10530,7 @@ Usage:
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm project list [--app <product-id>] [--status <s>] [--json]
   odla-ai pm project add --app <product-id> --name <name> [--description <text>] [--json]
-  odla-ai pm project use <project-id> [--json]                         [saved locally in this worktree]
+  odla-ai pm project use <project-id> [--json]                         [saved for this app, on this machine]
   odla-ai pm goal list [--app <id>] [--project <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -10403,7 +10622,8 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device enroll [--app <id>[,<id>...]|--all-apps] [--capability all|<c>[,<c>...]] [--platform-wide]
+    [--name <label>] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--wait <seconds>] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
@@ -10417,8 +10637,11 @@ Usage:
 
 // src/help.ts
 function printHelp(output = console) {
-  output.log(`odla-ai
-${USAGE_SECTION}
+  output.log(helpText());
+}
+function helpText() {
+  return `odla-ai
+${AUTH_SECTION}${USAGE_SECTION}
 Commands:
   auth         Start a fresh, exact-project agent authorization for human review.
                The email is the signed-in odla account, never git or GitHub
@@ -10491,8 +10714,9 @@ Commands:
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
   pm           Project management (via @odla-ai/pm): Products contain Projects;
                projects contain goals, kanban tasks, decisions, and bugs. Use
-               "pm project list|add|use" to select worktree-local context, or
-               pass --app/--project explicitly. Same device-grant auth as "app".
+               "pm project list|add|use" selects a project for this app on this
+               machine \u2014 every worktree shares it \u2014 or pass --app/--project
+               explicitly. Same device-grant auth as "app".
                Status changes and comments post to each item's @odla-ai/chat
                discussion thread.
                NOTE: "--column ready" is OWNER-ONLY. Creating a task in Ready
@@ -10521,9 +10745,22 @@ Commands:
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
   device       Enrol THIS machine once, then stop asking. A human approves the
-               enrollment in the browser; from then on this terminal mints its
-               own short-lived credentials for the named projects with nobody's
-               attention, until the device expires or is revoked.
+               enrollment in the browser; from then on EVERY worktree on this
+               machine mints its own short-lived credentials with nobody's
+               attention, until the device is revoked or goes unused.
+               With no flags it covers every app you own, now and later, with
+               every capability that approval can carry \u2014 so creating an app
+               costs no new approval, and a capability nobody thought to name is
+               not a 403 next week. "--app" or "--capability" narrow it
+               deliberately, and the CLI says what that gave up.
+               "--platform-wide" is the administrator's version, across all of
+               odla.
+               The expiry is a GAP, not a clock: each use rolls it forward, so
+               only going quiet brings a human back into the loop \u2014 which is
+               where anything that changed can be explained.
+               "device list" shows what each machine holds and when it lapses;
+               revoking one takes down every credential it ever minted, and is
+               deliberately a signed-in human's decision in Studio.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
@@ -10619,7 +10856,46 @@ Safety:
   Run security plan first to inspect the admin-selected providers, models,
   per-route bounds, credential readiness, retention, no-execution boundary,
   and digest that binds consent to that exact plan.
-`);
+`;
+}
+
+// src/help-command.ts
+function printCommandHelp(command, output = console) {
+  const lines = helpText().split("\n");
+  const usage = allBlocks(lines, new RegExp(`^  odla-ai ${escapeRe(command)}(\\s|$)`));
+  const prose = block(lines, (line2) => new RegExp(`^  ${escapeRe(command)}\\s\\s+\\S`).test(line2));
+  if (usage.length === 0 && prose.length === 0) {
+    output.log(`odla-ai: no command "${command}". Run "odla-ai help" for all of them.`);
+    return;
+  }
+  output.log([
+    ...prose.length ? [prose.join("\n"), ""] : [],
+    ...usage.length ? ["Usage:", ...usage, ""] : [],
+    AUTH_SECTION.trimEnd()
+  ].join("\n"));
+}
+function allBlocks(lines, pattern) {
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!pattern.test(lines[i])) continue;
+    out.push(...block(lines.slice(i), (line2) => line2 === lines[i]));
+  }
+  return out;
+}
+function block(lines, starts) {
+  const first = lines.findIndex(starts);
+  if (first === -1) return [];
+  const indent = lines[first].length - lines[first].trimStart().length;
+  const out = [lines[first]];
+  for (const line2 of lines.slice(first + 1)) {
+    if (!line2.trim()) break;
+    if (line2.length - line2.trimStart().length <= indent) break;
+    out.push(line2);
+  }
+  return out;
+}
+function escapeRe(value2) {
+  return value2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 // src/discuss-principals.ts
@@ -11776,14 +12052,36 @@ async function pmWatch(ctx, parsed) {
 }
 
 // src/pm-project-context.ts
+import { existsSync as existsSync12, rmSync as rmSync5 } from "fs";
 import { resolve as resolve12 } from "path";
-var pmProjectContextFile = (rootDir) => resolve12(rootDir, ".odla", "pm-project.local.json");
+var pmProjectContextFile = () => pmContextFile();
 function readPmProjectContext(rootDir) {
-  const value2 = readJsonFile(pmProjectContextFile(rootDir));
-  return value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" ? value2 : null;
+  adoptLegacySelection(rootDir);
+  const entries = Object.values(readSelections()).filter(isSelection);
+  return entries.sort((a, b) => b.selectedAt.localeCompare(a.selectedAt))[0] ?? null;
 }
 function writePmProjectContext(rootDir, value2) {
-  writePrivateJson(pmProjectContextFile(rootDir), { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  adoptLegacySelection(rootDir);
+  writePrivateJson(pmProjectContextFile(), {
+    ...readSelections(),
+    [value2.appId]: { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() }
+  });
+}
+function adoptLegacySelection(rootDir) {
+  const legacy = resolve12(rootDir, ".odla", "pm-project.local.json");
+  if (!existsSync12(legacy)) return;
+  const previous = readJsonFile(legacy);
+  rmSync5(legacy, { force: true });
+  if (!isSelection(previous)) return;
+  const selections = readSelections();
+  if (selections[previous.appId]) return;
+  writePrivateJson(pmProjectContextFile(), { ...selections, [previous.appId]: previous });
+}
+function readSelections() {
+  return readJsonFile(pmProjectContextFile()) ?? {};
+}
+function isSelection(value2) {
+  return !!value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" && typeof value2.selectedAt === "string";
 }
 
 // src/pm-project-actions.ts
@@ -12808,7 +13106,7 @@ function percent(value2) {
 // src/provision.ts
 import { AppsError as AppsError2, createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor6 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
-import process14 from "process";
+import process18 from "process";
 
 // src/integration-provision.ts
 import { uuidv7 } from "@odla-ai/db";
@@ -13246,7 +13544,7 @@ async function provision(options) {
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process14.env[cfg.ai.keyEnv];
+      const key = process18.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret2({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -13288,7 +13586,7 @@ async function provision(options) {
 
 // src/record.ts
 import { appendFileSync } from "fs";
-import process15 from "process";
+import process19 from "process";
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -13470,7 +13768,7 @@ function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = process15.env.ODLA_CLI_RECORD;
+  const file = process19.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -13496,10 +13794,17 @@ function advisoryCollectingFetch(inner, sink) {
     return response2;
   });
 }
+var superseded = /* @__PURE__ */ new Set();
+function supersedeAdvisory(code) {
+  superseded.add(code);
+}
 function renderAdvisories(out, advisories, env = process.env) {
+  const retracted = new Set(superseded);
+  superseded.clear();
   if (env.ODLA_NO_ADVISORIES) return;
   const seen = /* @__PURE__ */ new Set();
   for (const advisory of advisories) {
+    if (retracted.has(advisory.code)) continue;
     const key = `${advisory.code}:${advisory.message}`;
     if (seen.has(key)) continue;
     seen.add(key);
@@ -13507,6 +13812,14 @@ function renderAdvisories(out, advisories, env = process.env) {
   }
 }
 
+// src/device-command.ts
+import {
+  ADMIN_DEVICE_SCOPES,
+  ALL_OWNED_APPS,
+  OPTIONAL_AGENT_PROJECT_CAPABILITIES,
+  OWNER_DEVICE_SCOPES
+} from "@odla-ai/db";
+
 // src/device-ttl.ts
 var OWNER_DEVICE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var DAY_MS = 24 * 60 * 60 * 1e3;
@@ -13526,10 +13839,26 @@ function parseDeviceTtl(raw) {
 }
 
 // src/device-command.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname10 } from "path";
-import process16 from "process";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname11 } from "path";
+import process20 from "process";
 async function deviceCommand(parsed, deps) {
+  assertArgs(parsed, [
+    "app",
+    "all-apps",
+    "platform-wide",
+    "name",
+    "capability",
+    "device-ttl",
+    "email",
+    "open",
+    "json",
+    "config",
+    "token",
+    "context",
+    "platform",
+    "wait"
+  ], 3);
   const action2 = parsed.positionals[1] ?? "";
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
@@ -13542,10 +13871,19 @@ async function deviceCommand(parsed, deps) {
 }
 async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
-  const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
-  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
+  const platformWide = parsed.options["platform-wide"] === true;
+  const narrowed = stringOpt(parsed.options.app) !== void 0 || stringOpt(parsed.options.capability) !== void 0;
+  const apps = platformWide || parsed.options["all-apps"] === true || !narrowed ? [ALL_OWNED_APPS] : (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
+  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026], or --all-apps");
   const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
-  const extended = deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const extended = platformWide || deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const { capabilities, scopes } = requestedEnvelope(parsed, platformWide, narrowed);
+  const narrowNotice = narrowEnrollmentNotice({
+    appIds: apps,
+    capabilities: capabilities ?? [],
+    scopes: scopes ?? []
+  });
+  if (narrowNotice) out.error(narrowNotice);
   const token = await scopedToken2(
     parsed,
     deps,
@@ -13560,9 +13898,10 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
     body: JSON.stringify({
       name,
-      platform: process16.platform,
+      platform: process20.platform,
       appIds: apps,
-      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {},
+      ...capabilities ? { capabilities } : {},
+      ...scopes ? { scopes } : {},
       ...deviceTtlMs === void 0 ? {} : { deviceTtlMs }
     })
   });
@@ -13571,19 +13910,54 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     throw new Error(`device enroll failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
   }
   const path = deviceCredentialPath();
-  mkdirSync4(dirname10(path), { recursive: true });
+  mkdirSync5(dirname11(path), { recursive: true });
   writeFileSync4(path, JSON.stringify({
     token: body.token,
     platform: cfg.platformUrl.replace(/\/$/, ""),
     deviceId: body.device.deviceId,
     name
   }, null, 2));
-  chmodSync2(path, 384);
-  out.error(`device: enrolled "${name}" for ${body.device.appIds.join(", ")}; credential written to ${path}`);
-  out.error("device: this terminal will mint its own credentials from now on \u2014 no further approvals.");
+  chmodSync3(path, 384);
+  rememberMachineIdentity(cfg.platformUrl.replace(/\/$/, ""), stringOpt(parsed.options.email));
+  supersedeAdvisory("credential.expiring");
+  const reach = body.device.appIds.includes(ALL_OWNED_APPS) ? "every app you own, now and later" : body.device.appIds.join(", ");
+  out.error(`device: enrolled "${name}" for ${reach}; credential written to ${path}`);
+  if (narrowNotice) out.error(narrowNotice);
+  out.error(
+    "device: every worktree on this machine mints its own credentials from now on \u2014 no further approvals,"
+  );
+  out.error(
+    `device: and the clock resets each time you use it. Going quiet for ${describeWindow(body.device.expiresAt)} is what ends it.`
+  );
   if (json) {
-    out.log(JSON.stringify({ deviceId: body.device.deviceId, name, appIds: body.device.appIds, expiresAt: body.device.expiresAt }, null, 2));
+    out.log(JSON.stringify({
+      deviceId: body.device.deviceId,
+      name,
+      appIds: body.device.appIds,
+      capabilities: body.device.capabilities ?? [],
+      scopes: body.device.scopes ?? [],
+      expiresAt: body.device.expiresAt,
+      hardExpiresAt: body.device.hardExpiresAt ?? null
+    }, null, 2));
+  }
+}
+function requestedEnvelope(parsed, platformWide, narrowed) {
+  const raw = stringOpt(parsed.options.capability);
+  const everything = platformWide || !narrowed || raw?.trim().toLowerCase() === "all";
+  if (everything) {
+    return {
+      capabilities: [...OPTIONAL_AGENT_PROJECT_CAPABILITIES],
+      scopes: platformWide ? [...ADMIN_DEVICE_SCOPES] : [...OWNER_DEVICE_SCOPES]
+    };
   }
+  const named = raw?.split(",").map((c) => c.trim()).filter(Boolean);
+  return named?.length ? { capabilities: named } : {};
+}
+function describeWindow(expiresAt, now = Date.now()) {
+  const days = Math.max(1, Math.round((expiresAt - now) / (24 * 60 * 60 * 1e3)));
+  if (days >= 365) return `${Math.round(days / 365)} year${days >= 730 ? "s" : ""}`;
+  if (days % 7 === 0) return `${days / 7} week${days > 7 ? "s" : ""}`;
+  return `${days} day${days === 1 ? "" : "s"}`;
 }
 async function list2(parsed, deps, cfg, doFetch, out, json) {
   const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device list)");
@@ -13598,12 +13972,17 @@ async function list2(parsed, deps, cfg, doFetch, out, json) {
   if (body.devices.length === 0) return out.log("no enrolled devices");
   for (const device of body.devices) {
     const state2 = device.revokedAt ? "revoked" : device.expiresAt <= Date.now() ? "expired" : "active";
-    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${device.appIds.join(", ")}]`);
+    const reach = device.appIds.includes("*") ? "every app you own" : device.appIds.join(", ");
+    const gap = state2 === "active" ? `  idle ${describeWindow(device.expiresAt)} left` : "";
+    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${reach}]${gap}`);
   }
 }
 async function revoke(parsed, deps, cfg, doFetch, out, json) {
   const deviceId = parsed.positionals[2];
   if (!deviceId) throw new Error("device revoke needs the device id from `odla-ai device list`");
+  out.error(
+    `device: revoking is a signed-in human's decision; if this is refused, open ${cfg.platformUrl}/studio and revoke it there.`
+  );
   const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device revoke)");
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices/${encodeURIComponent(deviceId)}/revoke`, {
     method: "POST",
@@ -13622,7 +14001,7 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
     // A device is granted the apps named in ONE approval, so --app is a list here.
     allowAppList: true
   });
-  const scopedTokenFile = credentials.scopedTokenFile;
+  const scopedTokenFile2 = credentials.scopedTokenFile;
   return getScopedPlatformToken({
     platform: cfg.platformUrl,
     scope,
@@ -13633,12 +14012,12 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     openApprovalUrl: deps.openUrl,
     rootDir: cfg.rootDir,
-    tokenFile: scopedTokenFile,
+    tokenFile: scopedTokenFile2,
     ...stringOpt(parsed.options.token) ? { token: stringOpt(parsed.options.token) } : {}
   });
 }
 function defaultDeviceName() {
-  return `${process16.env.HOSTNAME ?? process16.env.HOST ?? "machine"}-${process16.platform}`;
+  return `${process20.env.HOSTNAME ?? process20.env.HOST ?? "machine"}-${process20.platform}`;
 }
 
 // src/runbook-actions.ts
@@ -13782,7 +14161,7 @@ async function runbookRemove(ctx, slug) {
 
 // src/runbook-import.ts
 import { readFileSync as readFileSync11, readdirSync as readdirSync2, statSync } from "fs";
-import { basename as basename2, join as join14 } from "path";
+import { basename as basename2, join as join15 } from "path";
 function parseRunbook(text3, slug) {
   let rest = text3;
   const meta = {};
@@ -13812,7 +14191,7 @@ function readRunbookDir(dir) {
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = basename2(file, ".md");
-    const parsed = parseRunbook(readFileSync11(join14(dir, file), "utf8"), slug);
+    const parsed = parseRunbook(readFileSync11(join15(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -13880,8 +14259,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { join as join16 } from "path";
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -14050,8 +14429,8 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = join15(root, workspace, "package.json");
-    if (!existsSync12(manifest)) return void 0;
+    const manifest = join16(root, workspace, "package.json");
+    if (!existsSync13(manifest)) return void 0;
     try {
       const name = JSON.parse(readFileSync12(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
@@ -14120,7 +14499,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join15(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join16(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -14247,12 +14626,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join16 } from "path";
-import process17 from "process";
+import { join as join17 } from "path";
+import process21 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = process17.env) {
+function resolveEditor(env = process21.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -14266,8 +14645,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? process17.env;
-  const interactive = deps.interactive ?? (() => Boolean(process17.stdin.isTTY));
+  const env = deps.env ?? process21.env;
+  const interactive = deps.interactive ?? (() => Boolean(process21.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -14275,8 +14654,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = mkdtempSync(join16(tmpdir4(), "odla-runbook-"));
-  const file = join16(dir, `${slug}.md`);
+  const dir = mkdtempSync(join17(tmpdir4(), "odla-runbook-"));
+  const file = join17(dir, `${slug}.md`);
   try {
     writeFileSync5(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -14284,7 +14663,7 @@ function editText(initial, slug, deps = {}) {
     const edited = readFileSync13(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    rmSync3(dir, { recursive: true, force: true });
+    rmSync6(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -15196,8 +15575,10 @@ async function dispatchCli(argv, dependencies) {
     return;
   }
   if (command === "help" || command === "--help" || command === "-h") {
-    assertArgs(parsed, ["help"], 1);
-    printHelp(runtime.stdout);
+    assertArgs(parsed, ["help"], 2);
+    const topic = parsed.positionals[1];
+    if (topic) printCommandHelp(topic, runtime.stdout);
+    else printHelp(runtime.stdout);
     return;
   }
   if (command === "whoami") {
@@ -15411,4 +15792,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-WJAN5CZ2.js.map
+//# sourceMappingURL=chunk-2IHE5U3M.js.map