@odla-ai/cli 0.39.0 → 0.40.0

package/dist/{cli-ALS5OZPB.js → cli-LRJBESE6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-PJ3RATDD.js";
+} from "./chunk-2IHE5U3M.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-ALS5OZPB.js.map
+//# sourceMappingURL=cli-LRJBESE6.js.map

package/dist/index.cjs

@@ -295,6 +295,11 @@ var import_node_os2 = require("os");
 var import_node_path3 = require("path");
 var import_node_process5 = __toESM(require("process"), 1);
 function odlaHome(env = import_node_process5.default.env) {
+  if (env.VITEST && !env.ODLA_HOME) {
+    throw new Error(
+      "ODLA_HOME must be set under test \u2014 resolving the real ~/.odla would write to the developer's machine"
+    );
+  }
   return env.ODLA_HOME ?? (0, import_node_path3.join)(env.HOME ?? (0, import_node_os2.homedir)(), ".odla");
 }
 function odlaHomePath(segments, env = import_node_process5.default.env) {
@@ -320,15 +325,15 @@ function pmContextFile(env) {
 }
 function adoptRepoLocalCache(legacyPath, machinePath, out) {
   if (!(0, import_node_fs3.existsSync)(legacyPath) || legacyPath === machinePath) return false;
-  const superseded = (0, import_node_fs3.existsSync)(machinePath);
-  if (!superseded) {
+  const superseded2 = (0, import_node_fs3.existsSync)(machinePath);
+  if (!superseded2) {
     (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(machinePath), { recursive: true });
     (0, import_node_fs3.copyFileSync)(legacyPath, machinePath);
     (0, import_node_fs3.chmodSync)(machinePath, 384);
   }
   (0, import_node_fs3.rmSync)(legacyPath, { force: true });
   out?.error(
-    superseded ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
+    superseded2 ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
   );
   return true;
 }
@@ -465,7 +470,7 @@ function displayPath(path, rootDir = process.cwd()) {
 }
 
 // src/auth-guidance.ts
-var ENROL_EVERYTHING = "npx odla-ai device enroll --all-apps --capability all --no-open --wait 600";
+var ENROL_EVERYTHING = "npx odla-ai device enroll --no-open --wait 600";
 var ENROL_PLATFORM_WIDE = "npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600";
 function machineAuthState(audience, env = import_node_process6.default.env) {
   const device = readDeviceCredential(audience, env);
@@ -491,6 +496,20 @@ function scopeInterruptionNotice(scope, state2) {
     platformScope ? "   A platform scope needs an administrator's approval; an app owner's cannot carry it." : "   One approval, every app you own, and it rolls forward while you keep working."
   ].join("\n");
 }
+function narrowEnrollmentNotice(envelope) {
+  const everyApp = envelope.appIds.includes("*");
+  if (everyApp && envelope.capabilities.length > 0 && envelope.scopes.length > 0) return null;
+  const missing = [
+    everyApp ? null : `only ${envelope.appIds.length} app${envelope.appIds.length === 1 ? "" : "s"} \u2014 a new one will need a new approval`,
+    envelope.capabilities.length ? null : "no optional capabilities \u2014 app.manage, crm.read and code.session are not included",
+    envelope.scopes.length ? null : "no platform scopes \u2014 runbook edits, config plans and host connect will each ask again"
+  ].filter(Boolean);
+  return [
+    `odla: this is a NARROW enrollment: ${missing.join("; ")}.`,
+    "   That is a fine choice if you meant it. If you did not, drop the flags:",
+    `     ${ENROL_EVERYTHING}`
+  ].join("\n");
+}
 function lapseNotice(state2, now = Date.now()) {
   if (!state2.enrolled || !state2.lapsesAt) return null;
   const days = Math.floor((state2.lapsesAt - now) / (24 * 60 * 60 * 1e3));
@@ -2368,6 +2387,11 @@ async function authCommand(parsed, deps = {}) {
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
     );
   }
+  if (!machineAuthState(platformAudience(cfg.platformUrl)).enrolled) {
+    out.error("odla: this machine is not enrolled, so this approval buys one project until it lapses.");
+    out.error(`   For one approval that covers every app you own, with no repeats:
+     ${ENROL_EVERYTHING}`);
+  }
   const token = await getDeveloperToken(
     cfg,
     {
@@ -10573,13 +10597,16 @@ async function credentialCommand(parsed, deps = {}) {
 // src/help-usage.ts
 var AUTH_SECTION = `
 Enrol this machine once, then stop asking:
-  npx odla-ai device enroll --all-apps --capability all --no-open --wait 600
-      One browser approval. Afterwards every worktree on this machine mints its
-      own short-lived credentials with nobody's attention, for every app you
-      own \u2014 including apps you create later. The window rolls forward each time
-      you use it, so continuous work never interrupts anyone; only a real gap
-      does. Give the human the printed /studio?code= URL, keep the process
-      alive, and wait on it.
+  npx odla-ai device enroll --no-open --wait 600
+      One browser approval, and no flags to remember: this covers every app you
+      own \u2014 including apps you create later \u2014 with every capability that
+      approval can carry. Afterwards every worktree on this machine mints its
+      own short-lived credentials with nobody's attention. The window rolls
+      forward each time you use it, so continuous work never interrupts anyone;
+      only a real gap does. Give the human the printed /studio?code= URL, keep
+      the process alive, and wait on it.
+      Narrow it deliberately with --app <id> or --capability <c>; the CLI then
+      says what that gave up.
 
   npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600
       The same thing across all of odla, for weeks. Needs a platform
@@ -10722,7 +10749,7 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--all-apps|--app <id>[,<id>...]] [--capability all|<c>[,<c>...]] [--platform-wide]
+  odla-ai device enroll [--app <id>[,<id>...]|--all-apps] [--capability all|<c>[,<c>...]] [--platform-wide]
     [--name <label>] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--wait <seconds>] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
@@ -10848,11 +10875,13 @@ Commands:
                enrollment in the browser; from then on EVERY worktree on this
                machine mints its own short-lived credentials with nobody's
                attention, until the device is revoked or goes unused.
-               "--all-apps" covers every app you own, now and later, so creating
-               an app costs no new approval. "--capability all" takes everything
-               that approval is allowed to carry, so a capability you did not
-               think to name is not a 403 next week. "--platform-wide" is the
-               administrator's version, across all of odla.
+               With no flags it covers every app you own, now and later, with
+               every capability that approval can carry \u2014 so creating an app
+               costs no new approval, and a capability nobody thought to name is
+               not a 403 next week. "--app" or "--capability" narrow it
+               deliberately, and the CLI says what that gave up.
+               "--platform-wide" is the administrator's version, across all of
+               odla.
                The expiry is a GAP, not a clock: each use rolls it forward, so
                only going quiet brings a human back into the loop \u2014 which is
                where anything that changed can be explained.
@@ -13892,10 +13921,17 @@ function advisoryCollectingFetch(inner, sink) {
     return response2;
   });
 }
+var superseded = /* @__PURE__ */ new Set();
+function supersedeAdvisory(code) {
+  superseded.add(code);
+}
 function renderAdvisories(out, advisories, env = process.env) {
+  const retracted = new Set(superseded);
+  superseded.clear();
   if (env.ODLA_NO_ADVISORIES) return;
   const seen = /* @__PURE__ */ new Set();
   for (const advisory of advisories) {
+    if (retracted.has(advisory.code)) continue;
     const key = `${advisory.code}:${advisory.message}`;
     if (seen.has(key)) continue;
     seen.add(key);
@@ -13958,11 +13994,18 @@ async function deviceCommand(parsed, deps) {
 async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
   const platformWide = parsed.options["platform-wide"] === true;
-  const apps = platformWide || parsed.options["all-apps"] === true ? [import_db4.ALL_OWNED_APPS] : (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
+  const narrowed = stringOpt(parsed.options.app) !== void 0 || stringOpt(parsed.options.capability) !== void 0;
+  const apps = platformWide || parsed.options["all-apps"] === true || !narrowed ? [import_db4.ALL_OWNED_APPS] : (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
   if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026], or --all-apps");
   const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
   const extended = platformWide || deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
-  const { capabilities, scopes } = requestedEnvelope(parsed, platformWide);
+  const { capabilities, scopes } = requestedEnvelope(parsed, platformWide, narrowed);
+  const narrowNotice = narrowEnrollmentNotice({
+    appIds: apps,
+    capabilities: capabilities ?? [],
+    scopes: scopes ?? []
+  });
+  if (narrowNotice) out.error(narrowNotice);
   const token = await scopedToken2(
     parsed,
     deps,
@@ -13998,8 +14041,10 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
   }, null, 2));
   (0, import_node_fs19.chmodSync)(path, 384);
   rememberMachineIdentity(cfg.platformUrl.replace(/\/$/, ""), stringOpt(parsed.options.email));
+  supersedeAdvisory("credential.expiring");
   const reach = body.device.appIds.includes(import_db4.ALL_OWNED_APPS) ? "every app you own, now and later" : body.device.appIds.join(", ");
   out.error(`device: enrolled "${name}" for ${reach}; credential written to ${path}`);
+  if (narrowNotice) out.error(narrowNotice);
   out.error(
     "device: every worktree on this machine mints its own credentials from now on \u2014 no further approvals,"
   );
@@ -14018,9 +14063,9 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     }, null, 2));
   }
 }
-function requestedEnvelope(parsed, platformWide) {
+function requestedEnvelope(parsed, platformWide, narrowed) {
   const raw = stringOpt(parsed.options.capability);
-  const everything = platformWide || raw?.trim().toLowerCase() === "all";
+  const everything = platformWide || !narrowed || raw?.trim().toLowerCase() === "all";
   if (everything) {
     return {
       capabilities: [...import_db4.OPTIONAL_AGENT_PROJECT_CAPABILITIES],