@odla-ai/cli 0.39.0 → 0.40.1

package/dist/bin.js

@@ -174,7 +174,7 @@ function absoluteEntryPath(entryPath) {
 
 // src/bin.ts
 var argv = process.argv.slice(2);
-requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-ALS5OZPB.js")).runCli()).catch((err) => {
+requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-WJSQEBDO.js")).runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });

package/dist/{chunk-PJ3RATDD.js → chunk-XUTMQMXZ.js}

@@ -208,6 +208,11 @@ import { homedir as homedir2 } from "os";
 import { dirname as dirname2, join as join3 } from "path";
 import process6 from "process";
 function odlaHome(env = process6.env) {
+  if (env.VITEST && !env.ODLA_HOME) {
+    throw new Error(
+      "ODLA_HOME must be set under test \u2014 resolving the real ~/.odla would write to the developer's machine"
+    );
+  }
   return env.ODLA_HOME ?? join3(env.HOME ?? homedir2(), ".odla");
 }
 function odlaHomePath(segments, env = process6.env) {
@@ -233,15 +238,15 @@ function pmContextFile(env) {
 }
 function adoptRepoLocalCache(legacyPath, machinePath, out) {
   if (!existsSync2(legacyPath) || legacyPath === machinePath) return false;
-  const superseded = existsSync2(machinePath);
-  if (!superseded) {
+  const superseded2 = existsSync2(machinePath);
+  if (!superseded2) {
     mkdirSync(dirname2(machinePath), { recursive: true });
     copyFileSync(legacyPath, machinePath);
     chmodSync(machinePath, 384);
   }
   rmSync2(legacyPath, { force: true });
   out?.error(
-    superseded ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
+    superseded2 ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
   );
   return true;
 }
@@ -378,7 +383,7 @@ function displayPath(path, rootDir = process.cwd()) {
 }
 
 // src/auth-guidance.ts
-var ENROL_EVERYTHING = "npx odla-ai device enroll --all-apps --capability all --no-open --wait 600";
+var ENROL_EVERYTHING = "npx odla-ai device enroll --no-open --wait 600";
 var ENROL_PLATFORM_WIDE = "npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600";
 function machineAuthState(audience, env = process7.env) {
   const device = readDeviceCredential(audience, env);
@@ -404,6 +409,20 @@ function scopeInterruptionNotice(scope, state2) {
     platformScope ? "   A platform scope needs an administrator's approval; an app owner's cannot carry it." : "   One approval, every app you own, and it rolls forward while you keep working."
   ].join("\n");
 }
+function narrowEnrollmentNotice(envelope) {
+  const everyApp = envelope.appIds.includes("*");
+  if (everyApp && envelope.capabilities.length > 0 && envelope.scopes.length > 0) return null;
+  const missing = [
+    everyApp ? null : `only ${envelope.appIds.length} app${envelope.appIds.length === 1 ? "" : "s"} \u2014 a new one will need a new approval`,
+    envelope.capabilities.length ? null : "no optional capabilities \u2014 app.manage, crm.read and code.session are not included",
+    envelope.scopes.length ? null : "no platform scopes \u2014 runbook edits, config plans and host connect will each ask again"
+  ].filter(Boolean);
+  return [
+    `odla: this is a NARROW enrollment: ${missing.join("; ")}.`,
+    "   That is a fine choice if you meant it. If you did not, drop the flags:",
+    `     ${ENROL_EVERYTHING}`
+  ].join("\n");
+}
 function lapseNotice(state2, now = Date.now()) {
   if (!state2.enrolled || !state2.lapsesAt) return null;
   const days = Math.floor((state2.lapsesAt - now) / (24 * 60 * 60 * 1e3));
@@ -2281,6 +2300,11 @@ async function authCommand(parsed, deps = {}) {
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
     );
   }
+  if (!machineAuthState(platformAudience(cfg.platformUrl)).enrolled) {
+    out.error("odla: this machine is not enrolled, so this approval buys one project until it lapses.");
+    out.error(`   For one approval that covers every app you own, with no repeats:
+     ${ENROL_EVERYTHING}`);
+  }
   const token = await getDeveloperToken(
     cfg,
     {
@@ -6121,7 +6145,7 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
   }
 }
 
-// ../harness/dist/chunk-UVGZHNLW.js
+// ../harness/dist/chunk-L2T3LPEF.js
 import { createHash as createHash3 } from "crypto";
 import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
 import { relative as relative4, resolve as resolve10 } from "path";
@@ -6458,7 +6482,7 @@ function validateSnapshot(snapshot, limits) {
   }
 }
 
-// ../harness/dist/chunk-UVGZHNLW.js
+// ../harness/dist/chunk-L2T3LPEF.js
 import { spawn as spawn4 } from "child_process";
 import { lstat as lstat2 } from "fs/promises";
 import { resolve as resolve23, sep as sep3 } from "path";
@@ -6763,7 +6787,7 @@ function looksLikeDestination(value2) {
   return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text3) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text3);
 }
 
-// ../harness/dist/chunk-UVGZHNLW.js
+// ../harness/dist/chunk-L2T3LPEF.js
 import { readFile as readFile4, stat as stat2 } from "fs/promises";
 import { readFile as readFile3 } from "fs/promises";
 import { join as join33 } from "path";
@@ -7031,7 +7055,7 @@ async function buildCodeGraph(input) {
   return builder.build();
 }
 
-// ../harness/dist/chunk-UVGZHNLW.js
+// ../harness/dist/chunk-L2T3LPEF.js
 import { createHash as createHash32 } from "crypto";
 async function digestStagedWorkspace(root, limits) {
   const files = [];
@@ -7290,6 +7314,7 @@ function parseSnapshot(value2) {
   return { host, bindings, commands };
 }
 async function parseSource(value2) {
+  const repositoryLimits = { maximumFiles: 1e5, maximumBytes: 80 * 1024 * 1024 };
   const snapshot = record5(record5(value2)?.snapshot);
   if (!snapshot || typeof snapshot.repository !== "string" || typeof snapshot.commitSha !== "string" || typeof snapshot.treeDigest !== "string" || !Array.isArray(snapshot.files)) throw invalid("source");
   const files = snapshot.files.map((value22) => {
@@ -7311,12 +7336,12 @@ async function parseSource(value2) {
       return { path: file.path, content: file.content };
     });
     const source2 = { repository: reference.repository, commitSha: reference.commitSha, files: referenceFiles };
-    const referenceDigest = await digestCodeRepositorySnapshot(source2, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+    const referenceDigest = await digestCodeRepositorySnapshot(source2, repositoryLimits);
     if (referenceDigest !== reference.treeDigest) throw invalid("reference source digest");
     references.push({ alias: reference.alias, ...source2, treeDigest: referenceDigest });
   }
   const source = { repository: snapshot.repository, commitSha: snapshot.commitSha, files };
-  const digest = await digestCodeRepositorySnapshot(source, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+  const digest = await digestCodeRepositorySnapshot(source, repositoryLimits);
   if (digest !== snapshot.treeDigest) throw invalid("source digest");
   return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
 }
@@ -7968,8 +7993,11 @@ async function prepareRuntimeLocalSource(input) {
 }
 var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
 var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+var SOURCE_MAX_FILES = 1e5;
+var SOURCE_MAX_BYTES = 80 * 1024 * 1024;
+var SOURCE_SET_MAX_BYTES = 480 * 1024 * 1024;
 async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
-  if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
+  if (!snapshot.files.length || snapshot.files.length > SOURCE_MAX_FILES) throw new TypeError("Code source file count is invalid");
   const root = await mkdtemp3(join23(tempRoot, "odla-code-source-"));
   const sourceDir = join23(root, "source");
   await mkdir3(sourceDir);
@@ -7981,7 +8009,7 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
       if (seen.has(file.path)) throw new TypeError("Code source repeats a path");
       seen.add(file.path);
       bytes += Buffer.byteLength(file.path) + Buffer.byteLength(file.content);
-      if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
+      if (bytes > SOURCE_MAX_BYTES) throw new TypeError("Code source exceeds its byte bound");
       const target = resolve32(sourceDir, file.path);
       if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code source path escapes its root");
       await mkdir3(dirname10(target), { recursive: true });
@@ -7989,14 +8017,14 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
     }
     for (const reference of snapshot.references ?? []) {
       validateAlias(reference.alias);
-      if (!reference.files.length || reference.files.length > 1e4) throw new TypeError("Code reference file count is invalid");
+      if (!reference.files.length || reference.files.length > SOURCE_MAX_FILES) throw new TypeError("Code reference file count is invalid");
       for (const file of reference.files) {
         validatePath(file.path);
         const path = `.odla-references/${reference.alias}/${file.path}`;
         if (seen.has(path)) throw new TypeError("Code reference repeats a path");
         seen.add(path);
         bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
-        if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
+        if (bytes > SOURCE_SET_MAX_BYTES) throw new TypeError("Code source set exceeds its byte bound");
         const target = resolve32(sourceDir, path);
         if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
         await mkdir3(dirname10(target), { recursive: true });
@@ -8022,7 +8050,7 @@ async function attachCodeRuntimeReferences(workspace, references) {
       validatePath(file.path);
       const path = `.odla-references/${reference.alias}/${file.path}`;
       bytes += Buffer.byteLength(path) + Buffer.byteLength(file.content);
-      if (bytes > 64 * 1024 * 1024) throw new TypeError("Code reference set exceeds its byte bound");
+      if (bytes > SOURCE_SET_MAX_BYTES - SOURCE_MAX_BYTES) throw new TypeError("Code reference set exceeds its byte bound");
       for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
         const target = resolve32(root, path);
         if (!target.startsWith(`${resolve32(root)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
@@ -8072,7 +8100,10 @@ async function materializeCommandWorkspace(input) {
       trustedBaseDir: materialized.sourceDir,
       trustedBaseCommitSha: source.commitSha,
       checkpoint: codeCheckpointPayload(command.payload)
-    })).workspace : await stageWorkspace(materialized.sourceDir);
+    })).workspace : await stageWorkspace(materialized.sourceDir, {
+      maxFiles: SOURCE_MAX_FILES,
+      maxBytes: SOURCE_SET_MAX_BYTES
+    });
     return { workspace, sourceDigest: source.treeDigest, requestedLocal: null };
   } finally {
     await materialized.cleanup();
@@ -10446,13 +10477,16 @@ async function credentialCommand(parsed, deps = {}) {
 // src/help-usage.ts
 var AUTH_SECTION = `
 Enrol this machine once, then stop asking:
-  npx odla-ai device enroll --all-apps --capability all --no-open --wait 600
-      One browser approval. Afterwards every worktree on this machine mints its
-      own short-lived credentials with nobody's attention, for every app you
-      own \u2014 including apps you create later. The window rolls forward each time
-      you use it, so continuous work never interrupts anyone; only a real gap
-      does. Give the human the printed /studio?code= URL, keep the process
-      alive, and wait on it.
+  npx odla-ai device enroll --no-open --wait 600
+      One browser approval, and no flags to remember: this covers every app you
+      own \u2014 including apps you create later \u2014 with every capability that
+      approval can carry. Afterwards every worktree on this machine mints its
+      own short-lived credentials with nobody's attention. The window rolls
+      forward each time you use it, so continuous work never interrupts anyone;
+      only a real gap does. Give the human the printed /studio?code= URL, keep
+      the process alive, and wait on it.
+      Narrow it deliberately with --app <id> or --capability <c>; the CLI then
+      says what that gave up.
 
   npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600
       The same thing across all of odla, for weeks. Needs a platform
@@ -10595,7 +10629,7 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--all-apps|--app <id>[,<id>...]] [--capability all|<c>[,<c>...]] [--platform-wide]
+  odla-ai device enroll [--app <id>[,<id>...]|--all-apps] [--capability all|<c>[,<c>...]] [--platform-wide]
     [--name <label>] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--wait <seconds>] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
@@ -10721,11 +10755,13 @@ Commands:
                enrollment in the browser; from then on EVERY worktree on this
                machine mints its own short-lived credentials with nobody's
                attention, until the device is revoked or goes unused.
-               "--all-apps" covers every app you own, now and later, so creating
-               an app costs no new approval. "--capability all" takes everything
-               that approval is allowed to carry, so a capability you did not
-               think to name is not a 403 next week. "--platform-wide" is the
-               administrator's version, across all of odla.
+               With no flags it covers every app you own, now and later, with
+               every capability that approval can carry \u2014 so creating an app
+               costs no new approval, and a capability nobody thought to name is
+               not a 403 next week. "--app" or "--capability" narrow it
+               deliberately, and the CLI says what that gave up.
+               "--platform-wide" is the administrator's version, across all of
+               odla.
                The expiry is a GAP, not a clock: each use rolls it forward, so
                only going quiet brings a human back into the loop \u2014 which is
                where anything that changed can be explained.
@@ -13765,10 +13801,17 @@ function advisoryCollectingFetch(inner, sink) {
     return response2;
   });
 }
+var superseded = /* @__PURE__ */ new Set();
+function supersedeAdvisory(code) {
+  superseded.add(code);
+}
 function renderAdvisories(out, advisories, env = process.env) {
+  const retracted = new Set(superseded);
+  superseded.clear();
   if (env.ODLA_NO_ADVISORIES) return;
   const seen = /* @__PURE__ */ new Set();
   for (const advisory of advisories) {
+    if (retracted.has(advisory.code)) continue;
     const key = `${advisory.code}:${advisory.message}`;
     if (seen.has(key)) continue;
     seen.add(key);
@@ -13836,11 +13879,18 @@ async function deviceCommand(parsed, deps) {
 async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
   const platformWide = parsed.options["platform-wide"] === true;
-  const apps = platformWide || parsed.options["all-apps"] === true ? [ALL_OWNED_APPS] : (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
+  const narrowed = stringOpt(parsed.options.app) !== void 0 || stringOpt(parsed.options.capability) !== void 0;
+  const apps = platformWide || parsed.options["all-apps"] === true || !narrowed ? [ALL_OWNED_APPS] : (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
   if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026], or --all-apps");
   const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
   const extended = platformWide || deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
-  const { capabilities, scopes } = requestedEnvelope(parsed, platformWide);
+  const { capabilities, scopes } = requestedEnvelope(parsed, platformWide, narrowed);
+  const narrowNotice = narrowEnrollmentNotice({
+    appIds: apps,
+    capabilities: capabilities ?? [],
+    scopes: scopes ?? []
+  });
+  if (narrowNotice) out.error(narrowNotice);
   const token = await scopedToken2(
     parsed,
     deps,
@@ -13876,8 +13926,10 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
   }, null, 2));
   chmodSync3(path, 384);
   rememberMachineIdentity(cfg.platformUrl.replace(/\/$/, ""), stringOpt(parsed.options.email));
+  supersedeAdvisory("credential.expiring");
   const reach = body.device.appIds.includes(ALL_OWNED_APPS) ? "every app you own, now and later" : body.device.appIds.join(", ");
   out.error(`device: enrolled "${name}" for ${reach}; credential written to ${path}`);
+  if (narrowNotice) out.error(narrowNotice);
   out.error(
     "device: every worktree on this machine mints its own credentials from now on \u2014 no further approvals,"
   );
@@ -13896,9 +13948,9 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     }, null, 2));
   }
 }
-function requestedEnvelope(parsed, platformWide) {
+function requestedEnvelope(parsed, platformWide, narrowed) {
   const raw = stringOpt(parsed.options.capability);
-  const everything = platformWide || raw?.trim().toLowerCase() === "all";
+  const everything = platformWide || !narrowed || raw?.trim().toLowerCase() === "all";
   if (everything) {
     return {
       capabilities: [...OPTIONAL_AGENT_PROJECT_CAPABILITIES],
@@ -15747,4 +15799,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-PJ3RATDD.js.map
+//# sourceMappingURL=chunk-XUTMQMXZ.js.map