@odla-ai/cli 0.43.1 → 0.45.0

package/dist/{chunk-T4OPSRME.js → chunk-JHB6352A.js}

@@ -1,21 +1,29 @@
 #!/usr/bin/env node
 import {
+  adoptRepoLocalCache,
+  appCredentialsFile,
+  appTokenFile,
   cliVersion,
   describeUnmet,
+  deviceSessionFile,
+  identityFile,
   looksSecret,
   parseRequires,
+  pmContextFile,
   redactSecrets,
   redactingOutput,
-  unmetRequirements
-} from "./chunk-UKLSRQ5J.js";
+  scopedTokenFile,
+  unmetRequirements,
+  updateNotice
+} from "./chunk-5MEO3BVF.js";
 
 // src/admin-ai.ts
-import process13 from "process";
+import process12 from "process";
 
 // src/token.ts
 import { OdlaError, requestToken } from "@odla-ai/db";
 import { createHash } from "crypto";
-import process10 from "process";
+import process9 from "process";
 
 // src/handshake-approval.ts
 import process3 from "process";
@@ -150,10 +158,10 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
 }
 
 // src/cached-credential.ts
-import { rmSync as rmSync3 } from "fs";
+import { rmSync as rmSync2 } from "fs";
 
 // src/auth-guidance.ts
-import process7 from "process";
+import process6 from "process";
 
 // src/device-session.ts
 import { existsSync, readFileSync } from "fs";
@@ -202,63 +210,9 @@ async function mintDeviceSession(platformUrl, credential2, doFetch) {
   };
 }
 
-// src/odla-home.ts
-import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, rmSync as rmSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
-import process6 from "process";
-function odlaHome(env = process6.env) {
-  if (env.VITEST && !env.ODLA_HOME) {
-    throw new Error(
-      "ODLA_HOME must be set under test \u2014 resolving the real ~/.odla would write to the developer's machine"
-    );
-  }
-  return env.ODLA_HOME ?? join3(env.HOME ?? homedir2(), ".odla");
-}
-function odlaHomePath(segments, env = process6.env) {
-  return join3(odlaHome(env), ...segments);
-}
-function identityFile(env) {
-  return odlaHomePath(["identity.json"], env);
-}
-function deviceSessionFile(env) {
-  return odlaHomePath(["session.json"], env);
-}
-function appTokenFile(appId, env) {
-  return odlaHomePath(["apps", safeSegment(appId), "dev-token.json"], env);
-}
-function appCredentialsFile(appId, env) {
-  return odlaHomePath(["apps", safeSegment(appId), "credentials.json"], env);
-}
-function scopedTokenFile(env) {
-  return odlaHomePath(["admin-token.local.json"], env);
-}
-function pmContextFile(env) {
-  return odlaHomePath(["pm-context.json"], env);
-}
-function adoptRepoLocalCache(legacyPath, machinePath, out) {
-  if (!existsSync2(legacyPath) || legacyPath === machinePath) return false;
-  const superseded2 = existsSync2(machinePath);
-  if (!superseded2) {
-    mkdirSync(dirname2(machinePath), { recursive: true });
-    copyFileSync(legacyPath, machinePath);
-    chmodSync(machinePath, 384);
-  }
-  rmSync2(legacyPath, { force: true });
-  out?.error(
-    superseded2 ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
-  );
-  return true;
-}
-function safeSegment(value2) {
-  const clean4 = value2.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "");
-  if (!clean4) throw new Error(`"${value2}" is not a usable app id`);
-  return clean4;
-}
-
 // src/local.ts
-import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
-import { dirname as dirname3, isAbsolute, relative, resolve } from "path";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
+import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
@@ -272,7 +226,7 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!existsSync3(path)) return null;
+  if (!existsSync2(path)) return null;
   let value2;
   try {
     value2 = JSON.parse(readFileSync2(path, "utf8"));
@@ -306,7 +260,7 @@ function mergeCredential(current, update) {
 }
 function ensureGitignore(rootDir, localPaths = []) {
   const path = resolve(rootDir, ".gitignore");
-  const existing = existsSync3(path) ? readFileSync2(path, "utf8") : "";
+  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
@@ -326,7 +280,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return resolve(dirname3(cfg.configPath), requested);
+  return resolve(dirname2(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -340,7 +294,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = existsSync3(path) ? readFileSync2(path, "utf8") : "";
+  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -366,10 +320,10 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text4) {
-  mkdirSync2(dirname3(path), { recursive: true });
+  mkdirSync(dirname2(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync(temporary, text4, { mode: 384 });
-  chmodSync2(temporary, 384);
+  chmodSync(temporary, 384);
   renameSync(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
@@ -385,7 +339,7 @@ function displayPath(path, rootDir = process.cwd()) {
 // src/auth-guidance.ts
 var ENROL_EVERYTHING = "npx odla-ai device enroll --no-open --wait 600";
 var ENROL_PLATFORM_WIDE = "npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600";
-function machineAuthState(audience, env = process7.env) {
+function machineAuthState(audience, env = process6.env) {
   const device = readDeviceCredential(audience, env);
   if (!device) return { enrolled: false };
   const session = readJsonFile(deviceSessionFile(env));
@@ -443,7 +397,7 @@ function explainRejectedCredential(error) {
   const tokenFile = noted;
   if (!tokenFile || !isCredentialRejection(error)) return null;
   noted = null;
-  rmSync3(tokenFile, { force: true });
+  rmSync2(tokenFile, { force: true });
   return [
     "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
     "   The usual cause is a newer sign-in for this account: collecting a handshake retires the",
@@ -454,9 +408,9 @@ function explainRejectedCredential(error) {
 }
 
 // src/device-session-cache.ts
-import process8 from "process";
+import process7 from "process";
 var SKEW_MS = 6e4;
-async function deviceSessionToken(platformUrl, audience, credential2, doFetch, env = process8.env) {
+async function deviceSessionToken(platformUrl, audience, credential2, doFetch, env = process7.env) {
   const path = deviceSessionFile(env);
   const cached = readJsonFile(path);
   if (cached?.token && cached.platform === audience && cached.deviceId === credential2.deviceId && (cached.expiresAt ?? 0) > Date.now() + SKEW_MS) return cached;
@@ -471,13 +425,13 @@ async function deviceSessionToken(platformUrl, audience, credential2, doFetch, e
 }
 
 // src/machine-identity.ts
-import process9 from "process";
-function readMachineIdentity(audience, env = process9.env) {
+import process8 from "process";
+function readMachineIdentity(audience, env = process8.env) {
   const stored = readJsonFile(identityFile(env));
   if (!stored || typeof stored.email !== "string" || !stored.email) return null;
   return stored.platform === audience ? { platform: audience, email: stored.email } : null;
 }
-function rememberMachineIdentity(audience, email, env = process9.env) {
+function rememberMachineIdentity(audience, email, env = process8.env) {
   if (!email) return;
   const existing = readMachineIdentity(audience, env);
   if (existing?.email === email) return;
@@ -492,14 +446,14 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const cached = readJsonFile(cfg.local.tokenFile);
   if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
-    if (process10.env.ODLA_DEV_TOKEN) {
-      const declared = process10.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (process9.env.ODLA_DEV_TOKEN) {
+      const declared = process9.env.ODLA_DEV_TOKEN_AUDIENCE;
       if (declared) {
         if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
       } else if (audience !== "https://odla.ai") {
         throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
       }
-      return process10.env.ODLA_DEV_TOKEN;
+      return process9.env.ODLA_DEV_TOKEN;
     }
     const device = readDeviceCredential(audience);
     if (device) {
@@ -614,7 +568,7 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? process10.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? process9.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (/@users\.noreply\.github\.com$/i.test(email)) {
     throw new Error(
       `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
@@ -645,12 +599,12 @@ function platformAudience(value2) {
 }
 
 // src/secret-input.ts
-import process11 from "process";
+import process10 from "process";
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = process11.env[options.fromEnv];
+  if (options.fromEnv) value2 = process10.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -658,7 +612,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = process11.stdin) {
+async function readSecretStream(kind, stream = process10.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -668,8 +622,8 @@ async function readSecretStream(kind, stream = process11.stdin) {
 }
 
 // src/admin-ai-auth.ts
-import { join as join4 } from "path";
-import process12 from "process";
+import { join as join3 } from "path";
+import process11 from "process";
 import { requestToken as requestToken2 } from "@odla-ai/db";
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -677,7 +631,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = process12.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = process11.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -689,7 +643,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = process12.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = process11.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -716,9 +670,9 @@ var SCOPE_PURPOSE = {
 };
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? process12.cwd();
+  const rootDir = options.rootDir ?? process11.cwd();
   const tokenFile = options.tokenFile ?? scopedTokenFile();
-  adoptRepoLocalCache(join4(rootDir, ".odla/admin-token.local.json"), tokenFile, out);
+  adoptRepoLocalCache(join3(rootDir, ".odla/admin-token.local.json"), tokenFile, out);
   const device = readDeviceCredential(audience);
   if (device && options.cache !== false) {
     const session = await deviceSessionToken(platform, audience, device, doFetch);
@@ -934,7 +888,7 @@ function isRecord2(value2) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? process13.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? process12.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -1147,10 +1101,17 @@ function parseArgv(argv) {
 function assertArgs(parsed, allowedOptions2, maxPositionals) {
   const allowed = new Set(allowedOptions2);
   for (const name of Object.keys(parsed.options)) {
-    if (!allowed.has(name)) throw new Error(`unknown option "--${name}"; run "odla-ai help" for supported options`);
+    if (allowed.has(name)) continue;
+    const accepts = [...allowed].sort().map((option) => `--${option}`).join(" ");
+    throw new Error(
+      `unknown option "--${name}"` + (accepts ? ` \u2014 this command accepts: ${accepts}` : " \u2014 this command takes no options")
+    );
   }
   if (parsed.positionals.length > maxPositionals) {
-    throw new Error(`unexpected argument "${parsed.positionals[maxPositionals]}"; run "odla-ai help"`);
+    const taken = parsed.positionals.slice(0, maxPositionals).join(" ");
+    throw new Error(
+      `unexpected argument "${parsed.positionals[maxPositionals]}" \u2014 ` + (maxPositionals ? `"odla-ai ${taken}" takes no further arguments` : "this command takes no arguments")
+    );
   }
 }
 function requiredString(value2, name) {
@@ -1188,6 +1149,198 @@ function addOption(options, name, value2) {
   else options[name] = [String(current), String(value2)];
 }
 
+// src/surface.ts
+var PM_ACTIONS = {
+  list: {},
+  add: {},
+  create: {},
+  get: {},
+  set: {},
+  update: {},
+  status: {},
+  move: {},
+  done: {},
+  comment: {},
+  comments: {},
+  history: {},
+  link: {},
+  ref: {},
+  rm: {},
+  delete: {}
+};
+var PM_TASK_ACTIONS = {
+  ...PM_ACTIONS,
+  ready: {},
+  claim: {},
+  release: {}
+};
+var PM_ENTITIES = {
+  ...Object.fromEntries(
+    ["goal", "conformance", "decision", "bug"].map((entity) => [entity, PM_ACTIONS])
+  ),
+  task: PM_TASK_ACTIONS,
+  kanban: PM_TASK_ACTIONS
+};
+var COMMAND_SURFACE = {
+  agent: { jobs: {}, retry: {} },
+  ai: { models: {} },
+  admin: {
+    ai: {
+      show: {},
+      set: {},
+      credentials: {},
+      models: {},
+      usage: {},
+      audit: {},
+      credential: { set: {} }
+    },
+    spend: { show: {}, reset: {} }
+  },
+  app: {
+    archive: {},
+    restore: {},
+    export: {},
+    import: {},
+    rename: {},
+    "refresh-sandbox": {},
+    "go-live": {},
+    promote: {},
+    owners: { list: {}, add: {}, remove: {} }
+  },
+  auth: { login: {} },
+  brand: { design: { unpack: {} } },
+  bug: { create: {}, list: {}, report: {} },
+  calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
+  capabilities: {},
+  code: {
+    connect: {},
+    grant: { request: {}, list: {}, approve: {}, revoke: {} },
+    repository: { show: {}, list: {}, bind: {} }
+  },
+  config: { diff: {}, plan: {}, apply: {} },
+  context: { show: {}, list: {}, save: {}, remove: {} },
+  credentials: { list: {}, revoke: {} },
+  device: { enroll: {}, list: {}, revoke: {} },
+  // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
+  discuss: {
+    groups: {},
+    list: {},
+    topics: {},
+    read: {},
+    post: {},
+    reply: {},
+    resolve: {},
+    who: {},
+    watch: {}
+  },
+  doctor: {},
+  help: {},
+  init: {},
+  monitor: { plan: {}, apply: {}, run: {}, status: {}, incidents: {}, report: {} },
+  o11y: { status: {} },
+  operations: { get: {}, wait: {} },
+  platform: {
+    status: {}
+  },
+  pm: {
+    ...PM_ENTITIES,
+    project: { list: {}, add: {}, create: {}, use: {} },
+    handoff: {},
+    next: {},
+    start: {},
+    watch: {}
+  },
+  provision: {},
+  runbook: {
+    ask: {},
+    search: {},
+    impact: {},
+    list: {},
+    get: {},
+    cat: {},
+    new: {},
+    edit: {},
+    comment: {},
+    import: {},
+    visibility: {},
+    publish: {},
+    archive: {},
+    history: {},
+    revert: {},
+    rm: {},
+    lint: {}
+  },
+  secrets: { push: {}, status: {}, set: {}, "set-clerk-key": {} },
+  security: {
+    plan: {},
+    sources: {},
+    run: {},
+    status: {},
+    report: {},
+    github: { connect: {}, disconnect: {} }
+  },
+  setup: {},
+  skill: { install: {} },
+  smoke: {},
+  version: {},
+  whoami: {}
+};
+function acceptedAfter(path) {
+  let node = COMMAND_SURFACE;
+  for (const word of path) {
+    node = node?.[word];
+    if (!node) return [];
+  }
+  return Object.keys(node).sort();
+}
+function validateInvocation(words2) {
+  let node = COMMAND_SURFACE;
+  const walked = [];
+  for (const word of words2) {
+    if (Object.keys(node).length === 0) return null;
+    const next = node[word];
+    if (!next) return { validPrefix: walked.join(" "), word, accepted: Object.keys(node).sort() };
+    walked.push(word);
+    node = next;
+  }
+  return null;
+}
+function describeProblem(problem) {
+  const where = problem.validPrefix ? `after "${problem.validPrefix}"` : "as a command";
+  if (!problem.accepted.length) return `"${problem.word}" is not accepted ${where}. Run "odla-ai help"`;
+  if (!problem.word) return `"odla-ai ${problem.validPrefix}" needs one of: ${problem.accepted.join(", ")}`;
+  return `"${problem.word}" is not accepted ${where} \u2014 try: ${problem.accepted.join(", ")}`;
+}
+function rejectWord(path, word, note) {
+  const sentence = describeProblem({
+    validPrefix: path.join(" "),
+    word: word ?? "",
+    accepted: acceptedAfter(path)
+  });
+  throw new Error(note ? `${sentence}. ${note}` : sentence);
+}
+function invocationPath(words2) {
+  let node = COMMAND_SURFACE;
+  const path = [];
+  for (const word of words2) {
+    const next = node[word];
+    if (!next) break;
+    path.push(word);
+    node = next;
+    if (Object.keys(node).length === 0) break;
+  }
+  return path;
+}
+function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
+  const paths2 = [];
+  for (const [word, child] of Object.entries(node)) {
+    const path = [...prefix, word];
+    paths2.push(path);
+    paths2.push(...surfacePaths(child, path));
+  }
+  return paths2;
+}
+
 // src/admin-spend.ts
 async function call(ctx, method, scope) {
   const url = `${ctx.platformUrl.replace(/\/$/, "")}/registry/platform/spend?scope=${encodeURIComponent(scope)}`;
@@ -1237,9 +1390,7 @@ async function spendReset(ctx, scope) {
 async function adminSpend(parsed, ctx) {
   const action2 = parsed.positionals[2];
   const scope = parsed.positionals[3] ?? stringOpt(parsed.options.scope);
-  if (action2 !== "show" && action2 !== "reset") {
-    throw new Error('unknown spend command. Try "odla-ai admin spend show <scope>".');
-  }
+  if (action2 !== "show" && action2 !== "reset") rejectWord(["admin", "spend"], action2);
   if (!scope) {
     throw new Error(
       `"admin spend ${action2}" needs a scope, e.g. odla-ai admin spend ${action2} app:my-app:<incarnation>`
@@ -1249,13 +1400,13 @@ async function adminSpend(parsed, ctx) {
 }
 
 // src/operator-context.ts
-import { existsSync as existsSync6 } from "fs";
-import { join as join6, resolve as resolve4 } from "path";
-import process15 from "process";
+import { existsSync as existsSync5 } from "fs";
+import { join as join5, resolve as resolve4 } from "path";
+import process14 from "process";
 
 // src/config.ts
-import { existsSync as existsSync4, rmSync as rmSync4, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { existsSync as existsSync3, rmSync as rmSync3, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 import { appServiceDefinition, appServiceIds } from "@odla-ai/apps";
 
@@ -1665,11 +1816,11 @@ var stderr = { error: (message2) => {
 } };
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = resolve2(configPath);
-  if (!existsSync4(resolved)) {
+  if (!existsSync3(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = dirname4(resolved);
+  const rootDir = dirname3(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -1686,7 +1837,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   };
   adoptRepoLocalCache(resolve2(rootDir, ".odla/dev-token.json"), local.tokenFile, stderr);
   adoptRepoLocalCache(resolve2(rootDir, ".odla/credentials.local.json"), local.credentialsFile, stderr);
-  rmSync4(resolve2(rootDir, ".odla/handshake.local.json"), { force: true });
+  rmSync3(resolve2(rootDir, ".odla/handshake.local.json"), { force: true });
   return {
     ...raw,
     configPath: resolved,
@@ -1794,18 +1945,18 @@ function unique3(values) {
 }
 
 // src/operator-profiles.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join5, resolve as resolve3 } from "path";
-import process14 from "process";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname4, join as join4, resolve as resolve3 } from "path";
+import process13 from "process";
 function operatorProfileFile() {
   return resolve3(
-    clean(process14.env.ODLA_CONTEXT_FILE) ?? join5(homedir3(), ".odla", "contexts.json")
+    clean(process13.env.ODLA_CONTEXT_FILE) ?? join4(homedir2(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(process14.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(process13.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -1845,10 +1996,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? join5(dirname5(selection.file), "profiles", selection.name) : join5(homedir3(), ".odla");
+  const base = selection.name ? join4(dirname4(selection.file), "profiles", selection.name) : join4(homedir2(), ".odla");
   return {
-    developer: join5(base, "dev-token.json"),
-    scoped: join5(base, "admin-token.local.json")
+    developer: join4(base, "dev-token.json"),
+    scoped: join4(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -1859,7 +2010,7 @@ function assertOperatorName(value2, label) {
   }
 }
 function readOperatorProfiles(file) {
-  if (!existsSync5(file)) return emptyProfiles();
+  if (!existsSync4(file)) return emptyProfiles();
   let raw;
   try {
     raw = JSON.parse(readFileSync4(file, "utf8"));
@@ -1928,19 +2079,19 @@ async function resolveOperatorContext(parsed, options = {}) {
   const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const configPath = resolve4(configArgument);
   const explicitConfig = parsed.options.config !== void 0;
-  const hasConfig = existsSync6(configPath);
+  const hasConfig = existsSync5(configPath);
   if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
     await loadProjectConfig(configArgument);
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(process15.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(process14.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(process15.env.ODLA_APP_ID);
+  const appEnvironment = clean2(process14.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) {
@@ -1954,16 +2105,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(process15.env.ODLA_ENV);
+  const envEnvironment = clean2(process14.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? process15.cwd();
+  const rootDir = loaded?.rootDir ?? process14.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(process15.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process15.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile2 = clean2(process15.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process15.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join6(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(process14.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process14.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile2 = clean2(process14.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process14.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join5(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -1985,8 +2136,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: join6(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: join6(rootDir, ".dev.vars"),
+      credentialsFile: join5(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: join5(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -2038,6 +2189,11 @@ var SET_OPTIONS = [
 async function adminCommand(parsed, deps = {}) {
   const area = parsed.positionals[1];
   const action2 = parsed.positionals[2];
+  if (area !== "ai" && area !== "spend") rejectWord(["admin"], area);
+  if (!acceptedAfter(["admin", area]).includes(action2 ?? "")) rejectWord(["admin", area], action2);
+  if (action2 === "credential" && !acceptedAfter(["admin", "ai", "credential"]).includes(parsed.positionals[3] ?? "")) {
+    rejectWord(["admin", "ai", "credential"], parsed.positionals[3]);
+  }
   if (area === "spend") {
     assertArgs(parsed, JSON_OPTIONS, 4);
     const context2 = await resolveOperatorContext(parsed, { allowMissingConfig: true });
@@ -2063,14 +2219,11 @@ async function adminCommand(parsed, deps = {}) {
       out
     });
   }
-  const credentialSet = action2 === "credential" && parsed.positionals[3] === "set";
+  const credentialSet = action2 === "credential";
   const credentials = action2 === "credentials";
   const models = action2 === "models";
   const usage = action2 === "usage";
   const audit = action2 === "audit";
-  if (area !== "ai" || action2 !== "show" && action2 !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
-    throw new Error('unknown admin command. Try "odla-ai admin ai show".');
-  }
   const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action2 === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
   assertArgs(parsed, allowed, credentialSet ? 5 : action2 === "set" ? 4 : 3);
   const context = await resolveOperatorContext(parsed, { allowMissingConfig: true });
@@ -2108,7 +2261,7 @@ async function adminCommand(parsed, deps = {}) {
 }
 
 // src/auth-command.ts
-import process16 from "process";
+import process15 from "process";
 
 // src/whoami-command.ts
 var text2 = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
@@ -2284,9 +2437,7 @@ async function authCommand(parsed, deps = {}) {
     "json"
   ], 2);
   const action2 = parsed.positionals[1] ?? "login";
-  if (action2 !== "login") {
-    throw new Error(`unknown auth action "${action2}". Try "odla-ai auth login --app <id> --email <odla-account>".`);
-  }
+  if (action2 !== "login") rejectWord(["auth"], action2);
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true,
     requireApp: true
@@ -2294,7 +2445,7 @@ async function authCommand(parsed, deps = {}) {
   const { cfg } = context;
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const email = stringOpt(parsed.options.email) ?? process16.env.ODLA_USER_EMAIL?.trim();
+  const email = stringOpt(parsed.options.email) ?? process15.env.ODLA_USER_EMAIL?.trim();
   if (!email) {
     throw new Error(
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
@@ -2359,9 +2510,7 @@ function bothTenants(cfg) {
 // src/agent-command.ts
 async function agentCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[1];
-  if (action2 !== "jobs" && action2 !== "retry") {
-    throw new Error(`unknown agent action "${action2 ?? ""}". Try "odla-ai agent jobs --json".`);
-  }
+  if (action2 !== "jobs" && action2 !== "retry") rejectWord(["agent"], action2);
   assertArgs(parsed, ["config", "env", "state", "limit", "json", "token"], action2 === "jobs" ? 2 : 3);
   if (action2 === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
     throw new Error('--state and --limit are supported only by "agent jobs"');
@@ -2536,9 +2685,7 @@ async function appOwnersCommand(parsed, dependencies = {}) {
     await (sub === "add" ? ownersAdd(email, options) : ownersRemove(email, options));
     return;
   }
-  throw new Error(
-    `unknown app owners subcommand "${sub}". Try "odla-ai app owners list", "odla-ai app owners add <email>", or "odla-ai app owners remove <email>".`
-  );
+  rejectWord(["app", "owners"], sub);
 }
 
 // src/app-rename.ts
@@ -2644,8 +2791,10 @@ async function appCommand(parsed, dependencies = {}) {
     return;
   }
   if (sub !== "archive" && sub !== "restore") {
-    throw new Error(
-      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", "odla-ai app export", "odla-ai app import <file>", "odla-ai app refresh-sandbox", "odla-ai app go-live", "odla-ai app promote", "odla-ai app rename <name>", or "odla-ai app owners <list|add|remove>". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
+    rejectWord(
+      ["app"],
+      sub,
+      "Permanent deletion has no CLI: it requires a signed-in owner in Studio."
     );
   }
   assertArgs(parsed, ["config", "token", "email", "yes", "json"], 2);
@@ -2664,7 +2813,7 @@ async function appCommand(parsed, dependencies = {}) {
 
 // src/brand-command.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname6, resolve as resolve5 } from "path";
+import { dirname as dirname5, resolve as resolve5 } from "path";
 
 // src/brand-design-unpack.ts
 import { gunzipSync } from "zlib";
@@ -2779,7 +2928,7 @@ async function readBundle(source, deps) {
 async function writeAll(result, outDir) {
   for (const file of result.files) {
     const target = resolve5(outDir, file.path);
-    await mkdir(dirname6(target), { recursive: true });
+    await mkdir(dirname5(target), { recursive: true });
     await writeFile(target, file.bytes);
   }
 }
@@ -2811,7 +2960,8 @@ async function brandCommand(parsed, deps) {
     await designUnpack(parsed, deps);
     return;
   }
-  throw new Error(USAGE);
+  if (subject !== "design") rejectWord(["brand"], subject);
+  rejectWord(["brand", "design"], action2, USAGE);
 }
 
 // src/calendar-errors.ts
@@ -3345,7 +3495,7 @@ import {
   AppsError,
   createAppsClient
 } from "@odla-ai/apps";
-import { join as join7 } from "path";
+import { join as join6 } from "path";
 
 // src/config-operation-error.ts
 var ConfigOperationCommandError = class extends Error {
@@ -3770,7 +3920,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: join7(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join6(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3825,7 +3975,7 @@ function record4(value2) {
 
 // src/config-reconcile-command.ts
 import { createAppsClient as createAppsClient2, studioAppSettingsPath } from "@odla-ai/apps";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 
 // src/config-reconcile.ts
 import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
@@ -4121,7 +4271,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: join8(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join7(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4253,13 +4403,13 @@ function quoteArg2(value2) {
 
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { join as join10, resolve as resolve6 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { join as join9, resolve as resolve6 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -4273,8 +4423,8 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join9(rootDir, name);
-    if (existsSync7(path)) return path;
+    const path = join8(rootDir, name);
+    if (existsSync6(path)) return path;
   }
   return null;
 }
@@ -4434,7 +4584,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve6(rootDir, assets.directory);
       if (dir === resolve6(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync8(join10(dir, "node_modules"))) {
+      } else if (existsSync7(join9(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4470,7 +4620,7 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? resolve6(rootDir, config.main) : null;
-  if (!main || !existsSync8(main)) {
+  if (!main || !existsSync7(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
@@ -4499,7 +4649,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync8(join10(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync8(join9(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4793,14 +4943,14 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname7, resolve as resolve7 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname6, resolve as resolve7 } from "path";
 import { appServiceDefinition as appServiceDefinition3, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve7(options.rootDir ?? process.cwd());
   const configPath = resolve7(rootDir, options.configPath ?? "odla.config.mjs");
-  if (existsSync9(configPath) && !options.force) {
+  if (existsSync8(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -4816,9 +4966,9 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  mkdirSync3(dirname7(configPath), { recursive: true });
-  mkdirSync3(resolve7(rootDir, "src/odla"), { recursive: true });
-  mkdirSync3(resolve7(rootDir, ".odla"), { recursive: true });
+  mkdirSync2(dirname6(configPath), { recursive: true });
+  mkdirSync2(resolve7(rootDir, "src/odla"), { recursive: true });
+  mkdirSync2(resolve7(rootDir, ".odla"), { recursive: true });
   writeFileSync2(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing(resolve7(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing(resolve7(rootDir, "src/odla/rules.mjs"), rulesTemplate());
@@ -4828,7 +4978,7 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text4) {
-  if (existsSync9(path)) return;
+  if (existsSync8(path)) return;
   writeFileSync2(path, text4);
 }
 function configTemplate(input) {
@@ -5127,9 +5277,9 @@ function printReport(report5, out) {
 }
 
 // src/skill.ts
-import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync9, readdirSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname8, isAbsolute as isAbsolute3, join as join11, relative as relative2, resolve as resolve8, sep } from "path";
+import { existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname7, isAbsolute as isAbsolute3, join as join10, relative as relative2, resolve as resolve8, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -5229,7 +5379,7 @@ function installSkill(options = {}) {
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
   const root = resolve8(options.dir ?? process.cwd());
-  const home = resolve8(options.homeDir ?? homedir4());
+  const home = resolve8(options.homeDir ?? homedir3());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -5243,48 +5393,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join11(targetDir2, rel), readFileSync9(join11(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join10(targetDir2, rel), readFileSync9(join10(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join11(home, ".claude", "skills");
-    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join11(home, ".codex"), "skills");
+    const claudeRoot = join10(home, ".claude", "skills");
+    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join10(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : dirname8(dirname8(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : dirname7(dirname7(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join11(root, ".agents", "skills");
+    const sharedRoot = join10(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join11(root, ".claude", "skills");
+    const claudeRoot = join10(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = readFileSync9(join11(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join11(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
+        const canonical2 = readFileSync9(join10(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join10(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join11(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join10(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join11(root, "AGENTS.md");
+      const agentsFile = join10(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join11(root, ".github", "copilot-instructions.md");
+      const copilotFile = join10(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join11(root, "GEMINI.md");
+      const geminiFile = join10(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -5298,7 +5448,7 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!existsSync10(file.target)) {
+    if (!existsSync9(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
@@ -5319,8 +5469,8 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!existsSync10(file.target) || readFileSync9(file.target, "utf8") !== file.content) {
-      mkdirSync4(dirname8(file.target), { recursive: true });
+    if (!existsSync9(file.target) || readFileSync9(file.target, "utf8") !== file.content) {
+      mkdirSync3(dirname7(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
   }
@@ -5362,7 +5512,7 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block2, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!existsSync10(path)) return `${block2}
+  if (!existsSync9(path)) return `${block2}
 `;
   const current = readFileSync9(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
@@ -5391,7 +5541,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep).filter(Boolean)) {
-    current = join11(current, part);
+    current = join10(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -5404,11 +5554,11 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!existsSync10(dir)) return [];
+  if (!existsSync9(dir)) return [];
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join11(current, entry.name);
+      const path = join10(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative2(dir, path));
     }
@@ -5620,9 +5770,7 @@ async function secretsCommand(parsed, deps) {
     return;
   }
   if (sub !== "push") {
-    throw new Error(
-      `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets status --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
-    );
+    rejectWord(["secrets"], sub);
   }
   assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
   await secretsPush({
@@ -5635,7 +5783,7 @@ async function secretsCommand(parsed, deps) {
 async function projectCommand(command, parsed, deps) {
   if (command === "ai") {
     const sub = parsed.positionals[1];
-    if (sub !== "models") throw new Error(`unknown ai subcommand "${sub ?? ""}". Try "odla-ai ai models --env dev".`);
+    if (sub !== "models") rejectWord(["ai"], sub);
     assertArgs(parsed, ["config", "env", "provider", "json"], 2);
     await aiModels({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
@@ -5649,9 +5797,7 @@ async function projectCommand(command, parsed, deps) {
   }
   if (command === "config") {
     const sub = parsed.positionals[1];
-    if (sub !== "diff" && sub !== "plan" && sub !== "apply") {
-      throw new Error(`unknown config subcommand "${sub ?? ""}". Try "odla-ai config diff --json".`);
-    }
+    if (sub !== "diff" && sub !== "plan" && sub !== "apply") rejectWord(["config"], sub);
     assertArgs(
       parsed,
       sub === "apply" ? ["config", "plan", "idempotency-key", "token", "email", "open", "json"] : ["config", "token", "email", "open", "json"],
@@ -5679,7 +5825,7 @@ async function projectCommand(command, parsed, deps) {
   if (command === "operations") {
     const sub = parsed.positionals[1];
     if (sub !== "get" && sub !== "wait") {
-      throw new Error(`unknown operations subcommand "${sub ?? ""}". Try "odla-ai operations get <operation-id> --json".`);
+      rejectWord(["operations"], sub);
     }
     assertArgs(
       parsed,
@@ -5753,7 +5899,7 @@ async function projectCommand(command, parsed, deps) {
   }
   if (command === "skill") {
     const sub = parsed.positionals[1];
-    if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
+    if (sub !== "install") rejectWord(["skill"], sub);
     install(parsed, 2, deps);
     return true;
   }
@@ -5765,7 +5911,7 @@ async function projectCommand(command, parsed, deps) {
 }
 
 // src/code-connect.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { cpus, hostname, totalmem } from "os";
 import { resolve as resolve11 } from "path";
 
@@ -5776,7 +5922,7 @@ var HARNESS_PROTOCOL_VERSION = 1;
 import { execFile, spawn as spawn3 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
-import { delimiter, join as join12 } from "path";
+import { delimiter, join as join11 } from "path";
 import { getgid, getuid } from "process";
 import { mkdir as mkdir2, mkdtemp, realpath, rm, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir } from "os";
@@ -5794,7 +5940,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
     try {
-      await access(join12(directory, engine), constants.X_OK);
+      await access(join11(directory, engine), constants.X_OK);
       return true;
     } catch {
     }
@@ -6492,10 +6638,10 @@ import { randomUUID } from "crypto";
 import { createHash as createHash22, randomUUID as randomUUID2 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat22 } from "fs/promises";
-import { join as join14 } from "path";
+import { join as join13 } from "path";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname10, join as join23, resolve as resolve32, sep as sep23 } from "path";
+import { dirname as dirname9, join as join23, resolve as resolve32, sep as sep23 } from "path";
 import {
   keepRecentExchanges,
   runAgent
@@ -6893,11 +7039,11 @@ function rollup(graph, kind, options = {}) {
 }
 
 // ../graph/dist/code/index.js
-function dirname9(path) {
+function dirname8(path) {
   const at = path.lastIndexOf("/");
   return at <= 0 ? "." : path.slice(0, at);
 }
-function join13(base, specifier) {
+function join12(base, specifier) {
   const parts = [];
   const segments = `${base === "." ? "" : `${base}/`}${specifier}`.split("/");
   for (const segment of segments) {
@@ -6921,7 +7067,7 @@ var BARE_IMPORT = /^\s*import\s*["']([^"']+)["']/gm;
 var isSourcePath = (path) => SOURCE.test(path);
 function resolveImport(fromPath, specifier, known) {
   if (!specifier.startsWith(".")) return null;
-  const base = join13(dirname9(fromPath), specifier);
+  const base = join12(dirname8(fromPath), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -7725,7 +7871,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = join14(workspaceDir, artifact.path);
+      const path = join13(workspaceDir, artifact.path);
       const info = await lstat22(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
@@ -8014,7 +8160,7 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
       if (bytes > SOURCE_MAX_BYTES) throw new TypeError("Code source exceeds its byte bound");
       const target = resolve32(sourceDir, file.path);
       if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code source path escapes its root");
-      await mkdir3(dirname10(target), { recursive: true });
+      await mkdir3(dirname9(target), { recursive: true });
       await writeFile3(target, file.content, { flag: "wx", mode: 420 });
     }
     for (const reference of snapshot.references ?? []) {
@@ -8029,7 +8175,7 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
         if (bytes > SOURCE_SET_MAX_BYTES) throw new TypeError("Code source set exceeds its byte bound");
         const target = resolve32(sourceDir, path);
         if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
-        await mkdir3(dirname10(target), { recursive: true });
+        await mkdir3(dirname9(target), { recursive: true });
         await writeFile3(target, file.content, { flag: "wx", mode: 292 });
       }
     }
@@ -8056,7 +8202,7 @@ async function attachCodeRuntimeReferences(workspace, references) {
       for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
         const target = resolve32(root, path);
         if (!target.startsWith(`${resolve32(root)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
-        await mkdir3(dirname10(target), { recursive: true });
+        await mkdir3(dirname9(target), { recursive: true });
         await writeFile3(target, file.content, { flag: "wx", mode: 292 });
       }
     }
@@ -10119,7 +10265,7 @@ var CODE_BUILD_RECIPES = Object.freeze([{
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = resolve11(cwd, options.configPath);
-  const cfg = existsSync11(configPath) ? await loadProjectConfig(configPath) : null;
+  const cfg = existsSync10(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -10314,9 +10460,7 @@ function grantsUrl(cfg, suffix = "") {
 async function codeGrantCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[2];
   if (!isAction(action2)) {
-    throw new Error(
-      `unknown code grant action "${action2 ?? ""}". Try "odla-ai code grant list --env dev".`
-    );
+    rejectWord(["code", "grant"], action2);
   }
   const decides = action2 === "approve" || action2 === "revoke";
   assertArgs(parsed, ["config", "env", "json", "token", "email", "open"], decides ? 4 : 3);
@@ -10436,9 +10580,7 @@ function repositoryUrl(cfg, suffix = "") {
 async function codeRepositoryCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[2];
   if (!isAction2(action2)) {
-    throw new Error(
-      `unknown code repository action "${action2 ?? ""}". Try "odla-ai code repository show --env dev".`
-    );
+    rejectWord(["code", "repository"], action2);
   }
   assertArgs(parsed, ["config", "env", "repo", "json", "token", "email", "open"], 3);
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
@@ -10513,9 +10655,7 @@ async function codeCommand(parsed, dependencies) {
     });
   }
   if (sub !== "connect") {
-    throw new Error(
-      `unknown code subcommand "${sub ?? ""}". Try "odla-ai code connect --env dev" or "odla-ai code grant list --env dev".`
-    );
+    rejectWord(["code"], sub);
   }
   assertArgs(parsed, [
     "config",
@@ -10554,13 +10694,13 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-import process17 from "process";
+import process16 from "process";
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(process17.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(process16.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -10652,9 +10792,7 @@ async function contextCommand(parsed, deps = {}) {
     return;
   }
   if (action2 !== "show") {
-    throw new Error(
-      `unknown context action "${action2 ?? ""}". Try show|list|save|remove.`
-    );
+    rejectWord(["context"], action2);
   }
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true,
@@ -10710,9 +10848,7 @@ async function responseError(response2) {
 }
 async function credentialCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[1] ?? "list";
-  if (action2 !== "list" && action2 !== "revoke") {
-    throw new Error(`unknown credentials action "${action2}". Try "odla-ai credentials list".`);
-  }
+  if (action2 !== "list" && action2 !== "revoke") rejectWord(["credentials"], action2);
   assertArgs(parsed, ["config", "env", "all", "json", "token", "email", "open"], action2 === "revoke" ? 3 : 2);
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
   const doFetch = deps.fetch ?? fetch;
@@ -11121,9 +11257,17 @@ Safety:
   grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
   the local cache, prints and opens a fresh exact-project owner-review URL, then
   continues provisioning with the approved replacement credential.
-  Before a non-dry-run provision, the executable checks npm's current CLI
-  release. A confirmed stale client stops with a safe npx rerun command; a
-  workspace-linked client also identifies the worktree that must be updated.
+  Every command says so on STDERR when this CLI is older than the one npm
+  serves, naming the repair for how this executable was launched \u2014 rebuild the
+  worktree, npm i the dependency, or npx the scoped package. The answer is read
+  from a cache under ~/.odla refreshed in the background at most every three
+  hours, so no invocation waits on the registry and stdout is never touched.
+  Set ODLA_CLI_UPDATE_CHECK=0 to switch it off.
+  Before a non-dry-run provision, the executable additionally checks npm LIVE
+  rather than trusting that cache: a security-sensitive grant shape must not
+  ride on a three-hour-old answer. A confirmed stale client stops with a safe
+  npx rerun command; a workspace-linked client also identifies the worktree
+  that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. With an
   enrolled code.session device, the Studio repository selection authorizes the
@@ -11714,7 +11858,7 @@ async function discussCommand(parsed, deps = {}) {
   assertArgs(parsed, ALLOWED, 3);
   const action2 = parsed.positionals[1];
   const id2 = parsed.positionals[2];
-  if (!action2) throw new Error('"discuss" needs an action. Run "odla-ai help".');
+  if (!acceptedAfter(["discuss"]).includes(action2 ?? "")) rejectWord(["discuss"], action2);
   const ctx = await buildContext(parsed, deps);
   switch (action2) {
     case "groups":
@@ -11738,7 +11882,7 @@ async function discussCommand(parsed, deps = {}) {
       return;
     }
     default:
-      throw new Error(`unknown discuss action "${action2}". Run "odla-ai help".`);
+      rejectWord(["discuss"], action2);
   }
 }
 
@@ -12458,7 +12602,7 @@ async function pmWatch(ctx, parsed) {
 }
 
 // src/pm-project-context.ts
-import { existsSync as existsSync12, rmSync as rmSync5 } from "fs";
+import { existsSync as existsSync11, rmSync as rmSync4 } from "fs";
 import { resolve as resolve12 } from "path";
 var pmProjectContextFile = () => pmContextFile();
 function readPmProjectContext(rootDir) {
@@ -12475,9 +12619,9 @@ function writePmProjectContext(rootDir, value2) {
 }
 function adoptLegacySelection(rootDir) {
   const legacy = resolve12(rootDir, ".odla", "pm-project.local.json");
-  if (!existsSync12(legacy)) return;
+  if (!existsSync11(legacy)) return;
   const previous = readJsonFile(legacy);
-  rmSync5(legacy, { force: true });
+  rmSync4(legacy, { force: true });
   if (!isSelection(previous)) return;
   const selections = readSelections();
   if (selections[previous.appId]) return;
@@ -12648,7 +12792,7 @@ async function pmCommand(parsed, deps = {}) {
       assertArgs(parsed, COMMON_OPTIONS, 4);
       return pmProjectUse(await buildContext2(parsed, deps), requireId2(parsed.positionals[3], action3));
     }
-    throw new Error(`unknown pm project action "${action3}". Try list|add|use.`);
+    rejectWord(["pm", "project"], action3);
   }
   if (word === "next") {
     assertArgs(parsed, [...COMMON_OPTIONS, "app", "project", "verbose"], 2);
@@ -12679,10 +12823,10 @@ async function pmCommand(parsed, deps = {}) {
     return pmHandoff(await buildContext2(parsed, deps), parsed);
   }
   const entity = ALIASES[word];
-  if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm start" to claim Ready work, or "odla-ai pm bug list" (goal|task|decision|bug).`);
+  if (!entity) rejectWord(["pm"], word);
   const requestedAction = parsed.positionals[2] ?? "list";
   const action2 = canonicalAction(requestedAction);
-  if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|link|ref|comment|comments|history|rm.`);
+  if (!action2) rejectWord(["pm", word], requestedAction);
   assertArgs(parsed, allowedOptions(entity, action2), 4);
   if ((action2 === "ready" || action2 === "claim" || action2 === "release") && entity !== "task") {
     throw new Error(`pm ${action2} is only valid for tasks`);
@@ -12768,12 +12912,7 @@ async function platformCommand(parsed, deps = {}) {
   if (action2 === "status") {
     return platformStatus(parsed, deps);
   }
-  throw new Error(
-    `unknown platform action "${[
-      action2,
-      parsed.positionals[2]
-    ].filter(Boolean).join(" ")}". Try "odla-ai platform status --json".`
-  );
+  rejectWord(["platform"], action2);
 }
 async function platformStatus(parsed, deps) {
   assertArgs(
@@ -13110,9 +13249,7 @@ async function o11yCommand(parsed, deps = {}) {
   );
   const action2 = parsed.positionals[1];
   if (action2 !== "status") {
-    throw new Error(
-      `unknown o11y action "${action2 ?? ""}". Try "odla-ai o11y status --json".`
-    );
+    rejectWord(["o11y"], action2);
   }
   const minutes = statusMinutes(
     numberOpt(parsed.options.minutes, "--minutes") ?? 60
@@ -13365,9 +13502,7 @@ var OPTIONS = [
 async function monitorCommand(parsed, deps = {}) {
   assertArgs(parsed, OPTIONS, 3);
   const action2 = parsed.positionals[1] ?? "status";
-  if (!["plan", "apply", "run", "status", "incidents", "report"].includes(action2)) {
-    throw new Error(`unknown monitor action "${action2}". Try "odla-ai monitor status --json".`);
-  }
+  if (!acceptedAfter(["monitor"]).includes(action2)) rejectWord(["monitor"], action2);
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: action2 !== "plan" && action2 !== "apply",
     requireApp: true
@@ -13516,7 +13651,7 @@ function percent(value2) {
 // src/provision.ts
 import { AppsError as AppsError2, createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor6 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
-import process18 from "process";
+import process17 from "process";
 
 // src/integration-provision.ts
 import { uuidv7 } from "@odla-ai/db";
@@ -13954,7 +14089,7 @@ async function provision(options) {
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process18.env[cfg.ai.keyEnv];
+      const key = process17.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret2({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -13996,190 +14131,9 @@ async function provision(options) {
 
 // src/record.ts
 import { appendFileSync } from "fs";
-import process19 from "process";
-
-// src/surface.ts
-var PM_ACTIONS = {
-  list: {},
-  add: {},
-  create: {},
-  get: {},
-  set: {},
-  update: {},
-  status: {},
-  move: {},
-  done: {},
-  comment: {},
-  comments: {},
-  ref: {},
-  rm: {},
-  delete: {}
-};
-var PM_TASK_ACTIONS = {
-  ...PM_ACTIONS,
-  ready: {},
-  claim: {},
-  release: {}
-};
-var PM_ENTITIES = {
-  ...Object.fromEntries(
-    ["goal", "conformance", "decision", "bug"].map((entity) => [entity, PM_ACTIONS])
-  ),
-  task: PM_TASK_ACTIONS,
-  kanban: PM_TASK_ACTIONS
-};
-var COMMAND_SURFACE = {
-  agent: { jobs: {}, retry: {} },
-  ai: { models: {} },
-  admin: {
-    ai: {
-      show: {},
-      set: {},
-      credentials: {},
-      models: {},
-      usage: {},
-      audit: {},
-      credential: { set: {} }
-    }
-  },
-  app: {
-    archive: {},
-    restore: {},
-    export: {},
-    import: {},
-    rename: {},
-    "refresh-sandbox": {},
-    "go-live": {},
-    promote: {},
-    owners: { list: {}, add: {}, remove: {} }
-  },
-  auth: { login: {} },
-  brand: { design: { unpack: {} } },
-  bug: { create: {}, list: {}, report: {} },
-  calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
-  capabilities: {},
-  code: {
-    connect: {},
-    grant: { request: {}, list: {}, approve: {}, revoke: {} },
-    repository: { show: {}, list: {}, bind: {} }
-  },
-  config: { diff: {}, plan: {}, apply: {} },
-  context: { show: {}, list: {}, save: {}, remove: {} },
-  credentials: { list: {}, revoke: {} },
-  device: { enroll: {}, list: {}, revoke: {} },
-  // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
-  discuss: {
-    groups: {},
-    list: {},
-    topics: {},
-    read: {},
-    post: {},
-    reply: {},
-    resolve: {},
-    who: {},
-    watch: {}
-  },
-  doctor: {},
-  help: {},
-  init: {},
-  monitor: { plan: {}, apply: {}, run: {}, status: {}, incidents: {}, report: {} },
-  o11y: { status: {} },
-  operations: { get: {}, wait: {} },
-  platform: {
-    status: {}
-  },
-  pm: {
-    ...PM_ENTITIES,
-    project: { list: {}, add: {}, create: {}, use: {} },
-    handoff: {},
-    next: {},
-    start: {},
-    watch: {}
-  },
-  provision: {},
-  runbook: {
-    ask: {},
-    search: {},
-    impact: {},
-    list: {},
-    get: {},
-    cat: {},
-    new: {},
-    edit: {},
-    comment: {},
-    import: {},
-    visibility: {},
-    publish: {},
-    archive: {},
-    history: {},
-    revert: {},
-    rm: {},
-    lint: {}
-  },
-  secrets: { push: {}, status: {}, set: {}, "set-clerk-key": {} },
-  security: {
-    plan: {},
-    sources: {},
-    run: {},
-    status: {},
-    report: {},
-    github: { connect: {}, disconnect: {} }
-  },
-  setup: {},
-  skill: { install: {} },
-  smoke: {},
-  version: {},
-  whoami: {}
-};
-function acceptedAfter(path) {
-  let node = COMMAND_SURFACE;
-  for (const word of path) {
-    node = node?.[word];
-    if (!node) return [];
-  }
-  return Object.keys(node).sort();
-}
-function validateInvocation(words2) {
-  let node = COMMAND_SURFACE;
-  const walked = [];
-  for (const word of words2) {
-    if (Object.keys(node).length === 0) return null;
-    const next = node[word];
-    if (!next) return { validPrefix: walked.join(" "), word, accepted: Object.keys(node).sort() };
-    walked.push(word);
-    node = next;
-  }
-  return null;
-}
-function describeProblem(problem) {
-  const where = problem.validPrefix ? `after "${problem.validPrefix}"` : "as a command";
-  return `"${problem.word}" is not accepted ${where} \u2014 try: ${problem.accepted.join(", ")}`;
-}
-function invocationPath(words2) {
-  let node = COMMAND_SURFACE;
-  const path = [];
-  for (const word of words2) {
-    const next = node[word];
-    if (!next) break;
-    path.push(word);
-    node = next;
-    if (Object.keys(node).length === 0) break;
-  }
-  return path;
-}
-function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
-  const paths2 = [];
-  for (const [word, child] of Object.entries(node)) {
-    const path = [...prefix, word];
-    paths2.push(path);
-    paths2.push(...surfacePaths(child, path));
-  }
-  return paths2;
-}
-
-// src/record.ts
+import process18 from "process";
 function recordInvocation(parsed) {
-  const file = process19.env.ODLA_CLI_RECORD;
+  const file = process18.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -14250,9 +14204,9 @@ function parseDeviceTtl(raw) {
 }
 
 // src/device-command.ts
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname11 } from "path";
-import process20 from "process";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname10 } from "path";
+import process19 from "process";
 async function deviceCommand(parsed, deps) {
   assertArgs(parsed, [
     "app",
@@ -14271,6 +14225,7 @@ async function deviceCommand(parsed, deps) {
     "wait"
   ], 3);
   const action2 = parsed.positionals[1] ?? "";
+  if (!acceptedAfter(["device"]).includes(action2)) rejectWord(["device"], action2);
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config));
@@ -14278,7 +14233,7 @@ async function deviceCommand(parsed, deps) {
   if (action2 === "enroll") return enroll(parsed, deps, cfg, doFetch, out, json);
   if (action2 === "list") return list2(parsed, deps, cfg, doFetch, out, json);
   if (action2 === "revoke") return revoke(parsed, deps, cfg, doFetch, out, json);
-  throw new Error('odla-ai device expects "enroll", "list", or "revoke"');
+  rejectWord(["device"], action2);
 }
 async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
@@ -14309,7 +14264,7 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
     body: JSON.stringify({
       name,
-      platform: process20.platform,
+      platform: process19.platform,
       appIds: apps,
       ...capabilities ? { capabilities } : {},
       ...scopes ? { scopes } : {},
@@ -14321,14 +14276,14 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     throw new Error(`device enroll failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
   }
   const path = deviceCredentialPath();
-  mkdirSync5(dirname11(path), { recursive: true });
+  mkdirSync4(dirname10(path), { recursive: true });
   writeFileSync4(path, JSON.stringify({
     token: body.token,
     platform: cfg.platformUrl.replace(/\/$/, ""),
     deviceId: body.device.deviceId,
     name
   }, null, 2));
-  chmodSync3(path, 384);
+  chmodSync2(path, 384);
   rememberMachineIdentity(cfg.platformUrl.replace(/\/$/, ""), stringOpt(parsed.options.email));
   supersedeAdvisory("credential.expiring");
   const reach = body.device.appIds.includes(ALL_OWNED_APPS) ? "every app you own, now and later" : body.device.appIds.join(", ");
@@ -14428,7 +14383,7 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
   });
 }
 function defaultDeviceName() {
-  return `${process20.env.HOSTNAME ?? process20.env.HOST ?? "machine"}-${process20.platform}`;
+  return `${process19.env.HOSTNAME ?? process19.env.HOST ?? "machine"}-${process19.platform}`;
 }
 
 // src/runbook-actions.ts
@@ -14572,7 +14527,7 @@ async function runbookRemove(ctx, slug) {
 
 // src/runbook-import.ts
 import { readFileSync as readFileSync11, readdirSync as readdirSync2, statSync } from "fs";
-import { basename as basename2, join as join15 } from "path";
+import { basename as basename2, join as join14 } from "path";
 function parseRunbook(text4, slug) {
   let rest = text4;
   const meta = {};
@@ -14602,7 +14557,7 @@ function readRunbookDir(dir) {
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = basename2(file, ".md");
-    const parsed = parseRunbook(readFileSync11(join15(dir, file), "utf8"), slug);
+    const parsed = parseRunbook(readFileSync11(join14(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -14670,8 +14625,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { join as join15 } from "path";
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -14840,8 +14795,8 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = join16(root, workspace, "package.json");
-    if (!existsSync13(manifest)) return void 0;
+    const manifest = join15(root, workspace, "package.json");
+    if (!existsSync12(manifest)) return void 0;
     try {
       const name = JSON.parse(readFileSync12(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
@@ -14910,7 +14865,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join16(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join15(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -15037,12 +14992,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join17 } from "path";
-import process21 from "process";
+import { join as join16 } from "path";
+import process20 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = process21.env) {
+function resolveEditor(env = process20.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -15056,8 +15011,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? process21.env;
-  const interactive = deps.interactive ?? (() => Boolean(process21.stdin.isTTY));
+  const env = deps.env ?? process20.env;
+  const interactive = deps.interactive ?? (() => Boolean(process20.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -15065,8 +15020,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = mkdtempSync(join17(tmpdir4(), "odla-runbook-"));
-  const file = join17(dir, `${slug}.md`);
+  const dir = mkdtempSync(join16(tmpdir4(), "odla-runbook-"));
+  const file = join16(dir, `${slug}.md`);
   try {
     writeFileSync5(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -15074,7 +15029,7 @@ function editText(initial, slug, deps = {}) {
     const edited = readFileSync13(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    rmSync6(dir, { recursive: true, force: true });
+    rmSync5(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -15176,6 +15131,7 @@ async function buildContext3(parsed, deps, action2) {
 async function runbookCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[1] ?? "list";
   assertArgs(parsed, ALLOWED2, action2 === "ask" || action2 === "search" ? 64 : 4);
+  if (!acceptedAfter(["runbook"]).includes(action2)) rejectWord(["runbook"], action2);
   const ctx = await buildContext3(parsed, deps, action2);
   const slug = parsed.positionals[2];
   switch (action2) {
@@ -15265,7 +15221,7 @@ async function runbookCommand(parsed, deps = {}) {
     case "rm":
       return runbookRemove(ctx, requireSlug(slug, "rm"));
     default:
-      throw new Error(`unknown runbook action "${action2}". Try ${acceptedAfter(["runbook"]).join(", ")}.`);
+      rejectWord(["runbook"], action2);
   }
 }
 
@@ -15886,9 +15842,7 @@ async function securityCommand(parsed, dependencies) {
     else printHostedReport(context.stdout, report5);
     return;
   }
-  if (sub !== "run") {
-    throw new Error('unknown security command. Try "odla-ai security plan", "security sources", or "security run".');
-  }
+  if (sub !== "run") rejectWord(["security"], sub);
   const sourceId = stringOpt(parsed.options.source);
   if (sourceId) await runSourceSecurityCommand(parsed, dependencies, sourceId);
   else await runLocalSecurityCommand(parsed, dependencies);
@@ -15905,9 +15859,7 @@ async function githubSecurityCommand(parsed, dependencies) {
       stringOpt(parsed.options.env)
     );
   }
-  if (action2 !== "connect") {
-    throw new Error('unknown security github command. Try "odla-ai security github connect".');
-  }
+  if (action2 !== "connect") rejectWord(["security", "github"], action2);
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
   await requireStudioHuman(
     stringOpt(parsed.options.config) ?? "odla.config.mjs",
@@ -15970,6 +15922,11 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     throw error;
   } finally {
     renderAdvisories(out, advisories);
+    try {
+      const behind = updateNotice();
+      if (behind) out.error(behind);
+    } catch {
+    }
   }
 }
 async function dispatchCli(argv, dependencies) {
@@ -16050,6 +16007,7 @@ async function dispatchCli(argv, dependencies) {
   }
   if (command === "bug") {
     const action2 = parsed.positionals[1] ?? "list";
+    if (!acceptedAfter(["bug"]).includes(action2)) rejectWord(["bug"], action2);
     const canonical2 = action2 === "report" || action2 === "create" ? "add" : action2;
     await pmCommand({
       ...parsed,
@@ -16078,7 +16036,7 @@ async function dispatchCli(argv, dependencies) {
     return;
   }
   if (await projectCommand(command, parsed, runtime)) return;
-  throw new Error(`unknown command "${command}". Run "odla-ai help".`);
+  rejectWord([], command);
 }
 async function provisionCommand(parsed, dependencies) {
   assertArgs(parsed, [
@@ -16122,7 +16080,7 @@ async function provisionCommand(parsed, dependencies) {
 async function calendarCommand(parsed, dependencies) {
   const sub = parsed.positionals[1];
   if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "disconnect") {
-    throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
+    rejectWord(["calendar"], sub);
   }
   assertArgs(parsed, ["config", "env", "json", "token", "email", "open", "yes"], 2);
   if (sub !== "status" && sub !== "calendars" && parsed.options.json !== void 0) throw new Error(`--json is supported only by calendar status/calendars`);
@@ -16149,6 +16107,12 @@ export {
   getScopedPlatformToken,
   SYSTEM_AI_PURPOSES,
   adminAi,
+  COMMAND_SURFACE,
+  acceptedAfter,
+  validateInvocation,
+  describeProblem,
+  invocationPath,
+  surfacePaths,
   calendarServiceConfig,
   calendarBookingPageUrl,
   GOOGLE_CALENDAR_EVENTS_SCOPE,
@@ -16186,12 +16150,6 @@ export {
   monitoringWireConfig,
   monitorCommand,
   provision,
-  COMMAND_SURFACE,
-  acceptedAfter,
-  validateInvocation,
-  describeProblem,
-  invocationPath,
-  surfacePaths,
   runHostedSecurity,
   getHostedSecurityIntent,
   getHostedSecurityPlan,
@@ -16203,4 +16161,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-T4OPSRME.js.map
+//# sourceMappingURL=chunk-JHB6352A.js.map