@odla-ai/cli 0.5.0 → 0.6.0

package/dist/index.d.cts

@@ -1,3 +1,5 @@
+import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
+
 /**
  * Parse CLI arguments and dispatch to the matching command — the entry point
  * `bin.ts` invokes. `argv` defaults to `process.argv.slice(2)`; the first
@@ -8,7 +10,10 @@
  * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print
  * and return; `init` scaffolds a project (requires `--app-id` and `--name`);
  * `doctor` validates config offline; `capabilities` prints the responsibility
- * boundary; `provision` runs the full provision (including optional secret
+ * boundary; `admin ai` reads/updates purpose-specific platform AI policies and
+ * write-only credentials through a short-lived exact-scope device grant;
+ * `security run` performs an explicitly acknowledged, app-attributed hosted
+ * reasoning pass; `provision` runs the full provision (including optional secret
  * rotation, local vars, and deployed secret push); `smoke` checks a live env;
  * `setup` and `skill install` install the bundled offline runbooks for Claude
  * Code, Codex, Cursor, Copilot, Gemini, and `AGENTS.md`-aware agents; and
@@ -21,13 +26,62 @@
  */
 declare function runCli(argv?: string[]): Promise<void>;
 
+/** Hosted platform purposes whose provider, model, and budgets an admin may route. */
+declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
+/** One catalog-validated, platform-funded System AI purpose. */
+type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
+/** Inputs for one System AI read, policy update, credential-status read, or
+ * write-only credential transfer. Provider values may come only from a named
+ * environment variable or stdin. */
+interface AdminAiOptions {
+    action: "show" | "set" | "credentials" | "credential-set";
+    purpose?: string;
+    provider?: string;
+    model?: string;
+    enabled?: boolean;
+    maxInputBytes?: number;
+    maxOutputTokens?: number;
+    maxCallsPerRun?: number;
+    platform?: string;
+    token?: string;
+    json?: boolean;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    credentialProvider?: string;
+    fromEnv?: string;
+    stdin?: boolean;
+    readStdin?: () => Promise<string>;
+    /** Separate short-lived admin-token cache; never reuses the app developer-token file. */
+    tokenFile?: string;
+}
+/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
+interface ScopedPlatformTokenOptions {
+    platform: string;
+    scope: "platform:ai:read" | "platform:ai:write" | "platform:security:self";
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    tokenFile?: string;
+}
+/** Obtain/cache one exact platform scope without granting ambient admin. */
+declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
+/** Read or update platform-funded AI routing. Authentication is a short-lived,
+ * explicitly scoped device grant; ordinary app developer tokens never become
+ * platform admins. Credential writes accept values only from a named env var
+ * or stdin, transfer them once, and never place them in argv, output, or the
+ * scoped-token cache. */
+declare function adminAi(options: AdminAiOptions): Promise<void>;
+
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI routes/credentials through short-lived exact-scope approval"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
-    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges"];
-    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable"];
+    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning"];
+    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage"];
 };
 type Output = Pick<typeof console, "log">;
 /** Print the stable responsibility boundary for humans or agent tooling. */
@@ -300,6 +354,61 @@ interface SecretsPushOptions {
  */
 declare function secretsPush(options: SecretsPushOptions): Promise<void>;
 
+/** Built-in security coverage profile selected for a hosted reasoning run. */
+type HostedSecurityProfile = "odla" | "cloudflare-app" | "generic";
+/** Exact attribution and authorization need supplied to a lazy token callback. */
+interface HostedSecurityTokenRequest {
+    platform: string;
+    appId: string;
+    env: string;
+    selfAudit: boolean;
+    /** Self-audit asks the caller for an explicitly scoped platform credential. */
+    /** Ordinary app runs use owner authority and therefore request no platform scope. */
+    scope: "platform:security:self" | null;
+}
+/** Local snapshot/orchestration controls for an app-attributed hosted security
+ * run. The platform supplies model routes and provider credentials. */
+interface RunHostedSecurityOptions {
+    /** Project config; loaded for customer-app runs and ignored for self-audit. */
+    configPath?: string;
+    /** Scan odla itself under the protected odla-ai/prod identity. */
+    selfAudit?: boolean;
+    /** Repository directory to snapshot. Defaults to the config root or cwd for self-audit. */
+    target?: string;
+    /** Private artifact directory. Defaults to `<target>/.odla/security/hosted`. */
+    out?: string;
+    /** Customer environment. Must be declared in config. Self-audit always uses prod. */
+    env?: string;
+    profile?: HostedSecurityProfile;
+    maxHuntTasks?: number;
+    /** Exact acknowledgement required before any source capture or network call. */
+    sourceDisclosureAck?: "redacted";
+    /** Optional client correlation id; the platform returns the authoritative run id. */
+    runId?: string;
+    /** Platform override. Customer runs otherwise use config.platformUrl. */
+    platform?: string;
+    /** Injected app credential; for self-audit this must be explicitly scoped by the caller. */
+    token?: string;
+    /** Lazy token acquisition. Receives the exact app/env and required scope. */
+    getToken?: (request: HostedSecurityTokenRequest) => string | Promise<string>;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+    stdout?: Pick<typeof console, "log" | "error">;
+}
+/** Completed local report, public platform run metadata, and private artifact path. */
+interface HostedSecurityResult {
+    report: SecurityReport;
+    run: Readonly<PlatformSecurityRun>;
+    output: string;
+}
+/**
+ * Run the hosted, redacted-source security harness for an odla app or odla's
+ * protected self-audit identity. Provider/model selection and provider secrets
+ * remain platform-owned; this function accepts only an app/scoped bearer and
+ * the opaque role grants remain inside @odla-ai/security's reasoner closures.
+ */
+declare function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult>;
+
 /** Agent harnesses with a first-class local adapter. */
 declare const AGENT_HARNESSES: readonly ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
 /** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */
@@ -379,4 +488,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, doctor, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, secretsPush, smoke };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type SystemAiPurpose, adminAi, doctor, getScopedPlatformToken, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, runHostedSecurity, secretsPush, smoke };

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
+
 /**
  * Parse CLI arguments and dispatch to the matching command — the entry point
  * `bin.ts` invokes. `argv` defaults to `process.argv.slice(2)`; the first
@@ -8,7 +10,10 @@
  * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print
  * and return; `init` scaffolds a project (requires `--app-id` and `--name`);
  * `doctor` validates config offline; `capabilities` prints the responsibility
- * boundary; `provision` runs the full provision (including optional secret
+ * boundary; `admin ai` reads/updates purpose-specific platform AI policies and
+ * write-only credentials through a short-lived exact-scope device grant;
+ * `security run` performs an explicitly acknowledged, app-attributed hosted
+ * reasoning pass; `provision` runs the full provision (including optional secret
  * rotation, local vars, and deployed secret push); `smoke` checks a live env;
  * `setup` and `skill install` install the bundled offline runbooks for Claude
  * Code, Codex, Cursor, Copilot, Gemini, and `AGENTS.md`-aware agents; and
@@ -21,13 +26,62 @@
  */
 declare function runCli(argv?: string[]): Promise<void>;
 
+/** Hosted platform purposes whose provider, model, and budgets an admin may route. */
+declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
+/** One catalog-validated, platform-funded System AI purpose. */
+type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
+/** Inputs for one System AI read, policy update, credential-status read, or
+ * write-only credential transfer. Provider values may come only from a named
+ * environment variable or stdin. */
+interface AdminAiOptions {
+    action: "show" | "set" | "credentials" | "credential-set";
+    purpose?: string;
+    provider?: string;
+    model?: string;
+    enabled?: boolean;
+    maxInputBytes?: number;
+    maxOutputTokens?: number;
+    maxCallsPerRun?: number;
+    platform?: string;
+    token?: string;
+    json?: boolean;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    credentialProvider?: string;
+    fromEnv?: string;
+    stdin?: boolean;
+    readStdin?: () => Promise<string>;
+    /** Separate short-lived admin-token cache; never reuses the app developer-token file. */
+    tokenFile?: string;
+}
+/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
+interface ScopedPlatformTokenOptions {
+    platform: string;
+    scope: "platform:ai:read" | "platform:ai:write" | "platform:security:self";
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    tokenFile?: string;
+}
+/** Obtain/cache one exact platform scope without granting ambient admin. */
+declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
+/** Read or update platform-funded AI routing. Authentication is a short-lived,
+ * explicitly scoped device grant; ordinary app developer tokens never become
+ * platform admins. Credential writes accept values only from a named env var
+ * or stdin, transfer them once, and never place them in argv, output, or the
+ * scoped-token cache. */
+declare function adminAi(options: AdminAiOptions): Promise<void>;
+
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI routes/credentials through short-lived exact-scope approval"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
-    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges"];
-    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable"];
+    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning"];
+    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage"];
 };
 type Output = Pick<typeof console, "log">;
 /** Print the stable responsibility boundary for humans or agent tooling. */
@@ -300,6 +354,61 @@ interface SecretsPushOptions {
  */
 declare function secretsPush(options: SecretsPushOptions): Promise<void>;
 
+/** Built-in security coverage profile selected for a hosted reasoning run. */
+type HostedSecurityProfile = "odla" | "cloudflare-app" | "generic";
+/** Exact attribution and authorization need supplied to a lazy token callback. */
+interface HostedSecurityTokenRequest {
+    platform: string;
+    appId: string;
+    env: string;
+    selfAudit: boolean;
+    /** Self-audit asks the caller for an explicitly scoped platform credential. */
+    /** Ordinary app runs use owner authority and therefore request no platform scope. */
+    scope: "platform:security:self" | null;
+}
+/** Local snapshot/orchestration controls for an app-attributed hosted security
+ * run. The platform supplies model routes and provider credentials. */
+interface RunHostedSecurityOptions {
+    /** Project config; loaded for customer-app runs and ignored for self-audit. */
+    configPath?: string;
+    /** Scan odla itself under the protected odla-ai/prod identity. */
+    selfAudit?: boolean;
+    /** Repository directory to snapshot. Defaults to the config root or cwd for self-audit. */
+    target?: string;
+    /** Private artifact directory. Defaults to `<target>/.odla/security/hosted`. */
+    out?: string;
+    /** Customer environment. Must be declared in config. Self-audit always uses prod. */
+    env?: string;
+    profile?: HostedSecurityProfile;
+    maxHuntTasks?: number;
+    /** Exact acknowledgement required before any source capture or network call. */
+    sourceDisclosureAck?: "redacted";
+    /** Optional client correlation id; the platform returns the authoritative run id. */
+    runId?: string;
+    /** Platform override. Customer runs otherwise use config.platformUrl. */
+    platform?: string;
+    /** Injected app credential; for self-audit this must be explicitly scoped by the caller. */
+    token?: string;
+    /** Lazy token acquisition. Receives the exact app/env and required scope. */
+    getToken?: (request: HostedSecurityTokenRequest) => string | Promise<string>;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+    stdout?: Pick<typeof console, "log" | "error">;
+}
+/** Completed local report, public platform run metadata, and private artifact path. */
+interface HostedSecurityResult {
+    report: SecurityReport;
+    run: Readonly<PlatformSecurityRun>;
+    output: string;
+}
+/**
+ * Run the hosted, redacted-source security harness for an odla app or odla's
+ * protected self-audit identity. Provider/model selection and provider secrets
+ * remain platform-owned; this function accepts only an app/scoped bearer and
+ * the opaque role grants remain inside @odla-ai/security's reasoner closures.
+ */
+declare function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult>;
+
 /** Agent harnesses with a first-class local adapter. */
 declare const AGENT_HARNESSES: readonly ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
 /** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */
@@ -379,4 +488,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, doctor, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, secretsPush, smoke };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type SystemAiPurpose, adminAi, doctor, getScopedPlatformToken, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, runHostedSecurity, secretsPush, smoke };

package/dist/index.js

@@ -2,26 +2,34 @@
 import {
   AGENT_HARNESSES,
   CAPABILITIES,
+  SYSTEM_AI_PURPOSES,
+  adminAi,
   doctor,
+  getScopedPlatformToken,
   initProject,
   installSkill,
   printCapabilities,
   provision,
   redactSecrets,
   runCli,
+  runHostedSecurity,
   secretsPush,
   smoke
-} from "./chunk-7WZIZCGA.js";
+} from "./chunk-OERLHVLH.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,
+  SYSTEM_AI_PURPOSES,
+  adminAi,
   doctor,
+  getScopedPlatformToken,
   initProject,
   installSkill,
   printCapabilities,
   provision,
   redactSecrets,
   runCli,
+  runHostedSecurity,
   secretsPush,
   smoke
 };

package/llms.txt

@@ -1,6 +1,6 @@
 # @odla-ai/cli — LLM context
 
-> Agent-operable CLI for provisioning odla apps, services, credentials, Worker secrets, and local runtime files.
+> Agent-operable CLI for odla provisioning, scoped System AI administration, hosted security runs, Worker secrets, and smoke checks.
 
 > ⚠️ **Early access — pre-1.0.** Agents work from bounded runbooks; humans
 > approve credentials, production changes, releases, and merges. APIs and exact
@@ -9,9 +9,11 @@
 
 Project-neutral provisioning CLI for odla apps. It creates and validates an
 `odla.config.mjs`, then uses that config to register an app, enable services,
-push odla-db schema/rules, configure platform AI, configure Clerk auth, record
+push odla-db schema/rules, configure per-app BYOK AI, configure Clerk auth, record
 deployment links, provision o11y ingest credentials, and transfer local or
-deployed Worker secrets without printing them.
+deployed Worker secrets without printing them. It also gives platform admins a
+scoped System AI control surface and gives app owners a provider-key-free
+hosted security command.
 
 It does not know about any specific app. App identity, environments, services,
 schema, rules, auth, AI provider, and links all come from config.
@@ -29,8 +31,8 @@ For a project you keep working in, install it as a dev dependency so the
 shorter `npx odla-ai` form works and the version is pinned by your lockfile:
 
 ```bash
-npm view @odla-ai/cli@0.5.0 version
-npm i -D --save-exact @odla-ai/cli@0.5.0
+npm view @odla-ai/cli@0.6.0 version
+npm i -D --save-exact @odla-ai/cli@0.6.0
 ```
 
 ## Prerequisites
@@ -59,6 +61,11 @@ npx odla-ai provision --dry-run
 npx odla-ai provision --write-dev-vars --push-secrets
 npx odla-ai smoke --env dev
 npx odla-ai secrets push --env dev
+npx odla-ai security run . --env dev --ack-redacted-source
+npx odla-ai admin ai show
+npx odla-ai admin ai set security.discovery --provider anthropic --model claude-opus-4-8 --enabled
+npx odla-ai admin ai credentials
+npx odla-ai admin ai credential set anthropic --from-env ANTHROPIC_API_KEY
 npx odla-ai skill install
 npx odla-ai version
 ```
@@ -119,17 +126,30 @@ when provisioning has not written `.odla/credentials.local.json`.
 
 The bundled build/migration skills add a passive pre-ship gate with
 `@odla-ai/security`: after the exact-version availability check, run
-`npm i -D --save-exact @odla-ai/security@0.1.0`, then
+`npm i -D --save-exact @odla-ai/security@0.2.0`, then
 `npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical`.
-This is a separate binary, not a hidden `odla-ai` subcommand; it makes no model
-calls and does not execute target code.
+The passive scan remains a separate binary: it makes no model calls and does
+not execute target code. After explicit redacted-source approval,
+`odla-ai security run . --env dev --ack-redacted-source` adds hosted discovery
+and independent validation. The CLI obtains/reuses app-owner auth and the
+platform supplies bounded role grants; it never requests provider keys.
+Early-access run ceilings are rolling; a `429` includes the platform's safe
+retry hint, which the CLI surfaces without echoing arbitrary response text.
 Before installing the exact release, require
-`npm view @odla-ai/security@0.1.0 version` to succeed before installation. An
+`npm view @odla-ai/security@0.2.0 version` to succeed before installation. An
 exact-version `E404` means the release is unavailable, not that the security
 preflight passed, and does not prove the package name is absent. odla's own
 engineering environment uses an equivalent internal gate; customer projects
 should use the published `odla-security` command above.
 
+`admin ai show|set|credentials|credential set` manages platform-funded System
+AI (`o11y.triage`, `security.discovery`, `security.validation`). It uses a
+separate, mode-`0600` `.odla/admin-token.local.json` cache. Studio displays the
+exact scope, only an admin can approve it, and it expires after ~15 minutes;
+the token never becomes ambient admin. Credential writes accept only
+`--from-env <NAME>` or `--stdin` and never place the value in argv, output, or
+the cache. System AI and each app's BYOK AI are separate vault/funding paths.
+
 `secrets push --env <env>` is the narrower recovery/retry command. It moves the
 configured env's odla-db key and/or o11y ingest token from
 `.odla/credentials.local.json` into the deployed Worker by piping each value
@@ -151,7 +171,8 @@ agent owns application semantics: installing `@odla-ai/o11y`, wrapping the
 Worker with `withObservability`, and choosing useful spans, metrics, errors, and
 LLM-usage records. The human owns the device approval, production consent, and
 explicit destructive rotation. Studio is where people view telemetry and
-perform manual recovery; its token control is not the normal setup path.
+perform manual recovery, configure System AI, and inspect app/run-attributed
+platform usage; its o11y token control is not the normal setup path.
 Run `npx odla-ai capabilities` for the human-readable contract or add `--json`
 when an agent or tool needs to branch on it without scraping prose.
 
@@ -230,9 +251,11 @@ If schema is present and rules are omitted, `defaultRules: "deny"` generates
 deny-all rules for every schema entity. That is the safe default for Workers
 that mediate reads and writes with an app key.
 
-## API reference (generated from dist/index.d.ts, v0.5.0)
+## API reference (generated from dist/index.d.ts, v0.6.0)
 
 ```ts
+import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
+
 /**
  * Parse CLI arguments and dispatch to the matching command — the entry point
  * `bin.ts` invokes. `argv` defaults to `process.argv.slice(2)`; the first
@@ -243,7 +266,10 @@ that mediate reads and writes with an app key.
  * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print
  * and return; `init` scaffolds a project (requires `--app-id` and `--name`);
  * `doctor` validates config offline; `capabilities` prints the responsibility
- * boundary; `provision` runs the full provision (including optional secret
+ * boundary; `admin ai` reads/updates purpose-specific platform AI policies and
+ * write-only credentials through a short-lived exact-scope device grant;
+ * `security run` performs an explicitly acknowledged, app-attributed hosted
+ * reasoning pass; `provision` runs the full provision (including optional secret
  * rotation, local vars, and deployed secret push); `smoke` checks a live env;
  * `setup` and `skill install` install the bundled offline runbooks for Claude
  * Code, Codex, Cursor, Copilot, Gemini, and `AGENTS.md`-aware agents; and
@@ -256,13 +282,62 @@ that mediate reads and writes with an app key.
  */
 declare function runCli(argv?: string[]): Promise<void>;
 
+/** Hosted platform purposes whose provider, model, and budgets an admin may route. */
+declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
+/** One catalog-validated, platform-funded System AI purpose. */
+type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
+/** Inputs for one System AI read, policy update, credential-status read, or
+ * write-only credential transfer. Provider values may come only from a named
+ * environment variable or stdin. */
+interface AdminAiOptions {
+    action: "show" | "set" | "credentials" | "credential-set";
+    purpose?: string;
+    provider?: string;
+    model?: string;
+    enabled?: boolean;
+    maxInputBytes?: number;
+    maxOutputTokens?: number;
+    maxCallsPerRun?: number;
+    platform?: string;
+    token?: string;
+    json?: boolean;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    credentialProvider?: string;
+    fromEnv?: string;
+    stdin?: boolean;
+    readStdin?: () => Promise<string>;
+    /** Separate short-lived admin-token cache; never reuses the app developer-token file. */
+    tokenFile?: string;
+}
+/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
+interface ScopedPlatformTokenOptions {
+    platform: string;
+    scope: "platform:ai:read" | "platform:ai:write" | "platform:security:self";
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    tokenFile?: string;
+}
+/** Obtain/cache one exact platform scope without granting ambient admin. */
+declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
+/** Read or update platform-funded AI routing. Authentication is a short-lived,
+ * explicitly scoped device grant; ordinary app developer tokens never become
+ * platform admins. Credential writes accept values only from a named env var
+ * or stdin, transfer them once, and never place them in argv, output, or the
+ * scoped-token cache. */
+declare function adminAi(options: AdminAiOptions): Promise<void>;
+
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI routes/credentials through short-lived exact-scope approval"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
-    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges"];
-    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable"];
+    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning"];
+    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage"];
 };
 type Output = Pick<typeof console, "log">;
 /** Print the stable responsibility boundary for humans or agent tooling. */
@@ -535,6 +610,61 @@ interface SecretsPushOptions {
  */
 declare function secretsPush(options: SecretsPushOptions): Promise<void>;
 
+/** Built-in security coverage profile selected for a hosted reasoning run. */
+type HostedSecurityProfile = "odla" | "cloudflare-app" | "generic";
+/** Exact attribution and authorization need supplied to a lazy token callback. */
+interface HostedSecurityTokenRequest {
+    platform: string;
+    appId: string;
+    env: string;
+    selfAudit: boolean;
+    /** Self-audit asks the caller for an explicitly scoped platform credential. */
+    /** Ordinary app runs use owner authority and therefore request no platform scope. */
+    scope: "platform:security:self" | null;
+}
+/** Local snapshot/orchestration controls for an app-attributed hosted security
+ * run. The platform supplies model routes and provider credentials. */
+interface RunHostedSecurityOptions {
+    /** Project config; loaded for customer-app runs and ignored for self-audit. */
+    configPath?: string;
+    /** Scan odla itself under the protected odla-ai/prod identity. */
+    selfAudit?: boolean;
+    /** Repository directory to snapshot. Defaults to the config root or cwd for self-audit. */
+    target?: string;
+    /** Private artifact directory. Defaults to `<target>/.odla/security/hosted`. */
+    out?: string;
+    /** Customer environment. Must be declared in config. Self-audit always uses prod. */
+    env?: string;
+    profile?: HostedSecurityProfile;
+    maxHuntTasks?: number;
+    /** Exact acknowledgement required before any source capture or network call. */
+    sourceDisclosureAck?: "redacted";
+    /** Optional client correlation id; the platform returns the authoritative run id. */
+    runId?: string;
+    /** Platform override. Customer runs otherwise use config.platformUrl. */
+    platform?: string;
+    /** Injected app credential; for self-audit this must be explicitly scoped by the caller. */
+    token?: string;
+    /** Lazy token acquisition. Receives the exact app/env and required scope. */
+    getToken?: (request: HostedSecurityTokenRequest) => string | Promise<string>;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+    stdout?: Pick<typeof console, "log" | "error">;
+}
+/** Completed local report, public platform run metadata, and private artifact path. */
+interface HostedSecurityResult {
+    report: SecurityReport;
+    run: Readonly<PlatformSecurityRun>;
+    output: string;
+}
+/**
+ * Run the hosted, redacted-source security harness for an odla app or odla's
+ * protected self-audit identity. Provider/model selection and provider secrets
+ * remain platform-owned; this function accepts only an app/scoped bearer and
+ * the opaque role grants remain inside @odla-ai/security's reasoner closures.
+ */
+declare function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult>;
+
 /** Agent harnesses with a first-class local adapter. */
 declare const AGENT_HARNESSES: readonly ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
 /** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */
@@ -614,5 +744,5 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, doctor, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, secretsPush, smoke };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type SystemAiPurpose, adminAi, doctor, getScopedPlatformToken, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, runHostedSecurity, secretsPush, smoke };
 ```

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.5.0",
-  "description": "Agent-operable CLI for provisioning odla apps, services, credentials, Worker secrets, and local runtime files.",
+  "version": "0.6.0",
+  "description": "Agent-operable CLI for odla provisioning, scoped System AI administration, hosted security runs, Worker secrets, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",
   "repository": {
@@ -59,9 +59,10 @@
     "prepublishOnly": "npm run build && npm run gen:llms"
   },
   "dependencies": {
-    "@odla-ai/ai": "^0.3.0",
+    "@odla-ai/ai": "^0.3.1",
     "@odla-ai/apps": "^0.7.1",
-    "@odla-ai/db": "^0.6.0"
+    "@odla-ai/db": "^0.6.1",
+    "@odla-ai/security": "^0.2.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",

package/skills/odla/SKILL.md

@@ -69,8 +69,12 @@ guessing which platform/credential steps need manual work. Then:
    ingest token when enabled), pushes schema + rules, writes `.dev.vars`, and
    transfers Worker secrets through Wrangler stdin.
 4. **run** — `npx wrangler dev` (auto-loads `.dev.vars`); verify locally.
-5. **security** — run the passive `@odla-ai/security` odla profile;
-   inspect every lead and keep critical candidate gating enabled.
+5. **security** — run the passive `@odla-ai/security` odla profile; inspect
+   every lead and keep critical candidate gating enabled. If the human approves
+   redacted source disclosure, follow with
+   `npx @odla-ai/cli security run . --env dev --ack-redacted-source` for
+   app-attributed discovery + independent validation. Never request provider
+   keys; the platform selects the routes and returns bounded role grants.
 6. **ship** ⏸ — after adding `prod`, run `npx @odla-ai/cli provision --dry-run`,
    show the human, then `npx @odla-ai/cli provision --yes --push-secrets` and
    `npx wrangler deploy`.